xref: /xnu-11215.61.5/bsd/netinet6/udp6_output.c (revision 4f1223e81cd707a65cc109d0b8ad6653699da3c4)
1 /*
2  * Copyright (c) 2000-2024 Apple Inc. All rights reserved.
3  *
4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5  *
6  * This file contains Original Code and/or Modifications of Original Code
7  * as defined in and that are subject to the Apple Public Source License
8  * Version 2.0 (the 'License'). You may not use this file except in
9  * compliance with the License. The rights granted to you under the License
10  * may not be used to create, or enable the creation or redistribution of,
11  * unlawful or unlicensed copies of an Apple operating system, or to
12  * circumvent, violate, or enable the circumvention or violation of, any
13  * terms of an Apple operating system software license agreement.
14  *
15  * Please obtain a copy of the License at
16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
17  *
18  * The Original Code and all software distributed under the License are
19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23  * Please see the License for the specific language governing rights and
24  * limitations under the License.
25  *
26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27  */
28 
29 
30 /*	$FreeBSD: src/sys/netinet6/udp6_output.c,v 1.1.2.3 2001/08/31 13:49:58 jlemon Exp $	*/
31 /*	$KAME: udp6_output.c,v 1.31 2001/05/21 16:39:15 jinmei Exp $	*/
32 
33 /*
34  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
35  * All rights reserved.
36  *
37  * Redistribution and use in source and binary forms, with or without
38  * modification, are permitted provided that the following conditions
39  * are met:
40  * 1. Redistributions of source code must retain the above copyright
41  *    notice, this list of conditions and the following disclaimer.
42  * 2. Redistributions in binary form must reproduce the above copyright
43  *    notice, this list of conditions and the following disclaimer in the
44  *    documentation and/or other materials provided with the distribution.
45  * 3. Neither the name of the project nor the names of its contributors
46  *    may be used to endorse or promote products derived from this software
47  *    without specific prior written permission.
48  *
49  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59  * SUCH DAMAGE.
60  */
61 
62 /*
63  * Copyright (c) 1982, 1986, 1989, 1993
64  *	The Regents of the University of California.  All rights reserved.
65  *
66  * Redistribution and use in source and binary forms, with or without
67  * modification, are permitted provided that the following conditions
68  * are met:
69  * 1. Redistributions of source code must retain the above copyright
70  *    notice, this list of conditions and the following disclaimer.
71  * 2. Redistributions in binary form must reproduce the above copyright
72  *    notice, this list of conditions and the following disclaimer in the
73  *    documentation and/or other materials provided with the distribution.
74  * 3. All advertising materials mentioning features or use of this software
75  *    must display the following acknowledgement:
76  *	This product includes software developed by the University of
77  *	California, Berkeley and its contributors.
78  * 4. Neither the name of the University nor the names of its contributors
79  *    may be used to endorse or promote products derived from this software
80  *    without specific prior written permission.
81  *
82  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
83  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
84  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
85  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
86  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
87  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
88  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
89  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
90  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
91  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
92  * SUCH DAMAGE.
93  *
94  *	@(#)udp_var.h	8.1 (Berkeley) 6/10/93
95  */
96 
97 #include <sys/param.h>
98 #include <sys/malloc.h>
99 #include <sys/mbuf.h>
100 #include <sys/protosw.h>
101 #include <sys/socket.h>
102 #include <sys/socketvar.h>
103 #include <sys/sysctl.h>
104 #include <sys/errno.h>
105 #include <sys/stat.h>
106 #include <sys/systm.h>
107 #include <sys/proc.h>
108 #include <sys/syslog.h>
109 
110 #include <machine/endian.h>
111 
112 #include <net/if.h>
113 #include <net/route.h>
114 #include <net/if_types.h>
115 #include <net/ntstat.h>
116 #include <net/droptap.h>
117 
118 #include <netinet/in.h>
119 #include <netinet/in_var.h>
120 #include <netinet/in_systm.h>
121 #include <netinet/in_tclass.h>
122 #include <netinet/ip.h>
123 #include <netinet/ip_var.h>
124 #include <netinet/in_pcb.h>
125 #include <netinet/udp.h>
126 #include <netinet/udp_var.h>
127 #include <netinet/ip6.h>
128 #include <netinet6/ip6_var.h>
129 #include <netinet6/in6_pcb.h>
130 #include <netinet6/udp6_var.h>
131 #include <netinet/icmp6.h>
132 #include <netinet6/ip6protosw.h>
133 
134 #if NECP
135 #include <net/necp.h>
136 #endif /* NECP */
137 
138 #include <net/net_osdep.h>
139 
140 #if CONTENT_FILTER
141 #include <net/content_filter.h>
142 #endif /* CONTENT_FILTER */
143 
144 #include <net/sockaddr_utils.h>
145 
146 /*
147  * UDP protocol inplementation.
148  * Per RFC 768, August, 1980.
149  */
150 int
udp6_output(struct in6pcb * in6p,struct mbuf * m,struct sockaddr * addr6,struct mbuf * control,struct proc * p)151 udp6_output(struct in6pcb *in6p, struct mbuf *m, struct sockaddr *addr6,
152     struct mbuf *control, struct proc *p)
153 {
154 	u_int32_t ulen = m->m_pkthdr.len;
155 	u_int32_t plen = sizeof(struct udphdr) + ulen;
156 	struct ip6_hdr *ip6;
157 	struct udphdr *__single udp6;
158 	struct in6_addr *__single laddr, *__single faddr;
159 	u_short fport;
160 	int error = 0;
161 	struct ip6_pktopts opt, *__single optp = NULL;
162 	struct ip6_moptions *__single im6o;
163 	int af = AF_INET6, hlen = sizeof(struct ip6_hdr);
164 	int flags;
165 	struct sockaddr_in6 tmp;
166 	struct in6_addr storage;
167 	int sotc = SO_TC_UNSPEC;
168 	int netsvctype = _NET_SERVICE_TYPE_UNSPEC;
169 	struct ip6_out_args ip6oa;
170 	struct flowadv *__single adv = &ip6oa.ip6oa_flowadv;
171 	struct socket *__single so = in6p->in6p_socket;
172 	struct route_in6 ro;
173 	int flowadv = 0;
174 	bool sndinprog_cnt_used = false;
175 #if CONTENT_FILTER
176 	struct m_tag *__single cfil_tag = NULL;
177 	bool cfil_faddr_use = false;
178 	uint32_t cfil_so_state_change_cnt = 0;
179 	struct sockaddr *__single cfil_faddr = NULL;
180 	struct sockaddr_in6 *__single cfil_sin6 = NULL;
181 #endif
182 	bool check_qos_marking_again = (so->so_flags1 & SOF1_QOSMARKING_POLICY_OVERRIDE) ? FALSE : TRUE;
183 	uint32_t lifscope = IFSCOPE_NONE, fifscope = IFSCOPE_NONE;
184 	drop_reason_t drop_reason = DROP_REASON_UNSPECIFIED;
185 
186 	bzero(&ip6oa, sizeof(ip6oa));
187 	ip6oa.ip6oa_boundif = IFSCOPE_NONE;
188 	ip6oa.ip6oa_flags = IP6OAF_SELECT_SRCIF;
189 
190 	/* Enable flow advisory only when connected */
191 	flowadv = (so->so_state & SS_ISCONNECTED) ? 1 : 0;
192 
193 	if (flowadv && INP_WAIT_FOR_IF_FEEDBACK(in6p)) {
194 		error = ENOBUFS;
195 		drop_reason = DROP_REASON_IP_ENOBUFS;
196 		goto release;
197 	}
198 
199 	if (in6p->inp_flags & INP_BOUND_IF) {
200 		ip6oa.ip6oa_boundif = in6p->inp_boundifp->if_index;
201 		ip6oa.ip6oa_flags |= IP6OAF_BOUND_IF;
202 	} else if (!in6_embedded_scope && IN6_IS_SCOPE_EMBED(&in6p->in6p_faddr)) {
203 		ip6oa.ip6oa_boundif = in6p->inp_fifscope;
204 		ip6oa.ip6oa_flags |= IP6OAF_BOUND_IF;
205 	}
206 	if (INP_NO_CELLULAR(in6p)) {
207 		ip6oa.ip6oa_flags |= IP6OAF_NO_CELLULAR;
208 	}
209 	if (INP_NO_EXPENSIVE(in6p)) {
210 		ip6oa.ip6oa_flags |= IP6OAF_NO_EXPENSIVE;
211 	}
212 	if (INP_NO_CONSTRAINED(in6p)) {
213 		ip6oa.ip6oa_flags |= IP6OAF_NO_CONSTRAINED;
214 	}
215 	if (INP_AWDL_UNRESTRICTED(in6p)) {
216 		ip6oa.ip6oa_flags |= IP6OAF_AWDL_UNRESTRICTED;
217 	}
218 	if (INP_INTCOPROC_ALLOWED(in6p)) {
219 		ip6oa.ip6oa_flags |= IP6OAF_INTCOPROC_ALLOWED;
220 	}
221 	if (INP_MANAGEMENT_ALLOWED(in6p)) {
222 		ip6oa.ip6oa_flags |= IP6OAF_MANAGEMENT_ALLOWED;
223 	}
224 
225 #if CONTENT_FILTER
226 	/*
227 	 * If socket is subject to UDP Content Filter and no addr is passed in,
228 	 * retrieve CFIL saved state from mbuf and use it if necessary.
229 	 */
230 	if (CFIL_DGRAM_FILTERED(so) && !addr6) {
231 		cfil_tag = cfil_dgram_get_socket_state(m, &cfil_so_state_change_cnt, NULL, &cfil_faddr, NULL);
232 		if (cfil_tag) {
233 			cfil_sin6 = SIN6(cfil_faddr);
234 			if ((so->so_state_change_cnt != cfil_so_state_change_cnt) &&
235 			    (in6p->in6p_fport != cfil_sin6->sin6_port ||
236 			    !in6_are_addr_equal_scoped(&in6p->in6p_faddr, &cfil_sin6->sin6_addr, in6p->inp_fifscope, cfil_sin6->sin6_scope_id))) {
237 				/*
238 				 * Socket is connected but socket state and dest addr/port changed.
239 				 * We need to use the saved faddr info.
240 				 */
241 				cfil_faddr_use = true;
242 			}
243 		}
244 	}
245 #endif
246 
247 	if (control) {
248 		sotc = so_tc_from_control(control, &netsvctype);
249 		if ((error = ip6_setpktopts(control, &opt,
250 		    in6p->in6p_outputopts, IPPROTO_UDP)) != 0) {
251 			drop_reason = DROP_REASON_IP6_BAD_OPTION;
252 			goto release;
253 		}
254 		optp = &opt;
255 	} else {
256 		optp = in6p->in6p_outputopts;
257 	}
258 
259 	if (sotc == SO_TC_UNSPEC) {
260 		sotc = so->so_traffic_class;
261 		netsvctype = so->so_netsvctype;
262 	}
263 	ip6oa.ip6oa_sotc = sotc;
264 	ip6oa.ip6oa_netsvctype = netsvctype;
265 
266 	in6p->inp_sndinprog_cnt++;
267 	sndinprog_cnt_used = true;
268 
269 	if (addr6) {
270 		/*
271 		 * IPv4 version of udp_output calls in_pcbconnect in this case,
272 		 * which has its costs.
273 		 *
274 		 * Since we saw no essential reason for calling in_pcbconnect,
275 		 * we get rid of such kind of logic, and call in6_selectsrc
276 		 * and in6_pcbsetport in order to fill in the local address
277 		 * and the local port.
278 		 */
279 		struct sockaddr_in6 *__single sin6 = SIN6(addr6);
280 
281 		if (sin6->sin6_port == 0) {
282 			error = EADDRNOTAVAIL;
283 			drop_reason = DROP_REASON_IP_DST_ADDR_NO_AVAIL;
284 			goto release;
285 		}
286 
287 		if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr)) {
288 			/* how about ::ffff:0.0.0.0 case? */
289 			error = EISCONN;
290 			drop_reason = DROP_REASON_IP_EISCONN;
291 			goto release;
292 		}
293 
294 		/* protect *sin6 from overwrites */
295 		tmp = *sin6;
296 		sin6 = &tmp;
297 
298 		faddr = &sin6->sin6_addr;
299 		fport = sin6->sin6_port; /* allow 0 port */
300 
301 		if (IN6_IS_ADDR_V4MAPPED(faddr)) {
302 			if ((in6p->in6p_flags & IN6P_IPV6_V6ONLY)) {
303 				/*
304 				 * I believe we should explicitly discard the
305 				 * packet when mapped addresses are disabled,
306 				 * rather than send the packet as an IPv6 one.
307 				 * If we chose the latter approach, the packet
308 				 * might be sent out on the wire based on the
309 				 * default route, the situation which we'd
310 				 * probably want to avoid.
311 				 * (20010421 [email protected])
312 				 */
313 				error = EINVAL;
314 				drop_reason = DROP_REASON_IP6_ONLY;
315 				goto release;
316 			} else {
317 				af = AF_INET;
318 			}
319 		}
320 
321 		/* KAME hack: embed scopeid */
322 		if (in6_embedscope(&sin6->sin6_addr, sin6, in6p, NULL,
323 		    optp, IN6_NULL_IF_EMBEDDED_SCOPE(&sin6->sin6_scope_id)) != 0) {
324 			error = EINVAL;
325 			drop_reason = DROP_REASON_IP6_BAD_SCOPE;
326 			goto release;
327 		}
328 		fifscope = sin6->sin6_scope_id;
329 
330 		if (!IN6_IS_ADDR_V4MAPPED(faddr)) {
331 			struct ifnet *__single src_ifp = NULL;
332 			laddr = in6_selectsrc(sin6, optp,
333 			    in6p, &in6p->in6p_route, &src_ifp, &storage,
334 			    ip6oa.ip6oa_boundif, &error);
335 			if (src_ifp != NULL) {
336 				lifscope = src_ifp->if_index;
337 				ifnet_release(src_ifp);
338 			}
339 		} else {
340 			laddr = &in6p->in6p_laddr;      /* XXX */
341 			lifscope = in6p->inp_lifscope;
342 		}
343 		if (laddr == NULL) {
344 			if (error == 0) {
345 				error = EADDRNOTAVAIL;
346 			}
347 			drop_reason = DROP_REASON_IP_SRC_ADDR_NO_AVAIL;
348 			goto release;
349 		}
350 		if (in6p->in6p_lport == 0) {
351 			inp_enter_bind_in_progress(so);
352 
353 			error = in6_pcbsetport(laddr, addr6, in6p, p, 0);
354 
355 			if (error == 0) {
356 				ASSERT(in6p->in6p_lport != 0);
357 			}
358 
359 			inp_exit_bind_in_progress(so);
360 
361 			if (error != 0) {
362 				goto release;
363 			}
364 		}
365 	} else {
366 		if (IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr)) {
367 			error = ENOTCONN;
368 			drop_reason = DROP_REASON_IP6_ADDR_UNSPECIFIED;
369 			goto release;
370 		}
371 		laddr = &in6p->in6p_laddr;
372 		faddr = &in6p->in6p_faddr;
373 		fport = in6p->in6p_fport;
374 		fifscope = in6p->inp_fifscope;
375 		lifscope = in6p->inp_lifscope;
376 #if CONTENT_FILTER
377 		if (cfil_faddr_use) {
378 			faddr = &SIN6(cfil_faddr)->sin6_addr;
379 			fport = SIN6(cfil_faddr)->sin6_port;
380 			fifscope = SIN6(cfil_faddr)->sin6_scope_id;
381 
382 			/* Do not use cached route */
383 			ROUTE_RELEASE(&in6p->in6p_route);
384 		}
385 #endif
386 		if (IN6_IS_ADDR_V4MAPPED(faddr)) {
387 			if ((in6p->in6p_flags & IN6P_IPV6_V6ONLY)) {
388 				/*
389 				 * XXX: this case would happen when the
390 				 * application sets the V6ONLY flag after
391 				 * connecting the foreign address.
392 				 * Such applications should be fixed,
393 				 * so we bark here.
394 				 */
395 				log(LOG_INFO, "udp6_output: IPV6_V6ONLY "
396 				    "option was set for a connected socket\n");
397 				error = EINVAL;
398 				goto release;
399 			} else {
400 				af = AF_INET;
401 			}
402 		}
403 	}
404 
405 	if (in6p->inp_flowhash == 0) {
406 		inp_calc_flowhash(in6p);
407 		ASSERT(in6p->inp_flowhash != 0);
408 	}
409 	/* update flowinfo - RFC 6437 */
410 	if (in6p->inp_flow == 0 && in6p->in6p_flags & IN6P_AUTOFLOWLABEL) {
411 		in6p->inp_flow &= ~IPV6_FLOWLABEL_MASK;
412 		in6p->inp_flow |=
413 		    (htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK);
414 	}
415 
416 	if (af == AF_INET) {
417 		hlen = sizeof(struct ip);
418 	}
419 
420 	if (fport == htons(53) && !(so->so_flags1 & SOF1_DNS_COUNTED)) {
421 		so->so_flags1 |= SOF1_DNS_COUNTED;
422 		INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_dns);
423 	}
424 
425 	/*
426 	 * Calculate data length and get a mbuf
427 	 * for UDP and IP6 headers.
428 	 */
429 	M_PREPEND(m, hlen + sizeof(struct udphdr), M_DONTWAIT, 1);
430 	if (m == 0) {
431 		error = ENOBUFS;
432 		drop_reason = DROP_REASON_IP_ENOBUFS;
433 		goto release;
434 	}
435 
436 	/*
437 	 * Stuff checksum and output datagram.
438 	 */
439 	udp6 = (struct udphdr *)(void *)(mtod(m, caddr_t) + hlen);
440 	udp6->uh_sport = in6p->in6p_lport; /* lport is always set in the PCB */
441 	udp6->uh_dport = fport;
442 	if (plen <= 0xffff) {
443 		udp6->uh_ulen = htons((u_short)plen);
444 	} else {
445 		udp6->uh_ulen = 0;
446 	}
447 	udp6->uh_sum = 0;
448 
449 	switch (af) {
450 	case AF_INET6:
451 		ip6 = mtod(m, struct ip6_hdr *);
452 		ip6->ip6_flow   = in6p->inp_flow & IPV6_FLOWINFO_MASK;
453 		ip6->ip6_vfc    &= ~IPV6_VERSION_MASK;
454 		ip6->ip6_vfc    |= IPV6_VERSION;
455 #if 0           /* ip6_plen will be filled in ip6_output. */
456 		ip6->ip6_plen   = htons((u_short)plen);
457 #endif
458 		ip6->ip6_nxt    = IPPROTO_UDP;
459 		ip6->ip6_hlim   = in6_selecthlim(in6p, in6p->in6p_route.ro_rt ?
460 		    in6p->in6p_route.ro_rt->rt_ifp : NULL);
461 		ip6->ip6_src    = *laddr;
462 		ip6->ip6_dst    = *faddr;
463 
464 		udp6->uh_sum = in6_pseudo(laddr, faddr,
465 		    htonl(plen + IPPROTO_UDP));
466 		m->m_pkthdr.csum_flags = (CSUM_UDPIPV6 | CSUM_ZERO_INVERT);
467 		m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
468 
469 		if (!IN6_IS_ADDR_UNSPECIFIED(laddr)) {
470 			ip6oa.ip6oa_flags |= IP6OAF_BOUND_SRCADDR;
471 		}
472 
473 		flags = IPV6_OUTARGS;
474 
475 		udp6stat.udp6s_opackets++;
476 
477 #if NECP
478 		{
479 			necp_kernel_policy_id policy_id;
480 			necp_kernel_policy_id skip_policy_id;
481 			u_int32_t route_rule_id;
482 			u_int32_t pass_flags;
483 
484 			/*
485 			 * We need a route to perform NECP route rule checks
486 			 */
487 			if (net_qos_policy_restricted != 0 &&
488 			    ROUTE_UNUSABLE(&in6p->inp_route)) {
489 				struct sockaddr_in6 to;
490 				struct sockaddr_in6 from;
491 
492 				ROUTE_RELEASE(&in6p->inp_route);
493 
494 				SOCKADDR_ZERO(&from, sizeof(struct sockaddr_in6));
495 				from.sin6_family = AF_INET6;
496 				from.sin6_len = sizeof(struct sockaddr_in6);
497 				from.sin6_addr = *laddr;
498 
499 				SOCKADDR_ZERO(&to, sizeof(struct sockaddr_in6));
500 				to.sin6_family = AF_INET6;
501 				to.sin6_len = sizeof(struct sockaddr_in6);
502 				to.sin6_addr = *faddr;
503 
504 				in6p->inp_route.ro_dst.sa_family = AF_INET6;
505 				in6p->inp_route.ro_dst.sa_len = sizeof(struct sockaddr_in6);
506 				SIN6(&in6p->inp_route.ro_dst)->sin6_addr = *faddr;
507 
508 				if (!in6_embedded_scope) {
509 					SIN6(&in6p->inp_route.ro_dst)->sin6_scope_id =
510 					    IN6_IS_SCOPE_EMBED(faddr) ? fifscope : IFSCOPE_NONE;
511 				}
512 				rtalloc_scoped(&in6p->inp_route, ip6oa.ip6oa_boundif);
513 
514 				inp_update_necp_policy(in6p, SA(&from),
515 				    SA(&to), ip6oa.ip6oa_boundif);
516 				in6p->inp_policyresult.results.qos_marking_gencount = 0;
517 			}
518 
519 			if (!necp_socket_is_allowed_to_send_recv_v6(in6p, in6p->in6p_lport, fport, laddr, faddr, NULL, 0, &policy_id, &route_rule_id, &skip_policy_id, &pass_flags)) {
520 				error = EHOSTUNREACH;
521 				drop_reason = DROP_REASON_IP_NECP_POLICY_DROP;
522 				goto release;
523 			}
524 
525 			necp_mark_packet_from_socket(m, in6p, policy_id, route_rule_id, skip_policy_id, pass_flags);
526 
527 			if (net_qos_policy_restricted != 0) {
528 				necp_socket_update_qos_marking(in6p, in6p->in6p_route.ro_rt, route_rule_id);
529 			}
530 		}
531 #endif /* NECP */
532 		if ((so->so_flags1 & SOF1_QOSMARKING_ALLOWED)) {
533 			ip6oa.ip6oa_flags |= IP6OAF_QOSMARKING_ALLOWED;
534 		}
535 		if (check_qos_marking_again) {
536 			ip6oa.ip6oa_flags |= IP6OAF_REDO_QOSMARKING_POLICY;
537 		}
538 		ip6oa.qos_marking_gencount = in6p->inp_policyresult.results.qos_marking_gencount;
539 
540 #if IPSEC
541 		if (in6p->in6p_sp != NULL && ipsec_setsocket(m, so) != 0) {
542 			error = ENOBUFS;
543 			drop_reason = DROP_REASON_IP_ENOBUFS;
544 			goto release;
545 		}
546 #endif /*IPSEC*/
547 
548 		/* In case of IPv4-mapped address used in previous send */
549 		if (ROUTE_UNUSABLE(&in6p->in6p_route) ||
550 		    rt_key(in6p->in6p_route.ro_rt)->sa_family != AF_INET6) {
551 			ROUTE_RELEASE(&in6p->in6p_route);
552 		}
553 
554 		/* Copy the cached route and take an extra reference */
555 		in6p_route_copyout(in6p, &ro);
556 
557 		set_packet_service_class(m, so, sotc, PKT_SCF_IPV6);
558 
559 		m->m_pkthdr.pkt_flowsrc = FLOWSRC_INPCB;
560 		m->m_pkthdr.pkt_flowid = in6p->inp_flowhash;
561 		m->m_pkthdr.pkt_proto = IPPROTO_UDP;
562 		m->m_pkthdr.pkt_flags |= (PKTF_FLOW_ID | PKTF_FLOW_LOCALSRC);
563 		if (flowadv) {
564 			m->m_pkthdr.pkt_flags |= PKTF_FLOW_ADV;
565 		}
566 		m->m_pkthdr.tx_udp_pid = so->last_pid;
567 		if (so->so_flags & SOF_DELEGATED) {
568 			m->m_pkthdr.tx_udp_e_pid = so->e_pid;
569 		} else {
570 			m->m_pkthdr.tx_udp_e_pid = 0;
571 		}
572 #if (DEBUG || DEVELOPMENT)
573 		if (so->so_flags & SOF_MARK_WAKE_PKT) {
574 			so->so_flags &= ~SOF_MARK_WAKE_PKT;
575 			m->m_pkthdr.pkt_flags |= PKTF_WAKE_PKT;
576 		}
577 #endif /* (DEBUG || DEVELOPMENT) */
578 
579 		im6o = in6p->in6p_moptions;
580 		if (im6o != NULL) {
581 			IM6O_LOCK(im6o);
582 			IM6O_ADDREF_LOCKED(im6o);
583 			if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) &&
584 			    im6o->im6o_multicast_ifp != NULL) {
585 				in6p->in6p_last_outifp =
586 				    im6o->im6o_multicast_ifp;
587 #if SKYWALK
588 				if (NETNS_TOKEN_VALID(&in6p->inp_netns_token)) {
589 					netns_set_ifnet(&in6p->inp_netns_token,
590 					    in6p->in6p_last_outifp);
591 				}
592 #endif /* SKYWALK */
593 			}
594 			IM6O_UNLOCK(im6o);
595 		}
596 
597 		ip6_output_setdstifscope(m, fifscope, NULL);
598 		ip6_output_setsrcifscope(m, lifscope, NULL);
599 
600 		socket_unlock(so, 0);
601 		error = ip6_output(m, optp, &ro, flags, im6o, NULL, &ip6oa);
602 		m = NULL;
603 		socket_lock(so, 0);
604 
605 		if (im6o != NULL) {
606 			IM6O_REMREF(im6o);
607 		}
608 
609 		if (check_qos_marking_again) {
610 			in6p->inp_policyresult.results.qos_marking_gencount = ip6oa.qos_marking_gencount;
611 			if (ip6oa.ip6oa_flags & IP6OAF_QOSMARKING_ALLOWED) {
612 				in6p->inp_socket->so_flags1 |= SOF1_QOSMARKING_ALLOWED;
613 			} else {
614 				in6p->inp_socket->so_flags1 &= ~SOF1_QOSMARKING_ALLOWED;
615 			}
616 		}
617 
618 		if (error == 0 && nstat_collect) {
619 			stats_functional_type ifnet_count_type = stats_functional_type_none;
620 
621 			if (in6p->in6p_route.ro_rt != NULL) {
622 				ifnet_count_type = IFNET_COUNT_TYPE(in6p->in6p_route.
623 				    ro_rt->rt_ifp);
624 			}
625 			INP_ADD_STAT(in6p, ifnet_count_type, txpackets, 1);
626 			INP_ADD_STAT(in6p, ifnet_count_type, txbytes, ulen);
627 			inp_set_activity_bitmap(in6p);
628 		}
629 
630 		if (flowadv && (adv->code == FADV_FLOW_CONTROLLED ||
631 		    adv->code == FADV_SUSPENDED)) {
632 			/*
633 			 * Return an error to indicate
634 			 * that the packet has been dropped.
635 			 */
636 			error = ENOBUFS;
637 			inp_set_fc_state(in6p, adv->code);
638 		}
639 
640 		if (ro.ro_rt != NULL) {
641 			struct ifnet *__single outif = ro.ro_rt->rt_ifp;
642 
643 			so->so_pktheadroom = (uint16_t)P2ROUNDUP(
644 				sizeof(struct udphdr) +
645 				hlen +
646 				ifnet_hdrlen(outif) +
647 				ifnet_mbuf_packetpreamblelen(outif),
648 				sizeof(u_int32_t));
649 		}
650 
651 		/* Synchronize PCB cached route */
652 		in6p_route_copyin(in6p, &ro);
653 
654 		if (in6p->in6p_route.ro_rt != NULL) {
655 			struct rtentry *__single rt = in6p->in6p_route.ro_rt;
656 			struct ifnet *__single outif;
657 
658 			if (IS_LOCALNET_ROUTE(rt)) {
659 				in6p->in6p_flags2 |= INP2_LAST_ROUTE_LOCAL;
660 			} else {
661 				in6p->in6p_flags2 &= ~INP2_LAST_ROUTE_LOCAL;
662 			}
663 
664 			if (rt->rt_flags & RTF_MULTICAST) {
665 				rt = NULL;      /* unusable */
666 			}
667 #if CONTENT_FILTER
668 			/*
669 			 * Discard temporary route for cfil case
670 			 */
671 			if (cfil_faddr_use) {
672 				rt = NULL;      /* unusable */
673 			}
674 #endif
675 
676 			/*
677 			 * Always discard the cached route for unconnected
678 			 * socket or if it is a multicast route.
679 			 */
680 			if (rt == NULL) {
681 				ROUTE_RELEASE(&in6p->in6p_route);
682 			}
683 
684 			/*
685 			 * If the destination route is unicast, update outif
686 			 * with that of the route interface used by IP.
687 			 */
688 			if (rt != NULL) {
689 				/*
690 				 * When an NECP IP tunnel policy forces the outbound interface,
691 				 * ip6_output_list() informs the transport layer what is the actual
692 				 * outgoing interface
693 				 */
694 				if (ip6oa.ip6oa_flags & IP6OAF_BOUND_IF) {
695 					outif = ifindex2ifnet[ip6oa.ip6oa_boundif];
696 				} else {
697 					outif = rt->rt_ifp;
698 				}
699 				if (outif != NULL && outif != in6p->in6p_last_outifp) {
700 					in6p->in6p_last_outifp = outif;
701 #if SKYWALK
702 					if (NETNS_TOKEN_VALID(&in6p->inp_netns_token)) {
703 						netns_set_ifnet(&in6p->inp_netns_token,
704 						    in6p->in6p_last_outifp);
705 					}
706 #endif /* SKYWALK */
707 
708 					so->so_pktheadroom = (uint16_t)P2ROUNDUP(
709 						sizeof(struct udphdr) +
710 						hlen +
711 						ifnet_hdrlen(outif) +
712 						ifnet_mbuf_packetpreamblelen(outif),
713 						sizeof(u_int32_t));
714 				}
715 			}
716 		} else {
717 			ROUTE_RELEASE(&in6p->in6p_route);
718 		}
719 
720 		/*
721 		 * If output interface was cellular/expensive, and this
722 		 * socket is denied access to it, generate an event.
723 		 */
724 		if (error != 0 && (ip6oa.ip6oa_flags & IP6OAF_R_IFDENIED) &&
725 		    (INP_NO_CELLULAR(in6p) || INP_NO_EXPENSIVE(in6p) || INP_NO_CONSTRAINED(in6p))) {
726 			soevent(in6p->inp_socket, (SO_FILT_HINT_LOCKED |
727 			    SO_FILT_HINT_IFDENIED));
728 		}
729 		break;
730 	case AF_INET:
731 		error = EAFNOSUPPORT;
732 		drop_reason = DROP_REASON_IP_EAFNOSUPPORT;
733 		goto release;
734 	}
735 	goto releaseopt;
736 
737 release:
738 
739 	if (m != NULL) {
740 		m_drop(m, DROPTAP_FLAG_DIR_OUT | DROPTAP_FLAG_L2_MISSING, drop_reason, NULL, 0);
741 	}
742 
743 releaseopt:
744 	if (control != NULL) {
745 		if (optp == &opt) {
746 			ip6_clearpktopts(optp, -1);
747 		}
748 		m_freem(control);
749 	}
750 #if CONTENT_FILTER
751 	if (cfil_tag) {
752 		m_tag_free(cfil_tag);
753 	}
754 #endif
755 	if (sndinprog_cnt_used) {
756 		VERIFY(in6p->inp_sndinprog_cnt > 0);
757 		if (--in6p->inp_sndinprog_cnt == 0) {
758 			in6p->inp_flags &= ~(INP_FC_FEEDBACK);
759 			if (in6p->inp_sndingprog_waiters > 0) {
760 				wakeup(&in6p->inp_sndinprog_cnt);
761 			}
762 		}
763 		sndinprog_cnt_used = false;
764 	}
765 
766 	return error;
767 }
768