Home | History | Annotate | Line # | Download | only in netinet6
icmp6.c revision 1.10
      1 /*	$NetBSD: icmp6.c,v 1.10 1999/07/31 18:41:16 itojun Exp $	*/
      2 
      3 /*
      4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
      5  * All rights reserved.
      6  *
      7  * Redistribution and use in source and binary forms, with or without
      8  * modification, are permitted provided that the following conditions
      9  * are met:
     10  * 1. Redistributions of source code must retain the above copyright
     11  *    notice, this list of conditions and the following disclaimer.
     12  * 2. Redistributions in binary form must reproduce the above copyright
     13  *    notice, this list of conditions and the following disclaimer in the
     14  *    documentation and/or other materials provided with the distribution.
     15  * 3. Neither the name of the project nor the names of its contributors
     16  *    may be used to endorse or promote products derived from this software
     17  *    without specific prior written permission.
     18  *
     19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
     20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
     23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     29  * SUCH DAMAGE.
     30  */
     31 
     32 /*
     33  * Copyright (c) 1982, 1986, 1988, 1993
     34  *	The Regents of the University of California.  All rights reserved.
     35  *
     36  * Redistribution and use in source and binary forms, with or without
     37  * modification, are permitted provided that the following conditions
     38  * are met:
     39  * 1. Redistributions of source code must retain the above copyright
     40  *    notice, this list of conditions and the following disclaimer.
     41  * 2. Redistributions in binary form must reproduce the above copyright
     42  *    notice, this list of conditions and the following disclaimer in the
     43  *    documentation and/or other materials provided with the distribution.
     44  * 3. All advertising materials mentioning features or use of this software
     45  *    must display the following acknowledgement:
     46  *	This product includes software developed by the University of
     47  *	California, Berkeley and its contributors.
     48  * 4. Neither the name of the University nor the names of its contributors
     49  *    may be used to endorse or promote products derived from this software
     50  *    without specific prior written permission.
     51  *
     52  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
     53  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     54  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     55  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
     56  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     57  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     58  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     59  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     60  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     61  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     62  * SUCH DAMAGE.
     63  *
     64  *	@(#)ip_icmp.c	8.2 (Berkeley) 1/4/94
     65  */
     66 
     67 #if (defined(__FreeBSD__) && __FreeBSD__ >= 3) || defined(__NetBSD__)
     68 #include "opt_inet.h"
     69 #ifdef __NetBSD__	/*XXX*/
     70 #include "opt_ipsec.h"
     71 #endif
     72 #endif
     73 
     74 #include <sys/param.h>
     75 #include <sys/systm.h>
     76 #include <sys/malloc.h>
     77 #include <sys/mbuf.h>
     78 #include <sys/protosw.h>
     79 #include <sys/socket.h>
     80 #include <sys/socketvar.h>
     81 #include <sys/time.h>
     82 #include <sys/kernel.h>
     83 #include <sys/syslog.h>
     84 
     85 #include <net/if.h>
     86 #include <net/route.h>
     87 #include <net/if_dl.h>
     88 #include <net/if_types.h>
     89 
     90 #include <netinet/in.h>
     91 #include <netinet/in_var.h>
     92 #include <netinet6/ip6.h>
     93 #include <netinet6/ip6_var.h>
     94 #include <netinet6/icmp6.h>
     95 #include <netinet6/mld6_var.h>
     96 #if !defined(__FreeBSD__) || __FreeBSD__ < 3
     97 #include <netinet6/in6_pcb.h>
     98 #else
     99 #include <netinet/in_pcb.h>
    100 #endif
    101 #include <netinet6/nd6.h>
    102 #include <netinet6/in6_ifattach.h>
    103 #include <netinet6/ip6protosw.h>
    104 
    105 #ifdef IPSEC
    106 #include <netkey/key.h>
    107 #include <netkey/key_debug.h>
    108 #endif
    109 
    110 #include "faith.h"
    111 
    112 extern struct ip6protosw inet6sw[];
    113 extern u_char ip6_protox[];
    114 
    115 struct icmp6stat icmp6stat;
    116 
    117 #if !defined(__FreeBSD__) || __FreeBSD__ < 3
    118 extern struct in6pcb rawin6pcb;
    119 #else
    120 extern struct inpcbhead ripcb;
    121 #endif
    122 extern u_int icmp6errratelim;
    123 #ifdef __NetBSD__
    124 static struct rttimer_queue *icmp6_mtudisc_timeout_q = NULL;
    125 extern int pmtu_expire;
    126 #endif
    127 
    128 static int icmp6_rip6_input __P((struct mbuf **, int));
    129 static int icmp6_ratelimit __P((const struct in6_addr *, const int, const int));
    130 static struct mbuf * ni6_input __P((struct mbuf *, int));
    131 static int ni6_addrs __P((struct icmp6_nodeinfo *, struct mbuf *,
    132 			  struct ifnet **));
    133 static int ni6_store_addrs __P((struct icmp6_nodeinfo *, struct icmp6_nodeinfo *,
    134 				struct ifnet *, int));
    135 #ifdef __NetBSD__
    136 static struct rtentry *icmp6_mtudisc_clone __P((struct sockaddr *));
    137 static void icmp6_mtudisc_timeout __P((struct rtentry *, struct rttimer *));
    138 #endif
    139 
    140 #ifdef COMPAT_RFC1885
    141 static struct route_in6 icmp6_reflect_rt;
    142 #endif
    143 static struct timeval icmp6_nextsend = {0, 0};
    144 
    145 void
    146 icmp6_init()
    147 {
    148 	mld6_init();
    149 #ifdef __NetBSD__
    150 	icmp6_mtudisc_timeout_q = rt_timer_queue_create(pmtu_expire);
    151 #endif
    152 }
    153 
    154 /*
    155  * Generate an error packet of type error in response to bad IP6 packet.
    156  */
    157 void
    158 icmp6_error(m, type, code, param)
    159 	struct mbuf *m;
    160 	int type, code, param;
    161 {
    162 	struct ip6_hdr *oip6, *nip6;
    163 	struct icmp6_hdr *icmp6;
    164 	u_int prep;
    165 	int off;
    166 	u_char nxt;
    167 
    168 	icmp6stat.icp6s_error++;
    169 
    170 	if (m->m_flags & M_DECRYPTED)
    171 		goto freeit;
    172 
    173 	oip6 = mtod(m, struct ip6_hdr *);
    174 
    175 	/*
    176 	 * Multicast destination check. For unrecognized option errors,
    177 	 * this check has already done in ip6_unknown_opt(), so we can
    178 	 * check only for other errors.
    179 	 */
    180 	if ((m->m_flags & (M_BCAST|M_MCAST) ||
    181 	     IN6_IS_ADDR_MULTICAST(&oip6->ip6_dst)) &&
    182 	    (type != ICMP6_PACKET_TOO_BIG &&
    183 	     (type != ICMP6_PARAM_PROB ||
    184 	      code != ICMP6_PARAMPROB_OPTION)))
    185 		goto freeit;
    186 
    187 	/* Source address check. XXX: the case of anycast source? */
    188 	if (IN6_IS_ADDR_UNSPECIFIED(&oip6->ip6_src) ||
    189 	    IN6_IS_ADDR_MULTICAST(&oip6->ip6_src))
    190 		goto freeit;
    191 
    192 	/*
    193 	 * If the erroneous packet is also an ICMP error, discard it.
    194 	 */
    195 	IP6_EXTHDR_CHECK(m, 0, sizeof(struct ip6_hdr), );
    196 	off = sizeof(struct ip6_hdr);
    197 	nxt = oip6->ip6_nxt;
    198 	while(1) {		/* XXX: should avoid inf. loop explicitly? */
    199 		struct ip6_ext *ip6e;
    200 		struct icmp6_hdr *icp;
    201 
    202 		switch(nxt) {
    203 		case IPPROTO_IPV6:
    204 		case IPPROTO_IPV4:
    205 		case IPPROTO_UDP:
    206 		case IPPROTO_TCP:
    207 		case IPPROTO_ESP:
    208 		case IPPROTO_FRAGMENT:
    209 			/*
    210 			 * ICMPv6 error must not be fragmented.
    211 			 * XXX: but can we trust the sender?
    212 			 */
    213 		default:
    214 			/* What if unknown header followed by ICMP error? */
    215 			goto generate;
    216 		case IPPROTO_ICMPV6:
    217 			IP6_EXTHDR_CHECK(m, 0, off + sizeof(struct icmp6_hdr), );
    218 			icp = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
    219 			if (icp->icmp6_type < ICMP6_ECHO_REQUEST
    220 			 || icp->icmp6_type == ND_REDIRECT) {
    221 				/*
    222 				 * ICMPv6 error
    223 				 * Special case: for redirect (which is
    224 				 * informational) we must not send icmp6 error.
    225 				 */
    226 				icmp6stat.icp6s_canterror++;
    227 				goto freeit;
    228 			} else {
    229 				/* ICMPv6 informational */
    230 				goto generate;
    231 			}
    232 		case IPPROTO_HOPOPTS:
    233 		case IPPROTO_DSTOPTS:
    234 		case IPPROTO_ROUTING:
    235 		case IPPROTO_AH:
    236 			IP6_EXTHDR_CHECK(m, 0, off + sizeof(struct ip6_ext), );
    237 			ip6e = (struct ip6_ext *)(mtod(m, caddr_t) + off);
    238 			if (nxt == IPPROTO_AH)
    239 				off += (ip6e->ip6e_len + 2) << 2;
    240 			else
    241 				off += (ip6e->ip6e_len + 1) << 3;
    242 			nxt = ip6e->ip6e_nxt;
    243 			break;
    244 		}
    245 	}
    246 
    247   freeit:
    248 	/*
    249 	 * If we can't tell wheter or not we can generate ICMP6, free it.
    250 	 */
    251 	m_freem(m);
    252 	return;
    253 
    254   generate:
    255 	oip6 = mtod(m, struct ip6_hdr *); /* adjust pointer */
    256 
    257 	/* Finally, do rate limitation check. */
    258 	if (icmp6_ratelimit(&oip6->ip6_src, type, code)) {
    259 		icmp6stat.icp6s_toofreq++;
    260 		goto freeit;
    261 	}
    262 
    263 	/*
    264 	 * OK, ICMP6 can be generated.
    265 	 */
    266 
    267 	if (m->m_pkthdr.len >= ICMPV6_PLD_MAXLEN)
    268 		m_adj(m, ICMPV6_PLD_MAXLEN - m->m_pkthdr.len);
    269 
    270 	prep = sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr);
    271 	M_PREPEND(m, prep, M_DONTWAIT);
    272 	if (m && m->m_len < prep)
    273 		m = m_pullup(m, prep);
    274 	if (m == NULL) {
    275 		printf("ENOBUFS in icmp6_error %d\n", __LINE__);
    276 		return;
    277 	}
    278 
    279 	nip6 = mtod(m, struct ip6_hdr *);
    280 	nip6->ip6_src  = oip6->ip6_src;
    281 	nip6->ip6_dst  = oip6->ip6_dst;
    282 
    283 	if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_src))
    284 		oip6->ip6_src.s6_addr16[1] = 0;
    285 	if (IN6_IS_SCOPE_LINKLOCAL(&oip6->ip6_dst))
    286 		oip6->ip6_dst.s6_addr16[1] = 0;
    287 
    288 	icmp6 = (struct icmp6_hdr *)(nip6 + 1);
    289 	icmp6->icmp6_type = type;
    290 	icmp6->icmp6_code = code;
    291 	icmp6->icmp6_pptr = htonl((u_int32_t)param);
    292 
    293 	icmp6stat.icp6s_outhist[type]++;
    294 	icmp6_reflect(m, sizeof(struct ip6_hdr)); /*header order: IPv6 - ICMPv6*/
    295 }
    296 
    297 /*
    298  * Process a received ICMP6 message.
    299  */
    300 int
    301 icmp6_input(mp, offp, proto)
    302 	struct mbuf **mp;
    303 	int *offp, proto;
    304 {
    305 	struct mbuf *m = *mp, *n;
    306 	struct ip6_hdr *ip6, *nip6;
    307 	struct icmp6_hdr *icmp6, *nicmp6;
    308 	int off = *offp;
    309 	int icmp6len = m->m_pkthdr.len - *offp;
    310 	int code, sum, noff;
    311 	struct sockaddr_in6 icmp6src;
    312 
    313 	IP6_EXTHDR_CHECK(m, off, sizeof(struct icmp6_hdr), IPPROTO_DONE);
    314 	/* m might change if M_LOOP. So, call mtod after this */
    315 
    316 	/*
    317 	 * Locate icmp6 structure in mbuf, and check
    318 	 * that not corrupted and of at least minimum length
    319 	 */
    320 
    321 	ip6 = mtod(m, struct ip6_hdr *);
    322 	if (icmp6len < sizeof(struct icmp6_hdr)) {
    323 		icmp6stat.icp6s_tooshort++;
    324 		goto freeit;
    325 	}
    326 
    327 	/*
    328 	 * calculate the checksum
    329 	 */
    330 
    331 	icmp6 = (struct icmp6_hdr *)((caddr_t)ip6 + off);
    332 	code = icmp6->icmp6_code;
    333 
    334 	if ((sum = in6_cksum(m, IPPROTO_ICMPV6, off, icmp6len)) != 0) {
    335 		log(LOG_ERR,
    336 		    "ICMP6 checksum error(%d|%x) %s\n",
    337 		    icmp6->icmp6_type,
    338 		    sum,
    339 		    ip6_sprintf(&ip6->ip6_src));
    340 		icmp6stat.icp6s_checksum++;
    341 		goto freeit;
    342 	}
    343 
    344 #if defined(NFAITH) && 0 < NFAITH
    345 	if (m->m_pkthdr.rcvif && m->m_pkthdr.rcvif->if_type == IFT_FAITH) {
    346 		/*
    347 		 * Deliver very specific ICMP6 type only.
    348 		 * This is important to deilver TOOBIG.  Otherwise PMTUD
    349 		 * will not work.
    350 		 */
    351 		switch (icmp6->icmp6_type) {
    352 		case ICMP6_DST_UNREACH:
    353 		case ICMP6_PACKET_TOO_BIG:
    354 		case ICMP6_TIME_EXCEEDED:
    355 			break;
    356 		default:
    357 			goto freeit;
    358 		}
    359 	}
    360 #endif
    361 
    362 #ifdef IPSEC
    363 	/* drop it if it does not match the default policy */
    364 	if (ipsec6_in_reject(m, NULL)) {
    365 		ipsecstat.in_polvio++;
    366 		goto freeit;
    367 	}
    368 #endif
    369 
    370 	icmp6stat.icp6s_inhist[icmp6->icmp6_type]++;
    371 
    372 	switch (icmp6->icmp6_type) {
    373 
    374 	case ICMP6_DST_UNREACH:
    375 		switch (code) {
    376 		case ICMP6_DST_UNREACH_NOROUTE:
    377 			code = PRC_UNREACH_NET;
    378 			break;
    379 		case ICMP6_DST_UNREACH_ADMIN:
    380 		case ICMP6_DST_UNREACH_ADDR:
    381 			code = PRC_UNREACH_HOST;
    382 			break;
    383 		case ICMP6_DST_UNREACH_NOTNEIGHBOR:
    384 			code = PRC_UNREACH_SRCFAIL;
    385 			break;
    386 		case ICMP6_DST_UNREACH_NOPORT:
    387 			code = PRC_UNREACH_PORT;
    388 			break;
    389 		default:
    390 			goto badcode;
    391 		}
    392 		goto deliver;
    393 		break;
    394 
    395 	case ICMP6_PACKET_TOO_BIG:
    396 		if (code != 0)
    397 			goto badcode;
    398 	    {
    399 		u_int mtu = ntohl(icmp6->icmp6_mtu);
    400 		struct rtentry *rt;
    401 		struct sockaddr_in6 sin6;
    402 #ifdef __bsdi__
    403 		struct route_in6 ro6;
    404 #endif
    405 
    406 		code = PRC_MSGSIZE;
    407 		bzero(&sin6, sizeof(sin6));
    408 		sin6.sin6_family = PF_INET6;
    409 		sin6.sin6_len = sizeof(struct sockaddr_in6);
    410 		sin6.sin6_addr = ((struct ip6_hdr *)(icmp6 + 1))->ip6_dst;
    411 #ifdef __NetBSD__
    412 		rt = rtalloc1((struct sockaddr *)&sin6, 1);	/*clone*/
    413 		if (!rt || (rt->rt_flags & RTF_HOST) == 0) {
    414 			if (rt)
    415 				RTFREE(rt);
    416 			rt = icmp6_mtudisc_clone((struct sockaddr *)&sin6);
    417 		}
    418 #endif
    419 #ifdef __FreeBSD__
    420 		rt = rtalloc1((struct sockaddr *)&sin6, 0,
    421 			RTF_CLONING | RTF_PRCLONING);
    422 #endif /*__FreeBSD__*/
    423 #ifdef __bsdi__
    424 		bcopy(&sin6, &ro6.ro_dst, sizeof(struct sockaddr_in6));
    425 		ro6.ro_rt = 0;
    426 		rtcalloc((struct route *)&ro6);
    427 		rt = ro6.ro_rt;
    428 #endif /*__bsdi__*/
    429 
    430 		if (rt && (rt->rt_flags & RTF_HOST)
    431 		    && !(rt->rt_rmx.rmx_locks & RTV_MTU)) {
    432 			if (mtu < IPV6_MMTU) {
    433 				/* xxx */
    434 				rt->rt_rmx.rmx_locks |= RTV_MTU;
    435 			} else if (mtu < rt->rt_ifp->if_mtu &&
    436 				   rt->rt_rmx.rmx_mtu > mtu) {
    437 				rt->rt_rmx.rmx_mtu = mtu;
    438 			}
    439 		}
    440 		if (rt)
    441 			RTFREE(rt);
    442 
    443 		goto deliver;
    444 	    }
    445 		break;
    446 
    447 	case ICMP6_TIME_EXCEEDED:
    448 		switch (code) {
    449 		case ICMP6_TIME_EXCEED_TRANSIT:
    450 		case ICMP6_TIME_EXCEED_REASSEMBLY:
    451 			code += PRC_TIMXCEED_INTRANS;
    452 			break;
    453 		default:
    454 			goto badcode;
    455 		}
    456 		goto deliver;
    457 		break;
    458 
    459 	case ICMP6_PARAM_PROB:
    460 		switch (code) {
    461 		case ICMP6_PARAMPROB_NEXTHEADER:
    462 			code = PRC_UNREACH_PROTOCOL;
    463 			break;
    464 		case ICMP6_PARAMPROB_HEADER:
    465 		case ICMP6_PARAMPROB_OPTION:
    466 			code = PRC_PARAMPROB;
    467 			break;
    468 		default:
    469 			goto badcode;
    470 		}
    471 		goto deliver;
    472 		break;
    473 
    474 	case ICMP6_ECHO_REQUEST:
    475 		if (code != 0)
    476 			goto badcode;
    477 		if ((n = m_copy(m, 0, M_COPYALL)) == NULL) {
    478 			/* Give up remote */
    479 			break;
    480 		}
    481 		if (n->m_flags & M_EXT) {
    482 			int gap, move;
    483 			struct mbuf *n0 = n;
    484 
    485 			/*
    486 			 * Prepare an internal mbuf. m_pullup() doesn't
    487 			 * always copy the length we specified.
    488 			 */
    489 			MGETHDR(n, M_DONTWAIT, n0->m_type);
    490 			if (n == NULL) {
    491 				/* Give up remote */
    492 				m_freem(n0);
    493 				break;
    494 			}
    495 			M_COPY_PKTHDR(n, n0);
    496 			n0->m_flags &= ~M_PKTHDR;
    497 			n->m_next = n0;
    498 			/*
    499 			 * Copy IPv6 and ICMPv6 only.
    500 			 */
    501 			nip6 = mtod(n, struct ip6_hdr *);
    502 			bcopy(ip6, nip6, sizeof(struct ip6_hdr));
    503 			nicmp6 = (struct icmp6_hdr *)(nip6 + 1);
    504 			bcopy(icmp6, nicmp6, sizeof(struct icmp6_hdr));
    505 			/*
    506 			 * Adjust mbuf. ip6_plen will be adjusted.
    507 			 */
    508 			noff = sizeof(struct ip6_hdr);
    509 			n->m_len = noff + sizeof(struct icmp6_hdr);
    510 			move = off + sizeof(struct icmp6_hdr);
    511 			n0->m_len -= move;
    512 			n0->m_data += move;
    513 			gap = off - noff;
    514 			n->m_pkthdr.len -= gap;
    515 		} else {
    516 			nip6 = mtod(n, struct ip6_hdr *);
    517 			nicmp6 = (struct icmp6_hdr *)((caddr_t)nip6 + off);
    518 			noff = off;
    519 		}
    520 		nicmp6->icmp6_type = ICMP6_ECHO_REPLY;
    521 		nicmp6->icmp6_code = 0;
    522 		if (n) {
    523 			icmp6stat.icp6s_reflect++;
    524 			icmp6stat.icp6s_outhist[ICMP6_ECHO_REPLY]++;
    525 			icmp6_reflect(n, noff);
    526 		}
    527 		break;
    528 
    529 	case ICMP6_ECHO_REPLY:
    530 		if (code != 0)
    531 			goto badcode;
    532 		break;
    533 
    534 	case MLD6_LISTENER_QUERY:
    535 	case MLD6_LISTENER_REPORT:
    536 		if (icmp6len < sizeof(struct mld6_hdr))
    537 			goto badlen;
    538 		IP6_EXTHDR_CHECK(m, off, icmp6len, IPPROTO_DONE);
    539 		mld6_input(m, off);
    540 		/* m stays. */
    541 		break;
    542 
    543 	case MLD6_LISTENER_DONE:
    544 		if (icmp6len < sizeof(struct mld6_hdr))
    545 			goto badlen;
    546 		break;		/* nothing to be done in kernel */
    547 
    548 	case ICMP6_WRUREQUEST:	/* ICMP6_FQDN_QUERY */
    549 	    {
    550 		enum { WRU, FQDN } mode;
    551 
    552 		if (code != 0)
    553 			goto badcode;
    554 		if (icmp6len == sizeof(struct icmp6_hdr) + 4)
    555 			mode = WRU;
    556 		else if (icmp6len >= sizeof(struct icmp6_hdr) + 8) /* XXX */
    557 			mode = FQDN;
    558 		else
    559 			goto badlen;
    560 
    561 #ifdef __FreeBSD__
    562 #define hostnamelen	strlen(hostname)
    563 #endif
    564 		if (mode == FQDN) {
    565 			IP6_EXTHDR_CHECK(m, off, sizeof(struct icmp6_nodeinfo),
    566 					 IPPROTO_DONE);
    567 			n = ni6_input(m, off);
    568 			noff = sizeof(struct ip6_hdr);
    569 		}
    570 		else {
    571 			u_char *p;
    572 
    573 			MGETHDR(n, M_DONTWAIT, m->m_type);
    574 			if (n == NULL) {
    575 				/* Give up remote */
    576 				break;
    577 			}
    578 			/*
    579 			 * Copy IPv6 and ICMPv6 only.
    580 			 */
    581 			nip6 = mtod(n, struct ip6_hdr *);
    582 			bcopy(ip6, nip6, sizeof(struct ip6_hdr));
    583 			nicmp6 = (struct icmp6_hdr *)(nip6 + 1);
    584 			bcopy(icmp6, nicmp6, sizeof(struct icmp6_hdr));
    585 			p = (u_char *)(nicmp6 + 1);
    586 			bzero(p, 4);
    587 			bcopy(hostname, p + 4, hostnamelen);
    588 			noff = sizeof(struct ip6_hdr);
    589 			M_COPY_PKTHDR(n, m); /* just for recvif */
    590 			n->m_pkthdr.len = n->m_len = sizeof(struct ip6_hdr) +
    591 				sizeof(struct icmp6_hdr) + 4 + hostnamelen;
    592 			nicmp6->icmp6_type = ICMP6_WRUREPLY;
    593 			nicmp6->icmp6_code = 0;
    594 		}
    595 #undef hostnamelen
    596 		if (n) {
    597 			icmp6stat.icp6s_reflect++;
    598 			icmp6stat.icp6s_outhist[ICMP6_WRUREPLY]++;
    599 			icmp6_reflect(n, noff);
    600 		}
    601 		break;
    602 	    }
    603 
    604 	case ICMP6_WRUREPLY:
    605 		if (code != 0)
    606 			goto badcode;
    607 		break;
    608 
    609 	case ND_ROUTER_SOLICIT:
    610 		if (code != 0)
    611 			goto badcode;
    612 		if (icmp6len < sizeof(struct nd_router_solicit))
    613 			goto badlen;
    614 		IP6_EXTHDR_CHECK(m, off, icmp6len, IPPROTO_DONE);
    615 		nd6_rs_input(m, off, icmp6len);
    616 		/* m stays. */
    617 		break;
    618 
    619 	case ND_ROUTER_ADVERT:
    620 		if (code != 0)
    621 			goto badcode;
    622 		if (icmp6len < sizeof(struct nd_router_advert))
    623 			goto badlen;
    624 		IP6_EXTHDR_CHECK(m, off, icmp6len, IPPROTO_DONE);
    625 		nd6_ra_input(m, off, icmp6len);
    626 		/* m stays. */
    627 		break;
    628 
    629 	case ND_NEIGHBOR_SOLICIT:
    630 		if (code != 0)
    631 			goto badcode;
    632 		if (icmp6len < sizeof(struct nd_neighbor_solicit))
    633 			goto badlen;
    634 		IP6_EXTHDR_CHECK(m, off, icmp6len, IPPROTO_DONE);
    635 		nd6_ns_input(m, off, icmp6len);
    636 		/* m stays. */
    637 		break;
    638 
    639 	case ND_NEIGHBOR_ADVERT:
    640 		if (code != 0)
    641 			goto badcode;
    642 		if (icmp6len < sizeof(struct nd_neighbor_advert))
    643 			goto badlen;
    644 		IP6_EXTHDR_CHECK(m, off, icmp6len, IPPROTO_DONE);
    645 		nd6_na_input(m, off, icmp6len);
    646 		/* m stays. */
    647 		break;
    648 
    649 	case ND_REDIRECT:
    650 		if (code != 0)
    651 			goto badcode;
    652 		if (icmp6len < sizeof(struct nd_redirect))
    653 			goto badlen;
    654 		icmp6_redirect_input(m, off);
    655 		/* m stays. */
    656 		break;
    657 
    658 	case ICMP6_ROUTER_RENUMBERING:
    659 		if (code != ICMP6_ROUTER_RENUMBERING_COMMAND &&
    660 		    code != ICMP6_ROUTER_RENUMBERING_RESULT)
    661 			goto badcode;
    662 		if (icmp6len < sizeof(struct icmp6_router_renum))
    663 			goto badlen;
    664 		break;
    665 
    666 	default:
    667 		printf("icmp6_input: unknown type %d\n", icmp6->icmp6_type);
    668 		if (icmp6->icmp6_type < ICMP6_ECHO_REQUEST) {
    669 			/* ICMPv6 error: MUST deliver it by spec... */
    670 			code = PRC_NCMDS;
    671 			/* deliver */
    672 		} else {
    673 			/* ICMPv6 informational: MUST not deliver */
    674 			break;
    675 		}
    676 	deliver:
    677 		if (icmp6len < sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr)) {
    678 			icmp6stat.icp6s_tooshort++;
    679 			goto freeit;
    680 		}
    681 		IP6_EXTHDR_CHECK(m, off,
    682 			sizeof(struct icmp6_hdr) + sizeof(struct ip6_hdr),
    683 			IPPROTO_DONE);
    684 		icmp6 = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
    685 		bzero(&icmp6src, sizeof(icmp6src));
    686 		icmp6src.sin6_len = sizeof(struct sockaddr_in6);
    687 		icmp6src.sin6_family = AF_INET6;
    688 		icmp6src.sin6_addr = ((struct ip6_hdr *)(icmp6 + 1))->ip6_dst;
    689 
    690 		/* Detect the upper level protocol */
    691 	    {
    692 		void (*ctlfunc) __P((int, struct sockaddr *,
    693 				     struct ip6_hdr *,
    694 				     struct mbuf *, int)); /* XXX */
    695 		struct ip6_hdr *eip6 = (struct ip6_hdr *)(icmp6 + 1);
    696 		u_int8_t nxt = eip6->ip6_nxt;
    697 		int eoff = off + sizeof(struct icmp6_hdr) +
    698 			sizeof(struct ip6_hdr);
    699 
    700 		while (1) { /* XXX: should avoid inf. loop explicitly? */
    701 			struct ip6_ext *eh;
    702 
    703 			switch(nxt) {
    704 			case IPPROTO_ESP:
    705 			case IPPROTO_NONE:
    706 				goto passit;
    707 			case IPPROTO_HOPOPTS:
    708 			case IPPROTO_DSTOPTS:
    709 			case IPPROTO_ROUTING:
    710 			case IPPROTO_AH:
    711 			case IPPROTO_FRAGMENT:
    712 				IP6_EXTHDR_CHECK(m, 0, eoff +
    713 						 sizeof(struct ip6_ext),
    714 						 IPPROTO_DONE);
    715 				eh = (struct ip6_ext *)(mtod(m, caddr_t)
    716 							+ eoff);
    717 				if (nxt == IPPROTO_AH)
    718 					eoff += (eh->ip6e_len + 2) << 2;
    719 				else if (nxt == IPPROTO_FRAGMENT)
    720 					eoff += sizeof(struct ip6_frag);
    721 				else
    722 					eoff += (eh->ip6e_len + 1) << 3;
    723 				nxt = eh->ip6e_nxt;
    724 				break;
    725 			default:
    726 				goto notify;
    727 			}
    728 		}
    729 	    notify:
    730 		icmp6 = (struct icmp6_hdr *)(mtod(m, caddr_t) + off);
    731 		ctlfunc = (void (*) __P((int, struct sockaddr *,
    732 					 struct ip6_hdr *,
    733 					 struct mbuf *, int)))
    734 			(inet6sw[ip6_protox[nxt]].pr_ctlinput);
    735 		if (ctlfunc)
    736 			(*ctlfunc)(code, (struct sockaddr *)&icmp6src,
    737 				   (struct ip6_hdr *)(icmp6 + 1),
    738 				   m, eoff);
    739 	    }
    740 		break;
    741 
    742 	badcode:
    743 		icmp6stat.icp6s_badcode++;
    744 		break;
    745 
    746 	badlen:
    747 		icmp6stat.icp6s_badlen++;
    748 		break;
    749 	}
    750 
    751  passit:
    752 	icmp6_rip6_input(&m, *offp);
    753 	return IPPROTO_DONE;
    754 
    755  freeit:
    756 	m_freem(m);
    757 	return IPPROTO_DONE;
    758 }
    759 
    760 /*
    761  * Process a Node Information Query
    762  */
    763 #ifdef __FreeBSD__
    764 #define hostnamelen	strlen(hostname)
    765 #endif
    766 #ifndef offsetof		/* XXX */
    767 #define	offsetof(type, member)	((size_t)(&((type *)0)->member))
    768 #endif
    769 
    770 static struct mbuf *
    771 ni6_input(m, off)
    772 	struct mbuf *m;
    773 	int off;
    774 {
    775 	struct icmp6_nodeinfo *ni6 =
    776 		(struct icmp6_nodeinfo *)(mtod(m, caddr_t) + off), *nni6;
    777 	struct mbuf *n = NULL;
    778 	u_int16_t qtype = ntohs(ni6->ni_qtype);
    779 	int replylen = sizeof(struct ip6_hdr) + sizeof(struct icmp6_nodeinfo);
    780 	struct ni_reply_fqdn *fqdn;
    781 	int addrs;		/* for NI_QTYPE_NODEADDR */
    782 	struct ifnet *ifp = NULL; /* for NI_QTYPE_NODEADDR */
    783 
    784 	switch(qtype) {
    785 	 case NI_QTYPE_NOOP:
    786 		 break;		/* no reply data */
    787 	 case NI_QTYPE_SUPTYPES:
    788 		 goto bad;	/* xxx: to be implemented */
    789 		 break;
    790 	 case NI_QTYPE_FQDN:
    791 		 replylen += offsetof(struct ni_reply_fqdn, ni_fqdn_name) +
    792 			 hostnamelen;
    793 		 break;
    794 	 case NI_QTYPE_NODEADDR:
    795 		 addrs = ni6_addrs(ni6, m, &ifp);
    796 		 if ((replylen += addrs * sizeof(struct in6_addr)) > MCLBYTES)
    797 			 replylen = MCLBYTES; /* XXX: we'll truncate later */
    798 
    799 		 break;
    800 	 default:
    801 		 /*
    802 		  * XXX: We must return a reply with the ICMP6 code
    803 		  * `unknown Qtype' in this case. However we regard the case
    804 		  * as an FQDN query for backward compatibility.
    805 		  * Older versions set a random value to this field,
    806 		  * so it rarely varies in the defined qtypes.
    807 		  * But the mechanism is not reliable...
    808 		  * maybe we should obsolete older versions.
    809 		  */
    810 		 qtype = NI_QTYPE_FQDN;
    811 		 replylen += offsetof(struct ni_reply_fqdn, ni_fqdn_name) +
    812 			 hostnamelen;
    813 		 break;
    814 	}
    815 
    816 	/* allocate a mbuf to reply. */
    817 	MGETHDR(n, M_DONTWAIT, m->m_type);
    818 	if (n == NULL)
    819 		return(NULL);
    820 	M_COPY_PKTHDR(n, m); /* just for recvif */
    821 	if (replylen > MHLEN) {
    822 		if (replylen > MCLBYTES)
    823 			 /*
    824 			  * XXX: should we try to allocate more? But MCLBYTES is
    825 			  * probably much larger than IPV6_MMTU...
    826 			  */
    827 			goto bad;
    828 		MCLGET(n, M_DONTWAIT);
    829 		if ((n->m_flags & M_EXT) == 0) {
    830 			goto bad;
    831 		}
    832 	}
    833 	n->m_pkthdr.len = n->m_len = replylen;
    834 
    835 	/* copy mbuf header and IPv6 + Node Information base headers */
    836 	bcopy(mtod(m, caddr_t), mtod(n, caddr_t), sizeof(struct ip6_hdr));
    837 	nni6 = (struct icmp6_nodeinfo *)(mtod(n, struct ip6_hdr *) + 1);
    838 	bcopy(mtod(m, caddr_t) + off, (caddr_t)nni6, sizeof(struct icmp6_nodeinfo));
    839 
    840 	/* qtype dependent procedure */
    841 	switch (qtype) {
    842 	 case NI_QTYPE_NOOP:
    843 		 nni6->ni_flags = 0;
    844 		 break;
    845 	 case NI_QTYPE_SUPTYPES:
    846 		 goto bad;	/* xxx: to be implemented */
    847 		 break;
    848 	 case NI_QTYPE_FQDN:
    849 		 if (hostnamelen > 255) { /* XXX: rare case, but may happen */
    850 			 printf("ni6_input: "
    851 				"hostname length(%d) is too large for reply\n",
    852 				hostnamelen);
    853 			 goto bad;
    854 		 }
    855 		 fqdn = (struct ni_reply_fqdn *)(mtod(n, caddr_t) +
    856 						 sizeof(struct ip6_hdr) +
    857 						 sizeof(struct icmp6_nodeinfo));
    858 		 nni6->ni_flags = 0; /* XXX: meaningless TTL */
    859 		 fqdn->ni_fqdn_ttl = 0;	/* ditto. */
    860 		 fqdn->ni_fqdn_namelen = hostnamelen;
    861 		 bcopy(hostname, &fqdn->ni_fqdn_name[0], hostnamelen);
    862 		 break;
    863 	 case NI_QTYPE_NODEADDR:
    864 	 {
    865 		 int lenlim, copied;
    866 
    867 		 if (n->m_flags & M_EXT)
    868 			 lenlim = MCLBYTES - sizeof(struct ip6_hdr) -
    869 				 sizeof(struct icmp6_nodeinfo);
    870 		 else
    871 			 lenlim = MHLEN - sizeof(struct ip6_hdr) -
    872 				 sizeof(struct icmp6_nodeinfo);
    873 		 copied = ni6_store_addrs(ni6, nni6, ifp, lenlim);
    874 		 /* XXX: reset mbuf length */
    875 		 n->m_pkthdr.len = n->m_len = sizeof(struct ip6_hdr) +
    876 			 sizeof(struct icmp6_nodeinfo) + copied;
    877 		 break;
    878 	 }
    879 	 default:
    880 		 break;		/* XXX impossible! */
    881 	}
    882 
    883 	nni6->ni_type = ICMP6_NI_REPLY;
    884 	nni6->ni_code = ICMP6_NI_SUCESS;
    885 	return(n);
    886 
    887   bad:
    888 	if (n)
    889 		m_freem(n);
    890 	return(NULL);
    891 }
    892 #undef hostnamelen
    893 
    894 /*
    895  * calculate the number of addresses to be returned in the node info reply.
    896  */
    897 static int
    898 ni6_addrs(ni6, m, ifpp)
    899 	struct icmp6_nodeinfo *ni6;
    900 	struct mbuf *m;
    901 	struct ifnet **ifpp;
    902 {
    903 	register struct ifnet *ifp;
    904 	register struct in6_ifaddr *ifa6;
    905 	register struct ifaddr *ifa;
    906 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
    907 	int addrs = 0, addrsofif, iffound = 0;
    908 
    909 #ifdef __NetBSD__
    910 	for (ifp = TAILQ_FIRST(&ifnet); ifp; ifp = TAILQ_NEXT(ifp, if_list))
    911 #else
    912 	for (ifp = ifnet; ifp; ifp = ifp->if_next)
    913 #endif
    914 	{
    915 		addrsofif = 0;
    916 #ifdef __NetBSD__
    917 		for (ifa = ifp->if_addrlist.tqh_first; ifa;
    918 		     ifa = ifa->ifa_list.tqe_next)
    919 #else
    920 		for (ifa = ifp->if_addrlist; ifa; ifa = ifa->ifa_next)
    921 #endif
    922 		{
    923 			if (ifa->ifa_addr->sa_family != AF_INET6)
    924 				continue;
    925 			ifa6 = (struct in6_ifaddr *)ifa;
    926 
    927 			if (!(ni6->ni_flags & NI_NODEADDR_FLAG_ALL) &&
    928 			    IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
    929 					       &ifa6->ia_addr.sin6_addr))
    930 				iffound = 1;
    931 
    932 			if (ifa6->ia6_flags & IN6_IFF_ANYCAST)
    933 				continue; /* we need only unicast addresses */
    934 
    935 			if ((ni6->ni_flags & (NI_NODEADDR_FLAG_LINKLOCAL |
    936 					      NI_NODEADDR_FLAG_SITELOCAL |
    937 					      NI_NODEADDR_FLAG_GLOBAL)) == 0)
    938 				continue;
    939 
    940 			/* What do we have to do about ::1? */
    941 			switch(in6_addrscope(&ifa6->ia_addr.sin6_addr)) {
    942 			 case IPV6_ADDR_SCOPE_LINKLOCAL:
    943 				if (ni6->ni_flags & NI_NODEADDR_FLAG_LINKLOCAL)
    944 					addrsofif++;
    945 				break;
    946 			 case IPV6_ADDR_SCOPE_SITELOCAL:
    947 				if (ni6->ni_flags & NI_NODEADDR_FLAG_SITELOCAL)
    948 					addrsofif++;
    949 				break;
    950 			 case IPV6_ADDR_SCOPE_GLOBAL:
    951 				 if (ni6->ni_flags & NI_NODEADDR_FLAG_GLOBAL)
    952 					 addrsofif++;
    953 				 break;
    954 			 default:
    955 				 continue;
    956 			}
    957 		}
    958 		if (iffound) {
    959 			*ifpp = ifp;
    960 			return(addrsofif);
    961 		}
    962 
    963 		addrs += addrsofif;
    964 	}
    965 
    966 	return(addrs);
    967 }
    968 
    969 static int
    970 ni6_store_addrs(ni6, nni6, ifp0, resid)
    971 	struct icmp6_nodeinfo *ni6, *nni6;
    972 	struct ifnet *ifp0;
    973 	int resid;
    974 {
    975 #ifdef __NetBSD__
    976 	register struct ifnet *ifp = ifp0 ? ifp0 : TAILQ_FIRST(&ifnet);
    977 #else
    978 	register struct ifnet *ifp = ifp0 ? ifp0 : ifnet;
    979 #endif
    980 	register struct in6_ifaddr *ifa6;
    981 	register struct ifaddr *ifa;
    982 	int docopy, copied = 0;
    983 	u_char *cp = (u_char *)(nni6 + 1);
    984 
    985 	if (ifp0 == NULL && !(ni6->ni_flags & NI_NODEADDR_FLAG_ALL))
    986 		return(0);	/* needless to copy */
    987 
    988 #ifdef __NetBSD__
    989 	for (; ifp; ifp = TAILQ_NEXT(ifp, if_list))
    990 #else
    991 	for (; ifp; ifp = ifp->if_next)
    992 #endif
    993 	{
    994 #ifdef __NetBSD__
    995 		for (ifa = ifp->if_addrlist.tqh_first; ifa;
    996 		     ifa = ifa->ifa_list.tqe_next)
    997 #else
    998 		for (ifa = ifp->if_addrlist; ifa; ifa = ifa->ifa_next)
    999 #endif
   1000 		{
   1001 			docopy = 0;
   1002 
   1003 			if (ifa->ifa_addr->sa_family != AF_INET6)
   1004 				continue;
   1005 			ifa6 = (struct in6_ifaddr *)ifa;
   1006 
   1007 			if (ifa6->ia6_flags & IN6_IFF_ANYCAST)
   1008 				continue; /* we need only unicast addresses */
   1009 
   1010 			/* What do we have to do about ::1? */
   1011 			switch(in6_addrscope(&ifa6->ia_addr.sin6_addr)) {
   1012 			 case IPV6_ADDR_SCOPE_LINKLOCAL:
   1013 				if (ni6->ni_flags & NI_NODEADDR_FLAG_LINKLOCAL)
   1014 					docopy = 1;
   1015 				break;
   1016 			 case IPV6_ADDR_SCOPE_SITELOCAL:
   1017 				if (ni6->ni_flags & NI_NODEADDR_FLAG_SITELOCAL)
   1018 					docopy = 1;
   1019 				break;
   1020 			 case IPV6_ADDR_SCOPE_GLOBAL:
   1021 				 if (ni6->ni_flags & NI_NODEADDR_FLAG_GLOBAL)
   1022 					 docopy = 1;
   1023 				 break;
   1024 			 default:
   1025 				 continue;
   1026 			}
   1027 
   1028 			if (docopy) {
   1029 				if (resid < sizeof(struct in6_addr)) {
   1030 					/*
   1031 					 * We give up much more copy.
   1032 					 * Set the truncate flag and return.
   1033 					 */
   1034 					nni6->ni_flags |=
   1035 						NI_NODEADDR_FLAG_TRUNCATE;
   1036 					return(copied);
   1037 				}
   1038 				bcopy(&ifa6->ia_addr.sin6_addr, cp,
   1039 				      sizeof(struct in6_addr));
   1040 				/* XXX: KAME link-local hack; remove ifindex */
   1041 				if (IN6_IS_ADDR_LINKLOCAL(&ifa6->ia_addr.sin6_addr))
   1042 					((struct in6_addr *)cp)->s6_addr16[1] = 0;
   1043 				cp += sizeof(struct in6_addr);
   1044 				resid -= sizeof(struct in6_addr);
   1045 				copied += sizeof(struct in6_addr);
   1046 			}
   1047 		}
   1048 		if (ifp0)	/* we need search only on the specified IF */
   1049 			break;
   1050 	}
   1051 
   1052 	return(copied);
   1053 }
   1054 
   1055 /*
   1056  * XXX almost dup'ed code with rip6_input.
   1057  */
   1058 static int
   1059 icmp6_rip6_input(mp, off)
   1060 	struct	mbuf **mp;
   1061 	int	off;
   1062 {
   1063 	struct mbuf *m = *mp;
   1064 	register struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
   1065 	register struct in6pcb *in6p;
   1066 	struct in6pcb *last = NULL;
   1067 	struct sockaddr_in6 rip6src;
   1068 	struct icmp6_hdr *icmp6;
   1069 	struct mbuf *opts = NULL;
   1070 
   1071 	/* this is assumed to be safe. */
   1072 	icmp6 = (struct icmp6_hdr *)((caddr_t)ip6 + off);
   1073 
   1074 	bzero(&rip6src, sizeof(rip6src));
   1075 	rip6src.sin6_len = sizeof(struct sockaddr_in6);
   1076 	rip6src.sin6_family = AF_INET6;
   1077 	rip6src.sin6_addr = ip6->ip6_src;
   1078 	if (IN6_IS_SCOPE_LINKLOCAL(&rip6src.sin6_addr))
   1079 		rip6src.sin6_addr.s6_addr16[1] = 0;
   1080 	if (m->m_pkthdr.rcvif) {
   1081 		if (IN6_IS_SCOPE_LINKLOCAL(&rip6src.sin6_addr))
   1082 			rip6src.sin6_scope_id = m->m_pkthdr.rcvif->if_index;
   1083 		else
   1084 			rip6src.sin6_scope_id = 0;
   1085 	} else
   1086 		rip6src.sin6_scope_id = 0;
   1087 
   1088 #if !defined(__FreeBSD__) || __FreeBSD__ < 3
   1089 	for (in6p = rawin6pcb.in6p_next;
   1090 	     in6p != &rawin6pcb; in6p = in6p->in6p_next)
   1091 #else
   1092 	LIST_FOREACH(in6p, &ripcb, inp_list)
   1093 #endif
   1094 	{
   1095 #if defined(__FreeBSD__) && __FreeBSD__ >= 3
   1096 		if ((in6p->inp_vflag & INP_IPV6) == NULL)
   1097 			continue;
   1098 #endif
   1099 		if (in6p->in6p_ip6_nxt != IPPROTO_ICMPV6)
   1100 			continue;
   1101 		if (!IN6_IS_ADDR_ANY(&in6p->in6p_laddr) &&
   1102 		   !IN6_ARE_ADDR_EQUAL(&in6p->in6p_laddr, &ip6->ip6_dst))
   1103 			continue;
   1104 		if (!IN6_IS_ADDR_ANY(&in6p->in6p_faddr) &&
   1105 		   !IN6_ARE_ADDR_EQUAL(&in6p->in6p_faddr, &ip6->ip6_src))
   1106 			continue;
   1107 		if (in6p->in6p_icmp6filt
   1108 		    && ICMP6_FILTER_WILLBLOCK(icmp6->icmp6_type,
   1109 				 in6p->in6p_icmp6filt))
   1110 			continue;
   1111 		if (last) {
   1112 			struct	mbuf *n;
   1113 			if ((n = m_copy(m, 0, (int)M_COPYALL)) != NULL) {
   1114 				if (last->in6p_flags & IN6P_CONTROLOPTS)
   1115 					ip6_savecontrol(last, &opts, ip6, n);
   1116 				/* strip intermediate headers */
   1117 				m_adj(n, off);
   1118 				if (sbappendaddr(&last->in6p_socket->so_rcv,
   1119 						 (struct sockaddr *)&rip6src,
   1120 						 n, opts) == 0) {
   1121 					/* should notify about lost packet */
   1122 					m_freem(n);
   1123 					if (opts)
   1124 						m_freem(opts);
   1125 				} else
   1126 					sorwakeup(last->in6p_socket);
   1127 				opts = NULL;
   1128 			}
   1129 		}
   1130 		last = in6p;
   1131 	}
   1132 	if (last) {
   1133 		if (last->in6p_flags & IN6P_CONTROLOPTS)
   1134 			ip6_savecontrol(last, &opts, ip6, m);
   1135 		/* strip intermediate headers */
   1136 		m_adj(m, off);
   1137 		if (sbappendaddr(&last->in6p_socket->so_rcv,
   1138 				(struct sockaddr *)&rip6src, m, opts) == 0) {
   1139 			m_freem(m);
   1140 			if (opts)
   1141 				m_freem(opts);
   1142 		} else
   1143 			sorwakeup(last->in6p_socket);
   1144 	} else {
   1145 		m_freem(m);
   1146 		ip6stat.ip6s_delivered--;
   1147 	}
   1148 	return IPPROTO_DONE;
   1149 }
   1150 
   1151 /*
   1152  * Reflect the ip6 packet back to the source.
   1153  * The caller MUST check if the destination is multicast or not.
   1154  * This function is usually called with a unicast destination which
   1155  * can be safely the source of the reply packet. But some exceptions
   1156  * exist(e.g. ECHOREPLY, PATCKET_TOOBIG, "10" in OPTION type).
   1157  * ``off'' points to the icmp6 header, counted from the top of the mbuf.
   1158  */
   1159 void
   1160 icmp6_reflect(m, off)
   1161 	struct	mbuf *m;
   1162 	size_t off;
   1163 {
   1164 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
   1165 	struct icmp6_hdr *icmp6;
   1166 	struct in6_ifaddr *ia;
   1167 	struct in6_addr t, *src = 0;
   1168 	int plen = m->m_pkthdr.len - sizeof(struct ip6_hdr);
   1169 #ifdef COMPAT_RFC1885
   1170 	int mtu = IPV6_MMTU;
   1171 	struct sockaddr_in6 *sin6 = &icmp6_reflect_rt.ro_dst;
   1172 #endif
   1173 
   1174 	/*
   1175 	 * If there are extra headers between IPv6 and ICMPv6, strip
   1176 	 * off that header first.
   1177 	 */
   1178 	if (off != sizeof(struct ip6_hdr)) {
   1179 		size_t siz;
   1180 
   1181 		/* sanity checks */
   1182 		if (off < sizeof(struct ip6_hdr)) {
   1183 			printf("sanity fail: off=%x, sizeof(ip6)=%x in %s:%d\n",
   1184 			       (unsigned int)off,
   1185 			       (unsigned int)sizeof(struct ip6_hdr),
   1186 			       __FILE__, __LINE__);
   1187 			goto bad;
   1188 		}
   1189 		siz = off - sizeof(struct ip6_hdr);
   1190 		if (plen < siz) {
   1191 			printf("sanity fail: siz=%x, payloadlen=%x in %s:%d\n",
   1192 			       (unsigned int)siz, plen, __FILE__, __LINE__);
   1193 			goto bad;
   1194 		}
   1195 		IP6_EXTHDR_CHECK(m, 0, off, /*nothing*/);
   1196 		IP6_EXTHDR_CHECK(m, off, sizeof(struct icmp6_hdr), /*nothing*/);
   1197 
   1198 		bcopy((caddr_t)ip6,
   1199 			(caddr_t)(mtod(m, u_char *) + siz),
   1200 			sizeof(struct ip6_hdr));
   1201 		m->m_data += siz;
   1202 		m->m_len -= siz;
   1203 		m->m_pkthdr.len -= siz;
   1204 		ip6 = mtod(m, struct ip6_hdr *);
   1205 		ip6->ip6_nxt = IPPROTO_ICMPV6;
   1206 		plen -= siz;
   1207 	}
   1208 
   1209 	icmp6 = (struct icmp6_hdr *)(ip6 + 1);
   1210 
   1211 	t = ip6->ip6_dst;
   1212 	/*
   1213 	 * ip6_input() drops a packet if its src is multicast.
   1214 	 * So, the src is never multicast.
   1215 	 */
   1216 	ip6->ip6_dst = ip6->ip6_src;
   1217 
   1218 	/* XXX hack for link-local addresses */
   1219 	if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst))
   1220 		ip6->ip6_dst.s6_addr16[1] =
   1221 			htons(m->m_pkthdr.rcvif->if_index);
   1222 	if (IN6_IS_ADDR_LINKLOCAL(&t))
   1223 		t.s6_addr16[1] = htons(m->m_pkthdr.rcvif->if_index);
   1224 
   1225 #ifdef COMPAT_RFC1885
   1226 	/*
   1227 	 * xxx guess MTU
   1228 	 * RFC 1885 requires that echo reply should be truncated if it
   1229 	 * does not fit in with (return) path MTU, but the description was
   1230 	 * removed in the new spec.
   1231 	 */
   1232 	if (icmp6_reflect_rt.ro_rt == 0 ||
   1233 	    ! (IN6_ARE_ADDR_EQUAL(&sin6->sin6_addr, &ip6->ip6_dst))) {
   1234 		if (icmp6_reflect_rt.ro_rt) {
   1235 #ifdef __FreeBSD__
   1236 			RTFREE(icmp6_reflect_rt.ro_rt);
   1237 #endif
   1238 #ifdef __bsdi__
   1239 			rtfree(icmp6_reflect_rt.ro_rt);
   1240 #endif
   1241 			icmp6_reflect_rt.ro_rt = 0;
   1242 		}
   1243 		bzero(sin6, sizeof(*sin6));
   1244 		sin6->sin6_family = PF_INET6;
   1245 		sin6->sin6_len = sizeof(struct sockaddr_in6);
   1246 		sin6->sin6_addr = ip6->ip6_dst;
   1247 
   1248 #ifdef __FreeBSD__
   1249 		rtalloc_ign((struct route *)&icmp6_reflect_rt.ro_rt,
   1250 			    RTF_PRCLONING);
   1251 #else
   1252 		rtalloc((struct route *)&icmp6_reflect_rt.ro_rt);
   1253 #endif
   1254 	}
   1255 
   1256 	if (icmp6_reflect_rt.ro_rt == 0)
   1257 		goto bad;
   1258 
   1259 	if ((icmp6_reflect_rt.ro_rt->rt_flags & RTF_HOST)
   1260 	    && mtu < icmp6_reflect_rt.ro_rt->rt_ifp->if_mtu)
   1261 		mtu = icmp6_reflect_rt.ro_rt->rt_rmx.rmx_mtu;
   1262 
   1263 	if (mtu < m->m_pkthdr.len) {
   1264 		plen -= (m->m_pkthdr.len - mtu);
   1265 		m_adj(m, mtu - m->m_pkthdr.len);
   1266 	}
   1267 #endif
   1268 	/*
   1269 	 * If the incoming packet was addressed directly to us(i.e. unicast),
   1270 	 * use dst as the src for the reply.
   1271 	 */
   1272 	for (ia = in6_ifaddr; ia; ia = ia->ia_next)
   1273 		if (IN6_ARE_ADDR_EQUAL(&t, &ia->ia_addr.sin6_addr) &&
   1274 		    (ia->ia6_flags & IN6_IFF_ANYCAST) == 0) {
   1275 			src = &t;
   1276 			break;
   1277 		}
   1278 	if (ia == NULL && IN6_IS_ADDR_LINKLOCAL(&t) && (m->m_flags & M_LOOP)) {
   1279 		/*
   1280 		 * This is the case if the dst is our link-local address
   1281 		 * and the sender is also ourseleves.
   1282 		 */
   1283 		src = &t;
   1284 	}
   1285 
   1286 	if (src == 0)
   1287 		/*
   1288 		 * We have not multicast routing yet. So this case matches
   1289 		 * to our multicast, our anycast or not to our unicast.
   1290 		 * Select a source address which has the same scope.
   1291 		 */
   1292 		if ((ia = in6_ifawithscope(m->m_pkthdr.rcvif, &t)) != 0)
   1293 			src = &IA6_SIN6(ia)->sin6_addr;
   1294 
   1295 	if (src == 0)
   1296 		goto bad;
   1297 
   1298 	ip6->ip6_src = *src;
   1299 
   1300 	ip6->ip6_flow = 0;
   1301 	ip6->ip6_vfc = IPV6_VERSION;
   1302 	ip6->ip6_nxt = IPPROTO_ICMPV6;
   1303 	if (m->m_pkthdr.rcvif) {
   1304 		/* XXX: This may not be the outgoing interface */
   1305 		ip6->ip6_hlim = nd_ifinfo[m->m_pkthdr.rcvif->if_index].chlim;
   1306 	}
   1307 
   1308 	icmp6->icmp6_cksum = 0;
   1309 	icmp6->icmp6_cksum = in6_cksum(m, IPPROTO_ICMPV6,
   1310 					sizeof(struct ip6_hdr), plen);
   1311 
   1312 	/*
   1313 	 * xxx option handling
   1314 	 */
   1315 
   1316 	m->m_flags &= ~(M_BCAST|M_MCAST);
   1317 #ifdef IPSEC
   1318 	m->m_pkthdr.rcvif = NULL;
   1319 #endif /*IPSEC*/
   1320 
   1321 #ifdef COMPAT_RFC1885
   1322 	ip6_output(m, NULL, &icmp6_reflect_rt, 0, NULL);
   1323 #else
   1324 	ip6_output(m, NULL, NULL, 0, NULL);
   1325 #endif
   1326 
   1327 	return;
   1328 
   1329  bad:
   1330 	m_freem(m);
   1331 	return;
   1332 }
   1333 
   1334 void
   1335 icmp6_fasttimo()
   1336 {
   1337 	mld6_fasttimeo();
   1338 }
   1339 
   1340 void
   1341 icmp6_redirect_input(m, off)
   1342 	register struct mbuf *m;
   1343 	int off;
   1344 {
   1345 	struct ifnet *ifp = m->m_pkthdr.rcvif;
   1346 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
   1347 	struct nd_redirect *nd_rd = (struct nd_redirect *)((caddr_t)ip6 + off);
   1348 	int icmp6len = ntohs(ip6->ip6_plen);
   1349 	char *lladdr = NULL;
   1350 	int lladdrlen = 0;
   1351 	u_char *redirhdr = NULL;
   1352 	int redirhdrlen = 0;
   1353 	struct rtentry *rt = NULL;
   1354 	int is_router;
   1355 	int is_onlink;
   1356 	struct in6_addr src6 = ip6->ip6_src;
   1357 	struct in6_addr redtgt6 = nd_rd->nd_rd_target;
   1358 	struct in6_addr reddst6 = nd_rd->nd_rd_dst;
   1359 	union nd_opts ndopts;
   1360 
   1361 	if (!m || !ifp)
   1362 		return;
   1363 
   1364 	/* XXX if we are router, we don't update route by icmp6 redirect */
   1365 	if (ip6_forwarding)
   1366 		return;
   1367 	if (!icmp6_rediraccept)
   1368 		return;
   1369 
   1370 	if (IN6_IS_ADDR_LINKLOCAL(&redtgt6))
   1371 		redtgt6.s6_addr16[1] = htons(ifp->if_index);
   1372 	if (IN6_IS_ADDR_LINKLOCAL(&reddst6))
   1373 		reddst6.s6_addr16[1] = htons(ifp->if_index);
   1374 
   1375 	/* validation */
   1376 	if (!IN6_IS_ADDR_LINKLOCAL(&src6)) {
   1377 		log(LOG_ERR,
   1378 			"ICMP6 redirect sent from %s rejected; "
   1379 			"must be from linklocal\n", ip6_sprintf(&src6));
   1380 		return;
   1381 	}
   1382 	if (ip6->ip6_hlim != 255) {
   1383 		log(LOG_ERR,
   1384 			"ICMP6 redirect sent from %s rejected; "
   1385 			"hlim=%d (must be 255)\n",
   1386 			ip6_sprintf(&src6), ip6->ip6_hlim);
   1387 		return;
   1388 	}
   1389     {
   1390 	/* ip6->ip6_src must be equal to gw for icmp6->icmp6_reddst */
   1391 	struct sockaddr_in6 sin6;
   1392 	struct in6_addr *gw6;
   1393 
   1394 	bzero(&sin6, sizeof(sin6));
   1395 	sin6.sin6_family = AF_INET6;
   1396 	sin6.sin6_len = sizeof(struct sockaddr_in6);
   1397 	bcopy(&reddst6, &sin6.sin6_addr, sizeof(reddst6));
   1398 	rt = rtalloc1((struct sockaddr *)&sin6, 0
   1399 #ifdef __FreeBSD__
   1400 		      , 0UL
   1401 #endif
   1402 		      );
   1403 	if (rt) {
   1404 		gw6 = &(((struct sockaddr_in6 *)rt->rt_gateway)->sin6_addr);
   1405 		if (bcmp(&src6, gw6, sizeof(struct in6_addr)) != 0) {
   1406 			log(LOG_ERR,
   1407 				"ICMP6 redirect sent from %s rejected; "
   1408 				"ip src=%s, gw for %s=%s (must be same)\n",
   1409 				ip6_sprintf(&src6), ip6_sprintf(&src6),
   1410 				ip6_sprintf(&reddst6), ip6_sprintf(gw6));
   1411 			RTFREE(rt);
   1412 			return;
   1413 		}
   1414 	} else {
   1415 		log(LOG_ERR,
   1416 			"ICMP6 redirect sent from %s rejected; "
   1417 			"no route found for redirect destination %s\n",
   1418 			ip6_sprintf(&src6), ip6_sprintf(&reddst6));
   1419 		return;
   1420 	}
   1421 	RTFREE(rt);
   1422 	rt = NULL;
   1423     }
   1424 	if (IN6_IS_ADDR_MULTICAST(&reddst6)) {
   1425 		log(LOG_ERR,
   1426 			"ICMP6 redirect sent from %s rejected; "
   1427 			"redirect destination=%s (must be unicast)\n",
   1428 			ip6_sprintf(&src6), ip6_sprintf(&reddst6));
   1429 		return;
   1430 	}
   1431 
   1432 	is_router = is_onlink = 0;
   1433 	if (IN6_IS_ADDR_LINKLOCAL(&redtgt6))
   1434 		is_router = 1;	/* router case */
   1435 	if (bcmp(&redtgt6, &reddst6, sizeof(redtgt6)) == 0)
   1436 		is_onlink = 1;	/* on-link destination case */
   1437 	if (!is_router && !is_onlink) {
   1438 		log(LOG_ERR,
   1439 			"ICMP6 redirect sent from %s rejected; "
   1440 			"redirect target=%s, destination=%s\n",
   1441 			ip6_sprintf(&src6), ip6_sprintf(&redtgt6),
   1442 			ip6_sprintf(&reddst6));
   1443 		return;
   1444 	}
   1445 	/* validation passed */
   1446 
   1447 	icmp6len -= sizeof(*nd_rd);
   1448 	nd6_option_init(nd_rd + 1, icmp6len, &ndopts);
   1449 	if (nd6_options(&ndopts) < 0) {
   1450 		log(LOG_INFO, "icmp6_redirect_input: "
   1451 			"invalid ND option, rejected\n");
   1452 		return;
   1453 	}
   1454 
   1455 	if (ndopts.nd_opts_tgt_lladdr) {
   1456 		lladdr = (char *)(ndopts.nd_opts_tgt_lladdr + 1);
   1457 		lladdrlen = ndopts.nd_opts_tgt_lladdr->nd_opt_len << 3;
   1458 	}
   1459 
   1460 	if (ndopts.nd_opts_rh) {
   1461 		redirhdrlen = ndopts.nd_opts_rh->nd_opt_rh_len;
   1462 		redirhdr = (u_char *)(ndopts.nd_opts_rh + 1); /* xxx */
   1463 	}
   1464 
   1465 	if (lladdr && ((ifp->if_addrlen + 2 + 7) & ~7) != lladdrlen) {
   1466 		log(LOG_INFO,
   1467 			"icmp6_redirect_input: lladdrlen mismatch for %s "
   1468 			"(if %d, icmp6 packet %d)\n",
   1469 			ip6_sprintf(&redtgt6), ifp->if_addrlen, lladdrlen - 2);
   1470 	}
   1471 
   1472 	/* RFC 2461 8.3 */
   1473 	nd6_cache_lladdr(ifp, &redtgt6, lladdr, lladdrlen, ND_REDIRECT,
   1474 			 is_onlink ? ND_REDIRECT_ONLINK : ND_REDIRECT_ROUTER);
   1475 
   1476 	if (!is_onlink) {	/* better router case. perform rtredirect. */
   1477 		/* perform rtredirect */
   1478 		struct sockaddr_in6 sdst;
   1479 		struct sockaddr_in6 sgw;
   1480 		struct sockaddr_in6 ssrc;
   1481 #ifdef __bsdi__
   1482 		extern int icmp_redirtimeout;	/*XXX*/
   1483 #endif
   1484 
   1485 		bzero(&sdst, sizeof(sdst));
   1486 		bzero(&sgw, sizeof(sgw));
   1487 		bzero(&ssrc, sizeof(ssrc));
   1488 		sdst.sin6_family = sgw.sin6_family = ssrc.sin6_family = AF_INET6;
   1489 		sdst.sin6_len = sgw.sin6_len = ssrc.sin6_len =
   1490 			sizeof(struct sockaddr_in6);
   1491 		bcopy(&redtgt6, &sgw.sin6_addr, sizeof(struct in6_addr));
   1492 		bcopy(&reddst6, &sdst.sin6_addr, sizeof(struct in6_addr));
   1493 		bcopy(&src6, &ssrc.sin6_addr, sizeof(struct in6_addr));
   1494 		rtredirect((struct sockaddr *)&sdst, (struct sockaddr *)&sgw,
   1495 			   (struct sockaddr *)NULL, RTF_GATEWAY | RTF_HOST,
   1496 			   (struct sockaddr *)&ssrc,
   1497 #if defined(__FreeBSD__) || defined(__NetBSD__)
   1498 			   (struct rtentry **)NULL
   1499 #elif defined(__bsdi__)
   1500 			   icmp_redirtimeout /*XXX*/
   1501 #endif /*__FreeBSD__, __NetBSD__, __bsdi__*/
   1502 			   );
   1503 	}
   1504 	/* finally update cached route in each socket via pfctlinput */
   1505 	{
   1506 		struct sockaddr_in6 sdst;
   1507 
   1508 		bzero(&sdst, sizeof(sdst));
   1509 		sdst.sin6_family = AF_INET6;
   1510 		sdst.sin6_len = sizeof(struct sockaddr_in6);
   1511 		bcopy(&reddst6, &sdst.sin6_addr, sizeof(struct in6_addr));
   1512 		pfctlinput(PRC_REDIRECT_HOST, (struct sockaddr *)&sdst);
   1513 #ifdef IPSEC
   1514 		key_sa_routechange((struct sockaddr *)&sdst);
   1515 #endif
   1516 	}
   1517 }
   1518 
   1519 void
   1520 icmp6_redirect_output(m0, rt)
   1521 	struct mbuf *m0;
   1522 	struct rtentry *rt;
   1523 {
   1524 	struct ifnet *ifp;	/* my outgoing interface */
   1525 	struct in6_addr *ifp_ll6;
   1526 	struct in6_addr *router_ll6;
   1527 	struct ip6_hdr *sip6;	/* m0 as struct ip6_hdr */
   1528 	struct mbuf *m = NULL;	/* newly allocated one */
   1529 	struct ip6_hdr *ip6;	/* m as struct ip6_hdr */
   1530 	struct nd_redirect *nd_rd;
   1531 	size_t maxlen;
   1532 	u_char *p;
   1533 
   1534 	/* if we are not router, we don't send icmp6 redirect */
   1535 	if (!ip6_forwarding || ip6_accept_rtadv)
   1536 		goto fail;
   1537 
   1538 	/* sanity check */
   1539 	if (!m0 || !rt || !(rt->rt_flags & RTF_UP) || !(ifp = rt->rt_ifp))
   1540 		goto fail;
   1541 
   1542 	/*
   1543 	 * Address check:
   1544 	 *  the source address must identify a neighbor, and
   1545 	 *  the destination address must not be a multicast address
   1546 	 *  [RFC 2461, sec 8.2]
   1547 	 */
   1548 	sip6 = mtod(m0, struct ip6_hdr *);
   1549 	if (nd6_is_addr_neighbor(&sip6->ip6_src, ifp) == 0)
   1550 		goto fail;
   1551 	if (IN6_IS_ADDR_MULTICAST(&sip6->ip6_dst))
   1552 		goto fail;	/* what should we do here? */
   1553 
   1554 	/* rate limit */
   1555 	if (icmp6_ratelimit(&sip6->ip6_src, ND_REDIRECT, 0))
   1556 		goto fail;
   1557 
   1558 	/*
   1559 	 * Since we are going to append up to 1280 bytes (= IPV6_MMTU),
   1560 	 * we almost always ask for an mbuf cluster for simplicity.
   1561 	 * (MHLEN < IPV6_MMTU is almost always true)
   1562 	 */
   1563 	MGETHDR(m, M_DONTWAIT, MT_HEADER);
   1564 	if (!m)
   1565 		goto fail;
   1566 	if (MHLEN < IPV6_MMTU)
   1567 		MCLGET(m, M_DONTWAIT);
   1568 	maxlen = (m->m_flags & M_EXT) ? MCLBYTES : MHLEN;
   1569 	maxlen = min(IPV6_MMTU, maxlen);
   1570 	/* just for safety */
   1571 	if (maxlen < sizeof(struct ip6_hdr) + sizeof(struct icmp6_hdr))
   1572 		goto fail;
   1573 
   1574 	{
   1575 		/* get ip6 linklocal address for ifp(my outgoing interface). */
   1576 		struct in6_ifaddr *ia = in6ifa_ifpforlinklocal(ifp);
   1577 		if (ia == NULL)
   1578 			goto fail;
   1579 		ifp_ll6 = &ia->ia_addr.sin6_addr;
   1580 	}
   1581 
   1582 	/* get ip6 linklocal address for the router. */
   1583 	if (rt->rt_gateway && (rt->rt_flags & RTF_GATEWAY)) {
   1584 		struct sockaddr_in6 *sin6;
   1585 		sin6 = (struct sockaddr_in6 *)rt->rt_gateway;
   1586 		router_ll6 = &sin6->sin6_addr;
   1587 		if (!IN6_IS_ADDR_LINKLOCAL(router_ll6))
   1588 			router_ll6 = (struct in6_addr *)NULL;
   1589 	} else
   1590 		router_ll6 = (struct in6_addr *)NULL;
   1591 
   1592 	/* ip6 */
   1593 	ip6 = mtod(m, struct ip6_hdr *);
   1594 	ip6->ip6_flow = 0;
   1595 	ip6->ip6_vfc = IPV6_VERSION;
   1596 	/* ip6->ip6_plen will be set later */
   1597 	ip6->ip6_nxt = IPPROTO_ICMPV6;
   1598 	ip6->ip6_hlim = 255;
   1599 	/* ip6->ip6_src must be linklocal addr for my outgoing if. */
   1600 	bcopy(ifp_ll6, &ip6->ip6_src, sizeof(struct in6_addr));
   1601 	bcopy(&sip6->ip6_src, &ip6->ip6_dst, sizeof(struct in6_addr));
   1602 
   1603 	/* ND Redirect */
   1604 	nd_rd = (struct nd_redirect *)(ip6 + 1);
   1605 	nd_rd->nd_rd_type = ND_REDIRECT;
   1606 	nd_rd->nd_rd_code = 0;
   1607 	nd_rd->nd_rd_reserved = 0;
   1608 	if (rt->rt_flags & RTF_GATEWAY) {
   1609 		/*
   1610 		 * nd_rd->nd_rd_target must be a link-local address in
   1611 		 * better router cases.
   1612 		 */
   1613 		if (!router_ll6)
   1614 			goto fail;
   1615 		bcopy(router_ll6, &nd_rd->nd_rd_target,
   1616 		      sizeof(nd_rd->nd_rd_target));
   1617 		bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_dst,
   1618 		      sizeof(nd_rd->nd_rd_dst));
   1619 	} else {
   1620 		/* make sure redtgt == reddst */
   1621 		bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_target,
   1622 		      sizeof(nd_rd->nd_rd_target));
   1623 		bcopy(&sip6->ip6_dst, &nd_rd->nd_rd_dst,
   1624 		      sizeof(nd_rd->nd_rd_dst));
   1625 	}
   1626 
   1627 	p = (u_char *)(nd_rd + 1);
   1628 
   1629 	if (!router_ll6)
   1630 		goto nolladdropt;
   1631 
   1632     {
   1633 	/* target lladdr option */
   1634 	struct rtentry *rt_router = NULL;
   1635 	int len;
   1636 	struct sockaddr_dl *sdl;
   1637 	struct nd_opt_hdr *nd_opt;
   1638 	char *lladdr;
   1639 
   1640 	rt_router = nd6_lookup(router_ll6, 0, ifp);
   1641 	if (!rt_router)
   1642 		goto nolladdropt;
   1643 	if (!(rt_router->rt_flags & RTF_GATEWAY)
   1644 	 && (rt_router->rt_flags & RTF_LLINFO)
   1645 	 && (rt_router->rt_gateway->sa_family == AF_LINK)
   1646 	 && (sdl = (struct sockaddr_dl *)rt_router->rt_gateway)) {
   1647 		nd_opt = (struct nd_opt_hdr *)p;
   1648 		nd_opt->nd_opt_type = ND_OPT_TARGET_LINKADDR;
   1649 		len = 2 + ifp->if_addrlen;
   1650 		len = (len + 7) & ~7;	/*round by 8*/
   1651 		nd_opt->nd_opt_len = len >> 3;
   1652 		p += len;
   1653 		lladdr = (char *)(nd_opt + 1);
   1654 		bcopy(LLADDR(sdl), lladdr, ifp->if_addrlen);
   1655 	}
   1656     }
   1657 nolladdropt:;
   1658 
   1659 	m->m_pkthdr.len = m->m_len = p - (u_char *)ip6;
   1660 
   1661 	/* just to be safe */
   1662 	if (m0->m_flags & M_DECRYPTED)
   1663 		goto noredhdropt;
   1664 
   1665     {
   1666 	/* redirected header option */
   1667 	int len;
   1668 	struct nd_opt_rd_hdr *nd_opt_rh;
   1669 
   1670 	/*
   1671 	 * compute the maximum size for icmp6 redirect header option.
   1672 	 * XXX room for auth header?
   1673 	 */
   1674 	len = maxlen - (p - (u_char *)ip6);
   1675 	len &= ~7;
   1676 
   1677 	/* This is just for simplicity. */
   1678 	if (m0->m_pkthdr.len != m0->m_len) {
   1679 		if (m0->m_next) {
   1680 			m_freem(m0->m_next);
   1681 			m0->m_next = NULL;
   1682 		}
   1683 		m0->m_pkthdr.len = m0->m_len;
   1684 	}
   1685 
   1686 	/*
   1687 	 * Redirected header option spec (RFC2461 4.6.3) talks nothing
   1688 	 * about padding/trancate rule for the original IP packet.
   1689 	 * From the discussion on IPv6imp in Feb 1999, the consensus was:
   1690 	 * - "attach as much as possible" is the goal
   1691 	 * - pad if not aligned (original size can be guessed by original
   1692 	 *   ip6 header)
   1693 	 * Following code adds the padding if it is simple enough,
   1694 	 * and truncates if not.
   1695 	 */
   1696 	if (m0->m_next || m0->m_pkthdr.len != m0->m_len)
   1697 		panic("assumption failed in %s:%d\n", __FILE__, __LINE__);
   1698 
   1699 	if (len - sizeof(*nd_opt_rh) < m0->m_pkthdr.len) {
   1700 		/* not enough room, truncate */
   1701 		m0->m_pkthdr.len = m0->m_len = len - sizeof(*nd_opt_rh);
   1702 	} else {
   1703 		/* enough room, pad or truncate */
   1704 		size_t extra;
   1705 
   1706 		extra = m0->m_pkthdr.len % 8;
   1707 		if (extra) {
   1708 			/* pad if easy enough, truncate if not */
   1709 			if (8 - extra <= M_TRAILINGSPACE(m0)) {
   1710 				/* pad */
   1711 				m0->m_len += (8 - extra);
   1712 				m0->m_pkthdr.len += (8 - extra);
   1713 			} else {
   1714 				/* truncate */
   1715 				m0->m_pkthdr.len -= extra;
   1716 				m0->m_len -= extra;
   1717 			}
   1718 		}
   1719 		len = m0->m_pkthdr.len + sizeof(*nd_opt_rh);
   1720 		m0->m_pkthdr.len = m0->m_len = len - sizeof(*nd_opt_rh);
   1721 	}
   1722 
   1723 	nd_opt_rh = (struct nd_opt_rd_hdr *)p;
   1724 	bzero(nd_opt_rh, sizeof(*nd_opt_rh));
   1725 	nd_opt_rh->nd_opt_rh_type = ND_OPT_REDIRECTED_HEADER;
   1726 	nd_opt_rh->nd_opt_rh_len = len >> 3;
   1727 	p += sizeof(*nd_opt_rh);
   1728 	m->m_pkthdr.len = m->m_len = p - (u_char *)ip6;
   1729 
   1730 	/* connect m0 to m */
   1731 	m->m_next = m0;
   1732 	m->m_pkthdr.len = m->m_len + m0->m_len;
   1733     }
   1734 noredhdropt:;
   1735 
   1736 	if (IN6_IS_ADDR_LINKLOCAL(&sip6->ip6_src))
   1737 		sip6->ip6_src.s6_addr16[1] = 0;
   1738 	if (IN6_IS_ADDR_LINKLOCAL(&sip6->ip6_dst))
   1739 		sip6->ip6_dst.s6_addr16[1] = 0;
   1740 #if 0
   1741 	if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src))
   1742 		ip6->ip6_src.s6_addr16[1] = 0;
   1743 	if (IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_dst))
   1744 		ip6->ip6_dst.s6_addr16[1] = 0;
   1745 #endif
   1746 	if (IN6_IS_ADDR_LINKLOCAL(&nd_rd->nd_rd_target))
   1747 		nd_rd->nd_rd_target.s6_addr16[1] = 0;
   1748 	if (IN6_IS_ADDR_LINKLOCAL(&nd_rd->nd_rd_dst))
   1749 		nd_rd->nd_rd_dst.s6_addr16[1] = 0;
   1750 
   1751 	ip6->ip6_plen = htons(m->m_pkthdr.len - sizeof(struct ip6_hdr));
   1752 
   1753 	nd_rd->nd_rd_cksum = 0;
   1754 	nd_rd->nd_rd_cksum
   1755 		= in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), ntohs(ip6->ip6_plen));
   1756 
   1757 	/* send the packet to outside... */
   1758 #ifdef IPSEC
   1759 	m->m_pkthdr.rcvif = NULL;
   1760 #endif /*IPSEC*/
   1761 	ip6_output(m, NULL, NULL, 0, NULL);
   1762 	icmp6stat.icp6s_outhist[ND_REDIRECT]++;
   1763 
   1764 	return;
   1765 
   1766 fail:
   1767 	if (m)
   1768 		m_freem(m);
   1769 	if (m0)
   1770 		m_freem(m0);
   1771 }
   1772 
   1773 /*
   1774  * ICMPv6 socket option processing.
   1775  */
   1776 int
   1777 icmp6_ctloutput(op, so, level, optname, mp)
   1778 	int op;
   1779 	struct socket *so;
   1780 	int level, optname;
   1781 	struct mbuf **mp;
   1782 {
   1783 	register struct in6pcb *in6p = sotoin6pcb(so);
   1784 	register struct mbuf *m = *mp;
   1785 	int error = 0;
   1786 
   1787 	if (level != IPPROTO_ICMPV6) {
   1788 		error = EINVAL;
   1789 		if (op == PRCO_SETOPT && m)
   1790 			(void)m_free(m);
   1791 	} else switch(op) {
   1792 	 case PRCO_SETOPT:
   1793 		 switch (optname) {
   1794 		  case ICMP6_FILTER:
   1795 		  {
   1796 			  struct icmp6_filter *p;
   1797 
   1798 			  p = mtod(m, struct icmp6_filter *);
   1799 			  if (!p || !in6p->in6p_icmp6filt) {
   1800 				  error = EINVAL;
   1801 				  break;
   1802 			  }
   1803 			  bcopy(p, in6p->in6p_icmp6filt,
   1804 				sizeof(struct icmp6_filter));
   1805 			  error = 0;
   1806 			  break;
   1807 		  }
   1808 
   1809 		  default:
   1810 			  error = ENOPROTOOPT;
   1811 			  break;
   1812 		 }
   1813 		 if (m)
   1814 			 (void)m_free(m);
   1815 		 break;
   1816 
   1817 	 case PRCO_GETOPT:
   1818 		 switch (optname) {
   1819 		  case ICMP6_FILTER:
   1820 		  {
   1821 			  struct icmp6_filter *p;
   1822 
   1823 			  p = mtod(m, struct icmp6_filter *);
   1824 			  if (!p || !in6p->in6p_icmp6filt) {
   1825 				  error = EINVAL;
   1826 				  break;
   1827 			  }
   1828 			  bcopy(in6p->in6p_icmp6filt, p,
   1829 				sizeof(struct icmp6_filter));
   1830 			  error = 0;
   1831 			  break;
   1832 		  }
   1833 
   1834 		  default:
   1835 			  error = ENOPROTOOPT;
   1836 			  break;
   1837 		 }
   1838 		 break;
   1839 	}
   1840 
   1841 	return(error);
   1842 }
   1843 
   1844 /*
   1845  * Perform rate limit check.
   1846  * Returns 0 if it is okay to send the icmp6 packet.
   1847  * Returns 1 if the router SHOULD NOT send this icmp6 packet due to rate
   1848  * limitation.
   1849  *
   1850  * XXX per-destination/type check necessary?
   1851  */
   1852 static int
   1853 icmp6_ratelimit(dst, type, code)
   1854 	const struct in6_addr *dst;	/* not used at this moment */
   1855 	const int type;			/* not used at this moment */
   1856 	const int code;			/* not used at this moment */
   1857 {
   1858 	struct timeval tp;
   1859 	long sec_diff, usec_diff;
   1860 
   1861 	/* If we are not doing rate limitation, it is always okay to send */
   1862 	if (!icmp6errratelim)
   1863 		return 0;
   1864 
   1865 #if defined(__FreeBSD__) && __FreeBSD__ >= 3
   1866 	microtime(&tp);
   1867 	tp.tv_sec = time_second;
   1868 #else
   1869 	tp = time;
   1870 #endif
   1871 	if (tp.tv_sec < icmp6_nextsend.tv_sec
   1872 	 || (tp.tv_sec == icmp6_nextsend.tv_sec
   1873 	  && tp.tv_usec < icmp6_nextsend.tv_usec)) {
   1874 		/* The packet is subject to rate limit */
   1875 		return 1;
   1876 	}
   1877 	sec_diff = icmp6errratelim / 1000000;
   1878 	usec_diff = icmp6errratelim % 1000000;
   1879 	icmp6_nextsend.tv_sec = tp.tv_sec + sec_diff;
   1880 	if ((tp.tv_usec = tp.tv_usec + usec_diff) >= 1000000) {
   1881 		icmp6_nextsend.tv_sec++;
   1882 		icmp6_nextsend.tv_usec -= 1000000;
   1883 	}
   1884 
   1885 	/* it is okay to send this */
   1886 	return 0;
   1887 }
   1888 
   1889 #ifdef __NetBSD__
   1890 static struct rtentry *
   1891 icmp6_mtudisc_clone(dst)
   1892 	struct sockaddr *dst;
   1893 {
   1894 	struct rtentry *rt;
   1895 	int    error;
   1896 
   1897 	rt = rtalloc1(dst, 1);
   1898 	if (rt == 0)
   1899 		return NULL;
   1900 
   1901 	/* If we didn't get a host route, allocate one */
   1902 	if ((rt->rt_flags & RTF_HOST) == 0) {
   1903 		struct rtentry *nrt;
   1904 
   1905 		error = rtrequest((int) RTM_ADD, dst,
   1906 		    (struct sockaddr *) rt->rt_gateway,
   1907 		    (struct sockaddr *) 0,
   1908 		    RTF_GATEWAY | RTF_HOST | RTF_DYNAMIC, &nrt);
   1909 		if (error) {
   1910 			rtfree(rt);
   1911 			rtfree(nrt);
   1912 			return NULL;
   1913 		}
   1914 		nrt->rt_rmx = rt->rt_rmx;
   1915 		rtfree(rt);
   1916 		rt = nrt;
   1917 	}
   1918 	error = rt_timer_add(rt, icmp6_mtudisc_timeout,
   1919 			icmp6_mtudisc_timeout_q);
   1920 	if (error) {
   1921 		rtfree(rt);
   1922 		return NULL;
   1923 	}
   1924 
   1925 	return rt;	/* caller need to call rtfree() */
   1926 }
   1927 
   1928 static void
   1929 icmp6_mtudisc_timeout(rt, r)
   1930 	struct rtentry *rt;
   1931 	struct rttimer *r;
   1932 {
   1933 	if (rt == NULL)
   1934 		panic("icmp6_mtudisc_timeout: bad route to timeout");
   1935 	if ((rt->rt_flags & (RTF_DYNAMIC | RTF_HOST)) ==
   1936 	    (RTF_DYNAMIC | RTF_HOST)) {
   1937 		rtrequest((int) RTM_DELETE, (struct sockaddr *)rt_key(rt),
   1938 		    rt->rt_gateway, rt_mask(rt), rt->rt_flags, 0);
   1939 	} else {
   1940 		if ((rt->rt_rmx.rmx_locks & RTV_MTU) == 0) {
   1941 			rt->rt_rmx.rmx_mtu = 0;
   1942 		}
   1943 	}
   1944 }
   1945 #endif /*__NetBSD__*/
   1946 
   1947 #ifdef __bsdi__
   1948 void
   1949 icmp6_mtuexpire(rt, rtt)
   1950 	struct rtentry *rt;
   1951 	struct rttimer *rtt;
   1952 {
   1953 	rt->rt_flags |= RTF_PROBEMTU;
   1954 	Free(rtt);
   1955 }
   1956 
   1957 int *icmp6_sysvars[] = ICMPV6CTL_VARS;
   1958 
   1959 int
   1960 icmp6_sysctl(name, namelen, oldp, oldlenp, newp, newlen)
   1961 	int *name;
   1962 	u_int namelen;
   1963 	void *oldp;
   1964 	size_t *oldlenp;
   1965 	void *newp;
   1966 	size_t newlen;
   1967 {
   1968 	if (name[0] >= ICMPV6CTL_MAXID)
   1969 		return (EOPNOTSUPP);
   1970 	switch (name[0]) {
   1971 #if 0
   1972 	ICMPV6CTL_ND6_PRUNE:
   1973 	ICMPV6CTL_ND6_DELAY:
   1974 	ICMPV6CTL_ND6_UMAXTRIES:
   1975 	ICMPV6CTL_ND6_MMAXTRIES:
   1976 	ICMPV6CTL_ND6_USELOOPBACK:
   1977 	ICMPV6CTL_ND6_PROXYALL:
   1978 		/* need to check the value. */
   1979 #endif
   1980 	case ICMPV6CTL_STATS:
   1981 		return sysctl_rdtrunc(oldp, oldlenp, newp, &icmp6stat,
   1982 		    sizeof(icmp6stat));
   1983 
   1984 	default:
   1985 		return (sysctl_int_arr(icmp6_sysvars, name, namelen,
   1986 		    oldp, oldlenp, newp, newlen));
   1987 	}
   1988 }
   1989 #endif /*__bsdi__*/
   1990 
   1991 #ifdef __NetBSD__
   1992 #include <vm/vm.h>
   1993 #include <sys/sysctl.h>
   1994 int
   1995 icmp6_sysctl(name, namelen, oldp, oldlenp, newp, newlen)
   1996 	int *name;
   1997 	u_int namelen;
   1998 	void *oldp;
   1999 	size_t *oldlenp;
   2000 	void *newp;
   2001 	size_t newlen;
   2002 {
   2003 
   2004 	/* All sysctl names at this level are terminal. */
   2005 	if (namelen != 1)
   2006 		return ENOTDIR;
   2007 
   2008 	switch (name[0]) {
   2009 
   2010 	case ICMPV6CTL_REDIRACCEPT:
   2011 		return sysctl_int(oldp, oldlenp, newp, newlen,
   2012 				&icmp6_rediraccept);
   2013 	case ICMPV6CTL_REDIRTIMEOUT:
   2014 		return sysctl_int(oldp, oldlenp, newp, newlen,
   2015 				&icmp6_redirtimeout);
   2016 	case ICMPV6CTL_STATS:
   2017 		return sysctl_rdstruct(oldp, oldlenp, newp,
   2018 				&icmp6stat, sizeof(icmp6stat));
   2019 	case ICMPV6CTL_ERRRATELIMIT:
   2020 		return sysctl_int(oldp, oldlenp, newp, newlen,
   2021 				  &icmp6errratelim);
   2022 	case ICMPV6CTL_ND6_PRUNE:
   2023 		return sysctl_int(oldp, oldlenp, newp, newlen, &nd6_prune);
   2024 	case ICMPV6CTL_ND6_DELAY:
   2025 		return sysctl_int(oldp, oldlenp, newp, newlen, &nd6_delay);
   2026 	case ICMPV6CTL_ND6_UMAXTRIES:
   2027 		return sysctl_int(oldp, oldlenp, newp, newlen, &nd6_umaxtries);
   2028 	case ICMPV6CTL_ND6_MMAXTRIES:
   2029 		return sysctl_int(oldp, oldlenp, newp, newlen, &nd6_mmaxtries);
   2030 	case ICMPV6CTL_ND6_USELOOPBACK:
   2031 		return sysctl_int(oldp, oldlenp, newp, newlen,
   2032 				&nd6_useloopback);
   2033 	case ICMPV6CTL_ND6_PROXYALL:
   2034 		return sysctl_int(oldp, oldlenp, newp, newlen, &nd6_proxyall);
   2035 	default:
   2036 		return ENOPROTOOPT;
   2037 	}
   2038 	/* NOTREACHED */
   2039 }
   2040 #endif /* __NetBSD__ */
   2041