bsd/netinet6/udp6_output.c

   1 /*
   2  * Copyright (c) 2000-2019 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28
  29
  30 /*      $FreeBSD: src/sys/netinet6/udp6_output.c,v 1.1.2.3 2001/08/31 13:49:58 jlemon Exp $     */
  31 /*      $KAME: udp6_output.c,v 1.31 2001/05/21 16:39:15 jinmei Exp $    */
  32
  33 /*
  34  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  35  * All rights reserved.
  36  *
  37  * Redistribution and use in source and binary forms, with or without
  38  * modification, are permitted provided that the following conditions
  39  * are met:
  40  * 1. Redistributions of source code must retain the above copyright
  41  *    notice, this list of conditions and the following disclaimer.
  42  * 2. Redistributions in binary form must reproduce the above copyright
  43  *    notice, this list of conditions and the following disclaimer in the
  44  *    documentation and/or other materials provided with the distribution.
  45  * 3. Neither the name of the project nor the names of its contributors
  46  *    may be used to endorse or promote products derived from this software
  47  *    without specific prior written permission.
  48  *
  49  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  59  * SUCH DAMAGE.
  60  */
  61
  62 /*
  63  * Copyright (c) 1982, 1986, 1989, 1993
  64  *      The Regents of the University of California.  All rights reserved.
  65  *
  66  * Redistribution and use in source and binary forms, with or without
  67  * modification, are permitted provided that the following conditions
  68  * are met:
  69  * 1. Redistributions of source code must retain the above copyright
  70  *    notice, this list of conditions and the following disclaimer.
  71  * 2. Redistributions in binary form must reproduce the above copyright
  72  *    notice, this list of conditions and the following disclaimer in the
  73  *    documentation and/or other materials provided with the distribution.
  74  * 3. All advertising materials mentioning features or use of this software
  75  *    must display the following acknowledgement:
  76  *      This product includes software developed by the University of
  77  *      California, Berkeley and its contributors.
  78  * 4. Neither the name of the University nor the names of its contributors
  79  *    may be used to endorse or promote products derived from this software
  80  *    without specific prior written permission.
  81  *
  82  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  83  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  84  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  85  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  86  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  87  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  88  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  89  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  90  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  91  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  92  * SUCH DAMAGE.
  93  *
  94  *      @(#)udp_var.h   8.1 (Berkeley) 6/10/93
  95  */
  96
  97 #include <sys/param.h>
  98 #include <sys/malloc.h>
  99 #include <sys/mbuf.h>
 100 #include <sys/protosw.h>
 101 #include <sys/socket.h>
 102 #include <sys/socketvar.h>
 103 #include <sys/sysctl.h>
 104 #include <sys/errno.h>
 105 #include <sys/stat.h>
 106 #include <sys/systm.h>
 107 #include <sys/proc.h>
 108 #include <sys/syslog.h>
 109
 110 #include <machine/endian.h>
 111
 112 #include <net/if.h>
 113 #include <net/route.h>
 114 #include <net/if_types.h>
 115 #include <net/ntstat.h>
 116
 117 #include <netinet/in.h>
 118 #include <netinet/in_var.h>
 119 #include <netinet/in_systm.h>
 120 #include <netinet/in_tclass.h>
 121 #include <netinet/ip.h>
 122 #include <netinet/ip_var.h>
 123 #include <netinet/in_pcb.h>
 124 #include <netinet/udp.h>
 125 #include <netinet/udp_var.h>
 126 #include <netinet/ip6.h>
 127 #include <netinet6/ip6_var.h>
 128 #include <netinet6/in6_pcb.h>
 129 #include <netinet6/udp6_var.h>
 130 #include <netinet/icmp6.h>
 131 #include <netinet6/ip6protosw.h>
 132
 133 #if NECP
 134 #include <net/necp.h>
 135 #endif /* NECP */
 136
 137 #include <net/net_osdep.h>
 138
 139 #if CONTENT_FILTER
 140 #include <net/content_filter.h>
 141 #endif /* CONTENT_FILTER */
 142
 143 /*
 144  * UDP protocol inplementation.
 145  * Per RFC 768, August, 1980.
 146  */
 147 extern int soreserveheadroom;
 148
 149 int
 150 udp6_output(struct in6pcb *in6p, struct mbuf *m, struct sockaddr *addr6,
 151     struct mbuf *control, struct proc *p)
 152 {
 153         u_int32_t ulen = m->m_pkthdr.len;
 154         u_int32_t plen = sizeof(struct udphdr) + ulen;
 155         struct ip6_hdr *ip6;
 156         struct udphdr *udp6;
 157         struct in6_addr *laddr, *faddr;
 158         u_short fport;
 159         int error = 0;
 160         struct ip6_pktopts opt, *optp = NULL;
 161         struct ip6_moptions *im6o;
 162         int af = AF_INET6, hlen = sizeof(struct ip6_hdr);
 163         int flags;
 164         struct sockaddr_in6 tmp;
 165         struct  in6_addr storage;
 166         int sotc = SO_TC_UNSPEC;
 167         int netsvctype = _NET_SERVICE_TYPE_UNSPEC;
 168         struct ip6_out_args ip6oa;
 169         struct flowadv *adv = &ip6oa.ip6oa_flowadv;
 170         struct socket *so = in6p->in6p_socket;
 171         struct route_in6 ro;
 172         int flowadv = 0;
 173         bool sndinprog_cnt_used = false;
 174 #if CONTENT_FILTER
 175         struct m_tag *cfil_tag = NULL;
 176         bool cfil_faddr_use = false;
 177         uint32_t cfil_so_state_change_cnt = 0;
 178         struct sockaddr *cfil_faddr = NULL;
 179         struct sockaddr_in6 *cfil_sin6 = NULL;
 180 #endif
 181         bool check_qos_marking_again = (so->so_flags1 & SOF1_QOSMARKING_POLICY_OVERRIDE) ? FALSE : TRUE;
 182
 183         bzero(&ip6oa, sizeof(ip6oa));
 184         ip6oa.ip6oa_boundif = IFSCOPE_NONE;
 185         ip6oa.ip6oa_flags = IP6OAF_SELECT_SRCIF;
 186
 187         /* Enable flow advisory only when connected */
 188         flowadv = (so->so_state & SS_ISCONNECTED) ? 1 : 0;
 189
 190         if (flowadv && INP_WAIT_FOR_IF_FEEDBACK(in6p)) {
 191                 error = ENOBUFS;
 192                 goto release;
 193         }
 194
 195         if (in6p->inp_flags & INP_BOUND_IF) {
 196                 ip6oa.ip6oa_boundif = in6p->inp_boundifp->if_index;
 197                 ip6oa.ip6oa_flags |= IP6OAF_BOUND_IF;
 198         }
 199         if (INP_NO_CELLULAR(in6p)) {
 200                 ip6oa.ip6oa_flags |= IP6OAF_NO_CELLULAR;
 201         }
 202         if (INP_NO_EXPENSIVE(in6p)) {
 203                 ip6oa.ip6oa_flags |= IP6OAF_NO_EXPENSIVE;
 204         }
 205         if (INP_NO_CONSTRAINED(in6p)) {
 206                 ip6oa.ip6oa_flags |= IP6OAF_NO_CONSTRAINED;
 207         }
 208         if (INP_AWDL_UNRESTRICTED(in6p)) {
 209                 ip6oa.ip6oa_flags |= IP6OAF_AWDL_UNRESTRICTED;
 210         }
 211         if (INP_INTCOPROC_ALLOWED(in6p)) {
 212                 ip6oa.ip6oa_flags |= IP6OAF_INTCOPROC_ALLOWED;
 213         }
 214
 215 #if CONTENT_FILTER
 216         /*
 217          * If socket is subject to UDP Content Filter and no addr is passed in,
 218          * retrieve CFIL saved state from mbuf and use it if necessary.
 219          */
 220         if (so->so_cfil_db && !addr6) {
 221                 cfil_tag = cfil_dgram_get_socket_state(m, &cfil_so_state_change_cnt, NULL, &cfil_faddr, NULL);
 222                 if (cfil_tag) {
 223                         cfil_sin6 = (struct sockaddr_in6 *)(void *)cfil_faddr;
 224                         if ((so->so_state_change_cnt != cfil_so_state_change_cnt) &&
 225                             (in6p->in6p_fport != cfil_sin6->sin6_port ||
 226                             !IN6_ARE_ADDR_EQUAL(&in6p->in6p_faddr, &cfil_sin6->sin6_addr))) {
 227                                 /*
 228                                  * Socket is connected but socket state and dest addr/port changed.
 229                                  * We need to use the saved faddr info.
 230                                  */
 231                                 cfil_faddr_use = true;
 232                         }
 233                 }
 234         }
 235 #endif
 236
 237         if (control) {
 238                 sotc = so_tc_from_control(control, &netsvctype);
 239                 if ((error = ip6_setpktopts(control, &opt,
 240                     NULL, IPPROTO_UDP)) != 0) {
 241                         goto release;
 242                 }
 243                 optp = &opt;
 244         } else {
 245                 optp = in6p->in6p_outputopts;
 246         }
 247
 248         if (sotc == SO_TC_UNSPEC) {
 249                 sotc = so->so_traffic_class;
 250                 netsvctype = so->so_netsvctype;
 251         }
 252         ip6oa.ip6oa_sotc = sotc;
 253         ip6oa.ip6oa_netsvctype = netsvctype;
 254
 255         in6p->inp_sndinprog_cnt++;
 256         sndinprog_cnt_used = true;
 257
 258         if (addr6) {
 259                 /*
 260                  * IPv4 version of udp_output calls in_pcbconnect in this case,
 261                  * which has its costs.
 262                  *
 263                  * Since we saw no essential reason for calling in_pcbconnect,
 264                  * we get rid of such kind of logic, and call in6_selectsrc
 265                  * and in6_pcbsetport in order to fill in the local address
 266                  * and the local port.
 267                  */
 268                 struct sockaddr_in6 *sin6 =
 269                     (struct sockaddr_in6 *)(void *)addr6;
 270
 271                 if (sin6->sin6_port == 0) {
 272                         error = EADDRNOTAVAIL;
 273                         goto release;
 274                 }
 275
 276                 if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr)) {
 277                         /* how about ::ffff:0.0.0.0 case? */
 278                         error = EISCONN;
 279                         goto release;
 280                 }
 281
 282                 /* protect *sin6 from overwrites */
 283                 tmp = *sin6;
 284                 sin6 = &tmp;
 285
 286                 faddr = &sin6->sin6_addr;
 287                 fport = sin6->sin6_port; /* allow 0 port */
 288
 289                 if (IN6_IS_ADDR_V4MAPPED(faddr)) {
 290                         if ((in6p->in6p_flags & IN6P_IPV6_V6ONLY)) {
 291                                 /*
 292                                  * I believe we should explicitly discard the
 293                                  * packet when mapped addresses are disabled,
 294                                  * rather than send the packet as an IPv6 one.
 295                                  * If we chose the latter approach, the packet
 296                                  * might be sent out on the wire based on the
 297                                  * default route, the situation which we'd
 298                                  * probably want to avoid.
 299                                  * (20010421 jinmei@kame.net)
 300                                  */
 301                                 error = EINVAL;
 302                                 goto release;
 303                         } else {
 304                                 af = AF_INET;
 305                         }
 306                 }
 307
 308                 /* KAME hack: embed scopeid */
 309                 if (in6_embedscope(&sin6->sin6_addr, sin6, in6p, NULL,
 310                     optp) != 0) {
 311                         error = EINVAL;
 312                         goto release;
 313                 }
 314
 315                 if (!IN6_IS_ADDR_V4MAPPED(faddr)) {
 316                         laddr = in6_selectsrc(sin6, optp,
 317                             in6p, &in6p->in6p_route, NULL, &storage,
 318                             ip6oa.ip6oa_boundif, &error);
 319                 } else {
 320                         laddr = &in6p->in6p_laddr;      /* XXX */
 321                 }
 322                 if (laddr == NULL) {
 323                         if (error == 0) {
 324                                 error = EADDRNOTAVAIL;
 325                         }
 326                         goto release;
 327                 }
 328                 if (in6p->in6p_lport == 0 &&
 329                     (error = in6_pcbsetport(laddr, in6p, p, 0)) != 0) {
 330                         goto release;
 331                 }
 332         } else {
 333                 if (IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr)) {
 334                         error = ENOTCONN;
 335                         goto release;
 336                 }
 337                 laddr = &in6p->in6p_laddr;
 338                 faddr = &in6p->in6p_faddr;
 339                 fport = in6p->in6p_fport;
 340 #if CONTENT_FILTER
 341                 if (cfil_faddr_use) {
 342                         faddr = &((struct sockaddr_in6 *)(void *)cfil_faddr)->sin6_addr;
 343                         fport = ((struct sockaddr_in6 *)(void *)cfil_faddr)->sin6_port;
 344
 345                         /* Do not use cached route */
 346                         ROUTE_RELEASE(&in6p->in6p_route);
 347                 }
 348 #endif
 349                 if (IN6_IS_ADDR_V4MAPPED(faddr)) {
 350                         if ((in6p->in6p_flags & IN6P_IPV6_V6ONLY)) {
 351                                 /*
 352                                  * XXX: this case would happen when the
 353                                  * application sets the V6ONLY flag after
 354                                  * connecting the foreign address.
 355                                  * Such applications should be fixed,
 356                                  * so we bark here.
 357                                  */
 358                                 log(LOG_INFO, "udp6_output: IPV6_V6ONLY "
 359                                     "option was set for a connected socket\n");
 360                                 error = EINVAL;
 361                                 goto release;
 362                         } else {
 363                                 af = AF_INET;
 364                         }
 365                 }
 366         }
 367
 368         if (in6p->inp_flowhash == 0) {
 369                 in6p->inp_flowhash = inp_calc_flowhash(in6p);
 370         }
 371         /* update flowinfo - RFC 6437 */
 372         if (in6p->inp_flow == 0 && in6p->in6p_flags & IN6P_AUTOFLOWLABEL) {
 373                 in6p->inp_flow &= ~IPV6_FLOWLABEL_MASK;
 374                 in6p->inp_flow |=
 375                     (htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK);
 376         }
 377
 378         if (af == AF_INET) {
 379                 hlen = sizeof(struct ip);
 380         }
 381
 382         if (fport == htons(53) && !(so->so_flags1 & SOF1_DNS_COUNTED)) {
 383                 so->so_flags1 |= SOF1_DNS_COUNTED;
 384                 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_dns);
 385         }
 386
 387         /*
 388          * Calculate data length and get a mbuf
 389          * for UDP and IP6 headers.
 390          */
 391         M_PREPEND(m, hlen + sizeof(struct udphdr), M_DONTWAIT, 1);
 392         if (m == 0) {
 393                 error = ENOBUFS;
 394                 goto release;
 395         }
 396
 397         /*
 398          * Stuff checksum and output datagram.
 399          */
 400         udp6 = (struct udphdr *)(void *)(mtod(m, caddr_t) + hlen);
 401         udp6->uh_sport = in6p->in6p_lport; /* lport is always set in the PCB */
 402         udp6->uh_dport = fport;
 403         if (plen <= 0xffff) {
 404                 udp6->uh_ulen = htons((u_short)plen);
 405         } else {
 406                 udp6->uh_ulen = 0;
 407         }
 408         udp6->uh_sum = 0;
 409
 410         switch (af) {
 411         case AF_INET6:
 412                 ip6 = mtod(m, struct ip6_hdr *);
 413                 ip6->ip6_flow   = in6p->inp_flow & IPV6_FLOWINFO_MASK;
 414                 ip6->ip6_vfc    &= ~IPV6_VERSION_MASK;
 415                 ip6->ip6_vfc    |= IPV6_VERSION;
 416 #if 0           /* ip6_plen will be filled in ip6_output. */
 417                 ip6->ip6_plen   = htons((u_short)plen);
 418 #endif
 419                 ip6->ip6_nxt    = IPPROTO_UDP;
 420                 ip6->ip6_hlim   = in6_selecthlim(in6p, in6p->in6p_route.ro_rt ?
 421                     in6p->in6p_route.ro_rt->rt_ifp : NULL);
 422                 ip6->ip6_src    = *laddr;
 423                 ip6->ip6_dst    = *faddr;
 424
 425                 udp6->uh_sum = in6_pseudo(laddr, faddr,
 426                     htonl(plen + IPPROTO_UDP));
 427                 m->m_pkthdr.csum_flags = (CSUM_UDPIPV6 | CSUM_ZERO_INVERT);
 428                 m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
 429
 430                 if (!IN6_IS_ADDR_UNSPECIFIED(laddr)) {
 431                         ip6oa.ip6oa_flags |= IP6OAF_BOUND_SRCADDR;
 432                 }
 433
 434                 flags = IPV6_OUTARGS;
 435
 436                 udp6stat.udp6s_opackets++;
 437
 438 #if NECP
 439                 {
 440                         necp_kernel_policy_id policy_id;
 441                         necp_kernel_policy_id skip_policy_id;
 442                         u_int32_t route_rule_id;
 443                         u_int32_t pass_flags;
 444
 445                         /*
 446                          * We need a route to perform NECP route rule checks
 447                          */
 448                         if (net_qos_policy_restricted != 0 &&
 449                             ROUTE_UNUSABLE(&in6p->inp_route)) {
 450                                 struct sockaddr_in6 to;
 451                                 struct sockaddr_in6 from;
 452
 453                                 ROUTE_RELEASE(&in6p->inp_route);
 454
 455                                 bzero(&from, sizeof(struct sockaddr_in6));
 456                                 from.sin6_family = AF_INET6;
 457                                 from.sin6_len = sizeof(struct sockaddr_in6);
 458                                 from.sin6_addr = *laddr;
 459
 460                                 bzero(&to, sizeof(struct sockaddr_in6));
 461                                 to.sin6_family = AF_INET6;
 462                                 to.sin6_len = sizeof(struct sockaddr_in6);
 463                                 to.sin6_addr = *faddr;
 464
 465                                 in6p->inp_route.ro_dst.sa_family = AF_INET6;
 466                                 in6p->inp_route.ro_dst.sa_len = sizeof(struct sockaddr_in6);
 467                                 ((struct sockaddr_in6 *)(void *)&in6p->inp_route.ro_dst)->sin6_addr =
 468                                     *faddr;
 469
 470                                 rtalloc_scoped(&in6p->inp_route, ip6oa.ip6oa_boundif);
 471
 472                                 inp_update_necp_policy(in6p, (struct sockaddr *)&from,
 473                                     (struct sockaddr *)&to, ip6oa.ip6oa_boundif);
 474                                 in6p->inp_policyresult.results.qos_marking_gencount = 0;
 475                         }
 476
 477                         if (!necp_socket_is_allowed_to_send_recv_v6(in6p, in6p->in6p_lport, fport, laddr, faddr, NULL, 0, &policy_id, &route_rule_id, &skip_policy_id, &pass_flags)) {
 478                                 error = EHOSTUNREACH;
 479                                 goto release;
 480                         }
 481
 482                         necp_mark_packet_from_socket(m, in6p, policy_id, route_rule_id, skip_policy_id, pass_flags);
 483
 484                         if (net_qos_policy_restricted != 0) {
 485                                 necp_socket_update_qos_marking(in6p, in6p->in6p_route.ro_rt, route_rule_id);
 486                         }
 487                 }
 488 #endif /* NECP */
 489                 if ((so->so_flags1 & SOF1_QOSMARKING_ALLOWED)) {
 490                         ip6oa.ip6oa_flags |= IP6OAF_QOSMARKING_ALLOWED;
 491                 }
 492                 if (check_qos_marking_again) {
 493                         ip6oa.ip6oa_flags |= IP6OAF_REDO_QOSMARKING_POLICY;
 494                 }
 495                 ip6oa.qos_marking_gencount = in6p->inp_policyresult.results.qos_marking_gencount;
 496
 497 #if IPSEC
 498                 if (in6p->in6p_sp != NULL && ipsec_setsocket(m, so) != 0) {
 499                         error = ENOBUFS;
 500                         goto release;
 501                 }
 502 #endif /*IPSEC*/
 503
 504                 /* In case of IPv4-mapped address used in previous send */
 505                 if (ROUTE_UNUSABLE(&in6p->in6p_route) ||
 506                     rt_key(in6p->in6p_route.ro_rt)->sa_family != AF_INET6) {
 507                         ROUTE_RELEASE(&in6p->in6p_route);
 508                 }
 509
 510                 /* Copy the cached route and take an extra reference */
 511                 in6p_route_copyout(in6p, &ro);
 512
 513                 set_packet_service_class(m, so, sotc, PKT_SCF_IPV6);
 514
 515                 m->m_pkthdr.pkt_flowsrc = FLOWSRC_INPCB;
 516                 m->m_pkthdr.pkt_flowid = in6p->inp_flowhash;
 517                 m->m_pkthdr.pkt_proto = IPPROTO_UDP;
 518                 m->m_pkthdr.pkt_flags |= (PKTF_FLOW_ID | PKTF_FLOW_LOCALSRC);
 519                 if (flowadv) {
 520                         m->m_pkthdr.pkt_flags |= PKTF_FLOW_ADV;
 521                 }
 522                 m->m_pkthdr.tx_udp_pid = so->last_pid;
 523                 if (so->so_flags & SOF_DELEGATED) {
 524                         m->m_pkthdr.tx_udp_e_pid = so->e_pid;
 525                 } else {
 526                         m->m_pkthdr.tx_udp_e_pid = 0;
 527                 }
 528
 529                 im6o = in6p->in6p_moptions;
 530                 if (im6o != NULL) {
 531                         IM6O_LOCK(im6o);
 532                         IM6O_ADDREF_LOCKED(im6o);
 533                         if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) &&
 534                             im6o->im6o_multicast_ifp != NULL) {
 535                                 in6p->in6p_last_outifp =
 536                                     im6o->im6o_multicast_ifp;
 537                         }
 538                         IM6O_UNLOCK(im6o);
 539                 }
 540
 541                 socket_unlock(so, 0);
 542                 error = ip6_output(m, optp, &ro, flags, im6o, NULL, &ip6oa);
 543                 m = NULL;
 544                 socket_lock(so, 0);
 545
 546                 if (im6o != NULL) {
 547                         IM6O_REMREF(im6o);
 548                 }
 549
 550                 if (check_qos_marking_again) {
 551                         in6p->inp_policyresult.results.qos_marking_gencount = ip6oa.qos_marking_gencount;
 552                         if (ip6oa.ip6oa_flags & IP6OAF_QOSMARKING_ALLOWED) {
 553                                 in6p->inp_socket->so_flags1 |= SOF1_QOSMARKING_ALLOWED;
 554                         } else {
 555                                 in6p->inp_socket->so_flags1 &= ~SOF1_QOSMARKING_ALLOWED;
 556                         }
 557                 }
 558
 559                 if (error == 0 && nstat_collect) {
 560                         boolean_t cell, wifi, wired;
 561
 562                         if (in6p->in6p_route.ro_rt != NULL) {
 563                                 cell = IFNET_IS_CELLULAR(in6p->in6p_route.
 564                                     ro_rt->rt_ifp);
 565                                 wifi = (!cell && IFNET_IS_WIFI(in6p->in6p_route.
 566                                     ro_rt->rt_ifp));
 567                                 wired = (!wifi && IFNET_IS_WIRED(in6p->in6p_route.
 568                                     ro_rt->rt_ifp));
 569                         } else {
 570                                 cell = wifi = wired = FALSE;
 571                         }
 572                         INP_ADD_STAT(in6p, cell, wifi, wired, txpackets, 1);
 573                         INP_ADD_STAT(in6p, cell, wifi, wired, txbytes, ulen);
 574                         inp_set_activity_bitmap(in6p);
 575                 }
 576
 577                 if (flowadv && (adv->code == FADV_FLOW_CONTROLLED ||
 578                     adv->code == FADV_SUSPENDED)) {
 579                         /*
 580                          * Return an error to indicate
 581                          * that the packet has been dropped.
 582                          */
 583                         error = ENOBUFS;
 584                         inp_set_fc_state(in6p, adv->code);
 585                 }
 586
 587                 if (ro.ro_rt != NULL) {
 588                         struct ifnet *outif = ro.ro_rt->rt_ifp;
 589
 590                         so->so_pktheadroom = (uint16_t)P2ROUNDUP(
 591                                 sizeof(struct udphdr) +
 592                                 hlen +
 593                                 ifnet_hdrlen(outif) +
 594                                 ifnet_mbuf_packetpreamblelen(outif),
 595                                 sizeof(u_int32_t));
 596                 }
 597
 598                 /* Synchronize PCB cached route */
 599                 in6p_route_copyin(in6p, &ro);
 600
 601                 if (in6p->in6p_route.ro_rt != NULL) {
 602                         struct rtentry *rt = in6p->in6p_route.ro_rt;
 603                         struct ifnet *outif;
 604
 605                         if (rt->rt_flags & RTF_MULTICAST) {
 606                                 rt = NULL;      /* unusable */
 607                         }
 608 #if CONTENT_FILTER
 609                         /*
 610                          * Discard temporary route for cfil case
 611                          */
 612                         if (cfil_faddr_use) {
 613                                 rt = NULL;      /* unusable */
 614                         }
 615 #endif
 616
 617                         /*
 618                          * Always discard the cached route for unconnected
 619                          * socket or if it is a multicast route.
 620                          */
 621                         if (rt == NULL) {
 622                                 ROUTE_RELEASE(&in6p->in6p_route);
 623                         }
 624
 625                         /*
 626                          * If the destination route is unicast, update outif
 627                          * with that of the route interface used by IP.
 628                          */
 629                         if (rt != NULL) {
 630                                 /*
 631                                  * When an NECP IP tunnel policy forces the outbound interface,
 632                                  * ip6_output_list() informs the transport layer what is the actual
 633                                  * outgoing interface
 634                                  */
 635                                 if (ip6oa.ip6oa_flags & IP6OAF_BOUND_IF) {
 636                                         outif = ifindex2ifnet[ip6oa.ip6oa_boundif];
 637                                 } else {
 638                                         outif = rt->rt_ifp;
 639                                 }
 640                                 if (outif != NULL && outif != in6p->in6p_last_outifp) {
 641                                         in6p->in6p_last_outifp = outif;
 642
 643                                         so->so_pktheadroom = (uint16_t)P2ROUNDUP(
 644                                                 sizeof(struct udphdr) +
 645                                                 hlen +
 646                                                 ifnet_hdrlen(outif) +
 647                                                 ifnet_mbuf_packetpreamblelen(outif),
 648                                                 sizeof(u_int32_t));
 649                                 }
 650                         }
 651                 } else {
 652                         ROUTE_RELEASE(&in6p->in6p_route);
 653                 }
 654
 655                 /*
 656                  * If output interface was cellular/expensive, and this
 657                  * socket is denied access to it, generate an event.
 658                  */
 659                 if (error != 0 && (ip6oa.ip6oa_retflags & IP6OARF_IFDENIED) &&
 660                     (INP_NO_CELLULAR(in6p) || INP_NO_EXPENSIVE(in6p) || INP_NO_CONSTRAINED(in6p))) {
 661                         soevent(in6p->inp_socket, (SO_FILT_HINT_LOCKED |
 662                             SO_FILT_HINT_IFDENIED));
 663                 }
 664                 break;
 665         case AF_INET:
 666                 error = EAFNOSUPPORT;
 667                 goto release;
 668         }
 669         goto releaseopt;
 670
 671 release:
 672
 673         if (m != NULL) {
 674                 m_freem(m);
 675         }
 676
 677 releaseopt:
 678         if (control != NULL) {
 679                 if (optp == &opt) {
 680                         ip6_clearpktopts(optp, -1);
 681                 }
 682                 m_freem(control);
 683         }
 684 #if CONTENT_FILTER
 685         if (cfil_tag) {
 686                 m_tag_free(cfil_tag);
 687         }
 688 #endif
 689         if (sndinprog_cnt_used) {
 690                 VERIFY(in6p->inp_sndinprog_cnt > 0);
 691                 if (--in6p->inp_sndinprog_cnt == 0) {
 692                         in6p->inp_flags &= ~(INP_FC_FEEDBACK);
 693                         if (in6p->inp_sndingprog_waiters > 0) {
 694                                 wakeup(&in6p->inp_sndinprog_cnt);
 695                         }
 696                 }
 697                 sndinprog_cnt_used = false;
 698         }
 699
 700         return error;
 701 }