1 /*
2 * Copyright (c) 2000-2023 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 /*
30 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
31 * All rights reserved.
32 *
33 * Redistribution and use in source and binary forms, with or without
34 * modification, are permitted provided that the following conditions
35 * are met:
36 * 1. Redistributions of source code must retain the above copyright
37 * notice, this list of conditions and the following disclaimer.
38 * 2. Redistributions in binary form must reproduce the above copyright
39 * notice, this list of conditions and the following disclaimer in the
40 * documentation and/or other materials provided with the distribution.
41 * 3. Neither the name of the project nor the names of its contributors
42 * may be used to endorse or promote products derived from this software
43 * without specific prior written permission.
44 *
45 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
46 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
47 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
48 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
49 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
50 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
51 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
52 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
53 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
54 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
55 * SUCH DAMAGE.
56 */
57
58 /*
59 * Copyright (c) 1982, 1986, 1988, 1990, 1993
60 * The Regents of the University of California. All rights reserved.
61 *
62 * Redistribution and use in source and binary forms, with or without
63 * modification, are permitted provided that the following conditions
64 * are met:
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
67 * 2. Redistributions in binary form must reproduce the above copyright
68 * notice, this list of conditions and the following disclaimer in the
69 * documentation and/or other materials provided with the distribution.
70 * 3. All advertising materials mentioning features or use of this software
71 * must display the following acknowledgement:
72 * This product includes software developed by the University of
73 * California, Berkeley and its contributors.
74 * 4. Neither the name of the University nor the names of its contributors
75 * may be used to endorse or promote products derived from this software
76 * without specific prior written permission.
77 *
78 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
79 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
80 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
81 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
82 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
83 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
84 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
85 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
86 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
87 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
88 * SUCH DAMAGE.
89 *
90 * @(#)ip_output.c 8.3 (Berkeley) 1/21/94
91 */
92 /*
93 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
94 * support for mandatory and extensible security protections. This notice
95 * is included in support of clause 2.2 (b) of the Apple Public License,
96 * Version 2.0.
97 */
98
99 #include <sys/param.h>
100 #include <sys/malloc.h>
101 #include <sys/mbuf.h>
102 #include <sys/errno.h>
103 #include <sys/protosw.h>
104 #include <sys/socket.h>
105 #include <sys/socketvar.h>
106 #include <sys/systm.h>
107 #include <sys/kernel.h>
108 #include <sys/proc.h>
109 #include <sys/kauth.h>
110 #include <sys/mcache.h>
111 #include <sys/sysctl.h>
112 #include <kern/zalloc.h>
113 #include <libkern/OSByteOrder.h>
114
115 #include <pexpert/pexpert.h>
116 #include <mach/sdt.h>
117
118 #include <net/if.h>
119 #include <net/route.h>
120 #include <net/dlil.h>
121 #include <net/net_api_stats.h>
122 #include <net/net_osdep.h>
123 #include <net/net_perf.h>
124
125 #include <netinet/ip.h>
126 #include <netinet/in.h>
127 #include <netinet/in_var.h>
128 #include <netinet/ip_var.h>
129 #include <netinet6/in6_var.h>
130 #include <netinet/ip6.h>
131 #include <netinet/kpi_ipfilter_var.h>
132 #include <netinet/in_tclass.h>
133
134 #include <netinet6/ip6protosw.h>
135 #include <netinet/icmp6.h>
136 #include <netinet6/ip6_var.h>
137 #include <netinet/in_pcb.h>
138 #include <netinet6/nd6.h>
139 #include <netinet6/scope6_var.h>
140 #if IPSEC
141 #include <netinet6/ipsec.h>
142 #include <netinet6/ipsec6.h>
143 #include <netkey/key.h>
144 extern int ipsec_bypass;
145 #endif /* IPSEC */
146
147 #if NECP
148 #include <net/necp.h>
149 #endif /* NECP */
150
151 #if DUMMYNET
152 #include <netinet/ip_dummynet.h>
153 #endif /* DUMMYNET */
154
155 #if PF
156 #include <net/pfvar.h>
157 #endif /* PF */
158
159 static int sysctl_reset_ip6_output_stats SYSCTL_HANDLER_ARGS;
160 static int sysctl_ip6_output_measure_bins SYSCTL_HANDLER_ARGS;
161 static int sysctl_ip6_output_getperf SYSCTL_HANDLER_ARGS;
162 static int ip6_copyexthdr(struct mbuf **, caddr_t, int);
163 static void ip6_out_cksum_stats(int, u_int32_t);
164 static int ip6_insert_jumboopt(struct ip6_exthdrs *, u_int32_t);
165 static int ip6_insertfraghdr(struct mbuf *, struct mbuf *, int,
166 struct ip6_frag **);
167 static int ip6_getpmtu(struct route_in6 *, struct route_in6 *,
168 struct ifnet *, struct in6_addr *, uint32_t, u_int32_t *);
169 static int ip6_pcbopts(struct ip6_pktopts **, struct mbuf *, struct socket *,
170 struct sockopt *sopt);
171 static int ip6_pcbopt(int, u_char *, int, struct ip6_pktopts **, int);
172 static int ip6_getpcbopt(struct ip6_pktopts *, int, struct sockopt *);
173 static int copypktopts(struct ip6_pktopts *, struct ip6_pktopts *, zalloc_flags_t);
174 static void im6o_trace(struct ip6_moptions *, int);
175 static int ip6_setpktopt(int, u_char *, int, struct ip6_pktopts *, int,
176 int, int);
177 static int ip6_splithdr(struct mbuf *, struct ip6_exthdrs *);
178 static void ip6_output_checksum(struct ifnet *, uint32_t, struct mbuf *,
179 int, uint32_t, uint32_t);
180 extern int udp_ctloutput(struct socket *, struct sockopt *);
181 static int ip6_fragment_packet(struct mbuf **m,
182 struct ip6_pktopts *opt, struct ip6_out_args * ip6oa,
183 struct ip6_exthdrs *exthdrsp, struct ifnet *ifp,
184 uint32_t mtu, uint32_t unfragpartlen,
185 int nxt0, uint32_t optlen);
186
187 SYSCTL_DECL(_net_inet6_ip6);
188
189 static int ip6_output_measure = 0;
190 SYSCTL_PROC(_net_inet6_ip6, OID_AUTO, output_perf,
191 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED,
192 &ip6_output_measure, 0, sysctl_reset_ip6_output_stats, "I", "Do time measurement");
193
194 static uint64_t ip6_output_measure_bins = 0;
195 SYSCTL_PROC(_net_inet6_ip6, OID_AUTO, output_perf_bins,
196 CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED, &ip6_output_measure_bins, 0,
197 sysctl_ip6_output_measure_bins, "I",
198 "bins for chaining performance data histogram");
199
200 static net_perf_t net_perf;
201 SYSCTL_PROC(_net_inet6_ip6, OID_AUTO, output_perf_data,
202 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED,
203 0, 0, sysctl_ip6_output_getperf, "S,net_perf",
204 "IP6 output performance data (struct net_perf, net/net_perf.h)");
205
206 #define IM6O_TRACE_HIST_SIZE 32 /* size of trace history */
207
208 /* For gdb */
209 __private_extern__ unsigned int im6o_trace_hist_size = IM6O_TRACE_HIST_SIZE;
210
211 struct ip6_moptions_dbg {
212 struct ip6_moptions im6o; /* ip6_moptions */
213 u_int16_t im6o_refhold_cnt; /* # of IM6O_ADDREF */
214 u_int16_t im6o_refrele_cnt; /* # of IM6O_REMREF */
215 /*
216 * Alloc and free callers.
217 */
218 ctrace_t im6o_alloc;
219 ctrace_t im6o_free;
220 /*
221 * Circular lists of IM6O_ADDREF and IM6O_REMREF callers.
222 */
223 ctrace_t im6o_refhold[IM6O_TRACE_HIST_SIZE];
224 ctrace_t im6o_refrele[IM6O_TRACE_HIST_SIZE];
225 };
226
227 #if DEBUG
228 static unsigned int im6o_debug = 1; /* debugging (enabled) */
229 #else
230 static unsigned int im6o_debug; /* debugging (disabled) */
231 #endif /* !DEBUG */
232
233 static struct zone *im6o_zone; /* zone for ip6_moptions */
234 #define IM6O_ZONE_NAME "ip6_moptions" /* zone name */
235
236 /*
237 * ip6_output() calls ip6_output_list() to do the work
238 */
239 int
ip6_output(struct mbuf * m0,struct ip6_pktopts * opt,struct route_in6 * ro,int flags,struct ip6_moptions * im6o,struct ifnet ** ifpp,struct ip6_out_args * ip6oa)240 ip6_output(struct mbuf *m0, struct ip6_pktopts *opt,
241 struct route_in6 *ro, int flags, struct ip6_moptions *im6o,
242 struct ifnet **ifpp, struct ip6_out_args *ip6oa)
243 {
244 return ip6_output_list(m0, 0, opt, ro, flags, im6o, ifpp, ip6oa);
245 }
246
247 /*
248 * IP6 output. Each packet in mbuf chain m contains a skeletal IP6
249 * header (with pri, len, nxt, hlim, src, dst).
250 * This function may modify ver and hlim only.
251 * The mbuf chain containing the packet will be freed.
252 * The mbuf opt, if present, will not be freed.
253 *
254 * If ro is non-NULL and has valid ro->ro_rt, route lookup would be
255 * skipped and ro->ro_rt would be used. Otherwise the result of route
256 * lookup is stored in ro->ro_rt.
257 *
258 * type of "mtu": rt_rmx.rmx_mtu is u_int32_t, ifnet.ifr_mtu is int, and
259 * nd_ifinfo.linkmtu is u_int32_t. so we use u_int32_t to hold largest one,
260 * which is rt_rmx.rmx_mtu.
261 */
262 int
ip6_output_list(struct mbuf * m0,int packetchain,struct ip6_pktopts * opt,struct route_in6 * ro,int flags,struct ip6_moptions * im6o,struct ifnet ** ifpp,struct ip6_out_args * ip6oa)263 ip6_output_list(struct mbuf *m0, int packetchain, struct ip6_pktopts *opt,
264 struct route_in6 *ro, int flags, struct ip6_moptions *im6o,
265 struct ifnet **ifpp, struct ip6_out_args *ip6oa)
266 {
267 struct ip6_hdr *ip6;
268 u_char *nexthdrp;
269 struct ifnet *ifp = NULL, *origifp = NULL; /* refcnt'd */
270 struct ifnet **ifpp_save = ifpp;
271 struct mbuf *m, *mprev;
272 struct mbuf *sendchain = NULL, *sendchain_last = NULL;
273 struct mbuf *inputchain = NULL;
274 int nxt0 = 0;
275 struct route_in6 *ro_pmtu = NULL;
276 struct rtentry *rt = NULL;
277 struct sockaddr_in6 *dst = NULL, src_sa, dst_sa;
278 int error = 0;
279 struct in6_ifaddr *ia = NULL, *src_ia = NULL;
280 u_int32_t mtu = 0;
281 u_int32_t optlen = 0, plen = 0, unfragpartlen = 0;
282 struct ip6_rthdr *rh;
283 struct in6_addr finaldst;
284 ipfilter_t inject_filter_ref;
285 struct ipf_pktopts *ippo = NULL;
286 struct flowadv *adv = NULL;
287 uint32_t pktcnt = 0;
288 uint32_t packets_processed = 0;
289 struct timeval start_tv;
290 #if PF
291 boolean_t skip_pf = (ip6oa != NULL) &&
292 (ip6oa->ip6oa_flags & IP6OAF_SKIP_PF);
293 #endif
294
295 #if DUMMYNET
296 struct m_tag *tag;
297 struct ip6_out_args saved_ip6oa;
298 struct sockaddr_in6 dst_buf;
299 #endif /* DUMMYNET */
300 #if IPSEC
301 struct socket *so = NULL;
302 struct secpolicy *sp = NULL;
303 struct route_in6 *ipsec_saved_route = NULL;
304 boolean_t needipsectun = FALSE;
305 #endif /* IPSEC */
306 #if NECP
307 necp_kernel_policy_result necp_result = 0;
308 necp_kernel_policy_result_parameter necp_result_parameter;
309 necp_kernel_policy_id necp_matched_policy_id = 0;
310 #endif /* NECP */
311 struct {
312 struct ipf_pktopts ipf_pktopts;
313 struct ip6_exthdrs exthdrs;
314 struct route_in6 ip6route;
315 #if IPSEC
316 struct ipsec_output_state ipsec_state;
317 #endif /* IPSEC */
318 #if NECP
319 struct route_in6 necp_route;
320 #endif /* NECP */
321 #if DUMMYNET
322 struct route_in6 saved_route;
323 struct route_in6 saved_ro_pmtu;
324 struct ip_fw_args args;
325 #endif /* DUMMYNET */
326 } ip6obz;
327 #define ipf_pktopts ip6obz.ipf_pktopts
328 #define exthdrs ip6obz.exthdrs
329 #define ip6route ip6obz.ip6route
330 #define ipsec_state ip6obz.ipsec_state
331 #define necp_route ip6obz.necp_route
332 #define saved_route ip6obz.saved_route
333 #define saved_ro_pmtu ip6obz.saved_ro_pmtu
334 #define args ip6obz.args
335 union {
336 struct {
337 boolean_t select_srcif : 1;
338 boolean_t hdrsplit : 1;
339 boolean_t route_selected : 1;
340 boolean_t dontfrag : 1;
341 #if IPSEC
342 boolean_t needipsec : 1;
343 boolean_t noipsec : 1;
344 #endif /* IPSEC */
345 };
346 uint32_t raw;
347 } ip6obf = { .raw = 0 };
348
349 if (ip6_output_measure) {
350 net_perf_start_time(&net_perf, &start_tv);
351 }
352
353 VERIFY(m0->m_flags & M_PKTHDR);
354
355 /* zero out {saved_route, saved_ro_pmtu, ip6route, exthdrs, args} */
356 bzero(&ip6obz, sizeof(ip6obz));
357
358 #if DUMMYNET
359 if (SLIST_EMPTY(&m0->m_pkthdr.tags)) {
360 goto tags_done;
361 }
362
363 /* Grab info from mtags prepended to the chain */
364 if ((tag = m_tag_locate(m0, KERNEL_MODULE_TAG_ID,
365 KERNEL_TAG_TYPE_DUMMYNET)) != NULL) {
366 struct dn_pkt_tag *dn_tag;
367
368 /*
369 * ip6_output_list() cannot handle chains of packets reinjected
370 * by dummynet. The same restriction applies to
371 * ip_output_list().
372 */
373 VERIFY(0 == packetchain);
374
375 dn_tag = (struct dn_pkt_tag *)(tag->m_tag_data);
376 args.fwa_pf_rule = dn_tag->dn_pf_rule;
377
378 bcopy(&dn_tag->dn_dst6, &dst_buf, sizeof(dst_buf));
379 dst = &dst_buf;
380 ifp = dn_tag->dn_ifp;
381 if (ifp != NULL) {
382 ifnet_reference(ifp);
383 }
384 flags = dn_tag->dn_flags;
385 if (dn_tag->dn_flags & IPV6_OUTARGS) {
386 saved_ip6oa = dn_tag->dn_ip6oa;
387 ip6oa = &saved_ip6oa;
388 }
389
390 saved_route = dn_tag->dn_ro6;
391 ro = &saved_route;
392 saved_ro_pmtu = dn_tag->dn_ro6_pmtu;
393 ro_pmtu = &saved_ro_pmtu;
394 origifp = dn_tag->dn_origifp;
395 if (origifp != NULL) {
396 ifnet_reference(origifp);
397 }
398 mtu = dn_tag->dn_mtu;
399 unfragpartlen = dn_tag->dn_unfragpartlen;
400
401 bcopy(&dn_tag->dn_exthdrs, &exthdrs, sizeof(exthdrs));
402
403 m_tag_delete(m0, tag);
404 }
405
406 tags_done:
407 #endif /* DUMMYNET */
408
409 m = m0;
410
411 #if IPSEC
412 if (ipsec_bypass == 0) {
413 so = ipsec_getsocket(m);
414 if (so != NULL) {
415 (void) ipsec_setsocket(m, NULL);
416 }
417 /* If packet is bound to an interface, check bound policies */
418 if ((flags & IPV6_OUTARGS) &&
419 (ip6oa->ip6oa_flags & IP6OAF_BOUND_IF) &&
420 ip6oa->ip6oa_boundif != IFSCOPE_NONE) {
421 /* ip6obf.noipsec is a bitfield, use temp integer */
422 int noipsec = 0;
423
424 if (ipsec6_getpolicybyinterface(m, IPSEC_DIR_OUTBOUND,
425 flags, ip6oa, &noipsec, &sp) != 0) {
426 goto bad;
427 }
428
429 ip6obf.noipsec = (noipsec != 0);
430 }
431 }
432 #endif /* IPSEC */
433
434 ippo = &ipf_pktopts;
435
436 if (flags & IPV6_OUTARGS) {
437 /*
438 * In the forwarding case, only the ifscope value is used,
439 * as source interface selection doesn't take place.
440 */
441 if ((ip6obf.select_srcif = (!(flags & (IPV6_FORWARDING |
442 IPV6_UNSPECSRC | IPV6_FLAG_NOSRCIFSEL)) &&
443 (ip6oa->ip6oa_flags & IP6OAF_SELECT_SRCIF)))) {
444 ipf_pktopts.ippo_flags |= IPPOF_SELECT_SRCIF;
445 }
446
447 if ((ip6oa->ip6oa_flags & IP6OAF_BOUND_IF) &&
448 ip6oa->ip6oa_boundif != IFSCOPE_NONE) {
449 ipf_pktopts.ippo_flags |= (IPPOF_BOUND_IF |
450 (ip6oa->ip6oa_boundif << IPPOF_SHIFT_IFSCOPE));
451 }
452
453 if (ip6oa->ip6oa_flags & IP6OAF_BOUND_SRCADDR) {
454 ipf_pktopts.ippo_flags |= IPPOF_BOUND_SRCADDR;
455 }
456 } else {
457 ip6obf.select_srcif = FALSE;
458 if (flags & IPV6_OUTARGS) {
459 ip6oa->ip6oa_boundif = IFSCOPE_NONE;
460 ip6oa->ip6oa_flags &= ~(IP6OAF_SELECT_SRCIF |
461 IP6OAF_BOUND_IF | IP6OAF_BOUND_SRCADDR);
462 }
463 }
464
465 if (flags & IPV6_OUTARGS) {
466 if (ip6oa->ip6oa_flags & IP6OAF_NO_CELLULAR) {
467 ipf_pktopts.ippo_flags |= IPPOF_NO_IFT_CELLULAR;
468 }
469 if (ip6oa->ip6oa_flags & IP6OAF_NO_EXPENSIVE) {
470 ipf_pktopts.ippo_flags |= IPPOF_NO_IFF_EXPENSIVE;
471 }
472 if (ip6oa->ip6oa_flags & IP6OAF_NO_CONSTRAINED) {
473 ipf_pktopts.ippo_flags |= IPPOF_NO_IFF_CONSTRAINED;
474 }
475 adv = &ip6oa->ip6oa_flowadv;
476 adv->code = FADV_SUCCESS;
477 ip6oa->ip6oa_flags &= ~IP6OAF_RET_MASK;
478 }
479
480 /*
481 * Clear out ifpp to be filled in after determining route. ifpp_save is
482 * used to keep old value to release reference properly and dtrace
483 * ipsec tunnel traffic properly.
484 */
485 if (ifpp != NULL && *ifpp != NULL) {
486 *ifpp = NULL;
487 }
488
489 #if DUMMYNET
490 if (args.fwa_pf_rule) {
491 ip6 = mtod(m, struct ip6_hdr *);
492 VERIFY(ro != NULL); /* ro == saved_route */
493 goto check_with_pf;
494 }
495 #endif /* DUMMYNET */
496
497 #if NECP
498 /*
499 * Since all packets are assumed to come from same socket, necp lookup
500 * only needs to happen once per function entry.
501 */
502 necp_matched_policy_id = necp_ip6_output_find_policy_match(m, flags,
503 (flags & IPV6_OUTARGS) ? ip6oa : NULL, ro ? ro->ro_rt : NULL, &necp_result,
504 &necp_result_parameter);
505 #endif /* NECP */
506
507 /*
508 * If a chain was passed in, prepare for ther first iteration. For all
509 * other iterations, this work will be done at evaluateloop: label.
510 */
511 if (packetchain) {
512 /*
513 * Remove m from the chain during processing to avoid
514 * accidental frees on entire list.
515 */
516 inputchain = m->m_nextpkt;
517 m->m_nextpkt = NULL;
518 }
519
520 loopit:
521 packets_processed++;
522 m->m_pkthdr.pkt_flags &= ~(PKTF_LOOP | PKTF_IFAINFO);
523 ip6 = mtod(m, struct ip6_hdr *);
524 nxt0 = ip6->ip6_nxt;
525 finaldst = ip6->ip6_dst;
526 ip6obf.hdrsplit = FALSE;
527 ro_pmtu = NULL;
528
529 if (!SLIST_EMPTY(&m->m_pkthdr.tags)) {
530 inject_filter_ref = ipf_get_inject_filter(m);
531 } else {
532 inject_filter_ref = NULL;
533 }
534
535 #define MAKE_EXTHDR(hp, mp) do { \
536 if (hp != NULL) { \
537 struct ip6_ext *eh = (struct ip6_ext *)(hp); \
538 error = ip6_copyexthdr((mp), (caddr_t)(hp), \
539 ((eh)->ip6e_len + 1) << 3); \
540 if (error) \
541 goto freehdrs; \
542 } \
543 } while (0)
544
545 if (opt != NULL) {
546 /* Hop-by-Hop options header */
547 MAKE_EXTHDR(opt->ip6po_hbh, &exthdrs.ip6e_hbh);
548 /* Destination options header(1st part) */
549 if (opt->ip6po_rthdr) {
550 /*
551 * Destination options header(1st part)
552 * This only makes sense with a routing header.
553 * See Section 9.2 of RFC 3542.
554 * Disabling this part just for MIP6 convenience is
555 * a bad idea. We need to think carefully about a
556 * way to make the advanced API coexist with MIP6
557 * options, which might automatically be inserted in
558 * the kernel.
559 */
560 MAKE_EXTHDR(opt->ip6po_dest1, &exthdrs.ip6e_dest1);
561 }
562 /* Routing header */
563 MAKE_EXTHDR(opt->ip6po_rthdr, &exthdrs.ip6e_rthdr);
564 /* Destination options header(2nd part) */
565 MAKE_EXTHDR(opt->ip6po_dest2, &exthdrs.ip6e_dest2);
566 }
567
568 #undef MAKE_EXTHDR
569
570 #if NECP
571 if (necp_matched_policy_id) {
572 necp_mark_packet_from_ip(m, necp_matched_policy_id);
573
574 switch (necp_result) {
575 case NECP_KERNEL_POLICY_RESULT_PASS:
576 if (necp_result_parameter.pass_flags & NECP_KERNEL_POLICY_PASS_NO_SKIP_IPSEC) {
577 break;
578 }
579 goto skip_ipsec;
580 case NECP_KERNEL_POLICY_RESULT_DROP:
581 error = EHOSTUNREACH;
582 ip6stat.ip6s_necp_policy_drop++;
583 goto freehdrs;
584 case NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT:
585 /*
586 * Flow divert packets should be blocked at the IP
587 * layer.
588 */
589 error = EHOSTUNREACH;
590 ip6stat.ip6s_necp_policy_drop++;
591 goto freehdrs;
592 case NECP_KERNEL_POLICY_RESULT_IP_TUNNEL: {
593 /*
594 * Verify that the packet is being routed to the tunnel
595 */
596 struct ifnet *policy_ifp =
597 necp_get_ifnet_from_result_parameter(
598 &necp_result_parameter);
599
600 /*
601 * Update the QOS marking policy if
602 * 1. upper layer asks it to do so
603 * 2. net_qos_policy_restricted is not set
604 * 3. qos_marking_gencount doesn't match necp_kernel_socket_policies_gencount (checked in necp_lookup_current_qos_marking)
605 */
606 if (ip6oa != NULL && (ip6oa->ip6oa_flags & IP6OAF_REDO_QOSMARKING_POLICY) &&
607 net_qos_policy_restricted != 0) {
608 bool qos_marking = (ip6oa->ip6oa_flags & IP6OAF_QOSMARKING_ALLOWED) != 0;
609 qos_marking = necp_lookup_current_qos_marking(&ip6oa->qos_marking_gencount, NULL, policy_ifp, necp_result_parameter.route_rule_id, qos_marking);
610 if (qos_marking) {
611 ip6oa->ip6oa_flags |= IP6OAF_QOSMARKING_ALLOWED;
612 } else {
613 ip6oa->ip6oa_flags &= ~IP6OAF_QOSMARKING_ALLOWED;
614 }
615 }
616
617 if (policy_ifp == ifp) {
618 goto skip_ipsec;
619 } else {
620 if (necp_packet_can_rebind_to_ifnet(m,
621 policy_ifp, (struct route *)&necp_route,
622 AF_INET6)) {
623 /*
624 * Set scoped index to the tunnel
625 * interface, since it is compatible
626 * with the packet. This will only work
627 * for callers who pass IPV6_OUTARGS,
628 * but that covers all of the clients
629 * we care about today.
630 */
631 if (flags & IPV6_OUTARGS) {
632 ip6oa->ip6oa_boundif =
633 policy_ifp->if_index;
634 ip6oa->ip6oa_flags |=
635 IP6OAF_BOUND_IF;
636 }
637 if (opt != NULL
638 && opt->ip6po_pktinfo != NULL) {
639 opt->ip6po_pktinfo->
640 ipi6_ifindex =
641 policy_ifp->if_index;
642 }
643 ro = &necp_route;
644 goto skip_ipsec;
645 } else {
646 error = ENETUNREACH;
647 ip6stat.ip6s_necp_policy_drop++;
648 goto freehdrs;
649 }
650 }
651 }
652 default:
653 break;
654 }
655 }
656 #endif /* NECP */
657
658 #if IPSEC
659 if (ipsec_bypass != 0 || ip6obf.noipsec) {
660 goto skip_ipsec;
661 }
662
663 if (sp == NULL) {
664 /* get a security policy for this packet */
665 if (so != NULL) {
666 sp = ipsec6_getpolicybysock(m, IPSEC_DIR_OUTBOUND,
667 so, &error);
668 } else {
669 sp = ipsec6_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND,
670 0, &error);
671 }
672 if (sp == NULL) {
673 IPSEC_STAT_INCREMENT(ipsec6stat.out_inval);
674 goto freehdrs;
675 }
676 }
677
678 error = 0;
679
680 /* check policy */
681 switch (sp->policy) {
682 case IPSEC_POLICY_DISCARD:
683 case IPSEC_POLICY_GENERATE:
684 /*
685 * This packet is just discarded.
686 */
687 IPSEC_STAT_INCREMENT(ipsec6stat.out_polvio);
688 goto freehdrs;
689
690 case IPSEC_POLICY_BYPASS:
691 case IPSEC_POLICY_NONE:
692 /* no need to do IPsec. */
693 ip6obf.needipsec = FALSE;
694 break;
695
696 case IPSEC_POLICY_IPSEC:
697 if (sp->req == NULL) {
698 /* acquire a policy */
699 error = key_spdacquire(sp);
700 goto freehdrs;
701 }
702 if (sp->ipsec_if) {
703 goto skip_ipsec;
704 } else {
705 ip6obf.needipsec = true;
706 }
707 break;
708
709 case IPSEC_POLICY_ENTRUST:
710 default:
711 printf("%s: Invalid policy found: %d\n", __func__, sp->policy);
712 break;
713 }
714 skip_ipsec:
715 #endif /* IPSEC */
716
717 /*
718 * Calculate the total length of the extension header chain.
719 * Keep the length of the unfragmentable part for fragmentation.
720 */
721 optlen = 0;
722 if (exthdrs.ip6e_hbh != NULL) {
723 optlen += exthdrs.ip6e_hbh->m_len;
724 }
725 if (exthdrs.ip6e_dest1 != NULL) {
726 optlen += exthdrs.ip6e_dest1->m_len;
727 }
728 if (exthdrs.ip6e_rthdr != NULL) {
729 optlen += exthdrs.ip6e_rthdr->m_len;
730 }
731 unfragpartlen = optlen + sizeof(struct ip6_hdr);
732
733 /* NOTE: we don't add AH/ESP length here. do that later. */
734 if (exthdrs.ip6e_dest2 != NULL) {
735 optlen += exthdrs.ip6e_dest2->m_len;
736 }
737
738 /*
739 * If we need IPsec, or there is at least one extension header,
740 * separate IP6 header from the payload.
741 */
742 if ((
743 #if IPSEC
744 ip6obf.needipsec ||
745 #endif /* IPSEC */
746 optlen) && !ip6obf.hdrsplit) {
747 if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
748 m = NULL;
749 goto freehdrs;
750 }
751 m = exthdrs.ip6e_ip6;
752 ip6obf.hdrsplit = true;
753 }
754
755 /* adjust pointer */
756 ip6 = mtod(m, struct ip6_hdr *);
757
758 /* adjust mbuf packet header length */
759 m->m_pkthdr.len += optlen;
760 plen = m->m_pkthdr.len - sizeof(*ip6);
761
762 /* If this is a jumbo payload, insert a jumbo payload option. */
763 if (plen > IPV6_MAXPACKET) {
764 if (!ip6obf.hdrsplit) {
765 if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
766 m = NULL;
767 goto freehdrs;
768 }
769 m = exthdrs.ip6e_ip6;
770 ip6obf.hdrsplit = true;
771 }
772 /* adjust pointer */
773 ip6 = mtod(m, struct ip6_hdr *);
774 if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0) {
775 goto freehdrs;
776 }
777 ip6->ip6_plen = 0;
778 } else {
779 ip6->ip6_plen = htons((uint16_t)plen);
780 }
781 /*
782 * Concatenate headers and fill in next header fields.
783 * Here we have, on "m"
784 * IPv6 payload
785 * and we insert headers accordingly. Finally, we should be getting:
786 * IPv6 hbh dest1 rthdr ah* [esp* dest2 payload]
787 *
788 * during the header composing process, "m" points to IPv6 header.
789 * "mprev" points to an extension header prior to esp.
790 */
791 nexthdrp = &ip6->ip6_nxt;
792 mprev = m;
793
794 /*
795 * we treat dest2 specially. this makes IPsec processing
796 * much easier. the goal here is to make mprev point the
797 * mbuf prior to dest2.
798 *
799 * result: IPv6 dest2 payload
800 * m and mprev will point to IPv6 header.
801 */
802 if (exthdrs.ip6e_dest2 != NULL) {
803 if (!ip6obf.hdrsplit) {
804 panic("assumption failed: hdr not split");
805 /* NOTREACHED */
806 }
807 exthdrs.ip6e_dest2->m_next = m->m_next;
808 m->m_next = exthdrs.ip6e_dest2;
809 *mtod(exthdrs.ip6e_dest2, u_char *) = ip6->ip6_nxt;
810 ip6->ip6_nxt = IPPROTO_DSTOPTS;
811 }
812
813 #define MAKE_CHAIN(m, mp, p, i) do { \
814 if (m != NULL) { \
815 if (!ip6obf.hdrsplit) { \
816 panic("assumption failed: hdr not split"); \
817 /* NOTREACHED */ \
818 } \
819 *mtod((m), u_char *) = *(p); \
820 *(p) = (i); \
821 p = mtod((m), u_char *); \
822 (m)->m_next = (mp)->m_next; \
823 (mp)->m_next = (m); \
824 (mp) = (m); \
825 } \
826 } while (0)
827 /*
828 * result: IPv6 hbh dest1 rthdr dest2 payload
829 * m will point to IPv6 header. mprev will point to the
830 * extension header prior to dest2 (rthdr in the above case).
831 */
832 MAKE_CHAIN(exthdrs.ip6e_hbh, mprev, nexthdrp, IPPROTO_HOPOPTS);
833 MAKE_CHAIN(exthdrs.ip6e_dest1, mprev, nexthdrp, IPPROTO_DSTOPTS);
834 MAKE_CHAIN(exthdrs.ip6e_rthdr, mprev, nexthdrp, IPPROTO_ROUTING);
835
836 /* It is no longer safe to free the pointers in exthdrs. */
837 exthdrs.merged = TRUE;
838
839 #undef MAKE_CHAIN
840
841 #if IPSEC
842 if (ip6obf.needipsec && (m->m_pkthdr.csum_flags & CSUM_DELAY_IPV6_DATA)) {
843 in6_delayed_cksum_offset(m, 0, optlen, nxt0);
844 }
845 #endif /* IPSEC */
846
847 if (!TAILQ_EMPTY(&ipv6_filters) &&
848 !((flags & IPV6_OUTARGS) &&
849 (ip6oa->ip6oa_flags & IP6OAF_INTCOPROC_ALLOWED) &&
850 (ip6oa->ip6oa_flags & IP6OAF_MANAGEMENT_ALLOWED)
851 #if NECP
852 && !necp_packet_should_skip_filters(m)
853 #endif // NECP
854 )) {
855 struct ipfilter *filter;
856 int seen = (inject_filter_ref == NULL);
857 int fixscope = 0;
858
859 if (im6o != NULL && IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
860 ippo->ippo_flags |= IPPOF_MCAST_OPTS;
861 IM6O_LOCK(im6o);
862 ippo->ippo_mcast_ifnet = im6o->im6o_multicast_ifp;
863 ippo->ippo_mcast_ttl = im6o->im6o_multicast_hlim;
864 ippo->ippo_mcast_loop = im6o->im6o_multicast_loop;
865 IM6O_UNLOCK(im6o);
866 }
867
868 /* Hack: embed the scope_id in the destination */
869 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst) &&
870 (ip6->ip6_dst.s6_addr16[1] == 0) && (ro != NULL)) {
871 fixscope = 1;
872 ip6->ip6_dst.s6_addr16[1] =
873 htons((uint16_t)ro->ro_dst.sin6_scope_id);
874 }
875
876 ipf_ref();
877 TAILQ_FOREACH(filter, &ipv6_filters, ipf_link) {
878 /*
879 * Don't process packet twice if we've already seen it.
880 */
881 if (seen == 0) {
882 if ((struct ipfilter *)inject_filter_ref ==
883 filter) {
884 seen = 1;
885 }
886 } else if (filter->ipf_filter.ipf_output != NULL) {
887 errno_t result;
888
889 result = filter->ipf_filter.ipf_output(
890 filter->ipf_filter.cookie,
891 (mbuf_t *)&m, ippo);
892 if (result == EJUSTRETURN) {
893 ipf_unref();
894 m = NULL;
895 goto evaluateloop;
896 }
897 if (result != 0) {
898 ipf_unref();
899 goto bad;
900 }
901 }
902 }
903 ipf_unref();
904
905 ip6 = mtod(m, struct ip6_hdr *);
906 /* Hack: cleanup embedded scope_id if we put it there */
907 if (fixscope) {
908 ip6->ip6_dst.s6_addr16[1] = 0;
909 }
910 }
911
912 #if IPSEC
913 if (ip6obf.needipsec) {
914 uint8_t segleft_org;
915
916 /*
917 * pointers after IPsec headers are not valid any more.
918 * other pointers need a great care too.
919 * (IPsec routines should not mangle mbufs prior to AH/ESP)
920 */
921 exthdrs.ip6e_dest2 = NULL;
922
923 if (exthdrs.ip6e_rthdr != NULL) {
924 rh = mtod(exthdrs.ip6e_rthdr, struct ip6_rthdr *);
925 segleft_org = rh->ip6r_segleft;
926 rh->ip6r_segleft = 0;
927 } else {
928 rh = NULL;
929 segleft_org = 0;
930 }
931
932 ipsec_state.m = m;
933 error = ipsec6_output_trans(&ipsec_state, nexthdrp, mprev,
934 sp, flags, &needipsectun);
935 m = ipsec_state.m;
936 if (error) {
937 /* mbuf is already reclaimed in ipsec6_output_trans. */
938 m = NULL;
939 switch (error) {
940 case EHOSTUNREACH:
941 case ENETUNREACH:
942 case EMSGSIZE:
943 case ENOBUFS:
944 case ENOMEM:
945 break;
946 default:
947 printf("ip6_output (ipsec): error code %d\n",
948 error);
949 OS_FALLTHROUGH;
950 case ENOENT:
951 /* don't show these error codes to the user */
952 error = 0;
953 break;
954 }
955 goto bad;
956 }
957 if (exthdrs.ip6e_rthdr != NULL) {
958 /* ah6_output doesn't modify mbuf chain */
959 rh->ip6r_segleft = segleft_org;
960 }
961 }
962 #endif /* IPSEC */
963
964 /* If there is a routing header, discard the packet. */
965 if (exthdrs.ip6e_rthdr != NULL) {
966 error = EINVAL;
967 goto bad;
968 }
969
970 /* Source address validation */
971 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) &&
972 !(flags & IPV6_UNSPECSRC)) {
973 error = EOPNOTSUPP;
974 ip6stat.ip6s_badscope++;
975 goto bad;
976 }
977 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) {
978 error = EOPNOTSUPP;
979 ip6stat.ip6s_badscope++;
980 goto bad;
981 }
982
983 ip6stat.ip6s_localout++;
984
985 /*
986 * Route packet.
987 */
988 if (ro == NULL) {
989 ro = &ip6route;
990 bzero((caddr_t)ro, sizeof(*ro));
991 }
992 ro_pmtu = ro;
993 if (opt != NULL && opt->ip6po_rthdr) {
994 ro = &opt->ip6po_route;
995 }
996 dst = SIN6(&ro->ro_dst);
997
998 if (ro->ro_rt != NULL) {
999 RT_LOCK_ASSERT_NOTHELD(ro->ro_rt);
1000 }
1001 /*
1002 * if specified, try to fill in the traffic class field.
1003 * do not override if a non-zero value is already set.
1004 * we check the diffserv field and the ecn field separately.
1005 */
1006 if (opt != NULL && opt->ip6po_tclass >= 0) {
1007 int mask = 0;
1008
1009 if ((ip6->ip6_flow & htonl(0xfc << 20)) == 0) {
1010 mask |= 0xfc;
1011 }
1012 if ((ip6->ip6_flow & htonl(0x03 << 20)) == 0) {
1013 mask |= 0x03;
1014 }
1015 if (mask != 0) {
1016 ip6->ip6_flow |=
1017 htonl((opt->ip6po_tclass & mask) << 20);
1018 }
1019 }
1020
1021 if (((ntohl(ip6->ip6_flow & IPV6_FLOW_ECN_MASK) >> 20) & IPTOS_ECN_ECT1) == IPTOS_ECN_ECT1) {
1022 m->m_pkthdr.pkt_ext_flags |= PKTF_EXT_L4S;
1023 }
1024
1025 /* fill in or override the hop limit field, if necessary. */
1026 if (opt && opt->ip6po_hlim != -1) {
1027 ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
1028 } else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
1029 if (im6o != NULL) {
1030 IM6O_LOCK(im6o);
1031 ip6->ip6_hlim = im6o->im6o_multicast_hlim;
1032 IM6O_UNLOCK(im6o);
1033 } else {
1034 ip6->ip6_hlim = (uint8_t)ip6_defmcasthlim;
1035 }
1036 }
1037
1038 /*
1039 * If there is a cached route, check that it is to the same
1040 * destination and is still up. If not, free it and try again.
1041 * Test rt_flags without holding rt_lock for performance reasons;
1042 * if the route is down it will hopefully be caught by the layer
1043 * below (since it uses this route as a hint) or during the
1044 * next transmit.
1045 */
1046 if (ROUTE_UNUSABLE(ro) || dst->sin6_family != AF_INET6 ||
1047 !in6_are_addr_equal_scoped(&dst->sin6_addr, &ip6->ip6_dst, dst->sin6_scope_id, ip6_output_getdstifscope(m))) {
1048 ROUTE_RELEASE(ro);
1049 }
1050
1051 if (ro->ro_rt == NULL) {
1052 bzero(dst, sizeof(*dst));
1053 dst->sin6_family = AF_INET6;
1054 dst->sin6_len = sizeof(struct sockaddr_in6);
1055 dst->sin6_addr = ip6->ip6_dst;
1056 }
1057 #if IPSEC
1058 if (ip6obf.needipsec && needipsectun) {
1059 #if CONFIG_DTRACE
1060 struct ifnet *trace_ifp = (ifpp_save != NULL) ? (*ifpp_save) : NULL;
1061 #endif /* CONFIG_DTRACE */
1062 /*
1063 * All the extension headers will become inaccessible
1064 * (since they can be encrypted).
1065 * Don't panic, we need no more updates to extension headers
1066 * on inner IPv6 packet (since they are now encapsulated).
1067 *
1068 * IPv6 [ESP|AH] IPv6 [extension headers] payload
1069 */
1070 bzero(&exthdrs, sizeof(exthdrs));
1071 exthdrs.ip6e_ip6 = m;
1072
1073 ipsec_state.m = m;
1074 route_copyout((struct route *)&ipsec_state.ro, (struct route *)ro,
1075 sizeof(struct route_in6));
1076 ipsec_state.dst = SA(dst);
1077
1078 /* So that we can see packets inside the tunnel */
1079 DTRACE_IP6(send, struct mbuf *, m, struct inpcb *, NULL,
1080 struct ip6_hdr *, ip6, struct ifnet *, trace_ifp,
1081 struct ip *, NULL, struct ip6_hdr *, ip6);
1082
1083 error = ipsec6_output_tunnel(&ipsec_state, sp, flags);
1084 /* tunneled in IPv4? packet is gone */
1085 if (ipsec_state.tunneled == 4) {
1086 m = NULL;
1087 goto evaluateloop;
1088 }
1089 m = ipsec_state.m;
1090 ipsec_saved_route = ro;
1091 ro = (struct route_in6 *)&ipsec_state.ro;
1092 dst = SIN6(ipsec_state.dst);
1093 if (error) {
1094 /* mbuf is already reclaimed in ipsec6_output_tunnel. */
1095 m = NULL;
1096 switch (error) {
1097 case EHOSTUNREACH:
1098 case ENETUNREACH:
1099 case EMSGSIZE:
1100 case ENOBUFS:
1101 case ENOMEM:
1102 break;
1103 default:
1104 printf("ip6_output (ipsec): error code %d\n",
1105 error);
1106 OS_FALLTHROUGH;
1107 case ENOENT:
1108 /* don't show these error codes to the user */
1109 error = 0;
1110 break;
1111 }
1112 goto bad;
1113 }
1114 /*
1115 * The packet has been encapsulated so the ifscope
1116 * is no longer valid since it does not apply to the
1117 * outer address: ignore the ifscope.
1118 */
1119 if (flags & IPV6_OUTARGS) {
1120 ip6oa->ip6oa_boundif = IFSCOPE_NONE;
1121 ip6oa->ip6oa_flags &= ~IP6OAF_BOUND_IF;
1122 }
1123 if (opt != NULL && opt->ip6po_pktinfo != NULL) {
1124 if (opt->ip6po_pktinfo->ipi6_ifindex != IFSCOPE_NONE) {
1125 opt->ip6po_pktinfo->ipi6_ifindex = IFSCOPE_NONE;
1126 }
1127 }
1128 exthdrs.ip6e_ip6 = m;
1129 }
1130 #endif /* IPSEC */
1131
1132 /*
1133 * ifp should only be filled in for dummy net packets which will jump
1134 * to check_with_pf label.
1135 */
1136 if (ifp != NULL) {
1137 VERIFY(ip6obf.route_selected);
1138 }
1139
1140 /* adjust pointer */
1141 ip6 = mtod(m, struct ip6_hdr *);
1142
1143 if (ip6obf.select_srcif) {
1144 bzero(&src_sa, sizeof(src_sa));
1145 src_sa.sin6_family = AF_INET6;
1146 src_sa.sin6_len = sizeof(src_sa);
1147 src_sa.sin6_addr = ip6->ip6_src;
1148 src_sa.sin6_scope_id = (!in6_embedded_scope && IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) ? ip6_output_getsrcifscope(m) : IFSCOPE_NONE;
1149 }
1150 bzero(&dst_sa, sizeof(dst_sa));
1151 dst_sa.sin6_family = AF_INET6;
1152 dst_sa.sin6_len = sizeof(dst_sa);
1153 dst_sa.sin6_addr = ip6->ip6_dst;
1154 dst_sa.sin6_scope_id = (!in6_embedded_scope && IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) ? ip6_output_getdstifscope(m) : IFSCOPE_NONE;
1155
1156 /*
1157 * Only call in6_selectroute() on first iteration to avoid taking
1158 * multiple references on ifp and rt.
1159 *
1160 * in6_selectroute() might return an ifp with its reference held
1161 * even in the error case, so make sure to release its reference.
1162 * ip6oa may be NULL if IPV6_OUTARGS isn't set.
1163 */
1164 if (!ip6obf.route_selected) {
1165 error = in6_selectroute( ip6obf.select_srcif ? &src_sa : NULL,
1166 &dst_sa, opt, im6o, &src_ia, ro, &ifp, &rt, 0, ip6oa);
1167
1168 if (error != 0) {
1169 switch (error) {
1170 case EHOSTUNREACH:
1171 ip6stat.ip6s_noroute++;
1172 break;
1173 case EADDRNOTAVAIL:
1174 default:
1175 break; /* XXX statistics? */
1176 }
1177 if (ifp != NULL) {
1178 in6_ifstat_inc(ifp, ifs6_out_discard);
1179 }
1180 /* ifp (if non-NULL) will be released at the end */
1181 goto bad;
1182 }
1183 ip6obf.route_selected = true;
1184 }
1185 if (rt == NULL) {
1186 /*
1187 * If in6_selectroute() does not return a route entry,
1188 * dst may not have been updated.
1189 */
1190 *dst = dst_sa; /* XXX */
1191 }
1192
1193 #if NECP
1194 /* Catch-all to check if the interface is allowed */
1195 if (!necp_packet_is_allowed_over_interface(m, ifp)) {
1196 error = EHOSTUNREACH;
1197 ip6stat.ip6s_necp_policy_drop++;
1198 goto bad;
1199 }
1200 #endif /* NECP */
1201
1202 /*
1203 * then rt (for unicast) and ifp must be non-NULL valid values.
1204 */
1205 if (!(flags & IPV6_FORWARDING)) {
1206 in6_ifstat_inc_na(ifp, ifs6_out_request);
1207 }
1208 if (rt != NULL) {
1209 RT_LOCK(rt);
1210 if (ia == NULL) {
1211 ia = (struct in6_ifaddr *)(rt->rt_ifa);
1212 if (ia != NULL) {
1213 IFA_ADDREF(&ia->ia_ifa);
1214 }
1215 }
1216 rt->rt_use++;
1217 RT_UNLOCK(rt);
1218 }
1219
1220 /*
1221 * The outgoing interface must be in the zone of source and
1222 * destination addresses (except local/loopback). We should
1223 * use ia_ifp to support the case of sending packets to an
1224 * address of our own.
1225 */
1226 if (ia != NULL && ia->ia_ifp) {
1227 ifnet_reference(ia->ia_ifp); /* for origifp */
1228 if (origifp != NULL) {
1229 ifnet_release(origifp);
1230 }
1231 origifp = ia->ia_ifp;
1232 } else {
1233 if (ifp != NULL) {
1234 ifnet_reference(ifp); /* for origifp */
1235 }
1236 if (origifp != NULL) {
1237 ifnet_release(origifp);
1238 }
1239 origifp = ifp;
1240 }
1241
1242 /* skip scope enforcements for local/loopback route */
1243 if (rt == NULL || !(rt->rt_ifp->if_flags & IFF_LOOPBACK)) {
1244 struct in6_addr src0, dst0;
1245 u_int32_t zone;
1246
1247 src0 = ip6->ip6_src;
1248 if (in6_setscope(&src0, origifp, &zone)) {
1249 goto badscope;
1250 }
1251 bzero(&src_sa, sizeof(src_sa));
1252 src_sa.sin6_family = AF_INET6;
1253 src_sa.sin6_len = sizeof(src_sa);
1254 src_sa.sin6_addr = ip6->ip6_src;
1255 src_sa.sin6_scope_id = (!in6_embedded_scope && IN6_IS_SCOPE_EMBED(&src_sa.sin6_addr)) ? ip6_output_getsrcifscope(m) : IFSCOPE_NONE;
1256 if ((sa6_recoverscope(&src_sa, TRUE) ||
1257 zone != src_sa.sin6_scope_id)) {
1258 goto badscope;
1259 }
1260
1261 dst0 = ip6->ip6_dst;
1262 if ((in6_setscope(&dst0, origifp, &zone))) {
1263 goto badscope;
1264 }
1265 /* re-initialize to be sure */
1266 bzero(&dst_sa, sizeof(dst_sa));
1267 dst_sa.sin6_family = AF_INET6;
1268 dst_sa.sin6_len = sizeof(dst_sa);
1269 dst_sa.sin6_addr = ip6->ip6_dst;
1270 dst_sa.sin6_scope_id = (!in6_embedded_scope && IN6_IS_SCOPE_EMBED(&dst_sa.sin6_addr)) ? ip6_output_getdstifscope(m) : IFSCOPE_NONE;
1271 if ((sa6_recoverscope(&dst_sa, TRUE) ||
1272 zone != dst_sa.sin6_scope_id)) {
1273 goto badscope;
1274 }
1275
1276 /* scope check is done. */
1277 goto routefound;
1278
1279 badscope:
1280 ip6stat.ip6s_badscope++;
1281 in6_ifstat_inc(origifp, ifs6_out_discard);
1282 if (error == 0) {
1283 error = EHOSTUNREACH; /* XXX */
1284 }
1285 goto bad;
1286 }
1287
1288 routefound:
1289 if (rt != NULL && !IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
1290 if (opt != NULL && opt->ip6po_nextroute.ro_rt) {
1291 /*
1292 * The nexthop is explicitly specified by the
1293 * application. We assume the next hop is an IPv6
1294 * address.
1295 */
1296 dst = SIN6(opt->ip6po_nexthop);
1297 } else if ((rt->rt_flags & RTF_GATEWAY)) {
1298 dst = SIN6(rt->rt_gateway);
1299 }
1300 /*
1301 * For packets destined to local/loopback, record the
1302 * source the source interface (which owns the source
1303 * address), as well as the output interface. This is
1304 * needed to reconstruct the embedded zone for the
1305 * link-local address case in ip6_input().
1306 */
1307 if (ia != NULL && (ifp->if_flags & IFF_LOOPBACK)) {
1308 uint32_t srcidx;
1309
1310 if (src_ia != NULL) {
1311 srcidx = src_ia->ia_ifp->if_index;
1312 } else if (ro->ro_srcia != NULL) {
1313 srcidx = ro->ro_srcia->ifa_ifp->if_index;
1314 } else {
1315 srcidx = 0;
1316 }
1317
1318 ip6_setsrcifaddr_info(m, srcidx, NULL);
1319 ip6_setdstifaddr_info(m, 0, ia);
1320 }
1321 }
1322
1323 if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
1324 m->m_flags &= ~(M_BCAST | M_MCAST); /* just in case */
1325 } else {
1326 struct in6_multi *in6m;
1327
1328 m->m_flags = (m->m_flags & ~M_BCAST) | M_MCAST;
1329 in6_ifstat_inc_na(ifp, ifs6_out_mcast);
1330
1331 /*
1332 * Confirm that the outgoing interface supports multicast.
1333 */
1334 if (!(ifp->if_flags & IFF_MULTICAST)) {
1335 ip6stat.ip6s_noroute++;
1336 in6_ifstat_inc(ifp, ifs6_out_discard);
1337 error = ENETUNREACH;
1338 goto bad;
1339 }
1340 in6_multihead_lock_shared();
1341 IN6_LOOKUP_MULTI(&ip6->ip6_dst, ifp, in6m);
1342 in6_multihead_lock_done();
1343 if (im6o != NULL) {
1344 IM6O_LOCK(im6o);
1345 }
1346 if (in6m != NULL &&
1347 (im6o == NULL || im6o->im6o_multicast_loop)) {
1348 if (im6o != NULL) {
1349 IM6O_UNLOCK(im6o);
1350 }
1351 /*
1352 * If we belong to the destination multicast group
1353 * on the outgoing interface, and the caller did not
1354 * forbid loopback, loop back a copy.
1355 */
1356 ip6_mloopback(NULL, ifp, m, dst, optlen, nxt0);
1357 } else if (im6o != NULL) {
1358 IM6O_UNLOCK(im6o);
1359 }
1360 if (in6m != NULL) {
1361 IN6M_REMREF(in6m);
1362 }
1363 /*
1364 * Multicasts with a hoplimit of zero may be looped back,
1365 * above, but must not be transmitted on a network.
1366 * Also, multicasts addressed to the loopback interface
1367 * are not sent -- the above call to ip6_mloopback() will
1368 * loop back a copy if this host actually belongs to the
1369 * destination group on the loopback interface.
1370 */
1371 if (ip6->ip6_hlim == 0 || (ifp->if_flags & IFF_LOOPBACK) ||
1372 IN6_IS_ADDR_MC_INTFACELOCAL(&ip6->ip6_dst)) {
1373 /* remove m from the packetchain and continue looping */
1374 if (m != NULL) {
1375 m_freem(m);
1376 }
1377 m = NULL;
1378 goto evaluateloop;
1379 }
1380 }
1381
1382 /*
1383 * Fill the outgoing inteface to tell the upper layer
1384 * to increment per-interface statistics.
1385 */
1386 if (ifpp != NULL && *ifpp == NULL) {
1387 ifnet_reference(ifp); /* for caller */
1388 *ifpp = ifp;
1389 }
1390
1391 /* Determine path MTU. */
1392 if ((error = ip6_getpmtu(ro_pmtu, ro, ifp, &finaldst, ifp->if_index, &mtu)) != 0) {
1393 goto bad;
1394 }
1395
1396 /*
1397 * The caller of this function may specify to use the minimum MTU
1398 * in some cases.
1399 * An advanced API option (IPV6_USE_MIN_MTU) can also override MTU
1400 * setting. The logic is a bit complicated; by default, unicast
1401 * packets will follow path MTU while multicast packets will be sent at
1402 * the minimum MTU. If IP6PO_MINMTU_ALL is specified, all packets
1403 * including unicast ones will be sent at the minimum MTU. Multicast
1404 * packets will always be sent at the minimum MTU unless
1405 * IP6PO_MINMTU_DISABLE is explicitly specified.
1406 * See RFC 3542 for more details.
1407 */
1408 if (mtu > IPV6_MMTU) {
1409 if ((flags & IPV6_MINMTU)) {
1410 mtu = IPV6_MMTU;
1411 } else if (opt && opt->ip6po_minmtu == IP6PO_MINMTU_ALL) {
1412 mtu = IPV6_MMTU;
1413 } else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) &&
1414 (opt == NULL ||
1415 opt->ip6po_minmtu != IP6PO_MINMTU_DISABLE)) {
1416 mtu = IPV6_MMTU;
1417 }
1418 }
1419
1420 /*
1421 * clear embedded scope identifiers if necessary.
1422 * in6_clearscope will touch the addresses only when necessary.
1423 */
1424 in6_clearscope(&ip6->ip6_src);
1425 in6_clearscope(&ip6->ip6_dst);
1426 /*
1427 * If the outgoing packet contains a hop-by-hop options header,
1428 * it must be examined and processed even by the source node.
1429 * (RFC 2460, section 4.)
1430 */
1431 if (exthdrs.ip6e_hbh != NULL) {
1432 struct ip6_hbh *hbh = mtod(exthdrs.ip6e_hbh, struct ip6_hbh *);
1433 u_int32_t dummy; /* XXX unused */
1434 uint32_t oplen = 0; /* for ip6_process_hopopts() */
1435 #if DIAGNOSTIC
1436 if ((hbh->ip6h_len + 1) << 3 > exthdrs.ip6e_hbh->m_len) {
1437 panic("ip6e_hbh is not continuous");
1438 }
1439 #endif
1440 /*
1441 * XXX: If we have to send an ICMPv6 error to the sender,
1442 * we need the M_LOOP flag since icmp6_error() expects
1443 * the IPv6 and the hop-by-hop options header are
1444 * continuous unless the flag is set.
1445 */
1446 m->m_flags |= M_LOOP;
1447 m->m_pkthdr.rcvif = ifp;
1448 if (ip6_process_hopopts(m, (u_int8_t *)(hbh + 1),
1449 ((hbh->ip6h_len + 1) << 3) - sizeof(struct ip6_hbh),
1450 &dummy, &oplen) < 0) {
1451 /*
1452 * m was already freed at this point. Set to NULL so it
1453 * is not re-freed at end of ip6_output_list.
1454 */
1455 m = NULL;
1456 error = EINVAL; /* better error? */
1457 goto bad;
1458 }
1459 m->m_flags &= ~M_LOOP; /* XXX */
1460 m->m_pkthdr.rcvif = NULL;
1461 }
1462
1463 #if DUMMYNET
1464 check_with_pf:
1465 #endif /* DUMMYNET */
1466 #if PF
1467 if (PF_IS_ENABLED && !skip_pf) {
1468 #if DUMMYNET
1469
1470 /*
1471 * TODO: Need to save opt->ip6po_flags for reinjection
1472 * rdar://10434993
1473 */
1474 args.fwa_oif = ifp;
1475 args.fwa_oflags = flags;
1476 if (flags & IPV6_OUTARGS) {
1477 args.fwa_ip6oa = ip6oa;
1478 }
1479 args.fwa_ro6 = ro;
1480 args.fwa_dst6 = dst;
1481 args.fwa_ro6_pmtu = ro_pmtu;
1482 args.fwa_origifp = origifp;
1483 args.fwa_mtu = mtu;
1484 args.fwa_unfragpartlen = unfragpartlen;
1485 args.fwa_exthdrs = &exthdrs;
1486 /* Invoke outbound packet filter */
1487 error = pf_af_hook(ifp, NULL, &m, AF_INET6, FALSE, &args);
1488 #else /* !DUMMYNET */
1489 error = pf_af_hook(ifp, NULL, &m, AF_INET6, FALSE, NULL);
1490 #endif /* !DUMMYNET */
1491
1492 if (error != 0 || m == NULL) {
1493 if (m != NULL) {
1494 panic("%s: unexpected packet %p",
1495 __func__, m);
1496 /* NOTREACHED */
1497 }
1498 /* m was already freed by callee and is now NULL. */
1499 goto evaluateloop;
1500 }
1501 ip6 = mtod(m, struct ip6_hdr *);
1502 }
1503 #endif /* PF */
1504
1505 #ifdef IPSEC
1506 /* clean ipsec history before fragmentation */
1507 ipsec_delaux(m);
1508 #endif /* IPSEC */
1509
1510 if (ip6oa != NULL) {
1511 u_int8_t dscp;
1512
1513 dscp = (ntohl(ip6->ip6_flow) & IP6FLOW_DSCP_MASK) >> IP6FLOW_DSCP_SHIFT;
1514
1515 error = set_packet_qos(m, ifp,
1516 ip6oa->ip6oa_flags & IP6OAF_QOSMARKING_ALLOWED ? TRUE : FALSE,
1517 ip6oa->ip6oa_sotc, ip6oa->ip6oa_netsvctype, &dscp);
1518 if (error == 0) {
1519 ip6->ip6_flow &= ~htonl(IP6FLOW_DSCP_MASK);
1520 ip6->ip6_flow |= htonl((u_int32_t)dscp << IP6FLOW_DSCP_SHIFT);
1521 } else {
1522 printf("%s if_dscp_for_mbuf() error %d\n", __func__, error);
1523 error = 0;
1524 }
1525 }
1526 /*
1527 * Determine whether fragmentation is necessary. If so, m is passed
1528 * back as a chain of packets and original mbuf is freed. Otherwise, m
1529 * is unchanged.
1530 */
1531 error = ip6_fragment_packet(&m, opt, ip6oa,
1532 &exthdrs, ifp, mtu, unfragpartlen, nxt0,
1533 optlen);
1534
1535 if (error) {
1536 goto bad;
1537 }
1538
1539 /*
1540 * The evaluateloop label is where we decide whether to continue looping over
1541 * packets or call into nd code to send.
1542 */
1543 evaluateloop:
1544
1545 /*
1546 * m may be NULL when we jump to the evaluateloop label from PF or
1547 * other code that can drop packets.
1548 */
1549 if (m != NULL) {
1550 /*
1551 * If we already have a chain to send, tack m onto the end.
1552 * Otherwise make m the start and end of the to-be-sent chain.
1553 */
1554 if (sendchain != NULL) {
1555 sendchain_last->m_nextpkt = m;
1556 } else {
1557 sendchain = m;
1558 }
1559
1560 /* Fragmentation may mean m is a chain. Find the last packet. */
1561 while (m->m_nextpkt) {
1562 m = m->m_nextpkt;
1563 }
1564 sendchain_last = m;
1565 pktcnt++;
1566 }
1567
1568 /* Fill in next m from inputchain as appropriate. */
1569 m = inputchain;
1570 if (m != NULL) {
1571 /* Isolate m from rest of input chain. */
1572 inputchain = m->m_nextpkt;
1573 m->m_nextpkt = NULL;
1574
1575 /*
1576 * Clear exthdrs and ipsec_state so stale contents are not
1577 * reused. Note this also clears the exthdrs.merged flag.
1578 */
1579 bzero(&exthdrs, sizeof(exthdrs));
1580 bzero(&ipsec_state, sizeof(ipsec_state));
1581
1582 /* Continue looping. */
1583 goto loopit;
1584 }
1585
1586 /*
1587 * If we get here, there's no more mbufs in inputchain, so send the
1588 * sendchain if there is one.
1589 */
1590 if (pktcnt > 0) {
1591 error = nd6_output_list(ifp, origifp, sendchain, dst,
1592 ro->ro_rt, adv);
1593 /*
1594 * Fall through to done label even in error case because
1595 * nd6_output_list frees packetchain in both success and
1596 * failure cases.
1597 */
1598 }
1599
1600 done:
1601 if (ifpp_save != NULL && *ifpp_save != NULL) {
1602 ifnet_release(*ifpp_save);
1603 *ifpp_save = NULL;
1604 }
1605 ROUTE_RELEASE(&ip6route);
1606 #if IPSEC
1607 ROUTE_RELEASE(&ipsec_state.ro);
1608 if (sp != NULL) {
1609 key_freesp(sp, KEY_SADB_UNLOCKED);
1610 }
1611 #endif /* IPSEC */
1612 #if NECP
1613 ROUTE_RELEASE(&necp_route);
1614 #endif /* NECP */
1615 #if DUMMYNET
1616 ROUTE_RELEASE(&saved_route);
1617 ROUTE_RELEASE(&saved_ro_pmtu);
1618 #endif /* DUMMYNET */
1619
1620 if (ia != NULL) {
1621 IFA_REMREF(&ia->ia_ifa);
1622 }
1623 if (src_ia != NULL) {
1624 IFA_REMREF(&src_ia->ia_ifa);
1625 }
1626 if (ifp != NULL) {
1627 ifnet_release(ifp);
1628 }
1629 if (origifp != NULL) {
1630 ifnet_release(origifp);
1631 }
1632 if (ip6_output_measure) {
1633 net_perf_measure_time(&net_perf, &start_tv, packets_processed);
1634 net_perf_histogram(&net_perf, packets_processed);
1635 }
1636 return error;
1637
1638 freehdrs:
1639 if (exthdrs.ip6e_hbh != NULL) {
1640 if (exthdrs.merged) {
1641 panic("Double free of ip6e_hbh");
1642 }
1643 m_freem(exthdrs.ip6e_hbh);
1644 }
1645 if (exthdrs.ip6e_dest1 != NULL) {
1646 if (exthdrs.merged) {
1647 panic("Double free of ip6e_dest1");
1648 }
1649 m_freem(exthdrs.ip6e_dest1);
1650 }
1651 if (exthdrs.ip6e_rthdr != NULL) {
1652 if (exthdrs.merged) {
1653 panic("Double free of ip6e_rthdr");
1654 }
1655 m_freem(exthdrs.ip6e_rthdr);
1656 }
1657 if (exthdrs.ip6e_dest2 != NULL) {
1658 if (exthdrs.merged) {
1659 panic("Double free of ip6e_dest2");
1660 }
1661 m_freem(exthdrs.ip6e_dest2);
1662 }
1663 /* FALLTHRU */
1664 bad:
1665 if (inputchain != NULL) {
1666 m_freem_list(inputchain);
1667 }
1668 if (sendchain != NULL) {
1669 m_freem_list(sendchain);
1670 }
1671 if (m != NULL) {
1672 m_freem(m);
1673 }
1674
1675 goto done;
1676
1677 #undef ipf_pktopts
1678 #undef exthdrs
1679 #undef ip6route
1680 #undef ipsec_state
1681 #undef saved_route
1682 #undef saved_ro_pmtu
1683 #undef args
1684 }
1685
1686 /* ip6_fragment_packet
1687 *
1688 * The fragmentation logic is rather complex:
1689 * 1: normal case (dontfrag == 0)
1690 * 1-a: send as is if tlen <= path mtu
1691 * 1-b: fragment if tlen > path mtu
1692 *
1693 * 2: if user asks us not to fragment (dontfrag == 1)
1694 * 2-a: send as is if tlen <= interface mtu
1695 * 2-b: error if tlen > interface mtu
1696 */
1697
1698 static int
ip6_fragment_packet(struct mbuf ** mptr,struct ip6_pktopts * opt,struct ip6_out_args * ip6oa,struct ip6_exthdrs * exthdrsp,struct ifnet * ifp,uint32_t mtu,uint32_t unfragpartlen,int nxt0,uint32_t optlen)1699 ip6_fragment_packet(struct mbuf **mptr, struct ip6_pktopts *opt,
1700 struct ip6_out_args *ip6oa, struct ip6_exthdrs *exthdrsp,
1701 struct ifnet *ifp, uint32_t mtu, uint32_t unfragpartlen,
1702 int nxt0, uint32_t optlen)
1703 {
1704 VERIFY(NULL != mptr);
1705 struct mbuf *m = *mptr;
1706 int error = 0;
1707 uint32_t tlen = m->m_pkthdr.len;
1708 boolean_t dontfrag = (opt != NULL && (opt->ip6po_flags & IP6PO_DONTFRAG)) ||
1709 (ip6oa != NULL && (ip6oa->ip6oa_flags & IP6OAF_DONT_FRAG));
1710
1711 if (m->m_pkthdr.pkt_flags & PKTF_FORWARDED) {
1712 dontfrag = TRUE;
1713 /*
1714 * Discard partial sum information if this packet originated
1715 * from another interface; the packet would already have the
1716 * final checksum and we shouldn't recompute it.
1717 */
1718 if ((m->m_pkthdr.csum_flags & (CSUM_DATA_VALID | CSUM_PARTIAL)) ==
1719 (CSUM_DATA_VALID | CSUM_PARTIAL)) {
1720 m->m_pkthdr.csum_flags &= ~CSUM_TX_FLAGS;
1721 m->m_pkthdr.csum_data = 0;
1722 }
1723 }
1724
1725 /* Access without acquiring nd_ifinfo lock for performance */
1726 if (dontfrag && tlen > IN6_LINKMTU(ifp)) { /* case 2-b */
1727 /*
1728 * We do not notify the connection in the same outbound path
1729 * to avoid lock ordering issues.
1730 * The returned error should imply that the packet is too big
1731 * and the application should query the PMTU for a given destination.
1732 */
1733 return EMSGSIZE;
1734 }
1735
1736 /*
1737 * transmit packet without fragmentation
1738 */
1739 if (dontfrag ||
1740 (tlen <= mtu || TSO_IPV6_OK(ifp, m) ||
1741 (ifp->if_hwassist & CSUM_FRAGMENT_IPV6))) {
1742 /*
1743 * mppn not updated in this case because no new chain is formed
1744 * and inserted
1745 */
1746 ip6_output_checksum(ifp, mtu, m, nxt0, tlen, optlen);
1747 } else {
1748 /*
1749 * time to fragment - cases 1-b is handled inside
1750 * ip6_do_fragmentation().
1751 * mppn is passed down to be updated to point at fragment chain.
1752 */
1753 u_int8_t *lexthdrsp;
1754
1755 if (exthdrsp->ip6e_rthdr != NULL) {
1756 lexthdrsp = mtod(exthdrsp->ip6e_rthdr, uint8_t *);
1757 } else if (exthdrsp->ip6e_dest1 != NULL) {
1758 lexthdrsp = mtod(exthdrsp->ip6e_dest1, uint8_t *);
1759 } else if (exthdrsp->ip6e_hbh != NULL) {
1760 lexthdrsp = mtod(exthdrsp->ip6e_hbh, uint8_t *);
1761 } else {
1762 lexthdrsp = NULL;
1763 }
1764 error = ip6_do_fragmentation(mptr, optlen, ifp,
1765 unfragpartlen, mtod(m, struct ip6_hdr *), lexthdrsp, mtu,
1766 nxt0, htonl(ip6_randomid()));
1767 }
1768
1769 return error;
1770 }
1771
1772 /*
1773 * ip6_do_fragmentation() is called by ip6_fragment_packet() after determining
1774 * the packet needs to be fragmented. on success, morig is freed and a chain
1775 * of fragments is linked into the packet chain where morig existed. Otherwise,
1776 * an errno is returned.
1777 * optlen: total length of all extension headers (excludes the IPv6 header).
1778 * unfragpartlen: length of the per-fragment headers which consist of the IPv6
1779 * header plus any extension headers that must be processed by nodes
1780 * en route to the destination.
1781 * lexthdrsp: pointer to the last extension header in the unfragmentable part
1782 * or NULL.
1783 * nxt0: upper-layer protocol number.
1784 * id: Identification value to be used in the fragment header.
1785 */
1786 int
ip6_do_fragmentation(struct mbuf ** mptr,uint32_t optlen,struct ifnet * ifp,uint32_t unfragpartlen,struct ip6_hdr * ip6,uint8_t * lexthdrsp,uint32_t mtu,int nxt0,uint32_t id)1787 ip6_do_fragmentation(struct mbuf **mptr, uint32_t optlen, struct ifnet *ifp,
1788 uint32_t unfragpartlen, struct ip6_hdr *ip6, uint8_t *lexthdrsp,
1789 uint32_t mtu, int nxt0, uint32_t id)
1790 {
1791 VERIFY(NULL != mptr);
1792 int error = 0;
1793
1794 struct mbuf *morig = *mptr;
1795 struct mbuf *first_mbufp = NULL;
1796 struct mbuf *last_mbufp = NULL;
1797
1798 uint32_t tlen = morig->m_pkthdr.len;
1799
1800 /* try to fragment the packet. case 1-b */
1801 if ((morig->m_pkthdr.csum_flags & CSUM_TSO_IPV6)) {
1802 /* TSO and fragment aren't compatible */
1803 in6_ifstat_inc(ifp, ifs6_out_fragfail);
1804 return EMSGSIZE;
1805 } else if (mtu < IPV6_MMTU) {
1806 /* path MTU cannot be less than IPV6_MMTU */
1807 in6_ifstat_inc(ifp, ifs6_out_fragfail);
1808 return EMSGSIZE;
1809 } else if (ip6->ip6_plen == 0) {
1810 /* jumbo payload cannot be fragmented */
1811 in6_ifstat_inc(ifp, ifs6_out_fragfail);
1812 return EMSGSIZE;
1813 } else {
1814 uint32_t hlen, off, len;
1815 struct mbuf **mnext = NULL;
1816 struct ip6_frag *ip6f;
1817 u_char nextproto;
1818
1819 /*
1820 * Too large for the destination or interface;
1821 * fragment if possible.
1822 * Must be able to put at least 8 bytes per fragment.
1823 */
1824 hlen = unfragpartlen;
1825 if (mtu > IPV6_MAXPACKET) {
1826 mtu = IPV6_MAXPACKET;
1827 }
1828
1829 len = (mtu - hlen - sizeof(struct ip6_frag)) & ~7;
1830 if (len < 8) {
1831 in6_ifstat_inc(ifp, ifs6_out_fragfail);
1832 return EMSGSIZE;
1833 }
1834
1835 /*
1836 * Change the next header field of the last header in the
1837 * unfragmentable part.
1838 */
1839 if (lexthdrsp != NULL) {
1840 nextproto = *lexthdrsp;
1841 *lexthdrsp = IPPROTO_FRAGMENT;
1842 } else {
1843 nextproto = ip6->ip6_nxt;
1844 ip6->ip6_nxt = IPPROTO_FRAGMENT;
1845 }
1846
1847 if (morig->m_pkthdr.csum_flags & CSUM_DELAY_IPV6_DATA) {
1848 in6_delayed_cksum_offset(morig, 0, optlen, nxt0);
1849 }
1850
1851 /*
1852 * Loop through length of segment after first fragment,
1853 * make new header and copy data of each part and link onto
1854 * chain.
1855 */
1856 for (off = hlen; off < tlen; off += len) {
1857 struct ip6_hdr *new_mhip6;
1858 struct mbuf *new_m;
1859 struct mbuf *m_frgpart;
1860
1861 MGETHDR(new_m, M_DONTWAIT, MT_HEADER); /* MAC-OK */
1862 if (new_m == NULL) {
1863 error = ENOBUFS;
1864 ip6stat.ip6s_odropped++;
1865 break;
1866 }
1867 new_m->m_pkthdr.rcvif = NULL;
1868 new_m->m_flags = morig->m_flags & M_COPYFLAGS;
1869
1870 if (first_mbufp != NULL) {
1871 /* Every pass through loop but first */
1872 *mnext = new_m;
1873 last_mbufp = new_m;
1874 } else {
1875 /* This is the first element of the fragment chain */
1876 first_mbufp = new_m;
1877 last_mbufp = new_m;
1878 }
1879 mnext = &new_m->m_nextpkt;
1880
1881 new_m->m_data += max_linkhdr;
1882 new_mhip6 = mtod(new_m, struct ip6_hdr *);
1883 *new_mhip6 = *ip6;
1884 new_m->m_len = sizeof(*new_mhip6);
1885
1886 error = ip6_insertfraghdr(morig, new_m, hlen, &ip6f);
1887 if (error) {
1888 ip6stat.ip6s_odropped++;
1889 break;
1890 }
1891
1892 ip6f->ip6f_offlg = htons((u_short)((off - hlen) & ~7));
1893 if (off + len >= tlen) {
1894 len = tlen - off;
1895 } else {
1896 ip6f->ip6f_offlg |= IP6F_MORE_FRAG;
1897 }
1898 new_mhip6->ip6_plen = htons((u_short)(len + hlen +
1899 sizeof(*ip6f) - sizeof(struct ip6_hdr)));
1900
1901 if ((m_frgpart = m_copy(morig, off, len)) == NULL) {
1902 error = ENOBUFS;
1903 ip6stat.ip6s_odropped++;
1904 break;
1905 }
1906 m_cat(new_m, m_frgpart);
1907 new_m->m_pkthdr.len = len + hlen + sizeof(*ip6f);
1908 new_m->m_pkthdr.rcvif = NULL;
1909
1910 M_COPY_CLASSIFIER(new_m, morig);
1911 M_COPY_PFTAG(new_m, morig);
1912 M_COPY_NECPTAG(new_m, morig);
1913
1914 ip6f->ip6f_reserved = 0;
1915 ip6f->ip6f_ident = id;
1916 ip6f->ip6f_nxt = nextproto;
1917 ip6stat.ip6s_ofragments++;
1918 in6_ifstat_inc(ifp, ifs6_out_fragcreat);
1919 }
1920
1921 if (error) {
1922 /* free all the fragments created */
1923 if (first_mbufp != NULL) {
1924 m_freem_list(first_mbufp);
1925 first_mbufp = NULL;
1926 }
1927 last_mbufp = NULL;
1928 } else {
1929 /* successful fragmenting */
1930 m_freem(morig);
1931 *mptr = first_mbufp;
1932 last_mbufp->m_nextpkt = NULL;
1933 ip6stat.ip6s_fragmented++;
1934 in6_ifstat_inc(ifp, ifs6_out_fragok);
1935 }
1936 }
1937 return error;
1938 }
1939
1940 static int
ip6_copyexthdr(struct mbuf ** mp,caddr_t hdr,int hlen)1941 ip6_copyexthdr(struct mbuf **mp, caddr_t hdr, int hlen)
1942 {
1943 struct mbuf *m;
1944
1945 if (hlen > MCLBYTES) {
1946 return ENOBUFS; /* XXX */
1947 }
1948 MGET(m, M_DONTWAIT, MT_DATA);
1949 if (m == NULL) {
1950 return ENOBUFS;
1951 }
1952
1953 if (hlen > MLEN) {
1954 MCLGET(m, M_DONTWAIT);
1955 if (!(m->m_flags & M_EXT)) {
1956 m_free(m);
1957 return ENOBUFS;
1958 }
1959 }
1960 m->m_len = hlen;
1961 if (hdr != NULL) {
1962 bcopy(hdr, mtod(m, caddr_t), hlen);
1963 }
1964
1965 *mp = m;
1966 return 0;
1967 }
1968
1969 static void
ip6_out_cksum_stats(int proto,u_int32_t len)1970 ip6_out_cksum_stats(int proto, u_int32_t len)
1971 {
1972 switch (proto) {
1973 case IPPROTO_TCP:
1974 tcp_out6_cksum_stats(len);
1975 break;
1976 case IPPROTO_UDP:
1977 udp_out6_cksum_stats(len);
1978 break;
1979 default:
1980 /* keep only TCP or UDP stats for now */
1981 break;
1982 }
1983 }
1984
1985 /*
1986 * Process a delayed payload checksum calculation (outbound path.)
1987 *
1988 * hoff is the number of bytes beyond the mbuf data pointer which
1989 * points to the IPv6 header. optlen is the number of bytes, if any,
1990 * between the end of IPv6 header and the beginning of the ULP payload
1991 * header, which represents the extension headers. If optlen is less
1992 * than zero, this routine will bail when it detects extension headers.
1993 *
1994 * Returns a bitmask representing all the work done in software.
1995 */
1996 uint32_t
in6_finalize_cksum(struct mbuf * m,uint32_t hoff,int32_t optlen,int32_t nxt0,uint32_t csum_flags)1997 in6_finalize_cksum(struct mbuf *m, uint32_t hoff, int32_t optlen,
1998 int32_t nxt0, uint32_t csum_flags)
1999 {
2000 unsigned char buf[sizeof(struct ip6_hdr)] __attribute__((aligned(8)));
2001 struct ip6_hdr *ip6;
2002 uint32_t offset, mlen, hlen, olen, sw_csum;
2003 uint16_t csum, ulpoff, plen;
2004 uint8_t nxt;
2005
2006 _CASSERT(sizeof(csum) == sizeof(uint16_t));
2007 VERIFY(m->m_flags & M_PKTHDR);
2008
2009 sw_csum = (csum_flags & m->m_pkthdr.csum_flags);
2010
2011 if ((sw_csum &= CSUM_DELAY_IPV6_DATA) == 0) {
2012 goto done;
2013 }
2014
2015 mlen = m->m_pkthdr.len; /* total mbuf len */
2016 hlen = sizeof(*ip6); /* IPv6 header len */
2017
2018 /* sanity check (need at least IPv6 header) */
2019 if (mlen < (hoff + hlen)) {
2020 panic("%s: mbuf %p pkt len (%u) < hoff+ip6_hdr "
2021 "(%u+%u)\n", __func__, m, mlen, hoff, hlen);
2022 /* NOTREACHED */
2023 }
2024
2025 /*
2026 * In case the IPv6 header is not contiguous, or not 32-bit
2027 * aligned, copy it to a local buffer.
2028 */
2029 if ((hoff + hlen) > m->m_len ||
2030 !IP6_HDR_ALIGNED_P(mtod(m, caddr_t) + hoff)) {
2031 m_copydata(m, hoff, hlen, (caddr_t)buf);
2032 ip6 = (struct ip6_hdr *)(void *)buf;
2033 } else {
2034 ip6 = (struct ip6_hdr *)(void *)(m->m_data + hoff);
2035 }
2036
2037 nxt = ip6->ip6_nxt;
2038 plen = ntohs(ip6->ip6_plen);
2039 if (plen != (mlen - (hoff + hlen))) {
2040 plen = OSSwapInt16(plen);
2041 if (plen != (mlen - (hoff + hlen))) {
2042 /* Don't complain for jumbograms */
2043 if (plen != 0 || nxt != IPPROTO_HOPOPTS) {
2044 printf("%s: mbuf 0x%llx proto %d IPv6 "
2045 "plen %d (%x) [swapped %d (%x)] doesn't "
2046 "match actual packet length; %d is used "
2047 "instead\n", __func__,
2048 (uint64_t)VM_KERNEL_ADDRPERM(m), nxt,
2049 ip6->ip6_plen, ip6->ip6_plen, plen, plen,
2050 (mlen - (hoff + hlen)));
2051 }
2052 plen = (uint16_t)(mlen - (hoff + hlen));
2053 }
2054 }
2055
2056 if (optlen < 0) {
2057 /* next header isn't TCP/UDP and we don't know optlen, bail */
2058 if (nxt != IPPROTO_TCP && nxt != IPPROTO_UDP) {
2059 sw_csum = 0;
2060 goto done;
2061 }
2062 olen = 0;
2063 } else {
2064 /* caller supplied the original transport number; use it */
2065 if (nxt0 >= 0) {
2066 nxt = (uint8_t)nxt0;
2067 }
2068 olen = optlen;
2069 }
2070
2071 offset = hoff + hlen + olen; /* ULP header */
2072
2073 /* sanity check */
2074 if (mlen < offset) {
2075 panic("%s: mbuf %p pkt len (%u) < hoff+ip6_hdr+ext_hdr "
2076 "(%u+%u+%u)\n", __func__, m, mlen, hoff, hlen, olen);
2077 /* NOTREACHED */
2078 }
2079
2080 /*
2081 * offset is added to the lower 16-bit value of csum_data,
2082 * which is expected to contain the ULP offset; therefore
2083 * CSUM_PARTIAL offset adjustment must be undone.
2084 */
2085 if ((m->m_pkthdr.csum_flags & (CSUM_PARTIAL | CSUM_DATA_VALID)) ==
2086 (CSUM_PARTIAL | CSUM_DATA_VALID)) {
2087 /*
2088 * Get back the original ULP offset (this will
2089 * undo the CSUM_PARTIAL logic in ip6_output.)
2090 */
2091 m->m_pkthdr.csum_data = (m->m_pkthdr.csum_tx_stuff -
2092 m->m_pkthdr.csum_tx_start);
2093 }
2094
2095 ulpoff = (m->m_pkthdr.csum_data & 0xffff); /* ULP csum offset */
2096
2097 if (mlen < (ulpoff + sizeof(csum))) {
2098 panic("%s: mbuf %p pkt len (%u) proto %d invalid ULP "
2099 "cksum offset (%u) cksum flags 0x%x\n", __func__,
2100 m, mlen, nxt, ulpoff, m->m_pkthdr.csum_flags);
2101 /* NOTREACHED */
2102 }
2103
2104 csum = inet6_cksum(m, 0, offset, plen - olen);
2105
2106 /* Update stats */
2107 ip6_out_cksum_stats(nxt, plen - olen);
2108
2109 /* RFC1122 4.1.3.4 */
2110 if (csum == 0 &&
2111 (m->m_pkthdr.csum_flags & (CSUM_UDPIPV6 | CSUM_ZERO_INVERT))) {
2112 csum = 0xffff;
2113 }
2114
2115 /* Insert the checksum in the ULP csum field */
2116 offset += ulpoff;
2117 if ((offset + sizeof(csum)) > m->m_len) {
2118 m_copyback(m, offset, sizeof(csum), &csum);
2119 } else if (IP6_HDR_ALIGNED_P(mtod(m, char *) + hoff)) {
2120 *(uint16_t *)(void *)(mtod(m, char *) + offset) = csum;
2121 } else {
2122 bcopy(&csum, (mtod(m, char *) + offset), sizeof(csum));
2123 }
2124 m->m_pkthdr.csum_flags &= ~(CSUM_DELAY_IPV6_DATA | CSUM_DATA_VALID |
2125 CSUM_PARTIAL | CSUM_ZERO_INVERT);
2126
2127 done:
2128 return sw_csum;
2129 }
2130
2131 /*
2132 * Insert jumbo payload option.
2133 */
2134 static int
ip6_insert_jumboopt(struct ip6_exthdrs * exthdrs,u_int32_t plen)2135 ip6_insert_jumboopt(struct ip6_exthdrs *exthdrs, u_int32_t plen)
2136 {
2137 struct mbuf *mopt;
2138 u_char *optbuf;
2139 u_int32_t v;
2140
2141 #define JUMBOOPTLEN 8 /* length of jumbo payload option and padding */
2142
2143 /*
2144 * If there is no hop-by-hop options header, allocate new one.
2145 * If there is one but it doesn't have enough space to store the
2146 * jumbo payload option, allocate a cluster to store the whole options.
2147 * Otherwise, use it to store the options.
2148 */
2149 if (exthdrs->ip6e_hbh == NULL) {
2150 MGET(mopt, M_DONTWAIT, MT_DATA);
2151 if (mopt == NULL) {
2152 return ENOBUFS;
2153 }
2154 mopt->m_len = JUMBOOPTLEN;
2155 optbuf = mtod(mopt, u_char *);
2156 optbuf[1] = 0; /* = ((JUMBOOPTLEN) >> 3) - 1 */
2157 exthdrs->ip6e_hbh = mopt;
2158 } else {
2159 struct ip6_hbh *hbh;
2160
2161 mopt = exthdrs->ip6e_hbh;
2162 if (M_TRAILINGSPACE(mopt) < JUMBOOPTLEN) {
2163 /*
2164 * XXX assumption:
2165 * - exthdrs->ip6e_hbh is not referenced from places
2166 * other than exthdrs.
2167 * - exthdrs->ip6e_hbh is not an mbuf chain.
2168 */
2169 u_int32_t oldoptlen = mopt->m_len;
2170 struct mbuf *n;
2171
2172 /*
2173 * XXX: give up if the whole (new) hbh header does
2174 * not fit even in an mbuf cluster.
2175 */
2176 if (oldoptlen + JUMBOOPTLEN > MCLBYTES) {
2177 return ENOBUFS;
2178 }
2179
2180 /*
2181 * As a consequence, we must always prepare a cluster
2182 * at this point.
2183 */
2184 MGET(n, M_DONTWAIT, MT_DATA);
2185 if (n != NULL) {
2186 MCLGET(n, M_DONTWAIT);
2187 if (!(n->m_flags & M_EXT)) {
2188 m_freem(n);
2189 n = NULL;
2190 }
2191 }
2192 if (n == NULL) {
2193 return ENOBUFS;
2194 }
2195 n->m_len = oldoptlen + JUMBOOPTLEN;
2196 bcopy(mtod(mopt, caddr_t), mtod(n, caddr_t),
2197 oldoptlen);
2198 optbuf = mtod(n, u_char *) + oldoptlen;
2199 m_freem(mopt);
2200 mopt = exthdrs->ip6e_hbh = n;
2201 } else {
2202 optbuf = mtod(mopt, u_char *) + mopt->m_len;
2203 mopt->m_len += JUMBOOPTLEN;
2204 }
2205 optbuf[0] = IP6OPT_PADN;
2206 optbuf[1] = 1;
2207
2208 /*
2209 * Adjust the header length according to the pad and
2210 * the jumbo payload option.
2211 */
2212 hbh = mtod(mopt, struct ip6_hbh *);
2213 hbh->ip6h_len += (JUMBOOPTLEN >> 3);
2214 }
2215
2216 /* fill in the option. */
2217 optbuf[2] = IP6OPT_JUMBO;
2218 optbuf[3] = 4;
2219 v = (u_int32_t)htonl(plen + JUMBOOPTLEN);
2220 bcopy(&v, &optbuf[4], sizeof(u_int32_t));
2221
2222 /* finally, adjust the packet header length */
2223 exthdrs->ip6e_ip6->m_pkthdr.len += JUMBOOPTLEN;
2224
2225 return 0;
2226 #undef JUMBOOPTLEN
2227 }
2228
2229 /*
2230 * Insert fragment header and copy unfragmentable header portions.
2231 */
2232 static int
ip6_insertfraghdr(struct mbuf * m0,struct mbuf * m,int hlen,struct ip6_frag ** frghdrp)2233 ip6_insertfraghdr(struct mbuf *m0, struct mbuf *m, int hlen,
2234 struct ip6_frag **frghdrp)
2235 {
2236 struct mbuf *n, *mlast;
2237
2238 if (hlen > sizeof(struct ip6_hdr)) {
2239 n = m_copym(m0, sizeof(struct ip6_hdr),
2240 hlen - sizeof(struct ip6_hdr), M_DONTWAIT);
2241 if (n == NULL) {
2242 return ENOBUFS;
2243 }
2244 m->m_next = n;
2245 } else {
2246 n = m;
2247 }
2248
2249 /* Search for the last mbuf of unfragmentable part. */
2250 for (mlast = n; mlast->m_next; mlast = mlast->m_next) {
2251 ;
2252 }
2253
2254 if (!(mlast->m_flags & M_EXT) &&
2255 M_TRAILINGSPACE(mlast) >= sizeof(struct ip6_frag)) {
2256 /* use the trailing space of the last mbuf for the frag hdr */
2257 *frghdrp = (struct ip6_frag *)(mtod(mlast, caddr_t) +
2258 mlast->m_len);
2259 mlast->m_len += sizeof(struct ip6_frag);
2260 m->m_pkthdr.len += sizeof(struct ip6_frag);
2261 } else {
2262 /* allocate a new mbuf for the fragment header */
2263 struct mbuf *mfrg;
2264
2265 MGET(mfrg, M_DONTWAIT, MT_DATA);
2266 if (mfrg == NULL) {
2267 return ENOBUFS;
2268 }
2269 mfrg->m_len = sizeof(struct ip6_frag);
2270 *frghdrp = mtod(mfrg, struct ip6_frag *);
2271 mlast->m_next = mfrg;
2272 }
2273
2274 return 0;
2275 }
2276
2277 static int
ip6_getpmtu(struct route_in6 * ro_pmtu,struct route_in6 * ro,struct ifnet * ifp,struct in6_addr * dst,uint32_t dst_ifscope,u_int32_t * mtup)2278 ip6_getpmtu(struct route_in6 *ro_pmtu, struct route_in6 *ro,
2279 struct ifnet *ifp, struct in6_addr *dst, uint32_t dst_ifscope, u_int32_t *mtup)
2280 {
2281 u_int32_t mtu = 0;
2282 int error = 0;
2283
2284 if (ro_pmtu != ro) {
2285 /* The first hop and the final destination may differ. */
2286 struct sockaddr_in6 *sa6_dst = SIN6(&ro_pmtu->ro_dst);
2287 if (ROUTE_UNUSABLE(ro_pmtu) ||
2288 !in6_are_addr_equal_scoped(&sa6_dst->sin6_addr, dst, sa6_dst->sin6_scope_id, dst_ifscope)) {
2289 ROUTE_RELEASE(ro_pmtu);
2290 }
2291
2292 if (ro_pmtu->ro_rt == NULL) {
2293 bzero(sa6_dst, sizeof(*sa6_dst));
2294 sa6_dst->sin6_family = AF_INET6;
2295 sa6_dst->sin6_len = sizeof(struct sockaddr_in6);
2296 sa6_dst->sin6_addr = *dst;
2297
2298 rtalloc_scoped((struct route *)ro_pmtu,
2299 ifp != NULL ? ifp->if_index : IFSCOPE_NONE);
2300 }
2301 }
2302
2303 if (ro_pmtu->ro_rt != NULL) {
2304 u_int32_t ifmtu;
2305
2306 if (ifp == NULL) {
2307 ifp = ro_pmtu->ro_rt->rt_ifp;
2308 }
2309 /* Access without acquiring nd_ifinfo lock for performance */
2310 ifmtu = IN6_LINKMTU(ifp);
2311
2312 /*
2313 * Access rmx_mtu without holding the route entry lock,
2314 * for performance; this isn't something that changes
2315 * often, so optimize.
2316 */
2317 mtu = ro_pmtu->ro_rt->rt_rmx.rmx_mtu;
2318 if (mtu > ifmtu || mtu == 0) {
2319 /*
2320 * The MTU on the route is larger than the MTU on
2321 * the interface! This shouldn't happen, unless the
2322 * MTU of the interface has been changed after the
2323 * interface was brought up. Change the MTU in the
2324 * route to match the interface MTU (as long as the
2325 * field isn't locked).
2326 *
2327 * if MTU on the route is 0, we need to fix the MTU.
2328 * this case happens with path MTU discovery timeouts.
2329 */
2330 mtu = ifmtu;
2331 if (!(ro_pmtu->ro_rt->rt_rmx.rmx_locks & RTV_MTU)) {
2332 ro_pmtu->ro_rt->rt_rmx.rmx_mtu = mtu; /* XXX */
2333 }
2334 }
2335 } else {
2336 if (ifp) {
2337 /* Don't hold nd_ifinfo lock for performance */
2338 mtu = IN6_LINKMTU(ifp);
2339 } else {
2340 error = EHOSTUNREACH; /* XXX */
2341 }
2342 }
2343
2344 *mtup = mtu;
2345 return error;
2346 }
2347
2348 /*
2349 * IP6 socket option processing.
2350 */
2351 int
ip6_ctloutput(struct socket * so,struct sockopt * sopt)2352 ip6_ctloutput(struct socket *so, struct sockopt *sopt)
2353 {
2354 int optdatalen, uproto;
2355 void *optdata;
2356 int privileged;
2357 struct inpcb *in6p = sotoinpcb(so);
2358 int error = 0, optval = 0;
2359 int level, op = -1, optname = 0;
2360 size_t optlen = 0;
2361 struct proc *p;
2362 lck_mtx_t *mutex_held = NULL;
2363
2364 VERIFY(sopt != NULL);
2365
2366 level = sopt->sopt_level;
2367 op = sopt->sopt_dir;
2368 optname = sopt->sopt_name;
2369 optlen = sopt->sopt_valsize;
2370 p = sopt->sopt_p;
2371 uproto = (int)SOCK_PROTO(so);
2372
2373 privileged = (proc_suser(p) == 0);
2374
2375 if (level == IPPROTO_IPV6) {
2376 boolean_t capture_exthdrstat_in = FALSE;
2377 switch (op) {
2378 case SOPT_SET:
2379 mutex_held = socket_getlock(so, PR_F_WILLUNLOCK);
2380 /*
2381 * Wait if we are in the middle of ip6_output
2382 * as we unlocked the socket there and don't
2383 * want to overwrite the IP options
2384 */
2385 if (in6p->inp_sndinprog_cnt > 0) {
2386 in6p->inp_sndingprog_waiters++;
2387
2388 while (in6p->inp_sndinprog_cnt > 0) {
2389 msleep(&in6p->inp_sndinprog_cnt, mutex_held,
2390 PSOCK | PCATCH, "inp_sndinprog_cnt",
2391 NULL);
2392 }
2393 in6p->inp_sndingprog_waiters--;
2394 }
2395 switch (optname) {
2396 case IPV6_2292PKTOPTIONS: {
2397 struct mbuf *m;
2398
2399 error = soopt_getm(sopt, &m);
2400 if (error != 0) {
2401 break;
2402 }
2403 error = soopt_mcopyin(sopt, m);
2404 if (error != 0) {
2405 break;
2406 }
2407 error = ip6_pcbopts(&in6p->in6p_outputopts,
2408 m, so, sopt);
2409 m_freem(m);
2410 break;
2411 }
2412
2413 /*
2414 * Use of some Hop-by-Hop options or some
2415 * Destination options, might require special
2416 * privilege. That is, normal applications
2417 * (without special privilege) might be forbidden
2418 * from setting certain options in outgoing packets,
2419 * and might never see certain options in received
2420 * packets. [RFC 2292 Section 6]
2421 * KAME specific note:
2422 * KAME prevents non-privileged users from sending or
2423 * receiving ANY hbh/dst options in order to avoid
2424 * overhead of parsing options in the kernel.
2425 */
2426 case IPV6_RECVHOPOPTS:
2427 case IPV6_RECVDSTOPTS:
2428 case IPV6_RECVRTHDRDSTOPTS:
2429 if (!privileged) {
2430 break;
2431 }
2432 OS_FALLTHROUGH;
2433 case IPV6_UNICAST_HOPS:
2434 case IPV6_HOPLIMIT:
2435 case IPV6_RECVPKTINFO:
2436 case IPV6_RECVHOPLIMIT:
2437 case IPV6_RECVRTHDR:
2438 case IPV6_RECVPATHMTU:
2439 case IPV6_RECVTCLASS:
2440 case IPV6_V6ONLY:
2441 case IPV6_AUTOFLOWLABEL:
2442 if (optlen != sizeof(int)) {
2443 error = EINVAL;
2444 break;
2445 }
2446 error = sooptcopyin(sopt, &optval,
2447 sizeof(optval), sizeof(optval));
2448 if (error) {
2449 break;
2450 }
2451
2452 switch (optname) {
2453 case IPV6_UNICAST_HOPS:
2454 if (optval < -1 || optval >= 256) {
2455 error = EINVAL;
2456 } else {
2457 /* -1 = kernel default */
2458 in6p->in6p_hops = (short)optval;
2459 if (in6p->inp_vflag &
2460 INP_IPV4) {
2461 in6p->inp_ip_ttl =
2462 (uint8_t)optval;
2463 }
2464 }
2465 break;
2466 #define OPTSET(bit) do { \
2467 if (optval) \
2468 in6p->inp_flags |= (bit); \
2469 else \
2470 in6p->inp_flags &= ~(bit); \
2471 } while (0)
2472
2473 #define OPTSET2292(bit) do { \
2474 in6p->inp_flags |= IN6P_RFC2292; \
2475 if (optval) \
2476 in6p->inp_flags |= (bit); \
2477 else \
2478 in6p->inp_flags &= ~(bit); \
2479 } while (0)
2480
2481 #define OPTBIT(bit) (in6p->inp_flags & (bit) ? 1 : 0)
2482
2483 case IPV6_RECVPKTINFO:
2484 /* cannot mix with RFC2292 */
2485 if (OPTBIT(IN6P_RFC2292)) {
2486 error = EINVAL;
2487 break;
2488 }
2489 OPTSET(IN6P_PKTINFO);
2490 break;
2491
2492 case IPV6_HOPLIMIT: {
2493 struct ip6_pktopts **optp;
2494
2495 /* cannot mix with RFC2292 */
2496 if (OPTBIT(IN6P_RFC2292)) {
2497 error = EINVAL;
2498 break;
2499 }
2500 optp = &in6p->in6p_outputopts;
2501 error = ip6_pcbopt(IPV6_HOPLIMIT,
2502 (u_char *)&optval, sizeof(optval),
2503 optp, uproto);
2504 break;
2505 }
2506
2507 case IPV6_RECVHOPLIMIT:
2508 /* cannot mix with RFC2292 */
2509 if (OPTBIT(IN6P_RFC2292)) {
2510 error = EINVAL;
2511 break;
2512 }
2513 OPTSET(IN6P_HOPLIMIT);
2514 break;
2515
2516 case IPV6_RECVHOPOPTS:
2517 /* cannot mix with RFC2292 */
2518 if (OPTBIT(IN6P_RFC2292)) {
2519 error = EINVAL;
2520 break;
2521 }
2522 OPTSET(IN6P_HOPOPTS);
2523 capture_exthdrstat_in = TRUE;
2524 break;
2525
2526 case IPV6_RECVDSTOPTS:
2527 /* cannot mix with RFC2292 */
2528 if (OPTBIT(IN6P_RFC2292)) {
2529 error = EINVAL;
2530 break;
2531 }
2532 OPTSET(IN6P_DSTOPTS);
2533 capture_exthdrstat_in = TRUE;
2534 break;
2535
2536 case IPV6_RECVRTHDRDSTOPTS:
2537 /* cannot mix with RFC2292 */
2538 if (OPTBIT(IN6P_RFC2292)) {
2539 error = EINVAL;
2540 break;
2541 }
2542 OPTSET(IN6P_RTHDRDSTOPTS);
2543 capture_exthdrstat_in = TRUE;
2544 break;
2545
2546 case IPV6_RECVRTHDR:
2547 /* cannot mix with RFC2292 */
2548 if (OPTBIT(IN6P_RFC2292)) {
2549 error = EINVAL;
2550 break;
2551 }
2552 OPTSET(IN6P_RTHDR);
2553 capture_exthdrstat_in = TRUE;
2554 break;
2555
2556 case IPV6_RECVPATHMTU:
2557 /*
2558 * We ignore this option for TCP
2559 * sockets.
2560 * (RFC3542 leaves this case
2561 * unspecified.)
2562 */
2563 if (uproto != IPPROTO_TCP) {
2564 OPTSET(IN6P_MTU);
2565 }
2566 break;
2567
2568 case IPV6_V6ONLY:
2569 /*
2570 * make setsockopt(IPV6_V6ONLY)
2571 * available only prior to bind(2).
2572 * see ipng mailing list, Jun 22 2001.
2573 */
2574 if (in6p->inp_lport ||
2575 !IN6_IS_ADDR_UNSPECIFIED(
2576 &in6p->in6p_laddr)) {
2577 error = EINVAL;
2578 break;
2579 }
2580 OPTSET(IN6P_IPV6_V6ONLY);
2581 if (optval) {
2582 in6p->inp_vflag &= ~INP_IPV4;
2583 } else {
2584 in6p->inp_vflag |= INP_IPV4;
2585 }
2586 break;
2587
2588 case IPV6_RECVTCLASS:
2589 /* we can mix with RFC2292 */
2590 OPTSET(IN6P_TCLASS);
2591 break;
2592
2593 case IPV6_AUTOFLOWLABEL:
2594 OPTSET(IN6P_AUTOFLOWLABEL);
2595 break;
2596 }
2597 break;
2598
2599 case IPV6_TCLASS:
2600 case IPV6_DONTFRAG:
2601 case IPV6_USE_MIN_MTU:
2602 case IPV6_PREFER_TEMPADDR: {
2603 struct ip6_pktopts **optp;
2604
2605 if (optlen != sizeof(optval)) {
2606 error = EINVAL;
2607 break;
2608 }
2609 error = sooptcopyin(sopt, &optval,
2610 sizeof(optval), sizeof(optval));
2611 if (error) {
2612 break;
2613 }
2614
2615 optp = &in6p->in6p_outputopts;
2616 error = ip6_pcbopt(optname, (u_char *)&optval,
2617 sizeof(optval), optp, uproto);
2618
2619 if (optname == IPV6_TCLASS) {
2620 // Add in the ECN flags
2621 u_int8_t tos = (in6p->inp_ip_tos & ~IPTOS_ECN_MASK);
2622 u_int8_t ecn = optval & IPTOS_ECN_MASK;
2623 in6p->inp_ip_tos = tos | ecn;
2624 }
2625 break;
2626 }
2627
2628 case IPV6_2292PKTINFO:
2629 case IPV6_2292HOPLIMIT:
2630 case IPV6_2292HOPOPTS:
2631 case IPV6_2292DSTOPTS:
2632 case IPV6_2292RTHDR:
2633 /* RFC 2292 */
2634 if (optlen != sizeof(int)) {
2635 error = EINVAL;
2636 break;
2637 }
2638 error = sooptcopyin(sopt, &optval,
2639 sizeof(optval), sizeof(optval));
2640 if (error) {
2641 break;
2642 }
2643 switch (optname) {
2644 case IPV6_2292PKTINFO:
2645 OPTSET2292(IN6P_PKTINFO);
2646 break;
2647 case IPV6_2292HOPLIMIT:
2648 OPTSET2292(IN6P_HOPLIMIT);
2649 break;
2650 case IPV6_2292HOPOPTS:
2651 /*
2652 * Check super-user privilege.
2653 * See comments for IPV6_RECVHOPOPTS.
2654 */
2655 if (!privileged) {
2656 return EPERM;
2657 }
2658 OPTSET2292(IN6P_HOPOPTS);
2659 capture_exthdrstat_in = TRUE;
2660 break;
2661 case IPV6_2292DSTOPTS:
2662 if (!privileged) {
2663 return EPERM;
2664 }
2665 OPTSET2292(IN6P_DSTOPTS |
2666 IN6P_RTHDRDSTOPTS); /* XXX */
2667 capture_exthdrstat_in = TRUE;
2668 break;
2669 case IPV6_2292RTHDR:
2670 OPTSET2292(IN6P_RTHDR);
2671 capture_exthdrstat_in = TRUE;
2672 break;
2673 }
2674 break;
2675
2676 case IPV6_3542PKTINFO:
2677 case IPV6_3542HOPOPTS:
2678 case IPV6_3542RTHDR:
2679 case IPV6_3542DSTOPTS:
2680 case IPV6_RTHDRDSTOPTS:
2681 case IPV6_3542NEXTHOP: {
2682 struct ip6_pktopts **optp;
2683 /* new advanced API (RFC3542) */
2684 struct mbuf *m;
2685
2686 /* cannot mix with RFC2292 */
2687 if (OPTBIT(IN6P_RFC2292)) {
2688 error = EINVAL;
2689 break;
2690 }
2691 error = soopt_getm(sopt, &m);
2692 if (error != 0) {
2693 break;
2694 }
2695 error = soopt_mcopyin(sopt, m);
2696 if (error != 0) {
2697 break;
2698 }
2699
2700 optp = &in6p->in6p_outputopts;
2701 error = ip6_pcbopt(optname, mtod(m, u_char *),
2702 m->m_len, optp, uproto);
2703 m_freem(m);
2704 break;
2705 }
2706 #undef OPTSET
2707 case IPV6_MULTICAST_IF:
2708 case IPV6_MULTICAST_HOPS:
2709 case IPV6_MULTICAST_LOOP:
2710 case IPV6_JOIN_GROUP:
2711 case IPV6_LEAVE_GROUP:
2712 case IPV6_MSFILTER:
2713 case MCAST_BLOCK_SOURCE:
2714 case MCAST_UNBLOCK_SOURCE:
2715 case MCAST_JOIN_GROUP:
2716 case MCAST_LEAVE_GROUP:
2717 case MCAST_JOIN_SOURCE_GROUP:
2718 case MCAST_LEAVE_SOURCE_GROUP:
2719 error = ip6_setmoptions(in6p, sopt);
2720 break;
2721
2722 case IPV6_PORTRANGE:
2723 error = sooptcopyin(sopt, &optval,
2724 sizeof(optval), sizeof(optval));
2725 if (error) {
2726 break;
2727 }
2728
2729 switch (optval) {
2730 case IPV6_PORTRANGE_DEFAULT:
2731 in6p->inp_flags &= ~(INP_LOWPORT);
2732 in6p->inp_flags &= ~(INP_HIGHPORT);
2733 break;
2734
2735 case IPV6_PORTRANGE_HIGH:
2736 in6p->inp_flags &= ~(INP_LOWPORT);
2737 in6p->inp_flags |= INP_HIGHPORT;
2738 break;
2739
2740 case IPV6_PORTRANGE_LOW:
2741 in6p->inp_flags &= ~(INP_HIGHPORT);
2742 in6p->inp_flags |= INP_LOWPORT;
2743 break;
2744
2745 default:
2746 error = EINVAL;
2747 break;
2748 }
2749 break;
2750 #if IPSEC
2751 case IPV6_IPSEC_POLICY: {
2752 caddr_t req = NULL;
2753 size_t len = 0;
2754 struct mbuf *m;
2755
2756 if ((error = soopt_getm(sopt, &m)) != 0) {
2757 break;
2758 }
2759 if ((error = soopt_mcopyin(sopt, m)) != 0) {
2760 break;
2761 }
2762
2763 req = mtod(m, caddr_t);
2764 len = m->m_len;
2765 error = ipsec6_set_policy(in6p, optname, req,
2766 len, privileged);
2767 m_freem(m);
2768 break;
2769 }
2770 #endif /* IPSEC */
2771 /*
2772 * IPv6 variant of IP_BOUND_IF; for details see
2773 * comments on IP_BOUND_IF in ip_ctloutput().
2774 */
2775 case IPV6_BOUND_IF:
2776 /* This option is settable only on IPv6 */
2777 if (!(in6p->inp_vflag & INP_IPV6)) {
2778 error = EINVAL;
2779 break;
2780 }
2781
2782 error = sooptcopyin(sopt, &optval,
2783 sizeof(optval), sizeof(optval));
2784
2785 if (error) {
2786 break;
2787 }
2788
2789 error = inp_bindif(in6p, optval, NULL);
2790 break;
2791
2792 case IPV6_NO_IFT_CELLULAR:
2793 /* This option is settable only for IPv6 */
2794 if (!(in6p->inp_vflag & INP_IPV6)) {
2795 error = EINVAL;
2796 break;
2797 }
2798
2799 error = sooptcopyin(sopt, &optval,
2800 sizeof(optval), sizeof(optval));
2801
2802 if (error) {
2803 break;
2804 }
2805
2806 /* once set, it cannot be unset */
2807 if (!optval && INP_NO_CELLULAR(in6p)) {
2808 error = EINVAL;
2809 break;
2810 }
2811
2812 error = so_set_restrictions(so,
2813 SO_RESTRICT_DENY_CELLULAR);
2814 break;
2815
2816 case IPV6_OUT_IF:
2817 /* This option is not settable */
2818 error = EINVAL;
2819 break;
2820
2821 default:
2822 error = ENOPROTOOPT;
2823 break;
2824 }
2825 if (capture_exthdrstat_in) {
2826 if (uproto == IPPROTO_TCP) {
2827 INC_ATOMIC_INT64_LIM(net_api_stats.nas_sock_inet6_stream_exthdr_in);
2828 } else if (uproto == IPPROTO_UDP) {
2829 INC_ATOMIC_INT64_LIM(net_api_stats.nas_sock_inet6_dgram_exthdr_in);
2830 }
2831 }
2832 break;
2833
2834 case SOPT_GET:
2835 switch (optname) {
2836 case IPV6_2292PKTOPTIONS:
2837 /*
2838 * RFC3542 (effectively) deprecated the
2839 * semantics of the 2292-style pktoptions.
2840 * Since it was not reliable in nature (i.e.,
2841 * applications had to expect the lack of some
2842 * information after all), it would make sense
2843 * to simplify this part by always returning
2844 * empty data.
2845 */
2846 sopt->sopt_valsize = 0;
2847 break;
2848
2849 case IPV6_RECVHOPOPTS:
2850 case IPV6_RECVDSTOPTS:
2851 case IPV6_RECVRTHDRDSTOPTS:
2852 case IPV6_UNICAST_HOPS:
2853 case IPV6_RECVPKTINFO:
2854 case IPV6_RECVHOPLIMIT:
2855 case IPV6_RECVRTHDR:
2856 case IPV6_RECVPATHMTU:
2857 case IPV6_V6ONLY:
2858 case IPV6_PORTRANGE:
2859 case IPV6_RECVTCLASS:
2860 case IPV6_AUTOFLOWLABEL:
2861 switch (optname) {
2862 case IPV6_RECVHOPOPTS:
2863 optval = OPTBIT(IN6P_HOPOPTS);
2864 break;
2865
2866 case IPV6_RECVDSTOPTS:
2867 optval = OPTBIT(IN6P_DSTOPTS);
2868 break;
2869
2870 case IPV6_RECVRTHDRDSTOPTS:
2871 optval = OPTBIT(IN6P_RTHDRDSTOPTS);
2872 break;
2873
2874 case IPV6_UNICAST_HOPS:
2875 optval = in6p->in6p_hops;
2876 break;
2877
2878 case IPV6_RECVPKTINFO:
2879 optval = OPTBIT(IN6P_PKTINFO);
2880 break;
2881
2882 case IPV6_RECVHOPLIMIT:
2883 optval = OPTBIT(IN6P_HOPLIMIT);
2884 break;
2885
2886 case IPV6_RECVRTHDR:
2887 optval = OPTBIT(IN6P_RTHDR);
2888 break;
2889
2890 case IPV6_RECVPATHMTU:
2891 optval = OPTBIT(IN6P_MTU);
2892 break;
2893
2894 case IPV6_V6ONLY:
2895 optval = OPTBIT(IN6P_IPV6_V6ONLY);
2896 break;
2897
2898 case IPV6_PORTRANGE: {
2899 int flags;
2900 flags = in6p->inp_flags;
2901 if (flags & INP_HIGHPORT) {
2902 optval = IPV6_PORTRANGE_HIGH;
2903 } else if (flags & INP_LOWPORT) {
2904 optval = IPV6_PORTRANGE_LOW;
2905 } else {
2906 optval = 0;
2907 }
2908 break;
2909 }
2910 case IPV6_RECVTCLASS:
2911 optval = OPTBIT(IN6P_TCLASS);
2912 break;
2913
2914 case IPV6_AUTOFLOWLABEL:
2915 optval = OPTBIT(IN6P_AUTOFLOWLABEL);
2916 break;
2917 }
2918 if (error) {
2919 break;
2920 }
2921 error = sooptcopyout(sopt, &optval,
2922 sizeof(optval));
2923 break;
2924
2925 case IPV6_PATHMTU: {
2926 u_int32_t pmtu = 0;
2927 struct ip6_mtuinfo mtuinfo;
2928 struct route_in6 sro;
2929
2930 bzero(&sro, sizeof(sro));
2931
2932 if (!(so->so_state & SS_ISCONNECTED)) {
2933 return ENOTCONN;
2934 }
2935 /*
2936 * XXX: we dot not consider the case of source
2937 * routing, or optional information to specify
2938 * the outgoing interface.
2939 */
2940 error = ip6_getpmtu(&sro, NULL, NULL,
2941 &in6p->in6p_faddr, in6p->inp_fifscope, &pmtu);
2942 ROUTE_RELEASE(&sro);
2943 if (error) {
2944 break;
2945 }
2946 if (pmtu > IPV6_MAXPACKET) {
2947 pmtu = IPV6_MAXPACKET;
2948 }
2949
2950 bzero(&mtuinfo, sizeof(mtuinfo));
2951 mtuinfo.ip6m_mtu = (u_int32_t)pmtu;
2952 optdata = (void *)&mtuinfo;
2953 optdatalen = sizeof(mtuinfo);
2954 error = sooptcopyout(sopt, optdata,
2955 optdatalen);
2956 break;
2957 }
2958
2959 case IPV6_2292PKTINFO:
2960 case IPV6_2292HOPLIMIT:
2961 case IPV6_2292HOPOPTS:
2962 case IPV6_2292RTHDR:
2963 case IPV6_2292DSTOPTS:
2964 switch (optname) {
2965 case IPV6_2292PKTINFO:
2966 optval = OPTBIT(IN6P_PKTINFO);
2967 break;
2968 case IPV6_2292HOPLIMIT:
2969 optval = OPTBIT(IN6P_HOPLIMIT);
2970 break;
2971 case IPV6_2292HOPOPTS:
2972 optval = OPTBIT(IN6P_HOPOPTS);
2973 break;
2974 case IPV6_2292RTHDR:
2975 optval = OPTBIT(IN6P_RTHDR);
2976 break;
2977 case IPV6_2292DSTOPTS:
2978 optval = OPTBIT(IN6P_DSTOPTS |
2979 IN6P_RTHDRDSTOPTS);
2980 break;
2981 }
2982 error = sooptcopyout(sopt, &optval,
2983 sizeof(optval));
2984 break;
2985
2986 case IPV6_PKTINFO:
2987 case IPV6_HOPOPTS:
2988 case IPV6_RTHDR:
2989 case IPV6_DSTOPTS:
2990 case IPV6_RTHDRDSTOPTS:
2991 case IPV6_NEXTHOP:
2992 case IPV6_TCLASS:
2993 case IPV6_DONTFRAG:
2994 case IPV6_USE_MIN_MTU:
2995 case IPV6_PREFER_TEMPADDR:
2996 error = ip6_getpcbopt(in6p->in6p_outputopts,
2997 optname, sopt);
2998 break;
2999
3000 case IPV6_MULTICAST_IF:
3001 case IPV6_MULTICAST_HOPS:
3002 case IPV6_MULTICAST_LOOP:
3003 case IPV6_MSFILTER:
3004 error = ip6_getmoptions(in6p, sopt);
3005 break;
3006 #if IPSEC
3007 case IPV6_IPSEC_POLICY: {
3008 error = 0; /* This option is no longer supported */
3009 break;
3010 }
3011 #endif /* IPSEC */
3012 case IPV6_BOUND_IF:
3013 if (in6p->inp_flags & INP_BOUND_IF) {
3014 optval = in6p->inp_boundifp->if_index;
3015 }
3016 error = sooptcopyout(sopt, &optval,
3017 sizeof(optval));
3018 break;
3019
3020 case IPV6_NO_IFT_CELLULAR:
3021 optval = INP_NO_CELLULAR(in6p) ? 1 : 0;
3022 error = sooptcopyout(sopt, &optval,
3023 sizeof(optval));
3024 break;
3025
3026 case IPV6_OUT_IF:
3027 optval = (in6p->in6p_last_outifp != NULL) ?
3028 in6p->in6p_last_outifp->if_index : 0;
3029 error = sooptcopyout(sopt, &optval,
3030 sizeof(optval));
3031 break;
3032
3033 default:
3034 error = ENOPROTOOPT;
3035 break;
3036 }
3037 break;
3038 }
3039 } else {
3040 error = EINVAL;
3041 }
3042 return error;
3043 }
3044
3045 int
ip6_raw_ctloutput(struct socket * so,struct sockopt * sopt)3046 ip6_raw_ctloutput(struct socket *so, struct sockopt *sopt)
3047 {
3048 int error = 0, optval;
3049 size_t optlen;
3050 const int icmp6off = offsetof(struct icmp6_hdr, icmp6_cksum);
3051 struct inpcb *in6p = sotoinpcb(so);
3052 int level, op, optname;
3053
3054 level = sopt->sopt_level;
3055 op = sopt->sopt_dir;
3056 optname = sopt->sopt_name;
3057 optlen = sopt->sopt_valsize;
3058
3059 if (level != IPPROTO_IPV6) {
3060 return EINVAL;
3061 }
3062
3063 switch (optname) {
3064 case IPV6_CHECKSUM:
3065 /*
3066 * For ICMPv6 sockets, no modification allowed for checksum
3067 * offset, permit "no change" values to help existing apps.
3068 *
3069 * RFC3542 says: "An attempt to set IPV6_CHECKSUM
3070 * for an ICMPv6 socket will fail."
3071 * The current behavior does not meet RFC3542.
3072 */
3073 switch (op) {
3074 case SOPT_SET:
3075 if (optlen != sizeof(int)) {
3076 error = EINVAL;
3077 break;
3078 }
3079 error = sooptcopyin(sopt, &optval, sizeof(optval),
3080 sizeof(optval));
3081 if (error) {
3082 break;
3083 }
3084 if ((optval % 2) != 0) {
3085 /* the API assumes even offset values */
3086 error = EINVAL;
3087 } else if (SOCK_PROTO(so) == IPPROTO_ICMPV6) {
3088 if (optval != icmp6off) {
3089 error = EINVAL;
3090 }
3091 } else {
3092 in6p->in6p_cksum = optval;
3093 }
3094 break;
3095
3096 case SOPT_GET:
3097 if (SOCK_PROTO(so) == IPPROTO_ICMPV6) {
3098 optval = icmp6off;
3099 } else {
3100 optval = in6p->in6p_cksum;
3101 }
3102
3103 error = sooptcopyout(sopt, &optval, sizeof(optval));
3104 break;
3105
3106 default:
3107 error = EINVAL;
3108 break;
3109 }
3110 break;
3111
3112 default:
3113 error = ENOPROTOOPT;
3114 break;
3115 }
3116
3117 return error;
3118 }
3119
3120 /*
3121 * Set up IP6 options in pcb for insertion in output packets or
3122 * specifying behavior of outgoing packets.
3123 */
3124 static int
ip6_pcbopts(struct ip6_pktopts ** pktopt,struct mbuf * m,struct socket * so,struct sockopt * sopt)3125 ip6_pcbopts(struct ip6_pktopts **pktopt, struct mbuf *m, struct socket *so,
3126 struct sockopt *sopt)
3127 {
3128 #pragma unused(sopt)
3129 struct ip6_pktopts *opt = *pktopt;
3130 int error = 0;
3131
3132 /* turn off any old options. */
3133 if (opt != NULL) {
3134 #if DIAGNOSTIC
3135 if (opt->ip6po_pktinfo || opt->ip6po_nexthop ||
3136 opt->ip6po_hbh || opt->ip6po_dest1 || opt->ip6po_dest2 ||
3137 opt->ip6po_rhinfo.ip6po_rhi_rthdr) {
3138 printf("%s: all specified options are cleared.\n",
3139 __func__);
3140 }
3141 #endif
3142 ip6_clearpktopts(opt, -1);
3143 } else {
3144 opt = kalloc_type(struct ip6_pktopts, Z_WAITOK | Z_NOFAIL);
3145 }
3146 *pktopt = NULL;
3147
3148 if (m == NULL || m->m_len == 0) {
3149 /*
3150 * Only turning off any previous options, regardless of
3151 * whether the opt is just created or given.
3152 */
3153 if (opt != NULL) {
3154 kfree_type(struct ip6_pktopts, opt);
3155 }
3156 return 0;
3157 }
3158
3159 /* set options specified by user. */
3160 if ((error = ip6_setpktopts(m, opt, NULL, SOCK_PROTO(so))) != 0) {
3161 ip6_clearpktopts(opt, -1); /* XXX: discard all options */
3162 kfree_type(struct ip6_pktopts, opt);
3163 return error;
3164 }
3165 *pktopt = opt;
3166 return 0;
3167 }
3168
3169 /*
3170 * initialize ip6_pktopts. beware that there are non-zero default values in
3171 * the struct.
3172 */
3173 void
ip6_initpktopts(struct ip6_pktopts * opt)3174 ip6_initpktopts(struct ip6_pktopts *opt)
3175 {
3176 bzero(opt, sizeof(*opt));
3177 opt->ip6po_hlim = -1; /* -1 means default hop limit */
3178 opt->ip6po_tclass = -1; /* -1 means default traffic class */
3179 opt->ip6po_minmtu = IP6PO_MINMTU_MCASTONLY;
3180 opt->ip6po_prefer_tempaddr = IP6PO_TEMPADDR_SYSTEM;
3181 }
3182
3183 static int
ip6_pcbopt(int optname,u_char * buf,int len,struct ip6_pktopts ** pktopt,int uproto)3184 ip6_pcbopt(int optname, u_char *buf, int len, struct ip6_pktopts **pktopt,
3185 int uproto)
3186 {
3187 struct ip6_pktopts *opt;
3188
3189 opt = *pktopt;
3190 if (opt == NULL) {
3191 opt = kalloc_type(struct ip6_pktopts, Z_WAITOK | Z_NOFAIL);
3192 ip6_initpktopts(opt);
3193 *pktopt = opt;
3194 }
3195
3196 return ip6_setpktopt(optname, buf, len, opt, 1, 0, uproto);
3197 }
3198
3199 static int
ip6_getpcbopt(struct ip6_pktopts * pktopt,int optname,struct sockopt * sopt)3200 ip6_getpcbopt(struct ip6_pktopts *pktopt, int optname, struct sockopt *sopt)
3201 {
3202 void *optdata = NULL;
3203 int optdatalen = 0;
3204 struct ip6_ext *ip6e;
3205 struct in6_pktinfo null_pktinfo;
3206 int deftclass = 0, on;
3207 int defminmtu = IP6PO_MINMTU_MCASTONLY;
3208 int defpreftemp = IP6PO_TEMPADDR_SYSTEM;
3209
3210
3211 switch (optname) {
3212 case IPV6_PKTINFO:
3213 if (pktopt && pktopt->ip6po_pktinfo) {
3214 optdata = (void *)pktopt->ip6po_pktinfo;
3215 } else {
3216 /* XXX: we don't have to do this every time... */
3217 bzero(&null_pktinfo, sizeof(null_pktinfo));
3218 optdata = (void *)&null_pktinfo;
3219 }
3220 optdatalen = sizeof(struct in6_pktinfo);
3221 break;
3222
3223 case IPV6_TCLASS:
3224 if (pktopt && pktopt->ip6po_tclass >= 0) {
3225 optdata = (void *)&pktopt->ip6po_tclass;
3226 } else {
3227 optdata = (void *)&deftclass;
3228 }
3229 optdatalen = sizeof(int);
3230 break;
3231
3232 case IPV6_HOPOPTS:
3233 if (pktopt && pktopt->ip6po_hbh) {
3234 optdata = (void *)pktopt->ip6po_hbh;
3235 ip6e = (struct ip6_ext *)pktopt->ip6po_hbh;
3236 optdatalen = (ip6e->ip6e_len + 1) << 3;
3237 }
3238 break;
3239
3240 case IPV6_RTHDR:
3241 if (pktopt && pktopt->ip6po_rthdr) {
3242 optdata = (void *)pktopt->ip6po_rthdr;
3243 ip6e = (struct ip6_ext *)pktopt->ip6po_rthdr;
3244 optdatalen = (ip6e->ip6e_len + 1) << 3;
3245 }
3246 break;
3247
3248 case IPV6_RTHDRDSTOPTS:
3249 if (pktopt && pktopt->ip6po_dest1) {
3250 optdata = (void *)pktopt->ip6po_dest1;
3251 ip6e = (struct ip6_ext *)pktopt->ip6po_dest1;
3252 optdatalen = (ip6e->ip6e_len + 1) << 3;
3253 }
3254 break;
3255
3256 case IPV6_DSTOPTS:
3257 if (pktopt && pktopt->ip6po_dest2) {
3258 optdata = (void *)pktopt->ip6po_dest2;
3259 ip6e = (struct ip6_ext *)pktopt->ip6po_dest2;
3260 optdatalen = (ip6e->ip6e_len + 1) << 3;
3261 }
3262 break;
3263
3264 case IPV6_NEXTHOP:
3265 if (pktopt && pktopt->ip6po_nexthop) {
3266 optdata = (void *)pktopt->ip6po_nexthop;
3267 optdatalen = pktopt->ip6po_nexthop->sa_len;
3268 }
3269 break;
3270
3271 case IPV6_USE_MIN_MTU:
3272 if (pktopt) {
3273 optdata = (void *)&pktopt->ip6po_minmtu;
3274 } else {
3275 optdata = (void *)&defminmtu;
3276 }
3277 optdatalen = sizeof(int);
3278 break;
3279
3280 case IPV6_DONTFRAG:
3281 if (pktopt && ((pktopt->ip6po_flags) & IP6PO_DONTFRAG)) {
3282 on = 1;
3283 } else {
3284 on = 0;
3285 }
3286 optdata = (void *)&on;
3287 optdatalen = sizeof(on);
3288 break;
3289
3290 case IPV6_PREFER_TEMPADDR:
3291 if (pktopt) {
3292 optdata = (void *)&pktopt->ip6po_prefer_tempaddr;
3293 } else {
3294 optdata = (void *)&defpreftemp;
3295 }
3296 optdatalen = sizeof(int);
3297 break;
3298
3299 default: /* should not happen */
3300 #ifdef DIAGNOSTIC
3301 panic("ip6_getpcbopt: unexpected option");
3302 #endif
3303 return ENOPROTOOPT;
3304 }
3305
3306 return sooptcopyout(sopt, optdata, optdatalen);
3307 }
3308
3309 void
ip6_clearpktopts(struct ip6_pktopts * pktopt,int optname)3310 ip6_clearpktopts(struct ip6_pktopts *pktopt, int optname)
3311 {
3312 if (pktopt == NULL) {
3313 return;
3314 }
3315
3316 if (optname == -1 || optname == IPV6_PKTINFO) {
3317 if (pktopt->ip6po_pktinfo) {
3318 kfree_type(struct in6_pktinfo, pktopt->ip6po_pktinfo);
3319 }
3320 pktopt->ip6po_pktinfo = NULL;
3321 }
3322 if (optname == -1 || optname == IPV6_HOPLIMIT) {
3323 pktopt->ip6po_hlim = -1;
3324 }
3325 if (optname == -1 || optname == IPV6_TCLASS) {
3326 pktopt->ip6po_tclass = -1;
3327 }
3328 if (optname == -1 || optname == IPV6_NEXTHOP) {
3329 ROUTE_RELEASE(&pktopt->ip6po_nextroute);
3330 if (pktopt->ip6po_nexthop) {
3331 kfree_data_addr(pktopt->ip6po_nexthop);
3332 }
3333 pktopt->ip6po_nexthop = NULL;
3334 }
3335 if (optname == -1 || optname == IPV6_HOPOPTS) {
3336 if (pktopt->ip6po_hbh) {
3337 kfree_data_addr(pktopt->ip6po_hbh);
3338 }
3339 pktopt->ip6po_hbh = NULL;
3340 }
3341 if (optname == -1 || optname == IPV6_RTHDRDSTOPTS) {
3342 if (pktopt->ip6po_dest1) {
3343 kfree_data_addr(pktopt->ip6po_dest1);
3344 }
3345 pktopt->ip6po_dest1 = NULL;
3346 }
3347 if (optname == -1 || optname == IPV6_RTHDR) {
3348 if (pktopt->ip6po_rhinfo.ip6po_rhi_rthdr) {
3349 kfree_data_addr(pktopt->ip6po_rhinfo.ip6po_rhi_rthdr);
3350 }
3351 pktopt->ip6po_rhinfo.ip6po_rhi_rthdr = NULL;
3352 ROUTE_RELEASE(&pktopt->ip6po_route);
3353 }
3354 if (optname == -1 || optname == IPV6_DSTOPTS) {
3355 if (pktopt->ip6po_dest2) {
3356 kfree_data_addr(pktopt->ip6po_dest2);
3357 }
3358 pktopt->ip6po_dest2 = NULL;
3359 }
3360 }
3361
3362 #define PKTOPT_EXTHDRCPY(type) do { \
3363 if (src->type) { \
3364 int hlen = \
3365 (((struct ip6_ext *)src->type)->ip6e_len + 1) << 3; \
3366 dst->type = kalloc_data(hlen, canwait); \
3367 if (dst->type == NULL && canwait == Z_NOWAIT) \
3368 goto bad; \
3369 bcopy(src->type, dst->type, hlen); \
3370 } \
3371 } while (0)
3372
3373 static int
copypktopts(struct ip6_pktopts * dst,struct ip6_pktopts * src,zalloc_flags_t canwait)3374 copypktopts(struct ip6_pktopts *dst, struct ip6_pktopts *src, zalloc_flags_t canwait)
3375 {
3376 if (dst == NULL || src == NULL) {
3377 printf("copypktopts: invalid argument\n");
3378 return EINVAL;
3379 }
3380
3381 dst->ip6po_hlim = src->ip6po_hlim;
3382 dst->ip6po_tclass = src->ip6po_tclass;
3383 dst->ip6po_flags = src->ip6po_flags;
3384 if (src->ip6po_pktinfo) {
3385 dst->ip6po_pktinfo = kalloc_type(struct in6_pktinfo, canwait);
3386 if (dst->ip6po_pktinfo == NULL && canwait == Z_NOWAIT) {
3387 goto bad;
3388 }
3389 *dst->ip6po_pktinfo = *src->ip6po_pktinfo;
3390 }
3391 if (src->ip6po_nexthop) {
3392 dst->ip6po_nexthop = kalloc_data(src->ip6po_nexthop->sa_len, canwait);
3393 if (dst->ip6po_nexthop == NULL && canwait == Z_NOWAIT) {
3394 goto bad;
3395 }
3396 bcopy(src->ip6po_nexthop, dst->ip6po_nexthop,
3397 src->ip6po_nexthop->sa_len);
3398 }
3399 PKTOPT_EXTHDRCPY(ip6po_hbh);
3400 PKTOPT_EXTHDRCPY(ip6po_dest1);
3401 PKTOPT_EXTHDRCPY(ip6po_dest2);
3402 PKTOPT_EXTHDRCPY(ip6po_rthdr); /* not copy the cached route */
3403 return 0;
3404
3405 bad:
3406 ip6_clearpktopts(dst, -1);
3407 return ENOBUFS;
3408 }
3409 #undef PKTOPT_EXTHDRCPY
3410
3411 struct ip6_pktopts *
ip6_copypktopts(struct ip6_pktopts * src,zalloc_flags_t canwait)3412 ip6_copypktopts(struct ip6_pktopts *src, zalloc_flags_t canwait)
3413 {
3414 int error;
3415 struct ip6_pktopts *dst;
3416
3417 dst = kalloc_type(struct ip6_pktopts, canwait);
3418 if (dst == NULL) {
3419 return NULL;
3420 }
3421 ip6_initpktopts(dst);
3422
3423 if ((error = copypktopts(dst, src, canwait)) != 0) {
3424 kfree_type(struct ip6_pktopts, dst);
3425 return NULL;
3426 }
3427
3428 return dst;
3429 }
3430
3431 void
ip6_freepcbopts(struct ip6_pktopts * pktopt)3432 ip6_freepcbopts(struct ip6_pktopts *pktopt)
3433 {
3434 if (pktopt == NULL) {
3435 return;
3436 }
3437
3438 ip6_clearpktopts(pktopt, -1);
3439
3440 kfree_type(struct ip6_pktopts, pktopt);
3441 }
3442
3443 void
ip6_moptions_init(void)3444 ip6_moptions_init(void)
3445 {
3446 PE_parse_boot_argn("ifa_debug", &im6o_debug, sizeof(im6o_debug));
3447
3448 vm_size_t im6o_size = (im6o_debug == 0) ? sizeof(struct ip6_moptions) :
3449 sizeof(struct ip6_moptions_dbg);
3450
3451 im6o_zone = zone_create(IM6O_ZONE_NAME, im6o_size, ZC_ZFREE_CLEARMEM);
3452 }
3453
3454 void
im6o_addref(struct ip6_moptions * im6o,int locked)3455 im6o_addref(struct ip6_moptions *im6o, int locked)
3456 {
3457 if (!locked) {
3458 IM6O_LOCK(im6o);
3459 } else {
3460 IM6O_LOCK_ASSERT_HELD(im6o);
3461 }
3462
3463 if (++im6o->im6o_refcnt == 0) {
3464 panic("%s: im6o %p wraparound refcnt", __func__, im6o);
3465 /* NOTREACHED */
3466 } else if (im6o->im6o_trace != NULL) {
3467 (*im6o->im6o_trace)(im6o, TRUE);
3468 }
3469
3470 if (!locked) {
3471 IM6O_UNLOCK(im6o);
3472 }
3473 }
3474
3475 void
im6o_remref(struct ip6_moptions * im6o)3476 im6o_remref(struct ip6_moptions *im6o)
3477 {
3478 int i;
3479
3480 IM6O_LOCK(im6o);
3481 if (im6o->im6o_refcnt == 0) {
3482 panic("%s: im6o %p negative refcnt", __func__, im6o);
3483 /* NOTREACHED */
3484 } else if (im6o->im6o_trace != NULL) {
3485 (*im6o->im6o_trace)(im6o, FALSE);
3486 }
3487
3488 --im6o->im6o_refcnt;
3489 if (im6o->im6o_refcnt > 0) {
3490 IM6O_UNLOCK(im6o);
3491 return;
3492 }
3493
3494 for (i = 0; i < im6o->im6o_num_memberships; ++i) {
3495 struct in6_mfilter *imf;
3496
3497 imf = im6o->im6o_mfilters ? &im6o->im6o_mfilters[i] : NULL;
3498 if (imf != NULL) {
3499 im6f_leave(imf);
3500 }
3501
3502 (void) in6_mc_leave(im6o->im6o_membership[i], imf);
3503
3504 if (imf != NULL) {
3505 im6f_purge(imf);
3506 }
3507
3508 IN6M_REMREF(im6o->im6o_membership[i]);
3509 im6o->im6o_membership[i] = NULL;
3510 }
3511 im6o->im6o_num_memberships = 0;
3512 IM6O_UNLOCK(im6o);
3513
3514 kfree_type(struct in6_multi *, im6o->im6o_max_memberships, im6o->im6o_membership);
3515 kfree_type(struct in6_mfilter, im6o->im6o_max_memberships, im6o->im6o_mfilters);
3516 lck_mtx_destroy(&im6o->im6o_lock, &ifa_mtx_grp);
3517
3518 if (!(im6o->im6o_debug & IFD_ALLOC)) {
3519 panic("%s: im6o %p cannot be freed", __func__, im6o);
3520 /* NOTREACHED */
3521 }
3522 zfree(im6o_zone, im6o);
3523 }
3524
3525 static void
im6o_trace(struct ip6_moptions * im6o,int refhold)3526 im6o_trace(struct ip6_moptions *im6o, int refhold)
3527 {
3528 struct ip6_moptions_dbg *im6o_dbg = (struct ip6_moptions_dbg *)im6o;
3529 ctrace_t *tr;
3530 u_int32_t idx;
3531 u_int16_t *cnt;
3532
3533 if (!(im6o->im6o_debug & IFD_DEBUG)) {
3534 panic("%s: im6o %p has no debug structure", __func__, im6o);
3535 /* NOTREACHED */
3536 }
3537 if (refhold) {
3538 cnt = &im6o_dbg->im6o_refhold_cnt;
3539 tr = im6o_dbg->im6o_refhold;
3540 } else {
3541 cnt = &im6o_dbg->im6o_refrele_cnt;
3542 tr = im6o_dbg->im6o_refrele;
3543 }
3544
3545 idx = os_atomic_inc_orig(cnt, relaxed) % IM6O_TRACE_HIST_SIZE;
3546 ctrace_record(&tr[idx]);
3547 }
3548
3549 struct ip6_moptions *
ip6_allocmoptions(zalloc_flags_t how)3550 ip6_allocmoptions(zalloc_flags_t how)
3551 {
3552 struct ip6_moptions *im6o;
3553
3554 im6o = zalloc_flags(im6o_zone, how | Z_ZERO);
3555 if (im6o != NULL) {
3556 lck_mtx_init(&im6o->im6o_lock, &ifa_mtx_grp, &ifa_mtx_attr);
3557 im6o->im6o_debug |= IFD_ALLOC;
3558 if (im6o_debug != 0) {
3559 im6o->im6o_debug |= IFD_DEBUG;
3560 im6o->im6o_trace = im6o_trace;
3561 }
3562 IM6O_ADDREF(im6o);
3563 }
3564
3565 return im6o;
3566 }
3567
3568 /*
3569 * Set IPv6 outgoing packet options based on advanced API.
3570 */
3571 int
ip6_setpktopts(struct mbuf * control,struct ip6_pktopts * opt,struct ip6_pktopts * stickyopt,int uproto)3572 ip6_setpktopts(struct mbuf *control, struct ip6_pktopts *opt,
3573 struct ip6_pktopts *stickyopt, int uproto)
3574 {
3575 struct cmsghdr *cm = NULL;
3576
3577 if (control == NULL || opt == NULL) {
3578 return EINVAL;
3579 }
3580
3581 ip6_initpktopts(opt);
3582 if (stickyopt) {
3583 int error;
3584
3585 /*
3586 * If stickyopt is provided, make a local copy of the options
3587 * for this particular packet, then override them by ancillary
3588 * objects.
3589 * XXX: copypktopts() does not copy the cached route to a next
3590 * hop (if any). This is not very good in terms of efficiency,
3591 * but we can allow this since this option should be rarely
3592 * used.
3593 */
3594 if ((error = copypktopts(opt, stickyopt, Z_NOWAIT)) != 0) {
3595 return error;
3596 }
3597 }
3598
3599 /*
3600 * XXX: Currently, we assume all the optional information is stored
3601 * in a single mbuf.
3602 */
3603 if (control->m_next) {
3604 return EINVAL;
3605 }
3606
3607 if (control->m_len < CMSG_LEN(0)) {
3608 return EINVAL;
3609 }
3610
3611 for (cm = M_FIRST_CMSGHDR(control);
3612 is_cmsg_valid(control, cm);
3613 cm = M_NXT_CMSGHDR(control, cm)) {
3614 int error;
3615
3616 if (cm->cmsg_level != IPPROTO_IPV6) {
3617 continue;
3618 }
3619
3620 error = ip6_setpktopt(cm->cmsg_type, CMSG_DATA(cm),
3621 cm->cmsg_len - CMSG_LEN(0), opt, 0, 1, uproto);
3622 if (error) {
3623 return error;
3624 }
3625 }
3626
3627 return 0;
3628 }
3629 /*
3630 * Set a particular packet option, as a sticky option or an ancillary data
3631 * item. "len" can be 0 only when it's a sticky option.
3632 * We have 4 cases of combination of "sticky" and "cmsg":
3633 * "sticky=0, cmsg=0": impossible
3634 * "sticky=0, cmsg=1": RFC2292 or RFC3542 ancillary data
3635 * "sticky=1, cmsg=0": RFC3542 socket option
3636 * "sticky=1, cmsg=1": RFC2292 socket option
3637 */
3638 static int
ip6_setpktopt(int optname,u_char * buf,int len,struct ip6_pktopts * opt,int sticky,int cmsg,int uproto)3639 ip6_setpktopt(int optname, u_char *buf, int len, struct ip6_pktopts *opt,
3640 int sticky, int cmsg, int uproto)
3641 {
3642 int minmtupolicy, preftemp;
3643 int error;
3644 boolean_t capture_exthdrstat_out = FALSE;
3645
3646 if (!sticky && !cmsg) {
3647 #ifdef DIAGNOSTIC
3648 printf("ip6_setpktopt: impossible case\n");
3649 #endif
3650 return EINVAL;
3651 }
3652
3653 /*
3654 * Caller must have ensured that the buffer is at least
3655 * aligned on 32-bit boundary.
3656 */
3657 VERIFY(IS_P2ALIGNED(buf, sizeof(u_int32_t)));
3658
3659 /*
3660 * IPV6_2292xxx is for backward compatibility to RFC2292, and should
3661 * not be specified in the context of RFC3542. Conversely,
3662 * RFC3542 types should not be specified in the context of RFC2292.
3663 */
3664 if (!cmsg) {
3665 switch (optname) {
3666 case IPV6_2292PKTINFO:
3667 case IPV6_2292HOPLIMIT:
3668 case IPV6_2292NEXTHOP:
3669 case IPV6_2292HOPOPTS:
3670 case IPV6_2292DSTOPTS:
3671 case IPV6_2292RTHDR:
3672 case IPV6_2292PKTOPTIONS:
3673 return ENOPROTOOPT;
3674 }
3675 }
3676 if (sticky && cmsg) {
3677 switch (optname) {
3678 case IPV6_PKTINFO:
3679 case IPV6_HOPLIMIT:
3680 case IPV6_NEXTHOP:
3681 case IPV6_HOPOPTS:
3682 case IPV6_DSTOPTS:
3683 case IPV6_RTHDRDSTOPTS:
3684 case IPV6_RTHDR:
3685 case IPV6_USE_MIN_MTU:
3686 case IPV6_DONTFRAG:
3687 case IPV6_TCLASS:
3688 case IPV6_PREFER_TEMPADDR: /* XXX: not an RFC3542 option */
3689 return ENOPROTOOPT;
3690 }
3691 }
3692
3693 switch (optname) {
3694 case IPV6_2292PKTINFO:
3695 case IPV6_PKTINFO: {
3696 struct ifnet *ifp = NULL;
3697 struct in6_pktinfo *pktinfo;
3698
3699 if (len != sizeof(struct in6_pktinfo)) {
3700 return EINVAL;
3701 }
3702
3703 pktinfo = (struct in6_pktinfo *)(void *)buf;
3704
3705 /*
3706 * An application can clear any sticky IPV6_PKTINFO option by
3707 * doing a "regular" setsockopt with ipi6_addr being
3708 * in6addr_any and ipi6_ifindex being zero.
3709 * [RFC 3542, Section 6]
3710 */
3711 if (optname == IPV6_PKTINFO && opt->ip6po_pktinfo &&
3712 pktinfo->ipi6_ifindex == 0 &&
3713 IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
3714 ip6_clearpktopts(opt, optname);
3715 break;
3716 }
3717
3718 if (uproto == IPPROTO_TCP && optname == IPV6_PKTINFO &&
3719 sticky && !IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
3720 return EINVAL;
3721 }
3722
3723 /* validate the interface index if specified. */
3724 ifnet_head_lock_shared();
3725
3726 if (pktinfo->ipi6_ifindex > if_index) {
3727 ifnet_head_done();
3728 return ENXIO;
3729 }
3730
3731 if (pktinfo->ipi6_ifindex) {
3732 ifp = ifindex2ifnet[pktinfo->ipi6_ifindex];
3733 if (ifp == NULL) {
3734 ifnet_head_done();
3735 return ENXIO;
3736 }
3737 }
3738
3739 ifnet_head_done();
3740
3741 /*
3742 * We store the address anyway, and let in6_selectsrc()
3743 * validate the specified address. This is because ipi6_addr
3744 * may not have enough information about its scope zone, and
3745 * we may need additional information (such as outgoing
3746 * interface or the scope zone of a destination address) to
3747 * disambiguate the scope.
3748 * XXX: the delay of the validation may confuse the
3749 * application when it is used as a sticky option.
3750 */
3751 if (opt->ip6po_pktinfo == NULL) {
3752 opt->ip6po_pktinfo = kalloc_type(struct in6_pktinfo, Z_NOWAIT);
3753 if (opt->ip6po_pktinfo == NULL) {
3754 return ENOBUFS;
3755 }
3756 }
3757 bcopy(pktinfo, opt->ip6po_pktinfo, sizeof(*pktinfo));
3758 break;
3759 }
3760
3761 case IPV6_2292HOPLIMIT:
3762 case IPV6_HOPLIMIT: {
3763 int *hlimp;
3764
3765 /*
3766 * RFC 3542 deprecated the usage of sticky IPV6_HOPLIMIT
3767 * to simplify the ordering among hoplimit options.
3768 */
3769 if (optname == IPV6_HOPLIMIT && sticky) {
3770 return ENOPROTOOPT;
3771 }
3772
3773 if (len != sizeof(int)) {
3774 return EINVAL;
3775 }
3776 hlimp = (int *)(void *)buf;
3777 if (*hlimp < -1 || *hlimp > IPV6_MAXHLIM) {
3778 return EINVAL;
3779 }
3780
3781 opt->ip6po_hlim = *hlimp;
3782 break;
3783 }
3784
3785 case IPV6_TCLASS: {
3786 int tclass;
3787
3788 if (len != sizeof(int)) {
3789 return EINVAL;
3790 }
3791 tclass = *(int *)(void *)buf;
3792 if (tclass < -1 || tclass > 255) {
3793 return EINVAL;
3794 }
3795
3796 opt->ip6po_tclass = tclass;
3797 break;
3798 }
3799
3800 case IPV6_2292NEXTHOP:
3801 case IPV6_NEXTHOP:
3802 error = suser(kauth_cred_get(), 0);
3803 if (error) {
3804 return EACCES;
3805 }
3806
3807 if (len == 0) { /* just remove the option */
3808 ip6_clearpktopts(opt, IPV6_NEXTHOP);
3809 break;
3810 }
3811
3812 /* check if cmsg_len is large enough for sa_len */
3813 if (len < sizeof(struct sockaddr) || len < *buf) {
3814 return EINVAL;
3815 }
3816
3817 switch (SA(buf)->sa_family) {
3818 case AF_INET6: {
3819 struct sockaddr_in6 *sa6 = SIN6(buf);
3820
3821 if (sa6->sin6_len != sizeof(struct sockaddr_in6)) {
3822 return EINVAL;
3823 }
3824
3825 if (IN6_IS_ADDR_UNSPECIFIED(&sa6->sin6_addr) ||
3826 IN6_IS_ADDR_MULTICAST(&sa6->sin6_addr)) {
3827 return EINVAL;
3828 }
3829 if ((error = sa6_embedscope(sa6, ip6_use_defzone, IN6_NULL_IF_EMBEDDED_SCOPE(&sa6->sin6_scope_id)))
3830 != 0) {
3831 return error;
3832 }
3833 break;
3834 }
3835 case AF_LINK: /* should eventually be supported */
3836 default:
3837 return EAFNOSUPPORT;
3838 }
3839
3840 /* turn off the previous option, then set the new option. */
3841 ip6_clearpktopts(opt, IPV6_NEXTHOP);
3842 opt->ip6po_nexthop = kalloc_data(*buf, Z_NOWAIT);
3843 if (opt->ip6po_nexthop == NULL) {
3844 return ENOBUFS;
3845 }
3846 bcopy(buf, opt->ip6po_nexthop, *buf);
3847 break;
3848
3849 case IPV6_2292HOPOPTS:
3850 case IPV6_HOPOPTS: {
3851 struct ip6_hbh *hbh;
3852 int hbhlen;
3853
3854 /*
3855 * XXX: We don't allow a non-privileged user to set ANY HbH
3856 * options, since per-option restriction has too much
3857 * overhead.
3858 */
3859 error = suser(kauth_cred_get(), 0);
3860 if (error) {
3861 return EACCES;
3862 }
3863
3864 if (len == 0) {
3865 ip6_clearpktopts(opt, IPV6_HOPOPTS);
3866 break; /* just remove the option */
3867 }
3868
3869 /* message length validation */
3870 if (len < sizeof(struct ip6_hbh)) {
3871 return EINVAL;
3872 }
3873 hbh = (struct ip6_hbh *)(void *)buf;
3874 hbhlen = (hbh->ip6h_len + 1) << 3;
3875 if (len != hbhlen) {
3876 return EINVAL;
3877 }
3878
3879 /* turn off the previous option, then set the new option. */
3880 ip6_clearpktopts(opt, IPV6_HOPOPTS);
3881 opt->ip6po_hbh = kalloc_data(hbhlen, Z_NOWAIT);
3882 if (opt->ip6po_hbh == NULL) {
3883 return ENOBUFS;
3884 }
3885 bcopy(hbh, opt->ip6po_hbh, hbhlen);
3886 capture_exthdrstat_out = TRUE;
3887 break;
3888 }
3889
3890 case IPV6_2292DSTOPTS:
3891 case IPV6_DSTOPTS:
3892 case IPV6_RTHDRDSTOPTS: {
3893 struct ip6_dest *dest, **newdest = NULL;
3894 int destlen;
3895
3896 error = suser(kauth_cred_get(), 0);
3897 if (error) {
3898 return EACCES;
3899 }
3900
3901 if (len == 0) {
3902 ip6_clearpktopts(opt, optname);
3903 break; /* just remove the option */
3904 }
3905
3906 /* message length validation */
3907 if (len < sizeof(struct ip6_dest)) {
3908 return EINVAL;
3909 }
3910 dest = (struct ip6_dest *)(void *)buf;
3911 destlen = (dest->ip6d_len + 1) << 3;
3912 if (len != destlen) {
3913 return EINVAL;
3914 }
3915
3916 /*
3917 * Determine the position that the destination options header
3918 * should be inserted; before or after the routing header.
3919 */
3920 switch (optname) {
3921 case IPV6_2292DSTOPTS:
3922 /*
3923 * The old advacned API is ambiguous on this point.
3924 * Our approach is to determine the position based
3925 * according to the existence of a routing header.
3926 * Note, however, that this depends on the order of the
3927 * extension headers in the ancillary data; the 1st
3928 * part of the destination options header must appear
3929 * before the routing header in the ancillary data,
3930 * too.
3931 * RFC3542 solved the ambiguity by introducing
3932 * separate ancillary data or option types.
3933 */
3934 if (opt->ip6po_rthdr == NULL) {
3935 newdest = &opt->ip6po_dest1;
3936 } else {
3937 newdest = &opt->ip6po_dest2;
3938 }
3939 break;
3940 case IPV6_RTHDRDSTOPTS:
3941 newdest = &opt->ip6po_dest1;
3942 break;
3943 case IPV6_DSTOPTS:
3944 newdest = &opt->ip6po_dest2;
3945 break;
3946 }
3947
3948 /* turn off the previous option, then set the new option. */
3949 ip6_clearpktopts(opt, optname);
3950 *newdest = kalloc_data(destlen, Z_NOWAIT);
3951 if (*newdest == NULL) {
3952 return ENOBUFS;
3953 }
3954 bcopy(dest, *newdest, destlen);
3955 capture_exthdrstat_out = TRUE;
3956 break;
3957 }
3958
3959 case IPV6_2292RTHDR:
3960 case IPV6_RTHDR: {
3961 struct ip6_rthdr *rth;
3962 int rthlen;
3963
3964 if (len == 0) {
3965 ip6_clearpktopts(opt, IPV6_RTHDR);
3966 break; /* just remove the option */
3967 }
3968
3969 /* message length validation */
3970 if (len < sizeof(struct ip6_rthdr)) {
3971 return EINVAL;
3972 }
3973 rth = (struct ip6_rthdr *)(void *)buf;
3974 rthlen = (rth->ip6r_len + 1) << 3;
3975 if (len != rthlen) {
3976 return EINVAL;
3977 }
3978
3979 switch (rth->ip6r_type) {
3980 case IPV6_RTHDR_TYPE_0:
3981 if (rth->ip6r_len == 0) { /* must contain one addr */
3982 return EINVAL;
3983 }
3984 if (rth->ip6r_len % 2) { /* length must be even */
3985 return EINVAL;
3986 }
3987 if (rth->ip6r_len / 2 != rth->ip6r_segleft) {
3988 return EINVAL;
3989 }
3990 break;
3991 default:
3992 return EINVAL; /* not supported */
3993 }
3994
3995 /* turn off the previous option */
3996 ip6_clearpktopts(opt, IPV6_RTHDR);
3997 opt->ip6po_rthdr = kalloc_data(rthlen, Z_NOWAIT);
3998 if (opt->ip6po_rthdr == NULL) {
3999 return ENOBUFS;
4000 }
4001 bcopy(rth, opt->ip6po_rthdr, rthlen);
4002 capture_exthdrstat_out = TRUE;
4003 break;
4004 }
4005
4006 case IPV6_USE_MIN_MTU:
4007 if (len != sizeof(int)) {
4008 return EINVAL;
4009 }
4010 minmtupolicy = *(int *)(void *)buf;
4011 if (minmtupolicy != IP6PO_MINMTU_MCASTONLY &&
4012 minmtupolicy != IP6PO_MINMTU_DISABLE &&
4013 minmtupolicy != IP6PO_MINMTU_ALL) {
4014 return EINVAL;
4015 }
4016 opt->ip6po_minmtu = minmtupolicy;
4017 break;
4018
4019 case IPV6_DONTFRAG:
4020 if (len != sizeof(int)) {
4021 return EINVAL;
4022 }
4023
4024 if (uproto == IPPROTO_TCP || *(int *)(void *)buf == 0) {
4025 /*
4026 * we ignore this option for TCP sockets.
4027 * (RFC3542 leaves this case unspecified.)
4028 */
4029 opt->ip6po_flags &= ~IP6PO_DONTFRAG;
4030 } else {
4031 opt->ip6po_flags |= IP6PO_DONTFRAG;
4032 }
4033 break;
4034
4035 case IPV6_PREFER_TEMPADDR:
4036 if (len != sizeof(int)) {
4037 return EINVAL;
4038 }
4039 preftemp = *(int *)(void *)buf;
4040 if (preftemp != IP6PO_TEMPADDR_SYSTEM &&
4041 preftemp != IP6PO_TEMPADDR_NOTPREFER &&
4042 preftemp != IP6PO_TEMPADDR_PREFER) {
4043 return EINVAL;
4044 }
4045 opt->ip6po_prefer_tempaddr = preftemp;
4046 break;
4047
4048 default:
4049 return ENOPROTOOPT;
4050 } /* end of switch */
4051
4052 if (capture_exthdrstat_out) {
4053 if (uproto == IPPROTO_TCP) {
4054 INC_ATOMIC_INT64_LIM(net_api_stats.nas_sock_inet6_stream_exthdr_out);
4055 } else if (uproto == IPPROTO_UDP) {
4056 INC_ATOMIC_INT64_LIM(net_api_stats.nas_sock_inet6_dgram_exthdr_out);
4057 }
4058 }
4059
4060 return 0;
4061 }
4062
4063 /*
4064 * Routine called from ip6_output() to loop back a copy of an IP6 multicast
4065 * packet to the input queue of a specified interface. Note that this
4066 * calls the output routine of the loopback "driver", but with an interface
4067 * pointer that might NOT be &loif -- easier than replicating that code here.
4068 */
4069 void
ip6_mloopback(struct ifnet * srcifp,struct ifnet * origifp,struct mbuf * m,struct sockaddr_in6 * dst,uint32_t optlen,int32_t nxt0)4070 ip6_mloopback(struct ifnet *srcifp, struct ifnet *origifp, struct mbuf *m,
4071 struct sockaddr_in6 *dst, uint32_t optlen, int32_t nxt0)
4072 {
4073 struct mbuf *copym;
4074 struct ip6_hdr *ip6;
4075 struct in6_addr src;
4076
4077 if (lo_ifp == NULL) {
4078 return;
4079 }
4080
4081 /*
4082 * Copy the packet header as it's needed for the checksum.
4083 * Make sure to deep-copy IPv6 header portion in case the data
4084 * is in an mbuf cluster, so that we can safely override the IPv6
4085 * header portion later.
4086 */
4087 copym = m_copym_mode(m, 0, M_COPYALL, M_DONTWAIT, NULL, NULL, M_COPYM_COPY_HDR);
4088 if (copym != NULL && ((copym->m_flags & M_EXT) ||
4089 copym->m_len < sizeof(struct ip6_hdr))) {
4090 copym = m_pullup(copym, sizeof(struct ip6_hdr));
4091 }
4092
4093 if (copym == NULL) {
4094 return;
4095 }
4096
4097 ip6 = mtod(copym, struct ip6_hdr *);
4098 src = ip6->ip6_src;
4099 /*
4100 * clear embedded scope identifiers if necessary.
4101 * in6_clearscope will touch the addresses only when necessary.
4102 */
4103 in6_clearscope(&ip6->ip6_src);
4104 in6_clearscope(&ip6->ip6_dst);
4105
4106 if (copym->m_pkthdr.csum_flags & CSUM_DELAY_IPV6_DATA) {
4107 in6_delayed_cksum_offset(copym, 0, optlen, nxt0);
4108 }
4109
4110 /*
4111 * Stuff the 'real' ifp into the pkthdr, to be used in matching
4112 * in ip6_input(); we need the loopback ifp/dl_tag passed as args
4113 * to make the loopback driver compliant with the data link
4114 * requirements.
4115 */
4116 copym->m_pkthdr.rcvif = origifp;
4117
4118 /*
4119 * Also record the source interface (which owns the source address).
4120 * This is basically a stripped down version of ifa_foraddr6().
4121 */
4122 if (srcifp == NULL) {
4123 struct in6_ifaddr *ia;
4124
4125 lck_rw_lock_shared(&in6_ifaddr_rwlock);
4126 TAILQ_FOREACH(ia, IN6ADDR_HASH(&src), ia6_hash) {
4127 IFA_LOCK_SPIN(&ia->ia_ifa);
4128 /* compare against src addr with embedded scope */
4129 if (in6_are_addr_equal_scoped(&ia->ia_addr.sin6_addr, &src, ia->ia_addr.sin6_scope_id, ip6_output_getsrcifscope(m))) {
4130 srcifp = ia->ia_ifp;
4131 IFA_UNLOCK(&ia->ia_ifa);
4132 break;
4133 }
4134 IFA_UNLOCK(&ia->ia_ifa);
4135 }
4136 lck_rw_done(&in6_ifaddr_rwlock);
4137 }
4138 if (srcifp != NULL) {
4139 ip6_setsrcifaddr_info(copym, srcifp->if_index, NULL);
4140 }
4141 ip6_setdstifaddr_info(copym, origifp->if_index, NULL);
4142
4143 dlil_output(lo_ifp, PF_INET6, copym, NULL, SA(dst), 0, NULL);
4144 }
4145
4146 /*
4147 * Chop IPv6 header off from the payload.
4148 */
4149 static int
ip6_splithdr(struct mbuf * m,struct ip6_exthdrs * exthdrs)4150 ip6_splithdr(struct mbuf *m, struct ip6_exthdrs *exthdrs)
4151 {
4152 struct mbuf *mh;
4153 struct ip6_hdr *ip6;
4154
4155 ip6 = mtod(m, struct ip6_hdr *);
4156 if (m->m_len > sizeof(*ip6)) {
4157 MGETHDR(mh, M_DONTWAIT, MT_HEADER); /* MAC-OK */
4158 if (mh == NULL) {
4159 m_freem(m);
4160 return ENOBUFS;
4161 }
4162 M_COPY_PKTHDR(mh, m);
4163 MH_ALIGN(mh, sizeof(*ip6));
4164 m->m_flags &= ~M_PKTHDR;
4165 m->m_len -= sizeof(*ip6);
4166 m->m_data += sizeof(*ip6);
4167 mh->m_next = m;
4168 m = mh;
4169 m->m_len = sizeof(*ip6);
4170 bcopy((caddr_t)ip6, mtod(m, caddr_t), sizeof(*ip6));
4171 }
4172 exthdrs->ip6e_ip6 = m;
4173 return 0;
4174 }
4175
4176 static void
ip6_output_checksum(struct ifnet * ifp,uint32_t mtu,struct mbuf * m,int nxt0,uint32_t tlen,uint32_t optlen)4177 ip6_output_checksum(struct ifnet *ifp, uint32_t mtu, struct mbuf *m,
4178 int nxt0, uint32_t tlen, uint32_t optlen)
4179 {
4180 uint32_t sw_csum, hwcap = ifp->if_hwassist;
4181
4182 if (!hwcksum_tx) {
4183 /* do all in software; checksum offload is disabled */
4184 sw_csum = CSUM_DELAY_IPV6_DATA & m->m_pkthdr.csum_flags;
4185 } else {
4186 /* do in software what the hardware cannot */
4187 sw_csum = m->m_pkthdr.csum_flags & ~IF_HWASSIST_CSUM_FLAGS(hwcap);
4188 }
4189
4190 if (optlen != 0) {
4191 sw_csum |= (CSUM_DELAY_IPV6_DATA &
4192 m->m_pkthdr.csum_flags);
4193 } else if ((sw_csum & CSUM_DELAY_IPV6_DATA) && (hwcap & CSUM_PARTIAL)) {
4194 /*
4195 * Partial checksum offload, ere), if no extension headers,
4196 * and TCP only (no UDP support, as the hardware may not be
4197 * able to convert +0 to -0 (0xffff) per RFC1122 4.1.3.4.
4198 * unless the interface supports "invert zero" capability.)
4199 */
4200 if (hwcksum_tx &&
4201 ((m->m_pkthdr.csum_flags & CSUM_TCPIPV6) ||
4202 ((hwcap & CSUM_ZERO_INVERT) &&
4203 (m->m_pkthdr.csum_flags & CSUM_ZERO_INVERT))) &&
4204 tlen <= mtu) {
4205 uint16_t start = sizeof(struct ip6_hdr);
4206 uint16_t ulpoff =
4207 m->m_pkthdr.csum_data & 0xffff;
4208 m->m_pkthdr.csum_flags |=
4209 (CSUM_DATA_VALID | CSUM_PARTIAL);
4210 m->m_pkthdr.csum_tx_stuff = (ulpoff + start);
4211 m->m_pkthdr.csum_tx_start = start;
4212 sw_csum = 0;
4213 } else {
4214 sw_csum |= (CSUM_DELAY_IPV6_DATA &
4215 m->m_pkthdr.csum_flags);
4216 }
4217 }
4218
4219 if (sw_csum & CSUM_DELAY_IPV6_DATA) {
4220 in6_delayed_cksum_offset(m, 0, optlen, nxt0);
4221 sw_csum &= ~CSUM_DELAY_IPV6_DATA;
4222 }
4223
4224 if (hwcksum_tx) {
4225 uint32_t delay_data = m->m_pkthdr.csum_flags & CSUM_DELAY_IPV6_DATA;
4226 uint32_t hw_csum = IF_HWASSIST_CSUM_FLAGS(hwcap);
4227
4228 /*
4229 * Drop off bits that aren't supported by hardware;
4230 * also make sure to preserve non-checksum related bits.
4231 */
4232 m->m_pkthdr.csum_flags =
4233 ((m->m_pkthdr.csum_flags & (hw_csum | CSUM_DATA_VALID)) |
4234 (m->m_pkthdr.csum_flags & ~IF_HWASSIST_CSUM_MASK));
4235
4236 /*
4237 * If hardware supports partial checksum but not delay_data,
4238 * add back delay_data.
4239 */
4240 if ((hw_csum & CSUM_PARTIAL) != 0 &&
4241 (hw_csum & delay_data) == 0) {
4242 m->m_pkthdr.csum_flags |= delay_data;
4243 }
4244 } else {
4245 /* drop all bits; checksum offload is disabled */
4246 m->m_pkthdr.csum_flags = 0;
4247 }
4248 }
4249
4250 /*
4251 * Compute IPv6 extension header length.
4252 */
4253 int
ip6_optlen(struct in6pcb * in6p)4254 ip6_optlen(struct in6pcb *in6p)
4255 {
4256 int len;
4257
4258 if (!in6p->in6p_outputopts) {
4259 return 0;
4260 }
4261
4262 len = 0;
4263 #define elen(x) \
4264 (((struct ip6_ext *)(x)) ? \
4265 (((struct ip6_ext *)(x))->ip6e_len + 1) << 3 : 0)
4266
4267 len += elen(in6p->in6p_outputopts->ip6po_hbh);
4268 if (in6p->in6p_outputopts->ip6po_rthdr) {
4269 /* dest1 is valid with rthdr only */
4270 len += elen(in6p->in6p_outputopts->ip6po_dest1);
4271 }
4272 len += elen(in6p->in6p_outputopts->ip6po_rthdr);
4273 len += elen(in6p->in6p_outputopts->ip6po_dest2);
4274 return len;
4275 #undef elen
4276 }
4277
4278 static int
4279 sysctl_reset_ip6_output_stats SYSCTL_HANDLER_ARGS
4280 {
4281 #pragma unused(arg1, arg2)
4282 int error, i;
4283
4284 i = ip6_output_measure;
4285 error = sysctl_handle_int(oidp, &i, 0, req);
4286 if (error || req->newptr == USER_ADDR_NULL) {
4287 goto done;
4288 }
4289 /* impose bounds */
4290 if (i < 0 || i > 1) {
4291 error = EINVAL;
4292 goto done;
4293 }
4294 if (ip6_output_measure != i && i == 1) {
4295 net_perf_initialize(&net_perf, ip6_output_measure_bins);
4296 }
4297 ip6_output_measure = i;
4298 done:
4299 return error;
4300 }
4301
4302 static int
4303 sysctl_ip6_output_measure_bins SYSCTL_HANDLER_ARGS
4304 {
4305 #pragma unused(arg1, arg2)
4306 int error;
4307 uint64_t i;
4308
4309 i = ip6_output_measure_bins;
4310 error = sysctl_handle_quad(oidp, &i, 0, req);
4311 if (error || req->newptr == USER_ADDR_NULL) {
4312 goto done;
4313 }
4314 /* validate data */
4315 if (!net_perf_validate_bins(i)) {
4316 error = EINVAL;
4317 goto done;
4318 }
4319 ip6_output_measure_bins = i;
4320 done:
4321 return error;
4322 }
4323
4324 static int
4325 sysctl_ip6_output_getperf SYSCTL_HANDLER_ARGS
4326 {
4327 #pragma unused(oidp, arg1, arg2)
4328 if (req->oldptr == USER_ADDR_NULL) {
4329 req->oldlen = (size_t)sizeof(struct ipstat);
4330 }
4331
4332 return SYSCTL_OUT(req, &net_perf, MIN(sizeof(net_perf), req->oldlen));
4333 }
4334
4335 void
ip6_output_setsrcifscope(struct mbuf * m,uint32_t src_idx,struct in6_ifaddr * ia6)4336 ip6_output_setsrcifscope(struct mbuf *m, uint32_t src_idx, struct in6_ifaddr *ia6)
4337 {
4338 VERIFY(m->m_flags & M_PKTHDR);
4339
4340 m->m_pkthdr.pkt_ext_flags |= PKTF_EXT_OUTPUT_SCOPE;
4341 if (ia6 != NULL) {
4342 m->m_pkthdr.src_ifindex = ia6->ia_ifp->if_index;
4343 } else {
4344 m->m_pkthdr.src_ifindex = (uint16_t)src_idx;
4345 }
4346 }
4347
4348 void
ip6_output_setdstifscope(struct mbuf * m,uint32_t dst_idx,struct in6_ifaddr * ia6)4349 ip6_output_setdstifscope(struct mbuf *m, uint32_t dst_idx, struct in6_ifaddr *ia6)
4350 {
4351 VERIFY(m->m_flags & M_PKTHDR);
4352
4353 m->m_pkthdr.pkt_ext_flags |= PKTF_EXT_OUTPUT_SCOPE;
4354 if (ia6 != NULL) {
4355 m->m_pkthdr.dst_ifindex = ia6->ia_ifp->if_index;
4356 } else {
4357 m->m_pkthdr.dst_ifindex = (uint16_t)dst_idx;
4358 }
4359 }
4360
4361 uint32_t
ip6_output_getsrcifscope(struct mbuf * m)4362 ip6_output_getsrcifscope(struct mbuf *m)
4363 {
4364 VERIFY(m->m_flags & M_PKTHDR);
4365 if (in6_embedded_scope_debug) {
4366 VERIFY(m->m_pkthdr.pkt_ext_flags & PKTF_EXT_OUTPUT_SCOPE);
4367 VERIFY((m->m_pkthdr.pkt_flags & PKTF_IFAINFO) == 0);
4368 }
4369
4370 return m->m_pkthdr.src_ifindex;
4371 }
4372
4373 uint32_t
ip6_output_getdstifscope(struct mbuf * m)4374 ip6_output_getdstifscope(struct mbuf *m)
4375 {
4376 VERIFY(m->m_flags & M_PKTHDR);
4377 if (in6_embedded_scope_debug) {
4378 VERIFY(m->m_pkthdr.pkt_ext_flags & PKTF_EXT_OUTPUT_SCOPE);
4379 VERIFY((m->m_pkthdr.pkt_flags & PKTF_IFAINFO) == 0);
4380 }
4381
4382 return m->m_pkthdr.dst_ifindex;
4383 }
4384