1 /*
2 * Copyright (c) 2000-2024 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28
29 /*
30 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
31 * All rights reserved.
32 *
33 * Redistribution and use in source and binary forms, with or without
34 * modification, are permitted provided that the following conditions
35 * are met:
36 * 1. Redistributions of source code must retain the above copyright
37 * notice, this list of conditions and the following disclaimer.
38 * 2. Redistributions in binary form must reproduce the above copyright
39 * notice, this list of conditions and the following disclaimer in the
40 * documentation and/or other materials provided with the distribution.
41 * 3. Neither the name of the project nor the names of its contributors
42 * may be used to endorse or promote products derived from this software
43 * without specific prior written permission.
44 *
45 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
46 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
47 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
48 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
49 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
50 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
51 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
52 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
53 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
54 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
55 * SUCH DAMAGE.
56 */
57
58 /*
59 * Copyright (c) 1982, 1986, 1988, 1990, 1993
60 * The Regents of the University of California. All rights reserved.
61 *
62 * Redistribution and use in source and binary forms, with or without
63 * modification, are permitted provided that the following conditions
64 * are met:
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
67 * 2. Redistributions in binary form must reproduce the above copyright
68 * notice, this list of conditions and the following disclaimer in the
69 * documentation and/or other materials provided with the distribution.
70 * 3. All advertising materials mentioning features or use of this software
71 * must display the following acknowledgement:
72 * This product includes software developed by the University of
73 * California, Berkeley and its contributors.
74 * 4. Neither the name of the University nor the names of its contributors
75 * may be used to endorse or promote products derived from this software
76 * without specific prior written permission.
77 *
78 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
79 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
80 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
81 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
82 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
83 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
84 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
85 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
86 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
87 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
88 * SUCH DAMAGE.
89 *
90 * @(#)ip_output.c 8.3 (Berkeley) 1/21/94
91 */
92 /*
93 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
94 * support for mandatory and extensible security protections. This notice
95 * is included in support of clause 2.2 (b) of the Apple Public License,
96 * Version 2.0.
97 */
98
99 #include <sys/param.h>
100 #include <sys/malloc.h>
101 #include <sys/mbuf.h>
102 #include <sys/errno.h>
103 #include <sys/protosw.h>
104 #include <sys/socket.h>
105 #include <sys/socketvar.h>
106 #include <sys/systm.h>
107 #include <sys/kernel.h>
108 #include <sys/proc.h>
109 #include <sys/kauth.h>
110 #include <sys/mcache.h>
111 #include <sys/sysctl.h>
112 #include <kern/zalloc.h>
113 #include <libkern/OSByteOrder.h>
114
115 #include <pexpert/pexpert.h>
116 #include <mach/sdt.h>
117
118 #include <net/if.h>
119 #include <net/route.h>
120 #include <net/dlil.h>
121 #include <net/net_api_stats.h>
122 #include <net/net_osdep.h>
123 #include <net/net_perf.h>
124 #include <net/droptap.h>
125
126 #include <netinet/ip.h>
127 #include <netinet/in.h>
128 #include <netinet/in_var.h>
129 #include <netinet/ip_var.h>
130 #include <netinet6/in6_var.h>
131 #include <netinet/ip6.h>
132 #include <netinet/kpi_ipfilter_var.h>
133 #include <netinet/in_tclass.h>
134
135 #include <netinet6/ip6protosw.h>
136 #include <netinet/icmp6.h>
137 #include <netinet6/ip6_var.h>
138 #include <netinet/in_pcb.h>
139 #include <netinet6/nd6.h>
140 #include <netinet6/scope6_var.h>
141 #if IPSEC
142 #include <netinet6/ipsec.h>
143 #include <netinet6/ipsec6.h>
144 #include <netkey/key.h>
145 extern int ipsec_bypass;
146 #endif /* IPSEC */
147
148 #if NECP
149 #include <net/necp.h>
150 #endif /* NECP */
151
152 #if DUMMYNET
153 #include <netinet/ip_dummynet.h>
154 #endif /* DUMMYNET */
155
156 #if PF
157 #include <net/pfvar.h>
158 #endif /* PF */
159
160 #include <net/sockaddr_utils.h>
161
162 static int sysctl_reset_ip6_output_stats SYSCTL_HANDLER_ARGS;
163 static int sysctl_ip6_output_measure_bins SYSCTL_HANDLER_ARGS;
164 static int sysctl_ip6_output_getperf SYSCTL_HANDLER_ARGS;
165 static int ip6_copyexthdr(struct mbuf **, caddr_t __indexable, int);
166 static void ip6_out_cksum_stats(int, u_int32_t);
167 static int ip6_insert_jumboopt(struct ip6_exthdrs *, u_int32_t);
168 static int ip6_insertfraghdr(struct mbuf *, struct mbuf *, int,
169 struct ip6_frag **);
170 static int ip6_getpmtu(struct route_in6 *, struct route_in6 *,
171 struct ifnet *, struct in6_addr *, uint32_t, u_int32_t *);
172 static int ip6_pcbopts(struct ip6_pktopts **, struct mbuf *, struct socket *,
173 struct sockopt *sopt);
174 static int ip6_pcbopt(int, u_char *buf __sized_by(len), int len, struct ip6_pktopts **, int);
175 static int ip6_getpcbopt(struct ip6_pktopts *, int, struct sockopt *);
176 static int copypktopts(struct ip6_pktopts *, struct ip6_pktopts *, zalloc_flags_t);
177 static void im6o_trace(struct ip6_moptions *, int);
178 static int ip6_setpktopt(int, uint8_t * __sized_by(len), int len, struct ip6_pktopts *, int,
179 int, int);
180 static int ip6_splithdr(struct mbuf *, struct ip6_exthdrs *);
181 static void ip6_output_checksum(struct ifnet *, uint32_t, struct mbuf *,
182 int, uint32_t, uint32_t);
183 extern int udp_ctloutput(struct socket *, struct sockopt *);
184 static int ip6_fragment_packet(struct mbuf **m,
185 struct ip6_pktopts *opt, struct ip6_out_args * ip6oa,
186 struct ip6_exthdrs *exthdrsp, struct ifnet *ifp,
187 uint32_t mtu, uint32_t unfragpartlen,
188 int nxt0, uint32_t optlen);
189
190 SYSCTL_DECL(_net_inet6_ip6);
191
192 static int ip6_output_measure = 0;
193 SYSCTL_PROC(_net_inet6_ip6, OID_AUTO, output_perf,
194 CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_LOCKED,
195 &ip6_output_measure, 0, sysctl_reset_ip6_output_stats, "I", "Do time measurement");
196
197 static uint64_t ip6_output_measure_bins = 0;
198 SYSCTL_PROC(_net_inet6_ip6, OID_AUTO, output_perf_bins,
199 CTLTYPE_QUAD | CTLFLAG_RW | CTLFLAG_LOCKED, &ip6_output_measure_bins, 0,
200 sysctl_ip6_output_measure_bins, "I",
201 "bins for chaining performance data histogram");
202
203 static net_perf_t net_perf;
204 SYSCTL_PROC(_net_inet6_ip6, OID_AUTO, output_perf_data,
205 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED,
206 0, 0, sysctl_ip6_output_getperf, "S,net_perf",
207 "IP6 output performance data (struct net_perf, net/net_perf.h)");
208
209 #define IM6O_TRACE_HIST_SIZE 32 /* size of trace history */
210
211 #define GET_IP6EXTHDR(s, t, f) \
212 __unsafe_forge_bidi_indexable(t, s->f, (((struct ip6_ext *)s->f)->ip6e_len + 1) << 3)
213
214 /* For gdb */
215 __private_extern__ unsigned int im6o_trace_hist_size = IM6O_TRACE_HIST_SIZE;
216
217 struct ip6_moptions_dbg {
218 struct ip6_moptions im6o; /* ip6_moptions */
219 u_int16_t im6o_refhold_cnt; /* # of IM6O_ADDREF */
220 u_int16_t im6o_refrele_cnt; /* # of IM6O_REMREF */
221 /*
222 * Alloc and free callers.
223 */
224 ctrace_t im6o_alloc;
225 ctrace_t im6o_free;
226 /*
227 * Circular lists of IM6O_ADDREF and IM6O_REMREF callers.
228 */
229 ctrace_t im6o_refhold[IM6O_TRACE_HIST_SIZE];
230 ctrace_t im6o_refrele[IM6O_TRACE_HIST_SIZE];
231 };
232
233 #if DEBUG
234 static unsigned int im6o_debug = 1; /* debugging (enabled) */
235 #else
236 static unsigned int im6o_debug; /* debugging (disabled) */
237 #endif /* !DEBUG */
238
239 ZONE_DECLARE(im6o_zone, struct ip6_moptions);
240 #define IM6O_ZONE_NAME "ip6_moptions" /* zone name */
241 zone_t im6o_zone = {0}; /* zone for *ip6_moptions */
242
243 /*
244 * ip6_output() calls ip6_output_list() to do the work
245 */
246 int
ip6_output(struct mbuf * m0,struct ip6_pktopts * opt,struct route_in6 * ro,int flags,struct ip6_moptions * im6o,struct ifnet ** ifpp,struct ip6_out_args * ip6oa)247 ip6_output(struct mbuf *m0, struct ip6_pktopts *opt,
248 struct route_in6 *ro, int flags, struct ip6_moptions *im6o,
249 struct ifnet **ifpp, struct ip6_out_args *ip6oa)
250 {
251 return ip6_output_list(m0, 0, opt, ro, flags, im6o, ifpp, ip6oa);
252 }
253
254 /*
255 * IP6 output. Each packet in mbuf chain m contains a skeletal IP6
256 * header (with pri, len, nxt, hlim, src, dst).
257 * This function may modify ver and hlim only.
258 * The mbuf chain containing the packet will be freed.
259 * The mbuf opt, if present, will not be freed.
260 *
261 * If ro is non-NULL and has valid ro->ro_rt, route lookup would be
262 * skipped and ro->ro_rt would be used. Otherwise the result of route
263 * lookup is stored in ro->ro_rt.
264 *
265 * type of "mtu": rt_rmx.rmx_mtu is u_int32_t, ifnet.ifr_mtu is int, and
266 * nd_ifinfo.linkmtu is u_int32_t. so we use u_int32_t to hold largest one,
267 * which is rt_rmx.rmx_mtu.
268 */
269 int
ip6_output_list(struct mbuf * m0,int packetchain,struct ip6_pktopts * opt,struct route_in6 * ro,int flags,struct ip6_moptions * im6o,struct ifnet ** ifpp,struct ip6_out_args * ip6oa)270 ip6_output_list(struct mbuf *m0, int packetchain, struct ip6_pktopts *opt,
271 struct route_in6 *ro, int flags, struct ip6_moptions *im6o,
272 struct ifnet **ifpp, struct ip6_out_args *ip6oa)
273 {
274 struct ip6_hdr *__single ip6;
275 u_char *__single nexthdrp;
276 ifnet_ref_t ifp = NULL, origifp = NULL; /* refcnt'd */
277 ifnet_ref_t *ifpp_save = ifpp;
278 mbuf_ref_t m, mprev;
279 mbuf_ref_t sendchain = NULL, sendchain_last = NULL;
280 mbuf_ref_t inputchain = NULL;
281 int nxt0 = 0;
282 struct route_in6 *__single ro_pmtu = NULL;
283 rtentry_ref_t rt = NULL;
284 struct sockaddr_in6 *__single dst = NULL;
285 struct sockaddr_in6 src_sa, dst_sa;
286 int error = 0;
287 struct in6_ifaddr *__single ia = NULL, *__single src_ia = NULL;
288 u_int32_t mtu = 0;
289 u_int32_t optlen = 0, plen = 0, unfragpartlen = 0;
290 struct ip6_rthdr *__single rh;
291 struct in6_addr finaldst;
292 ipfilter_t __single inject_filter_ref;
293 struct ipf_pktopts *__single ippo = NULL;
294 struct flowadv *__single adv = NULL;
295 uint32_t pktcnt = 0;
296 uint32_t packets_processed = 0;
297 struct timeval start_tv;
298 #if PF
299 boolean_t skip_pf = (ip6oa != NULL) &&
300 (ip6oa->ip6oa_flags & IP6OAF_SKIP_PF);
301 #endif
302
303 #if DUMMYNET
304 struct m_tag *__single tag;
305 struct ip6_out_args saved_ip6oa;
306 struct sockaddr_in6 dst_buf;
307 #endif /* DUMMYNET */
308 #if IPSEC
309 struct socket *__single so = NULL;
310 struct secpolicy *__single sp = NULL;
311 struct route_in6 *__single ipsec_saved_route = NULL;
312 boolean_t needipsectun = FALSE;
313 #endif /* IPSEC */
314 #if NECP
315 necp_kernel_policy_result necp_result = 0;
316 necp_kernel_policy_result_parameter necp_result_parameter;
317 necp_kernel_policy_id necp_matched_policy_id = 0;
318 #endif /* NECP */
319 struct {
320 struct ipf_pktopts ipf_pktopts;
321 struct ip6_exthdrs exthdrs;
322 struct route_in6 ip6route;
323 #if IPSEC
324 struct ipsec_output_state ipsec_state;
325 #endif /* IPSEC */
326 #if NECP
327 struct route_in6 necp_route;
328 #endif /* NECP */
329 #if DUMMYNET
330 struct route_in6 saved_route;
331 struct route_in6 saved_ro_pmtu;
332 struct ip_fw_args args;
333 #endif /* DUMMYNET */
334 } ip6obz;
335 #define ipf_pktopts ip6obz.ipf_pktopts
336 #define exthdrs ip6obz.exthdrs
337 #define ip6route ip6obz.ip6route
338 #define ipsec_state ip6obz.ipsec_state
339 #define necp_route ip6obz.necp_route
340 #define saved_route ip6obz.saved_route
341 #define saved_ro_pmtu ip6obz.saved_ro_pmtu
342 #define args ip6obz.args
343 union {
344 struct {
345 boolean_t select_srcif : 1;
346 boolean_t hdrsplit : 1;
347 boolean_t route_selected : 1;
348 boolean_t dontfrag : 1;
349 #if IPSEC
350 boolean_t needipsec : 1;
351 boolean_t noipsec : 1;
352 #endif /* IPSEC */
353 };
354 uint32_t raw;
355 } ip6obf = { .raw = 0 };
356 drop_reason_t drop_reason = DROP_REASON_UNSPECIFIED;
357
358 if (ip6_output_measure) {
359 net_perf_start_time(&net_perf, &start_tv);
360 }
361
362 VERIFY(m0->m_flags & M_PKTHDR);
363
364 /* zero out {saved_route, saved_ro_pmtu, ip6route, exthdrs, args} */
365 bzero(&ip6obz, sizeof(ip6obz));
366
367 #if DUMMYNET
368 if (SLIST_EMPTY(&m0->m_pkthdr.tags)) {
369 goto tags_done;
370 }
371
372 /* Grab info from mtags prepended to the chain */
373 if ((tag = m_tag_locate(m0, KERNEL_MODULE_TAG_ID,
374 KERNEL_TAG_TYPE_DUMMYNET)) != NULL) {
375 struct dn_pkt_tag *__single dn_tag;
376
377 /*
378 * ip6_output_list() cannot handle chains of packets reinjected
379 * by dummynet. The same restriction applies to
380 * ip_output_list().
381 */
382 VERIFY(0 == packetchain);
383
384 dn_tag = (struct dn_pkt_tag *)(tag->m_tag_data);
385 args.fwa_pf_rule = dn_tag->dn_pf_rule;
386
387 SOCKADDR_COPY(&dn_tag->dn_dst6, &dst_buf, sizeof(dst_buf));
388 dst = &dst_buf;
389 ifp = dn_tag->dn_ifp;
390 if (ifp != NULL) {
391 ifnet_reference(ifp);
392 }
393 flags = dn_tag->dn_flags;
394 if (dn_tag->dn_flags & IPV6_OUTARGS) {
395 saved_ip6oa = dn_tag->dn_ip6oa;
396 ip6oa = &saved_ip6oa;
397 }
398
399 saved_route = dn_tag->dn_ro6;
400 ro = &saved_route;
401 saved_ro_pmtu = dn_tag->dn_ro6_pmtu;
402 ro_pmtu = &saved_ro_pmtu;
403 origifp = dn_tag->dn_origifp;
404 if (origifp != NULL) {
405 ifnet_reference(origifp);
406 }
407 mtu = dn_tag->dn_mtu;
408 unfragpartlen = dn_tag->dn_unfragpartlen;
409
410 bcopy(&dn_tag->dn_exthdrs, &exthdrs, sizeof(exthdrs));
411
412 m_tag_delete(m0, tag);
413 }
414
415 tags_done:
416 #endif /* DUMMYNET */
417
418 m = m0;
419
420 #if IPSEC
421 if (ipsec_bypass == 0) {
422 so = ipsec_getsocket(m);
423 if (so != NULL) {
424 (void) ipsec_setsocket(m, NULL);
425 }
426 /* If packet is bound to an interface, check bound policies */
427 if ((flags & IPV6_OUTARGS) &&
428 (ip6oa->ip6oa_flags & IP6OAF_BOUND_IF) &&
429 ip6oa->ip6oa_boundif != IFSCOPE_NONE) {
430 /* ip6obf.noipsec is a bitfield, use temp integer */
431 int noipsec = 0;
432
433 if (ipsec6_getpolicybyinterface(m, IPSEC_DIR_OUTBOUND,
434 flags, ip6oa, &noipsec, &sp) != 0) {
435 drop_reason = DROP_REASON_IP_OUTBOUND_IPSEC_POLICY;
436 goto bad;
437 }
438
439 ip6obf.noipsec = (noipsec != 0);
440 }
441 }
442 #endif /* IPSEC */
443
444 ippo = &ipf_pktopts;
445
446 if (flags & IPV6_OUTARGS) {
447 /*
448 * In the forwarding case, only the ifscope value is used,
449 * as source interface selection doesn't take place.
450 */
451 if ((ip6obf.select_srcif = (!(flags & (IPV6_FORWARDING |
452 IPV6_UNSPECSRC | IPV6_FLAG_NOSRCIFSEL)) &&
453 (ip6oa->ip6oa_flags & IP6OAF_SELECT_SRCIF)))) {
454 ipf_pktopts.ippo_flags |= IPPOF_SELECT_SRCIF;
455 }
456
457 if ((ip6oa->ip6oa_flags & IP6OAF_BOUND_IF) &&
458 ip6oa->ip6oa_boundif != IFSCOPE_NONE) {
459 ipf_pktopts.ippo_flags |= (IPPOF_BOUND_IF |
460 (ip6oa->ip6oa_boundif << IPPOF_SHIFT_IFSCOPE));
461 }
462
463 if (ip6oa->ip6oa_flags & IP6OAF_BOUND_SRCADDR) {
464 ipf_pktopts.ippo_flags |= IPPOF_BOUND_SRCADDR;
465 }
466 } else {
467 ip6obf.select_srcif = FALSE;
468 if (flags & IPV6_OUTARGS) {
469 ip6oa->ip6oa_boundif = IFSCOPE_NONE;
470 ip6oa->ip6oa_flags &= ~(IP6OAF_SELECT_SRCIF |
471 IP6OAF_BOUND_IF | IP6OAF_BOUND_SRCADDR);
472 }
473 }
474
475 if (flags & IPV6_OUTARGS) {
476 if (ip6oa->ip6oa_flags & IP6OAF_NO_CELLULAR) {
477 ipf_pktopts.ippo_flags |= IPPOF_NO_IFT_CELLULAR;
478 }
479 if (ip6oa->ip6oa_flags & IP6OAF_NO_EXPENSIVE) {
480 ipf_pktopts.ippo_flags |= IPPOF_NO_IFF_EXPENSIVE;
481 }
482 if (ip6oa->ip6oa_flags & IP6OAF_NO_CONSTRAINED) {
483 ipf_pktopts.ippo_flags |= IPPOF_NO_IFF_CONSTRAINED;
484 }
485 adv = &ip6oa->ip6oa_flowadv;
486 adv->code = FADV_SUCCESS;
487 ip6oa->ip6oa_flags &= ~IP6OAF_RET_MASK;
488 }
489
490 /*
491 * Clear out ifpp to be filled in after determining route. ifpp_save is
492 * used to keep old value to release reference properly and dtrace
493 * ipsec tunnel traffic properly.
494 */
495 if (ifpp != NULL && *ifpp != NULL) {
496 *ifpp = NULL;
497 }
498
499 #if DUMMYNET
500 if (args.fwa_pf_rule) {
501 ip6 = mtod(m, struct ip6_hdr *);
502 VERIFY(ro != NULL); /* ro == saved_route */
503 goto check_with_pf;
504 }
505 #endif /* DUMMYNET */
506
507 #if NECP
508 /*
509 * Since all packets are assumed to come from same socket, necp lookup
510 * only needs to happen once per function entry.
511 */
512 necp_matched_policy_id = necp_ip6_output_find_policy_match(m, flags,
513 (flags & IPV6_OUTARGS) ? ip6oa : NULL, ro ? ro->ro_rt : NULL, &necp_result,
514 &necp_result_parameter);
515 #endif /* NECP */
516
517 /*
518 * If a chain was passed in, prepare for ther first iteration. For all
519 * other iterations, this work will be done at evaluateloop: label.
520 */
521 if (packetchain) {
522 /*
523 * Remove m from the chain during processing to avoid
524 * accidental frees on entire list.
525 */
526 inputchain = m->m_nextpkt;
527 m->m_nextpkt = NULL;
528 }
529
530 loopit:
531 packets_processed++;
532 m->m_pkthdr.pkt_flags &= ~(PKTF_LOOP | PKTF_IFAINFO);
533 ip6 = mtod(m, struct ip6_hdr *);
534 nxt0 = ip6->ip6_nxt;
535 finaldst = ip6->ip6_dst;
536 ip6obf.hdrsplit = FALSE;
537 ro_pmtu = NULL;
538
539 if (!SLIST_EMPTY(&m->m_pkthdr.tags)) {
540 inject_filter_ref = ipf_get_inject_filter(m);
541 } else {
542 inject_filter_ref = NULL;
543 }
544
545 #define MAKE_EXTHDR(hp, mp) do { \
546 if (hp != NULL) { \
547 struct ip6_ext *__single eh = (struct ip6_ext *)(hp); \
548 error = ip6_copyexthdr((mp), (caddr_t)(hp), \
549 ((eh)->ip6e_len + 1) << 3); \
550 if (error) \
551 goto freehdrs; \
552 } \
553 } while (0)
554
555 if (opt != NULL) {
556 /* Hop-by-Hop options header */
557 MAKE_EXTHDR(GET_IP6EXTHDR(opt, struct ip6_hbh*, ip6po_hbh), &exthdrs.ip6e_hbh);
558 /* Destination options header(1st part) */
559 if (opt->ip6po_rthdr) {
560 /*
561 * Destination options header(1st part)
562 * This only makes sense with a routing header.
563 * See Section 9.2 of RFC 3542.
564 * Disabling this part just for MIP6 convenience is
565 * a bad idea. We need to think carefully about a
566 * way to make the advanced API coexist with MIP6
567 * options, which might automatically be inserted in
568 * the kernel.
569 */
570 MAKE_EXTHDR(GET_IP6EXTHDR(opt, struct ip6_dest*, ip6po_dest1), &exthdrs.ip6e_dest1);
571 }
572 /* Routing header */
573 MAKE_EXTHDR(GET_IP6EXTHDR(opt, struct ip6_rthdr*, ip6po_rthdr), &exthdrs.ip6e_rthdr);
574 /* Destination options header(2nd part) */
575 MAKE_EXTHDR(GET_IP6EXTHDR(opt, struct ip6_dest*, ip6po_dest2), &exthdrs.ip6e_dest2);
576 }
577
578 #undef MAKE_EXTHDR
579
580 #if NECP
581 if (necp_matched_policy_id) {
582 necp_mark_packet_from_ip(m, necp_matched_policy_id);
583
584 switch (necp_result) {
585 case NECP_KERNEL_POLICY_RESULT_PASS:
586 if (necp_result_parameter.pass_flags & NECP_KERNEL_POLICY_PASS_NO_SKIP_IPSEC) {
587 break;
588 }
589 goto skip_ipsec;
590 case NECP_KERNEL_POLICY_RESULT_DROP:
591 error = EHOSTUNREACH;
592 ip6stat.ip6s_necp_policy_drop++;
593 drop_reason = DROP_REASON_IP_NECP_POLICY_DROP;
594 goto freehdrs;
595 case NECP_KERNEL_POLICY_RESULT_SOCKET_DIVERT:
596 /*
597 * Flow divert packets should be blocked at the IP
598 * layer.
599 */
600 error = EHOSTUNREACH;
601 ip6stat.ip6s_necp_policy_drop++;
602 drop_reason = DROP_REASON_IP_NECP_POLICY_SOCKET_DIVERT;
603 goto freehdrs;
604 case NECP_KERNEL_POLICY_RESULT_IP_TUNNEL: {
605 /*
606 * Verify that the packet is being routed to the tunnel
607 */
608 struct ifnet *__single policy_ifp =
609 necp_get_ifnet_from_result_parameter(
610 &necp_result_parameter);
611
612 /*
613 * Update the QOS marking policy if
614 * 1. upper layer asks it to do so
615 * 2. net_qos_policy_restricted is not set
616 * 3. qos_marking_gencount doesn't match necp_kernel_socket_policies_gencount (checked in necp_lookup_current_qos_marking)
617 */
618 if (ip6oa != NULL && (ip6oa->ip6oa_flags & IP6OAF_REDO_QOSMARKING_POLICY) &&
619 net_qos_policy_restricted != 0) {
620 bool qos_marking = (ip6oa->ip6oa_flags & IP6OAF_QOSMARKING_ALLOWED) != 0;
621 qos_marking = necp_lookup_current_qos_marking(&ip6oa->qos_marking_gencount, NULL, policy_ifp, necp_result_parameter.route_rule_id, qos_marking);
622 if (qos_marking) {
623 ip6oa->ip6oa_flags |= IP6OAF_QOSMARKING_ALLOWED;
624 } else {
625 ip6oa->ip6oa_flags &= ~IP6OAF_QOSMARKING_ALLOWED;
626 }
627 }
628
629 if (policy_ifp == ifp) {
630 goto skip_ipsec;
631 } else {
632 if (necp_packet_can_rebind_to_ifnet(m,
633 policy_ifp, (struct route *)&necp_route,
634 AF_INET6)) {
635 /*
636 * Set scoped index to the tunnel
637 * interface, since it is compatible
638 * with the packet. This will only work
639 * for callers who pass IPV6_OUTARGS,
640 * but that covers all of the clients
641 * we care about today.
642 */
643 if (flags & IPV6_OUTARGS) {
644 ip6oa->ip6oa_boundif =
645 policy_ifp->if_index;
646 ip6oa->ip6oa_flags |=
647 IP6OAF_BOUND_IF;
648 }
649 if (opt != NULL
650 && opt->ip6po_pktinfo != NULL) {
651 opt->ip6po_pktinfo->
652 ipi6_ifindex =
653 policy_ifp->if_index;
654 }
655 ro = &necp_route;
656 goto skip_ipsec;
657 } else {
658 error = ENETUNREACH;
659 ip6stat.ip6s_necp_policy_drop++;
660 drop_reason = DROP_REASON_IP_NECP_POLICY_TUN_NO_REBIND_IF;
661 goto freehdrs;
662 }
663 }
664 }
665 default:
666 break;
667 }
668 }
669 #endif /* NECP */
670
671 #if IPSEC
672 if (ipsec_bypass != 0 || ip6obf.noipsec) {
673 goto skip_ipsec;
674 }
675
676 if (sp == NULL) {
677 /* get a security policy for this packet */
678 if (so != NULL) {
679 sp = ipsec6_getpolicybysock(m, IPSEC_DIR_OUTBOUND,
680 so, &error);
681 } else {
682 sp = ipsec6_getpolicybyaddr(m, IPSEC_DIR_OUTBOUND,
683 0, &error);
684 }
685 if (sp == NULL) {
686 IPSEC_STAT_INCREMENT(ipsec6stat.out_inval);
687 goto freehdrs;
688 }
689 }
690
691 error = 0;
692
693 /* check policy */
694 switch (sp->policy) {
695 case IPSEC_POLICY_DISCARD:
696 case IPSEC_POLICY_GENERATE:
697 /*
698 * This packet is just discarded.
699 */
700 IPSEC_STAT_INCREMENT(ipsec6stat.out_polvio);
701 goto freehdrs;
702
703 case IPSEC_POLICY_BYPASS:
704 case IPSEC_POLICY_NONE:
705 /* no need to do IPsec. */
706 ip6obf.needipsec = FALSE;
707 break;
708
709 case IPSEC_POLICY_IPSEC:
710 if (sp->req == NULL) {
711 /* acquire a policy */
712 error = key_spdacquire(sp);
713 goto freehdrs;
714 }
715 if (sp->ipsec_if) {
716 goto skip_ipsec;
717 } else {
718 ip6obf.needipsec = true;
719 }
720 break;
721
722 case IPSEC_POLICY_ENTRUST:
723 default:
724 printf("%s: Invalid policy found: %d\n", __func__, sp->policy);
725 break;
726 }
727 skip_ipsec:
728 #endif /* IPSEC */
729
730 /*
731 * Calculate the total length of the extension header chain.
732 * Keep the length of the unfragmentable part for fragmentation.
733 */
734 optlen = 0;
735 if (exthdrs.ip6e_hbh != NULL) {
736 optlen += exthdrs.ip6e_hbh->m_len;
737 }
738 if (exthdrs.ip6e_dest1 != NULL) {
739 optlen += exthdrs.ip6e_dest1->m_len;
740 }
741 if (exthdrs.ip6e_rthdr != NULL) {
742 optlen += exthdrs.ip6e_rthdr->m_len;
743 }
744 unfragpartlen = optlen + sizeof(struct ip6_hdr);
745
746 /* NOTE: we don't add AH/ESP length here. do that later. */
747 if (exthdrs.ip6e_dest2 != NULL) {
748 optlen += exthdrs.ip6e_dest2->m_len;
749 }
750
751 /*
752 * If we need IPsec, or there is at least one extension header,
753 * separate IP6 header from the payload.
754 */
755 if ((
756 #if IPSEC
757 ip6obf.needipsec ||
758 #endif /* IPSEC */
759 optlen) && !ip6obf.hdrsplit) {
760 if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
761 m = NULL;
762 goto freehdrs;
763 }
764 m = exthdrs.ip6e_ip6;
765 ip6obf.hdrsplit = true;
766 }
767
768 /* adjust pointer */
769 ip6 = mtod(m, struct ip6_hdr *);
770
771 /* adjust mbuf packet header length */
772 m->m_pkthdr.len += optlen;
773 plen = m->m_pkthdr.len - sizeof(*ip6);
774
775 /* If this is a jumbo payload, insert a jumbo payload option. */
776 if (plen > IPV6_MAXPACKET) {
777 if (!ip6obf.hdrsplit) {
778 if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
779 m = NULL;
780 goto freehdrs;
781 }
782 m = exthdrs.ip6e_ip6;
783 ip6obf.hdrsplit = true;
784 }
785 /* adjust pointer */
786 ip6 = mtod(m, struct ip6_hdr *);
787 if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0) {
788 goto freehdrs;
789 }
790 ip6->ip6_plen = 0;
791 } else {
792 ip6->ip6_plen = htons((uint16_t)plen);
793 }
794 /*
795 * Concatenate headers and fill in next header fields.
796 * Here we have, on "m"
797 * IPv6 payload
798 * and we insert headers accordingly. Finally, we should be getting:
799 * IPv6 hbh dest1 rthdr ah* [esp* dest2 payload]
800 *
801 * during the header composing process, "m" points to IPv6 header.
802 * "mprev" points to an extension header prior to esp.
803 */
804 nexthdrp = &ip6->ip6_nxt;
805 mprev = m;
806
807 /*
808 * we treat dest2 specially. this makes IPsec processing
809 * much easier. the goal here is to make mprev point the
810 * mbuf prior to dest2.
811 *
812 * result: IPv6 dest2 payload
813 * m and mprev will point to IPv6 header.
814 */
815 if (exthdrs.ip6e_dest2 != NULL) {
816 if (!ip6obf.hdrsplit) {
817 panic("assumption failed: hdr not split");
818 /* NOTREACHED */
819 }
820 exthdrs.ip6e_dest2->m_next = m->m_next;
821 m->m_next = exthdrs.ip6e_dest2;
822 *mtod(exthdrs.ip6e_dest2, u_char *) = ip6->ip6_nxt;
823 ip6->ip6_nxt = IPPROTO_DSTOPTS;
824 }
825
826 #define MAKE_CHAIN(m, mp, p, i) do { \
827 if (m != NULL) { \
828 if (!ip6obf.hdrsplit) { \
829 panic("assumption failed: hdr not split"); \
830 /* NOTREACHED */ \
831 } \
832 *mtod((m), u_char *) = *(p); \
833 *(p) = (i); \
834 p = mtod((m), u_char *); \
835 (m)->m_next = (mp)->m_next; \
836 (mp)->m_next = (m); \
837 (mp) = (m); \
838 } \
839 } while (0)
840 /*
841 * result: IPv6 hbh dest1 rthdr dest2 payload
842 * m will point to IPv6 header. mprev will point to the
843 * extension header prior to dest2 (rthdr in the above case).
844 */
845 MAKE_CHAIN(exthdrs.ip6e_hbh, mprev, nexthdrp, IPPROTO_HOPOPTS);
846 MAKE_CHAIN(exthdrs.ip6e_dest1, mprev, nexthdrp, IPPROTO_DSTOPTS);
847 MAKE_CHAIN(exthdrs.ip6e_rthdr, mprev, nexthdrp, IPPROTO_ROUTING);
848
849 /* It is no longer safe to free the pointers in exthdrs. */
850 exthdrs.merged = TRUE;
851
852 #undef MAKE_CHAIN
853
854 #if IPSEC
855 if (ip6obf.needipsec && (m->m_pkthdr.csum_flags & CSUM_DELAY_IPV6_DATA)) {
856 in6_delayed_cksum_offset(m, 0, optlen, nxt0);
857 }
858 #endif /* IPSEC */
859
860 if (!TAILQ_EMPTY(&ipv6_filters) &&
861 !((flags & IPV6_OUTARGS) &&
862 (ip6oa->ip6oa_flags & IP6OAF_INTCOPROC_ALLOWED) &&
863 (ip6oa->ip6oa_flags & IP6OAF_MANAGEMENT_ALLOWED)
864 #if NECP
865 && !necp_packet_should_skip_filters(m)
866 #endif // NECP
867 )) {
868 struct ipfilter *__single filter;
869 int seen = (inject_filter_ref == NULL);
870 int fixscope = 0;
871
872 if (im6o != NULL && IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
873 ippo->ippo_flags |= IPPOF_MCAST_OPTS;
874 IM6O_LOCK(im6o);
875 ippo->ippo_mcast_ifnet = im6o->im6o_multicast_ifp;
876 ippo->ippo_mcast_ttl = im6o->im6o_multicast_hlim;
877 ippo->ippo_mcast_loop = im6o->im6o_multicast_loop;
878 IM6O_UNLOCK(im6o);
879 }
880
881 /* Hack: embed the scope_id in the destination */
882 if (IN6_IS_SCOPE_LINKLOCAL(&ip6->ip6_dst) &&
883 (ip6->ip6_dst.s6_addr16[1] == 0) && (ro != NULL)) {
884 fixscope = 1;
885 ip6->ip6_dst.s6_addr16[1] =
886 htons((uint16_t)ro->ro_dst.sin6_scope_id);
887 }
888
889 ipf_ref();
890 TAILQ_FOREACH(filter, &ipv6_filters, ipf_link) {
891 /*
892 * Don't process packet twice if we've already seen it.
893 */
894 if (seen == 0) {
895 if ((struct ipfilter *)inject_filter_ref ==
896 filter) {
897 seen = 1;
898 }
899 } else if (filter->ipf_filter.ipf_output != NULL) {
900 errno_t result;
901
902 result = filter->ipf_filter.ipf_output(
903 filter->ipf_filter.cookie,
904 (mbuf_t *)&m, ippo);
905 if (result == EJUSTRETURN) {
906 ipf_unref();
907 m = NULL;
908 goto evaluateloop;
909 }
910 if (result != 0) {
911 ipf_unref();
912 drop_reason = DROP_REASON_IP_FILTER_DROP;
913 goto bad;
914 }
915 }
916 }
917 ipf_unref();
918
919 ip6 = mtod(m, struct ip6_hdr *);
920 /* Hack: cleanup embedded scope_id if we put it there */
921 if (fixscope) {
922 ip6->ip6_dst.s6_addr16[1] = 0;
923 }
924 }
925
926 #if IPSEC
927 if (ip6obf.needipsec) {
928 uint8_t segleft_org;
929
930 /*
931 * pointers after IPsec headers are not valid any more.
932 * other pointers need a great care too.
933 * (IPsec routines should not mangle mbufs prior to AH/ESP)
934 */
935 exthdrs.ip6e_dest2 = NULL;
936
937 if (exthdrs.ip6e_rthdr != NULL) {
938 rh = mtod(exthdrs.ip6e_rthdr, struct ip6_rthdr *);
939 segleft_org = rh->ip6r_segleft;
940 rh->ip6r_segleft = 0;
941 } else {
942 rh = NULL;
943 segleft_org = 0;
944 }
945
946 ipsec_state.m = m;
947 error = ipsec6_output_trans(&ipsec_state, nexthdrp, mprev,
948 sp, flags, &needipsectun);
949 m = ipsec_state.m;
950 if (error) {
951 /* mbuf is already reclaimed in ipsec6_output_trans. */
952 m = NULL;
953 switch (error) {
954 case EHOSTUNREACH:
955 case ENETUNREACH:
956 case EMSGSIZE:
957 case ENOBUFS:
958 case ENOMEM:
959 break;
960 default:
961 printf("ip6_output (ipsec): error code %d\n",
962 error);
963 OS_FALLTHROUGH;
964 case ENOENT:
965 /* don't show these error codes to the user */
966 error = 0;
967 break;
968 }
969 goto bad;
970 }
971 if (exthdrs.ip6e_rthdr != NULL) {
972 /* ah6_output doesn't modify mbuf chain */
973 rh->ip6r_segleft = segleft_org;
974 }
975 }
976 #endif /* IPSEC */
977
978 /* If there is a routing header, discard the packet. */
979 if (exthdrs.ip6e_rthdr != NULL) {
980 error = EINVAL;
981 goto bad;
982 }
983
984 /* Source address validation */
985 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) &&
986 !(flags & IPV6_UNSPECSRC)) {
987 error = EOPNOTSUPP;
988 ip6stat.ip6s_badscope++;
989 drop_reason = DROP_REASON_IP6_BAD_SCOPE;
990 goto bad;
991 }
992 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) {
993 error = EOPNOTSUPP;
994 ip6stat.ip6s_badscope++;
995 drop_reason = DROP_REASON_IP6_BAD_SCOPE;
996 goto bad;
997 }
998
999 ip6stat.ip6s_localout++;
1000
1001 /*
1002 * Route packet.
1003 */
1004 if (ro == NULL) {
1005 ro = &ip6route;
1006 bzero(ro, sizeof(*ro));
1007 }
1008 ro_pmtu = ro;
1009 if (opt != NULL && opt->ip6po_rthdr) {
1010 ro = &opt->ip6po_route;
1011 }
1012 dst = SIN6(&ro->ro_dst);
1013
1014 if (ro->ro_rt != NULL) {
1015 RT_LOCK_ASSERT_NOTHELD(ro->ro_rt);
1016 }
1017 /*
1018 * if specified, try to fill in the traffic class field.
1019 * do not override if a non-zero value is already set.
1020 * we check the diffserv field and the ecn field separately.
1021 */
1022 if (opt != NULL && opt->ip6po_tclass >= 0) {
1023 int mask = 0;
1024
1025 if ((ip6->ip6_flow & htonl(0xfc << 20)) == 0) {
1026 mask |= 0xfc;
1027 }
1028 if ((ip6->ip6_flow & htonl(0x03 << 20)) == 0) {
1029 mask |= 0x03;
1030 }
1031 if (mask != 0) {
1032 ip6->ip6_flow |=
1033 htonl((opt->ip6po_tclass & mask) << 20);
1034 }
1035 }
1036
1037 if (((ntohl(ip6->ip6_flow & IPV6_FLOW_ECN_MASK) >> 20) & IPTOS_ECN_ECT1) == IPTOS_ECN_ECT1) {
1038 m->m_pkthdr.pkt_ext_flags |= PKTF_EXT_L4S;
1039 }
1040
1041 /* fill in or override the hop limit field, if necessary. */
1042 if (opt && opt->ip6po_hlim != -1) {
1043 ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
1044 } else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
1045 if (im6o != NULL) {
1046 IM6O_LOCK(im6o);
1047 ip6->ip6_hlim = im6o->im6o_multicast_hlim;
1048 IM6O_UNLOCK(im6o);
1049 } else {
1050 ip6->ip6_hlim = (uint8_t)ip6_defmcasthlim;
1051 }
1052 }
1053
1054 /*
1055 * If there is a cached route, check that it is to the same
1056 * destination and is still up. If not, free it and try again.
1057 * Test rt_flags without holding rt_lock for performance reasons;
1058 * if the route is down it will hopefully be caught by the layer
1059 * below (since it uses this route as a hint) or during the
1060 * next transmit.
1061 */
1062 if (ROUTE_UNUSABLE(ro) || dst->sin6_family != AF_INET6 ||
1063 !in6_are_addr_equal_scoped(&dst->sin6_addr, &ip6->ip6_dst, dst->sin6_scope_id, ip6_output_getdstifscope(m))) {
1064 ROUTE_RELEASE(ro);
1065 }
1066
1067 if (ro->ro_rt == NULL) {
1068 SOCKADDR_ZERO(dst, sizeof(*dst));
1069 dst->sin6_family = AF_INET6;
1070 dst->sin6_len = sizeof(struct sockaddr_in6);
1071 dst->sin6_addr = ip6->ip6_dst;
1072 }
1073 #if IPSEC
1074 if (ip6obf.needipsec && needipsectun) {
1075 #if CONFIG_DTRACE
1076 struct ifnet *trace_ifp = (ifpp_save != NULL) ? (*ifpp_save) : NULL;
1077 #endif /* CONFIG_DTRACE */
1078 /*
1079 * All the extension headers will become inaccessible
1080 * (since they can be encrypted).
1081 * Don't panic, we need no more updates to extension headers
1082 * on inner IPv6 packet (since they are now encapsulated).
1083 *
1084 * IPv6 [ESP|AH] IPv6 [extension headers] payload
1085 */
1086 bzero(&exthdrs, sizeof(exthdrs));
1087 exthdrs.ip6e_ip6 = m;
1088
1089 ipsec_state.m = m;
1090 route_copyout((struct route *)&ipsec_state.ro, (struct route *)ro,
1091 sizeof(struct route_in6));
1092 ipsec_state.dst = SA(dst);
1093
1094 /* So that we can see packets inside the tunnel */
1095 DTRACE_IP6(send, struct mbuf *, m, struct inpcb *, NULL,
1096 struct ip6_hdr *, ip6, struct ifnet *, trace_ifp,
1097 struct ip *, NULL, struct ip6_hdr *, ip6);
1098
1099 error = ipsec6_output_tunnel(&ipsec_state, sp, flags);
1100 /* tunneled in IPv4? packet is gone */
1101 if (ipsec_state.tunneled == 4) {
1102 m = NULL;
1103 goto evaluateloop;
1104 }
1105 m = ipsec_state.m;
1106 ipsec_saved_route = ro;
1107 ro = (struct route_in6 *)&ipsec_state.ro;
1108 dst = SIN6(ipsec_state.dst);
1109 if (error) {
1110 /* mbuf is already reclaimed in ipsec6_output_tunnel. */
1111 m = NULL;
1112 switch (error) {
1113 case EHOSTUNREACH:
1114 case ENETUNREACH:
1115 case EMSGSIZE:
1116 case ENOBUFS:
1117 case ENOMEM:
1118 break;
1119 default:
1120 printf("ip6_output (ipsec): error code %d\n",
1121 error);
1122 OS_FALLTHROUGH;
1123 case ENOENT:
1124 /* don't show these error codes to the user */
1125 error = 0;
1126 break;
1127 }
1128 goto bad;
1129 }
1130 /*
1131 * The packet has been encapsulated so the ifscope
1132 * is no longer valid since it does not apply to the
1133 * outer address: ignore the ifscope.
1134 */
1135 if (flags & IPV6_OUTARGS) {
1136 ip6oa->ip6oa_boundif = IFSCOPE_NONE;
1137 ip6oa->ip6oa_flags &= ~IP6OAF_BOUND_IF;
1138 }
1139 if (opt != NULL && opt->ip6po_pktinfo != NULL) {
1140 if (opt->ip6po_pktinfo->ipi6_ifindex != IFSCOPE_NONE) {
1141 opt->ip6po_pktinfo->ipi6_ifindex = IFSCOPE_NONE;
1142 }
1143 }
1144 exthdrs.ip6e_ip6 = m;
1145 }
1146 #endif /* IPSEC */
1147
1148 /*
1149 * ifp should only be filled in for dummy net packets which will jump
1150 * to check_with_pf label.
1151 */
1152 if (ifp != NULL) {
1153 VERIFY(ip6obf.route_selected);
1154 }
1155
1156 /* adjust pointer */
1157 ip6 = mtod(m, struct ip6_hdr *);
1158
1159 if (ip6obf.select_srcif) {
1160 SOCKADDR_ZERO(&src_sa, sizeof(src_sa));
1161 src_sa.sin6_family = AF_INET6;
1162 src_sa.sin6_len = sizeof(src_sa);
1163 src_sa.sin6_addr = ip6->ip6_src;
1164 src_sa.sin6_scope_id = (!in6_embedded_scope && IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) ? ip6_output_getsrcifscope(m) : IFSCOPE_NONE;
1165 }
1166 SOCKADDR_ZERO(&dst_sa, sizeof(dst_sa));
1167 dst_sa.sin6_family = AF_INET6;
1168 dst_sa.sin6_len = sizeof(dst_sa);
1169 dst_sa.sin6_addr = ip6->ip6_dst;
1170 dst_sa.sin6_scope_id = (!in6_embedded_scope && IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) ? ip6_output_getdstifscope(m) : IFSCOPE_NONE;
1171
1172 /*
1173 * Only call in6_selectroute() on first iteration to avoid taking
1174 * multiple references on ifp and rt.
1175 *
1176 * in6_selectroute() might return an ifp with its reference held
1177 * even in the error case, so make sure to release its reference.
1178 * ip6oa may be NULL if IPV6_OUTARGS isn't set.
1179 */
1180 if (!ip6obf.route_selected) {
1181 error = in6_selectroute( ip6obf.select_srcif ? &src_sa : NULL,
1182 &dst_sa, opt, im6o, &src_ia, ro, &ifp, &rt, 0, ip6oa);
1183
1184 if (error != 0) {
1185 switch (error) {
1186 case EHOSTUNREACH:
1187 drop_reason = DROP_REASON_IP_NO_ROUTE;
1188 ip6stat.ip6s_noroute++;
1189 break;
1190 case EADDRNOTAVAIL:
1191 drop_reason = DROP_REASON_IP_SRC_ADDR_NO_AVAIL;
1192 default:
1193 break; /* XXX statistics? */
1194 }
1195 if (ifp != NULL) {
1196 in6_ifstat_inc(ifp, ifs6_out_discard);
1197 }
1198 /* ifp (if non-NULL) will be released at the end */
1199 goto bad;
1200 }
1201 ip6obf.route_selected = true;
1202 }
1203 if (rt == NULL) {
1204 /*
1205 * If in6_selectroute() does not return a route entry,
1206 * dst may not have been updated.
1207 */
1208 *dst = dst_sa; /* XXX */
1209 }
1210
1211 #if NECP
1212 /* Catch-all to check if the interface is allowed */
1213 if (!necp_packet_is_allowed_over_interface(m, ifp)) {
1214 error = EHOSTUNREACH;
1215 ip6stat.ip6s_necp_policy_drop++;
1216 drop_reason = DROP_REASON_IP_NECP_POLICY_NO_ALLOW_IF;
1217 goto bad;
1218 }
1219 #endif /* NECP */
1220
1221 /*
1222 * then rt (for unicast) and ifp must be non-NULL valid values.
1223 */
1224 if (!(flags & IPV6_FORWARDING)) {
1225 in6_ifstat_inc_na(ifp, ifs6_out_request);
1226 }
1227 if (rt != NULL) {
1228 RT_LOCK(rt);
1229 if (ia == NULL) {
1230 ia = ifatoia6(rt->rt_ifa);
1231 if (ia != NULL) {
1232 ifa_addref(&ia->ia_ifa);
1233 }
1234 }
1235 rt->rt_use++;
1236 RT_UNLOCK(rt);
1237 }
1238
1239 /*
1240 * The outgoing interface must be in the zone of source and
1241 * destination addresses (except local/loopback). We should
1242 * use ia_ifp to support the case of sending packets to an
1243 * address of our own.
1244 */
1245 if (ia != NULL && ia->ia_ifp) {
1246 ifnet_reference(ia->ia_ifp); /* for origifp */
1247 if (origifp != NULL) {
1248 ifnet_release(origifp);
1249 }
1250 origifp = ia->ia_ifp;
1251 } else {
1252 if (ifp != NULL) {
1253 ifnet_reference(ifp); /* for origifp */
1254 }
1255 if (origifp != NULL) {
1256 ifnet_release(origifp);
1257 }
1258 origifp = ifp;
1259 }
1260
1261 /* skip scope enforcements for local/loopback route */
1262 if (rt == NULL || rt->rt_ifp == NULL || !(rt->rt_ifp->if_flags & IFF_LOOPBACK)) {
1263 struct in6_addr src0, dst0;
1264 u_int32_t zone;
1265
1266 src0 = ip6->ip6_src;
1267 if (in6_setscope(&src0, origifp, &zone)) {
1268 goto badscope;
1269 }
1270 SOCKADDR_ZERO(&src_sa, sizeof(src_sa));
1271 src_sa.sin6_family = AF_INET6;
1272 src_sa.sin6_len = sizeof(src_sa);
1273 src_sa.sin6_addr = ip6->ip6_src;
1274 src_sa.sin6_scope_id = (!in6_embedded_scope && IN6_IS_SCOPE_EMBED(&src_sa.sin6_addr)) ? ip6_output_getsrcifscope(m) : IFSCOPE_NONE;
1275 if ((sa6_recoverscope(&src_sa, TRUE) ||
1276 zone != src_sa.sin6_scope_id)) {
1277 goto badscope;
1278 }
1279
1280 dst0 = ip6->ip6_dst;
1281 if ((in6_setscope(&dst0, origifp, &zone))) {
1282 goto badscope;
1283 }
1284 /* re-initialize to be sure */
1285 SOCKADDR_ZERO(&dst_sa, sizeof(dst_sa));
1286 dst_sa.sin6_family = AF_INET6;
1287 dst_sa.sin6_len = sizeof(dst_sa);
1288 dst_sa.sin6_addr = ip6->ip6_dst;
1289 dst_sa.sin6_scope_id = (!in6_embedded_scope && IN6_IS_SCOPE_EMBED(&dst_sa.sin6_addr)) ? ip6_output_getdstifscope(m) : IFSCOPE_NONE;
1290 if ((sa6_recoverscope(&dst_sa, TRUE) ||
1291 zone != dst_sa.sin6_scope_id)) {
1292 goto badscope;
1293 }
1294
1295 /* scope check is done. */
1296 goto routefound;
1297
1298 badscope:
1299 ip6stat.ip6s_badscope++;
1300 in6_ifstat_inc(origifp, ifs6_out_discard);
1301 if (error == 0) {
1302 error = EHOSTUNREACH; /* XXX */
1303 }
1304 drop_reason = DROP_REASON_IP6_BAD_SCOPE;
1305 goto bad;
1306 }
1307
1308 routefound:
1309 if (rt != NULL && !IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
1310 if (opt != NULL && opt->ip6po_nextroute.ro_rt) {
1311 /*
1312 * The nexthop is explicitly specified by the
1313 * application. We assume the next hop is an IPv6
1314 * address.
1315 */
1316 dst = SIN6(opt->ip6po_nexthop);
1317 } else if ((rt->rt_flags & RTF_GATEWAY)) {
1318 dst = SIN6(rt->rt_gateway);
1319 }
1320 /*
1321 * For packets destined to local/loopback, record the
1322 * source the source interface (which owns the source
1323 * address), as well as the output interface. This is
1324 * needed to reconstruct the embedded zone for the
1325 * link-local address case in ip6_input().
1326 */
1327 if (ia != NULL && (ifp->if_flags & IFF_LOOPBACK)) {
1328 uint32_t srcidx;
1329
1330 if (src_ia != NULL) {
1331 srcidx = src_ia->ia_ifp->if_index;
1332 } else if (ro->ro_srcia != NULL) {
1333 srcidx = ro->ro_srcia->ifa_ifp->if_index;
1334 } else {
1335 srcidx = 0;
1336 }
1337
1338 ip6_setsrcifaddr_info(m, srcidx, NULL);
1339 ip6_setdstifaddr_info(m, 0, ia);
1340 }
1341 }
1342
1343 if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
1344 m->m_flags &= ~(M_BCAST | M_MCAST); /* just in case */
1345 } else {
1346 struct in6_multi *__single in6m;
1347
1348 m->m_flags = (m->m_flags & ~M_BCAST) | M_MCAST;
1349 in6_ifstat_inc_na(ifp, ifs6_out_mcast);
1350
1351 /*
1352 * Confirm that the outgoing interface supports multicast.
1353 */
1354 if (!(ifp->if_flags & IFF_MULTICAST)) {
1355 ip6stat.ip6s_noroute++;
1356 in6_ifstat_inc(ifp, ifs6_out_discard);
1357 error = ENETUNREACH;
1358 drop_reason = DROP_REASON_IP_NO_ROUTE;
1359 goto bad;
1360 }
1361 in6_multihead_lock_shared();
1362 IN6_LOOKUP_MULTI(&ip6->ip6_dst, ifp, in6m);
1363 in6_multihead_lock_done();
1364 if (im6o != NULL) {
1365 IM6O_LOCK(im6o);
1366 }
1367 if (in6m != NULL &&
1368 (im6o == NULL || im6o->im6o_multicast_loop)) {
1369 if (im6o != NULL) {
1370 IM6O_UNLOCK(im6o);
1371 }
1372 /*
1373 * If we belong to the destination multicast group
1374 * on the outgoing interface, and the caller did not
1375 * forbid loopback, loop back a copy.
1376 */
1377 ip6_mloopback(NULL, ifp, m, dst, optlen, nxt0);
1378 } else if (im6o != NULL) {
1379 IM6O_UNLOCK(im6o);
1380 }
1381 if (in6m != NULL) {
1382 IN6M_REMREF(in6m);
1383 }
1384 /*
1385 * Multicasts with a hoplimit of zero may be looped back,
1386 * above, but must not be transmitted on a network.
1387 * Also, multicasts addressed to the loopback interface
1388 * are not sent -- the above call to ip6_mloopback() will
1389 * loop back a copy if this host actually belongs to the
1390 * destination group on the loopback interface.
1391 */
1392 if (ip6->ip6_hlim == 0 || (ifp->if_flags & IFF_LOOPBACK) ||
1393 IN6_IS_ADDR_MC_INTFACELOCAL(&ip6->ip6_dst)) {
1394 /* remove m from the packetchain and continue looping */
1395 if (m != NULL) {
1396 m_freem(m);
1397 }
1398 m = NULL;
1399 goto evaluateloop;
1400 }
1401 }
1402
1403 /*
1404 * Fill the outgoing inteface to tell the upper layer
1405 * to increment per-interface statistics.
1406 */
1407 if (ifpp != NULL && *ifpp == NULL) {
1408 ifnet_reference(ifp); /* for caller */
1409 *ifpp = ifp;
1410 }
1411
1412 /* Determine path MTU. */
1413 if ((error = ip6_getpmtu(ro_pmtu, ro, ifp, &finaldst, ifp->if_index, &mtu)) != 0) {
1414 drop_reason = DROP_REASON_IP6_BAD_PATH_MTU;
1415 goto bad;
1416 }
1417
1418 /*
1419 * The caller of this function may specify to use the minimum MTU
1420 * in some cases.
1421 * An advanced API option (IPV6_USE_MIN_MTU) can also override MTU
1422 * setting. The logic is a bit complicated; by default, unicast
1423 * packets will follow path MTU while multicast packets will be sent at
1424 * the minimum MTU. If IP6PO_MINMTU_ALL is specified, all packets
1425 * including unicast ones will be sent at the minimum MTU. Multicast
1426 * packets will always be sent at the minimum MTU unless
1427 * IP6PO_MINMTU_DISABLE is explicitly specified.
1428 * See RFC 3542 for more details.
1429 */
1430 if (mtu > IPV6_MMTU) {
1431 if ((flags & IPV6_MINMTU)) {
1432 mtu = IPV6_MMTU;
1433 } else if (opt && opt->ip6po_minmtu == IP6PO_MINMTU_ALL) {
1434 mtu = IPV6_MMTU;
1435 } else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) &&
1436 (opt == NULL ||
1437 opt->ip6po_minmtu != IP6PO_MINMTU_DISABLE)) {
1438 mtu = IPV6_MMTU;
1439 }
1440 }
1441
1442 /*
1443 * clear embedded scope identifiers if necessary.
1444 * in6_clearscope will touch the addresses only when necessary.
1445 */
1446 in6_clearscope(&ip6->ip6_src);
1447 in6_clearscope(&ip6->ip6_dst);
1448 /*
1449 * If the outgoing packet contains a hop-by-hop options header,
1450 * it must be examined and processed even by the source node.
1451 * (RFC 2460, section 4.)
1452 */
1453 if (exthdrs.ip6e_hbh != NULL) {
1454 struct ip6_hbh *hbh = mtod(exthdrs.ip6e_hbh, struct ip6_hbh *);
1455 u_int32_t dummy; /* XXX unused */
1456 uint32_t oplen = 0; /* for ip6_process_hopopts() */
1457 #if DIAGNOSTIC
1458 if ((hbh->ip6h_len + 1) << 3 > exthdrs.ip6e_hbh->m_len) {
1459 panic("ip6e_hbh is not continuous");
1460 }
1461 #endif
1462 /*
1463 * XXX: If we have to send an ICMPv6 error to the sender,
1464 * we need the M_LOOP flag since icmp6_error() expects
1465 * the IPv6 and the hop-by-hop options header are
1466 * continuous unless the flag is set.
1467 */
1468 m->m_flags |= M_LOOP;
1469 m->m_pkthdr.rcvif = ifp;
1470 if (ip6_process_hopopts(m, (u_int8_t *)(hbh + 1),
1471 ((hbh->ip6h_len + 1) << 3) - sizeof(struct ip6_hbh),
1472 &dummy, &oplen) < 0) {
1473 /*
1474 * m was already freed at this point. Set to NULL so it
1475 * is not re-freed at end of ip6_output_list.
1476 */
1477 m = NULL;
1478 error = EINVAL; /* better error? */
1479 goto bad;
1480 }
1481 m->m_flags &= ~M_LOOP; /* XXX */
1482 m->m_pkthdr.rcvif = NULL;
1483 }
1484
1485 #if DUMMYNET
1486 check_with_pf:
1487 #endif /* DUMMYNET */
1488 #if PF
1489 if (PF_IS_ENABLED && !skip_pf) {
1490 #if DUMMYNET
1491
1492 /*
1493 * TODO: Need to save opt->ip6po_flags for reinjection
1494 * rdar://10434993
1495 */
1496 args.fwa_oif = ifp;
1497 args.fwa_oflags = flags;
1498 if (flags & IPV6_OUTARGS) {
1499 args.fwa_ip6oa = ip6oa;
1500 }
1501 args.fwa_ro6 = ro;
1502 args.fwa_dst6 = dst;
1503 args.fwa_ro6_pmtu = ro_pmtu;
1504 args.fwa_origifp = origifp;
1505 args.fwa_mtu = mtu;
1506 args.fwa_unfragpartlen = unfragpartlen;
1507 args.fwa_exthdrs = &exthdrs;
1508 /* Invoke outbound packet filter */
1509 error = pf_af_hook(ifp, NULL, &m, AF_INET6, FALSE, &args);
1510 #else /* !DUMMYNET */
1511 error = pf_af_hook(ifp, NULL, &m, AF_INET6, FALSE, NULL);
1512 #endif /* !DUMMYNET */
1513
1514 if (error != 0 || m == NULL) {
1515 if (m != NULL) {
1516 panic("%s: unexpected packet %p",
1517 __func__, m);
1518 /* NOTREACHED */
1519 }
1520 /* m was already freed by callee and is now NULL. */
1521 goto evaluateloop;
1522 }
1523 ip6 = mtod(m, struct ip6_hdr *);
1524 }
1525 #endif /* PF */
1526
1527 #ifdef IPSEC
1528 /* clean ipsec history before fragmentation */
1529 ipsec_delaux(m);
1530 #endif /* IPSEC */
1531
1532 if (ip6oa != NULL) {
1533 u_int8_t dscp;
1534
1535 dscp = (ntohl(ip6->ip6_flow) & IP6FLOW_DSCP_MASK) >> IP6FLOW_DSCP_SHIFT;
1536
1537 error = set_packet_qos(m, ifp,
1538 ip6oa->ip6oa_flags & IP6OAF_QOSMARKING_ALLOWED ? TRUE : FALSE,
1539 ip6oa->ip6oa_sotc, ip6oa->ip6oa_netsvctype, &dscp);
1540 if (error == 0) {
1541 ip6->ip6_flow &= ~htonl(IP6FLOW_DSCP_MASK);
1542 ip6->ip6_flow |= htonl((u_int32_t)dscp << IP6FLOW_DSCP_SHIFT);
1543 } else {
1544 printf("%s if_dscp_for_mbuf() error %d\n", __func__, error);
1545 error = 0;
1546 }
1547 }
1548 /*
1549 * Determine whether fragmentation is necessary. If so, m is passed
1550 * back as a chain of packets and original mbuf is freed. Otherwise, m
1551 * is unchanged.
1552 */
1553 error = ip6_fragment_packet(&m, opt, ip6oa,
1554 &exthdrs, ifp, mtu, unfragpartlen, nxt0,
1555 optlen);
1556
1557 if (error) {
1558 drop_reason = DROP_REASON_IP_CANNOT_FRAGMENT;
1559 goto bad;
1560 }
1561
1562 /*
1563 * The evaluateloop label is where we decide whether to continue looping over
1564 * packets or call into nd code to send.
1565 */
1566 evaluateloop:
1567
1568 /*
1569 * m may be NULL when we jump to the evaluateloop label from PF or
1570 * other code that can drop packets.
1571 */
1572 if (m != NULL) {
1573 /*
1574 * If we already have a chain to send, tack m onto the end.
1575 * Otherwise make m the start and end of the to-be-sent chain.
1576 */
1577 if (sendchain != NULL) {
1578 sendchain_last->m_nextpkt = m;
1579 } else {
1580 sendchain = m;
1581 }
1582
1583 /* Fragmentation may mean m is a chain. Find the last packet. */
1584 while (m->m_nextpkt) {
1585 m = m->m_nextpkt;
1586 }
1587 sendchain_last = m;
1588 pktcnt++;
1589 }
1590
1591 /* Fill in next m from inputchain as appropriate. */
1592 m = inputchain;
1593 if (m != NULL) {
1594 /* Isolate m from rest of input chain. */
1595 inputchain = m->m_nextpkt;
1596 m->m_nextpkt = NULL;
1597
1598 /*
1599 * Clear exthdrs and ipsec_state so stale contents are not
1600 * reused. Note this also clears the exthdrs.merged flag.
1601 */
1602 bzero(&exthdrs, sizeof(exthdrs));
1603 bzero(&ipsec_state, sizeof(ipsec_state));
1604
1605 /* Continue looping. */
1606 goto loopit;
1607 }
1608
1609 /*
1610 * If we get here, there's no more mbufs in inputchain, so send the
1611 * sendchain if there is one.
1612 */
1613 if (pktcnt > 0) {
1614 error = nd6_output_list(ifp, origifp, sendchain, dst,
1615 ro->ro_rt, adv);
1616 /*
1617 * Fall through to done label even in error case because
1618 * nd6_output_list frees packetchain in both success and
1619 * failure cases.
1620 */
1621 }
1622
1623 done:
1624 if (ifpp_save != NULL && *ifpp_save != NULL) {
1625 ifnet_release(*ifpp_save);
1626 *ifpp_save = NULL;
1627 }
1628 ROUTE_RELEASE(&ip6route);
1629 #if IPSEC
1630 ROUTE_RELEASE(&ipsec_state.ro);
1631 if (sp != NULL) {
1632 key_freesp(sp, KEY_SADB_UNLOCKED);
1633 }
1634 #endif /* IPSEC */
1635 #if NECP
1636 ROUTE_RELEASE(&necp_route);
1637 #endif /* NECP */
1638 #if DUMMYNET
1639 ROUTE_RELEASE(&saved_route);
1640 ROUTE_RELEASE(&saved_ro_pmtu);
1641 #endif /* DUMMYNET */
1642
1643 if (ia != NULL) {
1644 ifa_remref(&ia->ia_ifa);
1645 }
1646 if (src_ia != NULL) {
1647 ifa_remref(&src_ia->ia_ifa);
1648 }
1649 if (ifp != NULL) {
1650 ifnet_release(ifp);
1651 }
1652 if (origifp != NULL) {
1653 ifnet_release(origifp);
1654 }
1655 if (ip6_output_measure) {
1656 net_perf_measure_time(&net_perf, &start_tv, packets_processed);
1657 net_perf_histogram(&net_perf, packets_processed);
1658 }
1659 return error;
1660
1661 freehdrs:
1662 if (exthdrs.ip6e_hbh != NULL) {
1663 if (exthdrs.merged) {
1664 panic("Double free of ip6e_hbh");
1665 }
1666 m_freem(exthdrs.ip6e_hbh);
1667 }
1668 if (exthdrs.ip6e_dest1 != NULL) {
1669 if (exthdrs.merged) {
1670 panic("Double free of ip6e_dest1");
1671 }
1672 m_freem(exthdrs.ip6e_dest1);
1673 }
1674 if (exthdrs.ip6e_rthdr != NULL) {
1675 if (exthdrs.merged) {
1676 panic("Double free of ip6e_rthdr");
1677 }
1678 m_freem(exthdrs.ip6e_rthdr);
1679 }
1680 if (exthdrs.ip6e_dest2 != NULL) {
1681 if (exthdrs.merged) {
1682 panic("Double free of ip6e_dest2");
1683 }
1684 m_freem(exthdrs.ip6e_dest2);
1685 }
1686 /* FALLTHRU */
1687 bad:
1688 if (inputchain != NULL) {
1689 m_freem_list(inputchain);
1690 }
1691 if (sendchain != NULL) {
1692 m_freem_list(sendchain);
1693 }
1694 if (m != NULL) {
1695 m_drop(m, DROPTAP_FLAG_DIR_OUT | DROPTAP_FLAG_L2_MISSING, drop_reason, NULL, 0);
1696 }
1697
1698 goto done;
1699
1700 #undef ipf_pktopts
1701 #undef exthdrs
1702 #undef ip6route
1703 #undef ipsec_state
1704 #undef saved_route
1705 #undef saved_ro_pmtu
1706 #undef args
1707 }
1708
1709 /* ip6_fragment_packet
1710 *
1711 * The fragmentation logic is rather complex:
1712 * 1: normal case (dontfrag == 0)
1713 * 1-a: send as is if tlen <= path mtu
1714 * 1-b: fragment if tlen > path mtu
1715 *
1716 * 2: if user asks us not to fragment (dontfrag == 1)
1717 * 2-a: send as is if tlen <= interface mtu
1718 * 2-b: error if tlen > interface mtu
1719 */
1720
1721 static int
ip6_fragment_packet(struct mbuf ** mptr,struct ip6_pktopts * opt,struct ip6_out_args * ip6oa,struct ip6_exthdrs * exthdrsp,struct ifnet * ifp,uint32_t mtu,uint32_t unfragpartlen,int nxt0,uint32_t optlen)1722 ip6_fragment_packet(struct mbuf **mptr, struct ip6_pktopts *opt,
1723 struct ip6_out_args *ip6oa, struct ip6_exthdrs *exthdrsp,
1724 struct ifnet *ifp, uint32_t mtu, uint32_t unfragpartlen,
1725 int nxt0, uint32_t optlen)
1726 {
1727 VERIFY(NULL != mptr);
1728 mbuf_ref_t m = *mptr;
1729 int error = 0;
1730 uint32_t tlen = m->m_pkthdr.len;
1731 boolean_t dontfrag = (opt != NULL && (opt->ip6po_flags & IP6PO_DONTFRAG)) ||
1732 (ip6oa != NULL && (ip6oa->ip6oa_flags & IP6OAF_DONT_FRAG));
1733
1734 if (m->m_pkthdr.pkt_flags & PKTF_FORWARDED) {
1735 dontfrag = TRUE;
1736 /*
1737 * Discard partial sum information if this packet originated
1738 * from another interface; the packet would already have the
1739 * final checksum and we shouldn't recompute it.
1740 */
1741 if ((m->m_pkthdr.csum_flags & (CSUM_DATA_VALID | CSUM_PARTIAL)) ==
1742 (CSUM_DATA_VALID | CSUM_PARTIAL)) {
1743 m->m_pkthdr.csum_flags &= ~CSUM_TX_FLAGS;
1744 m->m_pkthdr.csum_data = 0;
1745 }
1746 }
1747
1748 /* Access without acquiring nd_ifinfo lock for performance */
1749 if (dontfrag && tlen > IN6_LINKMTU(ifp)) { /* case 2-b */
1750 /*
1751 * We do not notify the connection in the same outbound path
1752 * to avoid lock ordering issues.
1753 * The returned error should imply that the packet is too big
1754 * and the application should query the PMTU for a given destination.
1755 */
1756 return EMSGSIZE;
1757 }
1758
1759 /*
1760 * transmit packet without fragmentation
1761 */
1762 if (dontfrag ||
1763 (tlen <= mtu || TSO_IPV6_OK(ifp, m) ||
1764 (ifp->if_hwassist & CSUM_FRAGMENT_IPV6))) {
1765 /*
1766 * mppn not updated in this case because no new chain is formed
1767 * and inserted
1768 */
1769 ip6_output_checksum(ifp, mtu, m, nxt0, tlen, optlen);
1770 } else {
1771 /*
1772 * time to fragment - cases 1-b is handled inside
1773 * ip6_do_fragmentation().
1774 * mppn is passed down to be updated to point at fragment chain.
1775 */
1776 u_int8_t *lexthdrsp;
1777
1778 if (exthdrsp->ip6e_rthdr != NULL) {
1779 lexthdrsp = mtod(exthdrsp->ip6e_rthdr, uint8_t *);
1780 } else if (exthdrsp->ip6e_dest1 != NULL) {
1781 lexthdrsp = mtod(exthdrsp->ip6e_dest1, uint8_t *);
1782 } else if (exthdrsp->ip6e_hbh != NULL) {
1783 lexthdrsp = mtod(exthdrsp->ip6e_hbh, uint8_t *);
1784 } else {
1785 lexthdrsp = NULL;
1786 }
1787 error = ip6_do_fragmentation(mptr, optlen, ifp,
1788 unfragpartlen, mtod(m, struct ip6_hdr *), lexthdrsp, mtu,
1789 nxt0, htonl(ip6_randomid((uint64_t)m)));
1790 }
1791
1792 return error;
1793 }
1794
1795 /*
1796 * ip6_do_fragmentation() is called by ip6_fragment_packet() after determining
1797 * the packet needs to be fragmented. on success, morig is freed and a chain
1798 * of fragments is linked into the packet chain where morig existed. Otherwise,
1799 * an errno is returned.
1800 * optlen: total length of all extension headers (excludes the IPv6 header).
1801 * unfragpartlen: length of the per-fragment headers which consist of the IPv6
1802 * header plus any extension headers that must be processed by nodes
1803 * en route to the destination.
1804 * lexthdrsp: pointer to the last extension header in the unfragmentable part
1805 * or NULL.
1806 * nxt0: upper-layer protocol number.
1807 * id: Identification value to be used in the fragment header.
1808 */
1809 int
ip6_do_fragmentation(struct mbuf ** mptr,uint32_t optlen,struct ifnet * ifp,uint32_t unfragpartlen,struct ip6_hdr * ip6,uint8_t * lexthdrsp,uint32_t mtu,int nxt0,uint32_t id)1810 ip6_do_fragmentation(struct mbuf **mptr, uint32_t optlen, struct ifnet *ifp,
1811 uint32_t unfragpartlen, struct ip6_hdr *ip6, uint8_t *lexthdrsp,
1812 uint32_t mtu, int nxt0, uint32_t id)
1813 {
1814 VERIFY(NULL != mptr);
1815 int error = 0;
1816
1817 mbuf_ref_t morig = *mptr;
1818 mbuf_ref_t first_mbufp = NULL;
1819 mbuf_ref_t last_mbufp = NULL;
1820
1821 uint32_t tlen = morig->m_pkthdr.len;
1822
1823 /* try to fragment the packet. case 1-b */
1824 if ((morig->m_pkthdr.csum_flags & CSUM_TSO_IPV6)) {
1825 /* TSO and fragment aren't compatible */
1826 in6_ifstat_inc(ifp, ifs6_out_fragfail);
1827 return EMSGSIZE;
1828 } else if (mtu < IPV6_MMTU) {
1829 /* path MTU cannot be less than IPV6_MMTU */
1830 in6_ifstat_inc(ifp, ifs6_out_fragfail);
1831 return EMSGSIZE;
1832 } else if (ip6->ip6_plen == 0) {
1833 /* jumbo payload cannot be fragmented */
1834 in6_ifstat_inc(ifp, ifs6_out_fragfail);
1835 return EMSGSIZE;
1836 } else {
1837 uint32_t hlen, off, len;
1838 mbuf_ref_t *mnext = NULL;
1839 struct ip6_frag *__single ip6f;
1840 u_char nextproto;
1841
1842 /*
1843 * Too large for the destination or interface;
1844 * fragment if possible.
1845 * Must be able to put at least 8 bytes per fragment.
1846 */
1847 hlen = unfragpartlen;
1848 if (mtu > IPV6_MAXPACKET) {
1849 mtu = IPV6_MAXPACKET;
1850 }
1851
1852 len = (mtu - hlen - sizeof(struct ip6_frag)) & ~7;
1853 if (len < 8) {
1854 in6_ifstat_inc(ifp, ifs6_out_fragfail);
1855 return EMSGSIZE;
1856 }
1857
1858 /*
1859 * Change the next header field of the last header in the
1860 * unfragmentable part.
1861 */
1862 if (lexthdrsp != NULL) {
1863 nextproto = *lexthdrsp;
1864 *lexthdrsp = IPPROTO_FRAGMENT;
1865 } else {
1866 nextproto = ip6->ip6_nxt;
1867 ip6->ip6_nxt = IPPROTO_FRAGMENT;
1868 }
1869
1870 if (morig->m_pkthdr.csum_flags & CSUM_DELAY_IPV6_DATA) {
1871 in6_delayed_cksum_offset(morig, 0, optlen, nxt0);
1872 }
1873
1874 /*
1875 * Loop through length of segment after first fragment,
1876 * make new header and copy data of each part and link onto
1877 * chain.
1878 */
1879 for (off = hlen; off < tlen; off += len) {
1880 struct ip6_hdr *__single new_mhip6;
1881 mbuf_ref_t new_m;
1882 mbuf_ref_t m_frgpart;
1883
1884 MGETHDR(new_m, M_DONTWAIT, MT_HEADER); /* MAC-OK */
1885 if (new_m == NULL) {
1886 error = ENOBUFS;
1887 ip6stat.ip6s_odropped++;
1888 break;
1889 }
1890 new_m->m_pkthdr.rcvif = NULL;
1891 new_m->m_flags = morig->m_flags & M_COPYFLAGS;
1892
1893 if (first_mbufp != NULL) {
1894 /* Every pass through loop but first */
1895 *mnext = new_m;
1896 last_mbufp = new_m;
1897 } else {
1898 /* This is the first element of the fragment chain */
1899 first_mbufp = new_m;
1900 last_mbufp = new_m;
1901 }
1902 mnext = &new_m->m_nextpkt;
1903
1904 new_m->m_data += max_linkhdr;
1905 new_mhip6 = mtod(new_m, struct ip6_hdr *);
1906 *new_mhip6 = *ip6;
1907 new_m->m_len = sizeof(*new_mhip6);
1908
1909 error = ip6_insertfraghdr(morig, new_m, hlen, &ip6f);
1910 if (error) {
1911 ip6stat.ip6s_odropped++;
1912 break;
1913 }
1914
1915 ip6f->ip6f_offlg = htons((u_short)((off - hlen) & ~7));
1916 if (off + len >= tlen) {
1917 len = tlen - off;
1918 } else {
1919 ip6f->ip6f_offlg |= IP6F_MORE_FRAG;
1920 }
1921 new_mhip6->ip6_plen = htons((u_short)(len + hlen +
1922 sizeof(*ip6f) - sizeof(struct ip6_hdr)));
1923
1924 if ((m_frgpart = m_copy(morig, off, len)) == NULL) {
1925 error = ENOBUFS;
1926 ip6stat.ip6s_odropped++;
1927 break;
1928 }
1929 m_cat(new_m, m_frgpart);
1930 new_m->m_pkthdr.len = len + hlen + sizeof(*ip6f);
1931 new_m->m_pkthdr.rcvif = NULL;
1932
1933 M_COPY_CLASSIFIER(new_m, morig);
1934 M_COPY_PFTAG(new_m, morig);
1935 M_COPY_NECPTAG(new_m, morig);
1936
1937 ip6f->ip6f_reserved = 0;
1938 ip6f->ip6f_ident = id;
1939 ip6f->ip6f_nxt = nextproto;
1940 ip6stat.ip6s_ofragments++;
1941 in6_ifstat_inc(ifp, ifs6_out_fragcreat);
1942 }
1943
1944 if (error) {
1945 /* free all the fragments created */
1946 if (first_mbufp != NULL) {
1947 m_freem_list(first_mbufp);
1948 first_mbufp = NULL;
1949 }
1950 last_mbufp = NULL;
1951 } else {
1952 /* successful fragmenting */
1953 m_freem(morig);
1954 *mptr = first_mbufp;
1955 last_mbufp->m_nextpkt = NULL;
1956 ip6stat.ip6s_fragmented++;
1957 in6_ifstat_inc(ifp, ifs6_out_fragok);
1958 }
1959 }
1960 return error;
1961 }
1962
1963 static int
ip6_copyexthdr(struct mbuf ** mp,caddr_t __indexable hdr,int hlen)1964 ip6_copyexthdr(struct mbuf **mp, caddr_t __indexable hdr, int hlen)
1965 {
1966 mbuf_ref_t m;
1967
1968 if (hlen > MCLBYTES) {
1969 return ENOBUFS; /* XXX */
1970 }
1971 MGET(m, M_DONTWAIT, MT_DATA);
1972 if (m == NULL) {
1973 return ENOBUFS;
1974 }
1975
1976 if (hlen > MLEN) {
1977 MCLGET(m, M_DONTWAIT);
1978 if (!(m->m_flags & M_EXT)) {
1979 m_free(m);
1980 return ENOBUFS;
1981 }
1982 }
1983 m->m_len = hlen;
1984 if (hdr != NULL) {
1985 bcopy(hdr, mtod(m, caddr_t), hlen);
1986 }
1987
1988 *mp = m;
1989 return 0;
1990 }
1991
1992 static void
ip6_out_cksum_stats(int proto,u_int32_t len)1993 ip6_out_cksum_stats(int proto, u_int32_t len)
1994 {
1995 switch (proto) {
1996 case IPPROTO_TCP:
1997 tcp_out6_cksum_stats(len);
1998 break;
1999 case IPPROTO_UDP:
2000 udp_out6_cksum_stats(len);
2001 break;
2002 default:
2003 /* keep only TCP or UDP stats for now */
2004 break;
2005 }
2006 }
2007
2008 /*
2009 * Process a delayed payload checksum calculation (outbound path.)
2010 *
2011 * hoff is the number of bytes beyond the mbuf data pointer which
2012 * points to the IPv6 header. optlen is the number of bytes, if any,
2013 * between the end of IPv6 header and the beginning of the ULP payload
2014 * header, which represents the extension headers. If optlen is less
2015 * than zero, this routine will bail when it detects extension headers.
2016 *
2017 * Returns a bitmask representing all the work done in software.
2018 */
2019 uint32_t
in6_finalize_cksum(struct mbuf * m,uint32_t hoff,int32_t optlen,int32_t nxt0,uint32_t csum_flags)2020 in6_finalize_cksum(struct mbuf *m, uint32_t hoff, int32_t optlen,
2021 int32_t nxt0, uint32_t csum_flags)
2022 {
2023 unsigned char buf[sizeof(struct ip6_hdr)] __attribute__((aligned(8)));
2024 struct ip6_hdr *__single ip6;
2025 uint32_t offset, mlen, hlen, olen, sw_csum;
2026 uint16_t csum, ulpoff, plen;
2027 uint8_t nxt;
2028
2029 _CASSERT(sizeof(csum) == sizeof(uint16_t));
2030 VERIFY(m->m_flags & M_PKTHDR);
2031
2032 sw_csum = (csum_flags & m->m_pkthdr.csum_flags);
2033
2034 if ((sw_csum &= CSUM_DELAY_IPV6_DATA) == 0) {
2035 goto done;
2036 }
2037
2038 mlen = m->m_pkthdr.len; /* total mbuf len */
2039 hlen = sizeof(*ip6); /* IPv6 header len */
2040
2041 /* sanity check (need at least IPv6 header) */
2042 if (mlen < (hoff + hlen)) {
2043 panic("%s: mbuf %p pkt len (%u) < hoff+ip6_hdr "
2044 "(%u+%u)\n", __func__, m, mlen, hoff, hlen);
2045 /* NOTREACHED */
2046 }
2047
2048 /*
2049 * In case the IPv6 header is not contiguous, or not 32-bit
2050 * aligned, copy it to a local buffer.
2051 */
2052 if ((hoff + hlen) > m->m_len ||
2053 !IP6_HDR_ALIGNED_P(mtod(m, caddr_t) + hoff)) {
2054 m_copydata(m, hoff, hlen, (caddr_t)buf);
2055 ip6 = (struct ip6_hdr *)(void *)buf;
2056 } else {
2057 ip6 = (struct ip6_hdr *)(m_mtod_current(m) + hoff);
2058 }
2059
2060 nxt = ip6->ip6_nxt;
2061 plen = ntohs(ip6->ip6_plen);
2062 if (plen != (mlen - (hoff + hlen))) {
2063 plen = OSSwapInt16(plen);
2064 if (plen != (mlen - (hoff + hlen))) {
2065 /* Don't complain for jumbograms */
2066 if (plen != 0 || nxt != IPPROTO_HOPOPTS) {
2067 printf("%s: mbuf 0x%llx proto %d IPv6 "
2068 "plen %d (%x) [swapped %d (%x)] doesn't "
2069 "match actual packet length; %d is used "
2070 "instead\n", __func__,
2071 (uint64_t)VM_KERNEL_ADDRPERM(m), nxt,
2072 ip6->ip6_plen, ip6->ip6_plen, plen, plen,
2073 (mlen - (hoff + hlen)));
2074 }
2075 plen = (uint16_t)(mlen - (hoff + hlen));
2076 }
2077 }
2078
2079 if (optlen < 0) {
2080 /* next header isn't TCP/UDP and we don't know optlen, bail */
2081 if (nxt != IPPROTO_TCP && nxt != IPPROTO_UDP) {
2082 sw_csum = 0;
2083 goto done;
2084 }
2085 olen = 0;
2086 } else {
2087 /* caller supplied the original transport number; use it */
2088 if (nxt0 >= 0) {
2089 nxt = (uint8_t)nxt0;
2090 }
2091 olen = optlen;
2092 }
2093
2094 offset = hoff + hlen + olen; /* ULP header */
2095
2096 /* sanity check */
2097 if (mlen < offset) {
2098 panic("%s: mbuf %p pkt len (%u) < hoff+ip6_hdr+ext_hdr "
2099 "(%u+%u+%u)\n", __func__, m, mlen, hoff, hlen, olen);
2100 /* NOTREACHED */
2101 }
2102
2103 /*
2104 * offset is added to the lower 16-bit value of csum_data,
2105 * which is expected to contain the ULP offset; therefore
2106 * CSUM_PARTIAL offset adjustment must be undone.
2107 */
2108 if ((m->m_pkthdr.csum_flags & (CSUM_PARTIAL | CSUM_DATA_VALID)) ==
2109 (CSUM_PARTIAL | CSUM_DATA_VALID)) {
2110 /*
2111 * Get back the original ULP offset (this will
2112 * undo the CSUM_PARTIAL logic in ip6_output.)
2113 */
2114 m->m_pkthdr.csum_data = (m->m_pkthdr.csum_tx_stuff -
2115 m->m_pkthdr.csum_tx_start);
2116 }
2117
2118 ulpoff = (m->m_pkthdr.csum_data & 0xffff); /* ULP csum offset */
2119
2120 if (mlen < (ulpoff + sizeof(csum))) {
2121 panic("%s: mbuf %p pkt len (%u) proto %d invalid ULP "
2122 "cksum offset (%u) cksum flags 0x%x\n", __func__,
2123 m, mlen, nxt, ulpoff, m->m_pkthdr.csum_flags);
2124 /* NOTREACHED */
2125 }
2126
2127 csum = inet6_cksum(m, 0, offset, plen - olen);
2128
2129 /* Update stats */
2130 ip6_out_cksum_stats(nxt, plen - olen);
2131
2132 /* RFC1122 4.1.3.4 */
2133 if (csum == 0 &&
2134 (m->m_pkthdr.csum_flags & (CSUM_UDPIPV6 | CSUM_ZERO_INVERT))) {
2135 csum = 0xffff;
2136 }
2137
2138 /* Insert the checksum in the ULP csum field */
2139 offset += ulpoff;
2140 if ((offset + sizeof(csum)) > m->m_len) {
2141 m_copyback(m, offset, sizeof(csum), &csum);
2142 } else if (IP6_HDR_ALIGNED_P(mtod(m, char *) + hoff)) {
2143 *(uint16_t *)(void *)(mtod(m, char *) + offset) = csum;
2144 } else {
2145 bcopy(&csum, (mtod(m, char *) + offset), sizeof(csum));
2146 }
2147 m->m_pkthdr.csum_flags &= ~(CSUM_DELAY_IPV6_DATA | CSUM_DATA_VALID |
2148 CSUM_PARTIAL | CSUM_ZERO_INVERT);
2149
2150 done:
2151 return sw_csum;
2152 }
2153
2154 /*
2155 * Insert jumbo payload option.
2156 */
2157 static int
ip6_insert_jumboopt(struct ip6_exthdrs * exthdrs,u_int32_t plen)2158 ip6_insert_jumboopt(struct ip6_exthdrs *exthdrs, u_int32_t plen)
2159 {
2160 mbuf_ref_t mopt;
2161 u_char *optbuf;
2162 u_int32_t v;
2163
2164 #define JUMBOOPTLEN 8 /* length of jumbo payload option and padding */
2165
2166 /*
2167 * If there is no hop-by-hop options header, allocate new one.
2168 * If there is one but it doesn't have enough space to store the
2169 * jumbo payload option, allocate a cluster to store the whole options.
2170 * Otherwise, use it to store the options.
2171 */
2172 if (exthdrs->ip6e_hbh == NULL) {
2173 MGET(mopt, M_DONTWAIT, MT_DATA);
2174 if (mopt == NULL) {
2175 return ENOBUFS;
2176 }
2177 mopt->m_len = JUMBOOPTLEN;
2178 optbuf = mtod(mopt, u_char *);
2179 optbuf[1] = 0; /* = ((JUMBOOPTLEN) >> 3) - 1 */
2180 exthdrs->ip6e_hbh = mopt;
2181 } else {
2182 struct ip6_hbh *hbh;
2183
2184 mopt = exthdrs->ip6e_hbh;
2185 if (M_TRAILINGSPACE(mopt) < JUMBOOPTLEN) {
2186 /*
2187 * XXX assumption:
2188 * - exthdrs->ip6e_hbh is not referenced from places
2189 * other than exthdrs.
2190 * - exthdrs->ip6e_hbh is not an mbuf chain.
2191 */
2192 u_int32_t oldoptlen = mopt->m_len;
2193 mbuf_ref_t n;
2194
2195 /*
2196 * XXX: give up if the whole (new) hbh header does
2197 * not fit even in an mbuf cluster.
2198 */
2199 if (oldoptlen + JUMBOOPTLEN > MCLBYTES) {
2200 return ENOBUFS;
2201 }
2202
2203 /*
2204 * As a consequence, we must always prepare a cluster
2205 * at this point.
2206 */
2207 MGET(n, M_DONTWAIT, MT_DATA);
2208 if (n != NULL) {
2209 MCLGET(n, M_DONTWAIT);
2210 if (!(n->m_flags & M_EXT)) {
2211 m_freem(n);
2212 n = NULL;
2213 }
2214 }
2215 if (n == NULL) {
2216 return ENOBUFS;
2217 }
2218 n->m_len = oldoptlen + JUMBOOPTLEN;
2219 bcopy(mtod(mopt, caddr_t), mtod(n, caddr_t),
2220 oldoptlen);
2221 optbuf = mtod(n, u_char *) + oldoptlen;
2222 m_freem(mopt);
2223 mopt = exthdrs->ip6e_hbh = n;
2224 } else {
2225 optbuf = mtod(mopt, u_char *) + mopt->m_len;
2226 mopt->m_len += JUMBOOPTLEN;
2227 }
2228 optbuf[0] = IP6OPT_PADN;
2229 optbuf[1] = 1;
2230
2231 /*
2232 * Adjust the header length according to the pad and
2233 * the jumbo payload option.
2234 */
2235 hbh = mtod(mopt, struct ip6_hbh *);
2236 hbh->ip6h_len += (JUMBOOPTLEN >> 3);
2237 }
2238
2239 /* fill in the option. */
2240 optbuf[2] = IP6OPT_JUMBO;
2241 optbuf[3] = 4;
2242 v = (u_int32_t)htonl(plen + JUMBOOPTLEN);
2243 bcopy(&v, &optbuf[4], sizeof(u_int32_t));
2244
2245 /* finally, adjust the packet header length */
2246 exthdrs->ip6e_ip6->m_pkthdr.len += JUMBOOPTLEN;
2247
2248 return 0;
2249 #undef JUMBOOPTLEN
2250 }
2251
2252 /*
2253 * Insert fragment header and copy unfragmentable header portions.
2254 */
2255 static int
ip6_insertfraghdr(struct mbuf * m0,struct mbuf * m,int hlen,struct ip6_frag ** frghdrp)2256 ip6_insertfraghdr(struct mbuf *m0, struct mbuf *m, int hlen,
2257 struct ip6_frag **frghdrp)
2258 {
2259 mbuf_ref_t n, mlast;
2260
2261 if (hlen > sizeof(struct ip6_hdr)) {
2262 n = m_copym(m0, sizeof(struct ip6_hdr),
2263 hlen - sizeof(struct ip6_hdr), M_DONTWAIT);
2264 if (n == NULL) {
2265 return ENOBUFS;
2266 }
2267 m->m_next = n;
2268 } else {
2269 n = m;
2270 }
2271
2272 /* Search for the last mbuf of unfragmentable part. */
2273 for (mlast = n; mlast->m_next; mlast = mlast->m_next) {
2274 ;
2275 }
2276
2277 if (!(mlast->m_flags & M_EXT) &&
2278 M_TRAILINGSPACE(mlast) >= sizeof(struct ip6_frag)) {
2279 /* use the trailing space of the last mbuf for the frag hdr */
2280 *frghdrp = (struct ip6_frag *)(mtod(mlast, caddr_t) +
2281 mlast->m_len);
2282 mlast->m_len += sizeof(struct ip6_frag);
2283 m->m_pkthdr.len += sizeof(struct ip6_frag);
2284 } else {
2285 /* allocate a new mbuf for the fragment header */
2286 mbuf_ref_t mfrg;
2287
2288 MGET(mfrg, M_DONTWAIT, MT_DATA);
2289 if (mfrg == NULL) {
2290 return ENOBUFS;
2291 }
2292 mfrg->m_len = sizeof(struct ip6_frag);
2293 *frghdrp = mtod(mfrg, struct ip6_frag *);
2294 mlast->m_next = mfrg;
2295 }
2296
2297 return 0;
2298 }
2299
2300 static int
ip6_getpmtu(struct route_in6 * ro_pmtu,struct route_in6 * ro,struct ifnet * ifp,struct in6_addr * dst,uint32_t dst_ifscope,u_int32_t * mtup)2301 ip6_getpmtu(struct route_in6 *ro_pmtu, struct route_in6 *ro,
2302 struct ifnet *ifp, struct in6_addr *dst, uint32_t dst_ifscope, u_int32_t *mtup)
2303 {
2304 u_int32_t mtu = 0;
2305 int error = 0;
2306
2307 if (ro_pmtu != ro) {
2308 /* The first hop and the final destination may differ. */
2309 struct sockaddr_in6 *__single sa6_dst = SIN6(&ro_pmtu->ro_dst);
2310 if (ROUTE_UNUSABLE(ro_pmtu) ||
2311 !in6_are_addr_equal_scoped(&sa6_dst->sin6_addr, dst, sa6_dst->sin6_scope_id, dst_ifscope)) {
2312 ROUTE_RELEASE(ro_pmtu);
2313 }
2314
2315 if (ro_pmtu->ro_rt == NULL) {
2316 SOCKADDR_ZERO(sa6_dst, sizeof(*sa6_dst));
2317 sa6_dst->sin6_family = AF_INET6;
2318 sa6_dst->sin6_len = sizeof(struct sockaddr_in6);
2319 sa6_dst->sin6_addr = *dst;
2320
2321 rtalloc_scoped((struct route *)ro_pmtu,
2322 ifp != NULL ? ifp->if_index : IFSCOPE_NONE);
2323 }
2324 }
2325
2326 if (ro_pmtu->ro_rt != NULL) {
2327 u_int32_t ifmtu;
2328
2329 if (ifp == NULL) {
2330 ifp = ro_pmtu->ro_rt->rt_ifp;
2331 }
2332 /* Access without acquiring nd_ifinfo lock for performance */
2333 ifmtu = IN6_LINKMTU(ifp);
2334
2335 /*
2336 * Access rmx_mtu without holding the route entry lock,
2337 * for performance; this isn't something that changes
2338 * often, so optimize.
2339 */
2340 mtu = ro_pmtu->ro_rt->rt_rmx.rmx_mtu;
2341 if (mtu > ifmtu || mtu == 0) {
2342 /*
2343 * The MTU on the route is larger than the MTU on
2344 * the interface! This shouldn't happen, unless the
2345 * MTU of the interface has been changed after the
2346 * interface was brought up. Change the MTU in the
2347 * route to match the interface MTU (as long as the
2348 * field isn't locked).
2349 *
2350 * if MTU on the route is 0, we need to fix the MTU.
2351 * this case happens with path MTU discovery timeouts.
2352 */
2353 mtu = ifmtu;
2354 if (!(ro_pmtu->ro_rt->rt_rmx.rmx_locks & RTV_MTU)) {
2355 ro_pmtu->ro_rt->rt_rmx.rmx_mtu = mtu; /* XXX */
2356 }
2357 }
2358 } else {
2359 if (ifp) {
2360 /* Don't hold nd_ifinfo lock for performance */
2361 mtu = IN6_LINKMTU(ifp);
2362 } else {
2363 error = EHOSTUNREACH; /* XXX */
2364 }
2365 }
2366
2367 *mtup = mtu;
2368 return error;
2369 }
2370
2371 /*
2372 * IP6 socket option processing.
2373 */
2374 int
ip6_ctloutput(struct socket * so,struct sockopt * sopt)2375 ip6_ctloutput(struct socket *so, struct sockopt *sopt)
2376 {
2377 int optdatalen, uproto;
2378 void *optdata;
2379 int privileged;
2380 struct inpcb *__single in6p = sotoinpcb(so);
2381 int error = 0, optval = 0;
2382 int level, op = -1, optname = 0;
2383 size_t optlen = 0;
2384 struct proc *__single p;
2385
2386 VERIFY(sopt != NULL);
2387
2388 level = sopt->sopt_level;
2389 op = sopt->sopt_dir;
2390 optname = sopt->sopt_name;
2391 optlen = sopt->sopt_valsize;
2392 p = sopt->sopt_p;
2393 uproto = (int)SOCK_PROTO(so);
2394
2395 privileged = (proc_suser(p) == 0);
2396
2397 if (level == IPPROTO_IPV6) {
2398 boolean_t capture_exthdrstat_in = FALSE;
2399 switch (op) {
2400 case SOPT_SET:
2401 /*
2402 * Wait if we are in the middle of ip6_output
2403 * as we unlocked the socket there and don't
2404 * want to overwrite the IP options
2405 */
2406 if (in6p->inp_sndinprog_cnt > 0) {
2407 lck_mtx_t *__single mutex_held = NULL;
2408
2409 mutex_held = socket_getlock(so, PR_F_WILLUNLOCK);
2410 in6p->inp_sndingprog_waiters++;
2411
2412 while (in6p->inp_sndinprog_cnt > 0) {
2413 msleep(&in6p->inp_sndinprog_cnt, mutex_held,
2414 PSOCK | PCATCH, "inp_sndinprog_cnt",
2415 NULL);
2416 }
2417 in6p->inp_sndingprog_waiters--;
2418 }
2419 switch (optname) {
2420 case IPV6_2292PKTOPTIONS: {
2421 mbuf_ref_t m;
2422
2423 error = soopt_getm(sopt, &m);
2424 if (error != 0) {
2425 break;
2426 }
2427 error = soopt_mcopyin(sopt, m);
2428 if (error != 0) {
2429 break;
2430 }
2431 error = ip6_pcbopts(&in6p->in6p_outputopts,
2432 m, so, sopt);
2433 m_freem(m);
2434 break;
2435 }
2436
2437 /*
2438 * Use of some Hop-by-Hop options or some
2439 * Destination options, might require special
2440 * privilege. That is, normal applications
2441 * (without special privilege) might be forbidden
2442 * from setting certain options in outgoing packets,
2443 * and might never see certain options in received
2444 * packets. [RFC 2292 Section 6]
2445 * KAME specific note:
2446 * KAME prevents non-privileged users from sending or
2447 * receiving ANY hbh/dst options in order to avoid
2448 * overhead of parsing options in the kernel.
2449 */
2450 case IPV6_RECVHOPOPTS:
2451 case IPV6_RECVDSTOPTS:
2452 case IPV6_RECVRTHDRDSTOPTS:
2453 if (!privileged) {
2454 break;
2455 }
2456 OS_FALLTHROUGH;
2457 case IPV6_UNICAST_HOPS:
2458 case IPV6_HOPLIMIT:
2459 case IPV6_RECVPKTINFO:
2460 case IPV6_RECVHOPLIMIT:
2461 case IPV6_RECVRTHDR:
2462 case IPV6_RECVPATHMTU:
2463 case IPV6_RECVTCLASS:
2464 case IPV6_V6ONLY:
2465 case IPV6_AUTOFLOWLABEL:
2466 if (optlen != sizeof(int)) {
2467 error = EINVAL;
2468 break;
2469 }
2470 error = sooptcopyin(sopt, &optval,
2471 sizeof(optval), sizeof(optval));
2472 if (error) {
2473 break;
2474 }
2475
2476 switch (optname) {
2477 case IPV6_UNICAST_HOPS:
2478 if (optval < -1 || optval >= 256) {
2479 error = EINVAL;
2480 } else {
2481 /* -1 = kernel default */
2482 in6p->in6p_hops = (short)optval;
2483 if (in6p->inp_vflag &
2484 INP_IPV4) {
2485 in6p->inp_ip_ttl =
2486 (uint8_t)optval;
2487 }
2488 }
2489 break;
2490 #define OPTSET(bit) do { \
2491 if (optval) \
2492 in6p->inp_flags |= (bit); \
2493 else \
2494 in6p->inp_flags &= ~(bit); \
2495 } while (0)
2496
2497 #define OPTSET2(bit) do { \
2498 if (optval) { \
2499 in6p->inp_flags2 |= (bit); \
2500 } else { \
2501 in6p->inp_flags2 &= ~(bit); \
2502 } \
2503 } while (0)
2504
2505 #define OPTSET2292(bit) do { \
2506 in6p->inp_flags |= IN6P_RFC2292; \
2507 if (optval) \
2508 in6p->inp_flags |= (bit); \
2509 else \
2510 in6p->inp_flags &= ~(bit); \
2511 } while (0)
2512
2513 #define OPTBIT(bit) (in6p->inp_flags & (bit) ? 1 : 0)
2514
2515 case IPV6_RECVPKTINFO:
2516 /* cannot mix with RFC2292 */
2517 if (OPTBIT(IN6P_RFC2292)) {
2518 error = EINVAL;
2519 break;
2520 }
2521 OPTSET(IN6P_PKTINFO);
2522 break;
2523
2524 case IPV6_HOPLIMIT: {
2525 struct ip6_pktopts **optp;
2526
2527 /* cannot mix with RFC2292 */
2528 if (OPTBIT(IN6P_RFC2292)) {
2529 error = EINVAL;
2530 break;
2531 }
2532 optp = &in6p->in6p_outputopts;
2533 error = ip6_pcbopt(IPV6_HOPLIMIT,
2534 (u_char *)&optval, sizeof(optval),
2535 optp, uproto);
2536 break;
2537 }
2538
2539 case IPV6_RECVHOPLIMIT:
2540 /* cannot mix with RFC2292 */
2541 if (OPTBIT(IN6P_RFC2292)) {
2542 error = EINVAL;
2543 break;
2544 }
2545 OPTSET(IN6P_HOPLIMIT);
2546 break;
2547
2548 case IPV6_RECVHOPOPTS:
2549 /* cannot mix with RFC2292 */
2550 if (OPTBIT(IN6P_RFC2292)) {
2551 error = EINVAL;
2552 break;
2553 }
2554 OPTSET(IN6P_HOPOPTS);
2555 capture_exthdrstat_in = TRUE;
2556 break;
2557
2558 case IPV6_RECVDSTOPTS:
2559 /* cannot mix with RFC2292 */
2560 if (OPTBIT(IN6P_RFC2292)) {
2561 error = EINVAL;
2562 break;
2563 }
2564 OPTSET(IN6P_DSTOPTS);
2565 capture_exthdrstat_in = TRUE;
2566 break;
2567
2568 case IPV6_RECVRTHDRDSTOPTS:
2569 /* cannot mix with RFC2292 */
2570 if (OPTBIT(IN6P_RFC2292)) {
2571 error = EINVAL;
2572 break;
2573 }
2574 OPTSET(IN6P_RTHDRDSTOPTS);
2575 capture_exthdrstat_in = TRUE;
2576 break;
2577
2578 case IPV6_RECVRTHDR:
2579 /* cannot mix with RFC2292 */
2580 if (OPTBIT(IN6P_RFC2292)) {
2581 error = EINVAL;
2582 break;
2583 }
2584 OPTSET(IN6P_RTHDR);
2585 capture_exthdrstat_in = TRUE;
2586 break;
2587
2588 case IPV6_RECVPATHMTU:
2589 /*
2590 * We ignore this option for TCP
2591 * sockets.
2592 * (RFC3542 leaves this case
2593 * unspecified.)
2594 */
2595 if (uproto != IPPROTO_TCP) {
2596 OPTSET(IN6P_MTU);
2597 }
2598 break;
2599
2600 case IPV6_V6ONLY:
2601 /*
2602 * make setsockopt(IPV6_V6ONLY)
2603 * available only prior to bind(2).
2604 * see ipng mailing list, Jun 22 2001.
2605 */
2606 if (in6p->inp_lport ||
2607 !IN6_IS_ADDR_UNSPECIFIED(
2608 &in6p->in6p_laddr)) {
2609 error = EINVAL;
2610 break;
2611 }
2612 OPTSET(IN6P_IPV6_V6ONLY);
2613 if (optval) {
2614 in6p->inp_vflag &= ~INP_IPV4;
2615 } else {
2616 in6p->inp_vflag |= INP_IPV4;
2617 }
2618 break;
2619
2620 case IPV6_RECVTCLASS:
2621 /* we can mix with RFC2292 */
2622 OPTSET(IN6P_TCLASS);
2623 break;
2624
2625 case IPV6_AUTOFLOWLABEL:
2626 OPTSET(IN6P_AUTOFLOWLABEL);
2627 break;
2628 }
2629 break;
2630
2631 case IPV6_TCLASS:
2632 case IPV6_DONTFRAG:
2633 case IPV6_USE_MIN_MTU:
2634 case IPV6_PREFER_TEMPADDR: {
2635 struct ip6_pktopts **optp;
2636
2637 if (optlen != sizeof(optval)) {
2638 error = EINVAL;
2639 break;
2640 }
2641 error = sooptcopyin(sopt, &optval,
2642 sizeof(optval), sizeof(optval));
2643 if (error) {
2644 break;
2645 }
2646
2647 optp = &in6p->in6p_outputopts;
2648 error = ip6_pcbopt(optname, (u_char *)&optval,
2649 sizeof(optval), optp, uproto);
2650 switch (optname) {
2651 case IPV6_TCLASS: {
2652 // Add in the ECN flags
2653 u_int8_t tos = (in6p->inp_ip_tos & ~IPTOS_ECN_MASK);
2654 u_int8_t ecn = optval & IPTOS_ECN_MASK;
2655 in6p->inp_ip_tos = tos | ecn;
2656 }
2657 break;
2658 case IPV6_DONTFRAG:
2659 if (in6p->inp_vflag & INP_IPV4) {
2660 OPTSET2(INP2_DONTFRAG);
2661 }
2662 break;
2663 }
2664 break;
2665 }
2666
2667 case IPV6_2292PKTINFO:
2668 case IPV6_2292HOPLIMIT:
2669 case IPV6_2292HOPOPTS:
2670 case IPV6_2292DSTOPTS:
2671 case IPV6_2292RTHDR:
2672 /* RFC 2292 */
2673 if (optlen != sizeof(int)) {
2674 error = EINVAL;
2675 break;
2676 }
2677 error = sooptcopyin(sopt, &optval,
2678 sizeof(optval), sizeof(optval));
2679 if (error) {
2680 break;
2681 }
2682 switch (optname) {
2683 case IPV6_2292PKTINFO:
2684 OPTSET2292(IN6P_PKTINFO);
2685 break;
2686 case IPV6_2292HOPLIMIT:
2687 OPTSET2292(IN6P_HOPLIMIT);
2688 break;
2689 case IPV6_2292HOPOPTS:
2690 /*
2691 * Check super-user privilege.
2692 * See comments for IPV6_RECVHOPOPTS.
2693 */
2694 if (!privileged) {
2695 return EPERM;
2696 }
2697 OPTSET2292(IN6P_HOPOPTS);
2698 capture_exthdrstat_in = TRUE;
2699 break;
2700 case IPV6_2292DSTOPTS:
2701 if (!privileged) {
2702 return EPERM;
2703 }
2704 OPTSET2292(IN6P_DSTOPTS |
2705 IN6P_RTHDRDSTOPTS); /* XXX */
2706 capture_exthdrstat_in = TRUE;
2707 break;
2708 case IPV6_2292RTHDR:
2709 OPTSET2292(IN6P_RTHDR);
2710 capture_exthdrstat_in = TRUE;
2711 break;
2712 }
2713 break;
2714
2715 case IPV6_3542PKTINFO:
2716 case IPV6_3542HOPOPTS:
2717 case IPV6_3542RTHDR:
2718 case IPV6_3542DSTOPTS:
2719 case IPV6_RTHDRDSTOPTS:
2720 case IPV6_3542NEXTHOP: {
2721 struct ip6_pktopts **optp;
2722 /* new advanced API (RFC3542) */
2723 mbuf_ref_t m;
2724
2725 /* cannot mix with RFC2292 */
2726 if (OPTBIT(IN6P_RFC2292)) {
2727 error = EINVAL;
2728 break;
2729 }
2730 error = soopt_getm(sopt, &m);
2731 if (error != 0) {
2732 break;
2733 }
2734 error = soopt_mcopyin(sopt, m);
2735 if (error != 0) {
2736 break;
2737 }
2738
2739 optp = &in6p->in6p_outputopts;
2740 error = ip6_pcbopt(optname, mtod(m, u_char *),
2741 m->m_len, optp, uproto);
2742 m_freem(m);
2743 break;
2744 }
2745 #undef OPTSET
2746 #undef OPTSET2
2747 case IPV6_MULTICAST_IF:
2748 case IPV6_MULTICAST_HOPS:
2749 case IPV6_MULTICAST_LOOP:
2750 case IPV6_JOIN_GROUP:
2751 case IPV6_LEAVE_GROUP:
2752 case IPV6_MSFILTER:
2753 case MCAST_BLOCK_SOURCE:
2754 case MCAST_UNBLOCK_SOURCE:
2755 case MCAST_JOIN_GROUP:
2756 case MCAST_LEAVE_GROUP:
2757 case MCAST_JOIN_SOURCE_GROUP:
2758 case MCAST_LEAVE_SOURCE_GROUP:
2759 error = ip6_setmoptions(in6p, sopt);
2760 break;
2761
2762 case IPV6_PORTRANGE:
2763 error = sooptcopyin(sopt, &optval,
2764 sizeof(optval), sizeof(optval));
2765 if (error) {
2766 break;
2767 }
2768
2769 switch (optval) {
2770 case IPV6_PORTRANGE_DEFAULT:
2771 in6p->inp_flags &= ~(INP_LOWPORT);
2772 in6p->inp_flags &= ~(INP_HIGHPORT);
2773 break;
2774
2775 case IPV6_PORTRANGE_HIGH:
2776 in6p->inp_flags &= ~(INP_LOWPORT);
2777 in6p->inp_flags |= INP_HIGHPORT;
2778 break;
2779
2780 case IPV6_PORTRANGE_LOW:
2781 in6p->inp_flags &= ~(INP_HIGHPORT);
2782 in6p->inp_flags |= INP_LOWPORT;
2783 break;
2784
2785 default:
2786 error = EINVAL;
2787 break;
2788 }
2789 break;
2790 #if IPSEC
2791 case IPV6_IPSEC_POLICY: {
2792 caddr_t req = NULL;
2793 size_t len = 0;
2794 mbuf_ref_t m;
2795
2796 if ((error = soopt_getm(sopt, &m)) != 0) {
2797 break;
2798 }
2799 if ((error = soopt_mcopyin(sopt, m)) != 0) {
2800 break;
2801 }
2802
2803 req = mtod(m, caddr_t);
2804 len = m->m_len;
2805 error = ipsec6_set_policy(in6p, optname, req,
2806 len, privileged);
2807 m_freem(m);
2808 break;
2809 }
2810 #endif /* IPSEC */
2811 /*
2812 * IPv6 variant of IP_BOUND_IF; for details see
2813 * comments on IP_BOUND_IF in ip_ctloutput().
2814 */
2815 case IPV6_BOUND_IF:
2816 /* This option is settable only on IPv6 */
2817 if (!(in6p->inp_vflag & INP_IPV6)) {
2818 error = EINVAL;
2819 break;
2820 }
2821
2822 error = sooptcopyin(sopt, &optval,
2823 sizeof(optval), sizeof(optval));
2824
2825 if (error) {
2826 break;
2827 }
2828
2829 error = inp_bindif(in6p, optval, NULL);
2830 break;
2831
2832 case IPV6_NO_IFT_CELLULAR:
2833 /* This option is settable only for IPv6 */
2834 if (!(in6p->inp_vflag & INP_IPV6)) {
2835 error = EINVAL;
2836 break;
2837 }
2838
2839 error = sooptcopyin(sopt, &optval,
2840 sizeof(optval), sizeof(optval));
2841
2842 if (error) {
2843 break;
2844 }
2845
2846 /* once set, it cannot be unset */
2847 if (!optval && INP_NO_CELLULAR(in6p)) {
2848 error = EINVAL;
2849 break;
2850 }
2851
2852 error = so_set_restrictions(so,
2853 SO_RESTRICT_DENY_CELLULAR);
2854 break;
2855
2856 case IPV6_OUT_IF:
2857 /* This option is not settable */
2858 error = EINVAL;
2859 break;
2860
2861 default:
2862 error = ENOPROTOOPT;
2863 break;
2864 }
2865 if (capture_exthdrstat_in) {
2866 if (uproto == IPPROTO_TCP) {
2867 INC_ATOMIC_INT64_LIM(net_api_stats.nas_sock_inet6_stream_exthdr_in);
2868 } else if (uproto == IPPROTO_UDP) {
2869 INC_ATOMIC_INT64_LIM(net_api_stats.nas_sock_inet6_dgram_exthdr_in);
2870 }
2871 }
2872 break;
2873
2874 case SOPT_GET:
2875 switch (optname) {
2876 case IPV6_2292PKTOPTIONS:
2877 /*
2878 * RFC3542 (effectively) deprecated the
2879 * semantics of the 2292-style pktoptions.
2880 * Since it was not reliable in nature (i.e.,
2881 * applications had to expect the lack of some
2882 * information after all), it would make sense
2883 * to simplify this part by always returning
2884 * empty data.
2885 */
2886 sopt->sopt_valsize = 0;
2887 break;
2888
2889 case IPV6_RECVHOPOPTS:
2890 case IPV6_RECVDSTOPTS:
2891 case IPV6_RECVRTHDRDSTOPTS:
2892 case IPV6_UNICAST_HOPS:
2893 case IPV6_RECVPKTINFO:
2894 case IPV6_RECVHOPLIMIT:
2895 case IPV6_RECVRTHDR:
2896 case IPV6_RECVPATHMTU:
2897 case IPV6_V6ONLY:
2898 case IPV6_PORTRANGE:
2899 case IPV6_RECVTCLASS:
2900 case IPV6_AUTOFLOWLABEL:
2901 switch (optname) {
2902 case IPV6_RECVHOPOPTS:
2903 optval = OPTBIT(IN6P_HOPOPTS);
2904 break;
2905
2906 case IPV6_RECVDSTOPTS:
2907 optval = OPTBIT(IN6P_DSTOPTS);
2908 break;
2909
2910 case IPV6_RECVRTHDRDSTOPTS:
2911 optval = OPTBIT(IN6P_RTHDRDSTOPTS);
2912 break;
2913
2914 case IPV6_UNICAST_HOPS:
2915 optval = in6p->in6p_hops;
2916 break;
2917
2918 case IPV6_RECVPKTINFO:
2919 optval = OPTBIT(IN6P_PKTINFO);
2920 break;
2921
2922 case IPV6_RECVHOPLIMIT:
2923 optval = OPTBIT(IN6P_HOPLIMIT);
2924 break;
2925
2926 case IPV6_RECVRTHDR:
2927 optval = OPTBIT(IN6P_RTHDR);
2928 break;
2929
2930 case IPV6_RECVPATHMTU:
2931 optval = OPTBIT(IN6P_MTU);
2932 break;
2933
2934 case IPV6_V6ONLY:
2935 optval = OPTBIT(IN6P_IPV6_V6ONLY);
2936 break;
2937
2938 case IPV6_PORTRANGE: {
2939 int flags;
2940 flags = in6p->inp_flags;
2941 if (flags & INP_HIGHPORT) {
2942 optval = IPV6_PORTRANGE_HIGH;
2943 } else if (flags & INP_LOWPORT) {
2944 optval = IPV6_PORTRANGE_LOW;
2945 } else {
2946 optval = 0;
2947 }
2948 break;
2949 }
2950 case IPV6_RECVTCLASS:
2951 optval = OPTBIT(IN6P_TCLASS);
2952 break;
2953
2954 case IPV6_AUTOFLOWLABEL:
2955 optval = OPTBIT(IN6P_AUTOFLOWLABEL);
2956 break;
2957 }
2958 if (error) {
2959 break;
2960 }
2961 error = sooptcopyout(sopt, &optval,
2962 sizeof(optval));
2963 break;
2964
2965 case IPV6_PATHMTU: {
2966 u_int32_t pmtu = 0;
2967 struct ip6_mtuinfo mtuinfo;
2968 struct route_in6 sro;
2969
2970 bzero(&sro, sizeof(sro));
2971
2972 if (!(so->so_state & SS_ISCONNECTED)) {
2973 return ENOTCONN;
2974 }
2975 /*
2976 * XXX: we dot not consider the case of source
2977 * routing, or optional information to specify
2978 * the outgoing interface.
2979 */
2980 error = ip6_getpmtu(&sro, NULL, NULL,
2981 &in6p->in6p_faddr, in6p->inp_fifscope, &pmtu);
2982 ROUTE_RELEASE(&sro);
2983 if (error) {
2984 break;
2985 }
2986 if (pmtu > IPV6_MAXPACKET) {
2987 pmtu = IPV6_MAXPACKET;
2988 }
2989
2990 bzero(&mtuinfo, sizeof(mtuinfo));
2991 mtuinfo.ip6m_mtu = (u_int32_t)pmtu;
2992 optdata = (void *)&mtuinfo;
2993 optdatalen = sizeof(mtuinfo);
2994 error = sooptcopyout(sopt, optdata,
2995 optdatalen);
2996 break;
2997 }
2998
2999 case IPV6_2292PKTINFO:
3000 case IPV6_2292HOPLIMIT:
3001 case IPV6_2292HOPOPTS:
3002 case IPV6_2292RTHDR:
3003 case IPV6_2292DSTOPTS:
3004 switch (optname) {
3005 case IPV6_2292PKTINFO:
3006 optval = OPTBIT(IN6P_PKTINFO);
3007 break;
3008 case IPV6_2292HOPLIMIT:
3009 optval = OPTBIT(IN6P_HOPLIMIT);
3010 break;
3011 case IPV6_2292HOPOPTS:
3012 optval = OPTBIT(IN6P_HOPOPTS);
3013 break;
3014 case IPV6_2292RTHDR:
3015 optval = OPTBIT(IN6P_RTHDR);
3016 break;
3017 case IPV6_2292DSTOPTS:
3018 optval = OPTBIT(IN6P_DSTOPTS |
3019 IN6P_RTHDRDSTOPTS);
3020 break;
3021 }
3022 error = sooptcopyout(sopt, &optval,
3023 sizeof(optval));
3024 break;
3025
3026 case IPV6_PKTINFO:
3027 case IPV6_HOPOPTS:
3028 case IPV6_RTHDR:
3029 case IPV6_DSTOPTS:
3030 case IPV6_RTHDRDSTOPTS:
3031 case IPV6_NEXTHOP:
3032 case IPV6_TCLASS:
3033 case IPV6_DONTFRAG:
3034 case IPV6_USE_MIN_MTU:
3035 case IPV6_PREFER_TEMPADDR:
3036 error = ip6_getpcbopt(in6p->in6p_outputopts,
3037 optname, sopt);
3038 break;
3039
3040 case IPV6_MULTICAST_IF:
3041 case IPV6_MULTICAST_HOPS:
3042 case IPV6_MULTICAST_LOOP:
3043 case IPV6_MSFILTER:
3044 error = ip6_getmoptions(in6p, sopt);
3045 break;
3046 #if IPSEC
3047 case IPV6_IPSEC_POLICY: {
3048 error = 0; /* This option is no longer supported */
3049 break;
3050 }
3051 #endif /* IPSEC */
3052 case IPV6_BOUND_IF:
3053 if (in6p->inp_flags & INP_BOUND_IF) {
3054 optval = in6p->inp_boundifp->if_index;
3055 }
3056 error = sooptcopyout(sopt, &optval,
3057 sizeof(optval));
3058 break;
3059
3060 case IPV6_NO_IFT_CELLULAR:
3061 optval = INP_NO_CELLULAR(in6p) ? 1 : 0;
3062 error = sooptcopyout(sopt, &optval,
3063 sizeof(optval));
3064 break;
3065
3066 case IPV6_OUT_IF:
3067 optval = (in6p->in6p_last_outifp != NULL) ?
3068 in6p->in6p_last_outifp->if_index : 0;
3069 error = sooptcopyout(sopt, &optval,
3070 sizeof(optval));
3071 break;
3072
3073 default:
3074 error = ENOPROTOOPT;
3075 break;
3076 }
3077 break;
3078 }
3079 } else if (sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_BINDTODEVICE) {
3080 char namebuf[IFNAMSIZ + 1] = {};
3081
3082 switch (op) {
3083 case SOPT_SET:
3084 error = sooptcopyin_bindtodevice(sopt, namebuf, sizeof(namebuf));
3085 if (error != 0) {
3086 break;
3087 }
3088 namebuf[IFNAMSIZ] = 0;
3089
3090 error = inp_bindtodevice(in6p, __unsafe_null_terminated_from_indexable(namebuf));
3091
3092 break;
3093 case SOPT_GET:
3094 if (in6p->inp_flags & INP_BOUND_IF) {
3095 strlcpy(namebuf, in6p->inp_boundifp->if_xname, IFNAMSIZ);
3096 }
3097 error = sooptcopyout(sopt, &namebuf, IFNAMSIZ);
3098 break;
3099 }
3100 } else {
3101 error = EINVAL;
3102 }
3103 return error;
3104 }
3105
3106 int
ip6_raw_ctloutput(struct socket * so,struct sockopt * sopt)3107 ip6_raw_ctloutput(struct socket *so, struct sockopt *sopt)
3108 {
3109 int error = 0, optval;
3110 size_t optlen;
3111 const int icmp6off = offsetof(struct icmp6_hdr, icmp6_cksum);
3112 struct inpcb *__single in6p = sotoinpcb(so);
3113 int level, op, optname;
3114
3115 level = sopt->sopt_level;
3116 op = sopt->sopt_dir;
3117 optname = sopt->sopt_name;
3118 optlen = sopt->sopt_valsize;
3119
3120 if (level != IPPROTO_IPV6) {
3121 return EINVAL;
3122 }
3123
3124 switch (optname) {
3125 case IPV6_CHECKSUM:
3126 /*
3127 * For ICMPv6 sockets, no modification allowed for checksum
3128 * offset, permit "no change" values to help existing apps.
3129 *
3130 * RFC3542 says: "An attempt to set IPV6_CHECKSUM
3131 * for an ICMPv6 socket will fail."
3132 * The current behavior does not meet RFC3542.
3133 */
3134 switch (op) {
3135 case SOPT_SET:
3136 if (optlen != sizeof(int)) {
3137 error = EINVAL;
3138 break;
3139 }
3140 error = sooptcopyin(sopt, &optval, sizeof(optval),
3141 sizeof(optval));
3142 if (error) {
3143 break;
3144 }
3145 if ((optval % 2) != 0) {
3146 /* the API assumes even offset values */
3147 error = EINVAL;
3148 } else if (SOCK_PROTO(so) == IPPROTO_ICMPV6) {
3149 if (optval != icmp6off) {
3150 error = EINVAL;
3151 }
3152 } else {
3153 in6p->in6p_cksum = optval;
3154 }
3155 break;
3156
3157 case SOPT_GET:
3158 if (SOCK_PROTO(so) == IPPROTO_ICMPV6) {
3159 optval = icmp6off;
3160 } else {
3161 optval = in6p->in6p_cksum;
3162 }
3163
3164 error = sooptcopyout(sopt, &optval, sizeof(optval));
3165 break;
3166
3167 default:
3168 error = EINVAL;
3169 break;
3170 }
3171 break;
3172 default:
3173 error = ENOPROTOOPT;
3174 break;
3175 }
3176
3177 return error;
3178 }
3179
3180 /*
3181 * Set up IP6 options in pcb for insertion in output packets or
3182 * specifying behavior of outgoing packets.
3183 */
3184 static int
ip6_pcbopts(struct ip6_pktopts ** pktopt,struct mbuf * m,struct socket * so,struct sockopt * sopt)3185 ip6_pcbopts(struct ip6_pktopts **pktopt, struct mbuf *m, struct socket *so,
3186 struct sockopt *sopt)
3187 {
3188 #pragma unused(sopt)
3189 struct ip6_pktopts *__single opt = *pktopt;
3190 int error = 0;
3191
3192 /* turn off any old options. */
3193 if (opt != NULL) {
3194 #if DIAGNOSTIC
3195 if (opt->ip6po_pktinfo || opt->ip6po_nexthop ||
3196 opt->ip6po_hbh || opt->ip6po_dest1 || opt->ip6po_dest2 ||
3197 opt->ip6po_rhinfo.ip6po_rhi_rthdr) {
3198 printf("%s: all specified options are cleared.\n",
3199 __func__);
3200 }
3201 #endif
3202 ip6_clearpktopts(opt, -1);
3203 } else {
3204 opt = kalloc_type(struct ip6_pktopts, Z_WAITOK | Z_NOFAIL);
3205 }
3206 *pktopt = NULL;
3207
3208 if (m == NULL || m->m_len == 0) {
3209 /*
3210 * Only turning off any previous options, regardless of
3211 * whether the opt is just created or given.
3212 */
3213 if (opt != NULL) {
3214 kfree_type(struct ip6_pktopts, opt);
3215 }
3216 return 0;
3217 }
3218
3219 /* set options specified by user. */
3220 if ((error = ip6_setpktopts(m, opt, NULL, SOCK_PROTO(so))) != 0) {
3221 ip6_clearpktopts(opt, -1); /* XXX: discard all options */
3222 kfree_type(struct ip6_pktopts, opt);
3223 return error;
3224 }
3225 *pktopt = opt;
3226 return 0;
3227 }
3228
3229 /*
3230 * initialize ip6_pktopts. beware that there are non-zero default values in
3231 * the struct.
3232 */
3233 void
ip6_initpktopts(struct ip6_pktopts * opt)3234 ip6_initpktopts(struct ip6_pktopts *opt)
3235 {
3236 bzero(opt, sizeof(*opt));
3237 opt->ip6po_hlim = -1; /* -1 means default hop limit */
3238 opt->ip6po_tclass = -1; /* -1 means default traffic class */
3239 opt->ip6po_minmtu = IP6PO_MINMTU_MCASTONLY;
3240 opt->ip6po_prefer_tempaddr = IP6PO_TEMPADDR_SYSTEM;
3241 }
3242
3243 static int
ip6_pcbopt(int optname,u_char * buf __sized_by (len),int len,struct ip6_pktopts ** pktopt,int uproto)3244 ip6_pcbopt(int optname, u_char *buf __sized_by(len), int len, struct ip6_pktopts **pktopt,
3245 int uproto)
3246 {
3247 struct ip6_pktopts *__single opt;
3248
3249 opt = *pktopt;
3250 if (opt == NULL) {
3251 opt = kalloc_type(struct ip6_pktopts, Z_WAITOK | Z_NOFAIL);
3252 ip6_initpktopts(opt);
3253 *pktopt = opt;
3254 }
3255
3256 return ip6_setpktopt(optname, buf, len, opt, 1, 0, uproto);
3257 }
3258
3259 static int
ip6_getpcbopt(struct ip6_pktopts * pktopt,int optname,struct sockopt * sopt)3260 ip6_getpcbopt(struct ip6_pktopts *pktopt, int optname, struct sockopt *sopt)
3261 {
3262 struct ip6_ext *ip6e;
3263
3264 /*
3265 * Buffer for serialization of empty IPV6_PKTINO option.
3266 * Initialized only once.
3267 */
3268 static uint8_t null_pktinfo_bytes[sizeof(struct in6_pktinfo)] = {0, };
3269
3270 switch (optname) {
3271 case IPV6_PKTINFO:
3272 if (pktopt && pktopt->ip6po_pktinfo) {
3273 return sooptcopyout(sopt, &pktopt->ip6po_pktinfo, sizeof(struct in6_pktinfo));
3274 } else {
3275 return sooptcopyout(sopt, &null_pktinfo_bytes, sizeof(struct in6_pktinfo));
3276 }
3277 case IPV6_TCLASS: {
3278 int optval;
3279 if (pktopt && pktopt->ip6po_tclass >= 0) {
3280 optval = pktopt->ip6po_tclass;
3281 } else {
3282 optval = 0;
3283 }
3284 return sooptcopyout(sopt, &optval, sizeof(optval));
3285 }
3286 case IPV6_HOPOPTS:
3287 if (pktopt && pktopt->ip6po_hbh) {
3288 ip6e = (struct ip6_ext *)pktopt->ip6po_hbh;
3289 return sooptcopyout(sopt, &pktopt->ip6po_hbh, IP6_EXT_LEN(ip6e));
3290 }
3291 break;
3292 case IPV6_RTHDR:
3293 if (pktopt && pktopt->ip6po_rthdr) {
3294 ip6e = (struct ip6_ext *)pktopt->ip6po_rthdr;
3295 return sooptcopyout(sopt, &pktopt->ip6po_rthdr, IP6_EXT_LEN(ip6e));
3296 }
3297 break;
3298 case IPV6_RTHDRDSTOPTS:
3299 if (pktopt && pktopt->ip6po_dest1) {
3300 ip6e = (struct ip6_ext *)pktopt->ip6po_dest1;
3301 return sooptcopyout(sopt, &pktopt->ip6po_dest1, IP6_EXT_LEN(ip6e));
3302 }
3303 break;
3304 case IPV6_DSTOPTS:
3305 if (pktopt && pktopt->ip6po_dest2) {
3306 ip6e = (struct ip6_ext *)pktopt->ip6po_dest2;
3307 return sooptcopyout(sopt, &pktopt->ip6po_dest2, IP6_EXT_LEN(ip6e));
3308 }
3309 break;
3310 case IPV6_NEXTHOP:
3311 if (pktopt && pktopt->ip6po_nexthop) {
3312 return sooptcopyout(sopt, &pktopt->ip6po_nexthop, pktopt->ip6po_nexthop->sa_len);
3313 }
3314 break;
3315 case IPV6_USE_MIN_MTU: {
3316 int optval;
3317 if (pktopt) {
3318 optval = pktopt->ip6po_minmtu;
3319 } else {
3320 optval = IP6PO_MINMTU_MCASTONLY;
3321 }
3322 return sooptcopyout(sopt, &optval, sizeof(optval));
3323 }
3324 case IPV6_DONTFRAG: {
3325 int on;
3326 if (pktopt && ((pktopt->ip6po_flags) & IP6PO_DONTFRAG)) {
3327 on = 1;
3328 } else {
3329 on = 0;
3330 }
3331 return sooptcopyout(sopt, &on, sizeof(on));
3332 }
3333 case IPV6_PREFER_TEMPADDR: {
3334 int optval;
3335 if (pktopt) {
3336 optval = pktopt->ip6po_prefer_tempaddr;
3337 } else {
3338 optval = IP6PO_TEMPADDR_SYSTEM;
3339 }
3340 return sooptcopyout(sopt, &optval, sizeof(optval));
3341 }
3342 default: /* should not happen */
3343 #ifdef DIAGNOSTIC
3344 panic("ip6_getpcbopt: unexpected option");
3345 #endif
3346 return ENOPROTOOPT;
3347 }
3348
3349 // for bincompat, update sopt->sopt_valsize to be 0
3350 return sooptcopyout(sopt, NULL, 0);
3351 }
3352
3353 void
ip6_clearpktopts(struct ip6_pktopts * pktopt,int optname)3354 ip6_clearpktopts(struct ip6_pktopts *pktopt, int optname)
3355 {
3356 if (pktopt == NULL) {
3357 return;
3358 }
3359
3360 if (optname == -1 || optname == IPV6_PKTINFO) {
3361 if (pktopt->ip6po_pktinfo) {
3362 kfree_type(struct in6_pktinfo, pktopt->ip6po_pktinfo);
3363 }
3364 pktopt->ip6po_pktinfo = NULL;
3365 }
3366 if (optname == -1 || optname == IPV6_HOPLIMIT) {
3367 pktopt->ip6po_hlim = -1;
3368 }
3369 if (optname == -1 || optname == IPV6_TCLASS) {
3370 pktopt->ip6po_tclass = -1;
3371 }
3372 if (optname == -1 || optname == IPV6_NEXTHOP) {
3373 ROUTE_RELEASE(&pktopt->ip6po_nextroute);
3374 if (pktopt->ip6po_nexthop) {
3375 kfree_data_addr(pktopt->ip6po_nexthop);
3376 }
3377 pktopt->ip6po_nexthop = NULL;
3378 }
3379 if (optname == -1 || optname == IPV6_HOPOPTS) {
3380 if (pktopt->ip6po_hbh) {
3381 kfree_data_addr(pktopt->ip6po_hbh);
3382 }
3383 pktopt->ip6po_hbh = NULL;
3384 }
3385 if (optname == -1 || optname == IPV6_RTHDRDSTOPTS) {
3386 if (pktopt->ip6po_dest1) {
3387 kfree_data_addr(pktopt->ip6po_dest1);
3388 }
3389 pktopt->ip6po_dest1 = NULL;
3390 }
3391 if (optname == -1 || optname == IPV6_RTHDR) {
3392 if (pktopt->ip6po_rhinfo.ip6po_rhi_rthdr) {
3393 kfree_data_addr(pktopt->ip6po_rhinfo.ip6po_rhi_rthdr);
3394 }
3395 pktopt->ip6po_rhinfo.ip6po_rhi_rthdr = NULL;
3396 ROUTE_RELEASE(&pktopt->ip6po_route);
3397 }
3398 if (optname == -1 || optname == IPV6_DSTOPTS) {
3399 if (pktopt->ip6po_dest2) {
3400 kfree_data_addr(pktopt->ip6po_dest2);
3401 }
3402 pktopt->ip6po_dest2 = NULL;
3403 }
3404 }
3405
3406 #define PKTOPT_EXTHDRCPY(t, f) do { \
3407 if (src->f != NULL) { \
3408 int hlen = \
3409 (((struct ip6_ext *)src->f)->ip6e_len + 1) << 3; \
3410 dst->f = kalloc_data(hlen, canwait); \
3411 if (dst->f == NULL && canwait == Z_NOWAIT) \
3412 goto bad; \
3413 bcopy(GET_IP6EXTHDR(src, t, f), \
3414 GET_IP6EXTHDR(dst, t, f), \
3415 hlen); \
3416 } \
3417 } while (0)
3418
3419 #define GET_IP6_DEST_OPT(b, d, dlen) { \
3420 do { \
3421 struct ip6_dest *t = (struct ip6_dest *)(void *)buf; \
3422 (dlen) = (t->ip6d_len + 1) << 3; \
3423 (d) = __unsafe_forge_bidi_indexable(struct ip6_dest *, (b), len); \
3424 } while(0); \
3425 }
3426
3427 static int
copypktopts(struct ip6_pktopts * dst,struct ip6_pktopts * src,zalloc_flags_t canwait)3428 copypktopts(struct ip6_pktopts *dst, struct ip6_pktopts *src, zalloc_flags_t canwait)
3429 {
3430 if (dst == NULL || src == NULL) {
3431 printf("copypktopts: invalid argument\n");
3432 return EINVAL;
3433 }
3434
3435 dst->ip6po_hlim = src->ip6po_hlim;
3436 dst->ip6po_tclass = src->ip6po_tclass;
3437 dst->ip6po_flags = src->ip6po_flags;
3438 if (src->ip6po_pktinfo) {
3439 dst->ip6po_pktinfo = kalloc_type(struct in6_pktinfo, canwait);
3440 if (dst->ip6po_pktinfo == NULL && canwait == Z_NOWAIT) {
3441 goto bad;
3442 }
3443 *dst->ip6po_pktinfo = *src->ip6po_pktinfo;
3444 }
3445 if (src->ip6po_nexthop) {
3446 dst->ip6po_nexthop = kalloc_data(src->ip6po_nexthop->sa_len, canwait);
3447 if (dst->ip6po_nexthop == NULL && canwait == Z_NOWAIT) {
3448 goto bad;
3449 }
3450 SOCKADDR_COPY(src->ip6po_nexthop, dst->ip6po_nexthop,
3451 src->ip6po_nexthop->sa_len);
3452 }
3453 PKTOPT_EXTHDRCPY(struct ip6_hbh*, ip6po_hbh);
3454 PKTOPT_EXTHDRCPY(struct ip6_dest*, ip6po_dest1);
3455 PKTOPT_EXTHDRCPY(struct ip6_dest*, ip6po_dest2);
3456 PKTOPT_EXTHDRCPY(struct ip6_rthdr*, ip6po_rthdr); /* not copy the cached route */
3457 return 0;
3458
3459 bad:
3460 ip6_clearpktopts(dst, -1);
3461 return ENOBUFS;
3462 }
3463 #undef PKTOPT_EXTHDRCPY
3464
3465 struct ip6_pktopts *
ip6_copypktopts(struct ip6_pktopts * src,zalloc_flags_t canwait)3466 ip6_copypktopts(struct ip6_pktopts *src, zalloc_flags_t canwait)
3467 {
3468 int error;
3469 struct ip6_pktopts *__single dst;
3470
3471 dst = kalloc_type(struct ip6_pktopts, canwait);
3472 if (dst == NULL) {
3473 return NULL;
3474 }
3475 ip6_initpktopts(dst);
3476
3477 if ((error = copypktopts(dst, src, canwait)) != 0) {
3478 kfree_type(struct ip6_pktopts, dst);
3479 return NULL;
3480 }
3481
3482 return dst;
3483 }
3484
3485 void
ip6_freepcbopts(struct ip6_pktopts * pktopt)3486 ip6_freepcbopts(struct ip6_pktopts *pktopt)
3487 {
3488 if (pktopt == NULL) {
3489 return;
3490 }
3491
3492 ip6_clearpktopts(pktopt, -1);
3493
3494 kfree_type(struct ip6_pktopts, pktopt);
3495 }
3496
3497 void
ip6_moptions_init(void)3498 ip6_moptions_init(void)
3499 {
3500 PE_parse_boot_argn("ifa_debug", &im6o_debug, sizeof(im6o_debug));
3501
3502 vm_size_t im6o_size = (im6o_debug == 0) ? sizeof(struct ip6_moptions) :
3503 sizeof(struct ip6_moptions_dbg);
3504
3505 im6o_zone = zone_create(IM6O_ZONE_NAME, im6o_size, ZC_ZFREE_CLEARMEM);
3506 }
3507
3508 void
im6o_addref(struct ip6_moptions * im6o,int locked)3509 im6o_addref(struct ip6_moptions *im6o, int locked)
3510 {
3511 if (!locked) {
3512 IM6O_LOCK(im6o);
3513 } else {
3514 IM6O_LOCK_ASSERT_HELD(im6o);
3515 }
3516
3517 if (++im6o->im6o_refcnt == 0) {
3518 panic("%s: im6o %p wraparound refcnt", __func__, im6o);
3519 /* NOTREACHED */
3520 } else if (im6o->im6o_trace != NULL) {
3521 (*im6o->im6o_trace)(im6o, TRUE);
3522 }
3523
3524 if (!locked) {
3525 IM6O_UNLOCK(im6o);
3526 }
3527 }
3528
3529 void
im6o_remref(struct ip6_moptions * im6o)3530 im6o_remref(struct ip6_moptions *im6o)
3531 {
3532 int i;
3533
3534 IM6O_LOCK(im6o);
3535 if (im6o->im6o_refcnt == 0) {
3536 panic("%s: im6o %p negative refcnt", __func__, im6o);
3537 /* NOTREACHED */
3538 } else if (im6o->im6o_trace != NULL) {
3539 (*im6o->im6o_trace)(im6o, FALSE);
3540 }
3541
3542 --im6o->im6o_refcnt;
3543 if (im6o->im6o_refcnt > 0) {
3544 IM6O_UNLOCK(im6o);
3545 return;
3546 }
3547
3548 for (i = 0; i < im6o->im6o_num_memberships; ++i) {
3549 struct in6_mfilter *__single imf;
3550
3551 imf = im6o->im6o_mfilters ? &im6o->im6o_mfilters[i] : NULL;
3552 if (imf != NULL) {
3553 im6f_leave(imf);
3554 }
3555
3556 (void) in6_mc_leave(im6o->im6o_membership[i], imf);
3557
3558 if (imf != NULL) {
3559 im6f_purge(imf);
3560 }
3561
3562 IN6M_REMREF(im6o->im6o_membership[i]);
3563 im6o->im6o_membership[i] = NULL;
3564 }
3565 im6o->im6o_num_memberships = 0;
3566 IM6O_UNLOCK(im6o);
3567
3568 kfree_type_counted_by(struct in6_multi *, im6o->im6o_max_memberships, im6o->im6o_membership);
3569 kfree_type_counted_by(struct in6_mfilter, im6o->im6o_max_filters, im6o->im6o_mfilters);
3570
3571 lck_mtx_destroy(&im6o->im6o_lock, &ifa_mtx_grp);
3572
3573 if (!(im6o->im6o_debug & IFD_ALLOC)) {
3574 panic("%s: im6o %p cannot be freed", __func__, im6o);
3575 /* NOTREACHED */
3576 }
3577 zfree(im6o_zone, im6o);
3578 }
3579
3580 static void
im6o_trace(struct ip6_moptions * im6o,int refhold)3581 im6o_trace(struct ip6_moptions *im6o, int refhold)
3582 {
3583 struct ip6_moptions_dbg *im6o_dbg = (struct ip6_moptions_dbg *)im6o;
3584 ctrace_t *tr;
3585 u_int32_t idx;
3586 u_int16_t *cnt;
3587
3588 if (!(im6o->im6o_debug & IFD_DEBUG)) {
3589 panic("%s: im6o %p has no debug structure", __func__, im6o);
3590 /* NOTREACHED */
3591 }
3592 if (refhold) {
3593 cnt = &im6o_dbg->im6o_refhold_cnt;
3594 tr = im6o_dbg->im6o_refhold;
3595 } else {
3596 cnt = &im6o_dbg->im6o_refrele_cnt;
3597 tr = im6o_dbg->im6o_refrele;
3598 }
3599
3600 idx = os_atomic_inc_orig(cnt, relaxed) % IM6O_TRACE_HIST_SIZE;
3601 ctrace_record(&tr[idx]);
3602 }
3603
3604 struct ip6_moptions *
ip6_allocmoptions(zalloc_flags_t how)3605 ip6_allocmoptions(zalloc_flags_t how)
3606 {
3607 struct ip6_moptions *im6o;
3608
3609 im6o = zalloc_flags(im6o_zone, how | Z_ZERO);
3610 if (im6o != NULL) {
3611 lck_mtx_init(&im6o->im6o_lock, &ifa_mtx_grp, &ifa_mtx_attr);
3612 im6o->im6o_debug |= IFD_ALLOC;
3613 if (im6o_debug != 0) {
3614 im6o->im6o_debug |= IFD_DEBUG;
3615 im6o->im6o_trace = im6o_trace;
3616 }
3617 IM6O_ADDREF(im6o);
3618 }
3619
3620 return im6o;
3621 }
3622
3623 /*
3624 * Set IPv6 outgoing packet options based on advanced API.
3625 */
3626 int
ip6_setpktopts(struct mbuf * control,struct ip6_pktopts * opt,struct ip6_pktopts * stickyopt,int uproto)3627 ip6_setpktopts(struct mbuf *control, struct ip6_pktopts *opt,
3628 struct ip6_pktopts *stickyopt, int uproto)
3629 {
3630 struct cmsghdr *cm = NULL;
3631
3632 if (control == NULL || opt == NULL) {
3633 return EINVAL;
3634 }
3635
3636 ip6_initpktopts(opt);
3637 if (stickyopt != NULL) {
3638 int error;
3639
3640 /*
3641 * If stickyopt is provided, make a local copy of the options
3642 * for this particular packet, then override them by ancillary
3643 * objects.
3644 * XXX: copypktopts() does not copy the cached route to a next
3645 * hop (if any). This is not very good in terms of efficiency,
3646 * but we can allow this since this option should be rarely
3647 * used.
3648 */
3649
3650 if ((error = copypktopts(opt, stickyopt, Z_NOWAIT)) != 0) {
3651 return error;
3652 }
3653 }
3654
3655 /*
3656 * XXX: Currently, we assume all the optional information is stored
3657 * in a single mbuf.
3658 */
3659 if (control->m_next) {
3660 return EINVAL;
3661 }
3662
3663 if (control->m_len < CMSG_LEN(0)) {
3664 return EINVAL;
3665 }
3666
3667 for (cm = M_FIRST_CMSGHDR(control);
3668 is_cmsg_valid(control, cm);
3669 cm = M_NXT_CMSGHDR(control, cm)) {
3670 int error;
3671
3672 if (cm->cmsg_level != IPPROTO_IPV6) {
3673 continue;
3674 }
3675
3676 error = ip6_setpktopt(cm->cmsg_type, CMSG_DATA(cm),
3677 cm->cmsg_len - CMSG_LEN(0), opt, 0, 1, uproto);
3678 if (error) {
3679 return error;
3680 }
3681 }
3682
3683 return 0;
3684 }
3685 /*
3686 * Set a particular packet option, as a sticky option or an ancillary data
3687 * item. "len" can be 0 only when it's a sticky option.
3688 * We have 4 cases of combination of "sticky" and "cmsg":
3689 * "sticky=0, cmsg=0": impossible
3690 * "sticky=0, cmsg=1": RFC2292 or RFC3542 ancillary data
3691 * "sticky=1, cmsg=0": RFC3542 socket option
3692 * "sticky=1, cmsg=1": RFC2292 socket option
3693 */
3694 static int
ip6_setpktopt(int optname,uint8_t * buf __sized_by (len),int len,struct ip6_pktopts * opt,int sticky,int cmsg,int uproto)3695 ip6_setpktopt(int optname, uint8_t *buf __sized_by(len), int len, struct ip6_pktopts *opt,
3696 int sticky, int cmsg, int uproto)
3697 {
3698 int minmtupolicy, preftemp;
3699 int error;
3700 boolean_t capture_exthdrstat_out = FALSE;
3701
3702 if (!sticky && !cmsg) {
3703 #ifdef DIAGNOSTIC
3704 printf("ip6_setpktopt: impossible case\n");
3705 #endif
3706 return EINVAL;
3707 }
3708
3709 /*
3710 * Caller must have ensured that the buffer is at least
3711 * aligned on 32-bit boundary.
3712 */
3713 VERIFY(IS_P2ALIGNED(buf, sizeof(u_int32_t)));
3714
3715 /*
3716 * IPV6_2292xxx is for backward compatibility to RFC2292, and should
3717 * not be specified in the context of RFC3542. Conversely,
3718 * RFC3542 types should not be specified in the context of RFC2292.
3719 */
3720 if (!cmsg) {
3721 switch (optname) {
3722 case IPV6_2292PKTINFO:
3723 case IPV6_2292HOPLIMIT:
3724 case IPV6_2292NEXTHOP:
3725 case IPV6_2292HOPOPTS:
3726 case IPV6_2292DSTOPTS:
3727 case IPV6_2292RTHDR:
3728 case IPV6_2292PKTOPTIONS:
3729 return ENOPROTOOPT;
3730 }
3731 }
3732 if (sticky && cmsg) {
3733 switch (optname) {
3734 case IPV6_PKTINFO:
3735 case IPV6_HOPLIMIT:
3736 case IPV6_NEXTHOP:
3737 case IPV6_HOPOPTS:
3738 case IPV6_DSTOPTS:
3739 case IPV6_RTHDRDSTOPTS:
3740 case IPV6_RTHDR:
3741 case IPV6_USE_MIN_MTU:
3742 case IPV6_DONTFRAG:
3743 case IPV6_TCLASS:
3744 case IPV6_PREFER_TEMPADDR: /* XXX: not an RFC3542 option */
3745 return ENOPROTOOPT;
3746 }
3747 }
3748
3749 switch (optname) {
3750 case IPV6_2292PKTINFO:
3751 case IPV6_PKTINFO: {
3752 struct ifnet *__single ifp = NULL;
3753 struct in6_pktinfo *pktinfo;
3754
3755 if (len != sizeof(struct in6_pktinfo)) {
3756 return EINVAL;
3757 }
3758
3759 pktinfo = (struct in6_pktinfo *)(void *)buf;
3760
3761 /*
3762 * An application can clear any sticky IPV6_PKTINFO option by
3763 * doing a "regular" setsockopt with ipi6_addr being
3764 * in6addr_any and ipi6_ifindex being zero.
3765 * [RFC 3542, Section 6]
3766 */
3767 if (optname == IPV6_PKTINFO && opt->ip6po_pktinfo &&
3768 pktinfo->ipi6_ifindex == 0 &&
3769 IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
3770 ip6_clearpktopts(opt, optname);
3771 break;
3772 }
3773
3774 if (uproto == IPPROTO_TCP && optname == IPV6_PKTINFO &&
3775 sticky && !IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
3776 return EINVAL;
3777 }
3778
3779 /* validate the interface index if specified. */
3780 ifnet_head_lock_shared();
3781
3782 if (pktinfo->ipi6_ifindex > if_index) {
3783 ifnet_head_done();
3784 return ENXIO;
3785 }
3786
3787 if (pktinfo->ipi6_ifindex) {
3788 ifp = ifindex2ifnet[pktinfo->ipi6_ifindex];
3789 if (ifp == NULL) {
3790 ifnet_head_done();
3791 return ENXIO;
3792 }
3793 }
3794
3795 ifnet_head_done();
3796
3797 /*
3798 * We store the address anyway, and let in6_selectsrc()
3799 * validate the specified address. This is because ipi6_addr
3800 * may not have enough information about its scope zone, and
3801 * we may need additional information (such as outgoing
3802 * interface or the scope zone of a destination address) to
3803 * disambiguate the scope.
3804 * XXX: the delay of the validation may confuse the
3805 * application when it is used as a sticky option.
3806 */
3807 if (opt->ip6po_pktinfo == NULL) {
3808 opt->ip6po_pktinfo = kalloc_type(struct in6_pktinfo, Z_NOWAIT);
3809 if (opt->ip6po_pktinfo == NULL) {
3810 return ENOBUFS;
3811 }
3812 }
3813 bcopy(pktinfo, opt->ip6po_pktinfo, sizeof(*pktinfo));
3814 break;
3815 }
3816
3817 case IPV6_2292HOPLIMIT:
3818 case IPV6_HOPLIMIT: {
3819 int *hlimp;
3820
3821 /*
3822 * RFC 3542 deprecated the usage of sticky IPV6_HOPLIMIT
3823 * to simplify the ordering among hoplimit options.
3824 */
3825 if (optname == IPV6_HOPLIMIT && sticky) {
3826 return ENOPROTOOPT;
3827 }
3828
3829 if (len != sizeof(int)) {
3830 return EINVAL;
3831 }
3832 hlimp = (int *)(void *)buf;
3833 if (*hlimp < -1 || *hlimp > IPV6_MAXHLIM) {
3834 return EINVAL;
3835 }
3836
3837 opt->ip6po_hlim = *hlimp;
3838 break;
3839 }
3840
3841 case IPV6_TCLASS: {
3842 int tclass;
3843
3844 if (len != sizeof(int)) {
3845 return EINVAL;
3846 }
3847 tclass = *(int *)(void *)buf;
3848 if (tclass < -1 || tclass > 255) {
3849 return EINVAL;
3850 }
3851
3852 opt->ip6po_tclass = tclass;
3853 break;
3854 }
3855
3856 case IPV6_2292NEXTHOP:
3857 case IPV6_NEXTHOP:
3858 error = suser(kauth_cred_get(), 0);
3859 if (error) {
3860 return EACCES;
3861 }
3862
3863 if (len == 0) { /* just remove the option */
3864 ip6_clearpktopts(opt, IPV6_NEXTHOP);
3865 break;
3866 }
3867
3868 /* check if cmsg_len is large enough for sa_len */
3869 if (len < sizeof(struct sockaddr) || len < *buf) {
3870 return EINVAL;
3871 }
3872
3873 switch (SA(buf)->sa_family) {
3874 case AF_INET6: {
3875 struct sockaddr_in6 *sa6 = SIN6(buf);
3876
3877 if (sa6->sin6_len != sizeof(struct sockaddr_in6)) {
3878 return EINVAL;
3879 }
3880
3881 if (IN6_IS_ADDR_UNSPECIFIED(&sa6->sin6_addr) ||
3882 IN6_IS_ADDR_MULTICAST(&sa6->sin6_addr)) {
3883 return EINVAL;
3884 }
3885 if ((error = sa6_embedscope(sa6, ip6_use_defzone, IN6_NULL_IF_EMBEDDED_SCOPE(&sa6->sin6_scope_id)))
3886 != 0) {
3887 return error;
3888 }
3889 break;
3890 }
3891 case AF_LINK: /* should eventually be supported */
3892 default:
3893 return EAFNOSUPPORT;
3894 }
3895
3896 /* turn off the previous option, then set the new option. */
3897 ip6_clearpktopts(opt, IPV6_NEXTHOP);
3898 opt->ip6po_nexthop = kalloc_data(*buf, Z_NOWAIT);
3899 if (opt->ip6po_nexthop == NULL) {
3900 return ENOBUFS;
3901 }
3902 SOCKADDR_COPY(buf, opt->ip6po_nexthop, *buf);
3903 break;
3904
3905 case IPV6_2292HOPOPTS:
3906 case IPV6_HOPOPTS: {
3907 struct ip6_hbh *hbh, *thbh = NULL;
3908 int hbhlen;
3909
3910 /*
3911 * XXX: We don't allow a non-privileged user to set ANY HbH
3912 * options, since per-option restriction has too much
3913 * overhead.
3914 */
3915 error = suser(kauth_cred_get(), 0);
3916 if (error) {
3917 return EACCES;
3918 }
3919
3920 if (len == 0) {
3921 ip6_clearpktopts(opt, IPV6_HOPOPTS);
3922 break; /* just remove the option */
3923 }
3924
3925 /* message length validation */
3926 if (len < sizeof(struct ip6_hbh)) {
3927 return EINVAL;
3928 }
3929 hbh = (struct ip6_hbh *)(void *)buf;
3930 hbhlen = (hbh->ip6h_len + 1) << 3;
3931 if (len != hbhlen) {
3932 return EINVAL;
3933 }
3934
3935 /* turn off the previous option, then set the new option. */
3936 ip6_clearpktopts(opt, IPV6_HOPOPTS);
3937 thbh = kalloc_data(hbhlen, Z_NOWAIT);
3938 if (thbh == NULL) {
3939 return ENOBUFS;
3940 }
3941
3942 bcopy(hbh, thbh, hbhlen);
3943 opt->ip6po_hbh = thbh;
3944 capture_exthdrstat_out = TRUE;
3945 break;
3946 }
3947
3948 case IPV6_2292DSTOPTS:
3949 case IPV6_DSTOPTS:
3950 case IPV6_RTHDRDSTOPTS: {
3951 struct ip6_dest *dest, *__single * newdest = NULL;
3952 int destlen;
3953
3954 error = suser(kauth_cred_get(), 0);
3955 if (error) {
3956 return EACCES;
3957 }
3958
3959 if (len == 0) {
3960 ip6_clearpktopts(opt, optname);
3961 break; /* just remove the option */
3962 }
3963
3964 /* message length validation */
3965 if (len < sizeof(struct ip6_dest)) {
3966 return EINVAL;
3967 }
3968
3969 GET_IP6_DEST_OPT(buf, dest, destlen);
3970 if (len != destlen) {
3971 return EINVAL;
3972 }
3973
3974 /*
3975 * Determine the position that the destination options header
3976 * should be inserted; before or after the routing header.
3977 */
3978 switch (optname) {
3979 case IPV6_2292DSTOPTS:
3980 /*
3981 * The old advanced API is ambiguous on this point.
3982 * Our approach is to determine the position based
3983 * according to the existence of a routing header.
3984 * Note, however, that this depends on the order of the
3985 * extension headers in the ancillary data; the 1st
3986 * part of the destination options header must appear
3987 * before the routing header in the ancillary data,
3988 * too.
3989 * RFC3542 solved the ambiguity by introducing
3990 * separate ancillary data or option types.
3991 */
3992 if (opt->ip6po_rthdr == NULL) {
3993 newdest = &opt->ip6po_dest1;
3994 } else {
3995 newdest = &opt->ip6po_dest2;
3996 }
3997 break;
3998 case IPV6_RTHDRDSTOPTS:
3999 newdest = &opt->ip6po_dest1;
4000 break;
4001 case IPV6_DSTOPTS:
4002 newdest = &opt->ip6po_dest2;
4003 break;
4004 }
4005
4006 /* turn off the previous option, then set the new option. */
4007 ip6_clearpktopts(opt, optname);
4008
4009 void *destbytes = kalloc_data(destlen, Z_NOWAIT);
4010 if (destbytes == NULL) {
4011 return ENOBUFS;
4012 }
4013 bcopy(dest, destbytes, destlen);
4014 *newdest = destbytes;
4015
4016 capture_exthdrstat_out = TRUE;
4017 break;
4018 }
4019
4020 case IPV6_2292RTHDR:
4021 case IPV6_RTHDR: {
4022 struct ip6_rthdr *rth, *trth = NULL;
4023 int rthlen;
4024
4025 if (len == 0) {
4026 ip6_clearpktopts(opt, IPV6_RTHDR);
4027 break; /* just remove the option */
4028 }
4029
4030 /* message length validation */
4031 if (len < sizeof(struct ip6_rthdr)) {
4032 return EINVAL;
4033 }
4034 rth = (struct ip6_rthdr *)(void *)buf;
4035 rthlen = (rth->ip6r_len + 1) << 3;
4036 if (len != rthlen) {
4037 return EINVAL;
4038 }
4039
4040 switch (rth->ip6r_type) {
4041 case IPV6_RTHDR_TYPE_0:
4042 if (rth->ip6r_len == 0) { /* must contain one addr */
4043 return EINVAL;
4044 }
4045 if (rth->ip6r_len % 2) { /* length must be even */
4046 return EINVAL;
4047 }
4048 if (rth->ip6r_len / 2 != rth->ip6r_segleft) {
4049 return EINVAL;
4050 }
4051 break;
4052 default:
4053 return EINVAL; /* not supported */
4054 }
4055
4056 /* turn off the previous option */
4057 ip6_clearpktopts(opt, IPV6_RTHDR);
4058
4059 trth = kalloc_data(rthlen, Z_NOWAIT);
4060 if (trth == NULL) {
4061 return ENOBUFS;
4062 }
4063 bcopy(rth, trth, rthlen);
4064 opt->ip6po_rthdr = trth;
4065 capture_exthdrstat_out = TRUE;
4066 break;
4067 }
4068
4069 case IPV6_USE_MIN_MTU:
4070 if (len != sizeof(int)) {
4071 return EINVAL;
4072 }
4073 minmtupolicy = *(int *)(void *)buf;
4074 if (minmtupolicy != IP6PO_MINMTU_MCASTONLY &&
4075 minmtupolicy != IP6PO_MINMTU_DISABLE &&
4076 minmtupolicy != IP6PO_MINMTU_ALL) {
4077 return EINVAL;
4078 }
4079 opt->ip6po_minmtu = minmtupolicy;
4080 break;
4081
4082 case IPV6_DONTFRAG:
4083 if (len != sizeof(int)) {
4084 return EINVAL;
4085 }
4086
4087 if (uproto == IPPROTO_TCP || *(int *)(void *)buf == 0) {
4088 /*
4089 * we ignore this option for TCP sockets.
4090 * (RFC3542 leaves this case unspecified.)
4091 */
4092 opt->ip6po_flags &= ~IP6PO_DONTFRAG;
4093 } else {
4094 opt->ip6po_flags |= IP6PO_DONTFRAG;
4095 }
4096 break;
4097
4098 case IPV6_PREFER_TEMPADDR:
4099 if (len != sizeof(int)) {
4100 return EINVAL;
4101 }
4102 preftemp = *(int *)(void *)buf;
4103 if (preftemp != IP6PO_TEMPADDR_SYSTEM &&
4104 preftemp != IP6PO_TEMPADDR_NOTPREFER &&
4105 preftemp != IP6PO_TEMPADDR_PREFER) {
4106 return EINVAL;
4107 }
4108 opt->ip6po_prefer_tempaddr = preftemp;
4109 break;
4110
4111 default:
4112 return ENOPROTOOPT;
4113 } /* end of switch */
4114
4115 if (capture_exthdrstat_out) {
4116 if (uproto == IPPROTO_TCP) {
4117 INC_ATOMIC_INT64_LIM(net_api_stats.nas_sock_inet6_stream_exthdr_out);
4118 } else if (uproto == IPPROTO_UDP) {
4119 INC_ATOMIC_INT64_LIM(net_api_stats.nas_sock_inet6_dgram_exthdr_out);
4120 }
4121 }
4122
4123 return 0;
4124 }
4125
4126 /*
4127 * Routine called from ip6_output() to loop back a copy of an IP6 multicast
4128 * packet to the input queue of a specified interface. Note that this
4129 * calls the output routine of the loopback "driver", but with an interface
4130 * pointer that might NOT be &loif -- easier than replicating that code here.
4131 */
4132 void
ip6_mloopback(struct ifnet * srcifp,struct ifnet * origifp,struct mbuf * m,struct sockaddr_in6 * dst,uint32_t optlen,int32_t nxt0)4133 ip6_mloopback(struct ifnet *srcifp, struct ifnet *origifp, struct mbuf *m,
4134 struct sockaddr_in6 *dst, uint32_t optlen, int32_t nxt0)
4135 {
4136 mbuf_ref_t copym;
4137 struct ip6_hdr *__single ip6;
4138 struct in6_addr src;
4139
4140 if (lo_ifp == NULL) {
4141 return;
4142 }
4143
4144 /*
4145 * Copy the packet header as it's needed for the checksum.
4146 * Make sure to deep-copy IPv6 header portion in case the data
4147 * is in an mbuf cluster, so that we can safely override the IPv6
4148 * header portion later.
4149 */
4150 copym = m_copym_mode(m, 0, M_COPYALL, M_DONTWAIT, NULL, NULL, M_COPYM_COPY_HDR);
4151 if (copym != NULL && ((copym->m_flags & M_EXT) ||
4152 copym->m_len < sizeof(struct ip6_hdr))) {
4153 copym = m_pullup(copym, sizeof(struct ip6_hdr));
4154 }
4155
4156 if (copym == NULL) {
4157 return;
4158 }
4159
4160 ip6 = mtod(copym, struct ip6_hdr *);
4161 src = ip6->ip6_src;
4162 /*
4163 * clear embedded scope identifiers if necessary.
4164 * in6_clearscope will touch the addresses only when necessary.
4165 */
4166 in6_clearscope(&ip6->ip6_src);
4167 in6_clearscope(&ip6->ip6_dst);
4168
4169 if (copym->m_pkthdr.csum_flags & CSUM_DELAY_IPV6_DATA) {
4170 in6_delayed_cksum_offset(copym, 0, optlen, nxt0);
4171 }
4172
4173 /*
4174 * Stuff the 'real' ifp into the pkthdr, to be used in matching
4175 * in ip6_input(); we need the loopback ifp/dl_tag passed as args
4176 * to make the loopback driver compliant with the data link
4177 * requirements.
4178 */
4179 copym->m_pkthdr.rcvif = origifp;
4180
4181 /*
4182 * Also record the source interface (which owns the source address).
4183 * This is basically a stripped down version of ifa_foraddr6().
4184 */
4185 if (srcifp == NULL) {
4186 struct in6_ifaddr *__single ia;
4187
4188 lck_rw_lock_shared(&in6_ifaddr_rwlock);
4189 TAILQ_FOREACH(ia, IN6ADDR_HASH(&src), ia6_hash) {
4190 IFA_LOCK_SPIN(&ia->ia_ifa);
4191 /* compare against src addr with embedded scope */
4192 if (in6_are_addr_equal_scoped(&ia->ia_addr.sin6_addr, &src, ia->ia_addr.sin6_scope_id, ip6_output_getsrcifscope(m))) {
4193 srcifp = ia->ia_ifp;
4194 IFA_UNLOCK(&ia->ia_ifa);
4195 break;
4196 }
4197 IFA_UNLOCK(&ia->ia_ifa);
4198 }
4199 lck_rw_done(&in6_ifaddr_rwlock);
4200 }
4201 if (srcifp != NULL) {
4202 ip6_setsrcifaddr_info(copym, srcifp->if_index, NULL);
4203 }
4204 ip6_setdstifaddr_info(copym, origifp->if_index, NULL);
4205
4206 dlil_output(lo_ifp, PF_INET6, copym, NULL, SA(dst), 0, NULL);
4207 }
4208
4209 /*
4210 * Chop IPv6 header off from the payload.
4211 */
4212 static int
ip6_splithdr(struct mbuf * m,struct ip6_exthdrs * exthdrs)4213 ip6_splithdr(struct mbuf *m, struct ip6_exthdrs *exthdrs)
4214 {
4215 mbuf_ref_t mh;
4216 struct ip6_hdr *ip6;
4217
4218 ip6 = mtod(m, struct ip6_hdr *);
4219 if (m->m_len > sizeof(*ip6)) {
4220 MGETHDR(mh, M_DONTWAIT, MT_HEADER); /* MAC-OK */
4221 if (mh == NULL) {
4222 m_freem(m);
4223 return ENOBUFS;
4224 }
4225 M_COPY_PKTHDR(mh, m);
4226 MH_ALIGN(mh, sizeof(*ip6));
4227 m->m_flags &= ~M_PKTHDR;
4228 m->m_len -= sizeof(*ip6);
4229 m->m_data += sizeof(*ip6);
4230 mh->m_next = m;
4231 m = mh;
4232 m->m_len = sizeof(*ip6);
4233 bcopy((caddr_t)ip6, mtod(m, caddr_t), sizeof(*ip6));
4234 }
4235 exthdrs->ip6e_ip6 = m;
4236 return 0;
4237 }
4238
4239 static void
ip6_output_checksum(struct ifnet * ifp,uint32_t mtu,struct mbuf * m,int nxt0,uint32_t tlen,uint32_t optlen)4240 ip6_output_checksum(struct ifnet *ifp, uint32_t mtu, struct mbuf *m,
4241 int nxt0, uint32_t tlen, uint32_t optlen)
4242 {
4243 uint32_t sw_csum, hwcap = ifp->if_hwassist;
4244
4245 if (!hwcksum_tx) {
4246 /* do all in software; checksum offload is disabled */
4247 sw_csum = CSUM_DELAY_IPV6_DATA & m->m_pkthdr.csum_flags;
4248 } else {
4249 /* do in software what the hardware cannot */
4250 sw_csum = m->m_pkthdr.csum_flags & ~IF_HWASSIST_CSUM_FLAGS(hwcap);
4251 }
4252
4253 if (optlen != 0) {
4254 sw_csum |= (CSUM_DELAY_IPV6_DATA &
4255 m->m_pkthdr.csum_flags);
4256 } else if ((sw_csum & CSUM_DELAY_IPV6_DATA) && (hwcap & CSUM_PARTIAL)) {
4257 /*
4258 * Partial checksum offload, ere), if no extension headers,
4259 * and TCP only (no UDP support, as the hardware may not be
4260 * able to convert +0 to -0 (0xffff) per RFC1122 4.1.3.4.
4261 * unless the interface supports "invert zero" capability.)
4262 */
4263 if (hwcksum_tx &&
4264 ((m->m_pkthdr.csum_flags & CSUM_TCPIPV6) ||
4265 ((hwcap & CSUM_ZERO_INVERT) &&
4266 (m->m_pkthdr.csum_flags & CSUM_ZERO_INVERT))) &&
4267 tlen <= mtu) {
4268 uint16_t start = sizeof(struct ip6_hdr);
4269 uint16_t ulpoff =
4270 m->m_pkthdr.csum_data & 0xffff;
4271 m->m_pkthdr.csum_flags |=
4272 (CSUM_DATA_VALID | CSUM_PARTIAL);
4273 m->m_pkthdr.csum_tx_stuff = (ulpoff + start);
4274 m->m_pkthdr.csum_tx_start = start;
4275 sw_csum = 0;
4276 } else {
4277 sw_csum |= (CSUM_DELAY_IPV6_DATA &
4278 m->m_pkthdr.csum_flags);
4279 }
4280 }
4281
4282 if (sw_csum & CSUM_DELAY_IPV6_DATA) {
4283 in6_delayed_cksum_offset(m, 0, optlen, nxt0);
4284 sw_csum &= ~CSUM_DELAY_IPV6_DATA;
4285 }
4286
4287 if (hwcksum_tx) {
4288 uint32_t delay_data = m->m_pkthdr.csum_flags & CSUM_DELAY_IPV6_DATA;
4289 uint32_t hw_csum = IF_HWASSIST_CSUM_FLAGS(hwcap);
4290
4291 /*
4292 * Drop off bits that aren't supported by hardware;
4293 * also make sure to preserve non-checksum related bits.
4294 */
4295 m->m_pkthdr.csum_flags =
4296 ((m->m_pkthdr.csum_flags & (hw_csum | CSUM_DATA_VALID)) |
4297 (m->m_pkthdr.csum_flags & ~IF_HWASSIST_CSUM_MASK));
4298
4299 /*
4300 * If hardware supports partial checksum but not delay_data,
4301 * add back delay_data.
4302 */
4303 if ((hw_csum & CSUM_PARTIAL) != 0 &&
4304 (hw_csum & delay_data) == 0) {
4305 m->m_pkthdr.csum_flags |= delay_data;
4306 }
4307 } else {
4308 /* drop all bits; checksum offload is disabled */
4309 m->m_pkthdr.csum_flags = 0;
4310 }
4311 }
4312
4313 /*
4314 * Compute IPv6 extension header length.
4315 */
4316 int
ip6_optlen(struct in6pcb * in6p)4317 ip6_optlen(struct in6pcb *in6p)
4318 {
4319 int len;
4320
4321 if (!in6p->in6p_outputopts) {
4322 return 0;
4323 }
4324
4325 len = 0;
4326 #define elen(x) \
4327 (((struct ip6_ext *)(x)) ? \
4328 (((struct ip6_ext *)(x))->ip6e_len + 1) << 3 : 0)
4329
4330 len += elen(in6p->in6p_outputopts->ip6po_hbh);
4331 if (in6p->in6p_outputopts->ip6po_rthdr) {
4332 /* dest1 is valid with rthdr only */
4333 len += elen(in6p->in6p_outputopts->ip6po_dest1);
4334 }
4335 len += elen(in6p->in6p_outputopts->ip6po_rthdr);
4336 len += elen(in6p->in6p_outputopts->ip6po_dest2);
4337 return len;
4338 #undef elen
4339 }
4340
4341 static int
4342 sysctl_reset_ip6_output_stats SYSCTL_HANDLER_ARGS
4343 {
4344 #pragma unused(arg1, arg2)
4345 int error, i;
4346
4347 i = ip6_output_measure;
4348 error = sysctl_handle_int(oidp, &i, 0, req);
4349 if (error || req->newptr == USER_ADDR_NULL) {
4350 goto done;
4351 }
4352 /* impose bounds */
4353 if (i < 0 || i > 1) {
4354 error = EINVAL;
4355 goto done;
4356 }
4357 if (ip6_output_measure != i && i == 1) {
4358 net_perf_initialize(&net_perf, ip6_output_measure_bins);
4359 }
4360 ip6_output_measure = i;
4361 done:
4362 return error;
4363 }
4364
4365 static int
4366 sysctl_ip6_output_measure_bins SYSCTL_HANDLER_ARGS
4367 {
4368 #pragma unused(arg1, arg2)
4369 int error;
4370 uint64_t i;
4371
4372 i = ip6_output_measure_bins;
4373 error = sysctl_handle_quad(oidp, &i, 0, req);
4374 if (error || req->newptr == USER_ADDR_NULL) {
4375 goto done;
4376 }
4377 /* validate data */
4378 if (!net_perf_validate_bins(i)) {
4379 error = EINVAL;
4380 goto done;
4381 }
4382 ip6_output_measure_bins = i;
4383 done:
4384 return error;
4385 }
4386
4387 static int
4388 sysctl_ip6_output_getperf SYSCTL_HANDLER_ARGS
4389 {
4390 #pragma unused(oidp, arg1, arg2)
4391 if (req->oldptr == USER_ADDR_NULL) {
4392 req->oldlen = (size_t)sizeof(struct ipstat);
4393 }
4394
4395 return SYSCTL_OUT(req, &net_perf, MIN(sizeof(net_perf), req->oldlen));
4396 }
4397
4398 void
ip6_output_setsrcifscope(struct mbuf * m,uint32_t src_idx,struct in6_ifaddr * ia6)4399 ip6_output_setsrcifscope(struct mbuf *m, uint32_t src_idx, struct in6_ifaddr *ia6)
4400 {
4401 VERIFY(m->m_flags & M_PKTHDR);
4402
4403 m->m_pkthdr.pkt_ext_flags |= PKTF_EXT_OUTPUT_SCOPE;
4404 if (ia6 != NULL) {
4405 m->m_pkthdr.src_ifindex = ia6->ia_ifp->if_index;
4406 } else {
4407 m->m_pkthdr.src_ifindex = (uint16_t)src_idx;
4408 }
4409 }
4410
4411 void
ip6_output_setdstifscope(struct mbuf * m,uint32_t dst_idx,struct in6_ifaddr * ia6)4412 ip6_output_setdstifscope(struct mbuf *m, uint32_t dst_idx, struct in6_ifaddr *ia6)
4413 {
4414 VERIFY(m->m_flags & M_PKTHDR);
4415
4416 m->m_pkthdr.pkt_ext_flags |= PKTF_EXT_OUTPUT_SCOPE;
4417 if (ia6 != NULL) {
4418 m->m_pkthdr.dst_ifindex = ia6->ia_ifp->if_index;
4419 } else {
4420 m->m_pkthdr.dst_ifindex = (uint16_t)dst_idx;
4421 }
4422 }
4423
4424 uint32_t
ip6_output_getsrcifscope(struct mbuf * m)4425 ip6_output_getsrcifscope(struct mbuf *m)
4426 {
4427 VERIFY(m->m_flags & M_PKTHDR);
4428 if (in6_embedded_scope_debug) {
4429 VERIFY(m->m_pkthdr.pkt_ext_flags & PKTF_EXT_OUTPUT_SCOPE);
4430 VERIFY((m->m_pkthdr.pkt_flags & PKTF_IFAINFO) == 0);
4431 }
4432
4433 return m->m_pkthdr.src_ifindex;
4434 }
4435
4436 uint32_t
ip6_output_getdstifscope(struct mbuf * m)4437 ip6_output_getdstifscope(struct mbuf *m)
4438 {
4439 VERIFY(m->m_flags & M_PKTHDR);
4440 if (in6_embedded_scope_debug) {
4441 VERIFY(m->m_pkthdr.pkt_ext_flags & PKTF_EXT_OUTPUT_SCOPE);
4442 VERIFY((m->m_pkthdr.pkt_flags & PKTF_IFAINFO) == 0);
4443 }
4444
4445 return m->m_pkthdr.dst_ifindex;
4446 }
4447