1/*
2 * Copyright (c) 2000-2017 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29/*
30 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
31 * All rights reserved.
32 *
33 * Redistribution and use in source and binary forms, with or without
34 * modification, are permitted provided that the following conditions
35 * are met:
36 * 1. Redistributions of source code must retain the above copyright
37 * notice, this list of conditions and the following disclaimer.
38 * 2. Redistributions in binary form must reproduce the above copyright
39 * notice, this list of conditions and the following disclaimer in the
40 * documentation and/or other materials provided with the distribution.
41 * 3. Neither the name of the project nor the names of its contributors
42 * may be used to endorse or promote products derived from this software
43 * without specific prior written permission.
44 *
45 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
46 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
47 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
48 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
49 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
50 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
51 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
52 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
53 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
54 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
55 * SUCH DAMAGE.
56 */
57
58/*
59 * Copyright (c) 1982, 1986, 1988, 1990, 1993
60 * The Regents of the University of California. All rights reserved.
61 *
62 * Redistribution and use in source and binary forms, with or without
63 * modification, are permitted provided that the following conditions
64 * are met:
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
67 * 2. Redistributions in binary form must reproduce the above copyright
68 * notice, this list of conditions and the following disclaimer in the
69 * documentation and/or other materials provided with the distribution.
70 * 3. All advertising materials mentioning features or use of this software
71 * must display the following acknowledgement:
72 * This product includes software developed by the University of
73 * California, Berkeley and its contributors.
74 * 4. Neither the name of the University nor the names of its contributors
75 * may be used to endorse or promote products derived from this software
76 * without specific prior written permission.
77 *
78 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
79 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
80 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
81 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
82 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
83 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
84 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
85 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
86 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
87 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
88 * SUCH DAMAGE.
89 *
90 * @(#)ip_output.c 8.3 (Berkeley) 1/21/94
91 */
92/*
93 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
94 * support for mandatory and extensible security protections. This notice
95 * is included in support of clause 2.2 (b) of the Apple Public License,
96 * Version 2.0.
97 */
98
99#include <sys/param.h>
100#include <sys/malloc.h>
101#include <sys/mbuf.h>
102#include <sys/errno.h>
103#include <sys/protosw.h>
104#include <sys/socket.h>
105#include <sys/socketvar.h>
106#include <sys/systm.h>
107#include <sys/kernel.h>
108#include <sys/proc.h>
109#include <sys/kauth.h>
110#include <sys/mcache.h>
111#include <sys/sysctl.h>
112#include <kern/zalloc.h>
113#include <libkern/OSByteOrder.h>
114
115#include <pexpert/pexpert.h>
116#include <mach/sdt.h>
117
118#include <net/if.h>
119#include <net/route.h>
120#include <net/dlil.h>
121#include <net/net_api_stats.h>
122#include <net/net_osdep.h>
123#include <net/net_perf.h>
124
125#include <netinet/ip.h>
126#include <netinet/in.h>
127#include <netinet/in_var.h>
128#include <netinet/ip_var.h>
129#include <netinet6/in6_var.h>
130#include <netinet/ip6.h>
131#include <netinet/kpi_ipfilter_var.h>
132#include <netinet/in_tclass.h>
133
134#include <netinet6/ip6protosw.h>
135#include <netinet/icmp6.h>
136#include <netinet6/ip6_var.h>
137#include <netinet/in_pcb.h>
138#include <netinet6/nd6.h>
139#include <netinet6/scope6_var.h>
140#if IPSEC
141#include <netinet6/ipsec.h>
142#include <netinet6/ipsec6.h>
143#include <netkey/key.h>
144extern int ipsec_bypass;
145#endif /* IPSEC */
146
147#if NECP
148#include <net/necp.h>
149#endif /* NECP */
150
151#if CONFIG_MACF_NET
152#include <security/mac.h>
153#endif /* CONFIG_MACF_NET */
154
155#if DUMMYNET
156#include <netinet/ip_fw.h>
157#include <netinet/ip_dummynet.h>
158#endif /* DUMMYNET */
159
160#if PF
161#include <net/pfvar.h>
162#endif /* PF */
163
164static int sysctl_reset_ip6_output_stats SYSCTL_HANDLER_ARGS;
165static int sysctl_ip6_output_measure_bins SYSCTL_HANDLER_ARGS;
166static int sysctl_ip6_output_getperf SYSCTL_HANDLER_ARGS;
167static int ip6_copyexthdr(struct mbuf **, caddr_t, int);
168static void ip6_out_cksum_stats(int, u_int32_t);
169static int ip6_insert_jumboopt(struct ip6_exthdrs *, u_int32_t);
170static int ip6_insertfraghdr(struct mbuf *, struct mbuf *, int,
171 struct ip6_frag **);
172static int ip6_getpmtu(struct route_in6 *, struct route_in6 *,
173 struct ifnet *, struct in6_addr *, u_int32_t *, boolean_t *);
174static int ip6_pcbopts(struct ip6_pktopts **, struct mbuf *, struct socket *,
175 struct sockopt *sopt);
176static int ip6_pcbopt(int, u_char *, int, struct ip6_pktopts **, int);
177static int ip6_getpcbopt(struct ip6_pktopts *, int, struct sockopt *);
178static int copypktopts(struct ip6_pktopts *, struct ip6_pktopts *, int);
179static void im6o_trace(struct ip6_moptions *, int);
180static int ip6_setpktopt(int, u_char *, int, struct ip6_pktopts *, int,
181 int, int);
182static int ip6_splithdr(struct mbuf *, struct ip6_exthdrs *);
183static void ip6_output_checksum(struct ifnet *, uint32_t, struct mbuf *,
184 int, uint32_t, uint32_t);
185extern int udp_ctloutput(struct socket *, struct sockopt *);
186static int ip6_fragment_packet(struct mbuf **m,
187 struct ip6_pktopts *opt, struct ip6_exthdrs *exthdrsp, struct ifnet *ifp,
188 uint32_t mtu, boolean_t alwaysfrag, uint32_t unfragpartlen,
189 struct route_in6 *ro_pmtu, int nxt0, uint32_t optlen);
190
191SYSCTL_DECL(_net_inet6_ip6);
192
193static int ip6_output_measure = 0;
194SYSCTL_PROC(_net_inet6_ip6, OID_AUTO, output_perf,
195 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED,
196 &ip6_output_measure, 0, sysctl_reset_ip6_output_stats, "I", "Do time measurement");
197
198static uint64_t ip6_output_measure_bins = 0;
199SYSCTL_PROC(_net_inet6_ip6, OID_AUTO, output_perf_bins,
200 CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED, &ip6_output_measure_bins, 0,
201 sysctl_ip6_output_measure_bins, "I",
202 "bins for chaining performance data histogram");
203
204static net_perf_t net_perf;
205SYSCTL_PROC(_net_inet6_ip6, OID_AUTO, output_perf_data,
206 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED,
207 0, 0, sysctl_ip6_output_getperf, "S,net_perf",
208 "IP6 output performance data (struct net_perf, net/net_perf.h)");
209
210#define IM6O_TRACE_HIST_SIZE 32 /* size of trace history */
211
212/* For gdb */
213__private_extern__ unsigned int im6o_trace_hist_size = IM6O_TRACE_HIST_SIZE;
214
215struct ip6_moptions_dbg {
216 struct ip6_moptions im6o; /* ip6_moptions */
217 u_int16_t im6o_refhold_cnt; /* # of IM6O_ADDREF */
218 u_int16_t im6o_refrele_cnt; /* # of IM6O_REMREF */
219 /*
220 * Alloc and free callers.
221 */
222 ctrace_t im6o_alloc;
223 ctrace_t im6o_free;
224 /*
225 * Circular lists of IM6O_ADDREF and IM6O_REMREF callers.
226 */
227 ctrace_t im6o_refhold[IM6O_TRACE_HIST_SIZE];
228 ctrace_t im6o_refrele[IM6O_TRACE_HIST_SIZE];
229};
230
231#if DEBUG
232static unsigned int im6o_debug = 1; /* debugging (enabled) */
233#else
234static unsigned int im6o_debug; /* debugging (disabled) */
235#endif /* !DEBUG */
236
237static unsigned int im6o_size; /* size of zone element */
238static struct zone *im6o_zone; /* zone for ip6_moptions */
239
240#define IM6O_ZONE_MAX 64 /* maximum elements in zone */
241#define IM6O_ZONE_NAME "ip6_moptions" /* zone name */
242
243/*
244 * ip6_output() calls ip6_output_list() to do the work
245 */
246int
247ip6_output(struct mbuf *m0, struct ip6_pktopts *opt,
248 struct route_in6 *ro, int flags, struct ip6_moptions *im6o,
249 struct ifnet **ifpp, struct ip6_out_args *ip6oa)
250{
251 return ip6_output_list(m0, 0, opt, ro, flags, im6o, ifpp, ip6oa);
252}
253
254/*
255 * IP6 output. Each packet in mbuf chain m contains a skeletal IP6
256 * header (with pri, len, nxt, hlim, src, dst).
257 * This function may modify ver and hlim only.
258 * The mbuf chain containing the packet will be freed.
259 * The mbuf opt, if present, will not be freed.
260 *
261 * If ro is non-NULL and has valid ro->ro_rt, route lookup would be
262 * skipped and ro->ro_rt would be used. Otherwise the result of route
263 * lookup is stored in ro->ro_rt.
264 *
265 * type of "mtu": rt_rmx.rmx_mtu is u_int32_t, ifnet.ifr_mtu is int, and
266 * nd_ifinfo.linkmtu is u_int32_t. so we use u_int32_t to hold largest one,
267 * which is rt_rmx.rmx_mtu.
268 */
269int
270ip6_output_list(struct mbuf *m0, int packetchain, struct ip6_pktopts *opt,
271 struct route_in6 *ro, int flags, struct ip6_moptions *im6o,
272 struct ifnet **ifpp, struct ip6_out_args *ip6oa)
273{
274 struct ip6_hdr *ip6;
275 u_char *nexthdrp;
276 struct ifnet *ifp = NULL, *origifp = NULL; /* refcnt'd */
277 struct ifnet **ifpp_save = ifpp;
278 struct mbuf *m, *mprev;
279 struct mbuf *sendchain = NULL, *sendchain_last = NULL;
280 struct mbuf *inputchain = NULL;
281 int nxt0 = 0;
282 struct route_in6 *ro_pmtu = NULL;
283 struct rtentry *rt = NULL;
284 struct sockaddr_in6 *dst = NULL, src_sa, dst_sa;
285 int error = 0;
286 struct in6_ifaddr *ia = NULL, *src_ia = NULL;
287 u_int32_t mtu = 0;
288 boolean_t alwaysfrag = FALSE;
289 u_int32_t optlen = 0, plen = 0, unfragpartlen = 0;
290 struct ip6_rthdr *rh;
291 struct in6_addr finaldst;
292 ipfilter_t inject_filter_ref;
293 struct ipf_pktopts *ippo = NULL;
294 struct flowadv *adv = NULL;
295 uint32_t pktcnt = 0;
296 uint32_t packets_processed = 0;
297 struct timeval start_tv;
298#if DUMMYNET
299 struct m_tag *tag;
300 struct ip6_out_args saved_ip6oa;
301 struct sockaddr_in6 dst_buf;
302#endif /* DUMMYNET */
303#if IPSEC
304 struct socket *so = NULL;
305 struct secpolicy *sp = NULL;
306 struct route_in6 *ipsec_saved_route = NULL;
307 boolean_t needipsectun = FALSE;
308#endif /* IPSEC */
309#if NECP
310 necp_kernel_policy_result necp_result = 0;
311 necp_kernel_policy_result_parameter necp_result_parameter;
312 necp_kernel_policy_id necp_matched_policy_id = 0;
313#endif /* NECP */
314 struct {
315 struct ipf_pktopts ipf_pktopts;
316 struct ip6_exthdrs exthdrs;
317 struct route_in6 ip6route;
318#if IPSEC
319 struct ipsec_output_state ipsec_state;
320#endif /* IPSEC */
321#if NECP
322 struct route_in6 necp_route;
323#endif /* NECP */
324#if DUMMYNET
325 struct route_in6 saved_route;
326 struct route_in6 saved_ro_pmtu;
327 struct ip_fw_args args;
328#endif /* DUMMYNET */
329 } ip6obz;
330#define ipf_pktopts ip6obz.ipf_pktopts
331#define exthdrs ip6obz.exthdrs
332#define ip6route ip6obz.ip6route
333#define ipsec_state ip6obz.ipsec_state
334#define necp_route ip6obz.necp_route
335#define saved_route ip6obz.saved_route
336#define saved_ro_pmtu ip6obz.saved_ro_pmtu
337#define args ip6obz.args
338 union {
339 struct {
340 boolean_t select_srcif : 1;
341 boolean_t hdrsplit : 1;
342 boolean_t route_selected : 1;
343 boolean_t dontfrag : 1;
344#if IPSEC
345 boolean_t needipsec : 1;
346 boolean_t noipsec : 1;
347#endif /* IPSEC */
348 };
349 uint32_t raw;
350 } ip6obf = { .raw = 0 };
351
352 if (ip6_output_measure)
353 net_perf_start_time(&net_perf, &start_tv);
354
355 VERIFY(m0->m_flags & M_PKTHDR);
356
357 /* zero out {saved_route, saved_ro_pmtu, ip6route, exthdrs, args} */
358 bzero(&ip6obz, sizeof (ip6obz));
359
360#if DUMMYNET
361 if (SLIST_EMPTY(&m0->m_pkthdr.tags))
362 goto tags_done;
363
364 /* Grab info from mtags prepended to the chain */
365 if ((tag = m_tag_locate(m0, KERNEL_MODULE_TAG_ID,
366 KERNEL_TAG_TYPE_DUMMYNET, NULL)) != NULL) {
367 struct dn_pkt_tag *dn_tag;
368
369 /*
370 * ip6_output_list() cannot handle chains of packets reinjected
371 * by dummynet. The same restriction applies to
372 * ip_output_list().
373 */
374 VERIFY(0 == packetchain);
375
376 dn_tag = (struct dn_pkt_tag *)(tag+1);
377 args.fwa_pf_rule = dn_tag->dn_pf_rule;
378
379 bcopy(&dn_tag->dn_dst6, &dst_buf, sizeof (dst_buf));
380 dst = &dst_buf;
381 ifp = dn_tag->dn_ifp;
382 if (ifp != NULL)
383 ifnet_reference(ifp);
384 flags = dn_tag->dn_flags;
385 if (dn_tag->dn_flags & IPV6_OUTARGS) {
386 saved_ip6oa = dn_tag->dn_ip6oa;
387 ip6oa = &saved_ip6oa;
388 }
389
390 saved_route = dn_tag->dn_ro6;
391 ro = &saved_route;
392 saved_ro_pmtu = dn_tag->dn_ro6_pmtu;
393 ro_pmtu = &saved_ro_pmtu;
394 origifp = dn_tag->dn_origifp;
395 if (origifp != NULL)
396 ifnet_reference(origifp);
397 mtu = dn_tag->dn_mtu;
398 alwaysfrag = (dn_tag->dn_alwaysfrag != 0);
399 unfragpartlen = dn_tag->dn_unfragpartlen;
400
401 bcopy(&dn_tag->dn_exthdrs, &exthdrs, sizeof (exthdrs));
402
403 m_tag_delete(m0, tag);
404 }
405
406tags_done:
407#endif /* DUMMYNET */
408
409 m = m0;
410
411#if IPSEC
412 if (ipsec_bypass == 0) {
413 so = ipsec_getsocket(m);
414 if (so != NULL) {
415 (void) ipsec_setsocket(m, NULL);
416 }
417 /* If packet is bound to an interface, check bound policies */
418 if ((flags & IPV6_OUTARGS) &&
419 (ip6oa->ip6oa_flags & IP6OAF_BOUND_IF) &&
420 ip6oa->ip6oa_boundif != IFSCOPE_NONE) {
421 /* ip6obf.noipsec is a bitfield, use temp integer */
422 int noipsec = 0;
423
424 if (ipsec6_getpolicybyinterface(m, IPSEC_DIR_OUTBOUND,
425 flags, ip6oa, &noipsec, &sp) != 0)
426 goto bad;
427
428 ip6obf.noipsec = (noipsec != 0);
429 }
430 }
431#endif /* IPSEC */
432
433 ippo = &ipf_pktopts;
434
435 if (flags & IPV6_OUTARGS) {
436 /*
437 * In the forwarding case, only the ifscope value is used,
438 * as source interface selection doesn't take place.
439 */
440 if ((ip6obf.select_srcif = (!(flags & (IPV6_FORWARDING |
441 IPV6_UNSPECSRC | IPV6_FLAG_NOSRCIFSEL)) &&
442 (ip6oa->ip6oa_flags & IP6OAF_SELECT_SRCIF))))
443 ipf_pktopts.ippo_flags |= IPPOF_SELECT_SRCIF;
444
445 if ((ip6oa->ip6oa_flags & IP6OAF_BOUND_IF) &&
446 ip6oa->ip6oa_boundif != IFSCOPE_NONE) {
447 ipf_pktopts.ippo_flags |= (IPPOF_BOUND_IF |
448 (ip6oa->ip6oa_boundif << IPPOF_SHIFT_IFSCOPE));
449 }
450
451 if (ip6oa->ip6oa_flags & IP6OAF_BOUND_SRCADDR)
452 ipf_pktopts.ippo_flags |= IPPOF_BOUND_SRCADDR;
453 } else {
454 ip6obf.select_srcif = FALSE;
455 if (flags & IPV6_OUTARGS) {
456 ip6oa->ip6oa_boundif = IFSCOPE_NONE;
457 ip6oa->ip6oa_flags &= ~(IP6OAF_SELECT_SRCIF |
458 IP6OAF_BOUND_IF | IP6OAF_BOUND_SRCADDR);
459 }
460 }
461
462 if (flags & IPV6_OUTARGS) {
463 if (ip6oa->ip6oa_flags & IP6OAF_NO_CELLULAR)
464 ipf_pktopts.ippo_flags |= IPPOF_NO_IFT_CELLULAR;
465 if (ip6oa->ip6oa_flags & IP6OAF_NO_EXPENSIVE)
466 ipf_pktopts.ippo_flags |= IPPOF_NO_IFF_EXPENSIVE;
467 adv = &ip6oa->ip6oa_flowadv;
468 adv->code = FADV_SUCCESS;
469 ip6oa->ip6oa_retflags = 0;
470 }
471
472 /*
473 * Clear out ifpp to be filled in after determining route. ifpp_save is
474 * used to keep old value to release reference properly and dtrace
475 * ipsec tunnel traffic properly.
476 */
477 if (ifpp != NULL && *ifpp != NULL)
478 *ifpp = NULL;
479
480#if DUMMYNET
481 if (args.fwa_pf_rule) {
482 ip6 = mtod(m, struct ip6_hdr *);
483 VERIFY(ro != NULL); /* ro == saved_route */
484 goto check_with_pf;
485 }
486#endif /* DUMMYNET */
487
488#if NECP
489 /*
490 * Since all packets are assumed to come from same socket, necp lookup
491 * only needs to happen once per function entry.
492 */
493 necp_matched_policy_id = necp_ip6_output_find_policy_match(m, flags,
494 (flags & IPV6_OUTARGS) ? ip6oa : NULL, &necp_result,
495 &necp_result_parameter);
496#endif /* NECP */
497
498 /*
499 * If a chain was passed in, prepare for ther first iteration. For all
500 * other iterations, this work will be done at evaluateloop: label.
501 */
502 if (packetchain) {
503 /*
504 * Remove m from the chain during processing to avoid
505 * accidental frees on entire list.
506 */
507 inputchain = m->m_nextpkt;
508 m->m_nextpkt = NULL;
509 }
510
511loopit:
512 packets_processed++;
513 m->m_pkthdr.pkt_flags &= ~(PKTF_LOOP|PKTF_IFAINFO);
514 ip6 = mtod(m, struct ip6_hdr *);
515 nxt0 = ip6->ip6_nxt;
516 finaldst = ip6->ip6_dst;
517 ip6obf.hdrsplit = FALSE;
518 ro_pmtu = NULL;
519
520 if (!SLIST_EMPTY(&m->m_pkthdr.tags))
521 inject_filter_ref = ipf_get_inject_filter(m);
522 else
523 inject_filter_ref = NULL;
524
525#define MAKE_EXTHDR(hp, mp) do { \
526 if (hp != NULL) { \
527 struct ip6_ext *eh = (struct ip6_ext *)(hp); \
528 error = ip6_copyexthdr((mp), (caddr_t)(hp), \
529 ((eh)->ip6e_len + 1) << 3); \
530 if (error) \
531 goto freehdrs; \
532 } \
533} while (0)
534
535 if (opt != NULL) {
536 /* Hop-by-Hop options header */
537 MAKE_EXTHDR(opt->ip6po_hbh, &exthdrs.ip6e_hbh);
538 /* Destination options header(1st part) */
539 if (opt->ip6po_rthdr) {
540 /*
541 * Destination options header(1st part)
542 * This only makes sense with a routing header.
543 * See Section 9.2 of RFC 3542.
544 * Disabling this part just for MIP6 convenience is
545 * a bad idea. We need to think carefully about a
546 * way to make the advanced API coexist with MIP6
547 * options, which might automatically be inserted in
548 * the kernel.
549 */
550 MAKE_EXTHDR(opt->ip6po_dest1, &exthdrs.ip6e_dest1);
551 }
552 /* Routing header */
553 MAKE_EXTHDR(opt->ip6po_rthdr, &exthdrs.ip6e_rthdr);
554 /* Destination options header(2nd part) */
555 MAKE_EXTHDR(opt->ip6po_dest2, &exthdrs.ip6e_dest2);
556 }
557
558#undef MAKE_EXTHDR
559
560#if NECP
561 if (necp_matched_policy_id) {
562 necp_mark_packet_from_ip(m, necp_matched_policy_id);
563
564 switch (necp_result) {
565 case NECP_KERNEL_POLICY_RESULT_PASS:
566 goto skip_ipsec;
567 case NECP_KERNEL_POLICY_RESULT_DROP:
568 case NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT:
569 /*
570 * Flow divert packets should be blocked at the IP
571 * layer.
572 */
573 error = EHOSTUNREACH;
574 ip6stat.ip6s_necp_policy_drop++;
575 goto freehdrs;
576 case NECP_KERNEL_POLICY_RESULT_IP_TUNNEL: {
577 /*
578 * Verify that the packet is being routed to the tunnel
579 */
580 struct ifnet *policy_ifp =
581 necp_get_ifnet_from_result_parameter(
582 &necp_result_parameter);
583
584 if (policy_ifp == ifp) {
585 goto skip_ipsec;
586 } else {
587 if (necp_packet_can_rebind_to_ifnet(m,
588 policy_ifp, (struct route *)&necp_route,
589 AF_INET6)) {
590 /*
591 * Set scoped index to the tunnel
592 * interface, since it is compatible
593 * with the packet. This will only work
594 * for callers who pass IPV6_OUTARGS,
595 * but that covers all of the clients
596 * we care about today.
597 */
598 if (flags & IPV6_OUTARGS) {
599 ip6oa->ip6oa_boundif =
600 policy_ifp->if_index;
601 ip6oa->ip6oa_flags |=
602 IP6OAF_BOUND_IF;
603 }
604 if (opt != NULL
605 && opt->ip6po_pktinfo != NULL) {
606 opt->ip6po_pktinfo->
607 ipi6_ifindex =
608 policy_ifp->if_index;
609 }
610 ro = &necp_route;
611 goto skip_ipsec;
612 } else {
613 error = ENETUNREACH;
614 ip6stat.ip6s_necp_policy_drop++;
615 goto freehdrs;
616 }
617 }
618 }
619 default:
620 break;
621 }
622 }
623#endif /* NECP */
624
625#if IPSEC
626 if (ipsec_bypass != 0 || ip6obf.noipsec)
627 goto skip_ipsec;
628
629 if (sp == NULL) {
630 /* get a security policy for this packet */
631 if (so != NULL) {
632 sp = ipsec6_getpolicybysock(m, IPSEC_DIR_OUTBOUND,
633 so, &error);
634 } else {
635 sp = ipsec6_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND,
636 0, &error);
637 }
638 if (sp == NULL) {
639 IPSEC_STAT_INCREMENT(ipsec6stat.out_inval);
640 goto freehdrs;
641 }
642 }
643
644 error = 0;
645
646 /* check policy */
647 switch (sp->policy) {
648 case IPSEC_POLICY_DISCARD:
649 case IPSEC_POLICY_GENERATE:
650 /*
651 * This packet is just discarded.
652 */
653 IPSEC_STAT_INCREMENT(ipsec6stat.out_polvio);
654 goto freehdrs;
655
656 case IPSEC_POLICY_BYPASS:
657 case IPSEC_POLICY_NONE:
658 /* no need to do IPsec. */
659 ip6obf.needipsec = FALSE;
660 break;
661
662 case IPSEC_POLICY_IPSEC:
663 if (sp->req == NULL) {
664 /* acquire a policy */
665 error = key_spdacquire(sp);
666 goto freehdrs;
667 }
668 if (sp->ipsec_if) {
669 goto skip_ipsec;
670 } else {
671 ip6obf.needipsec = TRUE;
672 }
673 break;
674
675 case IPSEC_POLICY_ENTRUST:
676 default:
677 printf("%s: Invalid policy found: %d\n", __func__, sp->policy);
678 break;
679 }
680skip_ipsec:
681#endif /* IPSEC */
682
683 /*
684 * Calculate the total length of the extension header chain.
685 * Keep the length of the unfragmentable part for fragmentation.
686 */
687 optlen = 0;
688 if (exthdrs.ip6e_hbh != NULL)
689 optlen += exthdrs.ip6e_hbh->m_len;
690 if (exthdrs.ip6e_dest1 != NULL)
691 optlen += exthdrs.ip6e_dest1->m_len;
692 if (exthdrs.ip6e_rthdr != NULL)
693 optlen += exthdrs.ip6e_rthdr->m_len;
694 unfragpartlen = optlen + sizeof (struct ip6_hdr);
695
696 /* NOTE: we don't add AH/ESP length here. do that later. */
697 if (exthdrs.ip6e_dest2 != NULL)
698 optlen += exthdrs.ip6e_dest2->m_len;
699
700 /*
701 * If we need IPsec, or there is at least one extension header,
702 * separate IP6 header from the payload.
703 */
704 if ((
705#if IPSEC
706 ip6obf.needipsec ||
707#endif /* IPSEC */
708 optlen) && !ip6obf.hdrsplit) {
709 if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
710 m = NULL;
711 goto freehdrs;
712 }
713 m = exthdrs.ip6e_ip6;
714 ip6obf.hdrsplit = TRUE;
715 }
716
717 /* adjust pointer */
718 ip6 = mtod(m, struct ip6_hdr *);
719
720 /* adjust mbuf packet header length */
721 m->m_pkthdr.len += optlen;
722 plen = m->m_pkthdr.len - sizeof (*ip6);
723
724 /* If this is a jumbo payload, insert a jumbo payload option. */
725 if (plen > IPV6_MAXPACKET) {
726 if (!ip6obf.hdrsplit) {
727 if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
728 m = NULL;
729 goto freehdrs;
730 }
731 m = exthdrs.ip6e_ip6;
732 ip6obf.hdrsplit = TRUE;
733 }
734 /* adjust pointer */
735 ip6 = mtod(m, struct ip6_hdr *);
736 if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0)
737 goto freehdrs;
738 ip6->ip6_plen = 0;
739 } else {
740 ip6->ip6_plen = htons(plen);
741 }
742 /*
743 * Concatenate headers and fill in next header fields.
744 * Here we have, on "m"
745 * IPv6 payload
746 * and we insert headers accordingly. Finally, we should be getting:
747 * IPv6 hbh dest1 rthdr ah* [esp* dest2 payload]
748 *
749 * during the header composing process, "m" points to IPv6 header.
750 * "mprev" points to an extension header prior to esp.
751 */
752 nexthdrp = &ip6->ip6_nxt;
753 mprev = m;
754
755 /*
756 * we treat dest2 specially. this makes IPsec processing
757 * much easier. the goal here is to make mprev point the
758 * mbuf prior to dest2.
759 *
760 * result: IPv6 dest2 payload
761 * m and mprev will point to IPv6 header.
762 */
763 if (exthdrs.ip6e_dest2 != NULL) {
764 if (!ip6obf.hdrsplit) {
765 panic("assumption failed: hdr not split");
766 /* NOTREACHED */
767 }
768 exthdrs.ip6e_dest2->m_next = m->m_next;
769 m->m_next = exthdrs.ip6e_dest2;
770 *mtod(exthdrs.ip6e_dest2, u_char *) = ip6->ip6_nxt;
771 ip6->ip6_nxt = IPPROTO_DSTOPTS;
772 }
773
774#define MAKE_CHAIN(m, mp, p, i) do { \
775 if (m != NULL) { \
776 if (!ip6obf.hdrsplit) { \
777 panic("assumption failed: hdr not split"); \
778 /* NOTREACHED */ \
779 } \
780 *mtod((m), u_char *) = *(p); \
781 *(p) = (i); \
782 p = mtod((m), u_char *); \
783 (m)->m_next = (mp)->m_next; \
784 (mp)->m_next = (m); \
785 (mp) = (m); \
786 } \
787} while (0)
788 /*
789 * result: IPv6 hbh dest1 rthdr dest2 payload
790 * m will point to IPv6 header. mprev will point to the
791 * extension header prior to dest2 (rthdr in the above case).
792 */
793 MAKE_CHAIN(exthdrs.ip6e_hbh, mprev, nexthdrp, IPPROTO_HOPOPTS);
794 MAKE_CHAIN(exthdrs.ip6e_dest1, mprev, nexthdrp, IPPROTO_DSTOPTS);
795 MAKE_CHAIN(exthdrs.ip6e_rthdr, mprev, nexthdrp, IPPROTO_ROUTING);
796
797 /* It is no longer safe to free the pointers in exthdrs. */
798 exthdrs.merged = TRUE;
799
800#undef MAKE_CHAIN
801
802#if IPSEC
803 if (ip6obf.needipsec && (m->m_pkthdr.csum_flags & CSUM_DELAY_IPV6_DATA))
804 in6_delayed_cksum_offset(m, 0, optlen, nxt0);
805#endif /* IPSEC */
806
807 if (!TAILQ_EMPTY(&ipv6_filters) &&
808 !((flags & IPV6_OUTARGS) &&
809 (ip6oa->ip6oa_flags & IP6OAF_INTCOPROC_ALLOWED))) {
810 struct ipfilter *filter;
811 int seen = (inject_filter_ref == NULL);
812 int fixscope = 0;
813
814 if (im6o != NULL && IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
815 ippo->ippo_flags |= IPPOF_MCAST_OPTS;
816 IM6O_LOCK(im6o);
817 ippo->ippo_mcast_ifnet = im6o->im6o_multicast_ifp;
818 ippo->ippo_mcast_ttl = im6o->im6o_multicast_hlim;
819 ippo->ippo_mcast_loop = im6o->im6o_multicast_loop;
820 IM6O_UNLOCK(im6o);
821 }
822
823 /* Hack: embed the scope_id in the destination */
824 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst) &&
825 (ip6->ip6_dst.s6_addr16[1] == 0) && (ro != NULL)) {
826 fixscope = 1;
827 ip6->ip6_dst.s6_addr16[1] =
828 htons(ro->ro_dst.sin6_scope_id);
829 }
830
831 ipf_ref();
832 TAILQ_FOREACH(filter, &ipv6_filters, ipf_link) {
833 /*
834 * Don't process packet twice if we've already seen it.
835 */
836 if (seen == 0) {
837 if ((struct ipfilter *)inject_filter_ref ==
838 filter)
839 seen = 1;
840 } else if (filter->ipf_filter.ipf_output != NULL) {
841 errno_t result;
842
843 result = filter->ipf_filter.ipf_output(
844 filter->ipf_filter.cookie,
845 (mbuf_t *)&m, ippo);
846 if (result == EJUSTRETURN) {
847 ipf_unref();
848 m = NULL;
849 goto evaluateloop;
850 }
851 if (result != 0) {
852 ipf_unref();
853 goto bad;
854 }
855 }
856 }
857 ipf_unref();
858
859 ip6 = mtod(m, struct ip6_hdr *);
860 /* Hack: cleanup embedded scope_id if we put it there */
861 if (fixscope)
862 ip6->ip6_dst.s6_addr16[1] = 0;
863 }
864
865#if IPSEC
866 if (ip6obf.needipsec) {
867 int segleft_org;
868
869 /*
870 * pointers after IPsec headers are not valid any more.
871 * other pointers need a great care too.
872 * (IPsec routines should not mangle mbufs prior to AH/ESP)
873 */
874 exthdrs.ip6e_dest2 = NULL;
875
876 if (exthdrs.ip6e_rthdr != NULL) {
877 rh = mtod(exthdrs.ip6e_rthdr, struct ip6_rthdr *);
878 segleft_org = rh->ip6r_segleft;
879 rh->ip6r_segleft = 0;
880 } else {
881 rh = NULL;
882 segleft_org = 0;
883 }
884
885 ipsec_state.m = m;
886 error = ipsec6_output_trans(&ipsec_state, nexthdrp, mprev,
887 sp, flags, &needipsectun);
888 m = ipsec_state.m;
889 if (error) {
890 /* mbuf is already reclaimed in ipsec6_output_trans. */
891 m = NULL;
892 switch (error) {
893 case EHOSTUNREACH:
894 case ENETUNREACH:
895 case EMSGSIZE:
896 case ENOBUFS:
897 case ENOMEM:
898 break;
899 default:
900 printf("ip6_output (ipsec): error code %d\n",
901 error);
902 /* FALLTHRU */
903 case ENOENT:
904 /* don't show these error codes to the user */
905 error = 0;
906 break;
907 }
908 goto bad;
909 }
910 if (exthdrs.ip6e_rthdr != NULL) {
911 /* ah6_output doesn't modify mbuf chain */
912 rh->ip6r_segleft = segleft_org;
913 }
914 }
915#endif /* IPSEC */
916
917 /*
918 * If there is a routing header, replace the destination address field
919 * with the first hop of the routing header.
920 */
921 if (exthdrs.ip6e_rthdr != NULL) {
922 struct ip6_rthdr0 *rh0;
923 struct in6_addr *addr;
924 struct sockaddr_in6 sa;
925
926 rh = (struct ip6_rthdr *)
927 (mtod(exthdrs.ip6e_rthdr, struct ip6_rthdr *));
928 switch (rh->ip6r_type) {
929 case IPV6_RTHDR_TYPE_0:
930 rh0 = (struct ip6_rthdr0 *)rh;
931 addr = (struct in6_addr *)(void *)(rh0 + 1);
932
933 /*
934 * construct a sockaddr_in6 form of
935 * the first hop.
936 *
937 * XXX: we may not have enough
938 * information about its scope zone;
939 * there is no standard API to pass
940 * the information from the
941 * application.
942 */
943 bzero(&sa, sizeof (sa));
944 sa.sin6_family = AF_INET6;
945 sa.sin6_len = sizeof (sa);
946 sa.sin6_addr = addr[0];
947 if ((error = sa6_embedscope(&sa,
948 ip6_use_defzone)) != 0) {
949 goto bad;
950 }
951 ip6->ip6_dst = sa.sin6_addr;
952 bcopy(&addr[1], &addr[0], sizeof (struct in6_addr) *
953 (rh0->ip6r0_segleft - 1));
954 addr[rh0->ip6r0_segleft - 1] = finaldst;
955 /* XXX */
956 in6_clearscope(addr + rh0->ip6r0_segleft - 1);
957 break;
958 default: /* is it possible? */
959 error = EINVAL;
960 goto bad;
961 }
962 }
963
964 /* Source address validation */
965 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) &&
966 !(flags & IPV6_UNSPECSRC)) {
967 error = EOPNOTSUPP;
968 ip6stat.ip6s_badscope++;
969 goto bad;
970 }
971 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) {
972 error = EOPNOTSUPP;
973 ip6stat.ip6s_badscope++;
974 goto bad;
975 }
976
977 ip6stat.ip6s_localout++;
978
979 /*
980 * Route packet.
981 */
982 if (ro == NULL) {
983 ro = &ip6route;
984 bzero((caddr_t)ro, sizeof (*ro));
985 }
986 ro_pmtu = ro;
987 if (opt != NULL && opt->ip6po_rthdr)
988 ro = &opt->ip6po_route;
989 dst = SIN6(&ro->ro_dst);
990
991 if (ro->ro_rt != NULL)
992 RT_LOCK_ASSERT_NOTHELD(ro->ro_rt);
993 /*
994 * if specified, try to fill in the traffic class field.
995 * do not override if a non-zero value is already set.
996 * we check the diffserv field and the ecn field separately.
997 */
998 if (opt != NULL && opt->ip6po_tclass >= 0) {
999 int mask = 0;
1000
1001 if ((ip6->ip6_flow & htonl(0xfc << 20)) == 0)
1002 mask |= 0xfc;
1003 if ((ip6->ip6_flow & htonl(0x03 << 20)) == 0)
1004 mask |= 0x03;
1005 if (mask != 0) {
1006 ip6->ip6_flow |=
1007 htonl((opt->ip6po_tclass & mask) << 20);
1008 }
1009 }
1010
1011 /* fill in or override the hop limit field, if necessary. */
1012 if (opt && opt->ip6po_hlim != -1) {
1013 ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
1014 } else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
1015 if (im6o != NULL) {
1016 IM6O_LOCK(im6o);
1017 ip6->ip6_hlim = im6o->im6o_multicast_hlim;
1018 IM6O_UNLOCK(im6o);
1019 } else {
1020 ip6->ip6_hlim = ip6_defmcasthlim;
1021 }
1022 }
1023
1024 /*
1025 * If there is a cached route, check that it is to the same
1026 * destination and is still up. If not, free it and try again.
1027 * Test rt_flags without holding rt_lock for performance reasons;
1028 * if the route is down it will hopefully be caught by the layer
1029 * below (since it uses this route as a hint) or during the
1030 * next transmit.
1031 */
1032 if (ROUTE_UNUSABLE(ro) || dst->sin6_family != AF_INET6 ||
1033 !IN6_ARE_ADDR_EQUAL(&dst->sin6_addr, &ip6->ip6_dst))
1034 ROUTE_RELEASE(ro);
1035
1036 if (ro->ro_rt == NULL) {
1037 bzero(dst, sizeof (*dst));
1038 dst->sin6_family = AF_INET6;
1039 dst->sin6_len = sizeof (struct sockaddr_in6);
1040 dst->sin6_addr = ip6->ip6_dst;
1041 }
1042#if IPSEC
1043 if (ip6obf.needipsec && needipsectun) {
1044#if CONFIG_DTRACE
1045 struct ifnet *trace_ifp = (ifpp_save != NULL) ? (*ifpp_save) : NULL;
1046#endif /* CONFIG_DTRACE */
1047 /*
1048 * All the extension headers will become inaccessible
1049 * (since they can be encrypted).
1050 * Don't panic, we need no more updates to extension headers
1051 * on inner IPv6 packet (since they are now encapsulated).
1052 *
1053 * IPv6 [ESP|AH] IPv6 [extension headers] payload
1054 */
1055 bzero(&exthdrs, sizeof (exthdrs));
1056 exthdrs.ip6e_ip6 = m;
1057
1058 ipsec_state.m = m;
1059 route_copyout((struct route *)&ipsec_state.ro, (struct route *)ro,
1060 sizeof (struct route_in6));
1061 ipsec_state.dst = SA(dst);
1062
1063 /* So that we can see packets inside the tunnel */
1064 DTRACE_IP6(send, struct mbuf *, m, struct inpcb *, NULL,
1065 struct ip6_hdr *, ip6, struct ifnet *, trace_ifp,
1066 struct ip *, NULL, struct ip6_hdr *, ip6);
1067
1068 error = ipsec6_output_tunnel(&ipsec_state, sp, flags);
1069 /* tunneled in IPv4? packet is gone */
1070 if (ipsec_state.tunneled == 4) {
1071 m = NULL;
1072 goto evaluateloop;
1073 }
1074 m = ipsec_state.m;
1075 ipsec_saved_route = ro;
1076 ro = (struct route_in6 *)&ipsec_state.ro;
1077 dst = SIN6(ipsec_state.dst);
1078 if (error) {
1079 /* mbuf is already reclaimed in ipsec6_output_tunnel. */
1080 m = NULL;
1081 switch (error) {
1082 case EHOSTUNREACH:
1083 case ENETUNREACH:
1084 case EMSGSIZE:
1085 case ENOBUFS:
1086 case ENOMEM:
1087 break;
1088 default:
1089 printf("ip6_output (ipsec): error code %d\n",
1090 error);
1091 /* FALLTHRU */
1092 case ENOENT:
1093 /* don't show these error codes to the user */
1094 error = 0;
1095 break;
1096 }
1097 goto bad;
1098 }
1099 /*
1100 * The packet has been encapsulated so the ifscope
1101 * is no longer valid since it does not apply to the
1102 * outer address: ignore the ifscope.
1103 */
1104 if (flags & IPV6_OUTARGS) {
1105 ip6oa->ip6oa_boundif = IFSCOPE_NONE;
1106 ip6oa->ip6oa_flags &= ~IP6OAF_BOUND_IF;
1107 }
1108 if (opt != NULL && opt->ip6po_pktinfo != NULL) {
1109 if (opt->ip6po_pktinfo->ipi6_ifindex != IFSCOPE_NONE)
1110 opt->ip6po_pktinfo->ipi6_ifindex = IFSCOPE_NONE;
1111 }
1112 exthdrs.ip6e_ip6 = m;
1113 }
1114#endif /* IPSEC */
1115
1116 /*
1117 * ifp should only be filled in for dummy net packets which will jump
1118 * to check_with_pf label.
1119 */
1120 if (ifp != NULL) {
1121 VERIFY(ip6obf.route_selected);
1122 }
1123
1124 /* adjust pointer */
1125 ip6 = mtod(m, struct ip6_hdr *);
1126
1127 if (ip6obf.select_srcif) {
1128 bzero(&src_sa, sizeof (src_sa));
1129 src_sa.sin6_family = AF_INET6;
1130 src_sa.sin6_len = sizeof (src_sa);
1131 src_sa.sin6_addr = ip6->ip6_src;
1132 }
1133 bzero(&dst_sa, sizeof (dst_sa));
1134 dst_sa.sin6_family = AF_INET6;
1135 dst_sa.sin6_len = sizeof (dst_sa);
1136 dst_sa.sin6_addr = ip6->ip6_dst;
1137
1138 /*
1139 * Only call in6_selectroute() on first iteration to avoid taking
1140 * multiple references on ifp and rt.
1141 *
1142 * in6_selectroute() might return an ifp with its reference held
1143 * even in the error case, so make sure to release its reference.
1144 * ip6oa may be NULL if IPV6_OUTARGS isn't set.
1145 */
1146 if (!ip6obf.route_selected) {
1147 error = in6_selectroute( ip6obf.select_srcif ? &src_sa : NULL,
1148 &dst_sa, opt, im6o, &src_ia, ro, &ifp, &rt, 0, ip6oa);
1149
1150 if (error != 0) {
1151 switch (error) {
1152 case EHOSTUNREACH:
1153 ip6stat.ip6s_noroute++;
1154 break;
1155 case EADDRNOTAVAIL:
1156 default:
1157 break; /* XXX statistics? */
1158 }
1159 if (ifp != NULL)
1160 in6_ifstat_inc(ifp, ifs6_out_discard);
1161 /* ifp (if non-NULL) will be released at the end */
1162 goto bad;
1163 }
1164 ip6obf.route_selected = TRUE;
1165 }
1166 if (rt == NULL) {
1167 /*
1168 * If in6_selectroute() does not return a route entry,
1169 * dst may not have been updated.
1170 */
1171 *dst = dst_sa; /* XXX */
1172 }
1173
1174#if NECP
1175 /* Catch-all to check if the interface is allowed */
1176 if (!necp_packet_is_allowed_over_interface(m, ifp)) {
1177 error = EHOSTUNREACH;
1178 ip6stat.ip6s_necp_policy_drop++;
1179 goto bad;
1180 }
1181#endif /* NECP */
1182
1183 /*
1184 * then rt (for unicast) and ifp must be non-NULL valid values.
1185 */
1186 if (!(flags & IPV6_FORWARDING)) {
1187 in6_ifstat_inc_na(ifp, ifs6_out_request);
1188 }
1189 if (rt != NULL) {
1190 RT_LOCK(rt);
1191 if (ia == NULL) {
1192 ia = (struct in6_ifaddr *)(rt->rt_ifa);
1193 if (ia != NULL)
1194 IFA_ADDREF(&ia->ia_ifa);
1195 }
1196 rt->rt_use++;
1197 RT_UNLOCK(rt);
1198 }
1199
1200 /*
1201 * The outgoing interface must be in the zone of source and
1202 * destination addresses (except local/loopback). We should
1203 * use ia_ifp to support the case of sending packets to an
1204 * address of our own.
1205 */
1206 if (ia != NULL && ia->ia_ifp) {
1207 ifnet_reference(ia->ia_ifp); /* for origifp */
1208 if (origifp != NULL)
1209 ifnet_release(origifp);
1210 origifp = ia->ia_ifp;
1211 } else {
1212 if (ifp != NULL)
1213 ifnet_reference(ifp); /* for origifp */
1214 if (origifp != NULL)
1215 ifnet_release(origifp);
1216 origifp = ifp;
1217 }
1218
1219 /* skip scope enforcements for local/loopback route */
1220 if (rt == NULL || !(rt->rt_ifp->if_flags & IFF_LOOPBACK)) {
1221 struct in6_addr src0, dst0;
1222 u_int32_t zone;
1223
1224 src0 = ip6->ip6_src;
1225 if (in6_setscope(&src0, origifp, &zone))
1226 goto badscope;
1227 bzero(&src_sa, sizeof (src_sa));
1228 src_sa.sin6_family = AF_INET6;
1229 src_sa.sin6_len = sizeof (src_sa);
1230 src_sa.sin6_addr = ip6->ip6_src;
1231 if ((sa6_recoverscope(&src_sa, TRUE) ||
1232 zone != src_sa.sin6_scope_id))
1233 goto badscope;
1234
1235 dst0 = ip6->ip6_dst;
1236 if ((in6_setscope(&dst0, origifp, &zone)))
1237 goto badscope;
1238 /* re-initialize to be sure */
1239 bzero(&dst_sa, sizeof (dst_sa));
1240 dst_sa.sin6_family = AF_INET6;
1241 dst_sa.sin6_len = sizeof (dst_sa);
1242 dst_sa.sin6_addr = ip6->ip6_dst;
1243 if ((sa6_recoverscope(&dst_sa, TRUE) ||
1244 zone != dst_sa.sin6_scope_id))
1245 goto badscope;
1246
1247 /* scope check is done. */
1248 goto routefound;
1249
1250badscope:
1251 ip6stat.ip6s_badscope++;
1252 in6_ifstat_inc(origifp, ifs6_out_discard);
1253 if (error == 0)
1254 error = EHOSTUNREACH; /* XXX */
1255 goto bad;
1256 }
1257
1258routefound:
1259 if (rt != NULL && !IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
1260 if (opt != NULL && opt->ip6po_nextroute.ro_rt) {
1261 /*
1262 * The nexthop is explicitly specified by the
1263 * application. We assume the next hop is an IPv6
1264 * address.
1265 */
1266 dst = SIN6(opt->ip6po_nexthop);
1267 } else if ((rt->rt_flags & RTF_GATEWAY)) {
1268 dst = SIN6(rt->rt_gateway);
1269 }
1270 /*
1271 * For packets destined to local/loopback, record the
1272 * source the source interface (which owns the source
1273 * address), as well as the output interface. This is
1274 * needed to reconstruct the embedded zone for the
1275 * link-local address case in ip6_input().
1276 */
1277 if (ia != NULL && (ifp->if_flags & IFF_LOOPBACK)) {
1278 uint32_t srcidx;
1279
1280 if (src_ia != NULL)
1281 srcidx = src_ia->ia_ifp->if_index;
1282 else if (ro->ro_srcia != NULL)
1283 srcidx = ro->ro_srcia->ifa_ifp->if_index;
1284 else
1285 srcidx = 0;
1286
1287 ip6_setsrcifaddr_info(m, srcidx, NULL);
1288 ip6_setdstifaddr_info(m, 0, ia);
1289 }
1290 }
1291
1292 if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
1293 m->m_flags &= ~(M_BCAST | M_MCAST); /* just in case */
1294 } else {
1295 struct in6_multi *in6m;
1296
1297 m->m_flags = (m->m_flags & ~M_BCAST) | M_MCAST;
1298 in6_ifstat_inc_na(ifp, ifs6_out_mcast);
1299
1300 /*
1301 * Confirm that the outgoing interface supports multicast.
1302 */
1303 if (!(ifp->if_flags & IFF_MULTICAST)) {
1304 ip6stat.ip6s_noroute++;
1305 in6_ifstat_inc(ifp, ifs6_out_discard);
1306 error = ENETUNREACH;
1307 goto bad;
1308 }
1309 in6_multihead_lock_shared();
1310 IN6_LOOKUP_MULTI(&ip6->ip6_dst, ifp, in6m);
1311 in6_multihead_lock_done();
1312 if (im6o != NULL)
1313 IM6O_LOCK(im6o);
1314 if (in6m != NULL &&
1315 (im6o == NULL || im6o->im6o_multicast_loop)) {
1316 if (im6o != NULL)
1317 IM6O_UNLOCK(im6o);
1318 /*
1319 * If we belong to the destination multicast group
1320 * on the outgoing interface, and the caller did not
1321 * forbid loopback, loop back a copy.
1322 */
1323 ip6_mloopback(NULL, ifp, m, dst, optlen, nxt0);
1324 } else if (im6o != NULL)
1325 IM6O_UNLOCK(im6o);
1326 if (in6m != NULL)
1327 IN6M_REMREF(in6m);
1328 /*
1329 * Multicasts with a hoplimit of zero may be looped back,
1330 * above, but must not be transmitted on a network.
1331 * Also, multicasts addressed to the loopback interface
1332 * are not sent -- the above call to ip6_mloopback() will
1333 * loop back a copy if this host actually belongs to the
1334 * destination group on the loopback interface.
1335 */
1336 if (ip6->ip6_hlim == 0 || (ifp->if_flags & IFF_LOOPBACK) ||
1337 IN6_IS_ADDR_MC_INTFACELOCAL(&ip6->ip6_dst)) {
1338 /* remove m from the packetchain and continue looping */
1339 if (m != NULL)
1340 m_freem(m);
1341 m = NULL;
1342 goto evaluateloop;
1343 }
1344 }
1345
1346 /*
1347 * Fill the outgoing inteface to tell the upper layer
1348 * to increment per-interface statistics.
1349 */
1350 if (ifpp != NULL && *ifpp == NULL) {
1351 ifnet_reference(ifp); /* for caller */
1352 *ifpp = ifp;
1353 }
1354
1355 /* Determine path MTU. */
1356 if ((error = ip6_getpmtu(ro_pmtu, ro, ifp, &finaldst, &mtu,
1357 &alwaysfrag)) != 0)
1358 goto bad;
1359
1360 /*
1361 * The caller of this function may specify to use the minimum MTU
1362 * in some cases.
1363 * An advanced API option (IPV6_USE_MIN_MTU) can also override MTU
1364 * setting. The logic is a bit complicated; by default, unicast
1365 * packets will follow path MTU while multicast packets will be sent at
1366 * the minimum MTU. If IP6PO_MINMTU_ALL is specified, all packets
1367 * including unicast ones will be sent at the minimum MTU. Multicast
1368 * packets will always be sent at the minimum MTU unless
1369 * IP6PO_MINMTU_DISABLE is explicitly specified.
1370 * See RFC 3542 for more details.
1371 */
1372 if (mtu > IPV6_MMTU) {
1373 if ((flags & IPV6_MINMTU)) {
1374 mtu = IPV6_MMTU;
1375 } else if (opt && opt->ip6po_minmtu == IP6PO_MINMTU_ALL) {
1376 mtu = IPV6_MMTU;
1377 } else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) &&
1378 (opt == NULL ||
1379 opt->ip6po_minmtu != IP6PO_MINMTU_DISABLE)) {
1380 mtu = IPV6_MMTU;
1381 }
1382 }
1383
1384 /*
1385 * clear embedded scope identifiers if necessary.
1386 * in6_clearscope will touch the addresses only when necessary.
1387 */
1388 in6_clearscope(&ip6->ip6_src);
1389 in6_clearscope(&ip6->ip6_dst);
1390 /*
1391 * If the outgoing packet contains a hop-by-hop options header,
1392 * it must be examined and processed even by the source node.
1393 * (RFC 2460, section 4.)
1394 */
1395 if (exthdrs.ip6e_hbh != NULL) {
1396 struct ip6_hbh *hbh = mtod(exthdrs.ip6e_hbh, struct ip6_hbh *);
1397 u_int32_t dummy; /* XXX unused */
1398 uint32_t oplen = 0; /* for ip6_process_hopopts() */
1399#if DIAGNOSTIC
1400 if ((hbh->ip6h_len + 1) << 3 > exthdrs.ip6e_hbh->m_len)
1401 panic("ip6e_hbh is not continuous");
1402#endif
1403 /*
1404 * XXX: If we have to send an ICMPv6 error to the sender,
1405 * we need the M_LOOP flag since icmp6_error() expects
1406 * the IPv6 and the hop-by-hop options header are
1407 * continuous unless the flag is set.
1408 */
1409 m->m_flags |= M_LOOP;
1410 m->m_pkthdr.rcvif = ifp;
1411 if (ip6_process_hopopts(m, (u_int8_t *)(hbh + 1),
1412 ((hbh->ip6h_len + 1) << 3) - sizeof (struct ip6_hbh),
1413 &dummy, &oplen) < 0) {
1414 /*
1415 * m was already freed at this point. Set to NULL so it
1416 * is not re-freed at end of ip6_output_list.
1417 */
1418 m = NULL;
1419 error = EINVAL; /* better error? */
1420 goto bad;
1421 }
1422 m->m_flags &= ~M_LOOP; /* XXX */
1423 m->m_pkthdr.rcvif = NULL;
1424 }
1425
1426#if DUMMYNET
1427check_with_pf:
1428#endif /* DUMMYNET */
1429#if PF
1430 if (PF_IS_ENABLED) {
1431#if DUMMYNET
1432
1433 /*
1434 * TODO: Need to save opt->ip6po_flags for reinjection
1435 * rdar://10434993
1436 */
1437 args.fwa_m = m;
1438 args.fwa_oif = ifp;
1439 args.fwa_oflags = flags;
1440 if (flags & IPV6_OUTARGS)
1441 args.fwa_ip6oa = ip6oa;
1442 args.fwa_ro6 = ro;
1443 args.fwa_dst6 = dst;
1444 args.fwa_ro6_pmtu = ro_pmtu;
1445 args.fwa_origifp = origifp;
1446 args.fwa_mtu = mtu;
1447 args.fwa_alwaysfrag = alwaysfrag;
1448 args.fwa_unfragpartlen = unfragpartlen;
1449 args.fwa_exthdrs = &exthdrs;
1450 /* Invoke outbound packet filter */
1451 error = pf_af_hook(ifp, NULL, &m, AF_INET6, FALSE, &args);
1452#else /* !DUMMYNET */
1453 error = pf_af_hook(ifp, NULL, &m, AF_INET6, FALSE, NULL);
1454#endif /* !DUMMYNET */
1455
1456 if (error != 0 || m == NULL) {
1457 if (m != NULL) {
1458 panic("%s: unexpected packet %p\n",
1459 __func__, m);
1460 /* NOTREACHED */
1461 }
1462 /* m was already freed by callee and is now NULL. */
1463 goto evaluateloop;
1464 }
1465 ip6 = mtod(m, struct ip6_hdr *);
1466 }
1467#endif /* PF */
1468
1469#ifdef IPSEC
1470 /* clean ipsec history before fragmentation */
1471 ipsec_delaux(m);
1472#endif /* IPSEC */
1473
1474 if (ip6oa != NULL) {
1475 u_int8_t dscp;
1476
1477 dscp = (ntohl(ip6->ip6_flow) & IP6FLOW_DSCP_MASK) >> IP6FLOW_DSCP_SHIFT;
1478
1479 error = set_packet_qos(m, ifp,
1480 ip6oa->ip6oa_flags & IP6OAF_QOSMARKING_ALLOWED ? TRUE : FALSE,
1481 ip6oa->ip6oa_sotc, ip6oa->ip6oa_netsvctype, &dscp);
1482 if (error == 0) {
1483 ip6->ip6_flow &= ~htonl(IP6FLOW_DSCP_MASK);
1484 ip6->ip6_flow |= htonl((u_int32_t)dscp << IP6FLOW_DSCP_SHIFT);
1485 } else {
1486 printf("%s if_dscp_for_mbuf() error %d\n", __func__, error);
1487 error = 0;
1488 }
1489 }
1490 /*
1491 * Determine whether fragmentation is necessary. If so, m is passed
1492 * back as a chain of packets and original mbuf is freed. Otherwise, m
1493 * is unchanged.
1494 */
1495 error = ip6_fragment_packet(&m, opt,
1496 &exthdrs, ifp, mtu, alwaysfrag, unfragpartlen, ro_pmtu, nxt0,
1497 optlen);
1498
1499 if (error)
1500 goto bad;
1501
1502/*
1503 * The evaluateloop label is where we decide whether to continue looping over
1504 * packets or call into nd code to send.
1505 */
1506evaluateloop:
1507
1508 /*
1509 * m may be NULL when we jump to the evaluateloop label from PF or
1510 * other code that can drop packets.
1511 */
1512 if (m != NULL) {
1513 /*
1514 * If we already have a chain to send, tack m onto the end.
1515 * Otherwise make m the start and end of the to-be-sent chain.
1516 */
1517 if (sendchain != NULL) {
1518 sendchain_last->m_nextpkt = m;
1519 } else {
1520 sendchain = m;
1521 }
1522
1523 /* Fragmentation may mean m is a chain. Find the last packet. */
1524 while (m->m_nextpkt)
1525 m = m->m_nextpkt;
1526 sendchain_last = m;
1527 pktcnt++;
1528 }
1529
1530 /* Fill in next m from inputchain as appropriate. */
1531 m = inputchain;
1532 if (m != NULL) {
1533 /* Isolate m from rest of input chain. */
1534 inputchain = m->m_nextpkt;
1535 m->m_nextpkt = NULL;
1536
1537 /*
1538 * Clear exthdrs and ipsec_state so stale contents are not
1539 * reused. Note this also clears the exthdrs.merged flag.
1540 */
1541 bzero(&exthdrs, sizeof(exthdrs));
1542 bzero(&ipsec_state, sizeof(ipsec_state));
1543
1544 /* Continue looping. */
1545 goto loopit;
1546 }
1547
1548 /*
1549 * If we get here, there's no more mbufs in inputchain, so send the
1550 * sendchain if there is one.
1551 */
1552 if (pktcnt > 0) {
1553 error = nd6_output_list(ifp, origifp, sendchain, dst,
1554 ro->ro_rt, adv);
1555 /*
1556 * Fall through to done label even in error case because
1557 * nd6_output_list frees packetchain in both success and
1558 * failure cases.
1559 */
1560 }
1561
1562done:
1563 if (ifpp_save != NULL && *ifpp_save != NULL) {
1564 ifnet_release(*ifpp_save);
1565 *ifpp_save = NULL;
1566 }
1567 ROUTE_RELEASE(&ip6route);
1568#if IPSEC
1569 ROUTE_RELEASE(&ipsec_state.ro);
1570 if (sp != NULL)
1571 key_freesp(sp, KEY_SADB_UNLOCKED);
1572#endif /* IPSEC */
1573#if NECP
1574 ROUTE_RELEASE(&necp_route);
1575#endif /* NECP */
1576#if DUMMYNET
1577 ROUTE_RELEASE(&saved_route);
1578 ROUTE_RELEASE(&saved_ro_pmtu);
1579#endif /* DUMMYNET */
1580
1581 if (ia != NULL)
1582 IFA_REMREF(&ia->ia_ifa);
1583 if (src_ia != NULL)
1584 IFA_REMREF(&src_ia->ia_ifa);
1585 if (ifp != NULL)
1586 ifnet_release(ifp);
1587 if (origifp != NULL)
1588 ifnet_release(origifp);
1589 if (ip6_output_measure) {
1590 net_perf_measure_time(&net_perf, &start_tv, packets_processed);
1591 net_perf_histogram(&net_perf, packets_processed);
1592 }
1593 return (error);
1594
1595freehdrs:
1596 if (exthdrs.ip6e_hbh != NULL) {
1597 if (exthdrs.merged)
1598 panic("Double free of ip6e_hbh");
1599 m_freem(exthdrs.ip6e_hbh);
1600 }
1601 if (exthdrs.ip6e_dest1 != NULL) {
1602 if (exthdrs.merged)
1603 panic("Double free of ip6e_dest1");
1604 m_freem(exthdrs.ip6e_dest1);
1605 }
1606 if (exthdrs.ip6e_rthdr != NULL) {
1607 if (exthdrs.merged)
1608 panic("Double free of ip6e_rthdr");
1609 m_freem(exthdrs.ip6e_rthdr);
1610 }
1611 if (exthdrs.ip6e_dest2 != NULL) {
1612 if (exthdrs.merged)
1613 panic("Double free of ip6e_dest2");
1614 m_freem(exthdrs.ip6e_dest2);
1615 }
1616 /* FALLTHRU */
1617bad:
1618 if (inputchain != NULL)
1619 m_freem_list(inputchain);
1620 if (sendchain != NULL)
1621 m_freem_list(sendchain);
1622 if (m != NULL)
1623 m_freem(m);
1624
1625 goto done;
1626
1627#undef ipf_pktopts
1628#undef exthdrs
1629#undef ip6route
1630#undef ipsec_state
1631#undef saved_route
1632#undef saved_ro_pmtu
1633#undef args
1634}
1635
1636/* ip6_fragment_packet
1637 *
1638 * The fragmentation logic is rather complex:
1639 * 1: normal case (dontfrag == 0, alwaysfrag == 0)
1640 * 1-a: send as is if tlen <= path mtu
1641 * 1-b: fragment if tlen > path mtu
1642 *
1643 * 2: if user asks us not to fragment (dontfrag == 1)
1644 * 2-a: send as is if tlen <= interface mtu
1645 * 2-b: error if tlen > interface mtu
1646 *
1647 * 3: if we always need to attach fragment header (alwaysfrag == 1)
1648 * always fragment
1649 *
1650 * 4: if dontfrag == 1 && alwaysfrag == 1
1651 * error, as we cannot handle this conflicting request
1652 */
1653
1654static int
1655ip6_fragment_packet(struct mbuf **mptr, struct ip6_pktopts *opt,
1656 struct ip6_exthdrs *exthdrsp, struct ifnet *ifp, uint32_t mtu,
1657 boolean_t alwaysfrag, uint32_t unfragpartlen, struct route_in6 *ro_pmtu,
1658 int nxt0, uint32_t optlen)
1659{
1660 VERIFY(NULL != mptr);
1661 struct mbuf *m = *mptr;
1662 int error = 0;
1663 size_t tlen = m->m_pkthdr.len;
1664 boolean_t dontfrag = (opt != NULL && (opt->ip6po_flags & IP6PO_DONTFRAG));
1665
1666 if (m->m_pkthdr.pkt_flags & PKTF_FORWARDED) {
1667 dontfrag = TRUE;
1668 /*
1669 * Discard partial sum information if this packet originated
1670 * from another interface; the packet would already have the
1671 * final checksum and we shouldn't recompute it.
1672 */
1673 if ((m->m_pkthdr.csum_flags & (CSUM_DATA_VALID|CSUM_PARTIAL)) ==
1674 (CSUM_DATA_VALID|CSUM_PARTIAL)) {
1675 m->m_pkthdr.csum_flags &= ~CSUM_TX_FLAGS;
1676 m->m_pkthdr.csum_data = 0;
1677 }
1678 }
1679
1680 if (dontfrag && alwaysfrag) { /* case 4 */
1681 /* conflicting request - can't transmit */
1682 return EMSGSIZE;
1683 }
1684
1685 /* Access without acquiring nd_ifinfo lock for performance */
1686 if (dontfrag && tlen > IN6_LINKMTU(ifp)) { /* case 2-b */
1687 /*
1688 * Even if the DONTFRAG option is specified, we cannot send the
1689 * packet when the data length is larger than the MTU of the
1690 * outgoing interface.
1691 * Notify the error by sending IPV6_PATHMTU ancillary data as
1692 * well as returning an error code (the latter is not described
1693 * in the API spec.)
1694 */
1695 u_int32_t mtu32;
1696 struct ip6ctlparam ip6cp;
1697
1698 mtu32 = (u_int32_t)mtu;
1699 bzero(&ip6cp, sizeof (ip6cp));
1700 ip6cp.ip6c_cmdarg = (void *)&mtu32;
1701 pfctlinput2(PRC_MSGSIZE, SA(&ro_pmtu->ro_dst), (void *)&ip6cp);
1702 return EMSGSIZE;
1703 }
1704
1705 /*
1706 * transmit packet without fragmentation
1707 */
1708 if (dontfrag || (!alwaysfrag && /* case 1-a and 2-a */
1709 (tlen <= mtu || TSO_IPV6_OK(ifp, m) ||
1710 (ifp->if_hwassist & CSUM_FRAGMENT_IPV6)))) {
1711 /*
1712 * mppn not updated in this case because no new chain is formed
1713 * and inserted
1714 */
1715 ip6_output_checksum(ifp, mtu, m, nxt0, tlen, optlen);
1716 } else {
1717 /*
1718 * time to fragment - cases 1-b and 3 are handled inside
1719 * ip6_do_fragmentation().
1720 * mppn is passed down to be updated to point at fragment chain.
1721 */
1722 error = ip6_do_fragmentation(mptr, optlen, ifp,
1723 unfragpartlen, mtod(m, struct ip6_hdr *), exthdrsp, mtu, nxt0);
1724 }
1725
1726 return error;
1727}
1728
1729/*
1730 * ip6_do_fragmentation() is called by ip6_fragment_packet() after determining
1731 * the packet needs to be fragmented. on success, morig is freed and a chain
1732 * of fragments is linked into the packet chain where morig existed. Otherwise,
1733 * an errno is returned.
1734 */
1735int
1736ip6_do_fragmentation(struct mbuf **mptr, uint32_t optlen, struct ifnet *ifp,
1737 uint32_t unfragpartlen, struct ip6_hdr *ip6, struct ip6_exthdrs *exthdrsp,
1738 uint32_t mtu, int nxt0)
1739{
1740 VERIFY(NULL != mptr);
1741 int error = 0;
1742
1743 struct mbuf *morig = *mptr;
1744 struct mbuf *first_mbufp = NULL;
1745 struct mbuf *last_mbufp = NULL;
1746
1747 size_t tlen = morig->m_pkthdr.len;
1748
1749 /*
1750 * try to fragment the packet. case 1-b and 3
1751 */
1752 if ((morig->m_pkthdr.csum_flags & CSUM_TSO_IPV6)) {
1753 /* TSO and fragment aren't compatible */
1754 in6_ifstat_inc(ifp, ifs6_out_fragfail);
1755 return EMSGSIZE;
1756 } else if (mtu < IPV6_MMTU) {
1757 /* path MTU cannot be less than IPV6_MMTU */
1758 in6_ifstat_inc(ifp, ifs6_out_fragfail);
1759 return EMSGSIZE;
1760 } else if (ip6->ip6_plen == 0) {
1761 /* jumbo payload cannot be fragmented */
1762 in6_ifstat_inc(ifp, ifs6_out_fragfail);
1763 return EMSGSIZE;
1764 } else {
1765 size_t hlen, len, off;
1766 struct mbuf **mnext = NULL;
1767 struct ip6_frag *ip6f;
1768 u_int32_t id = htonl(ip6_randomid());
1769 u_char nextproto;
1770
1771 /*
1772 * Too large for the destination or interface;
1773 * fragment if possible.
1774 * Must be able to put at least 8 bytes per fragment.
1775 */
1776 hlen = unfragpartlen;
1777 if (mtu > IPV6_MAXPACKET)
1778 mtu = IPV6_MAXPACKET;
1779
1780 len = (mtu - hlen - sizeof (struct ip6_frag)) & ~7;
1781 if (len < 8) {
1782 in6_ifstat_inc(ifp, ifs6_out_fragfail);
1783 return EMSGSIZE;
1784 }
1785
1786 /*
1787 * Change the next header field of the last header in the
1788 * unfragmentable part.
1789 */
1790 if (exthdrsp->ip6e_rthdr != NULL) {
1791 nextproto = *mtod(exthdrsp->ip6e_rthdr, u_char *);
1792 *mtod(exthdrsp->ip6e_rthdr, u_char *) = IPPROTO_FRAGMENT;
1793 } else if (exthdrsp->ip6e_dest1 != NULL) {
1794 nextproto = *mtod(exthdrsp->ip6e_dest1, u_char *);
1795 *mtod(exthdrsp->ip6e_dest1, u_char *) = IPPROTO_FRAGMENT;
1796 } else if (exthdrsp->ip6e_hbh != NULL) {
1797 nextproto = *mtod(exthdrsp->ip6e_hbh, u_char *);
1798 *mtod(exthdrsp->ip6e_hbh, u_char *) = IPPROTO_FRAGMENT;
1799 } else {
1800 nextproto = ip6->ip6_nxt;
1801 ip6->ip6_nxt = IPPROTO_FRAGMENT;
1802 }
1803
1804 if (morig->m_pkthdr.csum_flags & CSUM_DELAY_IPV6_DATA)
1805 in6_delayed_cksum_offset(morig, 0, optlen, nxt0);
1806
1807 /*
1808 * Loop through length of segment after first fragment,
1809 * make new header and copy data of each part and link onto
1810 * chain.
1811 */
1812 for (off = hlen; off < tlen; off += len) {
1813 struct ip6_hdr *new_mhip6;
1814 struct mbuf *new_m;
1815 struct mbuf *m_frgpart;
1816
1817 MGETHDR(new_m, M_DONTWAIT, MT_HEADER); /* MAC-OK */
1818 if (new_m == NULL) {
1819 error = ENOBUFS;
1820 ip6stat.ip6s_odropped++;
1821 break;
1822 }
1823 new_m->m_pkthdr.rcvif = NULL;
1824 new_m->m_flags = morig->m_flags & M_COPYFLAGS;
1825
1826 if (first_mbufp != NULL) {
1827 /* Every pass through loop but first */
1828 *mnext = new_m;
1829 last_mbufp = new_m;
1830 } else {
1831 /* This is the first element of the fragment chain */
1832 first_mbufp = new_m;
1833 last_mbufp = new_m;
1834 }
1835 mnext = &new_m->m_nextpkt;
1836
1837 new_m->m_data += max_linkhdr;
1838 new_mhip6 = mtod(new_m, struct ip6_hdr *);
1839 *new_mhip6 = *ip6;
1840 new_m->m_len = sizeof (*new_mhip6);
1841
1842 error = ip6_insertfraghdr(morig, new_m, hlen, &ip6f);
1843 if (error) {
1844 ip6stat.ip6s_odropped++;
1845 break;
1846 }
1847
1848 ip6f->ip6f_offlg = htons((u_short)((off - hlen) & ~7));
1849 if (off + len >= tlen)
1850 len = tlen - off;
1851 else
1852 ip6f->ip6f_offlg |= IP6F_MORE_FRAG;
1853 new_mhip6->ip6_plen = htons((u_short)(len + hlen +
1854 sizeof (*ip6f) - sizeof (struct ip6_hdr)));
1855
1856 if ((m_frgpart = m_copy(morig, off, len)) == NULL) {
1857 error = ENOBUFS;
1858 ip6stat.ip6s_odropped++;
1859 break;
1860 }
1861 m_cat(new_m, m_frgpart);
1862 new_m->m_pkthdr.len = len + hlen + sizeof (*ip6f);
1863 new_m->m_pkthdr.rcvif = NULL;
1864
1865 M_COPY_CLASSIFIER(new_m, morig);
1866 M_COPY_PFTAG(new_m, morig);
1867
1868#ifdef notyet
1869#if CONFIG_MACF_NET
1870 mac_create_fragment(morig, new_m);
1871#endif /* CONFIG_MACF_NET */
1872#endif /* notyet */
1873
1874 ip6f->ip6f_reserved = 0;
1875 ip6f->ip6f_ident = id;
1876 ip6f->ip6f_nxt = nextproto;
1877 ip6stat.ip6s_ofragments++;
1878 in6_ifstat_inc(ifp, ifs6_out_fragcreat);
1879 }
1880
1881 if (error) {
1882 /* free all the fragments created */
1883 if (first_mbufp != NULL) {
1884 m_freem_list(first_mbufp);
1885 first_mbufp = NULL;
1886 }
1887 last_mbufp = NULL;
1888 } else {
1889 /* successful fragmenting */
1890 m_freem(morig);
1891 *mptr = first_mbufp;
1892 last_mbufp->m_nextpkt = NULL;
1893 ip6stat.ip6s_fragmented++;
1894 in6_ifstat_inc(ifp, ifs6_out_fragok);
1895 }
1896 }
1897 return error;
1898}
1899
1900static int
1901ip6_copyexthdr(struct mbuf **mp, caddr_t hdr, int hlen)
1902{
1903 struct mbuf *m;
1904
1905 if (hlen > MCLBYTES)
1906 return (ENOBUFS); /* XXX */
1907
1908 MGET(m, M_DONTWAIT, MT_DATA);
1909 if (m == NULL)
1910 return (ENOBUFS);
1911
1912 if (hlen > MLEN) {
1913 MCLGET(m, M_DONTWAIT);
1914 if (!(m->m_flags & M_EXT)) {
1915 m_free(m);
1916 return (ENOBUFS);
1917 }
1918 }
1919 m->m_len = hlen;
1920 if (hdr != NULL)
1921 bcopy(hdr, mtod(m, caddr_t), hlen);
1922
1923 *mp = m;
1924 return (0);
1925}
1926
1927static void
1928ip6_out_cksum_stats(int proto, u_int32_t len)
1929{
1930 switch (proto) {
1931 case IPPROTO_TCP:
1932 tcp_out6_cksum_stats(len);
1933 break;
1934 case IPPROTO_UDP:
1935 udp_out6_cksum_stats(len);
1936 break;
1937 default:
1938 /* keep only TCP or UDP stats for now */
1939 break;
1940 }
1941}
1942
1943/*
1944 * Process a delayed payload checksum calculation (outbound path.)
1945 *
1946 * hoff is the number of bytes beyond the mbuf data pointer which
1947 * points to the IPv6 header. optlen is the number of bytes, if any,
1948 * between the end of IPv6 header and the beginning of the ULP payload
1949 * header, which represents the extension headers. If optlen is less
1950 * than zero, this routine will bail when it detects extension headers.
1951 *
1952 * Returns a bitmask representing all the work done in software.
1953 */
1954uint32_t
1955in6_finalize_cksum(struct mbuf *m, uint32_t hoff, int32_t optlen,
1956 int32_t nxt0, uint32_t csum_flags)
1957{
1958 unsigned char buf[sizeof (struct ip6_hdr)] __attribute__((aligned(8)));
1959 struct ip6_hdr *ip6;
1960 uint32_t offset, mlen, hlen, olen, sw_csum;
1961 uint16_t csum, ulpoff, plen;
1962 uint8_t nxt;
1963
1964 _CASSERT(sizeof (csum) == sizeof (uint16_t));
1965 VERIFY(m->m_flags & M_PKTHDR);
1966
1967 sw_csum = (csum_flags & m->m_pkthdr.csum_flags);
1968
1969 if ((sw_csum &= CSUM_DELAY_IPV6_DATA) == 0)
1970 goto done;
1971
1972 mlen = m->m_pkthdr.len; /* total mbuf len */
1973 hlen = sizeof (*ip6); /* IPv6 header len */
1974
1975 /* sanity check (need at least IPv6 header) */
1976 if (mlen < (hoff + hlen)) {
1977 panic("%s: mbuf %p pkt len (%u) < hoff+ip6_hdr "
1978 "(%u+%u)\n", __func__, m, mlen, hoff, hlen);
1979 /* NOTREACHED */
1980 }
1981
1982 /*
1983 * In case the IPv6 header is not contiguous, or not 32-bit
1984 * aligned, copy it to a local buffer.
1985 */
1986 if ((hoff + hlen) > m->m_len ||
1987 !IP6_HDR_ALIGNED_P(mtod(m, caddr_t) + hoff)) {
1988 m_copydata(m, hoff, hlen, (caddr_t)buf);
1989 ip6 = (struct ip6_hdr *)(void *)buf;
1990 } else {
1991 ip6 = (struct ip6_hdr *)(void *)(m->m_data + hoff);
1992 }
1993
1994 nxt = ip6->ip6_nxt;
1995 plen = ntohs(ip6->ip6_plen);
1996 if (plen != (mlen - (hoff + hlen))) {
1997 plen = OSSwapInt16(plen);
1998 if (plen != (mlen - (hoff + hlen))) {
1999 /* Don't complain for jumbograms */
2000 if (plen != 0 || nxt != IPPROTO_HOPOPTS) {
2001 printf("%s: mbuf 0x%llx proto %d IPv6 "
2002 "plen %d (%x) [swapped %d (%x)] doesn't "
2003 "match actual packet length; %d is used "
2004 "instead\n", __func__,
2005 (uint64_t)VM_KERNEL_ADDRPERM(m), nxt,
2006 ip6->ip6_plen, ip6->ip6_plen, plen, plen,
2007 (mlen - (hoff + hlen)));
2008 }
2009 plen = mlen - (hoff + hlen);
2010 }
2011 }
2012
2013 if (optlen < 0) {
2014 /* next header isn't TCP/UDP and we don't know optlen, bail */
2015 if (nxt != IPPROTO_TCP && nxt != IPPROTO_UDP) {
2016 sw_csum = 0;
2017 goto done;
2018 }
2019 olen = 0;
2020 } else {
2021 /* caller supplied the original transport number; use it */
2022 if (nxt0 >= 0)
2023 nxt = nxt0;
2024 olen = optlen;
2025 }
2026
2027 offset = hoff + hlen + olen; /* ULP header */
2028
2029 /* sanity check */
2030 if (mlen < offset) {
2031 panic("%s: mbuf %p pkt len (%u) < hoff+ip6_hdr+ext_hdr "
2032 "(%u+%u+%u)\n", __func__, m, mlen, hoff, hlen, olen);
2033 /* NOTREACHED */
2034 }
2035
2036 /*
2037 * offset is added to the lower 16-bit value of csum_data,
2038 * which is expected to contain the ULP offset; therefore
2039 * CSUM_PARTIAL offset adjustment must be undone.
2040 */
2041 if ((m->m_pkthdr.csum_flags & (CSUM_PARTIAL|CSUM_DATA_VALID)) ==
2042 (CSUM_PARTIAL|CSUM_DATA_VALID)) {
2043 /*
2044 * Get back the original ULP offset (this will
2045 * undo the CSUM_PARTIAL logic in ip6_output.)
2046 */
2047 m->m_pkthdr.csum_data = (m->m_pkthdr.csum_tx_stuff -
2048 m->m_pkthdr.csum_tx_start);
2049 }
2050
2051 ulpoff = (m->m_pkthdr.csum_data & 0xffff); /* ULP csum offset */
2052
2053 if (mlen < (ulpoff + sizeof (csum))) {
2054 panic("%s: mbuf %p pkt len (%u) proto %d invalid ULP "
2055 "cksum offset (%u) cksum flags 0x%x\n", __func__,
2056 m, mlen, nxt, ulpoff, m->m_pkthdr.csum_flags);
2057 /* NOTREACHED */
2058 }
2059
2060 csum = inet6_cksum(m, 0, offset, plen - olen);
2061
2062 /* Update stats */
2063 ip6_out_cksum_stats(nxt, plen - olen);
2064
2065 /* RFC1122 4.1.3.4 */
2066 if (csum == 0 &&
2067 (m->m_pkthdr.csum_flags & (CSUM_UDPIPV6|CSUM_ZERO_INVERT)))
2068 csum = 0xffff;
2069
2070 /* Insert the checksum in the ULP csum field */
2071 offset += ulpoff;
2072 if ((offset + sizeof (csum)) > m->m_len) {
2073 m_copyback(m, offset, sizeof (csum), &csum);
2074 } else if (IP6_HDR_ALIGNED_P(mtod(m, char *) + hoff)) {
2075 *(uint16_t *)(void *)(mtod(m, char *) + offset) = csum;
2076 } else {
2077 bcopy(&csum, (mtod(m, char *) + offset), sizeof (csum));
2078 }
2079 m->m_pkthdr.csum_flags &= ~(CSUM_DELAY_IPV6_DATA | CSUM_DATA_VALID |
2080 CSUM_PARTIAL | CSUM_ZERO_INVERT);
2081
2082done:
2083 return (sw_csum);
2084}
2085
2086/*
2087 * Insert jumbo payload option.
2088 */
2089static int
2090ip6_insert_jumboopt(struct ip6_exthdrs *exthdrs, u_int32_t plen)
2091{
2092 struct mbuf *mopt;
2093 u_char *optbuf;
2094 u_int32_t v;
2095
2096#define JUMBOOPTLEN 8 /* length of jumbo payload option and padding */
2097
2098 /*
2099 * If there is no hop-by-hop options header, allocate new one.
2100 * If there is one but it doesn't have enough space to store the
2101 * jumbo payload option, allocate a cluster to store the whole options.
2102 * Otherwise, use it to store the options.
2103 */
2104 if (exthdrs->ip6e_hbh == NULL) {
2105 MGET(mopt, M_DONTWAIT, MT_DATA);
2106 if (mopt == NULL)
2107 return (ENOBUFS);
2108 mopt->m_len = JUMBOOPTLEN;
2109 optbuf = mtod(mopt, u_char *);
2110 optbuf[1] = 0; /* = ((JUMBOOPTLEN) >> 3) - 1 */
2111 exthdrs->ip6e_hbh = mopt;
2112 } else {
2113 struct ip6_hbh *hbh;
2114
2115 mopt = exthdrs->ip6e_hbh;
2116 if (M_TRAILINGSPACE(mopt) < JUMBOOPTLEN) {
2117 /*
2118 * XXX assumption:
2119 * - exthdrs->ip6e_hbh is not referenced from places
2120 * other than exthdrs.
2121 * - exthdrs->ip6e_hbh is not an mbuf chain.
2122 */
2123 u_int32_t oldoptlen = mopt->m_len;
2124 struct mbuf *n;
2125
2126 /*
2127 * XXX: give up if the whole (new) hbh header does
2128 * not fit even in an mbuf cluster.
2129 */
2130 if (oldoptlen + JUMBOOPTLEN > MCLBYTES)
2131 return (ENOBUFS);
2132
2133 /*
2134 * As a consequence, we must always prepare a cluster
2135 * at this point.
2136 */
2137 MGET(n, M_DONTWAIT, MT_DATA);
2138 if (n != NULL) {
2139 MCLGET(n, M_DONTWAIT);
2140 if (!(n->m_flags & M_EXT)) {
2141 m_freem(n);
2142 n = NULL;
2143 }
2144 }
2145 if (n == NULL)
2146 return (ENOBUFS);
2147 n->m_len = oldoptlen + JUMBOOPTLEN;
2148 bcopy(mtod(mopt, caddr_t), mtod(n, caddr_t),
2149 oldoptlen);
2150 optbuf = mtod(n, u_char *) + oldoptlen;
2151 m_freem(mopt);
2152 mopt = exthdrs->ip6e_hbh = n;
2153 } else {
2154 optbuf = mtod(mopt, u_char *) + mopt->m_len;
2155 mopt->m_len += JUMBOOPTLEN;
2156 }
2157 optbuf[0] = IP6OPT_PADN;
2158 optbuf[1] = 1;
2159
2160 /*
2161 * Adjust the header length according to the pad and
2162 * the jumbo payload option.
2163 */
2164 hbh = mtod(mopt, struct ip6_hbh *);
2165 hbh->ip6h_len += (JUMBOOPTLEN >> 3);
2166 }
2167
2168 /* fill in the option. */
2169 optbuf[2] = IP6OPT_JUMBO;
2170 optbuf[3] = 4;
2171 v = (u_int32_t)htonl(plen + JUMBOOPTLEN);
2172 bcopy(&v, &optbuf[4], sizeof (u_int32_t));
2173
2174 /* finally, adjust the packet header length */
2175 exthdrs->ip6e_ip6->m_pkthdr.len += JUMBOOPTLEN;
2176
2177 return (0);
2178#undef JUMBOOPTLEN
2179}
2180
2181/*
2182 * Insert fragment header and copy unfragmentable header portions.
2183 */
2184static int
2185ip6_insertfraghdr(struct mbuf *m0, struct mbuf *m, int hlen,
2186 struct ip6_frag **frghdrp)
2187{
2188 struct mbuf *n, *mlast;
2189
2190 if (hlen > sizeof (struct ip6_hdr)) {
2191 n = m_copym(m0, sizeof (struct ip6_hdr),
2192 hlen - sizeof (struct ip6_hdr), M_DONTWAIT);
2193 if (n == NULL)
2194 return (ENOBUFS);
2195 m->m_next = n;
2196 } else
2197 n = m;
2198
2199 /* Search for the last mbuf of unfragmentable part. */
2200 for (mlast = n; mlast->m_next; mlast = mlast->m_next)
2201 ;
2202
2203 if (!(mlast->m_flags & M_EXT) &&
2204 M_TRAILINGSPACE(mlast) >= sizeof (struct ip6_frag)) {
2205 /* use the trailing space of the last mbuf for the frag hdr */
2206 *frghdrp = (struct ip6_frag *)(mtod(mlast, caddr_t) +
2207 mlast->m_len);
2208 mlast->m_len += sizeof (struct ip6_frag);
2209 m->m_pkthdr.len += sizeof (struct ip6_frag);
2210 } else {
2211 /* allocate a new mbuf for the fragment header */
2212 struct mbuf *mfrg;
2213
2214 MGET(mfrg, M_DONTWAIT, MT_DATA);
2215 if (mfrg == NULL)
2216 return (ENOBUFS);
2217 mfrg->m_len = sizeof (struct ip6_frag);
2218 *frghdrp = mtod(mfrg, struct ip6_frag *);
2219 mlast->m_next = mfrg;
2220 }
2221
2222 return (0);
2223}
2224
2225static int
2226ip6_getpmtu(struct route_in6 *ro_pmtu, struct route_in6 *ro,
2227 struct ifnet *ifp, struct in6_addr *dst, u_int32_t *mtup,
2228 boolean_t *alwaysfragp)
2229{
2230 u_int32_t mtu = 0;
2231 boolean_t alwaysfrag = FALSE;
2232 int error = 0;
2233 boolean_t is_local = FALSE;
2234
2235 if (IN6_IS_SCOPE_LINKLOCAL(dst))
2236 is_local = TRUE;
2237
2238 if (ro_pmtu != ro) {
2239 /* The first hop and the final destination may differ. */
2240 struct sockaddr_in6 *sa6_dst = SIN6(&ro_pmtu->ro_dst);
2241 if (ROUTE_UNUSABLE(ro_pmtu) ||
2242 !IN6_ARE_ADDR_EQUAL(&sa6_dst->sin6_addr, dst))
2243 ROUTE_RELEASE(ro_pmtu);
2244
2245 if (ro_pmtu->ro_rt == NULL) {
2246 bzero(sa6_dst, sizeof (*sa6_dst));
2247 sa6_dst->sin6_family = AF_INET6;
2248 sa6_dst->sin6_len = sizeof (struct sockaddr_in6);
2249 sa6_dst->sin6_addr = *dst;
2250
2251 rtalloc_scoped((struct route *)ro_pmtu,
2252 ifp != NULL ? ifp->if_index : IFSCOPE_NONE);
2253 }
2254 }
2255
2256 if (ro_pmtu->ro_rt != NULL) {
2257 u_int32_t ifmtu;
2258
2259 if (ifp == NULL)
2260 ifp = ro_pmtu->ro_rt->rt_ifp;
2261 /* Access without acquiring nd_ifinfo lock for performance */
2262 ifmtu = IN6_LINKMTU(ifp);
2263
2264 /*
2265 * Access rmx_mtu without holding the route entry lock,
2266 * for performance; this isn't something that changes
2267 * often, so optimize.
2268 */
2269 mtu = ro_pmtu->ro_rt->rt_rmx.rmx_mtu;
2270 if (mtu > ifmtu || mtu == 0) {
2271 /*
2272 * The MTU on the route is larger than the MTU on
2273 * the interface! This shouldn't happen, unless the
2274 * MTU of the interface has been changed after the
2275 * interface was brought up. Change the MTU in the
2276 * route to match the interface MTU (as long as the
2277 * field isn't locked).
2278 *
2279 * if MTU on the route is 0, we need to fix the MTU.
2280 * this case happens with path MTU discovery timeouts.
2281 */
2282 mtu = ifmtu;
2283 if (!(ro_pmtu->ro_rt->rt_rmx.rmx_locks & RTV_MTU))
2284 ro_pmtu->ro_rt->rt_rmx.rmx_mtu = mtu; /* XXX */
2285 } else if (mtu < IPV6_MMTU) {
2286 /*
2287 * RFC2460 section 5, last paragraph:
2288 * if we record ICMPv6 too big message with
2289 * mtu < IPV6_MMTU, transmit packets sized IPV6_MMTU
2290 * or smaller, with framgent header attached.
2291 * (fragment header is needed regardless from the
2292 * packet size, for translators to identify packets)
2293 */
2294 alwaysfrag = TRUE;
2295 mtu = IPV6_MMTU;
2296 }
2297 } else {
2298 if (ifp) {
2299 /* Don't hold nd_ifinfo lock for performance */
2300 mtu = IN6_LINKMTU(ifp);
2301 } else {
2302 error = EHOSTUNREACH; /* XXX */
2303 }
2304 }
2305
2306 *mtup = mtu;
2307 if ((alwaysfragp != NULL) && !is_local)
2308 *alwaysfragp = alwaysfrag;
2309 return (error);
2310}
2311
2312/*
2313 * IP6 socket option processing.
2314 */
2315int
2316ip6_ctloutput(struct socket *so, struct sockopt *sopt)
2317{
2318 int optdatalen, uproto;
2319 void *optdata;
2320 int privileged;
2321 struct inpcb *in6p = sotoinpcb(so);
2322 int error = 0, optval = 0;
2323 int level, op = -1, optname = 0;
2324 int optlen = 0;
2325 struct proc *p;
2326
2327 VERIFY(sopt != NULL);
2328
2329 level = sopt->sopt_level;
2330 op = sopt->sopt_dir;
2331 optname = sopt->sopt_name;
2332 optlen = sopt->sopt_valsize;
2333 p = sopt->sopt_p;
2334 uproto = (int)SOCK_PROTO(so);
2335
2336 privileged = (proc_suser(p) == 0);
2337
2338 if (level == IPPROTO_IPV6) {
2339 boolean_t capture_exthdrstat_in = FALSE;
2340 switch (op) {
2341 case SOPT_SET:
2342 switch (optname) {
2343 case IPV6_2292PKTOPTIONS: {
2344 struct mbuf *m;
2345
2346 error = soopt_getm(sopt, &m);
2347 if (error != 0)
2348 break;
2349 error = soopt_mcopyin(sopt, m);
2350 if (error != 0)
2351 break;
2352 error = ip6_pcbopts(&in6p->in6p_outputopts,
2353 m, so, sopt);
2354 m_freem(m);
2355 break;
2356 }
2357
2358 /*
2359 * Use of some Hop-by-Hop options or some
2360 * Destination options, might require special
2361 * privilege. That is, normal applications
2362 * (without special privilege) might be forbidden
2363 * from setting certain options in outgoing packets,
2364 * and might never see certain options in received
2365 * packets. [RFC 2292 Section 6]
2366 * KAME specific note:
2367 * KAME prevents non-privileged users from sending or
2368 * receiving ANY hbh/dst options in order to avoid
2369 * overhead of parsing options in the kernel.
2370 */
2371 case IPV6_RECVHOPOPTS:
2372 case IPV6_RECVDSTOPTS:
2373 case IPV6_RECVRTHDRDSTOPTS:
2374 if (!privileged)
2375 break;
2376 /* FALLTHROUGH */
2377 case IPV6_UNICAST_HOPS:
2378 case IPV6_HOPLIMIT:
2379 case IPV6_RECVPKTINFO:
2380 case IPV6_RECVHOPLIMIT:
2381 case IPV6_RECVRTHDR:
2382 case IPV6_RECVPATHMTU:
2383 case IPV6_RECVTCLASS:
2384 case IPV6_V6ONLY:
2385 case IPV6_AUTOFLOWLABEL:
2386 if (optlen != sizeof (int)) {
2387 error = EINVAL;
2388 break;
2389 }
2390 error = sooptcopyin(sopt, &optval,
2391 sizeof (optval), sizeof (optval));
2392 if (error)
2393 break;
2394
2395 switch (optname) {
2396 case IPV6_UNICAST_HOPS:
2397 if (optval < -1 || optval >= 256) {
2398 error = EINVAL;
2399 } else {
2400 /* -1 = kernel default */
2401 in6p->in6p_hops = optval;
2402 if (in6p->inp_vflag &
2403 INP_IPV4) {
2404 in6p->inp_ip_ttl =
2405 optval;
2406 }
2407 }
2408 break;
2409#define OPTSET(bit) do { \
2410 if (optval) \
2411 in6p->inp_flags |= (bit); \
2412 else \
2413 in6p->inp_flags &= ~(bit); \
2414} while (0)
2415
2416#define OPTSET2292(bit) do { \
2417 in6p->inp_flags |= IN6P_RFC2292; \
2418 if (optval) \
2419 in6p->inp_flags |= (bit); \
2420 else \
2421 in6p->inp_flags &= ~(bit); \
2422} while (0)
2423
2424#define OPTBIT(bit) (in6p->inp_flags & (bit) ? 1 : 0)
2425
2426 case IPV6_RECVPKTINFO:
2427 /* cannot mix with RFC2292 */
2428 if (OPTBIT(IN6P_RFC2292)) {
2429 error = EINVAL;
2430 break;
2431 }
2432 OPTSET(IN6P_PKTINFO);
2433 break;
2434
2435 case IPV6_HOPLIMIT: {
2436 struct ip6_pktopts **optp;
2437
2438 /* cannot mix with RFC2292 */
2439 if (OPTBIT(IN6P_RFC2292)) {
2440 error = EINVAL;
2441 break;
2442 }
2443 optp = &in6p->in6p_outputopts;
2444 error = ip6_pcbopt(IPV6_HOPLIMIT,
2445 (u_char *)&optval, sizeof (optval),
2446 optp, uproto);
2447 break;
2448 }
2449
2450 case IPV6_RECVHOPLIMIT:
2451 /* cannot mix with RFC2292 */
2452 if (OPTBIT(IN6P_RFC2292)) {
2453 error = EINVAL;
2454 break;
2455 }
2456 OPTSET(IN6P_HOPLIMIT);
2457 break;
2458
2459 case IPV6_RECVHOPOPTS:
2460 /* cannot mix with RFC2292 */
2461 if (OPTBIT(IN6P_RFC2292)) {
2462 error = EINVAL;
2463 break;
2464 }
2465 OPTSET(IN6P_HOPOPTS);
2466 capture_exthdrstat_in = TRUE;
2467 break;
2468
2469 case IPV6_RECVDSTOPTS:
2470 /* cannot mix with RFC2292 */
2471 if (OPTBIT(IN6P_RFC2292)) {
2472 error = EINVAL;
2473 break;
2474 }
2475 OPTSET(IN6P_DSTOPTS);
2476 capture_exthdrstat_in = TRUE;
2477 break;
2478
2479 case IPV6_RECVRTHDRDSTOPTS:
2480 /* cannot mix with RFC2292 */
2481 if (OPTBIT(IN6P_RFC2292)) {
2482 error = EINVAL;
2483 break;
2484 }
2485 OPTSET(IN6P_RTHDRDSTOPTS);
2486 capture_exthdrstat_in = TRUE;
2487 break;
2488
2489 case IPV6_RECVRTHDR:
2490 /* cannot mix with RFC2292 */
2491 if (OPTBIT(IN6P_RFC2292)) {
2492 error = EINVAL;
2493 break;
2494 }
2495 OPTSET(IN6P_RTHDR);
2496 capture_exthdrstat_in = TRUE;
2497 break;
2498
2499 case IPV6_RECVPATHMTU:
2500 /*
2501 * We ignore this option for TCP
2502 * sockets.
2503 * (RFC3542 leaves this case
2504 * unspecified.)
2505 */
2506 if (uproto != IPPROTO_TCP)
2507 OPTSET(IN6P_MTU);
2508 break;
2509
2510 case IPV6_V6ONLY:
2511 /*
2512 * make setsockopt(IPV6_V6ONLY)
2513 * available only prior to bind(2).
2514 * see ipng mailing list, Jun 22 2001.
2515 */
2516 if (in6p->inp_lport ||
2517 !IN6_IS_ADDR_UNSPECIFIED(
2518 &in6p->in6p_laddr)) {
2519 error = EINVAL;
2520 break;
2521 }
2522 OPTSET(IN6P_IPV6_V6ONLY);
2523 if (optval)
2524 in6p->inp_vflag &= ~INP_IPV4;
2525 else
2526 in6p->inp_vflag |= INP_IPV4;
2527 break;
2528
2529 case IPV6_RECVTCLASS:
2530 /* we can mix with RFC2292 */
2531 OPTSET(IN6P_TCLASS);
2532 break;
2533
2534 case IPV6_AUTOFLOWLABEL:
2535 OPTSET(IN6P_AUTOFLOWLABEL);
2536 break;
2537
2538 }
2539 break;
2540
2541 case IPV6_TCLASS:
2542 case IPV6_DONTFRAG:
2543 case IPV6_USE_MIN_MTU:
2544 case IPV6_PREFER_TEMPADDR: {
2545 struct ip6_pktopts **optp;
2546
2547 if (optlen != sizeof (optval)) {
2548 error = EINVAL;
2549 break;
2550 }
2551 error = sooptcopyin(sopt, &optval,
2552 sizeof (optval), sizeof (optval));
2553 if (error)
2554 break;
2555
2556 optp = &in6p->in6p_outputopts;
2557 error = ip6_pcbopt(optname, (u_char *)&optval,
2558 sizeof (optval), optp, uproto);
2559
2560 if (optname == IPV6_TCLASS) {
2561 // Add in the ECN flags
2562 u_int8_t tos = (in6p->inp_ip_tos & ~IPTOS_ECN_MASK);
2563 u_int8_t ecn = optval & IPTOS_ECN_MASK;
2564 in6p->inp_ip_tos = tos | ecn;
2565 }
2566 break;
2567 }
2568
2569 case IPV6_2292PKTINFO:
2570 case IPV6_2292HOPLIMIT:
2571 case IPV6_2292HOPOPTS:
2572 case IPV6_2292DSTOPTS:
2573 case IPV6_2292RTHDR:
2574 /* RFC 2292 */
2575 if (optlen != sizeof (int)) {
2576 error = EINVAL;
2577 break;
2578 }
2579 error = sooptcopyin(sopt, &optval,
2580 sizeof (optval), sizeof (optval));
2581 if (error)
2582 break;
2583 switch (optname) {
2584 case IPV6_2292PKTINFO:
2585 OPTSET2292(IN6P_PKTINFO);
2586 break;
2587 case IPV6_2292HOPLIMIT:
2588 OPTSET2292(IN6P_HOPLIMIT);
2589 break;
2590 case IPV6_2292HOPOPTS:
2591 /*
2592 * Check super-user privilege.
2593 * See comments for IPV6_RECVHOPOPTS.
2594 */
2595 if (!privileged)
2596 return (EPERM);
2597 OPTSET2292(IN6P_HOPOPTS);
2598 capture_exthdrstat_in = TRUE;
2599 break;
2600 case IPV6_2292DSTOPTS:
2601 if (!privileged)
2602 return (EPERM);
2603 OPTSET2292(IN6P_DSTOPTS|
2604 IN6P_RTHDRDSTOPTS); /* XXX */
2605 capture_exthdrstat_in = TRUE;
2606 break;
2607 case IPV6_2292RTHDR:
2608 OPTSET2292(IN6P_RTHDR);
2609 capture_exthdrstat_in = TRUE;
2610 break;
2611 }
2612 break;
2613
2614 case IPV6_3542PKTINFO:
2615 case IPV6_3542HOPOPTS:
2616 case IPV6_3542RTHDR:
2617 case IPV6_3542DSTOPTS:
2618 case IPV6_RTHDRDSTOPTS:
2619 case IPV6_3542NEXTHOP: {
2620 struct ip6_pktopts **optp;
2621 /* new advanced API (RFC3542) */
2622 struct mbuf *m;
2623
2624 /* cannot mix with RFC2292 */
2625 if (OPTBIT(IN6P_RFC2292)) {
2626 error = EINVAL;
2627 break;
2628 }
2629 error = soopt_getm(sopt, &m);
2630 if (error != 0)
2631 break;
2632 error = soopt_mcopyin(sopt, m);
2633 if (error != 0)
2634 break;
2635
2636 optp = &in6p->in6p_outputopts;
2637 error = ip6_pcbopt(optname, mtod(m, u_char *),
2638 m->m_len, optp, uproto);
2639 m_freem(m);
2640 break;
2641 }
2642#undef OPTSET
2643 case IPV6_MULTICAST_IF:
2644 case IPV6_MULTICAST_HOPS:
2645 case IPV6_MULTICAST_LOOP:
2646 case IPV6_JOIN_GROUP:
2647 case IPV6_LEAVE_GROUP:
2648 case IPV6_MSFILTER:
2649 case MCAST_BLOCK_SOURCE:
2650 case MCAST_UNBLOCK_SOURCE:
2651 case MCAST_JOIN_GROUP:
2652 case MCAST_LEAVE_GROUP:
2653 case MCAST_JOIN_SOURCE_GROUP:
2654 case MCAST_LEAVE_SOURCE_GROUP:
2655 error = ip6_setmoptions(in6p, sopt);
2656 break;
2657
2658 case IPV6_PORTRANGE:
2659 error = sooptcopyin(sopt, &optval,
2660 sizeof (optval), sizeof (optval));
2661 if (error)
2662 break;
2663
2664 switch (optval) {
2665 case IPV6_PORTRANGE_DEFAULT:
2666 in6p->inp_flags &= ~(INP_LOWPORT);
2667 in6p->inp_flags &= ~(INP_HIGHPORT);
2668 break;
2669
2670 case IPV6_PORTRANGE_HIGH:
2671 in6p->inp_flags &= ~(INP_LOWPORT);
2672 in6p->inp_flags |= INP_HIGHPORT;
2673 break;
2674
2675 case IPV6_PORTRANGE_LOW:
2676 in6p->inp_flags &= ~(INP_HIGHPORT);
2677 in6p->inp_flags |= INP_LOWPORT;
2678 break;
2679
2680 default:
2681 error = EINVAL;
2682 break;
2683 }
2684 break;
2685#if IPSEC
2686 case IPV6_IPSEC_POLICY: {
2687 caddr_t req = NULL;
2688 size_t len = 0;
2689 struct mbuf *m;
2690
2691 if ((error = soopt_getm(sopt, &m)) != 0)
2692 break;
2693 if ((error = soopt_mcopyin(sopt, m)) != 0)
2694 break;
2695
2696 req = mtod(m, caddr_t);
2697 len = m->m_len;
2698 error = ipsec6_set_policy(in6p, optname, req,
2699 len, privileged);
2700 m_freem(m);
2701 break;
2702 }
2703#endif /* IPSEC */
2704 /*
2705 * IPv6 variant of IP_BOUND_IF; for details see
2706 * comments on IP_BOUND_IF in ip_ctloutput().
2707 */
2708 case IPV6_BOUND_IF:
2709 /* This option is settable only on IPv6 */
2710 if (!(in6p->inp_vflag & INP_IPV6)) {
2711 error = EINVAL;
2712 break;
2713 }
2714
2715 error = sooptcopyin(sopt, &optval,
2716 sizeof (optval), sizeof (optval));
2717
2718 if (error)
2719 break;
2720
2721 error = inp_bindif(in6p, optval, NULL);
2722 break;
2723
2724 case IPV6_NO_IFT_CELLULAR:
2725 /* This option is settable only for IPv6 */
2726 if (!(in6p->inp_vflag & INP_IPV6)) {
2727 error = EINVAL;
2728 break;
2729 }
2730
2731 error = sooptcopyin(sopt, &optval,
2732 sizeof (optval), sizeof (optval));
2733
2734 if (error)
2735 break;
2736
2737 /* once set, it cannot be unset */
2738 if (!optval && INP_NO_CELLULAR(in6p)) {
2739 error = EINVAL;
2740 break;
2741 }
2742
2743 error = so_set_restrictions(so,
2744 SO_RESTRICT_DENY_CELLULAR);
2745 break;
2746
2747 case IPV6_OUT_IF:
2748 /* This option is not settable */
2749 error = EINVAL;
2750 break;
2751
2752 default:
2753 error = ENOPROTOOPT;
2754 break;
2755 }
2756 if (capture_exthdrstat_in) {
2757 if (uproto == IPPROTO_TCP) {
2758 INC_ATOMIC_INT64_LIM(net_api_stats.nas_sock_inet6_stream_exthdr_in);
2759 } else if (uproto == IPPROTO_UDP) {
2760 INC_ATOMIC_INT64_LIM(net_api_stats.nas_sock_inet6_dgram_exthdr_in);
2761 }
2762 }
2763 break;
2764
2765 case SOPT_GET:
2766 switch (optname) {
2767
2768 case IPV6_2292PKTOPTIONS:
2769 /*
2770 * RFC3542 (effectively) deprecated the
2771 * semantics of the 2292-style pktoptions.
2772 * Since it was not reliable in nature (i.e.,
2773 * applications had to expect the lack of some
2774 * information after all), it would make sense
2775 * to simplify this part by always returning
2776 * empty data.
2777 */
2778 sopt->sopt_valsize = 0;
2779 break;
2780
2781 case IPV6_RECVHOPOPTS:
2782 case IPV6_RECVDSTOPTS:
2783 case IPV6_RECVRTHDRDSTOPTS:
2784 case IPV6_UNICAST_HOPS:
2785 case IPV6_RECVPKTINFO:
2786 case IPV6_RECVHOPLIMIT:
2787 case IPV6_RECVRTHDR:
2788 case IPV6_RECVPATHMTU:
2789 case IPV6_V6ONLY:
2790 case IPV6_PORTRANGE:
2791 case IPV6_RECVTCLASS:
2792 case IPV6_AUTOFLOWLABEL:
2793 switch (optname) {
2794
2795 case IPV6_RECVHOPOPTS:
2796 optval = OPTBIT(IN6P_HOPOPTS);
2797 break;
2798
2799 case IPV6_RECVDSTOPTS:
2800 optval = OPTBIT(IN6P_DSTOPTS);
2801 break;
2802
2803 case IPV6_RECVRTHDRDSTOPTS:
2804 optval = OPTBIT(IN6P_RTHDRDSTOPTS);
2805 break;
2806
2807 case IPV6_UNICAST_HOPS:
2808 optval = in6p->in6p_hops;
2809 break;
2810
2811 case IPV6_RECVPKTINFO:
2812 optval = OPTBIT(IN6P_PKTINFO);
2813 break;
2814
2815 case IPV6_RECVHOPLIMIT:
2816 optval = OPTBIT(IN6P_HOPLIMIT);
2817 break;
2818
2819 case IPV6_RECVRTHDR:
2820 optval = OPTBIT(IN6P_RTHDR);
2821 break;
2822
2823 case IPV6_RECVPATHMTU:
2824 optval = OPTBIT(IN6P_MTU);
2825 break;
2826
2827 case IPV6_V6ONLY:
2828 optval = OPTBIT(IN6P_IPV6_V6ONLY);
2829 break;
2830
2831 case IPV6_PORTRANGE: {
2832 int flags;
2833 flags = in6p->inp_flags;
2834 if (flags & INP_HIGHPORT)
2835 optval = IPV6_PORTRANGE_HIGH;
2836 else if (flags & INP_LOWPORT)
2837 optval = IPV6_PORTRANGE_LOW;
2838 else
2839 optval = 0;
2840 break;
2841 }
2842 case IPV6_RECVTCLASS:
2843 optval = OPTBIT(IN6P_TCLASS);
2844 break;
2845
2846 case IPV6_AUTOFLOWLABEL:
2847 optval = OPTBIT(IN6P_AUTOFLOWLABEL);
2848 break;
2849 }
2850 if (error)
2851 break;
2852 error = sooptcopyout(sopt, &optval,
2853 sizeof (optval));
2854 break;
2855
2856 case IPV6_PATHMTU: {
2857 u_int32_t pmtu = 0;
2858 struct ip6_mtuinfo mtuinfo;
2859 struct route_in6 sro;
2860
2861 bzero(&sro, sizeof (sro));
2862
2863 if (!(so->so_state & SS_ISCONNECTED))
2864 return (ENOTCONN);
2865 /*
2866 * XXX: we dot not consider the case of source
2867 * routing, or optional information to specify
2868 * the outgoing interface.
2869 */
2870 error = ip6_getpmtu(&sro, NULL, NULL,
2871 &in6p->in6p_faddr, &pmtu, NULL);
2872 ROUTE_RELEASE(&sro);
2873 if (error)
2874 break;
2875 if (pmtu > IPV6_MAXPACKET)
2876 pmtu = IPV6_MAXPACKET;
2877
2878 bzero(&mtuinfo, sizeof (mtuinfo));
2879 mtuinfo.ip6m_mtu = (u_int32_t)pmtu;
2880 optdata = (void *)&mtuinfo;
2881 optdatalen = sizeof (mtuinfo);
2882 error = sooptcopyout(sopt, optdata,
2883 optdatalen);
2884 break;
2885 }
2886
2887 case IPV6_2292PKTINFO:
2888 case IPV6_2292HOPLIMIT:
2889 case IPV6_2292HOPOPTS:
2890 case IPV6_2292RTHDR:
2891 case IPV6_2292DSTOPTS:
2892 switch (optname) {
2893 case IPV6_2292PKTINFO:
2894 optval = OPTBIT(IN6P_PKTINFO);
2895 break;
2896 case IPV6_2292HOPLIMIT:
2897 optval = OPTBIT(IN6P_HOPLIMIT);
2898 break;
2899 case IPV6_2292HOPOPTS:
2900 optval = OPTBIT(IN6P_HOPOPTS);
2901 break;
2902 case IPV6_2292RTHDR:
2903 optval = OPTBIT(IN6P_RTHDR);
2904 break;
2905 case IPV6_2292DSTOPTS:
2906 optval = OPTBIT(IN6P_DSTOPTS|
2907 IN6P_RTHDRDSTOPTS);
2908 break;
2909 }
2910 error = sooptcopyout(sopt, &optval,
2911 sizeof (optval));
2912 break;
2913
2914 case IPV6_PKTINFO:
2915 case IPV6_HOPOPTS:
2916 case IPV6_RTHDR:
2917 case IPV6_DSTOPTS:
2918 case IPV6_RTHDRDSTOPTS:
2919 case IPV6_NEXTHOP:
2920 case IPV6_TCLASS:
2921 case IPV6_DONTFRAG:
2922 case IPV6_USE_MIN_MTU:
2923 case IPV6_PREFER_TEMPADDR:
2924 error = ip6_getpcbopt(in6p->in6p_outputopts,
2925 optname, sopt);
2926 break;
2927
2928 case IPV6_MULTICAST_IF:
2929 case IPV6_MULTICAST_HOPS:
2930 case IPV6_MULTICAST_LOOP:
2931 case IPV6_MSFILTER:
2932 error = ip6_getmoptions(in6p, sopt);
2933 break;
2934#if IPSEC
2935 case IPV6_IPSEC_POLICY: {
2936 error = 0; /* This option is no longer supported */
2937 break;
2938 }
2939#endif /* IPSEC */
2940 case IPV6_BOUND_IF:
2941 if (in6p->inp_flags & INP_BOUND_IF)
2942 optval = in6p->inp_boundifp->if_index;
2943 error = sooptcopyout(sopt, &optval,
2944 sizeof (optval));
2945 break;
2946
2947 case IPV6_NO_IFT_CELLULAR:
2948 optval = INP_NO_CELLULAR(in6p) ? 1 : 0;
2949 error = sooptcopyout(sopt, &optval,
2950 sizeof (optval));
2951 break;
2952
2953 case IPV6_OUT_IF:
2954 optval = (in6p->in6p_last_outifp != NULL) ?
2955 in6p->in6p_last_outifp->if_index : 0;
2956 error = sooptcopyout(sopt, &optval,
2957 sizeof (optval));
2958 break;
2959
2960 default:
2961 error = ENOPROTOOPT;
2962 break;
2963 }
2964 break;
2965 }
2966 } else if (level == IPPROTO_UDP) {
2967 error = udp_ctloutput(so, sopt);
2968 } else {
2969 error = EINVAL;
2970 }
2971 return (error);
2972}
2973
2974int
2975ip6_raw_ctloutput(struct socket *so, struct sockopt *sopt)
2976{
2977 int error = 0, optval, optlen;
2978 const int icmp6off = offsetof(struct icmp6_hdr, icmp6_cksum);
2979 struct inpcb *in6p = sotoinpcb(so);
2980 int level, op, optname;
2981
2982 level = sopt->sopt_level;
2983 op = sopt->sopt_dir;
2984 optname = sopt->sopt_name;
2985 optlen = sopt->sopt_valsize;
2986
2987 if (level != IPPROTO_IPV6)
2988 return (EINVAL);
2989
2990 switch (optname) {
2991 case IPV6_CHECKSUM:
2992 /*
2993 * For ICMPv6 sockets, no modification allowed for checksum
2994 * offset, permit "no change" values to help existing apps.
2995 *
2996 * RFC3542 says: "An attempt to set IPV6_CHECKSUM
2997 * for an ICMPv6 socket will fail."
2998 * The current behavior does not meet RFC3542.
2999 */
3000 switch (op) {
3001 case SOPT_SET:
3002 if (optlen != sizeof (int)) {
3003 error = EINVAL;
3004 break;
3005 }
3006 error = sooptcopyin(sopt, &optval, sizeof (optval),
3007 sizeof (optval));
3008 if (error)
3009 break;
3010 if ((optval % 2) != 0) {
3011 /* the API assumes even offset values */
3012 error = EINVAL;
3013 } else if (SOCK_PROTO(so) == IPPROTO_ICMPV6) {
3014 if (optval != icmp6off)
3015 error = EINVAL;
3016 } else {
3017 in6p->in6p_cksum = optval;
3018 }
3019 break;
3020
3021 case SOPT_GET:
3022 if (SOCK_PROTO(so) == IPPROTO_ICMPV6)
3023 optval = icmp6off;
3024 else
3025 optval = in6p->in6p_cksum;
3026
3027 error = sooptcopyout(sopt, &optval, sizeof (optval));
3028 break;
3029
3030 default:
3031 error = EINVAL;
3032 break;
3033 }
3034 break;
3035
3036 default:
3037 error = ENOPROTOOPT;
3038 break;
3039 }
3040
3041 return (error);
3042}
3043
3044/*
3045 * Set up IP6 options in pcb for insertion in output packets or
3046 * specifying behavior of outgoing packets.
3047 */
3048static int
3049ip6_pcbopts(struct ip6_pktopts **pktopt, struct mbuf *m, struct socket *so,
3050 struct sockopt *sopt)
3051{
3052#pragma unused(sopt)
3053 struct ip6_pktopts *opt = *pktopt;
3054 int error = 0;
3055
3056 /* turn off any old options. */
3057 if (opt != NULL) {
3058#if DIAGNOSTIC
3059 if (opt->ip6po_pktinfo || opt->ip6po_nexthop ||
3060 opt->ip6po_hbh || opt->ip6po_dest1 || opt->ip6po_dest2 ||
3061 opt->ip6po_rhinfo.ip6po_rhi_rthdr)
3062 printf("%s: all specified options are cleared.\n",
3063 __func__);
3064#endif
3065 ip6_clearpktopts(opt, -1);
3066 } else {
3067 opt = _MALLOC(sizeof (*opt), M_IP6OPT, M_WAITOK);
3068 if (opt == NULL)
3069 return (ENOBUFS);
3070 }
3071 *pktopt = NULL;
3072
3073 if (m == NULL || m->m_len == 0) {
3074 /*
3075 * Only turning off any previous options, regardless of
3076 * whether the opt is just created or given.
3077 */
3078 if (opt != NULL)
3079 FREE(opt, M_IP6OPT);
3080 return (0);
3081 }
3082
3083 /* set options specified by user. */
3084 if ((error = ip6_setpktopts(m, opt, NULL, SOCK_PROTO(so))) != 0) {
3085 ip6_clearpktopts(opt, -1); /* XXX: discard all options */
3086 FREE(opt, M_IP6OPT);
3087 return (error);
3088 }
3089 *pktopt = opt;
3090 return (0);
3091}
3092
3093/*
3094 * initialize ip6_pktopts. beware that there are non-zero default values in
3095 * the struct.
3096 */
3097void
3098ip6_initpktopts(struct ip6_pktopts *opt)
3099{
3100
3101 bzero(opt, sizeof (*opt));
3102 opt->ip6po_hlim = -1; /* -1 means default hop limit */
3103 opt->ip6po_tclass = -1; /* -1 means default traffic class */
3104 opt->ip6po_minmtu = IP6PO_MINMTU_MCASTONLY;
3105 opt->ip6po_prefer_tempaddr = IP6PO_TEMPADDR_SYSTEM;
3106}
3107
3108static int
3109ip6_pcbopt(int optname, u_char *buf, int len, struct ip6_pktopts **pktopt,
3110 int uproto)
3111{
3112 struct ip6_pktopts *opt;
3113
3114 opt = *pktopt;
3115 if (opt == NULL) {
3116 opt = _MALLOC(sizeof (*opt), M_IP6OPT, M_WAITOK);
3117 if (opt == NULL)
3118 return (ENOBUFS);
3119 ip6_initpktopts(opt);
3120 *pktopt = opt;
3121 }
3122
3123 return (ip6_setpktopt(optname, buf, len, opt, 1, 0, uproto));
3124}
3125
3126static int
3127ip6_getpcbopt(struct ip6_pktopts *pktopt, int optname, struct sockopt *sopt)
3128{
3129 void *optdata = NULL;
3130 int optdatalen = 0;
3131 struct ip6_ext *ip6e;
3132 struct in6_pktinfo null_pktinfo;
3133 int deftclass = 0, on;
3134 int defminmtu = IP6PO_MINMTU_MCASTONLY;
3135 int defpreftemp = IP6PO_TEMPADDR_SYSTEM;
3136
3137
3138 switch (optname) {
3139 case IPV6_PKTINFO:
3140 if (pktopt && pktopt->ip6po_pktinfo)
3141 optdata = (void *)pktopt->ip6po_pktinfo;
3142 else {
3143 /* XXX: we don't have to do this every time... */
3144 bzero(&null_pktinfo, sizeof (null_pktinfo));
3145 optdata = (void *)&null_pktinfo;
3146 }
3147 optdatalen = sizeof (struct in6_pktinfo);
3148 break;
3149
3150 case IPV6_TCLASS:
3151 if (pktopt && pktopt->ip6po_tclass >= 0)
3152 optdata = (void *)&pktopt->ip6po_tclass;
3153 else
3154 optdata = (void *)&deftclass;
3155 optdatalen = sizeof (int);
3156 break;
3157
3158 case IPV6_HOPOPTS:
3159 if (pktopt && pktopt->ip6po_hbh) {
3160 optdata = (void *)pktopt->ip6po_hbh;
3161 ip6e = (struct ip6_ext *)pktopt->ip6po_hbh;
3162 optdatalen = (ip6e->ip6e_len + 1) << 3;
3163 }
3164 break;
3165
3166 case IPV6_RTHDR:
3167 if (pktopt && pktopt->ip6po_rthdr) {
3168 optdata = (void *)pktopt->ip6po_rthdr;
3169 ip6e = (struct ip6_ext *)pktopt->ip6po_rthdr;
3170 optdatalen = (ip6e->ip6e_len + 1) << 3;
3171 }
3172 break;
3173
3174 case IPV6_RTHDRDSTOPTS:
3175 if (pktopt && pktopt->ip6po_dest1) {
3176 optdata = (void *)pktopt->ip6po_dest1;
3177 ip6e = (struct ip6_ext *)pktopt->ip6po_dest1;
3178 optdatalen = (ip6e->ip6e_len + 1) << 3;
3179 }
3180 break;
3181
3182 case IPV6_DSTOPTS:
3183 if (pktopt && pktopt->ip6po_dest2) {
3184 optdata = (void *)pktopt->ip6po_dest2;
3185 ip6e = (struct ip6_ext *)pktopt->ip6po_dest2;
3186 optdatalen = (ip6e->ip6e_len + 1) << 3;
3187 }
3188 break;
3189
3190 case IPV6_NEXTHOP:
3191 if (pktopt && pktopt->ip6po_nexthop) {
3192 optdata = (void *)pktopt->ip6po_nexthop;
3193 optdatalen = pktopt->ip6po_nexthop->sa_len;
3194 }
3195 break;
3196
3197 case IPV6_USE_MIN_MTU:
3198 if (pktopt)
3199 optdata = (void *)&pktopt->ip6po_minmtu;
3200 else
3201 optdata = (void *)&defminmtu;
3202 optdatalen = sizeof (int);
3203 break;
3204
3205 case IPV6_DONTFRAG:
3206 if (pktopt && ((pktopt->ip6po_flags) & IP6PO_DONTFRAG))
3207 on = 1;
3208 else
3209 on = 0;
3210 optdata = (void *)&on;
3211 optdatalen = sizeof (on);
3212 break;
3213
3214 case IPV6_PREFER_TEMPADDR:
3215 if (pktopt)
3216 optdata = (void *)&pktopt->ip6po_prefer_tempaddr;
3217 else
3218 optdata = (void *)&defpreftemp;
3219 optdatalen = sizeof (int);
3220 break;
3221
3222 default: /* should not happen */
3223#ifdef DIAGNOSTIC
3224 panic("ip6_getpcbopt: unexpected option\n");
3225#endif
3226 return (ENOPROTOOPT);
3227 }
3228
3229 return (sooptcopyout(sopt, optdata, optdatalen));
3230}
3231
3232void
3233ip6_clearpktopts(struct ip6_pktopts *pktopt, int optname)
3234{
3235 if (pktopt == NULL)
3236 return;
3237
3238 if (optname == -1 || optname == IPV6_PKTINFO) {
3239 if (pktopt->ip6po_pktinfo)
3240 FREE(pktopt->ip6po_pktinfo, M_IP6OPT);
3241 pktopt->ip6po_pktinfo = NULL;
3242 }
3243 if (optname == -1 || optname == IPV6_HOPLIMIT)
3244 pktopt->ip6po_hlim = -1;
3245 if (optname == -1 || optname == IPV6_TCLASS)
3246 pktopt->ip6po_tclass = -1;
3247 if (optname == -1 || optname == IPV6_NEXTHOP) {
3248 ROUTE_RELEASE(&pktopt->ip6po_nextroute);
3249 if (pktopt->ip6po_nexthop)
3250 FREE(pktopt->ip6po_nexthop, M_IP6OPT);
3251 pktopt->ip6po_nexthop = NULL;
3252 }
3253 if (optname == -1 || optname == IPV6_HOPOPTS) {
3254 if (pktopt->ip6po_hbh)
3255 FREE(pktopt->ip6po_hbh, M_IP6OPT);
3256 pktopt->ip6po_hbh = NULL;
3257 }
3258 if (optname == -1 || optname == IPV6_RTHDRDSTOPTS) {
3259 if (pktopt->ip6po_dest1)
3260 FREE(pktopt->ip6po_dest1, M_IP6OPT);
3261 pktopt->ip6po_dest1 = NULL;
3262 }
3263 if (optname == -1 || optname == IPV6_RTHDR) {
3264 if (pktopt->ip6po_rhinfo.ip6po_rhi_rthdr)
3265 FREE(pktopt->ip6po_rhinfo.ip6po_rhi_rthdr, M_IP6OPT);
3266 pktopt->ip6po_rhinfo.ip6po_rhi_rthdr = NULL;
3267 ROUTE_RELEASE(&pktopt->ip6po_route);
3268 }
3269 if (optname == -1 || optname == IPV6_DSTOPTS) {
3270 if (pktopt->ip6po_dest2)
3271 FREE(pktopt->ip6po_dest2, M_IP6OPT);
3272 pktopt->ip6po_dest2 = NULL;
3273 }
3274}
3275
3276#define PKTOPT_EXTHDRCPY(type) do { \
3277 if (src->type) { \
3278 int hlen = \
3279 (((struct ip6_ext *)src->type)->ip6e_len + 1) << 3; \
3280 dst->type = _MALLOC(hlen, M_IP6OPT, canwait); \
3281 if (dst->type == NULL && canwait == M_NOWAIT) \
3282 goto bad; \
3283 bcopy(src->type, dst->type, hlen); \
3284 } \
3285} while (0)
3286
3287static int
3288copypktopts(struct ip6_pktopts *dst, struct ip6_pktopts *src, int canwait)
3289{
3290 if (dst == NULL || src == NULL) {
3291 printf("copypktopts: invalid argument\n");
3292 return (EINVAL);
3293 }
3294
3295 dst->ip6po_hlim = src->ip6po_hlim;
3296 dst->ip6po_tclass = src->ip6po_tclass;
3297 dst->ip6po_flags = src->ip6po_flags;
3298 if (src->ip6po_pktinfo) {
3299 dst->ip6po_pktinfo = _MALLOC(sizeof (*dst->ip6po_pktinfo),
3300 M_IP6OPT, canwait);
3301 if (dst->ip6po_pktinfo == NULL && canwait == M_NOWAIT)
3302 goto bad;
3303 *dst->ip6po_pktinfo = *src->ip6po_pktinfo;
3304 }
3305 if (src->ip6po_nexthop) {
3306 dst->ip6po_nexthop = _MALLOC(src->ip6po_nexthop->sa_len,
3307 M_IP6OPT, canwait);
3308 if (dst->ip6po_nexthop == NULL && canwait == M_NOWAIT)
3309 goto bad;
3310 bcopy(src->ip6po_nexthop, dst->ip6po_nexthop,
3311 src->ip6po_nexthop->sa_len);
3312 }
3313 PKTOPT_EXTHDRCPY(ip6po_hbh);
3314 PKTOPT_EXTHDRCPY(ip6po_dest1);
3315 PKTOPT_EXTHDRCPY(ip6po_dest2);
3316 PKTOPT_EXTHDRCPY(ip6po_rthdr); /* not copy the cached route */
3317 return (0);
3318
3319bad:
3320 ip6_clearpktopts(dst, -1);
3321 return (ENOBUFS);
3322}
3323#undef PKTOPT_EXTHDRCPY
3324
3325struct ip6_pktopts *
3326ip6_copypktopts(struct ip6_pktopts *src, int canwait)
3327{
3328 int error;
3329 struct ip6_pktopts *dst;
3330
3331 dst = _MALLOC(sizeof (*dst), M_IP6OPT, canwait);
3332 if (dst == NULL)
3333 return (NULL);
3334 ip6_initpktopts(dst);
3335
3336 if ((error = copypktopts(dst, src, canwait)) != 0) {
3337 FREE(dst, M_IP6OPT);
3338 return (NULL);
3339 }
3340
3341 return (dst);
3342}
3343
3344void
3345ip6_freepcbopts(struct ip6_pktopts *pktopt)
3346{
3347 if (pktopt == NULL)
3348 return;
3349
3350 ip6_clearpktopts(pktopt, -1);
3351
3352 FREE(pktopt, M_IP6OPT);
3353}
3354
3355void
3356ip6_moptions_init(void)
3357{
3358 PE_parse_boot_argn("ifa_debug", &im6o_debug, sizeof (im6o_debug));
3359
3360 im6o_size = (im6o_debug == 0) ? sizeof (struct ip6_moptions) :
3361 sizeof (struct ip6_moptions_dbg);
3362
3363 im6o_zone = zinit(im6o_size, IM6O_ZONE_MAX * im6o_size, 0,
3364 IM6O_ZONE_NAME);
3365 if (im6o_zone == NULL) {
3366 panic("%s: failed allocating %s", __func__, IM6O_ZONE_NAME);
3367 /* NOTREACHED */
3368 }
3369 zone_change(im6o_zone, Z_EXPAND, TRUE);
3370}
3371
3372void
3373im6o_addref(struct ip6_moptions *im6o, int locked)
3374{
3375 if (!locked)
3376 IM6O_LOCK(im6o);
3377 else
3378 IM6O_LOCK_ASSERT_HELD(im6o);
3379
3380 if (++im6o->im6o_refcnt == 0) {
3381 panic("%s: im6o %p wraparound refcnt\n", __func__, im6o);
3382 /* NOTREACHED */
3383 } else if (im6o->im6o_trace != NULL) {
3384 (*im6o->im6o_trace)(im6o, TRUE);
3385 }
3386
3387 if (!locked)
3388 IM6O_UNLOCK(im6o);
3389}
3390
3391void
3392im6o_remref(struct ip6_moptions *im6o)
3393{
3394 int i;
3395
3396 IM6O_LOCK(im6o);
3397 if (im6o->im6o_refcnt == 0) {
3398 panic("%s: im6o %p negative refcnt", __func__, im6o);
3399 /* NOTREACHED */
3400 } else if (im6o->im6o_trace != NULL) {
3401 (*im6o->im6o_trace)(im6o, FALSE);
3402 }
3403
3404 --im6o->im6o_refcnt;
3405 if (im6o->im6o_refcnt > 0) {
3406 IM6O_UNLOCK(im6o);
3407 return;
3408 }
3409
3410 for (i = 0; i < im6o->im6o_num_memberships; ++i) {
3411 struct in6_mfilter *imf;
3412
3413 imf = im6o->im6o_mfilters ? &im6o->im6o_mfilters[i] : NULL;
3414 if (imf != NULL)
3415 im6f_leave(imf);
3416
3417 (void) in6_mc_leave(im6o->im6o_membership[i], imf);
3418
3419 if (imf != NULL)
3420 im6f_purge(imf);
3421
3422 IN6M_REMREF(im6o->im6o_membership[i]);
3423 im6o->im6o_membership[i] = NULL;
3424 }
3425 im6o->im6o_num_memberships = 0;
3426 if (im6o->im6o_mfilters != NULL) {
3427 FREE(im6o->im6o_mfilters, M_IN6MFILTER);
3428 im6o->im6o_mfilters = NULL;
3429 }
3430 if (im6o->im6o_membership != NULL) {
3431 FREE(im6o->im6o_membership, M_IP6MOPTS);
3432 im6o->im6o_membership = NULL;
3433 }
3434 IM6O_UNLOCK(im6o);
3435
3436 lck_mtx_destroy(&im6o->im6o_lock, ifa_mtx_grp);
3437
3438 if (!(im6o->im6o_debug & IFD_ALLOC)) {
3439 panic("%s: im6o %p cannot be freed", __func__, im6o);
3440 /* NOTREACHED */
3441 }
3442 zfree(im6o_zone, im6o);
3443}
3444
3445static void
3446im6o_trace(struct ip6_moptions *im6o, int refhold)
3447{
3448 struct ip6_moptions_dbg *im6o_dbg = (struct ip6_moptions_dbg *)im6o;
3449 ctrace_t *tr;
3450 u_int32_t idx;
3451 u_int16_t *cnt;
3452
3453 if (!(im6o->im6o_debug & IFD_DEBUG)) {
3454 panic("%s: im6o %p has no debug structure", __func__, im6o);
3455 /* NOTREACHED */
3456 }
3457 if (refhold) {
3458 cnt = &im6o_dbg->im6o_refhold_cnt;
3459 tr = im6o_dbg->im6o_refhold;
3460 } else {
3461 cnt = &im6o_dbg->im6o_refrele_cnt;
3462 tr = im6o_dbg->im6o_refrele;
3463 }
3464
3465 idx = atomic_add_16_ov(cnt, 1) % IM6O_TRACE_HIST_SIZE;
3466 ctrace_record(&tr[idx]);
3467}
3468
3469struct ip6_moptions *
3470ip6_allocmoptions(int how)
3471{
3472 struct ip6_moptions *im6o;
3473
3474 im6o = (how == M_WAITOK) ?
3475 zalloc(im6o_zone) : zalloc_noblock(im6o_zone);
3476 if (im6o != NULL) {
3477 bzero(im6o, im6o_size);
3478 lck_mtx_init(&im6o->im6o_lock, ifa_mtx_grp, ifa_mtx_attr);
3479 im6o->im6o_debug |= IFD_ALLOC;
3480 if (im6o_debug != 0) {
3481 im6o->im6o_debug |= IFD_DEBUG;
3482 im6o->im6o_trace = im6o_trace;
3483 }
3484 IM6O_ADDREF(im6o);
3485 }
3486
3487 return (im6o);
3488}
3489
3490/*
3491 * Set IPv6 outgoing packet options based on advanced API.
3492 */
3493int
3494ip6_setpktopts(struct mbuf *control, struct ip6_pktopts *opt,
3495 struct ip6_pktopts *stickyopt, int uproto)
3496{
3497 struct cmsghdr *cm = NULL;
3498
3499 if (control == NULL || opt == NULL)
3500 return (EINVAL);
3501
3502 ip6_initpktopts(opt);
3503 if (stickyopt) {
3504 int error;
3505
3506 /*
3507 * If stickyopt is provided, make a local copy of the options
3508 * for this particular packet, then override them by ancillary
3509 * objects.
3510 * XXX: copypktopts() does not copy the cached route to a next
3511 * hop (if any). This is not very good in terms of efficiency,
3512 * but we can allow this since this option should be rarely
3513 * used.
3514 */
3515 if ((error = copypktopts(opt, stickyopt, M_NOWAIT)) != 0)
3516 return (error);
3517 }
3518
3519 /*
3520 * XXX: Currently, we assume all the optional information is stored
3521 * in a single mbuf.
3522 */
3523 if (control->m_next)
3524 return (EINVAL);
3525
3526 if (control->m_len < CMSG_LEN(0))
3527 return (EINVAL);
3528
3529 for (cm = M_FIRST_CMSGHDR(control); cm != NULL;
3530 cm = M_NXT_CMSGHDR(control, cm)) {
3531 int error;
3532
3533 if (cm->cmsg_len < sizeof (struct cmsghdr) ||
3534 cm->cmsg_len > control->m_len)
3535 return (EINVAL);
3536 if (cm->cmsg_level != IPPROTO_IPV6)
3537 continue;
3538
3539 error = ip6_setpktopt(cm->cmsg_type, CMSG_DATA(cm),
3540 cm->cmsg_len - CMSG_LEN(0), opt, 0, 1, uproto);
3541 if (error)
3542 return (error);
3543 }
3544
3545 return (0);
3546}
3547/*
3548 * Set a particular packet option, as a sticky option or an ancillary data
3549 * item. "len" can be 0 only when it's a sticky option.
3550 * We have 4 cases of combination of "sticky" and "cmsg":
3551 * "sticky=0, cmsg=0": impossible
3552 * "sticky=0, cmsg=1": RFC2292 or RFC3542 ancillary data
3553 * "sticky=1, cmsg=0": RFC3542 socket option
3554 * "sticky=1, cmsg=1": RFC2292 socket option
3555 */
3556static int
3557ip6_setpktopt(int optname, u_char *buf, int len, struct ip6_pktopts *opt,
3558 int sticky, int cmsg, int uproto)
3559{
3560 int minmtupolicy, preftemp;
3561 int error;
3562 boolean_t capture_exthdrstat_out = FALSE;
3563
3564 if (!sticky && !cmsg) {
3565#ifdef DIAGNOSTIC
3566 printf("ip6_setpktopt: impossible case\n");
3567#endif
3568 return (EINVAL);
3569 }
3570
3571 /*
3572 * Caller must have ensured that the buffer is at least
3573 * aligned on 32-bit boundary.
3574 */
3575 VERIFY(IS_P2ALIGNED(buf, sizeof (u_int32_t)));
3576
3577 /*
3578 * IPV6_2292xxx is for backward compatibility to RFC2292, and should
3579 * not be specified in the context of RFC3542. Conversely,
3580 * RFC3542 types should not be specified in the context of RFC2292.
3581 */
3582 if (!cmsg) {
3583 switch (optname) {
3584 case IPV6_2292PKTINFO:
3585 case IPV6_2292HOPLIMIT:
3586 case IPV6_2292NEXTHOP:
3587 case IPV6_2292HOPOPTS:
3588 case IPV6_2292DSTOPTS:
3589 case IPV6_2292RTHDR:
3590 case IPV6_2292PKTOPTIONS:
3591 return (ENOPROTOOPT);
3592 }
3593 }
3594 if (sticky && cmsg) {
3595 switch (optname) {
3596 case IPV6_PKTINFO:
3597 case IPV6_HOPLIMIT:
3598 case IPV6_NEXTHOP:
3599 case IPV6_HOPOPTS:
3600 case IPV6_DSTOPTS:
3601 case IPV6_RTHDRDSTOPTS:
3602 case IPV6_RTHDR:
3603 case IPV6_USE_MIN_MTU:
3604 case IPV6_DONTFRAG:
3605 case IPV6_TCLASS:
3606 case IPV6_PREFER_TEMPADDR: /* XXX: not an RFC3542 option */
3607 return (ENOPROTOOPT);
3608 }
3609 }
3610
3611 switch (optname) {
3612 case IPV6_2292PKTINFO:
3613 case IPV6_PKTINFO: {
3614 struct ifnet *ifp = NULL;
3615 struct in6_pktinfo *pktinfo;
3616
3617 if (len != sizeof (struct in6_pktinfo))
3618 return (EINVAL);
3619
3620 pktinfo = (struct in6_pktinfo *)(void *)buf;
3621
3622 /*
3623 * An application can clear any sticky IPV6_PKTINFO option by
3624 * doing a "regular" setsockopt with ipi6_addr being
3625 * in6addr_any and ipi6_ifindex being zero.
3626 * [RFC 3542, Section 6]
3627 */
3628 if (optname == IPV6_PKTINFO && opt->ip6po_pktinfo &&
3629 pktinfo->ipi6_ifindex == 0 &&
3630 IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
3631 ip6_clearpktopts(opt, optname);
3632 break;
3633 }
3634
3635 if (uproto == IPPROTO_TCP && optname == IPV6_PKTINFO &&
3636 sticky && !IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
3637 return (EINVAL);
3638 }
3639
3640 /* validate the interface index if specified. */
3641 ifnet_head_lock_shared();
3642
3643 if (pktinfo->ipi6_ifindex > if_index) {
3644 ifnet_head_done();
3645 return (ENXIO);
3646 }
3647
3648 if (pktinfo->ipi6_ifindex) {
3649 ifp = ifindex2ifnet[pktinfo->ipi6_ifindex];
3650 if (ifp == NULL) {
3651 ifnet_head_done();
3652 return (ENXIO);
3653 }
3654 }
3655
3656 ifnet_head_done();
3657
3658 /*
3659 * We store the address anyway, and let in6_selectsrc()
3660 * validate the specified address. This is because ipi6_addr
3661 * may not have enough information about its scope zone, and
3662 * we may need additional information (such as outgoing
3663 * interface or the scope zone of a destination address) to
3664 * disambiguate the scope.
3665 * XXX: the delay of the validation may confuse the
3666 * application when it is used as a sticky option.
3667 */
3668 if (opt->ip6po_pktinfo == NULL) {
3669 opt->ip6po_pktinfo = _MALLOC(sizeof (*pktinfo),
3670 M_IP6OPT, M_NOWAIT);
3671 if (opt->ip6po_pktinfo == NULL)
3672 return (ENOBUFS);
3673 }
3674 bcopy(pktinfo, opt->ip6po_pktinfo, sizeof (*pktinfo));
3675 break;
3676 }
3677
3678 case IPV6_2292HOPLIMIT:
3679 case IPV6_HOPLIMIT: {
3680 int *hlimp;
3681
3682 /*
3683 * RFC 3542 deprecated the usage of sticky IPV6_HOPLIMIT
3684 * to simplify the ordering among hoplimit options.
3685 */
3686 if (optname == IPV6_HOPLIMIT && sticky)
3687 return (ENOPROTOOPT);
3688
3689 if (len != sizeof (int))
3690 return (EINVAL);
3691 hlimp = (int *)(void *)buf;
3692 if (*hlimp < -1 || *hlimp > 255)
3693 return (EINVAL);
3694
3695 opt->ip6po_hlim = *hlimp;
3696 break;
3697 }
3698
3699 case IPV6_TCLASS: {
3700 int tclass;
3701
3702 if (len != sizeof (int))
3703 return (EINVAL);
3704 tclass = *(int *)(void *)buf;
3705 if (tclass < -1 || tclass > 255)
3706 return (EINVAL);
3707
3708 opt->ip6po_tclass = tclass;
3709 break;
3710 }
3711
3712 case IPV6_2292NEXTHOP:
3713 case IPV6_NEXTHOP:
3714 error = suser(kauth_cred_get(), 0);
3715 if (error)
3716 return (EACCES);
3717
3718 if (len == 0) { /* just remove the option */
3719 ip6_clearpktopts(opt, IPV6_NEXTHOP);
3720 break;
3721 }
3722
3723 /* check if cmsg_len is large enough for sa_len */
3724 if (len < sizeof (struct sockaddr) || len < *buf)
3725 return (EINVAL);
3726
3727 switch (SA(buf)->sa_family) {
3728 case AF_INET6: {
3729 struct sockaddr_in6 *sa6 = SIN6(buf);
3730
3731 if (sa6->sin6_len != sizeof (struct sockaddr_in6))
3732 return (EINVAL);
3733
3734 if (IN6_IS_ADDR_UNSPECIFIED(&sa6->sin6_addr) ||
3735 IN6_IS_ADDR_MULTICAST(&sa6->sin6_addr)) {
3736 return (EINVAL);
3737 }
3738 if ((error = sa6_embedscope(sa6, ip6_use_defzone))
3739 != 0) {
3740 return (error);
3741 }
3742 break;
3743 }
3744 case AF_LINK: /* should eventually be supported */
3745 default:
3746 return (EAFNOSUPPORT);
3747 }
3748
3749 /* turn off the previous option, then set the new option. */
3750 ip6_clearpktopts(opt, IPV6_NEXTHOP);
3751 opt->ip6po_nexthop = _MALLOC(*buf, M_IP6OPT, M_NOWAIT);
3752 if (opt->ip6po_nexthop == NULL)
3753 return (ENOBUFS);
3754 bcopy(buf, opt->ip6po_nexthop, *buf);
3755 break;
3756
3757 case IPV6_2292HOPOPTS:
3758 case IPV6_HOPOPTS: {
3759 struct ip6_hbh *hbh;
3760 int hbhlen;
3761
3762 /*
3763 * XXX: We don't allow a non-privileged user to set ANY HbH
3764 * options, since per-option restriction has too much
3765 * overhead.
3766 */
3767 error = suser(kauth_cred_get(), 0);
3768 if (error)
3769 return (EACCES);
3770
3771 if (len == 0) {
3772 ip6_clearpktopts(opt, IPV6_HOPOPTS);
3773 break; /* just remove the option */
3774 }
3775
3776 /* message length validation */
3777 if (len < sizeof (struct ip6_hbh))
3778 return (EINVAL);
3779 hbh = (struct ip6_hbh *)(void *)buf;
3780 hbhlen = (hbh->ip6h_len + 1) << 3;
3781 if (len != hbhlen)
3782 return (EINVAL);
3783
3784 /* turn off the previous option, then set the new option. */
3785 ip6_clearpktopts(opt, IPV6_HOPOPTS);
3786 opt->ip6po_hbh = _MALLOC(hbhlen, M_IP6OPT, M_NOWAIT);
3787 if (opt->ip6po_hbh == NULL)
3788 return (ENOBUFS);
3789 bcopy(hbh, opt->ip6po_hbh, hbhlen);
3790 capture_exthdrstat_out = TRUE;
3791 break;
3792 }
3793
3794 case IPV6_2292DSTOPTS:
3795 case IPV6_DSTOPTS:
3796 case IPV6_RTHDRDSTOPTS: {
3797 struct ip6_dest *dest, **newdest = NULL;
3798 int destlen;
3799
3800 error = suser(kauth_cred_get(), 0);
3801 if (error)
3802 return (EACCES);
3803
3804 if (len == 0) {
3805 ip6_clearpktopts(opt, optname);
3806 break; /* just remove the option */
3807 }
3808
3809 /* message length validation */
3810 if (len < sizeof (struct ip6_dest))
3811 return (EINVAL);
3812 dest = (struct ip6_dest *)(void *)buf;
3813 destlen = (dest->ip6d_len + 1) << 3;
3814 if (len != destlen)
3815 return (EINVAL);
3816
3817 /*
3818 * Determine the position that the destination options header
3819 * should be inserted; before or after the routing header.
3820 */
3821 switch (optname) {
3822 case IPV6_2292DSTOPTS:
3823 /*
3824 * The old advacned API is ambiguous on this point.
3825 * Our approach is to determine the position based
3826 * according to the existence of a routing header.
3827 * Note, however, that this depends on the order of the
3828 * extension headers in the ancillary data; the 1st
3829 * part of the destination options header must appear
3830 * before the routing header in the ancillary data,
3831 * too.
3832 * RFC3542 solved the ambiguity by introducing
3833 * separate ancillary data or option types.
3834 */
3835 if (opt->ip6po_rthdr == NULL)
3836 newdest = &opt->ip6po_dest1;
3837 else
3838 newdest = &opt->ip6po_dest2;
3839 break;
3840 case IPV6_RTHDRDSTOPTS:
3841 newdest = &opt->ip6po_dest1;
3842 break;
3843 case IPV6_DSTOPTS:
3844 newdest = &opt->ip6po_dest2;
3845 break;
3846 }
3847
3848 /* turn off the previous option, then set the new option. */
3849 ip6_clearpktopts(opt, optname);
3850 *newdest = _MALLOC(destlen, M_IP6OPT, M_NOWAIT);
3851 if (*newdest == NULL)
3852 return (ENOBUFS);
3853 bcopy(dest, *newdest, destlen);
3854 capture_exthdrstat_out = TRUE;
3855 break;
3856 }
3857
3858 case IPV6_2292RTHDR:
3859 case IPV6_RTHDR: {
3860 struct ip6_rthdr *rth;
3861 int rthlen;
3862
3863 if (len == 0) {
3864 ip6_clearpktopts(opt, IPV6_RTHDR);
3865 break; /* just remove the option */
3866 }
3867
3868 /* message length validation */
3869 if (len < sizeof (struct ip6_rthdr))
3870 return (EINVAL);
3871 rth = (struct ip6_rthdr *)(void *)buf;
3872 rthlen = (rth->ip6r_len + 1) << 3;
3873 if (len != rthlen)
3874 return (EINVAL);
3875
3876 switch (rth->ip6r_type) {
3877 case IPV6_RTHDR_TYPE_0:
3878 if (rth->ip6r_len == 0) /* must contain one addr */
3879 return (EINVAL);
3880 if (rth->ip6r_len % 2) /* length must be even */
3881 return (EINVAL);
3882 if (rth->ip6r_len / 2 != rth->ip6r_segleft)
3883 return (EINVAL);
3884 break;
3885 default:
3886 return (EINVAL); /* not supported */
3887 }
3888
3889 /* turn off the previous option */
3890 ip6_clearpktopts(opt, IPV6_RTHDR);
3891 opt->ip6po_rthdr = _MALLOC(rthlen, M_IP6OPT, M_NOWAIT);
3892 if (opt->ip6po_rthdr == NULL)
3893 return (ENOBUFS);
3894 bcopy(rth, opt->ip6po_rthdr, rthlen);
3895 capture_exthdrstat_out = TRUE;
3896 break;
3897 }
3898
3899 case IPV6_USE_MIN_MTU:
3900 if (len != sizeof (int))
3901 return (EINVAL);
3902 minmtupolicy = *(int *)(void *)buf;
3903 if (minmtupolicy != IP6PO_MINMTU_MCASTONLY &&
3904 minmtupolicy != IP6PO_MINMTU_DISABLE &&
3905 minmtupolicy != IP6PO_MINMTU_ALL) {
3906 return (EINVAL);
3907 }
3908 opt->ip6po_minmtu = minmtupolicy;
3909 break;
3910
3911 case IPV6_DONTFRAG:
3912 if (len != sizeof (int))
3913 return (EINVAL);
3914
3915 if (uproto == IPPROTO_TCP || *(int *)(void *)buf == 0) {
3916 /*
3917 * we ignore this option for TCP sockets.
3918 * (RFC3542 leaves this case unspecified.)
3919 */
3920 opt->ip6po_flags &= ~IP6PO_DONTFRAG;
3921 } else {
3922 opt->ip6po_flags |= IP6PO_DONTFRAG;
3923 }
3924 break;
3925
3926 case IPV6_PREFER_TEMPADDR:
3927 if (len != sizeof (int))
3928 return (EINVAL);
3929 preftemp = *(int *)(void *)buf;
3930 if (preftemp != IP6PO_TEMPADDR_SYSTEM &&
3931 preftemp != IP6PO_TEMPADDR_NOTPREFER &&
3932 preftemp != IP6PO_TEMPADDR_PREFER) {
3933 return (EINVAL);
3934 }
3935 opt->ip6po_prefer_tempaddr = preftemp;
3936 break;
3937
3938 default:
3939 return (ENOPROTOOPT);
3940 } /* end of switch */
3941
3942 if (capture_exthdrstat_out) {
3943 if (uproto == IPPROTO_TCP) {
3944 INC_ATOMIC_INT64_LIM(net_api_stats.nas_sock_inet6_stream_exthdr_out);
3945 } else if (uproto == IPPROTO_UDP) {
3946 INC_ATOMIC_INT64_LIM(net_api_stats.nas_sock_inet6_dgram_exthdr_out);
3947 }
3948 }
3949
3950 return (0);
3951}
3952
3953/*
3954 * Routine called from ip6_output() to loop back a copy of an IP6 multicast
3955 * packet to the input queue of a specified interface. Note that this
3956 * calls the output routine of the loopback "driver", but with an interface
3957 * pointer that might NOT be &loif -- easier than replicating that code here.
3958 */
3959void
3960ip6_mloopback(struct ifnet *srcifp, struct ifnet *origifp, struct mbuf *m,
3961 struct sockaddr_in6 *dst, uint32_t optlen, int32_t nxt0)
3962{
3963 struct mbuf *copym;
3964 struct ip6_hdr *ip6;
3965 struct in6_addr src;
3966
3967 if (lo_ifp == NULL)
3968 return;
3969
3970 /*
3971 * Copy the packet header as it's needed for the checksum.
3972 * Make sure to deep-copy IPv6 header portion in case the data
3973 * is in an mbuf cluster, so that we can safely override the IPv6
3974 * header portion later.
3975 */
3976 copym = m_copym_mode(m, 0, M_COPYALL, M_DONTWAIT, M_COPYM_COPY_HDR);
3977 if (copym != NULL && ((copym->m_flags & M_EXT) ||
3978 copym->m_len < sizeof (struct ip6_hdr)))
3979 copym = m_pullup(copym, sizeof (struct ip6_hdr));
3980
3981 if (copym == NULL)
3982 return;
3983
3984 ip6 = mtod(copym, struct ip6_hdr *);
3985 src = ip6->ip6_src;
3986 /*
3987 * clear embedded scope identifiers if necessary.
3988 * in6_clearscope will touch the addresses only when necessary.
3989 */
3990 in6_clearscope(&ip6->ip6_src);
3991 in6_clearscope(&ip6->ip6_dst);
3992
3993 if (copym->m_pkthdr.csum_flags & CSUM_DELAY_IPV6_DATA)
3994 in6_delayed_cksum_offset(copym, 0, optlen, nxt0);
3995
3996 /*
3997 * Stuff the 'real' ifp into the pkthdr, to be used in matching
3998 * in ip6_input(); we need the loopback ifp/dl_tag passed as args
3999 * to make the loopback driver compliant with the data link
4000 * requirements.
4001 */
4002 copym->m_pkthdr.rcvif = origifp;
4003
4004 /*
4005 * Also record the source interface (which owns the source address).
4006 * This is basically a stripped down version of ifa_foraddr6().
4007 */
4008 if (srcifp == NULL) {
4009 struct in6_ifaddr *ia;
4010
4011 lck_rw_lock_shared(&in6_ifaddr_rwlock);
4012 for (ia = in6_ifaddrs; ia != NULL; ia = ia->ia_next) {
4013 IFA_LOCK_SPIN(&ia->ia_ifa);
4014 /* compare against src addr with embedded scope */
4015 if (IN6_ARE_ADDR_EQUAL(&ia->ia_addr.sin6_addr, &src)) {
4016 srcifp = ia->ia_ifp;
4017 IFA_UNLOCK(&ia->ia_ifa);
4018 break;
4019 }
4020 IFA_UNLOCK(&ia->ia_ifa);
4021 }
4022 lck_rw_done(&in6_ifaddr_rwlock);
4023 }
4024 if (srcifp != NULL)
4025 ip6_setsrcifaddr_info(copym, srcifp->if_index, NULL);
4026 ip6_setdstifaddr_info(copym, origifp->if_index, NULL);
4027
4028 dlil_output(lo_ifp, PF_INET6, copym, NULL, SA(dst), 0, NULL);
4029}
4030
4031/*
4032 * Chop IPv6 header off from the payload.
4033 */
4034static int
4035ip6_splithdr(struct mbuf *m, struct ip6_exthdrs *exthdrs)
4036{
4037 struct mbuf *mh;
4038 struct ip6_hdr *ip6;
4039
4040 ip6 = mtod(m, struct ip6_hdr *);
4041 if (m->m_len > sizeof (*ip6)) {
4042 MGETHDR(mh, M_DONTWAIT, MT_HEADER); /* MAC-OK */
4043 if (mh == NULL) {
4044 m_freem(m);
4045 return (ENOBUFS);
4046 }
4047 M_COPY_PKTHDR(mh, m);
4048 MH_ALIGN(mh, sizeof (*ip6));
4049 m->m_flags &= ~M_PKTHDR;
4050 m->m_len -= sizeof (*ip6);
4051 m->m_data += sizeof (*ip6);
4052 mh->m_next = m;
4053 m = mh;
4054 m->m_len = sizeof (*ip6);
4055 bcopy((caddr_t)ip6, mtod(m, caddr_t), sizeof (*ip6));
4056 }
4057 exthdrs->ip6e_ip6 = m;
4058 return (0);
4059}
4060
4061static void
4062ip6_output_checksum(struct ifnet *ifp, uint32_t mtu, struct mbuf *m,
4063 int nxt0, uint32_t tlen, uint32_t optlen)
4064{
4065 uint32_t sw_csum, hwcap = ifp->if_hwassist;
4066 int tso = TSO_IPV6_OK(ifp, m);
4067
4068 if (!hwcksum_tx) {
4069 /* do all in software; checksum offload is disabled */
4070 sw_csum = CSUM_DELAY_IPV6_DATA & m->m_pkthdr.csum_flags;
4071 } else {
4072 /* do in software what the hardware cannot */
4073 sw_csum = m->m_pkthdr.csum_flags &
4074 ~IF_HWASSIST_CSUM_FLAGS(hwcap);
4075 }
4076
4077 if (optlen != 0) {
4078 sw_csum |= (CSUM_DELAY_IPV6_DATA &
4079 m->m_pkthdr.csum_flags);
4080 } else if (!(sw_csum & CSUM_DELAY_IPV6_DATA) &&
4081 (hwcap & CSUM_PARTIAL)) {
4082 /*
4083 * Partial checksum offload, ere), if no extension headers,
4084 * and TCP only (no UDP support, as the hardware may not be
4085 * able to convert +0 to -0 (0xffff) per RFC1122 4.1.3.4.
4086 * unless the interface supports "invert zero" capability.)
4087 */
4088 if (hwcksum_tx && !tso &&
4089 ((m->m_pkthdr.csum_flags & CSUM_TCPIPV6) ||
4090 ((hwcap & CSUM_ZERO_INVERT) &&
4091 (m->m_pkthdr.csum_flags & CSUM_ZERO_INVERT))) &&
4092 tlen <= mtu) {
4093 uint16_t start = sizeof (struct ip6_hdr);
4094 uint16_t ulpoff =
4095 m->m_pkthdr.csum_data & 0xffff;
4096 m->m_pkthdr.csum_flags |=
4097 (CSUM_DATA_VALID | CSUM_PARTIAL);
4098 m->m_pkthdr.csum_tx_stuff = (ulpoff + start);
4099 m->m_pkthdr.csum_tx_start = start;
4100 sw_csum = 0;
4101 } else {
4102 sw_csum |= (CSUM_DELAY_IPV6_DATA &
4103 m->m_pkthdr.csum_flags);
4104 }
4105 }
4106
4107 if (sw_csum & CSUM_DELAY_IPV6_DATA) {
4108 in6_delayed_cksum_offset(m, 0, optlen, nxt0);
4109 sw_csum &= ~CSUM_DELAY_IPV6_DATA;
4110 }
4111
4112 if (hwcksum_tx) {
4113 /*
4114 * Drop off bits that aren't supported by hardware;
4115 * also make sure to preserve non-checksum related bits.
4116 */
4117 m->m_pkthdr.csum_flags =
4118 ((m->m_pkthdr.csum_flags &
4119 (IF_HWASSIST_CSUM_FLAGS(hwcap) | CSUM_DATA_VALID)) |
4120 (m->m_pkthdr.csum_flags & ~IF_HWASSIST_CSUM_MASK));
4121 } else {
4122 /* drop all bits; checksum offload is disabled */
4123 m->m_pkthdr.csum_flags = 0;
4124 }
4125}
4126
4127/*
4128 * Compute IPv6 extension header length.
4129 */
4130int
4131ip6_optlen(struct in6pcb *in6p)
4132{
4133 int len;
4134
4135 if (!in6p->in6p_outputopts)
4136 return (0);
4137
4138 len = 0;
4139#define elen(x) \
4140 (((struct ip6_ext *)(x)) ? \
4141 (((struct ip6_ext *)(x))->ip6e_len + 1) << 3 : 0)
4142
4143 len += elen(in6p->in6p_outputopts->ip6po_hbh);
4144 if (in6p->in6p_outputopts->ip6po_rthdr) {
4145 /* dest1 is valid with rthdr only */
4146 len += elen(in6p->in6p_outputopts->ip6po_dest1);
4147 }
4148 len += elen(in6p->in6p_outputopts->ip6po_rthdr);
4149 len += elen(in6p->in6p_outputopts->ip6po_dest2);
4150 return (len);
4151#undef elen
4152}
4153
4154static int
4155sysctl_reset_ip6_output_stats SYSCTL_HANDLER_ARGS
4156{
4157#pragma unused(arg1, arg2)
4158 int error, i;
4159
4160 i = ip6_output_measure;
4161 error = sysctl_handle_int(oidp, &i, 0, req);
4162 if (error || req->newptr == USER_ADDR_NULL)
4163 goto done;
4164 /* impose bounds */
4165 if (i < 0 || i > 1) {
4166 error = EINVAL;
4167 goto done;
4168 }
4169 if (ip6_output_measure != i && i == 1) {
4170 net_perf_initialize(&net_perf, ip6_output_measure_bins);
4171 }
4172 ip6_output_measure = i;
4173done:
4174 return (error);
4175}
4176
4177static int
4178sysctl_ip6_output_measure_bins SYSCTL_HANDLER_ARGS
4179{
4180#pragma unused(arg1, arg2)
4181 int error;
4182 uint64_t i;
4183
4184 i = ip6_output_measure_bins;
4185 error = sysctl_handle_quad(oidp, &i, 0, req);
4186 if (error || req->newptr == USER_ADDR_NULL)
4187 goto done;
4188 /* validate data */
4189 if (!net_perf_validate_bins(i)) {
4190 error = EINVAL;
4191 goto done;
4192 }
4193 ip6_output_measure_bins = i;
4194done:
4195 return (error);
4196}
4197
4198static int
4199sysctl_ip6_output_getperf SYSCTL_HANDLER_ARGS
4200{
4201#pragma unused(oidp, arg1, arg2)
4202 if (req->oldptr == USER_ADDR_NULL)
4203 req->oldlen = (size_t)sizeof (struct ipstat);
4204
4205 return (SYSCTL_OUT(req, &net_perf, MIN(sizeof (net_perf), req->oldlen)));
4206}
4207