xnu-4903.270.47.tar.gz

[apple/xnu.git] / bsd / netinet6 / icmp6.c

diff --git a/bsd/netinet6/icmp6.c b/bsd/netinet6/icmp6.c
index c747a78f69da9f07f746a05c34d9e7dcb63ee9cb..f1d66606e8947ba511fd5772d5e28a8d5a9d8c8e 100644 (file)
--- a/bsd/netinet6/icmp6.c
+++ b/bsd/netinet6/icmp6.c
@@ -1,3 +1,31 @@
+/*
+ * Copyright (c) 2000-2019 Apple Inc. All rights reserved.
+ *
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
+ *
+ * This file contains Original Code and/or Modifications of Original Code
+ * as defined in and that are subject to the Apple Public Source License
+ * Version 2.0 (the 'License'). You may not use this file except in
+ * compliance with the License. The rights granted to you under the License
+ * may not be used to create, or enable the creation or redistribution of,
+ * unlawful or unlicensed copies of an Apple operating system, or to
+ * circumvent, violate, or enable the circumvention or violation of, any
+ * terms of an Apple operating system software license agreement.
+ *
+ * Please obtain a copy of the License at
+ * http://www.opensource.apple.com/apsl/ and read it before using this file.
+ *
+ * The Original Code and all software distributed under the License are
+ * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
+ * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
+ * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
+ * Please see the License for the specific language governing rights and
+ * limitations under the License.
+ *
+ * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
+ */
+

 /*     $FreeBSD: src/sys/netinet6/icmp6.c,v 1.6.2.6 2001/07/10 09:44:16 ume Exp $      */
 /*     $KAME: icmp6.c,v 1.211 2001/04/04 05:56:20 itojun Exp $ */
 
 /*     $FreeBSD: src/sys/netinet6/icmp6.c,v 1.6.2.6 2001/07/10 09:44:16 ume Exp $      */
 /*     $KAME: icmp6.c,v 1.211 2001/04/04 05:56:20 itojun Exp $ */
 


@@ -70,6 +98,7 @@
 #include <sys/systm.h>
 #include <sys/lock.h>
 #include <sys/malloc.h>
 #include <sys/systm.h>
 #include <sys/lock.h>
 #include <sys/malloc.h>

+#include <sys/mcache.h>

 #include <sys/mbuf.h>
 #include <sys/protosw.h>
 #include <sys/socket.h>
 #include <sys/mbuf.h>
 #include <sys/protosw.h>
 #include <sys/socket.h>


@@ -78,6 +107,7 @@
 #include <sys/kernel.h>
 #include <sys/syslog.h>
 #include <sys/domain.h>
 #include <sys/kernel.h>
 #include <sys/syslog.h>
 #include <sys/domain.h>

+#include <sys/kauth.h>

 
 #include <net/if.h>
 #include <net/route.h>
 
 #include <net/if.h>
 #include <net/route.h>


@@ -92,71 +122,75 @@
 #include <netinet6/mld6_var.h>
 #include <netinet/in_pcb.h>
 #include <netinet6/in6_pcb.h>
 #include <netinet6/mld6_var.h>
 #include <netinet/in_pcb.h>
 #include <netinet6/in6_pcb.h>

+#include <netinet6/in6_var.h>

 #include <netinet6/nd6.h>
 #include <netinet6/in6_ifattach.h>
 #include <netinet6/ip6protosw.h>
 #include <netinet6/nd6.h>
 #include <netinet6/in6_ifattach.h>
 #include <netinet6/ip6protosw.h>

+#include <netinet6/scope6_var.h>

 
 #if IPSEC
 #include <netinet6/ipsec.h>
 #include <netkey/key.h>
 
 #if IPSEC
 #include <netinet6/ipsec.h>
 #include <netkey/key.h>

-
-extern int ipsec_bypass;
-#endif
-
-#include "faith.h"
-#if defined(NFAITH) && 0 < NFAITH
-#include <net/if_faith.h>

 #endif
 
 #include <net/net_osdep.h>
 
 #endif
 
 #include <net/net_osdep.h>
 

-extern struct domain inet6domain;
-extern struct ip6protosw inet6sw[];
+#if NECP
+#include <net/necp.h>
+#endif
+

 extern struct ip6protosw *ip6_protox[];
 
 extern struct ip6protosw *ip6_protox[];
 

+extern uint32_t rip_sendspace;
+extern uint32_t rip_recvspace;
+

 struct icmp6stat icmp6stat;
 
 extern struct inpcbhead ripcb;
 extern int icmp6errppslim;
 struct icmp6stat icmp6stat;
 
 extern struct inpcbhead ripcb;
 extern int icmp6errppslim;

+extern int icmp6rappslim;

 static int icmp6errpps_count = 0;
 static int icmp6errpps_count = 0;

+static int icmp6rapps_count = 0;

 static struct timeval icmp6errppslim_last;
 static struct timeval icmp6errppslim_last;

+static struct timeval icmp6rappslim_last;

 extern int icmp6_nodeinfo;
 extern struct inpcbinfo ripcbinfo;
 extern int icmp6_nodeinfo;
 extern struct inpcbinfo ripcbinfo;

-extern lck_mtx_t *ip6_mutex; 
-extern lck_mtx_t *nd6_mutex; 

 
 static void icmp6_errcount(struct icmp6errstat *, int, int);
 static int icmp6_rip6_input(struct mbuf **, int);
 static int icmp6_ratelimit(const struct in6_addr *, const int, const int);
 static const char *icmp6_redirect_diag(struct in6_addr *,
 
 static void icmp6_errcount(struct icmp6errstat *, int, int);
 static int icmp6_rip6_input(struct mbuf **, int);
 static int icmp6_ratelimit(const struct in6_addr *, const int, const int);
 static const char *icmp6_redirect_diag(struct in6_addr *,

-       struct in6_addr *, struct in6_addr *);
-#ifndef HAVE_PPSRATECHECK
-static int ppsratecheck(struct timeval *, int *, int);
-#endif
+    struct in6_addr *, struct in6_addr *);

 static struct mbuf *ni6_input(struct mbuf *, int);
 static struct mbuf *ni6_nametodns(const char *, int, int);
 static int ni6_dnsmatch(const char *, int, const char *, int);
 static struct mbuf *ni6_input(struct mbuf *, int);
 static struct mbuf *ni6_nametodns(const char *, int, int);
 static int ni6_dnsmatch(const char *, int, const char *, int);

-static int ni6_addrs(struct icmp6_nodeinfo *, 
-                         struct ifnet **, char *);
+static int ni6_addrs(struct icmp6_nodeinfo *,
+    struct ifnet **, char *);

 static int ni6_store_addrs(struct icmp6_nodeinfo *, struct icmp6_nodeinfo *,
 static int ni6_store_addrs(struct icmp6_nodeinfo *, struct icmp6_nodeinfo *,

-                               struct ifnet *, int);
+    struct ifnet *, int);

 static int icmp6_notify_error(struct mbuf *, int, int, int);
 
 static int icmp6_notify_error(struct mbuf *, int, int, int);
 

-#ifdef COMPAT_RFC1885
-static struct route_in6 icmp6_reflect_rt;
-#endif

 
 
 void
 
 
 void

-icmp6_init()
+icmp6_init(struct ip6protosw *pp, struct domain *dp)

 {
 {

-       mld6_init();
+#pragma unused(dp)
+       static int icmp6_initialized = 0;
+
+       /* Also called from ip6_init() without pp */
+       VERIFY(pp == NULL ||
+           (pp->pr_flags & (PR_INITIALIZED | PR_ATTACHED)) == PR_ATTACHED);
+
+       /* This gets called by more than one protocols, so initialize once */
+       if (!icmp6_initialized) {
+               icmp6_initialized = 1;
+               mld_init();
+       }

 }
 
 static void
 }
 
 static void

-icmp6_errcount(stat, type, code)
-       struct icmp6errstat *stat;
-       int type, code;
+icmp6_errcount(struct icmp6errstat *stat, int type, int code)

 {
        switch (type) {
        case ICMP6_DST_UNREACH:
 {
        switch (type) {
        case ICMP6_DST_UNREACH:


@@ -211,13 +245,54 @@ icmp6_errcount(stat, type, code)
        stat->icp6errs_unknown++;
 }
 
        stat->icp6errs_unknown++;
 }
 

+/*
+ * A wrapper function for icmp6_error() necessary when the erroneous packet
+ * may not contain enough scope zone information.
+ */
+void
+icmp6_error2(struct mbuf *m, int type, int code, int param,
+    struct ifnet *ifp)
+{
+       struct ip6_hdr *ip6;
+
+       if (ifp == NULL) {
+               return;
+       }
+
+#ifndef PULLDOWN_TEST
+       IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr), return );
+#else
+       if (m->m_len < sizeof(struct ip6_hdr)) {
+               m = m_pullup(m, sizeof(struct ip6_hdr));
+               if (m == NULL) {
+                       return;
+               }
+       }
+#endif
+
+       ip6 = mtod(m, struct ip6_hdr *);
+
+       if (in6_setscope(&ip6->ip6_src, ifp, NULL) != 0) {
+               return;
+       }
+       if (in6_setscope(&ip6->ip6_dst, ifp, NULL) != 0) {
+               return;
+       }
+
+       icmp6_error(m, type, code, param);
+}
+

 /*
  * Generate an error packet of type error in response to bad IP6 packet.
  */
 void
 /*
  * Generate an error packet of type error in response to bad IP6 packet.
  */
 void

-icmp6_error(m, type, code, param)
-       struct mbuf *m;
-       int type, code, param;
+icmp6_error(struct mbuf *m, int type, int code, int param)
+{
+       icmp6_error_flag(m, type, code, param, ICMP6_ERROR_RST_MRCVIF);
+}
+
+void
+icmp6_error_flag(struct mbuf *m, int type, int code, int param, int flags)

 {
        struct ip6_hdr *oip6, *nip6;
        struct icmp6_hdr *icmp6;
 {
        struct ip6_hdr *oip6, *nip6;
        struct icmp6_hdr *icmp6;


@@ -227,11 +302,10 @@ icmp6_error(m, type, code, param)
 
        icmp6stat.icp6s_error++;
 
 
        icmp6stat.icp6s_error++;
 

-       lck_mtx_assert(ip6_mutex, LCK_MTX_ASSERT_NOTOWNED);

        /* count per-type-code statistics */
        icmp6_errcount(&icmp6stat.icp6s_outerrhist, type, code);
 
        /* count per-type-code statistics */
        icmp6_errcount(&icmp6stat.icp6s_outerrhist, type, code);
 

-#ifdef M_DECRYPTED     /*not openbsd*/
+#ifdef M_DECRYPTED      /*not openbsd*/

        if (m->m_flags & M_DECRYPTED) {
                icmp6stat.icp6s_canterror++;
                goto freeit;
        if (m->m_flags & M_DECRYPTED) {
                icmp6stat.icp6s_canterror++;
                goto freeit;


@@ -239,32 +313,44 @@ icmp6_error(m, type, code, param)
 #endif
 
 #ifndef PULLDOWN_TEST
 #endif
 
 #ifndef PULLDOWN_TEST

-       IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr), return);
+       IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr), return );

 #else
        if (m->m_len < sizeof(struct ip6_hdr)) {
                m = m_pullup(m, sizeof(struct ip6_hdr));
 #else
        if (m->m_len < sizeof(struct ip6_hdr)) {
                m = m_pullup(m, sizeof(struct ip6_hdr));

-               if (m == NULL)
+               if (m == NULL) {

                        return;
                        return;

+               }

        }
 #endif
        oip6 = mtod(m, struct ip6_hdr *);
 
        /*
        }
 #endif
        oip6 = mtod(m, struct ip6_hdr *);
 
        /*

-        * Multicast destination check. For unrecognized option errors,
-        * this check has already done in ip6_unknown_opt(), so we can
-        * check only for other errors.
+        * If the destination address of the erroneous packet is a multicast
+        * address, or the packet was sent using link-layer multicast,
+        * we should basically suppress sending an error (RFC 2463, Section
+        * 2.4).
+        * We have two exceptions (the item e.2 in that section):
+        * - the Pakcet Too Big message can be sent for path MTU discovery.
+        * - the Parameter Problem Message that can be allowed an icmp6 error
+        *   in the option type field.  This check has been done in
+        *   ip6_unknown_opt(), so we can just check the type and code.

         */
         */

-       if ((m->m_flags & (M_BCAST|M_MCAST) ||
-            IN6_IS_ADDR_MULTICAST(&oip6->ip6_dst)) &&
+       if ((m->m_flags & (M_BCAST | M_MCAST) ||
+           IN6_IS_ADDR_MULTICAST(&oip6->ip6_dst)) &&

            (type != ICMP6_PACKET_TOO_BIG &&
            (type != ICMP6_PACKET_TOO_BIG &&

-            (type != ICMP6_PARAM_PROB ||
-             code != ICMP6_PARAMPROB_OPTION)))
+           (type != ICMP6_PARAM_PROB ||
+           code != ICMP6_PARAMPROB_OPTION))) {

                goto freeit;
                goto freeit;

+       }

 
 

-       /* Source address check. XXX: the case of anycast source? */
+       /*
+        * RFC 2463, 2.4 (e.5): source address check.
+        * XXX: the case of anycast source?
+        */

        if (IN6_IS_ADDR_UNSPECIFIED(&oip6->ip6_src) ||
        if (IN6_IS_ADDR_UNSPECIFIED(&oip6->ip6_src) ||

-           IN6_IS_ADDR_MULTICAST(&oip6->ip6_src))
+           IN6_IS_ADDR_MULTICAST(&oip6->ip6_src)) {

                goto freeit;
                goto freeit;

+       }

 
        /*
         * If we are about to send ICMPv6 against ICMPv6 error/redirect,
 
        /*
         * If we are about to send ICMPv6 against ICMPv6 error/redirect,


@@ -276,11 +362,11 @@ icmp6_error(m, type, code, param)
                struct icmp6_hdr *icp;
 
 #ifndef PULLDOWN_TEST
                struct icmp6_hdr *icp;
 
 #ifndef PULLDOWN_TEST

-               IP6_EXTHDR_CHECK(m, 0, off + sizeof(struct icmp6_hdr), return);
+               IP6_EXTHDR_CHECK(m, 0, off + sizeof(struct icmp6_hdr), return );

                icp = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
 #else
                IP6_EXTHDR_GET(icp, struct icmp6_hdr *, m, off,
                icp = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
 #else
                IP6_EXTHDR_GET(icp, struct icmp6_hdr *, m, off,

-                       sizeof(*icp));
+                   sizeof(*icp));

                if (icp == NULL) {
                        icmp6stat.icp6s_tooshort++;
                        return;
                if (icp == NULL) {
                        icmp6stat.icp6s_tooshort++;
                        return;


@@ -314,13 +400,15 @@ icmp6_error(m, type, code, param)
         * OK, ICMP6 can be generated.
         */
 
         * OK, ICMP6 can be generated.
         */
 

-       if (m->m_pkthdr.len >= ICMPV6_PLD_MAXLEN)
+       if (m->m_pkthdr.len >= ICMPV6_PLD_MAXLEN) {

                m_adj(m, ICMPV6_PLD_MAXLEN - m->m_pkthdr.len);
                m_adj(m, ICMPV6_PLD_MAXLEN - m->m_pkthdr.len);

+       }

 
        preplen = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
 
        preplen = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);

-       M_PREPEND(m, preplen, M_DONTWAIT);
-       if (m && m->m_len < preplen)
+       M_PREPEND(m, preplen, M_DONTWAIT, 1);
+       if (m && m->m_len < preplen) {

                m = m_pullup(m, preplen);
                m = m_pullup(m, preplen);

+       }

        if (m == NULL) {
                nd6log((LOG_DEBUG, "ENOBUFS in icmp6_error %d\n", __LINE__));
                return;
        if (m == NULL) {
                nd6log((LOG_DEBUG, "ENOBUFS in icmp6_error %d\n", __LINE__));
                return;


@@ -330,10 +418,8 @@ icmp6_error(m, type, code, param)
        nip6->ip6_src  = oip6->ip6_src;
        nip6->ip6_dst  = oip6->ip6_dst;
 
        nip6->ip6_src  = oip6->ip6_src;
        nip6->ip6_dst  = oip6->ip6_dst;
 

-       if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_src))
-               oip6->ip6_src.s6_addr16[1] = 0;
-       if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_dst))
-               oip6->ip6_dst.s6_addr16[1] = 0;
+       in6_clearscope(&oip6->ip6_src);
+       in6_clearscope(&oip6->ip6_dst);

 
        icmp6 = (struct icmp6_hdr *)(nip6 + 1);
        icmp6->icmp6_type = type;
 
        icmp6 = (struct icmp6_hdr *)(nip6 + 1);
        icmp6->icmp6_type = type;


@@ -342,21 +428,23 @@ icmp6_error(m, type, code, param)
 
        /*
         * icmp6_reflect() is designed to be in the input path.
 
        /*
         * icmp6_reflect() is designed to be in the input path.

-        * icmp6_error() can be called from both input and outut path,
+        * icmp6_error() can be called from both input and output path,

         * and if we are in output path rcvif could contain bogus value.
         * clear m->m_pkthdr.rcvif for safety, we should have enough scope
         * information in ip header (nip6).
         */
         * and if we are in output path rcvif could contain bogus value.
         * clear m->m_pkthdr.rcvif for safety, we should have enough scope
         * information in ip header (nip6).
         */

-       m->m_pkthdr.rcvif = NULL;
+       if (flags & ICMP6_ERROR_RST_MRCVIF) {
+               m->m_pkthdr.rcvif = NULL;
+       }

 
        icmp6stat.icp6s_outhist[type]++;
        icmp6_reflect(m, sizeof(struct ip6_hdr)); /* header order: IPv6 - ICMPv6 */
 
        return;
 
 
        icmp6stat.icp6s_outhist[type]++;
        icmp6_reflect(m, sizeof(struct ip6_hdr)); /* header order: IPv6 - ICMPv6 */
 
        return;
 

-  freeit:
+freeit:

        /*
        /*

-        * If we can't tell wheter or not we can generate ICMP6, free it.
+        * If we can't tell whether or not we can generate ICMP6, free it.

         */
        m_freem(m);
 }
         */
        m_freem(m);
 }


@@ -365,36 +453,37 @@ icmp6_error(m, type, code, param)
  * Process a received ICMP6 message.
  */
 int
  * Process a received ICMP6 message.
  */
 int

-icmp6_input(mp, offp)
-       struct mbuf **mp;
-       int *offp;
+icmp6_input(struct mbuf **mp, int *offp, int proto)

 {
 {

+#pragma unused(proto)

        struct mbuf *m = *mp, *n;
        struct mbuf *m = *mp, *n;

+       struct ifnet *ifp;

        struct ip6_hdr *ip6, *nip6;
        struct icmp6_hdr *icmp6, *nicmp6;
        int off = *offp;
        int icmp6len = m->m_pkthdr.len - *offp;
        struct ip6_hdr *ip6, *nip6;
        struct icmp6_hdr *icmp6, *nicmp6;
        int off = *offp;
        int icmp6len = m->m_pkthdr.len - *offp;

-       int code, sum, noff;
+       int code, sum, noff, proxy = 0;
+
+       ifp = m->m_pkthdr.rcvif;

 
 #ifndef PULLDOWN_TEST
        IP6_EXTHDR_CHECK(m, off, sizeof(struct icmp6_hdr), return IPPROTO_DONE);
        /* m might change if M_LOOP.  So, call mtod after this */
 #endif
 
 
 #ifndef PULLDOWN_TEST
        IP6_EXTHDR_CHECK(m, off, sizeof(struct icmp6_hdr), return IPPROTO_DONE);
        /* m might change if M_LOOP.  So, call mtod after this */
 #endif
 

+       /* Expect 32-bit aligned data pointer on strict-align platforms */
+       MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
+

        /*
         * Locate icmp6 structure in mbuf, and check
         * that not corrupted and of at least minimum length
         */
        /*
         * Locate icmp6 structure in mbuf, and check
         * that not corrupted and of at least minimum length
         */

-

        ip6 = mtod(m, struct ip6_hdr *);
        if (icmp6len < sizeof(struct icmp6_hdr)) {
                icmp6stat.icp6s_tooshort++;
                goto freeit;
        }
 
        ip6 = mtod(m, struct ip6_hdr *);
        if (icmp6len < sizeof(struct icmp6_hdr)) {
                icmp6stat.icp6s_tooshort++;
                goto freeit;
        }
 

-       /*
-        * calculate the checksum
-        */

 #ifndef PULLDOWN_TEST
        icmp6 = (struct icmp6_hdr *)((caddr_t)ip6 + off);
 #else
 #ifndef PULLDOWN_TEST
        icmp6 = (struct icmp6_hdr *)((caddr_t)ip6 + off);
 #else


@@ -406,6 +495,61 @@ icmp6_input(mp, offp)
 #endif
        code = icmp6->icmp6_code;
 
 #endif
        code = icmp6->icmp6_code;
 

+       /*
+        * Early check for RFC 6980
+        * Drop certain NDP packets if they came in fragmented
+        */
+       switch (icmp6->icmp6_type) {
+       case ND_ROUTER_SOLICIT:
+       case ND_ROUTER_ADVERT:
+       case ND_NEIGHBOR_SOLICIT:
+       case ND_NEIGHBOR_ADVERT:
+       case ND_REDIRECT:
+               if (m->m_pkthdr.pkt_flags & PKTF_REASSEMBLED) {
+                       icmp6stat.icp6s_rfc6980_drop++;
+                       goto freeit;
+               }
+               break;
+       default:
+               break;
+       }
+
+       /* Apply rate limit before checksum validation. */
+       if (icmp6_ratelimit(&ip6->ip6_dst, icmp6->icmp6_type, code)) {
+               icmp6stat.icp6s_toofreq++;
+               goto freeit;
+       }
+
+       /*
+        * Check multicast group membership.
+        * Note: SSM filters are not applied for ICMPv6 traffic.
+        */
+       if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
+               struct in6_multi        *inm;
+
+               in6_multihead_lock_shared();
+               IN6_LOOKUP_MULTI(&ip6->ip6_dst, ifp, inm);
+               in6_multihead_lock_done();
+
+               if (inm == NULL) {
+                       /*
+                        * Don't discard if this is a Neighbor Solicitation
+                        * that needs to be proxied (see check down below.)
+                        */
+                       if (!(m->m_pkthdr.pkt_flags & PKTF_PROXY_DST)) {
+                               ip6stat.ip6s_notmember++;
+                               in6_ifstat_inc(m->m_pkthdr.rcvif,
+                                   ifs6_in_discard);
+                               goto freeit;
+                       }
+               } else {
+                       IN6M_REMREF(inm);
+               }
+       }
+
+       /*
+        * calculate the checksum
+        */

        if ((sum = in6_cksum(m, IPPROTO_ICMPV6, off, icmp6len)) != 0) {
                nd6log((LOG_ERR,
                    "ICMP6 checksum error(%d|%x) %s\n",
        if ((sum = in6_cksum(m, IPPROTO_ICMPV6, off, icmp6len)) != 0) {
                nd6log((LOG_ERR,
                    "ICMP6 checksum error(%d|%x) %s\n",


@@ -414,53 +558,45 @@ icmp6_input(mp, offp)
                goto freeit;
        }
 
                goto freeit;
        }
 

-#if defined(NFAITH) && 0 < NFAITH
-       if (faithprefix(&ip6->ip6_dst)) {
+       if (m->m_pkthdr.pkt_flags & PKTF_PROXY_DST) {

                /*
                /*

-                * Deliver very specific ICMP6 type only.
-                * This is important to deilver TOOBIG.  Otherwise PMTUD
-                * will not work.
+                * This is the special case of proxying NS (dst is either
+                * solicited-node multicast or unicast); process it locally
+                * but don't deliver it to sockets.  It practically lets us
+                * steer the packet to nd6_prproxy_ns_input, where more
+                * specific tests and actions will be taken.

                 */
                switch (icmp6->icmp6_type) {
                 */
                switch (icmp6->icmp6_type) {

-               case ICMP6_DST_UNREACH:
-               case ICMP6_PACKET_TOO_BIG:
-               case ICMP6_TIME_EXCEEDED:
+               case ND_NEIGHBOR_SOLICIT:
+                       proxy = 1;

                        break;
                default:
                        goto freeit;
                }
        }
                        break;
                default:
                        goto freeit;
                }
        }

-#endif

 
        icmp6stat.icp6s_inhist[icmp6->icmp6_type]++;
        icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_msg);
 
        icmp6stat.icp6s_inhist[icmp6->icmp6_type]++;
        icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_msg);

-       if (icmp6->icmp6_type < ICMP6_INFOMSG_MASK)
+       if (icmp6->icmp6_type < ICMP6_INFOMSG_MASK) {

                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_error);
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_error);

+       }

 
        switch (icmp6->icmp6_type) {
        case ICMP6_DST_UNREACH:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_dstunreach);
                switch (code) {
                case ICMP6_DST_UNREACH_NOROUTE:
 
        switch (icmp6->icmp6_type) {
        case ICMP6_DST_UNREACH:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_dstunreach);
                switch (code) {
                case ICMP6_DST_UNREACH_NOROUTE:

+               case ICMP6_DST_UNREACH_ADDR:    /* PRC_HOSTDEAD is a DOS */

                        code = PRC_UNREACH_NET;
                        break;
                case ICMP6_DST_UNREACH_ADMIN:
                        icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_adminprohib);
                        code = PRC_UNREACH_PROTOCOL; /* is this a good code? */
                        break;
                        code = PRC_UNREACH_NET;
                        break;
                case ICMP6_DST_UNREACH_ADMIN:
                        icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_adminprohib);
                        code = PRC_UNREACH_PROTOCOL; /* is this a good code? */
                        break;

-               case ICMP6_DST_UNREACH_ADDR:
-                       code = PRC_HOSTDEAD;
-                       break;
-#ifdef COMPAT_RFC1885
-               case ICMP6_DST_UNREACH_NOTNEIGHBOR:
-                       code = PRC_UNREACH_SRCFAIL;
-                       break;
-#else

                case ICMP6_DST_UNREACH_BEYONDSCOPE:
                        /* I mean "source address was incorrect." */
                        code = PRC_PARAMPROB;
                        break;
                case ICMP6_DST_UNREACH_BEYONDSCOPE:
                        /* I mean "source address was incorrect." */
                        code = PRC_PARAMPROB;
                        break;

-#endif

                case ICMP6_DST_UNREACH_NOPORT:
                        code = PRC_UNREACH_PORT;
                        break;
                case ICMP6_DST_UNREACH_NOPORT:
                        code = PRC_UNREACH_PORT;
                        break;


@@ -468,12 +604,9 @@ icmp6_input(mp, offp)
                        goto badcode;
                }
                goto deliver;
                        goto badcode;
                }
                goto deliver;

-               break;

 
        case ICMP6_PACKET_TOO_BIG:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_pkttoobig);
 
        case ICMP6_PACKET_TOO_BIG:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_pkttoobig);

-               if (code != 0)
-                       goto badcode;

 
                code = PRC_MSGSIZE;
 
 
                code = PRC_MSGSIZE;
 


@@ -482,20 +615,20 @@ icmp6_input(mp, offp)
                 * intermediate extension headers.
                 */
                goto deliver;
                 * intermediate extension headers.
                 */
                goto deliver;

-               break;

 
        case ICMP6_TIME_EXCEEDED:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_timeexceed);
                switch (code) {
                case ICMP6_TIME_EXCEED_TRANSIT:
 
        case ICMP6_TIME_EXCEEDED:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_timeexceed);
                switch (code) {
                case ICMP6_TIME_EXCEED_TRANSIT:

+                       code = PRC_TIMXCEED_INTRANS;
+                       break;

                case ICMP6_TIME_EXCEED_REASSEMBLY:
                case ICMP6_TIME_EXCEED_REASSEMBLY:

-                       code += PRC_TIMXCEED_INTRANS;
+                       code = PRC_TIMXCEED_REASS;

                        break;
                default:
                        goto badcode;
                }
                goto deliver;
                        break;
                default:
                        goto badcode;
                }
                goto deliver;

-               break;

 
        case ICMP6_PARAM_PROB:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_paramprob);
 
        case ICMP6_PARAM_PROB:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_paramprob);


@@ -511,18 +644,19 @@ icmp6_input(mp, offp)
                        goto badcode;
                }
                goto deliver;
                        goto badcode;
                }
                goto deliver;

-               break;

 
        case ICMP6_ECHO_REQUEST:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_echo);
 
        case ICMP6_ECHO_REQUEST:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_echo);

-               if (code != 0)
+               if (code != 0) {

                        goto badcode;
                        goto badcode;

+               }
+

                if ((n = m_copy(m, 0, M_COPYALL)) == NULL) {
                        /* Give up remote */
                if ((n = m_copy(m, 0, M_COPYALL)) == NULL) {
                        /* Give up remote */

-                       break;
+                       goto rate_limit_checked;

                }
                if ((n->m_flags & M_EXT) != 0
                }
                if ((n->m_flags & M_EXT) != 0

-                || n->m_len < off + sizeof(struct icmp6_hdr)) {
+                   || n->m_len < off + sizeof(struct icmp6_hdr)) {

                        struct mbuf *n0 = n;
                        const int maxlen = sizeof(*nip6) + sizeof(*nicmp6);
 
                        struct mbuf *n0 = n;
                        const int maxlen = sizeof(*nip6) + sizeof(*nicmp6);
 


@@ -533,9 +667,9 @@ icmp6_input(mp, offp)
                        if (maxlen >= MCLBYTES) {
                                /* Give up remote */
                                m_freem(n0);
                        if (maxlen >= MCLBYTES) {
                                /* Give up remote */
                                m_freem(n0);

-                               break;
+                               goto rate_limit_checked;

                        }
                        }

-                       MGETHDR(n, M_DONTWAIT, n0->m_type);
+                       MGETHDR(n, M_DONTWAIT, n0->m_type);     /* MAC-OK */

                        if (n && maxlen >= MHLEN) {
                                MCLGET(n, M_DONTWAIT);
                                if ((n->m_flags & M_EXT) == 0) {
                        if (n && maxlen >= MHLEN) {
                                MCLGET(n, M_DONTWAIT);
                                if ((n->m_flags & M_EXT) == 0) {


@@ -546,7 +680,7 @@ icmp6_input(mp, offp)
                        if (n == NULL) {
                                /* Give up remote */
                                m_freem(n0);
                        if (n == NULL) {
                                /* Give up remote */
                                m_freem(n0);

-                               break;
+                               goto rate_limit_checked;

                        }
                        M_COPY_PKTHDR(n, n0);
                        /*
                        }
                        M_COPY_PKTHDR(n, n0);
                        /*


@@ -558,7 +692,7 @@ icmp6_input(mp, offp)
                        bcopy(icmp6, nicmp6, sizeof(struct icmp6_hdr));
                        noff = sizeof(struct ip6_hdr);
                        n->m_pkthdr.len = n->m_len =
                        bcopy(icmp6, nicmp6, sizeof(struct icmp6_hdr));
                        noff = sizeof(struct ip6_hdr);
                        n->m_pkthdr.len = n->m_len =

-                               noff + sizeof(struct icmp6_hdr);
+                           noff + sizeof(struct icmp6_hdr);

                        /*
                         * Adjust mbuf. ip6_plen will be adjusted in
                         * ip6_output().
                        /*
                         * Adjust mbuf. ip6_plen will be adjusted in
                         * ip6_output().


@@ -569,91 +703,114 @@ icmp6_input(mp, offp)
                        n0->m_flags &= ~M_PKTHDR;
                } else {
                        nip6 = mtod(n, struct ip6_hdr *);
                        n0->m_flags &= ~M_PKTHDR;
                } else {
                        nip6 = mtod(n, struct ip6_hdr *);

-                       nicmp6 = (struct icmp6_hdr *)((caddr_t)nip6 + off);
+                       IP6_EXTHDR_GET(nicmp6, struct icmp6_hdr *, n, off,
+                           sizeof(*nicmp6));

                        noff = off;
                }
                        noff = off;
                }

-               nicmp6->icmp6_type = ICMP6_ECHO_REPLY;
-               nicmp6->icmp6_code = 0;
+               if (nicmp6 == NULL) {
+                       panic("nicmp6 is NULL in %s, which isn't good!\n", __FUNCTION__);
+               } else {
+                       nicmp6->icmp6_type = ICMP6_ECHO_REPLY;
+                       nicmp6->icmp6_code = 0;
+               }

                if (n) {
                        icmp6stat.icp6s_reflect++;
                        icmp6stat.icp6s_outhist[ICMP6_ECHO_REPLY]++;
                        icmp6_reflect(n, noff);
                }
                if (n) {
                        icmp6stat.icp6s_reflect++;
                        icmp6stat.icp6s_outhist[ICMP6_ECHO_REPLY]++;
                        icmp6_reflect(n, noff);
                }

-               break;
+               goto rate_limit_checked;

 
        case ICMP6_ECHO_REPLY:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_echoreply);
 
        case ICMP6_ECHO_REPLY:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_echoreply);

-               if (code != 0)
+               if (code != 0) {

                        goto badcode;
                        goto badcode;

+               }

                break;
 
                break;
 

-       case MLD6_LISTENER_QUERY:
-       case MLD6_LISTENER_REPORT:
-               if (icmp6len < sizeof(struct mld6_hdr))
+       case MLD_LISTENER_QUERY:
+       case MLD_LISTENER_REPORT:
+
+               if (icmp6len < sizeof(struct mld_hdr)) {

                        goto badlen;
                        goto badlen;

-               if (icmp6->icmp6_type == MLD6_LISTENER_QUERY) /* XXX: ugly... */
+               }
+               if (icmp6->icmp6_type == MLD_LISTENER_QUERY) { /* XXX: ugly... */

                        icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mldquery);
                        icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mldquery);

-               else
+               } else {

                        icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mldreport);
                        icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mldreport);

+               }
+

                if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
                        /* give up local */
                if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
                        /* give up local */

-                       mld6_input(m, off);
-                       m = NULL;
+                       if (mld_input(m, off, icmp6len) == IPPROTO_DONE) {
+                               m = NULL;
+                       }

                        goto freeit;
                }
                        goto freeit;
                }

-               mld6_input(n, off);
+               if (mld_input(n, off, icmp6len) != IPPROTO_DONE) {
+                       m_freem(n);
+               }

                /* m stays. */
                /* m stays. */

-               break;
+               goto rate_limit_checked;

 
 

-       case MLD6_LISTENER_DONE:
+       case MLD_LISTENER_DONE:

                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mlddone);
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_mlddone);

-               if (icmp6len < sizeof(struct mld6_hdr)) /* necessary? */
+               if (icmp6len < sizeof(struct mld_hdr)) { /* necessary? */

                        goto badlen;
                        goto badlen;

-               break;          /* nothing to be done in kernel */
+               }
+               break;          /* nothing to be done in kernel */

 
 

-       case MLD6_MTRACE_RESP:
-       case MLD6_MTRACE:
-               /* XXX: these two are experimental. not officially defind. */
+       case MLD_MTRACE_RESP:
+       case MLD_MTRACE:
+               /* XXX: these two are experimental.  not officially defined. */

                /* XXX: per-interface statistics? */
                /* XXX: per-interface statistics? */

-               break;          /* just pass it to applications */
+               break;          /* just pass it to applications */

 
 

-       case ICMP6_FQDN_QUERY:
-               if (!icmp6_nodeinfo)
+       case ICMP6_NI_QUERY:
+               if (!icmp6_nodeinfo) {

                        break;
                        break;

-
-               /* By RFC 4620 refuse to answer queries from global scope addresses */ 
-               if ((icmp6_nodeinfo & 8) != 8 && in6_addrscope(&ip6->ip6_src) == IPV6_ADDR_SCOPE_GLOBAL)
+               }
+//### LD 10/20 Check fbsd differences here. Not sure we're more advanced or not.
+               /* By RFC 4620 refuse to answer queries from global scope addresses */
+               if ((icmp6_nodeinfo & 8) != 8 && in6_addrscope(&ip6->ip6_src) == IPV6_ADDR_SCOPE_GLOBAL) {

                        break;
                        break;

+               }

 
 

-               if (icmp6len < sizeof(struct icmp6_nodeinfo))
+               if (icmp6len < sizeof(struct icmp6_nodeinfo)) {

                        goto badlen;
                        goto badlen;

+               }

 
 #ifndef PULLDOWN_TEST
                IP6_EXTHDR_CHECK(m, off, sizeof(struct icmp6_nodeinfo),
 
 #ifndef PULLDOWN_TEST
                IP6_EXTHDR_CHECK(m, off, sizeof(struct icmp6_nodeinfo),

-                                return IPPROTO_DONE);
+                   return IPPROTO_DONE);

 #endif
 #endif

+

                n = m_copy(m, 0, M_COPYALL);
                n = m_copy(m, 0, M_COPYALL);

-               if (n)
+               if (n) {

                        n = ni6_input(n, off);
                        n = ni6_input(n, off);

+               }

                if (n) {
                        noff = sizeof(struct ip6_hdr);
                        icmp6stat.icp6s_reflect++;
                        icmp6stat.icp6s_outhist[ICMP6_WRUREPLY]++;
                        icmp6_reflect(n, noff);
                }
                if (n) {
                        noff = sizeof(struct ip6_hdr);
                        icmp6stat.icp6s_reflect++;
                        icmp6stat.icp6s_outhist[ICMP6_WRUREPLY]++;
                        icmp6_reflect(n, noff);
                }

-               break;
+               goto rate_limit_checked;

 
        case ICMP6_WRUREPLY:
 
        case ICMP6_WRUREPLY:

-               if (code != 0)
+               if (code != 0) {

                        goto badcode;
                        goto badcode;

+               }

                break;
 
        case ND_ROUTER_SOLICIT:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_routersolicit);
                break;
 
        case ND_ROUTER_SOLICIT:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_routersolicit);

-               if (code != 0)
+               if (code != 0) {

                        goto badcode;
                        goto badcode;

-               if (icmp6len < sizeof(struct nd_router_solicit))
+               }
+               if (icmp6len < sizeof(struct nd_router_solicit)) {

                        goto badlen;
                        goto badlen;

+               }
+

                if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
                        /* give up local */
                        nd6_rs_input(m, off, icmp6len);
                if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
                        /* give up local */
                        nd6_rs_input(m, off, icmp6len);


@@ -662,14 +819,17 @@ icmp6_input(mp, offp)
                }
                nd6_rs_input(n, off, icmp6len);
                /* m stays. */
                }
                nd6_rs_input(n, off, icmp6len);
                /* m stays. */

-               break;
+               goto rate_limit_checked;

 
        case ND_ROUTER_ADVERT:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_routeradvert);
 
        case ND_ROUTER_ADVERT:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_routeradvert);

-               if (code != 0)
+               if (code != 0) {

                        goto badcode;
                        goto badcode;

-               if (icmp6len < sizeof(struct nd_router_advert))
+               }
+               if (icmp6len < sizeof(struct nd_router_advert)) {

                        goto badlen;
                        goto badlen;

+               }
+

                if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
                        /* give up local */
                        nd6_ra_input(m, off, icmp6len);
                if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
                        /* give up local */
                        nd6_ra_input(m, off, icmp6len);


@@ -678,15 +838,19 @@ icmp6_input(mp, offp)
                }
                nd6_ra_input(n, off, icmp6len);
                /* m stays. */
                }
                nd6_ra_input(n, off, icmp6len);
                /* m stays. */

-               break;
+               goto rate_limit_checked;

 
        case ND_NEIGHBOR_SOLICIT:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_neighborsolicit);
 
        case ND_NEIGHBOR_SOLICIT:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_neighborsolicit);

-               if (code != 0)
+               if (code != 0) {

                        goto badcode;
                        goto badcode;

-               if (icmp6len < sizeof(struct nd_neighbor_solicit))
+               }
+               if (icmp6len < sizeof(struct nd_neighbor_solicit)) {

                        goto badlen;
                        goto badlen;

-               if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
+               }
+
+               if (proxy ||
+                   ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL)) {

                        /* give up local */
                        nd6_ns_input(m, off, icmp6len);
                        m = NULL;
                        /* give up local */
                        nd6_ns_input(m, off, icmp6len);
                        m = NULL;


@@ -694,14 +858,17 @@ icmp6_input(mp, offp)
                }
                nd6_ns_input(n, off, icmp6len);
                /* m stays. */
                }
                nd6_ns_input(n, off, icmp6len);
                /* m stays. */

-               break;
+               goto rate_limit_checked;

 
        case ND_NEIGHBOR_ADVERT:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_neighboradvert);
 
        case ND_NEIGHBOR_ADVERT:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_neighboradvert);

-               if (code != 0)
+               if (code != 0) {

                        goto badcode;
                        goto badcode;

-               if (icmp6len < sizeof(struct nd_neighbor_advert))
+               }
+               if (icmp6len < sizeof(struct nd_neighbor_advert)) {

                        goto badlen;
                        goto badlen;

+               }
+

                if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
                        /* give up local */
                        nd6_na_input(m, off, icmp6len);
                if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
                        /* give up local */
                        nd6_na_input(m, off, icmp6len);


@@ -710,14 +877,17 @@ icmp6_input(mp, offp)
                }
                nd6_na_input(n, off, icmp6len);
                /* m stays. */
                }
                nd6_na_input(n, off, icmp6len);
                /* m stays. */

-               break;
+               goto rate_limit_checked;

 
        case ND_REDIRECT:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_redirect);
 
        case ND_REDIRECT:
                icmp6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_redirect);

-               if (code != 0)
+               if (code != 0) {

                        goto badcode;
                        goto badcode;

-               if (icmp6len < sizeof(struct nd_redirect))
+               }
+               if (icmp6len < sizeof(struct nd_redirect)) {

                        goto badlen;
                        goto badlen;

+               }
+

                if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
                        /* give up local */
                        icmp6_redirect_input(m, off);
                if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
                        /* give up local */
                        icmp6_redirect_input(m, off);


@@ -726,14 +896,16 @@ icmp6_input(mp, offp)
                }
                icmp6_redirect_input(n, off);
                /* m stays. */
                }
                icmp6_redirect_input(n, off);
                /* m stays. */

-               break;
+               goto rate_limit_checked;

 
        case ICMP6_ROUTER_RENUMBERING:
                if (code != ICMP6_ROUTER_RENUMBERING_COMMAND &&
 
        case ICMP6_ROUTER_RENUMBERING:
                if (code != ICMP6_ROUTER_RENUMBERING_COMMAND &&

-                   code != ICMP6_ROUTER_RENUMBERING_RESULT)
+                   code != ICMP6_ROUTER_RENUMBERING_RESULT) {

                        goto badcode;
                        goto badcode;

-               if (icmp6len < sizeof(struct icmp6_router_renum))
+               }
+               if (icmp6len < sizeof(struct icmp6_router_renum)) {

                        goto badlen;
                        goto badlen;

+               }

                break;
 
        default:
                break;
 
        default:


@@ -748,38 +920,35 @@ icmp6_input(mp, offp)
                        /* deliver */
                } else {
                        /* ICMPv6 informational: MUST not deliver */
                        /* deliver */
                } else {
                        /* ICMPv6 informational: MUST not deliver */

-                       break;
+                       goto rate_limit_checked;

                }
                }

-       deliver:
+deliver:

                if (icmp6_notify_error(m, off, icmp6len, code)) {
                        /* In this case, m should've been freed. */
                if (icmp6_notify_error(m, off, icmp6len, code)) {
                        /* In this case, m should've been freed. */

-                       return(IPPROTO_DONE);
+                       return IPPROTO_DONE;

                }
                break;
 
                }
                break;
 

-       badcode:
+badcode:

                icmp6stat.icp6s_badcode++;
                break;
 
                icmp6stat.icp6s_badcode++;
                break;
 

-       badlen:
+badlen:

                icmp6stat.icp6s_badlen++;
                break;
        }
 
                icmp6stat.icp6s_badlen++;
                break;
        }
 

-       /* deliver the packet to appropriate sockets */
+rate_limit_checked:

        icmp6_rip6_input(&m, *offp);
        icmp6_rip6_input(&m, *offp);

-

        return IPPROTO_DONE;
 
        return IPPROTO_DONE;
 

- freeit:
+freeit:

        m_freem(m);
        return IPPROTO_DONE;
 }
 
 static int
        m_freem(m);
        return IPPROTO_DONE;
 }
 
 static int

-icmp6_notify_error(m, off, icmp6len, code)
-       struct mbuf *m;
-       int off, icmp6len, code;
+icmp6_notify_error(struct mbuf *m, int off, int icmp6len, int code)

 {
        struct icmp6_hdr *icmp6;
        struct ip6_hdr *eip6;
 {
        struct icmp6_hdr *icmp6;
        struct ip6_hdr *eip6;


@@ -792,25 +961,25 @@ icmp6_notify_error(m, off, icmp6len, code)
        }
 #ifndef PULLDOWN_TEST
        IP6_EXTHDR_CHECK(m, off,
        }
 #ifndef PULLDOWN_TEST
        IP6_EXTHDR_CHECK(m, off,

-                        sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr),
-                        return -1);
+           sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr),
+           return -1);

        icmp6 = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
 #else
        IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off,
        icmp6 = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
 #else
        IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off,

-                      sizeof(*icmp6) + sizeof(struct ip6_hdr));
+           sizeof(*icmp6) + sizeof(struct ip6_hdr));

        if (icmp6 == NULL) {
                icmp6stat.icp6s_tooshort++;
        if (icmp6 == NULL) {
                icmp6stat.icp6s_tooshort++;

-               return(-1);
+               return -1;

        }
 #endif
        eip6 = (struct ip6_hdr *)(icmp6 + 1);
 
        /* Detect the upper level protocol */
        {
        }
 #endif
        eip6 = (struct ip6_hdr *)(icmp6 + 1);
 
        /* Detect the upper level protocol */
        {

-               void (*ctlfunc)(int, struct sockaddr *, void *);
+               void (*ctlfunc)(int, struct sockaddr *, void *, struct ifnet *);

                u_int8_t nxt = eip6->ip6_nxt;
                int eoff = off + sizeof(struct icmp6_hdr) +
                u_int8_t nxt = eip6->ip6_nxt;
                int eoff = off + sizeof(struct icmp6_hdr) +

-                       sizeof(struct ip6_hdr);
+                   sizeof(struct ip6_hdr);

                struct ip6ctlparam ip6cp;
                struct in6_addr *finaldst = NULL;
                int icmp6type = icmp6->icmp6_type;
                struct ip6ctlparam ip6cp;
                struct in6_addr *finaldst = NULL;
                int icmp6type = icmp6->icmp6_type;


@@ -827,24 +996,24 @@ icmp6_notify_error(m, off, icmp6len, code)
                        case IPPROTO_DSTOPTS:
                        case IPPROTO_AH:
 #ifndef PULLDOWN_TEST
                        case IPPROTO_DSTOPTS:
                        case IPPROTO_AH:
 #ifndef PULLDOWN_TEST

-                               IP6_EXTHDR_CHECK(m, 0, eoff +
-                                                sizeof(struct ip6_ext),
-                                                return -1);
+                               IP6_EXTHDR_CHECK(m, 0,
+                                   eoff + sizeof(struct ip6_ext), return -1);

                                eh = (struct ip6_ext *)(mtod(m, caddr_t)
                                eh = (struct ip6_ext *)(mtod(m, caddr_t)

-                                                       + eoff);
+                                   + eoff);

 #else
                                IP6_EXTHDR_GET(eh, struct ip6_ext *, m,
 #else
                                IP6_EXTHDR_GET(eh, struct ip6_ext *, m,

-                                              eoff, sizeof(*eh));
+                                   eoff, sizeof(*eh));

                                if (eh == NULL) {
                                        icmp6stat.icp6s_tooshort++;
                                if (eh == NULL) {
                                        icmp6stat.icp6s_tooshort++;

-                                       return(-1);
+                                       return -1;

                                }
 #endif
                                }
 #endif

-                               
-                               if (nxt == IPPROTO_AH)
+
+                               if (nxt == IPPROTO_AH) {

                                        eoff += (eh->ip6e_len + 2) << 2;
                                        eoff += (eh->ip6e_len + 2) << 2;

-                               else
+                               } else {

                                        eoff += (eh->ip6e_len + 1) << 3;
                                        eoff += (eh->ip6e_len + 1) << 3;

+                               }

                                nxt = eh->ip6e_nxt;
                                break;
                        case IPPROTO_ROUTING:
                                nxt = eh->ip6e_nxt;
                                break;
                        case IPPROTO_ROUTING:


@@ -858,15 +1027,15 @@ icmp6_notify_error(m, off, icmp6len, code)
                                 */
 #ifndef PULLDOWN_TEST
                                IP6_EXTHDR_CHECK(m, 0, eoff + sizeof(*rth),
                                 */
 #ifndef PULLDOWN_TEST
                                IP6_EXTHDR_CHECK(m, 0, eoff + sizeof(*rth),

-                                                return -1);
-                               rth = (struct ip6_rthdr *)(mtod(m, caddr_t)
-                                                          + eoff);
+                                   return -1);
+                               rth = (struct ip6_rthdr *)
+                                   (mtod(m, caddr_t) + eoff);

 #else
                                IP6_EXTHDR_GET(rth, struct ip6_rthdr *, m,
 #else
                                IP6_EXTHDR_GET(rth, struct ip6_rthdr *, m,

-                                              eoff, sizeof(*rth));
+                                   eoff, sizeof(*rth));

                                if (rth == NULL) {
                                        icmp6stat.icp6s_tooshort++;
                                if (rth == NULL) {
                                        icmp6stat.icp6s_tooshort++;

-                                       return(-1);
+                                       return -1;

                                }
 #endif
                                rthlen = (rth->ip6r_len + 1) << 3;
                                }
 #endif
                                rthlen = (rth->ip6r_len + 1) << 3;


@@ -884,21 +1053,22 @@ icmp6_notify_error(m, off, icmp6len, code)
 
 #ifndef PULLDOWN_TEST
                                        IP6_EXTHDR_CHECK(m, 0, eoff + rthlen,
 
 #ifndef PULLDOWN_TEST
                                        IP6_EXTHDR_CHECK(m, 0, eoff + rthlen,

-                                                        return -1);
+                                           return -1);

                                        rth0 = (struct ip6_rthdr0 *)(mtod(m, caddr_t) + eoff);
 #else
                                        IP6_EXTHDR_GET(rth0,
                                        rth0 = (struct ip6_rthdr0 *)(mtod(m, caddr_t) + eoff);
 #else
                                        IP6_EXTHDR_GET(rth0,

-                                                      struct ip6_rthdr0 *, m,
-                                                      eoff, rthlen);
+                                           struct ip6_rthdr0 *, m,
+                                           eoff, rthlen);

                                        if (rth0 == NULL) {
                                                icmp6stat.icp6s_tooshort++;
                                        if (rth0 == NULL) {
                                                icmp6stat.icp6s_tooshort++;

-                                               return(-1);
+                                               return -1;

                                        }
 #endif
                                        /* just ignore a bogus header */
                                        if ((rth0->ip6r0_len % 2) == 0 &&
                                        }
 #endif
                                        /* just ignore a bogus header */
                                        if ((rth0->ip6r0_len % 2) == 0 &&

-                                           (hops = rth0->ip6r0_len/2))
-                                               finaldst = (struct in6_addr *)(rth0 + 1) + (hops - 1);
+                                           (hops = rth0->ip6r0_len / 2)) {
+                                               finaldst = (struct in6_addr *)(void *)(rth0 + 1) + (hops - 1);
+                                       }

                                }
                                eoff += rthlen;
                                nxt = rth->ip6r_nxt;
                                }
                                eoff += rthlen;
                                nxt = rth->ip6r_nxt;


@@ -906,16 +1076,16 @@ icmp6_notify_error(m, off, icmp6len, code)
                        case IPPROTO_FRAGMENT:
 #ifndef PULLDOWN_TEST
                                IP6_EXTHDR_CHECK(m, 0, eoff +
                        case IPPROTO_FRAGMENT:
 #ifndef PULLDOWN_TEST
                                IP6_EXTHDR_CHECK(m, 0, eoff +

-                                                sizeof(struct ip6_frag),
-                                                return -1);
+                                   sizeof(struct ip6_frag),
+                                   return -1);

                                fh = (struct ip6_frag *)(mtod(m, caddr_t)
                                fh = (struct ip6_frag *)(mtod(m, caddr_t)

-                                                        + eoff);
+                                   + eoff);

 #else
                                IP6_EXTHDR_GET(fh, struct ip6_frag *, m,
 #else
                                IP6_EXTHDR_GET(fh, struct ip6_frag *, m,

-                                              eoff, sizeof(*fh));
+                                   eoff, sizeof(*fh));

                                if (fh == NULL) {
                                        icmp6stat.icp6s_tooshort++;
                                if (fh == NULL) {
                                        icmp6stat.icp6s_tooshort++;

-                                       return(-1);
+                                       return -1;

                                }
 #endif
                                /*
                                }
 #endif
                                /*


@@ -924,8 +1094,9 @@ icmp6_notify_error(m, off, icmp6len, code)
                                 * we'll go to the notify label for path MTU
                                 * discovery.
                                 */
                                 * we'll go to the notify label for path MTU
                                 * discovery.
                                 */

-                               if (fh->ip6f_offlg & IP6F_OFF_MASK)
+                               if (fh->ip6f_offlg & IP6F_OFF_MASK) {

                                        goto notify;
                                        goto notify;

+                               }

 
                                eoff += sizeof(struct ip6_frag);
                                nxt = fh->ip6f_nxt;
 
                                eoff += sizeof(struct ip6_frag);
                                nxt = fh->ip6f_nxt;


@@ -942,62 +1113,52 @@ icmp6_notify_error(m, off, icmp6len, code)
                                goto notify;
                        }
                }
                                goto notify;
                        }
                }

-         notify:
+notify:

 #ifndef PULLDOWN_TEST
                icmp6 = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
 #else
                IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off,
 #ifndef PULLDOWN_TEST
                icmp6 = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
 #else
                IP6_EXTHDR_GET(icmp6, struct icmp6_hdr *, m, off,

-                              sizeof(*icmp6) + sizeof(struct ip6_hdr));
+                   sizeof(*icmp6) + sizeof(struct ip6_hdr));

                if (icmp6 == NULL) {
                        icmp6stat.icp6s_tooshort++;
                if (icmp6 == NULL) {
                        icmp6stat.icp6s_tooshort++;

-                       return(-1);
+                       return -1;

                }
 #endif
 
                }
 #endif
 

+               /*
+                * retrieve parameters from the inner IPv6 header, and convert
+                * them into sockaddr structures.
+                * XXX: there is no guarantee that the source or destination
+                * addresses of the inner packet are in the same scope as
+                * the addresses of the icmp packet.  But there is no other
+                * way to determine the zone.
+                */

                eip6 = (struct ip6_hdr *)(icmp6 + 1);
                eip6 = (struct ip6_hdr *)(icmp6 + 1);

+

                bzero(&icmp6dst, sizeof(icmp6dst));
                icmp6dst.sin6_len = sizeof(struct sockaddr_in6);
                icmp6dst.sin6_family = AF_INET6;
                bzero(&icmp6dst, sizeof(icmp6dst));
                icmp6dst.sin6_len = sizeof(struct sockaddr_in6);
                icmp6dst.sin6_family = AF_INET6;

-               if (finaldst == NULL)
+               if (finaldst == NULL) {

                        icmp6dst.sin6_addr = eip6->ip6_dst;
                        icmp6dst.sin6_addr = eip6->ip6_dst;

-               else
+               } else {

                        icmp6dst.sin6_addr = *finaldst;
                        icmp6dst.sin6_addr = *finaldst;

-               icmp6dst.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.rcvif,
-                                                         &icmp6dst.sin6_addr);
-#ifndef SCOPEDROUTING
-               if (in6_embedscope(&icmp6dst.sin6_addr, &icmp6dst,
-                                  NULL, NULL)) {
-                       /* should be impossbile */
-                       nd6log((LOG_DEBUG,
-                           "icmp6_notify_error: in6_embedscope failed\n"));
+               }
+               if (in6_setscope(&icmp6dst.sin6_addr, m->m_pkthdr.rcvif, NULL)) {

                        goto freeit;
                }
                        goto freeit;
                }

-#endif
-
-               /*
-                * retrieve parameters from the inner IPv6 header, and convert
-                * them into sockaddr structures.
-                */

                bzero(&icmp6src, sizeof(icmp6src));
                icmp6src.sin6_len = sizeof(struct sockaddr_in6);
                icmp6src.sin6_family = AF_INET6;
                icmp6src.sin6_addr = eip6->ip6_src;
                bzero(&icmp6src, sizeof(icmp6src));
                icmp6src.sin6_len = sizeof(struct sockaddr_in6);
                icmp6src.sin6_family = AF_INET6;
                icmp6src.sin6_addr = eip6->ip6_src;

-               icmp6src.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.rcvif,
-                                                         &icmp6src.sin6_addr);
-#ifndef SCOPEDROUTING
-               if (in6_embedscope(&icmp6src.sin6_addr, &icmp6src,
-                                  NULL, NULL)) {
-                       /* should be impossbile */
-                       nd6log((LOG_DEBUG,
-                           "icmp6_notify_error: in6_embedscope failed\n"));
+               if (in6_setscope(&icmp6src.sin6_addr, m->m_pkthdr.rcvif, NULL)) {

                        goto freeit;
                }
                        goto freeit;
                }

-#endif

                icmp6src.sin6_flowinfo =
                icmp6src.sin6_flowinfo =

-                       (eip6->ip6_flow & IPV6_FLOWLABEL_MASK);
+                   (eip6->ip6_flow & IPV6_FLOWLABEL_MASK);

 
 

-               if (finaldst == NULL)
+               if (finaldst == NULL) {

                        finaldst = &eip6->ip6_dst;
                        finaldst = &eip6->ip6_dst;

+               }

                ip6cp.ip6c_m = m;
                ip6cp.ip6c_icmp6 = icmp6;
                ip6cp.ip6c_ip6 = (struct ip6_hdr *)(icmp6 + 1);
                ip6cp.ip6c_m = m;
                ip6cp.ip6c_icmp6 = icmp6;
                ip6cp.ip6c_ip6 = (struct ip6_hdr *)(icmp6 + 1);


@@ -1009,37 +1170,58 @@ icmp6_notify_error(m, off, icmp6len, code)
                if (icmp6type == ICMP6_PACKET_TOO_BIG) {
                        notifymtu = ntohl(icmp6->icmp6_mtu);
                        ip6cp.ip6c_cmdarg = (void *)&notifymtu;
                if (icmp6type == ICMP6_PACKET_TOO_BIG) {
                        notifymtu = ntohl(icmp6->icmp6_mtu);
                        ip6cp.ip6c_cmdarg = (void *)&notifymtu;

-                       icmp6_mtudisc_update(&ip6cp, 1);        /*XXX*/
+                       icmp6_mtudisc_update(&ip6cp, 1);        /*XXX*/

                }
 
                }
 

-               ctlfunc = (void (*)(int, struct sockaddr *, void *))
-                       (ip6_protox[nxt]->pr_ctlinput);
+               ctlfunc = ip6_protox[nxt]->pr_ctlinput;

                if (ctlfunc) {
                if (ctlfunc) {

+                       LCK_MTX_ASSERT(inet6_domain_mutex, LCK_MTX_ASSERT_OWNED);
+
+                       lck_mtx_unlock(inet6_domain_mutex);
+

                        (void) (*ctlfunc)(code, (struct sockaddr *)&icmp6dst,
                        (void) (*ctlfunc)(code, (struct sockaddr *)&icmp6dst,

-                                         &ip6cp);
+                           &ip6cp, m->m_pkthdr.rcvif);
+
+                       lck_mtx_lock(inet6_domain_mutex);

                }
        }
                }
        }

-       return(0);
+       return 0;

 
 

-  freeit:
+freeit:

        m_freem(m);
        m_freem(m);

-       return(-1);
+       return -1;

 }
 
 void
 }
 
 void

-icmp6_mtudisc_update(ip6cp, validated)
-       struct ip6ctlparam *ip6cp;
-       int validated;
+icmp6_mtudisc_update(struct ip6ctlparam *ip6cp, int validated)

 {
        struct in6_addr *dst = ip6cp->ip6c_finaldst;
        struct icmp6_hdr *icmp6 = ip6cp->ip6c_icmp6;
 {
        struct in6_addr *dst = ip6cp->ip6c_finaldst;
        struct icmp6_hdr *icmp6 = ip6cp->ip6c_icmp6;

-       struct mbuf *m = ip6cp->ip6c_m; /* will be necessary for scope issue */
+       struct mbuf *m = ip6cp->ip6c_m; /* will be necessary for scope issue */

        u_int mtu = ntohl(icmp6->icmp6_mtu);
        struct rtentry *rt = NULL;
        struct sockaddr_in6 sin6;
        u_int mtu = ntohl(icmp6->icmp6_mtu);
        struct rtentry *rt = NULL;
        struct sockaddr_in6 sin6;

+       /*
+        * we reject ICMPv6 too big with abnormally small value.
+        * XXX what is the good definition of "abnormally small"?
+        */
+       if (mtu < sizeof(struct ip6_hdr) + sizeof(struct ip6_frag) + 8) {
+               return;
+       }

 
 

-       if (!validated)
+       if (!validated) {

                return;
                return;

+       }
+
+       /*
+        * In case the suggested mtu is less than IPV6_MMTU, we
+        * only need to remember that it was for above mentioned
+        * "alwaysfrag" case.
+        * Try to be as close to the spec as possible.
+        */
+       if (mtu < IPV6_MMTU) {
+               mtu = IPV6_MMTU - 8;
+       }

 
        bzero(&sin6, sizeof(sin6));
        sin6.sin6_family = PF_INET6;
 
        bzero(&sin6, sizeof(sin6));
        sin6.sin6_family = PF_INET6;


@@ -1051,28 +1233,33 @@ icmp6_mtudisc_update(ip6cp, validated)
                    htons(m->m_pkthdr.rcvif->if_index);
        }
        /* sin6.sin6_scope_id = XXX: should be set if DST is a scoped addr */
                    htons(m->m_pkthdr.rcvif->if_index);
        }
        /* sin6.sin6_scope_id = XXX: should be set if DST is a scoped addr */

-       rt = rtalloc1((struct sockaddr *)&sin6, 0,
-                     RTF_CLONING | RTF_PRCLONING);
-
-       if (rt && (rt->rt_flags & RTF_HOST)
-           && !(rt->rt_rmx.rmx_locks & RTV_MTU)) {
-               if (mtu < IPV6_MMTU) {
-                               /* xxx */
-                       rt->rt_rmx.rmx_locks |= RTV_MTU;
-               } else if (mtu < rt->rt_ifp->if_mtu &&
-                          rt->rt_rmx.rmx_mtu > mtu) {
+       /*
+        * XXX On a side note, for asymmetric data-path
+        * the lookup on receive interace is probably not
+        * what we want to do.
+        * That requires looking at the cached route for the
+        * protocol control block.
+        */
+       rt = rtalloc1_scoped((struct sockaddr *)&sin6, 0,
+           RTF_CLONING | RTF_PRCLONING, m->m_pkthdr.rcvif->if_index);
+       if (rt != NULL) {
+               RT_LOCK(rt);
+               if ((rt->rt_flags & RTF_HOST) &&
+                   !(rt->rt_rmx.rmx_locks & RTV_MTU) &&
+                   mtu < IN6_LINKMTU(rt->rt_ifp) &&
+                   rt->rt_rmx.rmx_mtu > mtu) {

                        icmp6stat.icp6s_pmtuchg++;
                        rt->rt_rmx.rmx_mtu = mtu;
                }
                        icmp6stat.icp6s_pmtuchg++;
                        rt->rt_rmx.rmx_mtu = mtu;
                }

-       }
-       if (rt)
+               RT_UNLOCK(rt);

                rtfree(rt);
                rtfree(rt);

+       }

 }
 
 /*
  * Process a Node Information Query packet, based on
  * draft-ietf-ipngwg-icmp-name-lookups-07.
 }
 
 /*
  * Process a Node Information Query packet, based on
  * draft-ietf-ipngwg-icmp-name-lookups-07.

- * 
+ *

  * Spec incompatibilities:
  * - IPv6 Subject address handling
  * - IPv4 Subject address handling support missing
  * Spec incompatibilities:
  * - IPv6 Subject address handling
  * - IPv4 Subject address handling support missing


@@ -1080,11 +1267,9 @@ icmp6_mtudisc_update(ip6cp, validated)
  * - joins NI group address at in6_ifattach() time only, does not cope
  *   with hostname changes by sethostname(3)
  */
  * - joins NI group address at in6_ifattach() time only, does not cope
  *   with hostname changes by sethostname(3)
  */

-#define hostnamelen    strlen(hostname)
+#define hostnamelen     strlen(hostname)

 static struct mbuf *
 static struct mbuf *

-ni6_input(m, off)
-       struct mbuf *m;
-       int off;
+ni6_input(struct mbuf *m, int off)

 {
        struct icmp6_nodeinfo *ni6, *nni6;
        struct mbuf *n = NULL;
 {
        struct icmp6_nodeinfo *ni6, *nni6;
        struct mbuf *n = NULL;


@@ -1092,14 +1277,13 @@ ni6_input(m, off)
        int subjlen;
        int replylen = sizeof(struct ip6_hdr) + sizeof(struct icmp6_nodeinfo);
        struct ni_reply_fqdn *fqdn;
        int subjlen;
        int replylen = sizeof(struct ip6_hdr) + sizeof(struct icmp6_nodeinfo);
        struct ni_reply_fqdn *fqdn;

-       int addrs;              /* for NI_QTYPE_NODEADDR */
+       int addrs;              /* for NI_QTYPE_NODEADDR */

        struct ifnet *ifp = NULL; /* for NI_QTYPE_NODEADDR */
        struct sockaddr_in6 sin6; /* double meaning; ip6_dst and subjectaddr */
        struct sockaddr_in6 sin6_d; /* XXX: we should retrieve this from m_aux */
        struct ip6_hdr *ip6;
        struct ifnet *ifp = NULL; /* for NI_QTYPE_NODEADDR */
        struct sockaddr_in6 sin6; /* double meaning; ip6_dst and subjectaddr */
        struct sockaddr_in6 sin6_d; /* XXX: we should retrieve this from m_aux */
        struct ip6_hdr *ip6;

-       int oldfqdn = 0;        /* if 1, return pascal string (03 draft) */
+       int oldfqdn = 0;        /* if 1, return pascal string (03 draft) */

        char *subj = NULL;
        char *subj = NULL;

-       struct in6_ifaddr *ia6 = NULL;

 
        ip6 = mtod(m, struct ip6_hdr *);
 #ifndef PULLDOWN_TEST
 
        ip6 = mtod(m, struct ip6_hdr *);
 #ifndef PULLDOWN_TEST


@@ -1112,36 +1296,52 @@ ni6_input(m, off)
        }
 #endif
 
        }
 #endif
 

+       /*
+        * Validate IPv6 source address.
+        * The default configuration MUST be to refuse answering queries from
+        * global-scope addresses according to RFC4602.
+        * Notes:
+        *  - it's not very clear what "refuse" means; this implementation
+        *    simply drops it.
+        *  - it's not very easy to identify global-scope (unicast) addresses
+        *    since there are many prefixes for them.  It should be safer
+        *    and in practice sufficient to check "all" but loopback and
+        *    link-local (note that site-local unicast was deprecated and
+        *    ULA is defined as global scope-wise)
+        */
+       if ((icmp6_nodeinfo & ICMP6_NODEINFO_GLOBALOK) == 0 &&
+           !IN6_IS_ADDR_LOOPBACK(&ip6->ip6_src) &&
+           !IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src)) {
+               goto bad;
+       }
+

        /*
         * Validate IPv6 destination address.
         *
         * The Responder must discard the Query without further processing
         * unless it is one of the Responder's unicast or anycast addresses, or
         * a link-local scope multicast address which the Responder has joined.
        /*
         * Validate IPv6 destination address.
         *
         * The Responder must discard the Query without further processing
         * unless it is one of the Responder's unicast or anycast addresses, or
         * a link-local scope multicast address which the Responder has joined.

-        * [icmp-name-lookups-07, Section 4.]
+        * [RFC4602, Section 5.]

         */
         */

-       bzero(&sin6, sizeof(sin6));
-       sin6.sin6_family = AF_INET6;
-       sin6.sin6_len = sizeof(struct sockaddr_in6);
-       bcopy(&ip6->ip6_dst, &sin6.sin6_addr, sizeof(sin6.sin6_addr));
-       /* XXX scopeid */
-       if ((ia6 = (struct in6_ifaddr *)ifa_ifwithaddr((struct sockaddr *)&sin6)) != NULL) {
-               /* unicast/anycast, fine */
-               if ((ia6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
-                   (icmp6_nodeinfo & 4) == 0) {
-                   ifafree(&ia6->ia_ifa);
-                   ia6 = NULL;
+       if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
+               if (!IN6_IS_ADDR_MC_LINKLOCAL(&ip6->ip6_dst)) {
+                       goto bad;
+               }
+               /* else it's a link-local multicast, fine */
+       } else {                /* unicast or anycast */
+               uint32_t ia6_flags;
+
+               if (ip6_getdstifaddr_info(m, NULL, &ia6_flags) != 0) {
+                       goto bad; /* XXX impossible */
+               }
+               if ((ia6_flags & IN6_IFF_TEMPORARY) &&
+                   !(icmp6_nodeinfo & ICMP6_NODEINFO_TMPADDROK)) {

                        nd6log((LOG_DEBUG, "ni6_input: ignore node info to "
                        nd6log((LOG_DEBUG, "ni6_input: ignore node info to "

-                               "a temporary address in %s:%d",
-                              __FILE__, __LINE__));
+                           "a temporary address in %s:%d",
+                           __func__, __LINE__));

                        goto bad;
                }
                        goto bad;
                }

-               ifafree(&ia6->ia_ifa);
-               ia6 = NULL;
-       } else if (IN6_IS_ADDR_MC_LINKLOCAL(&sin6.sin6_addr))
-               ; /* link-local multicast, fine */
-       else
-               goto bad;
+       }

 
        /* validate query Subject field. */
        qtype = ntohs(ni6->ni_qtype);
 
        /* validate query Subject field. */
        qtype = ntohs(ni6->ni_qtype);


@@ -1150,11 +1350,13 @@ ni6_input(m, off)
        case NI_QTYPE_NOOP:
        case NI_QTYPE_SUPTYPES:
                /* 07 draft */
        case NI_QTYPE_NOOP:
        case NI_QTYPE_SUPTYPES:
                /* 07 draft */

-               if (ni6->ni_code == ICMP6_NI_SUBJ_FQDN && subjlen == 0)
+               if (ni6->ni_code == ICMP6_NI_SUBJ_FQDN && subjlen == 0) {

                        break;
                        break;

-               /* FALLTHROUGH */
+               }
+       /* FALLTHROUGH */

        case NI_QTYPE_FQDN:
        case NI_QTYPE_NODEADDR:
        case NI_QTYPE_FQDN:
        case NI_QTYPE_NODEADDR:

+       case NI_QTYPE_IPV4ADDR:

                switch (ni6->ni_code) {
                case ICMP6_NI_SUBJ_IPV6:
 #if ICMP6_NI_SUBJ_IPV6 != 0
                switch (ni6->ni_code) {
                case ICMP6_NI_SUBJ_IPV6:
 #if ICMP6_NI_SUBJ_IPV6 != 0


@@ -1170,12 +1372,14 @@ ni6_input(m, off)
                                break;
                        }
 #if ICMP6_NI_SUBJ_IPV6 != 0
                                break;
                        }
 #if ICMP6_NI_SUBJ_IPV6 != 0

-                       if (ni6->ni_code != ICMP6_NI_SUBJ_IPV6)
+                       if (ni6->ni_code != ICMP6_NI_SUBJ_IPV6) {

                                goto bad;
                                goto bad;

+                       }

 #endif
 
 #endif
 

-                       if (subjlen != sizeof(sin6.sin6_addr))
+                       if (subjlen != sizeof(struct in6_addr)) {

                                goto bad;
                                goto bad;

+                       }

 
                        /*
                         * Validate Subject address.
 
                        /*
                         * Validate Subject address.


@@ -1195,28 +1399,28 @@ ni6_input(m, off)
                        m_copydata(m, off + sizeof(struct icmp6_nodeinfo),
                            subjlen, (caddr_t)&sin6.sin6_addr);
                        sin6.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.rcvif,
                        m_copydata(m, off + sizeof(struct icmp6_nodeinfo),
                            subjlen, (caddr_t)&sin6.sin6_addr);
                        sin6.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.rcvif,

-                                                             &sin6.sin6_addr);
-#ifndef SCOPEDROUTING
-                       in6_embedscope(&sin6.sin6_addr, &sin6, NULL, NULL);
-#endif
+                           &sin6.sin6_addr);
+                       in6_embedscope(&sin6.sin6_addr, &sin6, NULL, NULL,
+                           NULL);

                        bzero(&sin6_d, sizeof(sin6_d));
                        sin6_d.sin6_family = AF_INET6; /* not used, actually */
                        sin6_d.sin6_len = sizeof(sin6_d); /* ditto */
                        sin6_d.sin6_addr = ip6->ip6_dst;
                        sin6_d.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.rcvif,
                        bzero(&sin6_d, sizeof(sin6_d));
                        sin6_d.sin6_family = AF_INET6; /* not used, actually */
                        sin6_d.sin6_len = sizeof(sin6_d); /* ditto */
                        sin6_d.sin6_addr = ip6->ip6_dst;
                        sin6_d.sin6_scope_id = in6_addr2scopeid(m->m_pkthdr.rcvif,

-                                                               &ip6->ip6_dst);
-#ifndef SCOPEDROUTING
-                       in6_embedscope(&sin6_d.sin6_addr, &sin6_d, NULL, NULL);
-#endif
+                           &ip6->ip6_dst);
+                       in6_embedscope(&sin6_d.sin6_addr, &sin6_d, NULL, NULL,
+                           NULL);

                        subj = (char *)&sin6;
                        subj = (char *)&sin6;

-                       if (SA6_ARE_ADDR_EQUAL(&sin6, &sin6_d))
+                       if (SA6_ARE_ADDR_EQUAL(&sin6, &sin6_d)) {

                                break;
                                break;

+                       }

 
                        /*
                         * XXX if we are to allow other cases, we should really
                         * be careful about scope here.
                         * basically, we should disallow queries toward IPv6
 
                        /*
                         * XXX if we are to allow other cases, we should really
                         * be careful about scope here.
                         * basically, we should disallow queries toward IPv6

-                        * destination X with subject Y, if scope(X) > scope(Y).
+                        * destination X with subject Y,
+                        * if scope(X) > scope(Y).

                         * if we allow scope(X) > scope(Y), it will result in
                         * information leakage across scope boundary.
                         */
                         * if we allow scope(X) > scope(Y), it will result in
                         * information leakage across scope boundary.
                         */


@@ -1235,21 +1439,23 @@ ni6_input(m, off)
                         *   truncated hostname.
                         */
                        n = ni6_nametodns(hostname, hostnamelen, 0);
                         *   truncated hostname.
                         */
                        n = ni6_nametodns(hostname, hostnamelen, 0);

-                       if (!n || n->m_next || n->m_len == 0)
+                       if (!n || n->m_next || n->m_len == 0) {

                                goto bad;
                                goto bad;

+                       }

                        IP6_EXTHDR_GET(subj, char *, m,
                            off + sizeof(struct icmp6_nodeinfo), subjlen);
                        IP6_EXTHDR_GET(subj, char *, m,
                            off + sizeof(struct icmp6_nodeinfo), subjlen);

-                       if (subj == NULL)
+                       if (subj == NULL) {

                                goto bad;
                                goto bad;

+                       }

                        if (!ni6_dnsmatch(subj, subjlen, mtod(n, const char *),
                        if (!ni6_dnsmatch(subj, subjlen, mtod(n, const char *),

-                                       n->m_len)) {
+                           n->m_len)) {

                                goto bad;
                        }
                        m_freem(n);
                        n = NULL;
                        break;
 
                                goto bad;
                        }
                        m_freem(n);
                        n = NULL;
                        break;
 

-               case ICMP6_NI_SUBJ_IPV4:        /* XXX: to be implemented? */
+               case ICMP6_NI_SUBJ_IPV4:        /* XXX: to be implemented? */

                default:
                        goto bad;
                }
                default:
                        goto bad;
                }


@@ -1259,19 +1465,22 @@ ni6_input(m, off)
        /* refuse based on configuration.  XXX ICMP6_NI_REFUSED? */
        switch (qtype) {
        case NI_QTYPE_FQDN:
        /* refuse based on configuration.  XXX ICMP6_NI_REFUSED? */
        switch (qtype) {
        case NI_QTYPE_FQDN:

-               if ((icmp6_nodeinfo & 1) == 0)
+               if ((icmp6_nodeinfo & ICMP6_NODEINFO_FQDNOK) == 0) {

                        goto bad;
                        goto bad;

+               }

                break;
        case NI_QTYPE_NODEADDR:
                break;
        case NI_QTYPE_NODEADDR:

-               if ((icmp6_nodeinfo & 2) == 0)
+       case NI_QTYPE_IPV4ADDR:
+               if ((icmp6_nodeinfo & ICMP6_NODEINFO_NODEADDROK) == 0) {

                        goto bad;
                        goto bad;

+               }

                break;
        }
 
        /* guess reply length */
        switch (qtype) {
        case NI_QTYPE_NOOP:
                break;
        }
 
        /* guess reply length */
        switch (qtype) {
        case NI_QTYPE_NOOP:

-               break;          /* no reply data */
+               break;          /* no reply data */

        case NI_QTYPE_SUPTYPES:
                replylen += sizeof(u_int32_t);
                break;
        case NI_QTYPE_SUPTYPES:
                replylen += sizeof(u_int32_t);
                break;


@@ -1282,13 +1491,17 @@ ni6_input(m, off)
        case NI_QTYPE_NODEADDR:
                addrs = ni6_addrs(ni6, &ifp, subj);
                if ((replylen += addrs * (sizeof(struct in6_addr) +
        case NI_QTYPE_NODEADDR:
                addrs = ni6_addrs(ni6, &ifp, subj);
                if ((replylen += addrs * (sizeof(struct in6_addr) +

-                                         sizeof(u_int32_t))) > MCLBYTES)
+                   sizeof(u_int32_t))) > MCLBYTES) {

                        replylen = MCLBYTES; /* XXX: will truncate pkt later */
                        replylen = MCLBYTES; /* XXX: will truncate pkt later */

+               }
+               break;
+       case NI_QTYPE_IPV4ADDR:
+               /* unsupported - should respond with unknown Qtype? */

                break;
        default:
                /*
                 * XXX: We must return a reply with the ICMP6 code
                break;
        default:
                /*
                 * XXX: We must return a reply with the ICMP6 code

-                * `unknown Qtype' in this case. However we regard the case
+                * `unknown Qtype' in this case.  However we regard the case

                 * as an FQDN query for backward compatibility.
                 * Older versions set a random value to this field,
                 * so it rarely varies in the defined qtypes.
                 * as an FQDN query for backward compatibility.
                 * Older versions set a random value to this field,
                 * so it rarely varies in the defined qtypes.


@@ -1303,10 +1516,13 @@ ni6_input(m, off)
        }
 
        /* allocate an mbuf to reply. */
        }
 
        /* allocate an mbuf to reply. */

-       MGETHDR(n, M_DONTWAIT, m->m_type);
+       MGETHDR(n, M_DONTWAIT, m->m_type);      /* MAC-OK */

        if (n == NULL) {
                m_freem(m);
        if (n == NULL) {
                m_freem(m);

-               return(NULL);
+               if (ifp != NULL) {
+                       ifnet_release(ifp);
+               }
+               return NULL;

        }
        M_COPY_PKTHDR(n, m); /* just for recvif */
        if (replylen > MHLEN) {
        }
        M_COPY_PKTHDR(n, m); /* just for recvif */
        if (replylen > MHLEN) {


@@ -1339,7 +1555,7 @@ ni6_input(m, off)
        {
                u_int32_t v;
                nni6->ni_code = ICMP6_NI_SUCCESS;
        {
                u_int32_t v;
                nni6->ni_code = ICMP6_NI_SUCCESS;

-               nni6->ni_flags = htons(0x0000); /* raw bitmap */
+               nni6->ni_flags = htons(0x0000); /* raw bitmap */

                /* supports NOOP, SUPTYPES, FQDN, and NODEADDR */
                v = (u_int32_t)htonl(0x0000000f);
                bcopy(&v, nni6 + 1, sizeof(u_int32_t));
                /* supports NOOP, SUPTYPES, FQDN, and NODEADDR */
                v = (u_int32_t)htonl(0x0000000f);
                bcopy(&v, nni6 + 1, sizeof(u_int32_t));


@@ -1348,19 +1564,21 @@ ni6_input(m, off)
        case NI_QTYPE_FQDN:
                nni6->ni_code = ICMP6_NI_SUCCESS;
                fqdn = (struct ni_reply_fqdn *)(mtod(n, caddr_t) +
        case NI_QTYPE_FQDN:
                nni6->ni_code = ICMP6_NI_SUCCESS;
                fqdn = (struct ni_reply_fqdn *)(mtod(n, caddr_t) +

-                                               sizeof(struct ip6_hdr) +
-                                               sizeof(struct icmp6_nodeinfo));
+                   sizeof(struct ip6_hdr) +
+                   sizeof(struct icmp6_nodeinfo));

                nni6->ni_flags = 0; /* XXX: meaningless TTL */
                nni6->ni_flags = 0; /* XXX: meaningless TTL */

-               fqdn->ni_fqdn_ttl = 0;  /* ditto. */
+               fqdn->ni_fqdn_ttl = 0;  /* ditto. */

                /*
                 * XXX do we really have FQDN in variable "hostname"?
                 */
                n->m_next = ni6_nametodns(hostname, hostnamelen, oldfqdn);
                /*
                 * XXX do we really have FQDN in variable "hostname"?
                 */
                n->m_next = ni6_nametodns(hostname, hostnamelen, oldfqdn);

-               if (n->m_next == NULL)
+               if (n->m_next == NULL) {

                        goto bad;
                        goto bad;

+               }

                /* XXX we assume that n->m_next is not a chain */
                /* XXX we assume that n->m_next is not a chain */

-               if (n->m_next->m_next != NULL)
+               if (n->m_next->m_next != NULL) {

                        goto bad;
                        goto bad;

+               }

                n->m_pkthdr.len += n->m_next->m_len;
                break;
        case NI_QTYPE_NODEADDR:
                n->m_pkthdr.len += n->m_next->m_len;
                break;
        case NI_QTYPE_NODEADDR:


@@ -1374,22 +1592,29 @@ ni6_input(m, off)
                copied = ni6_store_addrs(ni6, nni6, ifp, lenlim);
                /* XXX: reset mbuf length */
                n->m_pkthdr.len = n->m_len = sizeof(struct ip6_hdr) +
                copied = ni6_store_addrs(ni6, nni6, ifp, lenlim);
                /* XXX: reset mbuf length */
                n->m_pkthdr.len = n->m_len = sizeof(struct ip6_hdr) +

-                       sizeof(struct icmp6_nodeinfo) + copied;
+                   sizeof(struct icmp6_nodeinfo) + copied;

                break;
        }
        default:
                break;
        }
        default:

-               break;          /* XXX impossible! */
+               break;          /* XXX impossible! */

        }
 
        nni6->ni_type = ICMP6_NI_REPLY;
        m_freem(m);
        }
 
        nni6->ni_type = ICMP6_NI_REPLY;
        m_freem(m);

-       return(n);
+       if (ifp != NULL) {
+               ifnet_release(ifp);
+       }
+       return n;

 
 

-  bad:
+bad:

        m_freem(m);
        m_freem(m);

-       if (n)
+       if (n) {

                m_freem(n);
                m_freem(n);

-       return(NULL);
+       }
+       if (ifp != NULL) {
+               ifnet_release(ifp);
+       }
+       return NULL;

 }
 #undef hostnamelen
 
 }
 #undef hostnamelen
 


@@ -1400,30 +1625,33 @@ ni6_input(m, off)
  * treated as truncated name (two \0 at the end).  this is a wild guess.
  */
 static struct mbuf *
  * treated as truncated name (two \0 at the end).  this is a wild guess.
  */
 static struct mbuf *

-ni6_nametodns(name, namelen, old)
-       const char *name;
-       int namelen;
-       int old;        /* return pascal string if non-zero */
+ni6_nametodns(
+       const char *name,
+       int namelen,
+       int old)        /* return pascal string if non-zero */

 {
        struct mbuf *m;
        char *cp, *ep;
        const char *p, *q;
        int i, len, nterm;
 
 {
        struct mbuf *m;
        char *cp, *ep;
        const char *p, *q;
        int i, len, nterm;
 

-       if (old)
+       if (old) {

                len = namelen + 1;
                len = namelen + 1;

-       else
+       } else {

                len = MCLBYTES;
                len = MCLBYTES;

+       }

 
        /* because MAXHOSTNAMELEN is usually 256, we use cluster mbuf */
        MGET(m, M_DONTWAIT, MT_DATA);
        if (m && len > MLEN) {
                MCLGET(m, M_DONTWAIT);
 
        /* because MAXHOSTNAMELEN is usually 256, we use cluster mbuf */
        MGET(m, M_DONTWAIT, MT_DATA);
        if (m && len > MLEN) {
                MCLGET(m, M_DONTWAIT);

-               if ((m->m_flags & M_EXT) == 0)
+               if ((m->m_flags & M_EXT) == 0) {

                        goto fail;
                        goto fail;

+               }

        }
        }

-       if (!m)
+       if (!m) {

                goto fail;
                goto fail;

+       }

        m->m_next = NULL;
 
        if (old) {
        m->m_next = NULL;
 
        if (old) {


@@ -1437,8 +1665,9 @@ ni6_nametodns(name, namelen, old)
                ep = mtod(m, char *) + M_TRAILINGSPACE(m);
 
                /* if not certain about my name, return empty buffer */
                ep = mtod(m, char *) + M_TRAILINGSPACE(m);
 
                /* if not certain about my name, return empty buffer */

-               if (namelen == 0)
+               if (namelen == 0) {

                        return m;
                        return m;

+               }

 
                /*
                 * guess if it looks like shortened hostname, or FQDN.
 
                /*
                 * guess if it looks like shortened hostname, or FQDN.


@@ -1446,41 +1675,49 @@ ni6_nametodns(name, namelen, old)
                 */
                i = 0;
                for (p = name; p < name + namelen; p++) {
                 */
                i = 0;
                for (p = name; p < name + namelen; p++) {

-                       if (*p && *p == '.')
+                       if (*p && *p == '.') {

                                i++;
                                i++;

+                       }

                }
                }

-               if (i < 2)
+               if (i < 2) {

                        nterm = 2;
                        nterm = 2;

-               else
+               } else {

                        nterm = 1;
                        nterm = 1;

+               }

 
                p = name;
                while (cp < ep && p < name + namelen) {
                        i = 0;
 
                p = name;
                while (cp < ep && p < name + namelen) {
                        i = 0;

-                       for (q = p; q < name + namelen && *q && *q != '.'; q++)
+                       for (q = p; q < name + namelen && *q && *q != '.'; q++) {

                                i++;
                                i++;

+                       }

                        /* result does not fit into mbuf */
                        /* result does not fit into mbuf */

-                       if (cp + i + 1 >= ep)
+                       if (cp + i + 1 >= ep) {

                                goto fail;
                                goto fail;

+                       }

                        /*
                         * DNS label length restriction, RFC1035 page 8.
                         * "i == 0" case is included here to avoid returning
                         * 0-length label on "foo..bar".
                         */
                        /*
                         * DNS label length restriction, RFC1035 page 8.
                         * "i == 0" case is included here to avoid returning
                         * 0-length label on "foo..bar".
                         */

-                       if (i <= 0 || i >= 64)
+                       if (i <= 0 || i >= 64) {

                                goto fail;
                                goto fail;

+                       }

                        *cp++ = i;
                        bcopy(p, cp, i);
                        cp += i;
                        p = q;
                        *cp++ = i;
                        bcopy(p, cp, i);
                        cp += i;
                        p = q;

-                       if (p < name + namelen && *p == '.')
+                       if (p < name + namelen && *p == '.') {

                                p++;
                                p++;

+                       }

                }
                /* termination */
                }
                /* termination */

-               if (cp + nterm >= ep)
+               if (cp + nterm >= ep) {

                        goto fail;
                        goto fail;

-               while (nterm-- > 0)
+               }
+               while (nterm-- > 0) {

                        *cp++ = '\0';
                        *cp++ = '\0';

+               }

                m->m_len = cp - mtod(m, char *);
                return m;
        }
                m->m_len = cp - mtod(m, char *);
                return m;
        }


@@ -1488,9 +1725,10 @@ ni6_nametodns(name, namelen, old)
        panic("should not reach here");
        /* NOTREACHED */
 
        panic("should not reach here");
        /* NOTREACHED */
 

- fail:
-       if (m)
+fail:
+       if (m) {

                m_freem(m);
                m_freem(m);

+       }

        return NULL;
 }
 
        return NULL;
 }
 


@@ -1500,74 +1738,80 @@ ni6_nametodns(name, namelen, old)
  * XXX upper/lowercase match (see RFC2065)
  */
 static int
  * XXX upper/lowercase match (see RFC2065)
  */
 static int

-ni6_dnsmatch(a, alen, b, blen)
-       const char *a;
-       int alen;
-       const char *b;
-       int blen;
+ni6_dnsmatch(const char *a, int alen, const char *b, int blen)

 {
        const char *a0, *b0;
        int l;
 
        /* simplest case - need validation? */
 {
        const char *a0, *b0;
        int l;
 
        /* simplest case - need validation? */

-       if (alen == blen && bcmp(a, b, alen) == 0)
+       if (alen == blen && bcmp(a, b, alen) == 0) {

                return 1;
                return 1;

+       }

 
        a0 = a;
        b0 = b;
 
        /* termination is mandatory */
 
        a0 = a;
        b0 = b;
 
        /* termination is mandatory */

-       if (alen < 2 || blen < 2)
+       if (alen < 2 || blen < 2) {

                return 0;
                return 0;

-       if (a0[alen - 1] != '\0' || b0[blen - 1] != '\0')
+       }
+       if (a0[alen - 1] != '\0' || b0[blen - 1] != '\0') {

                return 0;
                return 0;

+       }

        alen--;
        blen--;
 
        while (a - a0 < alen && b - b0 < blen) {
        alen--;
        blen--;
 
        while (a - a0 < alen && b - b0 < blen) {

-               if (a - a0 + 1 > alen || b - b0 + 1 > blen)
+               if (a - a0 + 1 > alen || b - b0 + 1 > blen) {

                        return 0;
                        return 0;

+               }

 
 

-               if ((signed char)a[0] < 0 || (signed char)b[0] < 0)
+               if ((signed char)a[0] < 0 || (signed char)b[0] < 0) {

                        return 0;
                        return 0;

+               }

                /* we don't support compression yet */
                /* we don't support compression yet */

-               if (a[0] >= 64 || b[0] >= 64)
+               if (a[0] >= 64 || b[0] >= 64) {

                        return 0;
                        return 0;

+               }

 
                /* truncated case */
 
                /* truncated case */

-               if (a[0] == 0 && a - a0 == alen - 1)
+               if (a[0] == 0 && a - a0 == alen - 1) {

                        return 1;
                        return 1;

-               if (b[0] == 0 && b - b0 == blen - 1)
+               }
+               if (b[0] == 0 && b - b0 == blen - 1) {

                        return 1;
                        return 1;

-               if (a[0] == 0 || b[0] == 0)
+               }
+               if (a[0] == 0 || b[0] == 0) {

                        return 0;
                        return 0;

+               }

 
 

-               if (a[0] != b[0])
+               if (a[0] != b[0]) {

                        return 0;
                        return 0;

+               }

                l = a[0];
                l = a[0];

-               if (a - a0 + 1 + l > alen || b - b0 + 1 + l > blen)
+               if (a - a0 + 1 + l > alen || b - b0 + 1 + l > blen) {

                        return 0;
                        return 0;

-               if (bcmp(a + 1, b + 1, l) != 0)
+               }
+               if (bcmp(a + 1, b + 1, l) != 0) {

                        return 0;
                        return 0;

+               }

 
                a += 1 + l;
                b += 1 + l;
        }
 
 
                a += 1 + l;
                b += 1 + l;
        }
 

-       if (a - a0 == alen && b - b0 == blen)
+       if (a - a0 == alen && b - b0 == blen) {

                return 1;
                return 1;

-       else
+       } else {

                return 0;
                return 0;

+       }

 }
 
 /*
  * calculate the number of addresses to be returned in the node info reply.
  */
 static int
 }
 
 /*
  * calculate the number of addresses to be returned in the node info reply.
  */
 static int

-ni6_addrs(ni6, ifpp, subj)
-       struct icmp6_nodeinfo *ni6;
-       struct ifnet **ifpp;
-       char *subj;
+ni6_addrs(struct icmp6_nodeinfo *ni6, struct ifnet **ifpp, char *subj)

 {
        struct ifnet *ifp;
        struct in6_ifaddr *ifa6;
 {
        struct ifnet *ifp;
        struct in6_ifaddr *ifa6;


@@ -1576,19 +1820,24 @@ ni6_addrs(ni6, ifpp, subj)
        int addrs = 0, addrsofif, iffound = 0;
        int niflags = ni6->ni_flags;
 
        int addrs = 0, addrsofif, iffound = 0;
        int niflags = ni6->ni_flags;
 

+       if (ifpp != NULL) {
+               *ifpp = NULL;
+       }
+

        if ((niflags & NI_NODEADDR_FLAG_ALL) == 0) {
                switch (ni6->ni_code) {
                case ICMP6_NI_SUBJ_IPV6:
        if ((niflags & NI_NODEADDR_FLAG_ALL) == 0) {
                switch (ni6->ni_code) {
                case ICMP6_NI_SUBJ_IPV6:

-                       if (subj == NULL) /* must be impossible... */
-                               return(0);
-                       subj_ip6 = (struct sockaddr_in6 *)subj;
+                       if (subj == NULL) { /* must be impossible... */
+                               return 0;
+                       }
+                       subj_ip6 = (struct sockaddr_in6 *)(void *)subj;

                        break;
                default:
                        /*
                         * XXX: we only support IPv6 subject address for
                         * this Qtype.
                         */
                        break;
                default:
                        /*
                         * XXX: we only support IPv6 subject address for
                         * this Qtype.
                         */

-                       return(0);
+                       return 0;

                }
        }
 
                }
        }
 


@@ -1598,14 +1847,18 @@ ni6_addrs(ni6, ifpp, subj)
                ifnet_lock_shared(ifp);
                TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
                {
                ifnet_lock_shared(ifp);
                TAILQ_FOREACH(ifa, &ifp->if_addrlist, ifa_list)
                {

-                       if (ifa->ifa_addr->sa_family != AF_INET6)
+                       IFA_LOCK(ifa);
+                       if (ifa->ifa_addr->sa_family != AF_INET6) {
+                               IFA_UNLOCK(ifa);

                                continue;
                                continue;

+                       }

                        ifa6 = (struct in6_ifaddr *)ifa;
 
                        if ((niflags & NI_NODEADDR_FLAG_ALL) == 0 &&
                            IN6_ARE_ADDR_EQUAL(&subj_ip6->sin6_addr,
                        ifa6 = (struct in6_ifaddr *)ifa;
 
                        if ((niflags & NI_NODEADDR_FLAG_ALL) == 0 &&
                            IN6_ARE_ADDR_EQUAL(&subj_ip6->sin6_addr,

-                                              &ifa6->ia_addr.sin6_addr))
+                           &ifa6->ia_addr.sin6_addr)) {

                                iffound = 1;
                                iffound = 1;

+                       }

 
                        /*
                         * IPv4-mapped addresses can only be returned by a
 
                        /*
                         * IPv4-mapped addresses can only be returned by a


@@ -1620,18 +1873,25 @@ ni6_addrs(ni6, ifpp, subj)
                        /* What do we have to do about ::1? */
                        switch (in6_addrscope(&ifa6->ia_addr.sin6_addr)) {
                        case IPV6_ADDR_SCOPE_LINKLOCAL:
                        /* What do we have to do about ::1? */
                        switch (in6_addrscope(&ifa6->ia_addr.sin6_addr)) {
                        case IPV6_ADDR_SCOPE_LINKLOCAL:

-                               if ((niflags & NI_NODEADDR_FLAG_LINKLOCAL) == 0)
+                               if ((niflags & NI_NODEADDR_FLAG_LINKLOCAL) == 0) {
+                                       IFA_UNLOCK(ifa);

                                        continue;
                                        continue;

+                               }

                                break;
                        case IPV6_ADDR_SCOPE_SITELOCAL:
                                break;
                        case IPV6_ADDR_SCOPE_SITELOCAL:

-                               if ((niflags & NI_NODEADDR_FLAG_SITELOCAL) == 0)
+                               if ((niflags & NI_NODEADDR_FLAG_SITELOCAL) == 0) {
+                                       IFA_UNLOCK(ifa);

                                        continue;
                                        continue;

+                               }

                                break;
                        case IPV6_ADDR_SCOPE_GLOBAL:
                                break;
                        case IPV6_ADDR_SCOPE_GLOBAL:

-                               if ((niflags & NI_NODEADDR_FLAG_GLOBAL) == 0)
+                               if ((niflags & NI_NODEADDR_FLAG_GLOBAL) == 0) {
+                                       IFA_UNLOCK(ifa);

                                        continue;
                                        continue;

+                               }

                                break;
                        default:
                                break;
                        default:

+                               IFA_UNLOCK(ifa);

                                continue;
                        }
 
                                continue;
                        }
 


@@ -1640,33 +1900,38 @@ ni6_addrs(ni6, ifpp, subj)
                         * XXX: just experimental.  not in the spec.
                         */
                        if ((ifa6->ia6_flags & IN6_IFF_ANYCAST) != 0 &&
                         * XXX: just experimental.  not in the spec.
                         */
                        if ((ifa6->ia6_flags & IN6_IFF_ANYCAST) != 0 &&

-                           (niflags & NI_NODEADDR_FLAG_ANYCAST) == 0)
+                           (niflags & NI_NODEADDR_FLAG_ANYCAST) == 0) {
+                               IFA_UNLOCK(ifa);

                                continue; /* we need only unicast addresses */
                                continue; /* we need only unicast addresses */

+                       }

                        if ((ifa6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
                        if ((ifa6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&

-                           (icmp6_nodeinfo & 4) == 0) {
+                           (icmp6_nodeinfo & ICMP6_NODEINFO_TMPADDROK) == 0) {
+                               IFA_UNLOCK(ifa);

                                continue;
                        }
                        addrsofif++; /* count the address */
                                continue;
                        }
                        addrsofif++; /* count the address */

+                       IFA_UNLOCK(ifa);

                }
                ifnet_lock_done(ifp);
                if (iffound) {
                }
                ifnet_lock_done(ifp);
                if (iffound) {

-                       *ifpp = ifp;
+                       if (ifpp != NULL) {
+                               *ifpp = ifp;
+                               ifnet_reference(ifp);
+                       }

                        ifnet_head_done();
                        ifnet_head_done();

-                       return(addrsofif);
+                       return addrsofif;

                }
 
                addrs += addrsofif;
        }
        ifnet_head_done();
 
                }
 
                addrs += addrsofif;
        }
        ifnet_head_done();
 

-       return(addrs);
+       return addrs;

 }
 
 static int
 }
 
 static int

-ni6_store_addrs(ni6, nni6, ifp0, resid)
-       struct icmp6_nodeinfo *ni6, *nni6;
-       struct ifnet *ifp0;
-       int resid;
+ni6_store_addrs(struct icmp6_nodeinfo *ni6, struct icmp6_nodeinfo *nni6,
+    struct ifnet *ifp0, int resid)

 {
        struct ifnet *ifp = ifp0;
        struct in6_ifaddr *ifa6;
 {
        struct ifnet *ifp = ifp0;
        struct in6_ifaddr *ifa6;


@@ -1676,25 +1941,29 @@ ni6_store_addrs(ni6, nni6, ifp0, resid)
        u_char *cp = (u_char *)(nni6 + 1);
        int niflags = ni6->ni_flags;
        u_int32_t ltime;
        u_char *cp = (u_char *)(nni6 + 1);
        int niflags = ni6->ni_flags;
        u_int32_t ltime;

-       struct timeval timenow;
-
-       getmicrotime(&timenow);
+       uint64_t now = net_uptime();

 
 

-       if (ifp0 == NULL && !(niflags & NI_NODEADDR_FLAG_ALL))
-               return(0);      /* needless to copy */
-
-  again:
+       if (ifp0 == NULL && !(niflags & NI_NODEADDR_FLAG_ALL)) {
+               return 0;     /* needless to copy */
+       }
+again:

 
        ifnet_head_lock_shared();
 
        ifnet_head_lock_shared();

-       if (ifp == NULL) ifp = TAILQ_FIRST(&ifnet_head);
-       
+       if (ifp == NULL) {
+               ifp = TAILQ_FIRST(&ifnet_head);
+       }
+

        for (; ifp; ifp = TAILQ_NEXT(ifp, if_list)) {
                ifnet_lock_shared(ifp);
                for (ifa = ifp->if_addrlist.tqh_first; ifa;
        for (; ifp; ifp = TAILQ_NEXT(ifp, if_list)) {
                ifnet_lock_shared(ifp);
                for (ifa = ifp->if_addrlist.tqh_first; ifa;

-                    ifa = ifa->ifa_list.tqe_next)
-               {
-                       if (ifa->ifa_addr->sa_family != AF_INET6)
+                   ifa = ifa->ifa_list.tqe_next) {
+                       struct in6_addrlifetime_i *lt;
+
+                       IFA_LOCK(ifa);
+                       if (ifa->ifa_addr->sa_family != AF_INET6) {
+                               IFA_UNLOCK(ifa);

                                continue;
                                continue;

+                       }

                        ifa6 = (struct in6_ifaddr *)ifa;
 
                        if ((ifa6->ia6_flags & IN6_IFF_DEPRECATED) != 0 &&
                        ifa6 = (struct in6_ifaddr *)ifa;
 
                        if ((ifa6->ia6_flags & IN6_IFF_DEPRECATED) != 0 &&


@@ -1705,57 +1974,70 @@ ni6_store_addrs(ni6, nni6, ifp0, resid)
                                 */
 
                                /* record the interface for later search */
                                 */
 
                                /* record the interface for later search */

-                               if (ifp_dep == NULL)
+                               if (ifp_dep == NULL) {

                                        ifp_dep = ifp;
                                        ifp_dep = ifp;

+                               }

 
 

+                               IFA_UNLOCK(ifa);

                                continue;
                                continue;

-                       }
-                       else if ((ifa6->ia6_flags & IN6_IFF_DEPRECATED) == 0 &&
-                                allow_deprecated != 0)
+                       } else if ((ifa6->ia6_flags & IN6_IFF_DEPRECATED) == 0 &&
+                           allow_deprecated != 0) {
+                               IFA_UNLOCK(ifa);

                                continue; /* we now collect deprecated addrs */
                                continue; /* we now collect deprecated addrs */

-
+                       }

                        /* What do we have to do about ::1? */
                        switch (in6_addrscope(&ifa6->ia_addr.sin6_addr)) {
                        case IPV6_ADDR_SCOPE_LINKLOCAL:
                        /* What do we have to do about ::1? */
                        switch (in6_addrscope(&ifa6->ia_addr.sin6_addr)) {
                        case IPV6_ADDR_SCOPE_LINKLOCAL:

-                               if ((niflags & NI_NODEADDR_FLAG_LINKLOCAL) == 0)
+                               if ((niflags & NI_NODEADDR_FLAG_LINKLOCAL) == 0) {
+                                       IFA_UNLOCK(ifa);

                                        continue;
                                        continue;

+                               }

                                break;
                        case IPV6_ADDR_SCOPE_SITELOCAL:
                                break;
                        case IPV6_ADDR_SCOPE_SITELOCAL:

-                               if ((niflags & NI_NODEADDR_FLAG_SITELOCAL) == 0)
+                               if ((niflags & NI_NODEADDR_FLAG_SITELOCAL) == 0) {
+                                       IFA_UNLOCK(ifa);

                                        continue;
                                        continue;

+                               }

                                break;
                        case IPV6_ADDR_SCOPE_GLOBAL:
                                break;
                        case IPV6_ADDR_SCOPE_GLOBAL:

-                               if ((niflags & NI_NODEADDR_FLAG_GLOBAL) == 0)
+                               if ((niflags & NI_NODEADDR_FLAG_GLOBAL) == 0) {
+                                       IFA_UNLOCK(ifa);

                                        continue;
                                        continue;

+                               }

                                break;
                        default:
                                break;
                        default:

+                               IFA_UNLOCK(ifa);

                                continue;
                        }
 
                        /*
                         * check if anycast is okay.
                                continue;
                        }
 
                        /*
                         * check if anycast is okay.

-                        * XXX: just experimental. not in the spec.
+                        * XXX: just experimental.  not in the spec.

                         */
                        if ((ifa6->ia6_flags & IN6_IFF_ANYCAST) != 0 &&
                         */
                        if ((ifa6->ia6_flags & IN6_IFF_ANYCAST) != 0 &&

-                           (niflags & NI_NODEADDR_FLAG_ANYCAST) == 0)
+                           (niflags & NI_NODEADDR_FLAG_ANYCAST) == 0) {
+                               IFA_UNLOCK(ifa);

                                continue;
                                continue;

+                       }

                        if ((ifa6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&
                        if ((ifa6->ia6_flags & IN6_IFF_TEMPORARY) != 0 &&

-                           (icmp6_nodeinfo & 4) == 0) {
+                           (icmp6_nodeinfo & ICMP6_NODEINFO_TMPADDROK) == 0) {
+                               IFA_UNLOCK(ifa);

                                continue;
                        }
 
                        /* now we can copy the address */
                        if (resid < sizeof(struct in6_addr) +
                            sizeof(u_int32_t)) {
                                continue;
                        }
 
                        /* now we can copy the address */
                        if (resid < sizeof(struct in6_addr) +
                            sizeof(u_int32_t)) {

+                               IFA_UNLOCK(ifa);

                                /*
                                 * We give up much more copy.
                                 * Set the truncate flag and return.
                                 */
                                nni6->ni_flags |=
                                /*
                                 * We give up much more copy.
                                 * Set the truncate flag and return.
                                 */
                                nni6->ni_flags |=

-                                       NI_NODEADDR_FLAG_TRUNCATE;
+                                   NI_NODEADDR_FLAG_TRUNCATE;

                                ifnet_lock_done(ifp);
                                ifnet_head_done();
                                ifnet_lock_done(ifp);
                                ifnet_head_done();

-                               return(copied);
+                               return copied;

                        }
 
                        /*
                        }
 
                        /*


@@ -1773,34 +2055,38 @@ ni6_store_addrs(ni6, nni6, ifp0, resid)
                         * address configuration by DHCPv6, so the former
                         * case can't happen.
                         */
                         * address configuration by DHCPv6, so the former
                         * case can't happen.
                         */

-                       if (ifa6->ia6_lifetime.ia6t_expire == 0)
+                       lt = &ifa6->ia6_lifetime;
+                       if (lt->ia6ti_expire == 0) {

                                ltime = ND6_INFINITE_LIFETIME;
                                ltime = ND6_INFINITE_LIFETIME;

-                       else {
-                               if (ifa6->ia6_lifetime.ia6t_expire >
-                                   timenow.tv_sec)
-                                       ltime = htonl(ifa6->ia6_lifetime.ia6t_expire - timenow.tv_sec);
-                               else
+                       } else {
+                               if (lt->ia6ti_expire > now) {
+                                       ltime = htonl(lt->ia6ti_expire - now);
+                               } else {

                                        ltime = 0;
                                        ltime = 0;

+                               }

                        }
                        }

-                       
+

                        bcopy(&ltime, cp, sizeof(u_int32_t));
                        cp += sizeof(u_int32_t);
 
                        /* copy the address itself */
                        bcopy(&ifa6->ia_addr.sin6_addr, cp,
                        bcopy(&ltime, cp, sizeof(u_int32_t));
                        cp += sizeof(u_int32_t);
 
                        /* copy the address itself */
                        bcopy(&ifa6->ia_addr.sin6_addr, cp,

-                             sizeof(struct in6_addr));
+                           sizeof(struct in6_addr));

                        /* XXX: KAME link-local hack; remove ifindex */
                        /* XXX: KAME link-local hack; remove ifindex */

-                       if (IN6_IS_ADDR_LINKLOCAL(&ifa6->ia_addr.sin6_addr))
-                               ((struct in6_addr *)cp)->s6_addr16[1] = 0;
+                       if (IN6_IS_ADDR_LINKLOCAL(&ifa6->ia_addr.sin6_addr)) {
+                               ((struct in6_addr *)(void *)cp)->s6_addr16[1] = 0;
+                       }

                        cp += sizeof(struct in6_addr);
                        cp += sizeof(struct in6_addr);

-                       
+

                        resid -= (sizeof(struct in6_addr) + sizeof(u_int32_t));
                        copied += (sizeof(struct in6_addr) +
                        resid -= (sizeof(struct in6_addr) + sizeof(u_int32_t));
                        copied += (sizeof(struct in6_addr) +

-                                  sizeof(u_int32_t));
+                           sizeof(u_int32_t));
+                       IFA_UNLOCK(ifa);

                }
                ifnet_lock_done(ifp);
                }
                ifnet_lock_done(ifp);

-               if (ifp0)       /* we need search only on the specified IF */
+               if (ifp0) {     /* we need search only on the specified IF */

                        break;
                        break;

+               }

        }
        ifnet_head_done();
 
        }
        ifnet_head_done();
 


@@ -1811,16 +2097,14 @@ ni6_store_addrs(ni6, nni6, ifp0, resid)
                goto again;
        }
 
                goto again;
        }
 

-       return(copied);
+       return copied;

 }
 
 /*
  * XXX almost dup'ed code with rip6_input.
  */
 static int
 }
 
 /*
  * XXX almost dup'ed code with rip6_input.
  */
 static int

-icmp6_rip6_input(mp, off)
-       struct  mbuf **mp;
-       int     off;
+icmp6_rip6_input(struct mbuf **mp, int off)

 {
        struct mbuf *m = *mp;
        struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
 {
        struct mbuf *m = *mp;
        struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);


@@ -1829,6 +2113,8 @@ icmp6_rip6_input(mp, off)
        struct sockaddr_in6 rip6src;
        struct icmp6_hdr *icmp6;
        struct mbuf *opts = NULL;
        struct sockaddr_in6 rip6src;
        struct icmp6_hdr *icmp6;
        struct mbuf *opts = NULL;

+       int ret = 0;
+       struct ifnet *ifp = m->m_pkthdr.rcvif;

 
 #ifndef PULLDOWN_TEST
        /* this is assumed to be safe. */
 
 #ifndef PULLDOWN_TEST
        /* this is assumed to be safe. */


@@ -1841,43 +2127,66 @@ icmp6_rip6_input(mp, off)
        }
 #endif
 
        }
 #endif
 

+       /*
+        * XXX: the address may have embedded scope zone ID, which should be
+        * hidden from applications.
+        */

        bzero(&rip6src, sizeof(rip6src));
        bzero(&rip6src, sizeof(rip6src));

-       rip6src.sin6_len = sizeof(struct sockaddr_in6);

        rip6src.sin6_family = AF_INET6;
        rip6src.sin6_family = AF_INET6;

-       /* KAME hack: recover scopeid */
-       (void)in6_recoverscope(&rip6src, &ip6->ip6_src, m->m_pkthdr.rcvif);
+       rip6src.sin6_len = sizeof(struct sockaddr_in6);
+       rip6src.sin6_addr = ip6->ip6_src;
+       if (sa6_recoverscope(&rip6src, TRUE)) {
+               return IPPROTO_DONE;
+       }

 
 

-       lck_rw_lock_shared(ripcbinfo.mtx);
+       lck_rw_lock_shared(ripcbinfo.ipi_lock);

        LIST_FOREACH(in6p, &ripcb, inp_list)
        {
        LIST_FOREACH(in6p, &ripcb, inp_list)
        {

-               if ((in6p->inp_vflag & INP_IPV6) == 0)
+               if ((in6p->inp_vflag & INP_IPV6) == 0) {

                        continue;
                        continue;

-#if HAVE_NRL_INPCB
-               if (!(in6p->in6p_flags & INP_IPV6))
-                       continue;
-#endif
-               if (in6p->in6p_ip6_nxt != IPPROTO_ICMPV6)
+               }
+               if (in6p->in6p_ip6_nxt != IPPROTO_ICMPV6) {

                        continue;
                        continue;

+               }

                if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr) &&
                if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr) &&

-                  !IN6_ARE_ADDR_EQUAL(&in6p->in6p_laddr, &ip6->ip6_dst))
+                   !IN6_ARE_ADDR_EQUAL(&in6p->in6p_laddr, &ip6->ip6_dst)) {

                        continue;
                        continue;

+               }

                if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr) &&
                if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr) &&

-                  !IN6_ARE_ADDR_EQUAL(&in6p->in6p_faddr, &ip6->ip6_src))
+                   !IN6_ARE_ADDR_EQUAL(&in6p->in6p_faddr, &ip6->ip6_src)) {

                        continue;
                        continue;

+               }

                if (in6p->in6p_icmp6filt
                    && ICMP6_FILTER_WILLBLOCK(icmp6->icmp6_type,
                if (in6p->in6p_icmp6filt
                    && ICMP6_FILTER_WILLBLOCK(icmp6->icmp6_type,

-                                in6p->in6p_icmp6filt))
+                   in6p->in6p_icmp6filt)) {
+                       continue;
+               }
+
+               if (inp_restricted_recv(in6p, ifp)) {

                        continue;
                        continue;

+               }
+

                if (last) {
                if (last) {

-                       struct  mbuf *n;
+                       struct  mbuf *n;

                        if ((n = m_copy(m, 0, (int)M_COPYALL)) != NULL) {
                        if ((n = m_copy(m, 0, (int)M_COPYALL)) != NULL) {

-                               if (last->in6p_flags & IN6P_CONTROLOPTS)
-                                       ip6_savecontrol(last, &opts, ip6, n);
+                               if ((last->in6p_flags & INP_CONTROLOPTS) != 0 ||
+                                   (last->in6p_socket->so_options & SO_TIMESTAMP) != 0 ||
+                                   (last->in6p_socket->so_options & SO_TIMESTAMP_MONOTONIC) != 0 ||
+                                   (last->in6p_socket->so_options & SO_TIMESTAMP_CONTINUOUS) != 0) {
+                                       ret = ip6_savecontrol(last, n, &opts);
+                                       if (ret != 0) {
+                                               m_freem(n);
+                                               m_freem(opts);
+                                               last = in6p;
+                                               continue;
+                                       }
+                               }

                                /* strip intermediate headers */
                                m_adj(n, off);
                                /* strip intermediate headers */
                                m_adj(n, off);

+                               so_recv_data_stat(last->in6p_socket, m, 0);

                                if (sbappendaddr(&last->in6p_socket->so_rcv,
                                if (sbappendaddr(&last->in6p_socket->so_rcv,

-                                                (struct sockaddr *)&rip6src,
-                                                n, opts, NULL) != 0) {
+                                   (struct sockaddr *)&rip6src,
+                                   n, opts, NULL) != 0) {

                                        sorwakeup(last->in6p_socket);
                                }
                                opts = NULL;
                                        sorwakeup(last->in6p_socket);
                                }
                                opts = NULL;


@@ -1885,20 +2194,34 @@ icmp6_rip6_input(mp, off)
                }
                last = in6p;
        }
                }
                last = in6p;
        }

-       lck_rw_done(ripcbinfo.mtx);

        if (last) {
        if (last) {

-               if (last->in6p_flags & IN6P_CONTROLOPTS)
-                       ip6_savecontrol(last, &opts, ip6, m);
+               if ((last->in6p_flags & INP_CONTROLOPTS) != 0 ||
+                   (last->in6p_socket->so_options & SO_TIMESTAMP) != 0 ||
+                   (last->in6p_socket->so_options & SO_TIMESTAMP_MONOTONIC) != 0 ||
+                   (last->in6p_socket->so_options & SO_TIMESTAMP_CONTINUOUS) != 0) {
+                       ret = ip6_savecontrol(last, m, &opts);
+                       if (ret != 0) {
+                               goto error;
+                       }
+               }

                /* strip intermediate headers */
                m_adj(m, off);
                /* strip intermediate headers */
                m_adj(m, off);

+               so_recv_data_stat(last->in6p_socket, m, 0);

                if (sbappendaddr(&last->in6p_socket->so_rcv,
                if (sbappendaddr(&last->in6p_socket->so_rcv,

-                                (struct sockaddr *)&rip6src, m, opts, NULL) != 0) {
+                   (struct sockaddr *)&rip6src, m, opts, NULL) != 0) {

                        sorwakeup(last->in6p_socket);
                }
        } else {
                        sorwakeup(last->in6p_socket);
                }
        } else {

-               m_freem(m);
-               ip6stat.ip6s_delivered--;
+               goto error;

        }
        }

+       lck_rw_done(ripcbinfo.ipi_lock);
+       return IPPROTO_DONE;
+
+error:
+       lck_rw_done(ripcbinfo.ipi_lock);
+       m_freem(m);
+       m_freem(opts);
+       ip6stat.ip6s_delivered--;

        return IPPROTO_DONE;
 }
 
        return IPPROTO_DONE;
 }
 


@@ -1907,10 +2230,9 @@ icmp6_rip6_input(mp, off)
  * OFF points to the icmp6 header, counted from the top of the mbuf.
  */
 void
  * OFF points to the icmp6 header, counted from the top of the mbuf.
  */
 void

-icmp6_reflect(m, off)
-       struct  mbuf *m;
-       size_t off;
+icmp6_reflect(struct mbuf *m, size_t off)

 {
 {

+       struct mbuf *m_ip6hdr = m;

        struct ip6_hdr *ip6;
        struct icmp6_hdr *icmp6;
        struct in6_ifaddr *ia;
        struct ip6_hdr *ip6;
        struct icmp6_hdr *icmp6;
        struct in6_ifaddr *ia;


@@ -1919,17 +2241,28 @@ icmp6_reflect(m, off)
        int type, code;
        struct ifnet *outif = NULL;
        struct sockaddr_in6 sa6_src, sa6_dst;
        int type, code;
        struct ifnet *outif = NULL;
        struct sockaddr_in6 sa6_src, sa6_dst;

-#ifdef COMPAT_RFC1885
-       int mtu = IPV6_MMTU;
-       struct sockaddr_in6 *sin6 = &icmp6_reflect_rt.ro_dst;
-#endif
+       struct nd_ifinfo *ndi = NULL;
+       u_int32_t oflow;
+       struct ip6_out_args ip6oa;
+
+       bzero(&ip6oa, sizeof(ip6oa));
+       ip6oa.ip6oa_boundif = IFSCOPE_NONE;
+       ip6oa.ip6oa_flags = IP6OAF_SELECT_SRCIF | IP6OAF_BOUND_SRCADDR |
+           IP6OAF_INTCOPROC_ALLOWED | IP6OAF_AWDL_UNRESTRICTED;
+       ip6oa.ip6oa_sotc = SO_TC_UNSPEC;
+       ip6oa.ip6oa_netsvctype = _NET_SERVICE_TYPE_UNSPEC;
+
+       if (!(m->m_pkthdr.pkt_flags & PKTF_LOOP) && m->m_pkthdr.rcvif != NULL) {
+               ip6oa.ip6oa_boundif = m->m_pkthdr.rcvif->if_index;
+               ip6oa.ip6oa_flags |= IP6OAF_BOUND_IF;
+       }

 
        /* too short to reflect */
        if (off < sizeof(struct ip6_hdr)) {
                nd6log((LOG_DEBUG,
                    "sanity fail: off=%lx, sizeof(ip6)=%lx in %s:%d\n",
 
        /* too short to reflect */
        if (off < sizeof(struct ip6_hdr)) {
                nd6log((LOG_DEBUG,
                    "sanity fail: off=%lx, sizeof(ip6)=%lx in %s:%d\n",

-                   (u_long)off, (u_long)sizeof(struct ip6_hdr),
-                   __FILE__, __LINE__));
+                   (u_int32_t)off, (u_int32_t)sizeof(struct ip6_hdr),
+                   __func__, __LINE__));

                goto bad;
        }
 
                goto bad;
        }
 


@@ -1937,10 +2270,6 @@ icmp6_reflect(m, off)
         * If there are extra headers between IPv6 and ICMPv6, strip
         * off that header first.
         */
         * If there are extra headers between IPv6 and ICMPv6, strip
         * off that header first.
         */

-#if DIAGNOSTIC
-       if (sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr) > MHLEN)
-               panic("assumption failed in icmp6_reflect");
-#endif

        if (off > sizeof(struct ip6_hdr)) {
                size_t l;
                struct ip6_hdr nip6;
        if (off > sizeof(struct ip6_hdr)) {
                size_t l;
                struct ip6_hdr nip6;


@@ -1950,20 +2279,22 @@ icmp6_reflect(m, off)
                m_adj(m, l);
                l = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
                if (m->m_len < l) {
                m_adj(m, l);
                l = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
                if (m->m_len < l) {

-                       if ((m = m_pullup(m, l)) == NULL)
+                       if ((m_ip6hdr = m_pulldown(m, 0, l, NULL)) == NULL) {

                                return;
                                return;

+                       }

                }
                bcopy((caddr_t)&nip6, mtod(m, caddr_t), sizeof(nip6));
                }
                bcopy((caddr_t)&nip6, mtod(m, caddr_t), sizeof(nip6));

-       } else /* off == sizeof(struct ip6_hdr) */ {
+       } else { /* off == sizeof(struct ip6_hdr) */

                size_t l;
                l = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
                if (m->m_len < l) {
                size_t l;
                l = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
                if (m->m_len < l) {

-                       if ((m = m_pullup(m, l)) == NULL)
+                       if ((m_ip6hdr = m_pulldown(m, 0, l, NULL)) == NULL) {

                                return;
                                return;

+                       }

                }
        }
        plen = m->m_pkthdr.len - sizeof(struct ip6_hdr);
                }
        }
        plen = m->m_pkthdr.len - sizeof(struct ip6_hdr);

-       ip6 = mtod(m, struct ip6_hdr *);
+       ip6 = mtod(m_ip6hdr, struct ip6_hdr *);

        ip6->ip6_nxt = IPPROTO_ICMPV6;
        icmp6 = (struct icmp6_hdr *)(ip6 + 1);
        type = icmp6->icmp6_type; /* keep type for statistics */
        ip6->ip6_nxt = IPPROTO_ICMPV6;
        icmp6 = (struct icmp6_hdr *)(ip6 + 1);
        type = icmp6->icmp6_type; /* keep type for statistics */


@@ -1980,80 +2311,57 @@ icmp6_reflect(m, off)
         * XXX: make sure to embed scope zone information, using
         * already embedded IDs or the received interface (if any).
         * Note that rcvif may be NULL.
         * XXX: make sure to embed scope zone information, using
         * already embedded IDs or the received interface (if any).
         * Note that rcvif may be NULL.

-        * TODO: scoped routing case (XXX).

         */
        bzero(&sa6_src, sizeof(sa6_src));
        sa6_src.sin6_family = AF_INET6;
        sa6_src.sin6_len = sizeof(sa6_src);
        sa6_src.sin6_addr = ip6->ip6_dst;
        in6_recoverscope(&sa6_src, &ip6->ip6_dst, m->m_pkthdr.rcvif);
         */
        bzero(&sa6_src, sizeof(sa6_src));
        sa6_src.sin6_family = AF_INET6;
        sa6_src.sin6_len = sizeof(sa6_src);
        sa6_src.sin6_addr = ip6->ip6_dst;
        in6_recoverscope(&sa6_src, &ip6->ip6_dst, m->m_pkthdr.rcvif);

-       in6_embedscope(&ip6->ip6_dst, &sa6_src, NULL, NULL);
+       in6_embedscope(&ip6->ip6_dst, &sa6_src, NULL, NULL, NULL);

        bzero(&sa6_dst, sizeof(sa6_dst));
        sa6_dst.sin6_family = AF_INET6;
        sa6_dst.sin6_len = sizeof(sa6_dst);
        sa6_dst.sin6_addr = t;
        in6_recoverscope(&sa6_dst, &t, m->m_pkthdr.rcvif);
        bzero(&sa6_dst, sizeof(sa6_dst));
        sa6_dst.sin6_family = AF_INET6;
        sa6_dst.sin6_len = sizeof(sa6_dst);
        sa6_dst.sin6_addr = t;
        in6_recoverscope(&sa6_dst, &t, m->m_pkthdr.rcvif);

-       in6_embedscope(&t, &sa6_dst, NULL, NULL);
+       in6_embedscope(&t, &sa6_dst, NULL, NULL, NULL);

 
 

-#ifdef COMPAT_RFC1885
-       /*
-        * xxx guess MTU
-        * RFC 1885 requires that echo reply should be truncated if it
-        * does not fit in with (return) path MTU, but the description was
-        * removed in the new spec.
-        */
-       if (icmp6_reflect_rt.ro_rt == 0 ||
-           ! (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr, &ip6->ip6_dst))) {
-               if (icmp6_reflect_rt.ro_rt) {
-                       rtfree(icmp6_reflect_rt.ro_rt);
-                       icmp6_reflect_rt.ro_rt = 0;
-               }
-               bzero(sin6, sizeof(*sin6));
-               sin6->sin6_family = PF_INET6;
-               sin6->sin6_len = sizeof(struct sockaddr_in6);
-               sin6->sin6_addr = ip6->ip6_dst;
-
-               rtalloc_ign((struct route *)&icmp6_reflect_rt.ro_rt,
-                           RTF_PRCLONING);
-       }
-
-       if (icmp6_reflect_rt.ro_rt == 0)
-               goto bad;
-
-       if ((icmp6_reflect_rt.ro_rt->rt_flags & RTF_HOST)
-           && mtu < icmp6_reflect_rt.ro_rt->rt_ifp->if_mtu)
-               mtu = icmp6_reflect_rt.ro_rt->rt_rmx.rmx_mtu;
-
-       if (mtu < m->m_pkthdr.len) {
-               plen -= (m->m_pkthdr.len - mtu);
-               m_adj(m, mtu - m->m_pkthdr.len);
-       }
-#endif

        /*
         * If the incoming packet was addressed directly to us(i.e. unicast),
         * use dst as the src for the reply.
        /*
         * If the incoming packet was addressed directly to us(i.e. unicast),
         * use dst as the src for the reply.

-        * The IN6_IFF_NOTREADY case would be VERY rare, but is possible
+        * The IN6_IFF_NOTREADY case should be VERY rare, but is possible

         * (for example) when we encounter an error while forwarding procedure
         * destined to a duplicated address of ours.
         * (for example) when we encounter an error while forwarding procedure
         * destined to a duplicated address of ours.

+        * Note that ip6_getdstifaddr() may fail if we are in an error handling
+        * procedure of an outgoing packet of our own, in which case we need
+        * to search in the ifaddr list.

         */
         */

-       lck_mtx_lock(nd6_mutex);
-       for (ia = in6_ifaddrs; ia; ia = ia->ia_next)
+       lck_rw_lock_shared(&in6_ifaddr_rwlock);
+       for (ia = in6_ifaddrs; ia; ia = ia->ia_next) {
+               IFA_LOCK(&ia->ia_ifa);

                if (IN6_ARE_ADDR_EQUAL(&t, &ia->ia_addr.sin6_addr) &&
                if (IN6_ARE_ADDR_EQUAL(&t, &ia->ia_addr.sin6_addr) &&

-                   (ia->ia6_flags & (IN6_IFF_ANYCAST|IN6_IFF_NOTREADY)) == 0) {
+                   (ia->ia6_flags & (IN6_IFF_ANYCAST | IN6_IFF_NOTREADY | IN6_IFF_CLAT46)) == 0) {
+                       IFA_UNLOCK(&ia->ia_ifa);

                        src = &t;
                        break;
                }
                        src = &t;
                        break;
                }

-       lck_mtx_unlock(nd6_mutex);
-       if (ia == NULL && IN6_IS_ADDR_LINKLOCAL(&t) && (m->m_flags & M_LOOP)) {
+               IFA_UNLOCK(&ia->ia_ifa);
+       }
+       lck_rw_done(&in6_ifaddr_rwlock);
+       if (ia == NULL && IN6_IS_ADDR_LINKLOCAL(&t) &&
+           ((m->m_flags & M_LOOP) || (m->m_pkthdr.pkt_flags & PKTF_LOOP))) {

                /*
                 * This is the case if the dst is our link-local address
                /*
                 * This is the case if the dst is our link-local address

-                * and the sender is also ourselves.
+                * and the sender is also ourselves.  Here we test for both
+                * M_LOOP and PKTF_LOOP, since the former may have been set
+                * in ip6_output() and that we get here as part of callling
+                * ip6_process_hopopts().  See comments in <sys/mbuf.h>

                 */
                src = &t;
        }
 
                 */
                src = &t;
        }
 

-       if (src == 0) {
+       if (src == NULL) {

                int e;
                int e;

+               struct sockaddr_in6 sin6;

                struct route_in6 ro;
 
                /*
                struct route_in6 ro;
 
                /*


@@ -2061,10 +2369,20 @@ icmp6_reflect(m, off)
                 * that we do not own.  Select a source address based on the
                 * source address of the erroneous packet.
                 */
                 * that we do not own.  Select a source address based on the
                 * source address of the erroneous packet.
                 */

+               bzero(&sin6, sizeof(sin6));
+               sin6.sin6_family = AF_INET6;
+               sin6.sin6_len = sizeof(sin6);
+               sin6.sin6_addr = ip6->ip6_dst; /* zone ID should be embedded */
+

                bzero(&ro, sizeof(ro));
                bzero(&ro, sizeof(ro));

-               src = in6_selectsrc(&sa6_src, NULL, NULL, &ro, NULL, &src_storage, &e);
-               if (ro.ro_rt)
-                       rtfree(ro.ro_rt); /* XXX: we could use this */
+               /*
+                * in6_selectsrc() might return outif with its reference held
+                * even in the error case, so we always need to release it
+                * if non-NULL.
+                */
+               src = in6_selectsrc(&sin6, NULL, NULL, &ro, &outif,
+                   &src_storage, ip6oa.ip6oa_boundif, &e);
+               ROUTE_RELEASE(&ro);

                if (src == NULL) {
                        nd6log((LOG_DEBUG,
                            "icmp6_reflect: source can't be determined: "
                if (src == NULL) {
                        nd6log((LOG_DEBUG,
                            "icmp6_reflect: source can't be determined: "


@@ -2073,72 +2391,76 @@ icmp6_reflect(m, off)
                        goto bad;
                }
        }
                        goto bad;
                }
        }

-
+       oflow = ip6->ip6_flow; /* Save for later */

        ip6->ip6_src = *src;
        ip6->ip6_src = *src;

-

        ip6->ip6_flow = 0;
        ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
        ip6->ip6_vfc |= IPV6_VERSION;
        ip6->ip6_flow = 0;
        ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
        ip6->ip6_vfc |= IPV6_VERSION;

+       if (icmp6->icmp6_type == ICMP6_ECHO_REPLY && icmp6->icmp6_code == 0) {
+               ip6->ip6_flow |= (oflow & htonl(0x0ff00000));
+       }

        ip6->ip6_nxt = IPPROTO_ICMPV6;
        ip6->ip6_nxt = IPPROTO_ICMPV6;

-       if (m->m_pkthdr.rcvif) {
+       if (outif != NULL && (ndi = ND_IFINFO(outif)) != NULL &&
+           ndi->initialized) {
+               lck_mtx_lock(&ndi->lock);
+               ip6->ip6_hlim = ndi->chlim;
+               lck_mtx_unlock(&ndi->lock);
+       }
+       if (m->m_pkthdr.rcvif != NULL &&
+           (ndi = ND_IFINFO(m->m_pkthdr.rcvif)) != NULL &&
+           ndi->initialized) {

                /* XXX: This may not be the outgoing interface */
                /* XXX: This may not be the outgoing interface */

-               ip6->ip6_hlim = nd_ifinfo[m->m_pkthdr.rcvif->if_index].chlim;
-       } else
+               lck_mtx_lock(&ndi->lock);
+               ip6->ip6_hlim = ndi->chlim;
+               lck_mtx_unlock(&ndi->lock);
+       } else {

                ip6->ip6_hlim = ip6_defhlim;
                ip6->ip6_hlim = ip6_defhlim;

-
+       }
+       /* Use the same traffic class as in the request to match IPv4 */

        icmp6->icmp6_cksum = 0;
        icmp6->icmp6_cksum = in6_cksum(m, IPPROTO_ICMPV6,
        icmp6->icmp6_cksum = 0;
        icmp6->icmp6_cksum = in6_cksum(m, IPPROTO_ICMPV6,

-                                       sizeof(struct ip6_hdr), plen);
+           sizeof(struct ip6_hdr), plen);

 
        /*
         * XXX option handling
         */
 
        /*
         * XXX option handling
         */

+       m->m_flags &= ~(M_BCAST | M_MCAST);

 
 

-       m->m_flags &= ~(M_BCAST|M_MCAST);
-#if IPSEC
-       /* Don't lookup socket */
-       if (ipsec_bypass == 0)
-               (void)ipsec_setsocket(m, NULL);
-#endif /*IPSEC*/
+       if (outif != NULL) {
+               ifnet_release(outif);
+               outif = NULL;
+       }

 
 

-#ifdef COMPAT_RFC1885
-       ip6_output(m, NULL, &icmp6_reflect_rt, 0, NULL, &outif, 0);
-#else
-       ip6_output(m, NULL, NULL, 0, NULL, &outif, 0);
-#endif
-       if (outif)
+       m->m_pkthdr.csum_data = 0;
+       m->m_pkthdr.csum_flags = 0;
+       ip6_output(m, NULL, NULL, IPV6_OUTARGS, NULL, &outif, &ip6oa);
+       if (outif != NULL) {

                icmp6_ifoutstat_inc(outif, type, code);
                icmp6_ifoutstat_inc(outif, type, code);

-
+               ifnet_release(outif);
+       }

        return;
 
        return;
 

- bad:
+bad:

        m_freem(m);
        m_freem(m);

+       if (outif != NULL) {
+               ifnet_release(outif);
+       }

        return;
 }
 
        return;
 }
 

-void
-icmp6_fasttimo()
-{
-
-       mld6_fasttimeo();
-}
-

 static const char *
 static const char *

-icmp6_redirect_diag(src6, dst6, tgt6)
-       struct in6_addr *src6;
-       struct in6_addr *dst6;
-       struct in6_addr *tgt6;
+icmp6_redirect_diag(struct in6_addr *src6,
+    struct in6_addr *dst6,
+    struct in6_addr *tgt6)

 {
        static char buf[1024];
        snprintf(buf, sizeof(buf), "(src=%s dst=%s tgt=%s)",
 {
        static char buf[1024];
        snprintf(buf, sizeof(buf), "(src=%s dst=%s tgt=%s)",

-               ip6_sprintf(src6), ip6_sprintf(dst6), ip6_sprintf(tgt6));
+           ip6_sprintf(src6), ip6_sprintf(dst6), ip6_sprintf(tgt6));

        return buf;
 }
 
 void
        return buf;
 }
 
 void

-icmp6_redirect_input(m, off)
-       struct mbuf *m;
-       int off;
+icmp6_redirect_input(struct mbuf *m, int off)

 {
        struct ifnet *ifp = m->m_pkthdr.rcvif;
        struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
 {
        struct ifnet *ifp = m->m_pkthdr.rcvif;
        struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);


@@ -2156,17 +2478,23 @@ icmp6_redirect_input(m, off)
        struct in6_addr reddst6;
        union nd_opts ndopts;
 
        struct in6_addr reddst6;
        union nd_opts ndopts;
 

-       if (!m || !ifp)
+       if (!m || !ifp) {

                return;
                return;

+       }

 
 

-       /* XXX if we are router, we don't update route by icmp6 redirect */
-       if (ip6_forwarding)
+       /*
+        * If we are an advertising router on this interface,
+        * don't update route by icmp6 redirect.
+        */
+       if (ifp->if_eflags & IFEF_IPV6_ROUTER) {

                goto freeit;
                goto freeit;

-       if (!icmp6_rediraccept)
+       }
+       if (!icmp6_rediraccept) {

                goto freeit;
                goto freeit;

+       }

 
 #ifndef PULLDOWN_TEST
 
 #ifndef PULLDOWN_TEST

-       IP6_EXTHDR_CHECK(m, off, icmp6len, return);
+       IP6_EXTHDR_CHECK(m, off, icmp6len, return );

        nd_rd = (struct nd_redirect *)((caddr_t)ip6 + off);
 #else
        IP6_EXTHDR_GET(nd_rd, struct nd_redirect *, m, off, icmp6len);
        nd_rd = (struct nd_redirect *)((caddr_t)ip6 + off);
 #else
        IP6_EXTHDR_GET(nd_rd, struct nd_redirect *, m, off, icmp6len);


@@ -2178,85 +2506,92 @@ icmp6_redirect_input(m, off)
        redtgt6 = nd_rd->nd_rd_target;
        reddst6 = nd_rd->nd_rd_dst;
 
        redtgt6 = nd_rd->nd_rd_target;
        reddst6 = nd_rd->nd_rd_dst;
 

-       if (IN6_IS_ADDR_LINKLOCAL(&redtgt6))
-               redtgt6.s6_addr16[1] = htons(ifp->if_index);
-       if (IN6_IS_ADDR_LINKLOCAL(&reddst6))
-               reddst6.s6_addr16[1] = htons(ifp->if_index);
+       if (in6_setscope(&redtgt6, m->m_pkthdr.rcvif, NULL) ||
+           in6_setscope(&reddst6, m->m_pkthdr.rcvif, NULL)) {
+               goto freeit;
+       }

 
        /* validation */
        if (!IN6_IS_ADDR_LINKLOCAL(&src6)) {
                nd6log((LOG_ERR,
 
        /* validation */
        if (!IN6_IS_ADDR_LINKLOCAL(&src6)) {
                nd6log((LOG_ERR,

-                       "ICMP6 redirect sent from %s rejected; "
-                       "must be from linklocal\n", ip6_sprintf(&src6)));
+                   "ICMP6 redirect sent from %s rejected; "
+                   "must be from linklocal\n", ip6_sprintf(&src6)));

                goto bad;
        }
        if (ip6->ip6_hlim != 255) {
                nd6log((LOG_ERR,
                goto bad;
        }
        if (ip6->ip6_hlim != 255) {
                nd6log((LOG_ERR,

-                       "ICMP6 redirect sent from %s rejected; "
-                       "hlim=%d (must be 255)\n",
-                       ip6_sprintf(&src6), ip6->ip6_hlim));
+                   "ICMP6 redirect sent from %s rejected; "
+                   "hlim=%d (must be 255)\n",
+                   ip6_sprintf(&src6), ip6->ip6_hlim));

                goto bad;
        }
                goto bad;
        }

-    {
-       /* ip6->ip6_src must be equal to gw for icmp6->icmp6_reddst */
-       struct sockaddr_in6 sin6;
-       struct in6_addr *gw6;
+       {
+               /* ip6->ip6_src must be equal to gw for icmp6->icmp6_reddst */
+               struct sockaddr_in6 sin6;
+               struct in6_addr *gw6;
+
+               bzero(&sin6, sizeof(sin6));
+               sin6.sin6_family = AF_INET6;
+               sin6.sin6_len = sizeof(struct sockaddr_in6);
+               bcopy(&reddst6, &sin6.sin6_addr, sizeof(reddst6));
+               rt = rtalloc1_scoped((struct sockaddr *)&sin6, 0, 0, ifp->if_index);
+               if (rt) {
+                       RT_LOCK(rt);
+                       if (rt->rt_gateway == NULL ||
+                           rt->rt_gateway->sa_family != AF_INET6) {
+                               nd6log((LOG_ERR,
+                                   "ICMP6 redirect rejected; no route "
+                                   "with inet6 gateway found for redirect dst: %s\n",
+                                   icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
+                               RT_UNLOCK(rt);
+                               rtfree(rt);
+                               goto bad;
+                       }

 
 

-       bzero(&sin6, sizeof(sin6));
-       sin6.sin6_family = AF_INET6;
-       sin6.sin6_len = sizeof(struct sockaddr_in6);
-       bcopy(&reddst6, &sin6.sin6_addr, sizeof(reddst6));
-       rt = rtalloc1((struct sockaddr *)&sin6, 0, 0UL);
-       if (rt) {
-               if (rt->rt_gateway == NULL ||
-                   rt->rt_gateway->sa_family != AF_INET6) {
+                       gw6 = &(((struct sockaddr_in6 *)(void *)
+                           rt->rt_gateway)->sin6_addr);
+                       if (bcmp(&src6, gw6, sizeof(struct in6_addr)) != 0) {
+                               nd6log((LOG_ERR,
+                                   "ICMP6 redirect rejected; "
+                                   "not equal to gw-for-src=%s (must be same): "
+                                   "%s\n",
+                                   ip6_sprintf(gw6),
+                                   icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
+                               RT_UNLOCK(rt);
+                               rtfree(rt);
+                               goto bad;
+                       }
+               } else {

                        nd6log((LOG_ERR,
                        nd6log((LOG_ERR,

-                           "ICMP6 redirect rejected; no route "
-                           "with inet6 gateway found for redirect dst: %s\n",
+                           "ICMP6 redirect rejected; "
+                           "no route found for redirect dst: %s\n",

                            icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
                            icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));

-                       rtfree(rt);

                        goto bad;
                }
                        goto bad;
                }

-
-               gw6 = &(((struct sockaddr_in6 *)rt->rt_gateway)->sin6_addr);
-               if (bcmp(&src6, gw6, sizeof(struct in6_addr)) != 0) {
-                       nd6log((LOG_ERR,
-                               "ICMP6 redirect rejected; "
-                               "not equal to gw-for-src=%s (must be same): "
-                               "%s\n",
-                               ip6_sprintf(gw6),
-                               icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
-                       rtfree(rt);
-                       goto bad;
-               }
-       } else {
-               nd6log((LOG_ERR,
-                       "ICMP6 redirect rejected; "
-                       "no route found for redirect dst: %s\n",
-                       icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
-               goto bad;
+               RT_UNLOCK(rt);
+               rtfree(rt);
+               rt = NULL;

        }
        }

-       rtfree(rt);
-       rt = NULL;
-    }

        if (IN6_IS_ADDR_MULTICAST(&reddst6)) {
                nd6log((LOG_ERR,
        if (IN6_IS_ADDR_MULTICAST(&reddst6)) {
                nd6log((LOG_ERR,

-                       "ICMP6 redirect rejected; "
-                       "redirect dst must be unicast: %s\n",
-                       icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
+                   "ICMP6 redirect rejected; "
+                   "redirect dst must be unicast: %s\n",
+                   icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));

                goto bad;
        }
 
        is_router = is_onlink = 0;
                goto bad;
        }
 
        is_router = is_onlink = 0;

-       if (IN6_IS_ADDR_LINKLOCAL(&redtgt6))
-               is_router = 1;  /* router case */
-       if (bcmp(&redtgt6, &reddst6, sizeof(redtgt6)) == 0)
-               is_onlink = 1;  /* on-link destination case */
+       if (IN6_IS_ADDR_LINKLOCAL(&redtgt6)) {
+               is_router = 1;  /* router case */
+       }
+       if (bcmp(&redtgt6, &reddst6, sizeof(redtgt6)) == 0) {
+               is_onlink = 1;  /* on-link destination case */
+       }

        if (!is_router && !is_onlink) {
                nd6log((LOG_ERR,
        if (!is_router && !is_onlink) {
                nd6log((LOG_ERR,

-                       "ICMP6 redirect rejected; "
-                       "neither router case nor onlink case: %s\n",
-                       icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
+                   "ICMP6 redirect rejected; "
+                   "neither router case nor onlink case: %s\n",
+                   icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));

                goto bad;
        }
        /* validation passed */
                goto bad;
        }
        /* validation passed */


@@ -2265,8 +2600,8 @@ icmp6_redirect_input(m, off)
        nd6_option_init(nd_rd + 1, icmp6len, &ndopts);
        if (nd6_options(&ndopts) < 0) {
                nd6log((LOG_INFO, "icmp6_redirect_input: "
        nd6_option_init(nd_rd + 1, icmp6len, &ndopts);
        if (nd6_options(&ndopts) < 0) {
                nd6log((LOG_INFO, "icmp6_redirect_input: "

-                       "invalid ND option, rejected: %s\n",
-                       icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
+                   "invalid ND option, rejected: %s\n",
+                   icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));

                /* nd6_options have incremented stats */
                goto freeit;
        }
                /* nd6_options have incremented stats */
                goto freeit;
        }


@@ -2283,18 +2618,18 @@ icmp6_redirect_input(m, off)
 
        if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
                nd6log((LOG_INFO,
 
        if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
                nd6log((LOG_INFO,

-                       "icmp6_redirect_input: lladdrlen mismatch for %s "
-                       "(if %d, icmp6 packet %d): %s\n",
-                       ip6_sprintf(&redtgt6), ifp->if_addrlen, lladdrlen - 2,
-                       icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));
+                   "icmp6_redirect_input: lladdrlen mismatch for %s "
+                   "(if %d, icmp6 packet %d): %s\n",
+                   ip6_sprintf(&redtgt6), ifp->if_addrlen, lladdrlen - 2,
+                   icmp6_redirect_diag(&src6, &reddst6, &redtgt6)));

                goto bad;
        }
 
        /* RFC 2461 8.3 */
        nd6_cache_lladdr(ifp, &redtgt6, lladdr, lladdrlen, ND_REDIRECT,
                goto bad;
        }
 
        /* RFC 2461 8.3 */
        nd6_cache_lladdr(ifp, &redtgt6, lladdr, lladdrlen, ND_REDIRECT,

-                        is_onlink ? ND_REDIRECT_ONLINK : ND_REDIRECT_ROUTER);
+           is_onlink ? ND_REDIRECT_ONLINK : ND_REDIRECT_ROUTER);

 
 

-       if (!is_onlink) {       /* better router case.  perform rtredirect. */
+       if (!is_onlink) {       /* better router case.  perform rtredirect. */

                /* perform rtredirect */
                struct sockaddr_in6 sdst;
                struct sockaddr_in6 sgw;
                /* perform rtredirect */
                struct sockaddr_in6 sdst;
                struct sockaddr_in6 sgw;


@@ -2305,64 +2640,78 @@ icmp6_redirect_input(m, off)
                bzero(&ssrc, sizeof(ssrc));
                sdst.sin6_family = sgw.sin6_family = ssrc.sin6_family = AF_INET6;
                sdst.sin6_len = sgw.sin6_len = ssrc.sin6_len =
                bzero(&ssrc, sizeof(ssrc));
                sdst.sin6_family = sgw.sin6_family = ssrc.sin6_family = AF_INET6;
                sdst.sin6_len = sgw.sin6_len = ssrc.sin6_len =

-                       sizeof(struct sockaddr_in6);
+                   sizeof(struct sockaddr_in6);

                bcopy(&redtgt6, &sgw.sin6_addr, sizeof(struct in6_addr));
                bcopy(&reddst6, &sdst.sin6_addr, sizeof(struct in6_addr));
                bcopy(&src6, &ssrc.sin6_addr, sizeof(struct in6_addr));
                bcopy(&redtgt6, &sgw.sin6_addr, sizeof(struct in6_addr));
                bcopy(&reddst6, &sdst.sin6_addr, sizeof(struct in6_addr));
                bcopy(&src6, &ssrc.sin6_addr, sizeof(struct in6_addr));

-               rtredirect((struct sockaddr *)&sdst, (struct sockaddr *)&sgw,
-                          (struct sockaddr *)NULL, RTF_GATEWAY | RTF_HOST,
-                          (struct sockaddr *)&ssrc,
-                          (struct rtentry **)NULL);
+               rtredirect(ifp, (struct sockaddr *)&sdst,
+                   (struct sockaddr *)&sgw, NULL, RTF_GATEWAY | RTF_HOST,
+                   (struct sockaddr *)&ssrc, NULL);

        }
        /* finally update cached route in each socket via pfctlinput */
        }
        /* finally update cached route in each socket via pfctlinput */

-    {
-       struct sockaddr_in6 sdst;
-
-       bzero(&sdst, sizeof(sdst));
-       sdst.sin6_family = AF_INET6;
-       sdst.sin6_len = sizeof(struct sockaddr_in6);
-       bcopy(&reddst6, &sdst.sin6_addr, sizeof(struct in6_addr));
-       pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&sdst);
+       {
+               struct sockaddr_in6 sdst;
+
+               bzero(&sdst, sizeof(sdst));
+               sdst.sin6_family = AF_INET6;
+               sdst.sin6_len = sizeof(struct sockaddr_in6);
+               bcopy(&reddst6, &sdst.sin6_addr, sizeof(struct in6_addr));
+
+               pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&sdst);

 #if IPSEC
 #if IPSEC

-       key_sa_routechange((struct sockaddr *)&sdst);
+               key_sa_routechange((struct sockaddr *)&sdst);

 #endif
 #endif

-    }
+       }

 
 

- freeit:
+freeit:

        m_freem(m);
        return;
 
        m_freem(m);
        return;
 

- bad:
+bad:

        icmp6stat.icp6s_badredirect++;
        m_freem(m);
 }
 
 void
        icmp6stat.icp6s_badredirect++;
        m_freem(m);
 }
 
 void

-icmp6_redirect_output(m0, rt)
-       struct mbuf *m0;
-       struct rtentry *rt;
+icmp6_redirect_output(struct mbuf *m0, struct rtentry *rt)

 {
 {

-       struct ifnet *ifp;      /* my outgoing interface */
+       struct ifnet *ifp;      /* my outgoing interface */

        struct in6_addr ifp_ll6;
        struct in6_addr *router_ll6;
        struct in6_addr ifp_ll6;
        struct in6_addr *router_ll6;

-       struct ip6_hdr *sip6;   /* m0 as struct ip6_hdr */
-       struct mbuf *m = NULL;  /* newly allocated one */
-       struct ip6_hdr *ip6;    /* m as struct ip6_hdr */
+       struct ip6_hdr *sip6;   /* m0 as struct ip6_hdr */
+       struct mbuf *m = NULL;  /* newly allocated one */
+       struct ip6_hdr *ip6;    /* m as struct ip6_hdr */

        struct nd_redirect *nd_rd;
        size_t maxlen;
        u_char *p;
        struct ifnet *outif = NULL;
        struct sockaddr_in6 src_sa;
        struct nd_redirect *nd_rd;
        size_t maxlen;
        u_char *p;
        struct ifnet *outif = NULL;
        struct sockaddr_in6 src_sa;

+       struct ip6_out_args ip6oa;
+
+       bzero(&ip6oa, sizeof(ip6oa));
+       ip6oa.ip6oa_boundif = IFSCOPE_NONE;
+       ip6oa.ip6oa_flags = IP6OAF_SELECT_SRCIF | IP6OAF_BOUND_SRCADDR;
+       ip6oa.ip6oa_sotc = SO_TC_UNSPEC;
+       ip6oa.ip6oa_netsvctype = _NET_SERVICE_TYPE_UNSPEC;

 
        icmp6_errcount(&icmp6stat.icp6s_outerrhist, ND_REDIRECT, 0);
 
 
        icmp6_errcount(&icmp6stat.icp6s_outerrhist, ND_REDIRECT, 0);
 

+       if (rt != NULL) {
+               RT_LOCK(rt);
+       }
+

        /* sanity check */
        /* sanity check */

-       if (!m0 || !rt || !(rt->rt_flags & RTF_UP) || !(ifp = rt->rt_ifp))
+       if (!m0 || !rt || !(rt->rt_flags & RTF_UP) || !(ifp = rt->rt_ifp)) {

                goto fail;
                goto fail;

+       }

 
 

-       /* if we are not router, we don't send icmp6 redirect */
-       if (!ip6_forwarding || ip6_accept_rtadv || (ifp->if_eflags & IFEF_ACCEPT_RTADVD))
+       /*
+        * If we are not a router to begin with, or not an advertising
+        * router on this interface, don't send icmp6 redirect.
+        */
+       if (!ip6_forwarding || !(ifp->if_eflags & IFEF_IPV6_ROUTER)) {

                goto fail;
                goto fail;

+       }

 
        /*
         * Address check:
 
        /*
         * Address check:


@@ -2377,14 +2726,20 @@ icmp6_redirect_output(m0, rt)
        src_sa.sin6_addr = sip6->ip6_src;
        /* we don't currently use sin6_scope_id, but eventually use it */
        src_sa.sin6_scope_id = in6_addr2scopeid(ifp, &sip6->ip6_src);
        src_sa.sin6_addr = sip6->ip6_src;
        /* we don't currently use sin6_scope_id, but eventually use it */
        src_sa.sin6_scope_id = in6_addr2scopeid(ifp, &sip6->ip6_src);

-       if (nd6_is_addr_neighbor(&src_sa, ifp, 0) == 0)
+       RT_UNLOCK(rt);
+       if (nd6_is_addr_neighbor(&src_sa, ifp, 0) == 0) {
+               /* already unlocked */
+               rt = NULL;

                goto fail;
                goto fail;

-       if (IN6_IS_ADDR_MULTICAST(&sip6->ip6_dst))
-               goto fail;      /* what should we do here? */
-
+       }
+       RT_LOCK(rt);
+       if (IN6_IS_ADDR_MULTICAST(&sip6->ip6_dst)) {
+               goto fail;      /* what should we do here? */
+       }

        /* rate limit */
        /* rate limit */

-       if (icmp6_ratelimit(&sip6->ip6_src, ND_REDIRECT, 0))
+       if (icmp6_ratelimit(&sip6->ip6_src, ND_REDIRECT, 0)) {

                goto fail;
                goto fail;

+       }

 
        /*
         * Since we are going to append up to 1280 bytes (= IPV6_MMTU),
 
        /*
         * Since we are going to append up to 1280 bytes (= IPV6_MMTU),


@@ -2394,11 +2749,13 @@ icmp6_redirect_output(m0, rt)
 #if IPV6_MMTU >= MCLBYTES
 # error assumption failed about IPV6_MMTU and MCLBYTES
 #endif
 #if IPV6_MMTU >= MCLBYTES
 # error assumption failed about IPV6_MMTU and MCLBYTES
 #endif

-       MGETHDR(m, M_DONTWAIT, MT_HEADER);
-       if (m && IPV6_MMTU >= MHLEN)
+       MGETHDR(m, M_DONTWAIT, MT_HEADER);      /* MAC-OK */
+       if (m && IPV6_MMTU >= MHLEN) {

                MCLGET(m, M_DONTWAIT);
                MCLGET(m, M_DONTWAIT);

-       if (!m)
+       }
+       if (!m) {

                goto fail;
                goto fail;

+       }

        m->m_pkthdr.rcvif = NULL;
        m->m_len = 0;
        maxlen = M_TRAILINGSPACE(m);
        m->m_pkthdr.rcvif = NULL;
        m->m_len = 0;
        maxlen = M_TRAILINGSPACE(m);


@@ -2413,22 +2770,27 @@ icmp6_redirect_output(m0, rt)
                /* get ip6 linklocal address for ifp(my outgoing interface). */
                struct in6_ifaddr *ia;
                if ((ia = in6ifa_ifpforlinklocal(ifp,
                /* get ip6 linklocal address for ifp(my outgoing interface). */
                struct in6_ifaddr *ia;
                if ((ia = in6ifa_ifpforlinklocal(ifp,

-                                                IN6_IFF_NOTREADY|
-                                                IN6_IFF_ANYCAST)) == NULL)
+                   IN6_IFF_NOTREADY |
+                   IN6_IFF_ANYCAST)) == NULL) {

                        goto fail;
                        goto fail;

+               }
+               IFA_LOCK(&ia->ia_ifa);

                ifp_ll6 = ia->ia_addr.sin6_addr;
                ifp_ll6 = ia->ia_addr.sin6_addr;

-               ifafree(&ia->ia_ifa);
+               IFA_UNLOCK(&ia->ia_ifa);
+               IFA_REMREF(&ia->ia_ifa);

        }
 
        /* get ip6 linklocal address for the router. */
        if (rt->rt_gateway && (rt->rt_flags & RTF_GATEWAY)) {
                struct sockaddr_in6 *sin6;
        }
 
        /* get ip6 linklocal address for the router. */
        if (rt->rt_gateway && (rt->rt_flags & RTF_GATEWAY)) {
                struct sockaddr_in6 *sin6;

-               sin6 = (struct sockaddr_in6 *)rt->rt_gateway;
+               sin6 = (struct sockaddr_in6 *)(void *)rt->rt_gateway;

                router_ll6 = &sin6->sin6_addr;
                router_ll6 = &sin6->sin6_addr;

-               if (!IN6_IS_ADDR_LINKLOCAL(router_ll6))
+               if (!IN6_IS_ADDR_LINKLOCAL(router_ll6)) {

                        router_ll6 = (struct in6_addr *)NULL;
                        router_ll6 = (struct in6_addr *)NULL;

-       } else
+               }
+       } else {

                router_ll6 = (struct in6_addr *)NULL;
                router_ll6 = (struct in6_addr *)NULL;

+       }

 
        /* ip6 */
        ip6 = mtod(m, struct ip6_hdr *);
 
        /* ip6 */
        ip6 = mtod(m, struct ip6_hdr *);


@@ -2452,192 +2814,197 @@ icmp6_redirect_output(m0, rt)
                 * nd_rd->nd_rd_target must be a link-local address in
                 * better router cases.
                 */
                 * nd_rd->nd_rd_target must be a link-local address in
                 * better router cases.
                 */

-               if (!router_ll6)
+               if (!router_ll6) {

                        goto fail;
                        goto fail;

+               }

                bcopy(router_ll6, &nd_rd->nd_rd_target,
                bcopy(router_ll6, &nd_rd->nd_rd_target,

-                     sizeof(nd_rd->nd_rd_target));
+                   sizeof(nd_rd->nd_rd_target));

                bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_dst,
                bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_dst,

-                     sizeof(nd_rd->nd_rd_dst));
+                   sizeof(nd_rd->nd_rd_dst));

        } else {
                /* make sure redtgt == reddst */
                bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_target,
        } else {
                /* make sure redtgt == reddst */
                bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_target,

-                     sizeof(nd_rd->nd_rd_target));
+                   sizeof(nd_rd->nd_rd_target));

                bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_dst,
                bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_dst,

-                     sizeof(nd_rd->nd_rd_dst));
+                   sizeof(nd_rd->nd_rd_dst));

        }
        }

+       RT_UNLOCK(rt);
+       rt = NULL;

 
        p = (u_char *)(nd_rd + 1);
 
 
        p = (u_char *)(nd_rd + 1);
 

-       if (!router_ll6)
+       if (!router_ll6) {

                goto nolladdropt;
                goto nolladdropt;

+       }

 
 

-    {
-       /* target lladdr option */
-       struct rtentry *rt_router = NULL;
-       int len;
-       struct sockaddr_dl *sdl;
-       struct nd_opt_hdr *nd_opt;
-       char *lladdr;
+       {
+               /* target lladdr option */
+               struct rtentry *rt_router = NULL;
+               int len;
+               struct sockaddr_dl *sdl;
+               struct nd_opt_hdr *nd_opt;
+               char *lladdr;
+
+               /* Callee returns a locked route upon success */
+               rt_router = nd6_lookup(router_ll6, 0, ifp, 0);
+               if (!rt_router) {
+                       goto nolladdropt;
+               }
+               RT_LOCK_ASSERT_HELD(rt_router);
+               len = sizeof(*nd_opt) + ifp->if_addrlen;
+               len = (len + 7) & ~7;   /* round by 8 */
+               /* safety check */
+               if (len + (p - (u_char *)ip6) > maxlen) {
+                       RT_REMREF_LOCKED(rt_router);
+                       RT_UNLOCK(rt_router);
+                       goto nolladdropt;
+               }
+
+               if (!(rt_router->rt_flags & RTF_GATEWAY) &&
+                   (rt_router->rt_flags & RTF_LLINFO) &&
+                   (rt_router->rt_gateway->sa_family == AF_LINK) &&
+                   (sdl = (struct sockaddr_dl *)(void *)
+                   rt_router->rt_gateway) && sdl->sdl_alen) {
+                       nd_opt = (struct nd_opt_hdr *)p;
+                       nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
+                       nd_opt->nd_opt_len = len >> 3;
+                       lladdr = (char *)(nd_opt + 1);
+                       bcopy(LLADDR(sdl), lladdr, ifp->if_addrlen);
+                       p += len;
+               }
+               RT_REMREF_LOCKED(rt_router);
+               RT_UNLOCK(rt_router);
+       }

 
 

-       rt_router = nd6_lookup(router_ll6, 0, ifp, 0);
-       if (!rt_router)
-               goto nolladdropt;
-       len = sizeof(*nd_opt) + ifp->if_addrlen;
-       len = (len + 7) & ~7;   /* round by 8 */
-       /* safety check */
-       if (len + (p - (u_char *)ip6) > maxlen)
-               goto nolladdropt;
-       if (!(rt_router->rt_flags & RTF_GATEWAY) &&
-           (rt_router->rt_flags & RTF_LLINFO) &&
-           (rt_router->rt_gateway->sa_family == AF_LINK) &&
-           (sdl = (struct sockaddr_dl *)rt_router->rt_gateway) &&
-           sdl->sdl_alen) {
-               nd_opt = (struct nd_opt_hdr *)p;
-               nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
-               nd_opt->nd_opt_len = len >> 3;
-               lladdr = (char *)(nd_opt + 1);
-               bcopy(LLADDR(sdl), lladdr, ifp->if_addrlen);
-               p += len;
-       }
-    }

 nolladdropt:;
 
        m->m_pkthdr.len = m->m_len = p - (u_char *)ip6;
 
        /* just to be safe */
 nolladdropt:;
 
        m->m_pkthdr.len = m->m_len = p - (u_char *)ip6;
 
        /* just to be safe */

-#ifdef M_DECRYPTED     /*not openbsd*/
-       if (m0->m_flags & M_DECRYPTED)
+#ifdef M_DECRYPTED      /*not openbsd*/
+       if (m0->m_flags & M_DECRYPTED) {

                goto noredhdropt;
                goto noredhdropt;

+       }

 #endif
 #endif

-       if (p - (u_char *)ip6 > maxlen)
+       if (p - (u_char *)ip6 > maxlen) {

                goto noredhdropt;
                goto noredhdropt;

+       }

 
 

-    {
-       /* redirected header option */
-       int len;
-       struct nd_opt_rd_hdr *nd_opt_rh;
-
-       /*
-        * compute the maximum size for icmp6 redirect header option.
-        * XXX room for auth header?
-        */
-       len = maxlen - (p - (u_char *)ip6);
-       len &= ~7;
+       {
+               /* redirected header option */
+               int len;
+               struct nd_opt_rd_hdr *nd_opt_rh;

 
 

-       /* This is just for simplicity. */
-       if (m0->m_pkthdr.len != m0->m_len) {
-               if (m0->m_next) {
-                       m_freem(m0->m_next);
-                       m0->m_next = NULL;
+               /*
+                * compute the maximum size for icmp6 redirect header option.
+                * XXX room for auth header?
+                */
+               len = maxlen - (p - (u_char *)ip6);
+               len &= ~7;
+
+               /* This is just for simplicity. */
+               if (m0->m_pkthdr.len != m0->m_len) {
+                       if (m0->m_next) {
+                               m_freem(m0->m_next);
+                               m0->m_next = NULL;
+                       }
+                       m0->m_pkthdr.len = m0->m_len;

                }
                }

-               m0->m_pkthdr.len = m0->m_len;
-       }

 
 

-       /*
-        * Redirected header option spec (RFC2461 4.6.3) talks nothing
-        * about padding/truncate rule for the original IP packet.
-        * From the discussion on IPv6imp in Feb 1999, the consensus was:
-        * - "attach as much as possible" is the goal
-        * - pad if not aligned (original size can be guessed by original
-        *   ip6 header)
-        * Following code adds the padding if it is simple enough,
-        * and truncates if not.
-        */
-       if (m0->m_next || m0->m_pkthdr.len != m0->m_len)
-               panic("assumption failed in %s:%d\n", __FILE__, __LINE__);
+               /*
+                * Redirected header option spec (RFC2461 4.6.3) talks nothing
+                * about padding/truncate rule for the original IP packet.
+                * From the discussion on IPv6imp in Feb 1999, the consensus was:
+                * - "attach as much as possible" is the goal
+                * - pad if not aligned (original size can be guessed by original
+                *   ip6 header)
+                * Following code adds the padding if it is simple enough,
+                * and truncates if not.
+                */
+               if (m0->m_next || m0->m_pkthdr.len != m0->m_len) {
+                       panic("assumption failed in %s:%d\n", __func__, __LINE__);
+               }

 
 

-       if (len - sizeof(*nd_opt_rh) < m0->m_pkthdr.len) {
-               /* not enough room, truncate */
-               m0->m_pkthdr.len = m0->m_len = len - sizeof(*nd_opt_rh);
-       } else {
-               /* enough room, pad or truncate */
-               size_t extra;
-
-               extra = m0->m_pkthdr.len % 8;
-               if (extra) {
-                       /* pad if easy enough, truncate if not */
-                       if (8 - extra <= M_TRAILINGSPACE(m0)) {
-                               /* pad */
-                               m0->m_len += (8 - extra);
-                               m0->m_pkthdr.len += (8 - extra);
-                       } else {
-                               /* truncate */
-                               m0->m_pkthdr.len -= extra;
-                               m0->m_len -= extra;
+               if (len - sizeof(*nd_opt_rh) < m0->m_pkthdr.len) {
+                       /* not enough room, truncate */
+                       m0->m_pkthdr.len = m0->m_len = len - sizeof(*nd_opt_rh);
+               } else {
+                       /* enough room, pad or truncate */
+                       size_t extra;
+
+                       extra = m0->m_pkthdr.len % 8;
+                       if (extra) {
+                               /* pad if easy enough, truncate if not */
+                               if (8 - extra <= M_TRAILINGSPACE(m0)) {
+                                       /* pad */
+                                       m0->m_len += (8 - extra);
+                                       m0->m_pkthdr.len += (8 - extra);
+                               } else {
+                                       /* truncate */
+                                       m0->m_pkthdr.len -= extra;
+                                       m0->m_len -= extra;
+                               }

                        }
                        }

+                       len = m0->m_pkthdr.len + sizeof(*nd_opt_rh);
+                       m0->m_pkthdr.len = m0->m_len = len - sizeof(*nd_opt_rh);

                }
                }

-               len = m0->m_pkthdr.len + sizeof(*nd_opt_rh);
-               m0->m_pkthdr.len = m0->m_len = len - sizeof(*nd_opt_rh);
-       }

 
 

-       nd_opt_rh = (struct nd_opt_rd_hdr *)p;
-       bzero(nd_opt_rh, sizeof(*nd_opt_rh));
-       nd_opt_rh->nd_opt_rh_type = ND_OPT_REDIRECTED_HEADER;
-       nd_opt_rh->nd_opt_rh_len = len >> 3;
-       p += sizeof(*nd_opt_rh);
-       m->m_pkthdr.len = m->m_len = p - (u_char *)ip6;
+               nd_opt_rh = (struct nd_opt_rd_hdr *)p;
+               bzero(nd_opt_rh, sizeof(*nd_opt_rh));
+               nd_opt_rh->nd_opt_rh_type = ND_OPT_REDIRECTED_HEADER;
+               nd_opt_rh->nd_opt_rh_len = len >> 3;
+               p += sizeof(*nd_opt_rh);
+               m->m_pkthdr.len = m->m_len = p - (u_char *)ip6;

 
 

-       /* connect m0 to m */
-       m->m_next = m0;
-       m->m_pkthdr.len = m->m_len + m0->m_len;
-    }
+               /* connect m0 to m */
+               m->m_next = m0;
+               m->m_pkthdr.len = m->m_len + m0->m_len;
+       }

 noredhdropt:;
 
 noredhdropt:;
 

-       if (IN6_IS_ADDR_LINKLOCAL(&sip6->ip6_src))
-               sip6->ip6_src.s6_addr16[1] = 0;
-       if (IN6_IS_ADDR_LINKLOCAL(&sip6->ip6_dst))
-               sip6->ip6_dst.s6_addr16[1] = 0;
-#if 0
-       if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src))
-               ip6->ip6_src.s6_addr16[1] = 0;
-       if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst))
-               ip6->ip6_dst.s6_addr16[1] = 0;
-#endif
-       if (IN6_IS_ADDR_LINKLOCAL(&nd_rd->nd_rd_target))
-               nd_rd->nd_rd_target.s6_addr16[1] = 0;
-       if (IN6_IS_ADDR_LINKLOCAL(&nd_rd->nd_rd_dst))
-               nd_rd->nd_rd_dst.s6_addr16[1] = 0;
+       /* XXX: clear embedded link IDs in the inner header */
+       in6_clearscope(&sip6->ip6_src);
+       in6_clearscope(&sip6->ip6_dst);
+       in6_clearscope(&nd_rd->nd_rd_target);
+       in6_clearscope(&nd_rd->nd_rd_dst);

 
        ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
 
        nd_rd->nd_rd_cksum = 0;
        nd_rd->nd_rd_cksum
 
        ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
 
        nd_rd->nd_rd_cksum = 0;
        nd_rd->nd_rd_cksum

-               = in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), ntohs(ip6->ip6_plen));
+               = in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), ntohs(ip6->ip6_plen));

 
        /* send the packet to outside... */
 
        /* send the packet to outside... */

-#if IPSEC
-       /* Don't lookup socket */
-       if (ipsec_bypass == 0)
-               (void)ipsec_setsocket(m, NULL);
-#endif /*IPSEC*/
-       ip6_output(m, NULL, NULL, 0, NULL, &outif, 0);
+       ip6oa.ip6oa_boundif = ifp->if_index;
+       ip6oa.ip6oa_flags |= IP6OAF_BOUND_IF;
+
+       ip6_output(m, NULL, NULL, IPV6_OUTARGS, NULL, &outif, &ip6oa);

        if (outif) {
                icmp6_ifstat_inc(outif, ifs6_out_msg);
                icmp6_ifstat_inc(outif, ifs6_out_redirect);
        if (outif) {
                icmp6_ifstat_inc(outif, ifs6_out_msg);
                icmp6_ifstat_inc(outif, ifs6_out_redirect);

+               ifnet_release(outif);

        }
        icmp6stat.icp6s_outhist[ND_REDIRECT]++;
 
        return;
 
 fail:
        }
        icmp6stat.icp6s_outhist[ND_REDIRECT]++;
 
        return;
 
 fail:

-       if (m)
+       if (rt != NULL) {
+               RT_UNLOCK(rt);
+       }
+       if (m) {

                m_freem(m);
                m_freem(m);

-       if (m0)
+       }
+       if (m0) {

                m_freem(m0);
                m_freem(m0);

+       }

 }
 
 }
 

-#if HAVE_NRL_INPCB
-#define sotoin6pcb     sotoinpcb
-#define in6pcb         inpcb
-#define in6p_icmp6filt inp_icmp6filt
-#endif

 /*
  * ICMPv6 socket option processing.
  */
 int
 /*
  * ICMPv6 socket option processing.
  */
 int

-icmp6_ctloutput(so, sopt)
-       struct socket *so;
-       struct sockopt *sopt;
+icmp6_ctloutput(struct socket *so, struct sockopt *sopt)

 {
        int error = 0;
        int optlen;
 {
        int error = 0;
        int optlen;


@@ -2649,8 +3016,9 @@ icmp6_ctloutput(so, sopt)
                op = sopt->sopt_dir;
                optname = sopt->sopt_name;
                optlen = sopt->sopt_valsize;
                op = sopt->sopt_dir;
                optname = sopt->sopt_name;
                optlen = sopt->sopt_valsize;

-       } else
+       } else {

                level = op = optname = optlen = 0;
                level = op = optname = optlen = 0;

+       }

 
        if (level != IPPROTO_ICMPV6) {
                return EINVAL;
 
        if (level != IPPROTO_ICMPV6) {
                return EINVAL;


@@ -2660,10 +3028,10 @@ icmp6_ctloutput(so, sopt)
        case PRCO_SETOPT:
                switch (optname) {
                case ICMP6_FILTER:
        case PRCO_SETOPT:
                switch (optname) {
                case ICMP6_FILTER:

-                   {
+               {

                        struct icmp6_filter *p;
 
                        struct icmp6_filter *p;
 

-                       if (optlen != sizeof(*p)) {
+                       if (optlen != 0 && optlen != sizeof(*p)) {

                                error = EMSGSIZE;
                                break;
                        }
                                error = EMSGSIZE;
                                break;
                        }


@@ -2671,10 +3039,19 @@ icmp6_ctloutput(so, sopt)
                                error = EINVAL;
                                break;
                        }
                                error = EINVAL;
                                break;
                        }

-                       error = sooptcopyin(sopt, inp->in6p_icmp6filt, optlen,
-                               optlen);
+
+                       if (optlen == 0) {
+                               /* According to RFC 3542, an installed filter can be
+                                * cleared by issuing a setsockopt for ICMP6_FILTER
+                                * with a zero length.
+                                */
+                               ICMP6_FILTER_SETPASSALL(inp->in6p_icmp6filt);
+                       } else {
+                               error = sooptcopyin(sopt, inp->in6p_icmp6filt, optlen,
+                                   optlen);
+                       }

                        break;
                        break;

-                   }
+               }

 
                default:
                        error = ENOPROTOOPT;
 
                default:
                        error = ENOPROTOOPT;


@@ -2685,15 +3062,15 @@ icmp6_ctloutput(so, sopt)
        case PRCO_GETOPT:
                switch (optname) {
                case ICMP6_FILTER:
        case PRCO_GETOPT:
                switch (optname) {
                case ICMP6_FILTER:

-                   {
+               {

                        if (inp->in6p_icmp6filt == NULL) {
                                error = EINVAL;
                                break;
                        }
                        error = sooptcopyout(sopt, inp->in6p_icmp6filt,
                        if (inp->in6p_icmp6filt == NULL) {
                                error = EINVAL;
                                break;
                        }
                        error = sooptcopyout(sopt, inp->in6p_icmp6filt,

-                               sizeof(struct icmp6_filter));
+                           min(sizeof(struct icmp6_filter), optlen));

                        break;
                        break;

-                   }
+               }

 
                default:
                        error = ENOPROTOOPT;
 
                default:
                        error = ENOPROTOOPT;


@@ -2702,83 +3079,202 @@ icmp6_ctloutput(so, sopt)
                break;
        }
 
                break;
        }
 

-       return(error);
+       return error;

 }
 }

-#if HAVE_NRL_INPCB
-#undef sotoin6pcb
-#undef in6pcb
-#undef in6p_icmp6filt
-#endif
-
-#ifndef HAVE_PPSRATECHECK
-#ifndef timersub
-#define        timersub(tvp, uvp, vvp)                                         \
-       do {                                                            \
-               (vvp)->tv_sec = (tvp)->tv_sec - (uvp)->tv_sec;          \
-               (vvp)->tv_usec = (tvp)->tv_usec - (uvp)->tv_usec;       \
-               if ((vvp)->tv_usec < 0) {                               \
-                       (vvp)->tv_sec--;                                \
-                       (vvp)->tv_usec += 1000000;                      \
-               }                                                       \
-       } while (0)
-#endif

 
 /*
 
 /*

- * ppsratecheck(): packets (or events) per second limitation.
+ * ICMPv6 socket datagram option processing.

  */
  */

-static int
-ppsratecheck(lasttime, curpps, maxpps)
-       struct timeval *lasttime;
-       int *curpps;
-       int maxpps;     /* maximum pps allowed */
+int
+icmp6_dgram_ctloutput(struct socket *so, struct sockopt *sopt)

 {
 {

-       struct timeval tv, delta;
-       int s, rv;
+       if (kauth_cred_issuser(so->so_cred)) {
+               return icmp6_ctloutput(so, sopt);
+       }

 
 

-       s = splclock(); 
-       microtime(&tv);
-       splx(s);
+       if (sopt->sopt_level == IPPROTO_ICMPV6) {
+               switch (sopt->sopt_name) {
+               case ICMP6_FILTER:
+                       return icmp6_ctloutput(so, sopt);
+               default:
+                       return EPERM;
+               }
+       }

 
 

-       timersub(&tv, lasttime, &delta);
+       if (sopt->sopt_level != IPPROTO_IPV6) {
+               return EINVAL;
+       }
+
+       switch (sopt->sopt_name) {
+       case IPV6_UNICAST_HOPS:
+       case IPV6_CHECKSUM:
+       case IPV6_V6ONLY:
+       case IPV6_USE_MIN_MTU:
+       case IPV6_RECVRTHDR:
+       case IPV6_RECVPKTINFO:
+       case IPV6_RECVHOPLIMIT:
+       case IPV6_PATHMTU:
+       case IPV6_PKTINFO:
+       case IPV6_HOPLIMIT:
+       case IPV6_HOPOPTS:
+       case IPV6_DSTOPTS:
+       case IPV6_MULTICAST_IF:
+       case IPV6_MULTICAST_HOPS:
+       case IPV6_MULTICAST_LOOP:
+       case IPV6_JOIN_GROUP:
+       case IPV6_LEAVE_GROUP:
+       case IPV6_PORTRANGE:
+       case IPV6_IPSEC_POLICY:
+       case IPV6_RECVTCLASS:
+       case IPV6_TCLASS:
+       case IPV6_2292PKTOPTIONS:
+       case IPV6_2292PKTINFO:
+       case IPV6_2292HOPLIMIT:
+       case IPV6_2292HOPOPTS:
+       case IPV6_2292DSTOPTS:
+       case IPV6_2292RTHDR:
+       case IPV6_BOUND_IF:
+       case IPV6_NO_IFT_CELLULAR:
+
+               return ip6_ctloutput(so, sopt);
+
+       default:
+               return EPERM;
+       }
+}
+
+__private_extern__ int
+icmp6_dgram_send(struct socket *so, int flags, struct mbuf *m,
+    struct sockaddr *nam, struct mbuf *control, struct proc *p)
+{
+#pragma unused(flags, p)
+       int error = 0;
+       struct inpcb *inp = sotoinpcb(so);
+       struct sockaddr_in6 tmp;
+       struct sockaddr_in6 *dst = (struct sockaddr_in6 *)(void *)nam;
+       struct icmp6_hdr *icmp6;
+
+       if (inp == NULL
+#if NECP
+           || (necp_socket_should_use_flow_divert(inp))
+#endif /* NECP */
+           ) {
+               error = (inp == NULL ? EINVAL : EPROTOTYPE);
+               goto bad;
+       }
+
+       if (kauth_cred_issuser(so->so_cred)) {
+               return rip6_output(m, so, SIN6(nam), control, 0);
+       }
+
+       /* always copy sockaddr to avoid overwrites */
+       if (so->so_state & SS_ISCONNECTED) {
+               if (nam != NULL) {
+                       error = EISCONN;
+                       goto bad;
+               }
+               /* XXX */
+               bzero(&tmp, sizeof(tmp));
+               tmp.sin6_family = AF_INET6;
+               tmp.sin6_len = sizeof(struct sockaddr_in6);
+               bcopy(&inp->in6p_faddr, &tmp.sin6_addr,
+                   sizeof(struct in6_addr));
+               dst = &tmp;
+       } else {
+               if (nam == NULL) {
+                       error = ENOTCONN;
+                       goto bad;
+               }
+               tmp = *(struct sockaddr_in6 *)(void *)nam;
+               dst = &tmp;
+       }

 
        /*
 
        /*

-        * Check for 0,0 so that the message will be seen at least once.
-        * If more than one second has passed since the last update of
-        * lasttime, reset the counter.
-        *
-        * we do increment *curpps even in *curpps < maxpps case, as some may
-        * try to use *curpps for stat purposes as well.
-        */
-       if ((lasttime->tv_sec == 0 && lasttime->tv_usec == 0) ||
-           delta.tv_sec >= 1) {
-               *lasttime = tv;
-               *curpps = 0;
-               rv = 1;
-       } else if (maxpps < 0)
-               rv = 1;
-       else if (*curpps < maxpps)
-               rv = 1;
-       else
-               rv = 0;
-
-#if 1 /* DIAGNOSTIC? */
-       /* be careful about wrap-around */
-       if (*curpps + 1 > *curpps)
-               *curpps = *curpps + 1;
-#else
-       /*
-        * assume that there's not too many calls to this function.
-        * not sure if the assumption holds, as it depends on *caller's*
-        * behavior, not the behavior of this function.
-        * IMHO it is wrong to make assumption on the caller's behavior,
-        * so the above #if is #if 1, not #ifdef DIAGNOSTIC.
+        * For an ICMPv6 packet, we should know its type and code

         */
         */

-       *curpps = *curpps + 1;
+       if (SOCK_PROTO(so) == IPPROTO_ICMPV6) {
+               if (m->m_len < sizeof(struct icmp6_hdr) &&
+                   (m = m_pullup(m, sizeof(struct icmp6_hdr))) == NULL) {
+                       error = ENOBUFS;
+                       goto bad;
+               }
+               icmp6 = mtod(m, struct icmp6_hdr *);
+
+               /*
+                * Allow only to send echo request and node information request
+                * See RFC 2463 for Echo Request Message format
+                */
+               if ((icmp6->icmp6_type == ICMP6_ECHO_REQUEST &&
+                   icmp6->icmp6_code == 0) ||
+                   (icmp6->icmp6_type == ICMP6_NI_QUERY &&
+                   (icmp6->icmp6_code == ICMP6_NI_SUBJ_IPV6 ||
+                   icmp6->icmp6_code == ICMP6_NI_SUBJ_FQDN))) {
+                       /* Good */
+                       ;
+               } else {
+                       error = EPERM;
+                       goto bad;
+               }
+       }
+
+#if ENABLE_DEFAULT_SCOPE
+       if (dst->sin6_scope_id == 0) {  /* not change if specified  */
+               dst->sin6_scope_id = scope6_addr2default(&dst->sin6_addr);
+       }

 #endif
 
 #endif
 

-       return (rv);
+       return rip6_output(m, so, dst, control, 0);
+bad:
+       VERIFY(error != 0);
+
+       if (m != NULL) {
+               m_freem(m);
+       }
+       if (control != NULL) {
+               m_freem(control);
+       }
+
+       return error;

 }
 }

-#endif
+
+/* Like rip6_attach but without root privilege enforcement */
+__private_extern__ int
+icmp6_dgram_attach(struct socket *so, int proto, struct proc *p)
+{
+       struct inpcb *inp;
+       int error;
+
+       inp = sotoinpcb(so);
+       if (inp) {
+               panic("icmp6_dgram_attach");
+       }
+
+       if (proto != IPPROTO_ICMPV6) {
+               return EINVAL;
+       }
+
+       error = soreserve(so, rip_sendspace, rip_recvspace);
+       if (error) {
+               return error;
+       }
+       error = in_pcballoc(so, &ripcbinfo, p);
+       if (error) {
+               return error;
+       }
+       inp = (struct inpcb *)so->so_pcb;
+       inp->inp_vflag |= INP_IPV6;
+       inp->in6p_ip6_nxt = IPPROTO_ICMPV6;
+       inp->in6p_hops = -1;    /* use kernel default */
+       inp->in6p_cksum = -1;
+       MALLOC(inp->in6p_icmp6filt, struct icmp6_filter *,
+           sizeof(struct icmp6_filter), M_PCB, M_WAITOK);
+       if (inp->in6p_icmp6filt == NULL) {
+               return ENOMEM;
+       }
+       ICMP6_FILTER_SETPASSALL(inp->in6p_icmp6filt);
+       return 0;
+}
+

 
 /*
  * Perform rate limit check.
 
 /*
  * Perform rate limit check.


@@ -2786,20 +3282,25 @@ ppsratecheck(lasttime, curpps, maxpps)
  * Returns 1 if the router SHOULD NOT send this icmp6 packet due to rate
  * limitation.
  *
  * Returns 1 if the router SHOULD NOT send this icmp6 packet due to rate
  * limitation.
  *

- * XXX per-destination/type check necessary?
+ * XXX per-destination check necessary?

  */
 static int
  */
 static int

-icmp6_ratelimit(dst, type, code)
-       const struct in6_addr *dst;     /* not used at this moment */
-       const int type;                 /* not used at this moment */
-       const int code;                 /* not used at this moment */
+icmp6_ratelimit(
+       __unused const struct in6_addr *dst,    /* not used at this moment */
+       const int type,
+       __unused const int code)

 {
        int ret;
 
 {
        int ret;
 

-       ret = 0;        /* okay to send */
+       ret = 0;        /* okay to send */

 
        /* PPS limit */
 
        /* PPS limit */

-       if (!ppsratecheck(&icmp6errppslim_last, &icmp6errpps_count,
+       if (type == ND_ROUTER_ADVERT) {
+               if (!ppsratecheck(&icmp6rappslim_last, &icmp6rapps_count,
+                   icmp6rappslim)) {
+                       ret++;
+               }
+       } else if (!ppsratecheck(&icmp6errppslim_last, &icmp6errpps_count,

            icmp6errppslim)) {
                /* The packet is subject to rate limit */
                ret++;
            icmp6errppslim)) {
                /* The packet is subject to rate limit */
                ret++;