ip6_output.c revision 1.170 1 /* $NetBSD: ip6_output.c,v 1.170 2016/06/21 10:25:27 ozaki-r Exp $ */
2 /* $KAME: ip6_output.c,v 1.172 2001/03/25 09:55:56 itojun Exp $ */
3
4 /*
5 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
6 * All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the project nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 */
32
33 /*
34 * Copyright (c) 1982, 1986, 1988, 1990, 1993
35 * The Regents of the University of California. All rights reserved.
36 *
37 * Redistribution and use in source and binary forms, with or without
38 * modification, are permitted provided that the following conditions
39 * are met:
40 * 1. Redistributions of source code must retain the above copyright
41 * notice, this list of conditions and the following disclaimer.
42 * 2. Redistributions in binary form must reproduce the above copyright
43 * notice, this list of conditions and the following disclaimer in the
44 * documentation and/or other materials provided with the distribution.
45 * 3. Neither the name of the University nor the names of its contributors
46 * may be used to endorse or promote products derived from this software
47 * without specific prior written permission.
48 *
49 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
50 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
51 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
52 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
53 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
54 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
55 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
56 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
57 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
58 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
59 * SUCH DAMAGE.
60 *
61 * @(#)ip_output.c 8.3 (Berkeley) 1/21/94
62 */
63
64 #include <sys/cdefs.h>
65 __KERNEL_RCSID(0, "$NetBSD: ip6_output.c,v 1.170 2016/06/21 10:25:27 ozaki-r Exp $");
66
67 #ifdef _KERNEL_OPT
68 #include "opt_inet.h"
69 #include "opt_inet6.h"
70 #include "opt_ipsec.h"
71 #endif
72
73 #include <sys/param.h>
74 #include <sys/malloc.h>
75 #include <sys/mbuf.h>
76 #include <sys/errno.h>
77 #include <sys/protosw.h>
78 #include <sys/socket.h>
79 #include <sys/socketvar.h>
80 #include <sys/systm.h>
81 #include <sys/proc.h>
82 #include <sys/kauth.h>
83
84 #include <net/if.h>
85 #include <net/route.h>
86 #include <net/pfil.h>
87
88 #include <netinet/in.h>
89 #include <netinet/in_var.h>
90 #include <netinet/ip6.h>
91 #include <netinet/ip_var.h>
92 #include <netinet/icmp6.h>
93 #include <netinet/in_offload.h>
94 #include <netinet/portalgo.h>
95 #include <netinet6/in6_offload.h>
96 #include <netinet6/ip6_var.h>
97 #include <netinet6/ip6_private.h>
98 #include <netinet6/in6_pcb.h>
99 #include <netinet6/nd6.h>
100 #include <netinet6/ip6protosw.h>
101 #include <netinet6/scope6_var.h>
102
103 #ifdef IPSEC
104 #include <netipsec/ipsec.h>
105 #include <netipsec/ipsec6.h>
106 #include <netipsec/key.h>
107 #include <netipsec/xform.h>
108 #endif
109
110
111 #include <net/net_osdep.h>
112
113 extern pfil_head_t *inet6_pfil_hook; /* XXX */
114
115 struct ip6_exthdrs {
116 struct mbuf *ip6e_ip6;
117 struct mbuf *ip6e_hbh;
118 struct mbuf *ip6e_dest1;
119 struct mbuf *ip6e_rthdr;
120 struct mbuf *ip6e_dest2;
121 };
122
123 static int ip6_pcbopt(int, u_char *, int, struct ip6_pktopts **,
124 kauth_cred_t, int);
125 static int ip6_getpcbopt(struct ip6_pktopts *, int, struct sockopt *);
126 static int ip6_setpktopt(int, u_char *, int, struct ip6_pktopts *, kauth_cred_t,
127 int, int, int);
128 static int ip6_setmoptions(const struct sockopt *, struct in6pcb *);
129 static int ip6_getmoptions(struct sockopt *, struct in6pcb *);
130 static int ip6_copyexthdr(struct mbuf **, void *, int);
131 static int ip6_insertfraghdr(struct mbuf *, struct mbuf *, int,
132 struct ip6_frag **);
133 static int ip6_insert_jumboopt(struct ip6_exthdrs *, u_int32_t);
134 static int ip6_splithdr(struct mbuf *, struct ip6_exthdrs *);
135 static int ip6_getpmtu(struct route *, struct route *, struct ifnet *,
136 const struct in6_addr *, u_long *, int *);
137 static int copypktopts(struct ip6_pktopts *, struct ip6_pktopts *, int);
138
139 #ifdef RFC2292
140 static int ip6_pcbopts(struct ip6_pktopts **, struct socket *, struct sockopt *);
141 #endif
142
143 /*
144 * IP6 output. The packet in mbuf chain m contains a skeletal IP6
145 * header (with pri, len, nxt, hlim, src, dst).
146 * This function may modify ver and hlim only.
147 * The mbuf chain containing the packet will be freed.
148 * The mbuf opt, if present, will not be freed.
149 *
150 * type of "mtu": rt_rmx.rmx_mtu is u_long, ifnet.ifr_mtu is int, and
151 * nd_ifinfo.linkmtu is u_int32_t. so we use u_long to hold largest one,
152 * which is rt_rmx.rmx_mtu.
153 */
154 int
155 ip6_output(
156 struct mbuf *m0,
157 struct ip6_pktopts *opt,
158 struct route *ro,
159 int flags,
160 struct ip6_moptions *im6o,
161 struct socket *so,
162 struct ifnet **ifpp /* XXX: just for statistics */
163 )
164 {
165 struct ip6_hdr *ip6, *mhip6;
166 struct ifnet *ifp, *origifp = NULL;
167 struct mbuf *m = m0;
168 int hlen, tlen, len, off;
169 bool tso;
170 struct route ip6route;
171 struct rtentry *rt = NULL;
172 const struct sockaddr_in6 *dst;
173 struct sockaddr_in6 src_sa, dst_sa;
174 int error = 0;
175 struct in6_ifaddr *ia = NULL;
176 u_long mtu;
177 int alwaysfrag, dontfrag;
178 u_int32_t optlen = 0, plen = 0, unfragpartlen = 0;
179 struct ip6_exthdrs exthdrs;
180 struct in6_addr finaldst, src0, dst0;
181 u_int32_t zone;
182 struct route *ro_pmtu = NULL;
183 int hdrsplit = 0;
184 int needipsec = 0;
185 #ifdef IPSEC
186 struct secpolicy *sp = NULL;
187 #endif
188 struct psref psref, psref_ia;
189 int bound = curlwp_bind();
190 bool release_psref_ia = false;
191
192 memset(&ip6route, 0, sizeof(ip6route));
193
194 #ifdef DIAGNOSTIC
195 if ((m->m_flags & M_PKTHDR) == 0)
196 panic("ip6_output: no HDR");
197
198 if ((m->m_pkthdr.csum_flags &
199 (M_CSUM_TCPv4|M_CSUM_UDPv4|M_CSUM_TSOv4)) != 0) {
200 panic("ip6_output: IPv4 checksum offload flags: %d",
201 m->m_pkthdr.csum_flags);
202 }
203
204 if ((m->m_pkthdr.csum_flags & (M_CSUM_TCPv6|M_CSUM_UDPv6)) ==
205 (M_CSUM_TCPv6|M_CSUM_UDPv6)) {
206 panic("ip6_output: conflicting checksum offload flags: %d",
207 m->m_pkthdr.csum_flags);
208 }
209 #endif
210
211 M_CSUM_DATA_IPv6_HL_SET(m->m_pkthdr.csum_data, sizeof(struct ip6_hdr));
212
213 #define MAKE_EXTHDR(hp, mp) \
214 do { \
215 if (hp) { \
216 struct ip6_ext *eh = (struct ip6_ext *)(hp); \
217 error = ip6_copyexthdr((mp), (void *)(hp), \
218 ((eh)->ip6e_len + 1) << 3); \
219 if (error) \
220 goto freehdrs; \
221 } \
222 } while (/*CONSTCOND*/ 0)
223
224 memset(&exthdrs, 0, sizeof(exthdrs));
225 if (opt) {
226 /* Hop-by-Hop options header */
227 MAKE_EXTHDR(opt->ip6po_hbh, &exthdrs.ip6e_hbh);
228 /* Destination options header(1st part) */
229 MAKE_EXTHDR(opt->ip6po_dest1, &exthdrs.ip6e_dest1);
230 /* Routing header */
231 MAKE_EXTHDR(opt->ip6po_rthdr, &exthdrs.ip6e_rthdr);
232 /* Destination options header(2nd part) */
233 MAKE_EXTHDR(opt->ip6po_dest2, &exthdrs.ip6e_dest2);
234 }
235
236 /*
237 * Calculate the total length of the extension header chain.
238 * Keep the length of the unfragmentable part for fragmentation.
239 */
240 optlen = 0;
241 if (exthdrs.ip6e_hbh) optlen += exthdrs.ip6e_hbh->m_len;
242 if (exthdrs.ip6e_dest1) optlen += exthdrs.ip6e_dest1->m_len;
243 if (exthdrs.ip6e_rthdr) optlen += exthdrs.ip6e_rthdr->m_len;
244 unfragpartlen = optlen + sizeof(struct ip6_hdr);
245 /* NOTE: we don't add AH/ESP length here. do that later. */
246 if (exthdrs.ip6e_dest2) optlen += exthdrs.ip6e_dest2->m_len;
247
248 #ifdef IPSEC
249 if (ipsec_used) {
250 /* Check the security policy (SP) for the packet */
251
252 sp = ipsec6_check_policy(m, so, flags, &needipsec, &error);
253 if (error != 0) {
254 /*
255 * Hack: -EINVAL is used to signal that a packet
256 * should be silently discarded. This is typically
257 * because we asked key management for an SA and
258 * it was delayed (e.g. kicked up to IKE).
259 */
260 if (error == -EINVAL)
261 error = 0;
262 goto freehdrs;
263 }
264 }
265 #endif /* IPSEC */
266
267
268 if (needipsec &&
269 (m->m_pkthdr.csum_flags & (M_CSUM_UDPv6|M_CSUM_TCPv6)) != 0) {
270 in6_delayed_cksum(m);
271 m->m_pkthdr.csum_flags &= ~(M_CSUM_UDPv6|M_CSUM_TCPv6);
272 }
273
274
275 /*
276 * If we need IPsec, or there is at least one extension header,
277 * separate IP6 header from the payload.
278 */
279 if ((needipsec || optlen) && !hdrsplit) {
280 if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
281 m = NULL;
282 goto freehdrs;
283 }
284 m = exthdrs.ip6e_ip6;
285 hdrsplit++;
286 }
287
288 /* adjust pointer */
289 ip6 = mtod(m, struct ip6_hdr *);
290
291 /* adjust mbuf packet header length */
292 m->m_pkthdr.len += optlen;
293 plen = m->m_pkthdr.len - sizeof(*ip6);
294
295 /* If this is a jumbo payload, insert a jumbo payload option. */
296 if (plen > IPV6_MAXPACKET) {
297 if (!hdrsplit) {
298 if ((error = ip6_splithdr(m, &exthdrs)) != 0) {
299 m = NULL;
300 goto freehdrs;
301 }
302 m = exthdrs.ip6e_ip6;
303 hdrsplit++;
304 }
305 /* adjust pointer */
306 ip6 = mtod(m, struct ip6_hdr *);
307 if ((error = ip6_insert_jumboopt(&exthdrs, plen)) != 0)
308 goto freehdrs;
309 optlen += 8; /* XXX JUMBOOPTLEN */
310 ip6->ip6_plen = 0;
311 } else
312 ip6->ip6_plen = htons(plen);
313
314 /*
315 * Concatenate headers and fill in next header fields.
316 * Here we have, on "m"
317 * IPv6 payload
318 * and we insert headers accordingly. Finally, we should be getting:
319 * IPv6 hbh dest1 rthdr ah* [esp* dest2 payload]
320 *
321 * during the header composing process, "m" points to IPv6 header.
322 * "mprev" points to an extension header prior to esp.
323 */
324 {
325 u_char *nexthdrp = &ip6->ip6_nxt;
326 struct mbuf *mprev = m;
327
328 /*
329 * we treat dest2 specially. this makes IPsec processing
330 * much easier. the goal here is to make mprev point the
331 * mbuf prior to dest2.
332 *
333 * result: IPv6 dest2 payload
334 * m and mprev will point to IPv6 header.
335 */
336 if (exthdrs.ip6e_dest2) {
337 if (!hdrsplit)
338 panic("assumption failed: hdr not split");
339 exthdrs.ip6e_dest2->m_next = m->m_next;
340 m->m_next = exthdrs.ip6e_dest2;
341 *mtod(exthdrs.ip6e_dest2, u_char *) = ip6->ip6_nxt;
342 ip6->ip6_nxt = IPPROTO_DSTOPTS;
343 }
344
345 #define MAKE_CHAIN(m, mp, p, i)\
346 do {\
347 if (m) {\
348 if (!hdrsplit) \
349 panic("assumption failed: hdr not split"); \
350 *mtod((m), u_char *) = *(p);\
351 *(p) = (i);\
352 p = mtod((m), u_char *);\
353 (m)->m_next = (mp)->m_next;\
354 (mp)->m_next = (m);\
355 (mp) = (m);\
356 }\
357 } while (/*CONSTCOND*/ 0)
358 /*
359 * result: IPv6 hbh dest1 rthdr dest2 payload
360 * m will point to IPv6 header. mprev will point to the
361 * extension header prior to dest2 (rthdr in the above case).
362 */
363 MAKE_CHAIN(exthdrs.ip6e_hbh, mprev, nexthdrp, IPPROTO_HOPOPTS);
364 MAKE_CHAIN(exthdrs.ip6e_dest1, mprev, nexthdrp,
365 IPPROTO_DSTOPTS);
366 MAKE_CHAIN(exthdrs.ip6e_rthdr, mprev, nexthdrp,
367 IPPROTO_ROUTING);
368
369 M_CSUM_DATA_IPv6_HL_SET(m->m_pkthdr.csum_data,
370 sizeof(struct ip6_hdr) + optlen);
371 }
372
373 /*
374 * If there is a routing header, replace destination address field
375 * with the first hop of the routing header.
376 */
377 if (exthdrs.ip6e_rthdr) {
378 struct ip6_rthdr *rh;
379 struct ip6_rthdr0 *rh0;
380 struct in6_addr *addr;
381 struct sockaddr_in6 sa;
382
383 rh = (struct ip6_rthdr *)(mtod(exthdrs.ip6e_rthdr,
384 struct ip6_rthdr *));
385 finaldst = ip6->ip6_dst;
386 switch (rh->ip6r_type) {
387 case IPV6_RTHDR_TYPE_0:
388 rh0 = (struct ip6_rthdr0 *)rh;
389 addr = (struct in6_addr *)(rh0 + 1);
390
391 /*
392 * construct a sockaddr_in6 form of
393 * the first hop.
394 *
395 * XXX: we may not have enough
396 * information about its scope zone;
397 * there is no standard API to pass
398 * the information from the
399 * application.
400 */
401 sockaddr_in6_init(&sa, addr, 0, 0, 0);
402 if ((error = sa6_embedscope(&sa,
403 ip6_use_defzone)) != 0) {
404 goto bad;
405 }
406 ip6->ip6_dst = sa.sin6_addr;
407 (void)memmove(&addr[0], &addr[1],
408 sizeof(struct in6_addr) *
409 (rh0->ip6r0_segleft - 1));
410 addr[rh0->ip6r0_segleft - 1] = finaldst;
411 /* XXX */
412 in6_clearscope(addr + rh0->ip6r0_segleft - 1);
413 break;
414 default: /* is it possible? */
415 error = EINVAL;
416 goto bad;
417 }
418 }
419
420 /* Source address validation */
421 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src) &&
422 (flags & IPV6_UNSPECSRC) == 0) {
423 error = EOPNOTSUPP;
424 IP6_STATINC(IP6_STAT_BADSCOPE);
425 goto bad;
426 }
427 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) {
428 error = EOPNOTSUPP;
429 IP6_STATINC(IP6_STAT_BADSCOPE);
430 goto bad;
431 }
432
433 IP6_STATINC(IP6_STAT_LOCALOUT);
434
435 /*
436 * Route packet.
437 */
438 /* initialize cached route */
439 if (ro == NULL) {
440 ro = &ip6route;
441 }
442 ro_pmtu = ro;
443 if (opt && opt->ip6po_rthdr)
444 ro = &opt->ip6po_route;
445
446 /*
447 * if specified, try to fill in the traffic class field.
448 * do not override if a non-zero value is already set.
449 * we check the diffserv field and the ecn field separately.
450 */
451 if (opt && opt->ip6po_tclass >= 0) {
452 int mask = 0;
453
454 if ((ip6->ip6_flow & htonl(0xfc << 20)) == 0)
455 mask |= 0xfc;
456 if ((ip6->ip6_flow & htonl(0x03 << 20)) == 0)
457 mask |= 0x03;
458 if (mask != 0)
459 ip6->ip6_flow |= htonl((opt->ip6po_tclass & mask) << 20);
460 }
461
462 /* fill in or override the hop limit field, if necessary. */
463 if (opt && opt->ip6po_hlim != -1)
464 ip6->ip6_hlim = opt->ip6po_hlim & 0xff;
465 else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
466 if (im6o != NULL)
467 ip6->ip6_hlim = im6o->im6o_multicast_hlim;
468 else
469 ip6->ip6_hlim = ip6_defmcasthlim;
470 }
471
472 #ifdef IPSEC
473 if (needipsec) {
474 int s = splsoftnet();
475 error = ipsec6_process_packet(m, sp->req);
476
477 /*
478 * Preserve KAME behaviour: ENOENT can be returned
479 * when an SA acquire is in progress. Don't propagate
480 * this to user-level; it confuses applications.
481 * XXX this will go away when the SADB is redone.
482 */
483 if (error == ENOENT)
484 error = 0;
485 splx(s);
486 goto done;
487 }
488 #endif /* IPSEC */
489
490 /* adjust pointer */
491 ip6 = mtod(m, struct ip6_hdr *);
492
493 sockaddr_in6_init(&dst_sa, &ip6->ip6_dst, 0, 0, 0);
494 ifp = NULL;
495 if ((error = in6_selectroute(&dst_sa, opt, im6o, ro,
496 &ifp, &psref, &rt, 0)) != 0) {
497 if (ifp != NULL)
498 in6_ifstat_inc(ifp, ifs6_out_discard);
499 goto bad;
500 }
501 if (rt == NULL) {
502 /*
503 * If in6_selectroute() does not return a route entry,
504 * dst may not have been updated.
505 */
506 error = rtcache_setdst(ro, sin6tosa(&dst_sa));
507 if (error) {
508 goto bad;
509 }
510 }
511
512 /*
513 * then rt (for unicast) and ifp must be non-NULL valid values.
514 */
515 if ((flags & IPV6_FORWARDING) == 0) {
516 /* XXX: the FORWARDING flag can be set for mrouting. */
517 in6_ifstat_inc(ifp, ifs6_out_request);
518 }
519 if (rt != NULL) {
520 ia = (struct in6_ifaddr *)(rt->rt_ifa);
521 rt->rt_use++;
522 }
523
524 /*
525 * The outgoing interface must be in the zone of source and
526 * destination addresses. We should use ia_ifp to support the
527 * case of sending packets to an address of our own.
528 */
529 if (ia != NULL && ia->ia_ifp) {
530 origifp = ia->ia_ifp;
531 if_acquire_NOMPSAFE(origifp, &psref_ia);
532 release_psref_ia = true;
533 } else
534 origifp = ifp;
535
536 src0 = ip6->ip6_src;
537 if (in6_setscope(&src0, origifp, &zone))
538 goto badscope;
539 sockaddr_in6_init(&src_sa, &ip6->ip6_src, 0, 0, 0);
540 if (sa6_recoverscope(&src_sa) || zone != src_sa.sin6_scope_id)
541 goto badscope;
542
543 dst0 = ip6->ip6_dst;
544 if (in6_setscope(&dst0, origifp, &zone))
545 goto badscope;
546 /* re-initialize to be sure */
547 sockaddr_in6_init(&dst_sa, &ip6->ip6_dst, 0, 0, 0);
548 if (sa6_recoverscope(&dst_sa) || zone != dst_sa.sin6_scope_id)
549 goto badscope;
550
551 /* scope check is done. */
552
553 if (rt == NULL || IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
554 dst = satocsin6(rtcache_getdst(ro));
555 KASSERT(dst != NULL);
556 } else if (opt && rtcache_validate(&opt->ip6po_nextroute) != NULL) {
557 /*
558 * The nexthop is explicitly specified by the
559 * application. We assume the next hop is an IPv6
560 * address.
561 */
562 dst = (struct sockaddr_in6 *)opt->ip6po_nexthop;
563 } else if ((rt->rt_flags & RTF_GATEWAY))
564 dst = (struct sockaddr_in6 *)rt->rt_gateway;
565 else
566 dst = satocsin6(rtcache_getdst(ro));
567
568 /*
569 * XXXXXX: original code follows:
570 */
571 if (!IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
572 m->m_flags &= ~(M_BCAST | M_MCAST); /* just in case */
573 else {
574 struct in6_multi *in6m;
575
576 m->m_flags = (m->m_flags & ~M_BCAST) | M_MCAST;
577
578 in6_ifstat_inc(ifp, ifs6_out_mcast);
579
580 /*
581 * Confirm that the outgoing interface supports multicast.
582 */
583 if (!(ifp->if_flags & IFF_MULTICAST)) {
584 IP6_STATINC(IP6_STAT_NOROUTE);
585 in6_ifstat_inc(ifp, ifs6_out_discard);
586 error = ENETUNREACH;
587 goto bad;
588 }
589
590 IN6_LOOKUP_MULTI(ip6->ip6_dst, ifp, in6m);
591 if (in6m != NULL &&
592 (im6o == NULL || im6o->im6o_multicast_loop)) {
593 /*
594 * If we belong to the destination multicast group
595 * on the outgoing interface, and the caller did not
596 * forbid loopback, loop back a copy.
597 */
598 KASSERT(dst != NULL);
599 ip6_mloopback(ifp, m, dst);
600 } else {
601 /*
602 * If we are acting as a multicast router, perform
603 * multicast forwarding as if the packet had just
604 * arrived on the interface to which we are about
605 * to send. The multicast forwarding function
606 * recursively calls this function, using the
607 * IPV6_FORWARDING flag to prevent infinite recursion.
608 *
609 * Multicasts that are looped back by ip6_mloopback(),
610 * above, will be forwarded by the ip6_input() routine,
611 * if necessary.
612 */
613 if (ip6_mrouter && (flags & IPV6_FORWARDING) == 0) {
614 if (ip6_mforward(ip6, ifp, m) != 0) {
615 m_freem(m);
616 goto done;
617 }
618 }
619 }
620 /*
621 * Multicasts with a hoplimit of zero may be looped back,
622 * above, but must not be transmitted on a network.
623 * Also, multicasts addressed to the loopback interface
624 * are not sent -- the above call to ip6_mloopback() will
625 * loop back a copy if this host actually belongs to the
626 * destination group on the loopback interface.
627 */
628 if (ip6->ip6_hlim == 0 || (ifp->if_flags & IFF_LOOPBACK) ||
629 IN6_IS_ADDR_MC_INTFACELOCAL(&ip6->ip6_dst)) {
630 m_freem(m);
631 goto done;
632 }
633 }
634
635 /*
636 * Fill the outgoing inteface to tell the upper layer
637 * to increment per-interface statistics.
638 */
639 if (ifpp)
640 *ifpp = ifp;
641
642 /* Determine path MTU. */
643 if ((error = ip6_getpmtu(ro_pmtu, ro, ifp, &finaldst, &mtu,
644 &alwaysfrag)) != 0)
645 goto bad;
646
647 /*
648 * The caller of this function may specify to use the minimum MTU
649 * in some cases.
650 * An advanced API option (IPV6_USE_MIN_MTU) can also override MTU
651 * setting. The logic is a bit complicated; by default, unicast
652 * packets will follow path MTU while multicast packets will be sent at
653 * the minimum MTU. If IP6PO_MINMTU_ALL is specified, all packets
654 * including unicast ones will be sent at the minimum MTU. Multicast
655 * packets will always be sent at the minimum MTU unless
656 * IP6PO_MINMTU_DISABLE is explicitly specified.
657 * See RFC 3542 for more details.
658 */
659 if (mtu > IPV6_MMTU) {
660 if ((flags & IPV6_MINMTU))
661 mtu = IPV6_MMTU;
662 else if (opt && opt->ip6po_minmtu == IP6PO_MINMTU_ALL)
663 mtu = IPV6_MMTU;
664 else if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) &&
665 (opt == NULL ||
666 opt->ip6po_minmtu != IP6PO_MINMTU_DISABLE)) {
667 mtu = IPV6_MMTU;
668 }
669 }
670
671 /*
672 * clear embedded scope identifiers if necessary.
673 * in6_clearscope will touch the addresses only when necessary.
674 */
675 in6_clearscope(&ip6->ip6_src);
676 in6_clearscope(&ip6->ip6_dst);
677
678 /*
679 * If the outgoing packet contains a hop-by-hop options header,
680 * it must be examined and processed even by the source node.
681 * (RFC 2460, section 4.)
682 */
683 if (ip6->ip6_nxt == IPV6_HOPOPTS) {
684 u_int32_t dummy1; /* XXX unused */
685 u_int32_t dummy2; /* XXX unused */
686 int hoff = sizeof(struct ip6_hdr);
687
688 if (ip6_hopopts_input(&dummy1, &dummy2, &m, &hoff)) {
689 /* m was already freed at this point */
690 error = EINVAL;/* better error? */
691 goto done;
692 }
693
694 ip6 = mtod(m, struct ip6_hdr *);
695 }
696
697 /*
698 * Run through list of hooks for output packets.
699 */
700 if ((error = pfil_run_hooks(inet6_pfil_hook, &m, ifp, PFIL_OUT)) != 0)
701 goto done;
702 if (m == NULL)
703 goto done;
704 ip6 = mtod(m, struct ip6_hdr *);
705
706 /*
707 * Send the packet to the outgoing interface.
708 * If necessary, do IPv6 fragmentation before sending.
709 *
710 * the logic here is rather complex:
711 * 1: normal case (dontfrag == 0, alwaysfrag == 0)
712 * 1-a: send as is if tlen <= path mtu
713 * 1-b: fragment if tlen > path mtu
714 *
715 * 2: if user asks us not to fragment (dontfrag == 1)
716 * 2-a: send as is if tlen <= interface mtu
717 * 2-b: error if tlen > interface mtu
718 *
719 * 3: if we always need to attach fragment header (alwaysfrag == 1)
720 * always fragment
721 *
722 * 4: if dontfrag == 1 && alwaysfrag == 1
723 * error, as we cannot handle this conflicting request
724 */
725 tlen = m->m_pkthdr.len;
726 tso = (m->m_pkthdr.csum_flags & M_CSUM_TSOv6) != 0;
727 if (opt && (opt->ip6po_flags & IP6PO_DONTFRAG))
728 dontfrag = 1;
729 else
730 dontfrag = 0;
731
732 if (dontfrag && alwaysfrag) { /* case 4 */
733 /* conflicting request - can't transmit */
734 error = EMSGSIZE;
735 goto bad;
736 }
737 if (dontfrag && (!tso && tlen > IN6_LINKMTU(ifp))) { /* case 2-b */
738 /*
739 * Even if the DONTFRAG option is specified, we cannot send the
740 * packet when the data length is larger than the MTU of the
741 * outgoing interface.
742 * Notify the error by sending IPV6_PATHMTU ancillary data as
743 * well as returning an error code (the latter is not described
744 * in the API spec.)
745 */
746 u_int32_t mtu32;
747 struct ip6ctlparam ip6cp;
748
749 mtu32 = (u_int32_t)mtu;
750 memset(&ip6cp, 0, sizeof(ip6cp));
751 ip6cp.ip6c_cmdarg = (void *)&mtu32;
752 pfctlinput2(PRC_MSGSIZE,
753 rtcache_getdst(ro_pmtu), &ip6cp);
754
755 error = EMSGSIZE;
756 goto bad;
757 }
758
759 /*
760 * transmit packet without fragmentation
761 */
762 if (dontfrag || (!alwaysfrag && (tlen <= mtu || tso))) {
763 /* case 1-a and 2-a */
764 struct in6_ifaddr *ia6;
765 int sw_csum;
766
767 ip6 = mtod(m, struct ip6_hdr *);
768 ia6 = in6_ifawithifp(ifp, &ip6->ip6_src);
769 if (ia6) {
770 /* Record statistics for this interface address. */
771 ia6->ia_ifa.ifa_data.ifad_outbytes += m->m_pkthdr.len;
772 }
773
774 sw_csum = m->m_pkthdr.csum_flags & ~ifp->if_csum_flags_tx;
775 if ((sw_csum & (M_CSUM_UDPv6|M_CSUM_TCPv6)) != 0) {
776 if (IN6_NEED_CHECKSUM(ifp,
777 sw_csum & (M_CSUM_UDPv6|M_CSUM_TCPv6))) {
778 in6_delayed_cksum(m);
779 }
780 m->m_pkthdr.csum_flags &= ~(M_CSUM_UDPv6|M_CSUM_TCPv6);
781 }
782
783 KASSERT(dst != NULL);
784 if (__predict_true(!tso ||
785 (ifp->if_capenable & IFCAP_TSOv6) != 0)) {
786 error = nd6_output(ifp, origifp, m, dst, rt);
787 } else {
788 error = ip6_tso_output(ifp, origifp, m, dst, rt);
789 }
790 goto done;
791 }
792
793 if (tso) {
794 error = EINVAL; /* XXX */
795 goto bad;
796 }
797
798 /*
799 * try to fragment the packet. case 1-b and 3
800 */
801 if (mtu < IPV6_MMTU) {
802 /* path MTU cannot be less than IPV6_MMTU */
803 error = EMSGSIZE;
804 in6_ifstat_inc(ifp, ifs6_out_fragfail);
805 goto bad;
806 } else if (ip6->ip6_plen == 0) {
807 /* jumbo payload cannot be fragmented */
808 error = EMSGSIZE;
809 in6_ifstat_inc(ifp, ifs6_out_fragfail);
810 goto bad;
811 } else {
812 struct mbuf **mnext, *m_frgpart;
813 struct ip6_frag *ip6f;
814 u_int32_t id = htonl(ip6_randomid());
815 u_char nextproto;
816 #if 0 /* see below */
817 struct ip6ctlparam ip6cp;
818 u_int32_t mtu32;
819 #endif
820
821 /*
822 * Too large for the destination or interface;
823 * fragment if possible.
824 * Must be able to put at least 8 bytes per fragment.
825 */
826 hlen = unfragpartlen;
827 if (mtu > IPV6_MAXPACKET)
828 mtu = IPV6_MAXPACKET;
829
830 #if 0
831 /*
832 * It is believed this code is a leftover from the
833 * development of the IPV6_RECVPATHMTU sockopt and
834 * associated work to implement RFC3542.
835 * It's not entirely clear what the intent of the API
836 * is at this point, so disable this code for now.
837 * The IPV6_RECVPATHMTU sockopt and/or IPV6_DONTFRAG
838 * will send notifications if the application requests.
839 */
840
841 /* Notify a proper path MTU to applications. */
842 mtu32 = (u_int32_t)mtu;
843 memset(&ip6cp, 0, sizeof(ip6cp));
844 ip6cp.ip6c_cmdarg = (void *)&mtu32;
845 pfctlinput2(PRC_MSGSIZE,
846 rtcache_getdst(ro_pmtu), &ip6cp);
847 #endif
848
849 len = (mtu - hlen - sizeof(struct ip6_frag)) & ~7;
850 if (len < 8) {
851 error = EMSGSIZE;
852 in6_ifstat_inc(ifp, ifs6_out_fragfail);
853 goto bad;
854 }
855
856 mnext = &m->m_nextpkt;
857
858 /*
859 * Change the next header field of the last header in the
860 * unfragmentable part.
861 */
862 if (exthdrs.ip6e_rthdr) {
863 nextproto = *mtod(exthdrs.ip6e_rthdr, u_char *);
864 *mtod(exthdrs.ip6e_rthdr, u_char *) = IPPROTO_FRAGMENT;
865 } else if (exthdrs.ip6e_dest1) {
866 nextproto = *mtod(exthdrs.ip6e_dest1, u_char *);
867 *mtod(exthdrs.ip6e_dest1, u_char *) = IPPROTO_FRAGMENT;
868 } else if (exthdrs.ip6e_hbh) {
869 nextproto = *mtod(exthdrs.ip6e_hbh, u_char *);
870 *mtod(exthdrs.ip6e_hbh, u_char *) = IPPROTO_FRAGMENT;
871 } else {
872 nextproto = ip6->ip6_nxt;
873 ip6->ip6_nxt = IPPROTO_FRAGMENT;
874 }
875
876 if ((m->m_pkthdr.csum_flags & (M_CSUM_UDPv6|M_CSUM_TCPv6))
877 != 0) {
878 if (IN6_NEED_CHECKSUM(ifp,
879 m->m_pkthdr.csum_flags &
880 (M_CSUM_UDPv6|M_CSUM_TCPv6))) {
881 in6_delayed_cksum(m);
882 }
883 m->m_pkthdr.csum_flags &= ~(M_CSUM_UDPv6|M_CSUM_TCPv6);
884 }
885
886 /*
887 * Loop through length of segment after first fragment,
888 * make new header and copy data of each part and link onto
889 * chain.
890 */
891 m0 = m;
892 for (off = hlen; off < tlen; off += len) {
893 struct mbuf *mlast;
894
895 MGETHDR(m, M_DONTWAIT, MT_HEADER);
896 if (!m) {
897 error = ENOBUFS;
898 IP6_STATINC(IP6_STAT_ODROPPED);
899 goto sendorfree;
900 }
901 m_reset_rcvif(m);
902 m->m_flags = m0->m_flags & M_COPYFLAGS;
903 *mnext = m;
904 mnext = &m->m_nextpkt;
905 m->m_data += max_linkhdr;
906 mhip6 = mtod(m, struct ip6_hdr *);
907 *mhip6 = *ip6;
908 m->m_len = sizeof(*mhip6);
909 /*
910 * ip6f must be valid if error is 0. But how
911 * can a compiler be expected to infer this?
912 */
913 ip6f = NULL;
914 error = ip6_insertfraghdr(m0, m, hlen, &ip6f);
915 if (error) {
916 IP6_STATINC(IP6_STAT_ODROPPED);
917 goto sendorfree;
918 }
919 ip6f->ip6f_offlg = htons((u_int16_t)((off - hlen) & ~7));
920 if (off + len >= tlen)
921 len = tlen - off;
922 else
923 ip6f->ip6f_offlg |= IP6F_MORE_FRAG;
924 mhip6->ip6_plen = htons((u_int16_t)(len + hlen +
925 sizeof(*ip6f) - sizeof(struct ip6_hdr)));
926 if ((m_frgpart = m_copy(m0, off, len)) == 0) {
927 error = ENOBUFS;
928 IP6_STATINC(IP6_STAT_ODROPPED);
929 goto sendorfree;
930 }
931 for (mlast = m; mlast->m_next; mlast = mlast->m_next)
932 ;
933 mlast->m_next = m_frgpart;
934 m->m_pkthdr.len = len + hlen + sizeof(*ip6f);
935 m_reset_rcvif(m);
936 ip6f->ip6f_reserved = 0;
937 ip6f->ip6f_ident = id;
938 ip6f->ip6f_nxt = nextproto;
939 IP6_STATINC(IP6_STAT_OFRAGMENTS);
940 in6_ifstat_inc(ifp, ifs6_out_fragcreat);
941 }
942
943 in6_ifstat_inc(ifp, ifs6_out_fragok);
944 }
945
946 /*
947 * Remove leading garbages.
948 */
949 sendorfree:
950 m = m0->m_nextpkt;
951 m0->m_nextpkt = 0;
952 m_freem(m0);
953 for (m0 = m; m; m = m0) {
954 m0 = m->m_nextpkt;
955 m->m_nextpkt = 0;
956 if (error == 0) {
957 struct in6_ifaddr *ia6;
958 ip6 = mtod(m, struct ip6_hdr *);
959 ia6 = in6_ifawithifp(ifp, &ip6->ip6_src);
960 if (ia6) {
961 /*
962 * Record statistics for this interface
963 * address.
964 */
965 ia6->ia_ifa.ifa_data.ifad_outbytes +=
966 m->m_pkthdr.len;
967 }
968 KASSERT(dst != NULL);
969 error = nd6_output(ifp, origifp, m, dst, rt);
970 } else
971 m_freem(m);
972 }
973
974 if (error == 0)
975 IP6_STATINC(IP6_STAT_FRAGMENTED);
976
977 done:
978 rtcache_free(&ip6route);
979
980 #ifdef IPSEC
981 if (sp != NULL)
982 KEY_FREESP(&sp);
983 #endif /* IPSEC */
984
985 if_put(ifp, &psref);
986 if (release_psref_ia)
987 if_put(origifp, &psref_ia);
988 curlwp_bindx(bound);
989
990 return (error);
991
992 freehdrs:
993 m_freem(exthdrs.ip6e_hbh); /* m_freem will check if mbuf is 0 */
994 m_freem(exthdrs.ip6e_dest1);
995 m_freem(exthdrs.ip6e_rthdr);
996 m_freem(exthdrs.ip6e_dest2);
997 /* FALLTHROUGH */
998 bad:
999 m_freem(m);
1000 goto done;
1001 badscope:
1002 IP6_STATINC(IP6_STAT_BADSCOPE);
1003 in6_ifstat_inc(origifp, ifs6_out_discard);
1004 if (error == 0)
1005 error = EHOSTUNREACH; /* XXX */
1006 goto bad;
1007 }
1008
1009 static int
1010 ip6_copyexthdr(struct mbuf **mp, void *hdr, int hlen)
1011 {
1012 struct mbuf *m;
1013
1014 if (hlen > MCLBYTES)
1015 return (ENOBUFS); /* XXX */
1016
1017 MGET(m, M_DONTWAIT, MT_DATA);
1018 if (!m)
1019 return (ENOBUFS);
1020
1021 if (hlen > MLEN) {
1022 MCLGET(m, M_DONTWAIT);
1023 if ((m->m_flags & M_EXT) == 0) {
1024 m_free(m);
1025 return (ENOBUFS);
1026 }
1027 }
1028 m->m_len = hlen;
1029 if (hdr)
1030 bcopy(hdr, mtod(m, void *), hlen);
1031
1032 *mp = m;
1033 return (0);
1034 }
1035
1036 /*
1037 * Process a delayed payload checksum calculation.
1038 */
1039 void
1040 in6_delayed_cksum(struct mbuf *m)
1041 {
1042 uint16_t csum, offset;
1043
1044 KASSERT((m->m_pkthdr.csum_flags & (M_CSUM_UDPv6|M_CSUM_TCPv6)) != 0);
1045 KASSERT((~m->m_pkthdr.csum_flags & (M_CSUM_UDPv6|M_CSUM_TCPv6)) != 0);
1046 KASSERT((m->m_pkthdr.csum_flags
1047 & (M_CSUM_UDPv4|M_CSUM_TCPv4|M_CSUM_TSOv4)) == 0);
1048
1049 offset = M_CSUM_DATA_IPv6_HL(m->m_pkthdr.csum_data);
1050 csum = in6_cksum(m, 0, offset, m->m_pkthdr.len - offset);
1051 if (csum == 0 && (m->m_pkthdr.csum_flags & M_CSUM_UDPv6) != 0) {
1052 csum = 0xffff;
1053 }
1054
1055 offset += M_CSUM_DATA_IPv6_OFFSET(m->m_pkthdr.csum_data);
1056 if ((offset + sizeof(csum)) > m->m_len) {
1057 m_copyback(m, offset, sizeof(csum), &csum);
1058 } else {
1059 *(uint16_t *)(mtod(m, char *) + offset) = csum;
1060 }
1061 }
1062
1063 /*
1064 * Insert jumbo payload option.
1065 */
1066 static int
1067 ip6_insert_jumboopt(struct ip6_exthdrs *exthdrs, u_int32_t plen)
1068 {
1069 struct mbuf *mopt;
1070 u_int8_t *optbuf;
1071 u_int32_t v;
1072
1073 #define JUMBOOPTLEN 8 /* length of jumbo payload option and padding */
1074
1075 /*
1076 * If there is no hop-by-hop options header, allocate new one.
1077 * If there is one but it doesn't have enough space to store the
1078 * jumbo payload option, allocate a cluster to store the whole options.
1079 * Otherwise, use it to store the options.
1080 */
1081 if (exthdrs->ip6e_hbh == 0) {
1082 MGET(mopt, M_DONTWAIT, MT_DATA);
1083 if (mopt == 0)
1084 return (ENOBUFS);
1085 mopt->m_len = JUMBOOPTLEN;
1086 optbuf = mtod(mopt, u_int8_t *);
1087 optbuf[1] = 0; /* = ((JUMBOOPTLEN) >> 3) - 1 */
1088 exthdrs->ip6e_hbh = mopt;
1089 } else {
1090 struct ip6_hbh *hbh;
1091
1092 mopt = exthdrs->ip6e_hbh;
1093 if (M_TRAILINGSPACE(mopt) < JUMBOOPTLEN) {
1094 /*
1095 * XXX assumption:
1096 * - exthdrs->ip6e_hbh is not referenced from places
1097 * other than exthdrs.
1098 * - exthdrs->ip6e_hbh is not an mbuf chain.
1099 */
1100 int oldoptlen = mopt->m_len;
1101 struct mbuf *n;
1102
1103 /*
1104 * XXX: give up if the whole (new) hbh header does
1105 * not fit even in an mbuf cluster.
1106 */
1107 if (oldoptlen + JUMBOOPTLEN > MCLBYTES)
1108 return (ENOBUFS);
1109
1110 /*
1111 * As a consequence, we must always prepare a cluster
1112 * at this point.
1113 */
1114 MGET(n, M_DONTWAIT, MT_DATA);
1115 if (n) {
1116 MCLGET(n, M_DONTWAIT);
1117 if ((n->m_flags & M_EXT) == 0) {
1118 m_freem(n);
1119 n = NULL;
1120 }
1121 }
1122 if (!n)
1123 return (ENOBUFS);
1124 n->m_len = oldoptlen + JUMBOOPTLEN;
1125 bcopy(mtod(mopt, void *), mtod(n, void *),
1126 oldoptlen);
1127 optbuf = mtod(n, u_int8_t *) + oldoptlen;
1128 m_freem(mopt);
1129 mopt = exthdrs->ip6e_hbh = n;
1130 } else {
1131 optbuf = mtod(mopt, u_int8_t *) + mopt->m_len;
1132 mopt->m_len += JUMBOOPTLEN;
1133 }
1134 optbuf[0] = IP6OPT_PADN;
1135 optbuf[1] = 0;
1136
1137 /*
1138 * Adjust the header length according to the pad and
1139 * the jumbo payload option.
1140 */
1141 hbh = mtod(mopt, struct ip6_hbh *);
1142 hbh->ip6h_len += (JUMBOOPTLEN >> 3);
1143 }
1144
1145 /* fill in the option. */
1146 optbuf[2] = IP6OPT_JUMBO;
1147 optbuf[3] = 4;
1148 v = (u_int32_t)htonl(plen + JUMBOOPTLEN);
1149 bcopy(&v, &optbuf[4], sizeof(u_int32_t));
1150
1151 /* finally, adjust the packet header length */
1152 exthdrs->ip6e_ip6->m_pkthdr.len += JUMBOOPTLEN;
1153
1154 return (0);
1155 #undef JUMBOOPTLEN
1156 }
1157
1158 /*
1159 * Insert fragment header and copy unfragmentable header portions.
1160 *
1161 * *frghdrp will not be read, and it is guaranteed that either an
1162 * error is returned or that *frghdrp will point to space allocated
1163 * for the fragment header.
1164 */
1165 static int
1166 ip6_insertfraghdr(struct mbuf *m0, struct mbuf *m, int hlen,
1167 struct ip6_frag **frghdrp)
1168 {
1169 struct mbuf *n, *mlast;
1170
1171 if (hlen > sizeof(struct ip6_hdr)) {
1172 n = m_copym(m0, sizeof(struct ip6_hdr),
1173 hlen - sizeof(struct ip6_hdr), M_DONTWAIT);
1174 if (n == 0)
1175 return (ENOBUFS);
1176 m->m_next = n;
1177 } else
1178 n = m;
1179
1180 /* Search for the last mbuf of unfragmentable part. */
1181 for (mlast = n; mlast->m_next; mlast = mlast->m_next)
1182 ;
1183
1184 if ((mlast->m_flags & M_EXT) == 0 &&
1185 M_TRAILINGSPACE(mlast) >= sizeof(struct ip6_frag)) {
1186 /* use the trailing space of the last mbuf for the fragment hdr */
1187 *frghdrp = (struct ip6_frag *)(mtod(mlast, char *) +
1188 mlast->m_len);
1189 mlast->m_len += sizeof(struct ip6_frag);
1190 m->m_pkthdr.len += sizeof(struct ip6_frag);
1191 } else {
1192 /* allocate a new mbuf for the fragment header */
1193 struct mbuf *mfrg;
1194
1195 MGET(mfrg, M_DONTWAIT, MT_DATA);
1196 if (mfrg == 0)
1197 return (ENOBUFS);
1198 mfrg->m_len = sizeof(struct ip6_frag);
1199 *frghdrp = mtod(mfrg, struct ip6_frag *);
1200 mlast->m_next = mfrg;
1201 }
1202
1203 return (0);
1204 }
1205
1206 static int
1207 ip6_getpmtu(struct route *ro_pmtu, struct route *ro, struct ifnet *ifp,
1208 const struct in6_addr *dst, u_long *mtup, int *alwaysfragp)
1209 {
1210 struct rtentry *rt;
1211 u_int32_t mtu = 0;
1212 int alwaysfrag = 0;
1213 int error = 0;
1214
1215 if (ro_pmtu != ro) {
1216 union {
1217 struct sockaddr dst;
1218 struct sockaddr_in6 dst6;
1219 } u;
1220
1221 /* The first hop and the final destination may differ. */
1222 sockaddr_in6_init(&u.dst6, dst, 0, 0, 0);
1223 rt = rtcache_lookup(ro_pmtu, &u.dst);
1224 } else
1225 rt = rtcache_validate(ro_pmtu);
1226 if (rt != NULL) {
1227 u_int32_t ifmtu;
1228
1229 if (ifp == NULL)
1230 ifp = rt->rt_ifp;
1231 ifmtu = IN6_LINKMTU(ifp);
1232 mtu = rt->rt_rmx.rmx_mtu;
1233 if (mtu == 0)
1234 mtu = ifmtu;
1235 else if (mtu < IPV6_MMTU) {
1236 /*
1237 * RFC2460 section 5, last paragraph:
1238 * if we record ICMPv6 too big message with
1239 * mtu < IPV6_MMTU, transmit packets sized IPV6_MMTU
1240 * or smaller, with fragment header attached.
1241 * (fragment header is needed regardless from the
1242 * packet size, for translators to identify packets)
1243 */
1244 alwaysfrag = 1;
1245 mtu = IPV6_MMTU;
1246 } else if (mtu > ifmtu) {
1247 /*
1248 * The MTU on the route is larger than the MTU on
1249 * the interface! This shouldn't happen, unless the
1250 * MTU of the interface has been changed after the
1251 * interface was brought up. Change the MTU in the
1252 * route to match the interface MTU (as long as the
1253 * field isn't locked).
1254 */
1255 mtu = ifmtu;
1256 if (!(rt->rt_rmx.rmx_locks & RTV_MTU))
1257 rt->rt_rmx.rmx_mtu = mtu;
1258 }
1259 } else if (ifp) {
1260 mtu = IN6_LINKMTU(ifp);
1261 } else
1262 error = EHOSTUNREACH; /* XXX */
1263
1264 *mtup = mtu;
1265 if (alwaysfragp)
1266 *alwaysfragp = alwaysfrag;
1267 return (error);
1268 }
1269
1270 /*
1271 * IP6 socket option processing.
1272 */
1273 int
1274 ip6_ctloutput(int op, struct socket *so, struct sockopt *sopt)
1275 {
1276 int optdatalen, uproto;
1277 void *optdata;
1278 struct in6pcb *in6p = sotoin6pcb(so);
1279 struct ip_moptions **mopts;
1280 int error, optval;
1281 int level, optname;
1282
1283 KASSERT(sopt != NULL);
1284
1285 level = sopt->sopt_level;
1286 optname = sopt->sopt_name;
1287
1288 error = optval = 0;
1289 uproto = (int)so->so_proto->pr_protocol;
1290
1291 switch (level) {
1292 case IPPROTO_IP:
1293 switch (optname) {
1294 case IP_ADD_MEMBERSHIP:
1295 case IP_DROP_MEMBERSHIP:
1296 case IP_MULTICAST_IF:
1297 case IP_MULTICAST_LOOP:
1298 case IP_MULTICAST_TTL:
1299 mopts = &in6p->in6p_v4moptions;
1300 switch (op) {
1301 case PRCO_GETOPT:
1302 return ip_getmoptions(*mopts, sopt);
1303 case PRCO_SETOPT:
1304 return ip_setmoptions(mopts, sopt);
1305 default:
1306 return EINVAL;
1307 }
1308 default:
1309 return ENOPROTOOPT;
1310 }
1311 case IPPROTO_IPV6:
1312 break;
1313 default:
1314 return ENOPROTOOPT;
1315 }
1316 switch (op) {
1317 case PRCO_SETOPT:
1318 switch (optname) {
1319 #ifdef RFC2292
1320 case IPV6_2292PKTOPTIONS:
1321 error = ip6_pcbopts(&in6p->in6p_outputopts, so, sopt);
1322 break;
1323 #endif
1324
1325 /*
1326 * Use of some Hop-by-Hop options or some
1327 * Destination options, might require special
1328 * privilege. That is, normal applications
1329 * (without special privilege) might be forbidden
1330 * from setting certain options in outgoing packets,
1331 * and might never see certain options in received
1332 * packets. [RFC 2292 Section 6]
1333 * KAME specific note:
1334 * KAME prevents non-privileged users from sending or
1335 * receiving ANY hbh/dst options in order to avoid
1336 * overhead of parsing options in the kernel.
1337 */
1338 case IPV6_RECVHOPOPTS:
1339 case IPV6_RECVDSTOPTS:
1340 case IPV6_RECVRTHDRDSTOPTS:
1341 error = kauth_authorize_network(kauth_cred_get(),
1342 KAUTH_NETWORK_IPV6, KAUTH_REQ_NETWORK_IPV6_HOPBYHOP,
1343 NULL, NULL, NULL);
1344 if (error)
1345 break;
1346 /* FALLTHROUGH */
1347 case IPV6_UNICAST_HOPS:
1348 case IPV6_HOPLIMIT:
1349 case IPV6_FAITH:
1350
1351 case IPV6_RECVPKTINFO:
1352 case IPV6_RECVHOPLIMIT:
1353 case IPV6_RECVRTHDR:
1354 case IPV6_RECVPATHMTU:
1355 case IPV6_RECVTCLASS:
1356 case IPV6_V6ONLY:
1357 error = sockopt_getint(sopt, &optval);
1358 if (error)
1359 break;
1360 switch (optname) {
1361 case IPV6_UNICAST_HOPS:
1362 if (optval < -1 || optval >= 256)
1363 error = EINVAL;
1364 else {
1365 /* -1 = kernel default */
1366 in6p->in6p_hops = optval;
1367 }
1368 break;
1369 #define OPTSET(bit) \
1370 do { \
1371 if (optval) \
1372 in6p->in6p_flags |= (bit); \
1373 else \
1374 in6p->in6p_flags &= ~(bit); \
1375 } while (/*CONSTCOND*/ 0)
1376
1377 #ifdef RFC2292
1378 #define OPTSET2292(bit) \
1379 do { \
1380 in6p->in6p_flags |= IN6P_RFC2292; \
1381 if (optval) \
1382 in6p->in6p_flags |= (bit); \
1383 else \
1384 in6p->in6p_flags &= ~(bit); \
1385 } while (/*CONSTCOND*/ 0)
1386 #endif
1387
1388 #define OPTBIT(bit) (in6p->in6p_flags & (bit) ? 1 : 0)
1389
1390 case IPV6_RECVPKTINFO:
1391 #ifdef RFC2292
1392 /* cannot mix with RFC2292 */
1393 if (OPTBIT(IN6P_RFC2292)) {
1394 error = EINVAL;
1395 break;
1396 }
1397 #endif
1398 OPTSET(IN6P_PKTINFO);
1399 break;
1400
1401 case IPV6_HOPLIMIT:
1402 {
1403 struct ip6_pktopts **optp;
1404
1405 #ifdef RFC2292
1406 /* cannot mix with RFC2292 */
1407 if (OPTBIT(IN6P_RFC2292)) {
1408 error = EINVAL;
1409 break;
1410 }
1411 #endif
1412 optp = &in6p->in6p_outputopts;
1413 error = ip6_pcbopt(IPV6_HOPLIMIT,
1414 (u_char *)&optval,
1415 sizeof(optval),
1416 optp,
1417 kauth_cred_get(), uproto);
1418 break;
1419 }
1420
1421 case IPV6_RECVHOPLIMIT:
1422 #ifdef RFC2292
1423 /* cannot mix with RFC2292 */
1424 if (OPTBIT(IN6P_RFC2292)) {
1425 error = EINVAL;
1426 break;
1427 }
1428 #endif
1429 OPTSET(IN6P_HOPLIMIT);
1430 break;
1431
1432 case IPV6_RECVHOPOPTS:
1433 #ifdef RFC2292
1434 /* cannot mix with RFC2292 */
1435 if (OPTBIT(IN6P_RFC2292)) {
1436 error = EINVAL;
1437 break;
1438 }
1439 #endif
1440 OPTSET(IN6P_HOPOPTS);
1441 break;
1442
1443 case IPV6_RECVDSTOPTS:
1444 #ifdef RFC2292
1445 /* cannot mix with RFC2292 */
1446 if (OPTBIT(IN6P_RFC2292)) {
1447 error = EINVAL;
1448 break;
1449 }
1450 #endif
1451 OPTSET(IN6P_DSTOPTS);
1452 break;
1453
1454 case IPV6_RECVRTHDRDSTOPTS:
1455 #ifdef RFC2292
1456 /* cannot mix with RFC2292 */
1457 if (OPTBIT(IN6P_RFC2292)) {
1458 error = EINVAL;
1459 break;
1460 }
1461 #endif
1462 OPTSET(IN6P_RTHDRDSTOPTS);
1463 break;
1464
1465 case IPV6_RECVRTHDR:
1466 #ifdef RFC2292
1467 /* cannot mix with RFC2292 */
1468 if (OPTBIT(IN6P_RFC2292)) {
1469 error = EINVAL;
1470 break;
1471 }
1472 #endif
1473 OPTSET(IN6P_RTHDR);
1474 break;
1475
1476 case IPV6_FAITH:
1477 OPTSET(IN6P_FAITH);
1478 break;
1479
1480 case IPV6_RECVPATHMTU:
1481 /*
1482 * We ignore this option for TCP
1483 * sockets.
1484 * (RFC3542 leaves this case
1485 * unspecified.)
1486 */
1487 if (uproto != IPPROTO_TCP)
1488 OPTSET(IN6P_MTU);
1489 break;
1490
1491 case IPV6_V6ONLY:
1492 /*
1493 * make setsockopt(IPV6_V6ONLY)
1494 * available only prior to bind(2).
1495 * see ipng mailing list, Jun 22 2001.
1496 */
1497 if (in6p->in6p_lport ||
1498 !IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr)) {
1499 error = EINVAL;
1500 break;
1501 }
1502 #ifdef INET6_BINDV6ONLY
1503 if (!optval)
1504 error = EINVAL;
1505 #else
1506 OPTSET(IN6P_IPV6_V6ONLY);
1507 #endif
1508 break;
1509 case IPV6_RECVTCLASS:
1510 #ifdef RFC2292
1511 /* cannot mix with RFC2292 XXX */
1512 if (OPTBIT(IN6P_RFC2292)) {
1513 error = EINVAL;
1514 break;
1515 }
1516 #endif
1517 OPTSET(IN6P_TCLASS);
1518 break;
1519
1520 }
1521 break;
1522
1523 case IPV6_OTCLASS:
1524 {
1525 struct ip6_pktopts **optp;
1526 u_int8_t tclass;
1527
1528 error = sockopt_get(sopt, &tclass, sizeof(tclass));
1529 if (error)
1530 break;
1531 optp = &in6p->in6p_outputopts;
1532 error = ip6_pcbopt(optname,
1533 (u_char *)&tclass,
1534 sizeof(tclass),
1535 optp,
1536 kauth_cred_get(), uproto);
1537 break;
1538 }
1539
1540 case IPV6_TCLASS:
1541 case IPV6_DONTFRAG:
1542 case IPV6_USE_MIN_MTU:
1543 case IPV6_PREFER_TEMPADDR:
1544 error = sockopt_getint(sopt, &optval);
1545 if (error)
1546 break;
1547 {
1548 struct ip6_pktopts **optp;
1549 optp = &in6p->in6p_outputopts;
1550 error = ip6_pcbopt(optname,
1551 (u_char *)&optval,
1552 sizeof(optval),
1553 optp,
1554 kauth_cred_get(), uproto);
1555 break;
1556 }
1557
1558 #ifdef RFC2292
1559 case IPV6_2292PKTINFO:
1560 case IPV6_2292HOPLIMIT:
1561 case IPV6_2292HOPOPTS:
1562 case IPV6_2292DSTOPTS:
1563 case IPV6_2292RTHDR:
1564 /* RFC 2292 */
1565 error = sockopt_getint(sopt, &optval);
1566 if (error)
1567 break;
1568
1569 switch (optname) {
1570 case IPV6_2292PKTINFO:
1571 OPTSET2292(IN6P_PKTINFO);
1572 break;
1573 case IPV6_2292HOPLIMIT:
1574 OPTSET2292(IN6P_HOPLIMIT);
1575 break;
1576 case IPV6_2292HOPOPTS:
1577 /*
1578 * Check super-user privilege.
1579 * See comments for IPV6_RECVHOPOPTS.
1580 */
1581 error =
1582 kauth_authorize_network(kauth_cred_get(),
1583 KAUTH_NETWORK_IPV6,
1584 KAUTH_REQ_NETWORK_IPV6_HOPBYHOP, NULL,
1585 NULL, NULL);
1586 if (error)
1587 return (error);
1588 OPTSET2292(IN6P_HOPOPTS);
1589 break;
1590 case IPV6_2292DSTOPTS:
1591 error =
1592 kauth_authorize_network(kauth_cred_get(),
1593 KAUTH_NETWORK_IPV6,
1594 KAUTH_REQ_NETWORK_IPV6_HOPBYHOP, NULL,
1595 NULL, NULL);
1596 if (error)
1597 return (error);
1598 OPTSET2292(IN6P_DSTOPTS|IN6P_RTHDRDSTOPTS); /* XXX */
1599 break;
1600 case IPV6_2292RTHDR:
1601 OPTSET2292(IN6P_RTHDR);
1602 break;
1603 }
1604 break;
1605 #endif
1606 case IPV6_PKTINFO:
1607 case IPV6_HOPOPTS:
1608 case IPV6_RTHDR:
1609 case IPV6_DSTOPTS:
1610 case IPV6_RTHDRDSTOPTS:
1611 case IPV6_NEXTHOP: {
1612 /* new advanced API (RFC3542) */
1613 void *optbuf;
1614 int optbuflen;
1615 struct ip6_pktopts **optp;
1616
1617 #ifdef RFC2292
1618 /* cannot mix with RFC2292 */
1619 if (OPTBIT(IN6P_RFC2292)) {
1620 error = EINVAL;
1621 break;
1622 }
1623 #endif
1624
1625 optbuflen = sopt->sopt_size;
1626 optbuf = malloc(optbuflen, M_IP6OPT, M_NOWAIT);
1627 if (optbuf == NULL) {
1628 error = ENOBUFS;
1629 break;
1630 }
1631
1632 error = sockopt_get(sopt, optbuf, optbuflen);
1633 if (error) {
1634 free(optbuf, M_IP6OPT);
1635 break;
1636 }
1637 optp = &in6p->in6p_outputopts;
1638 error = ip6_pcbopt(optname, optbuf, optbuflen,
1639 optp, kauth_cred_get(), uproto);
1640
1641 free(optbuf, M_IP6OPT);
1642 break;
1643 }
1644 #undef OPTSET
1645
1646 case IPV6_MULTICAST_IF:
1647 case IPV6_MULTICAST_HOPS:
1648 case IPV6_MULTICAST_LOOP:
1649 case IPV6_JOIN_GROUP:
1650 case IPV6_LEAVE_GROUP:
1651 error = ip6_setmoptions(sopt, in6p);
1652 break;
1653
1654 case IPV6_PORTRANGE:
1655 error = sockopt_getint(sopt, &optval);
1656 if (error)
1657 break;
1658
1659 switch (optval) {
1660 case IPV6_PORTRANGE_DEFAULT:
1661 in6p->in6p_flags &= ~(IN6P_LOWPORT);
1662 in6p->in6p_flags &= ~(IN6P_HIGHPORT);
1663 break;
1664
1665 case IPV6_PORTRANGE_HIGH:
1666 in6p->in6p_flags &= ~(IN6P_LOWPORT);
1667 in6p->in6p_flags |= IN6P_HIGHPORT;
1668 break;
1669
1670 case IPV6_PORTRANGE_LOW:
1671 in6p->in6p_flags &= ~(IN6P_HIGHPORT);
1672 in6p->in6p_flags |= IN6P_LOWPORT;
1673 break;
1674
1675 default:
1676 error = EINVAL;
1677 break;
1678 }
1679 break;
1680
1681 case IPV6_PORTALGO:
1682 error = sockopt_getint(sopt, &optval);
1683 if (error)
1684 break;
1685
1686 error = portalgo_algo_index_select(
1687 (struct inpcb_hdr *)in6p, optval);
1688 break;
1689
1690 #if defined(IPSEC)
1691 case IPV6_IPSEC_POLICY:
1692 if (ipsec_enabled) {
1693 error = ipsec6_set_policy(in6p, optname,
1694 sopt->sopt_data, sopt->sopt_size,
1695 kauth_cred_get());
1696 break;
1697 }
1698 /*FALLTHROUGH*/
1699 #endif /* IPSEC */
1700
1701 default:
1702 error = ENOPROTOOPT;
1703 break;
1704 }
1705 break;
1706
1707 case PRCO_GETOPT:
1708 switch (optname) {
1709 #ifdef RFC2292
1710 case IPV6_2292PKTOPTIONS:
1711 /*
1712 * RFC3542 (effectively) deprecated the
1713 * semantics of the 2292-style pktoptions.
1714 * Since it was not reliable in nature (i.e.,
1715 * applications had to expect the lack of some
1716 * information after all), it would make sense
1717 * to simplify this part by always returning
1718 * empty data.
1719 */
1720 break;
1721 #endif
1722
1723 case IPV6_RECVHOPOPTS:
1724 case IPV6_RECVDSTOPTS:
1725 case IPV6_RECVRTHDRDSTOPTS:
1726 case IPV6_UNICAST_HOPS:
1727 case IPV6_RECVPKTINFO:
1728 case IPV6_RECVHOPLIMIT:
1729 case IPV6_RECVRTHDR:
1730 case IPV6_RECVPATHMTU:
1731
1732 case IPV6_FAITH:
1733 case IPV6_V6ONLY:
1734 case IPV6_PORTRANGE:
1735 case IPV6_RECVTCLASS:
1736 switch (optname) {
1737
1738 case IPV6_RECVHOPOPTS:
1739 optval = OPTBIT(IN6P_HOPOPTS);
1740 break;
1741
1742 case IPV6_RECVDSTOPTS:
1743 optval = OPTBIT(IN6P_DSTOPTS);
1744 break;
1745
1746 case IPV6_RECVRTHDRDSTOPTS:
1747 optval = OPTBIT(IN6P_RTHDRDSTOPTS);
1748 break;
1749
1750 case IPV6_UNICAST_HOPS:
1751 optval = in6p->in6p_hops;
1752 break;
1753
1754 case IPV6_RECVPKTINFO:
1755 optval = OPTBIT(IN6P_PKTINFO);
1756 break;
1757
1758 case IPV6_RECVHOPLIMIT:
1759 optval = OPTBIT(IN6P_HOPLIMIT);
1760 break;
1761
1762 case IPV6_RECVRTHDR:
1763 optval = OPTBIT(IN6P_RTHDR);
1764 break;
1765
1766 case IPV6_RECVPATHMTU:
1767 optval = OPTBIT(IN6P_MTU);
1768 break;
1769
1770 case IPV6_FAITH:
1771 optval = OPTBIT(IN6P_FAITH);
1772 break;
1773
1774 case IPV6_V6ONLY:
1775 optval = OPTBIT(IN6P_IPV6_V6ONLY);
1776 break;
1777
1778 case IPV6_PORTRANGE:
1779 {
1780 int flags;
1781 flags = in6p->in6p_flags;
1782 if (flags & IN6P_HIGHPORT)
1783 optval = IPV6_PORTRANGE_HIGH;
1784 else if (flags & IN6P_LOWPORT)
1785 optval = IPV6_PORTRANGE_LOW;
1786 else
1787 optval = 0;
1788 break;
1789 }
1790 case IPV6_RECVTCLASS:
1791 optval = OPTBIT(IN6P_TCLASS);
1792 break;
1793
1794 }
1795 if (error)
1796 break;
1797 error = sockopt_setint(sopt, optval);
1798 break;
1799
1800 case IPV6_PATHMTU:
1801 {
1802 u_long pmtu = 0;
1803 struct ip6_mtuinfo mtuinfo;
1804 struct route *ro = &in6p->in6p_route;
1805
1806 if (!(so->so_state & SS_ISCONNECTED))
1807 return (ENOTCONN);
1808 /*
1809 * XXX: we dot not consider the case of source
1810 * routing, or optional information to specify
1811 * the outgoing interface.
1812 */
1813 error = ip6_getpmtu(ro, NULL, NULL,
1814 &in6p->in6p_faddr, &pmtu, NULL);
1815 if (error)
1816 break;
1817 if (pmtu > IPV6_MAXPACKET)
1818 pmtu = IPV6_MAXPACKET;
1819
1820 memset(&mtuinfo, 0, sizeof(mtuinfo));
1821 mtuinfo.ip6m_mtu = (u_int32_t)pmtu;
1822 optdata = (void *)&mtuinfo;
1823 optdatalen = sizeof(mtuinfo);
1824 if (optdatalen > MCLBYTES)
1825 return (EMSGSIZE); /* XXX */
1826 error = sockopt_set(sopt, optdata, optdatalen);
1827 break;
1828 }
1829
1830 #ifdef RFC2292
1831 case IPV6_2292PKTINFO:
1832 case IPV6_2292HOPLIMIT:
1833 case IPV6_2292HOPOPTS:
1834 case IPV6_2292RTHDR:
1835 case IPV6_2292DSTOPTS:
1836 switch (optname) {
1837 case IPV6_2292PKTINFO:
1838 optval = OPTBIT(IN6P_PKTINFO);
1839 break;
1840 case IPV6_2292HOPLIMIT:
1841 optval = OPTBIT(IN6P_HOPLIMIT);
1842 break;
1843 case IPV6_2292HOPOPTS:
1844 optval = OPTBIT(IN6P_HOPOPTS);
1845 break;
1846 case IPV6_2292RTHDR:
1847 optval = OPTBIT(IN6P_RTHDR);
1848 break;
1849 case IPV6_2292DSTOPTS:
1850 optval = OPTBIT(IN6P_DSTOPTS|IN6P_RTHDRDSTOPTS);
1851 break;
1852 }
1853 error = sockopt_setint(sopt, optval);
1854 break;
1855 #endif
1856 case IPV6_PKTINFO:
1857 case IPV6_HOPOPTS:
1858 case IPV6_RTHDR:
1859 case IPV6_DSTOPTS:
1860 case IPV6_RTHDRDSTOPTS:
1861 case IPV6_NEXTHOP:
1862 case IPV6_OTCLASS:
1863 case IPV6_TCLASS:
1864 case IPV6_DONTFRAG:
1865 case IPV6_USE_MIN_MTU:
1866 case IPV6_PREFER_TEMPADDR:
1867 error = ip6_getpcbopt(in6p->in6p_outputopts,
1868 optname, sopt);
1869 break;
1870
1871 case IPV6_MULTICAST_IF:
1872 case IPV6_MULTICAST_HOPS:
1873 case IPV6_MULTICAST_LOOP:
1874 case IPV6_JOIN_GROUP:
1875 case IPV6_LEAVE_GROUP:
1876 error = ip6_getmoptions(sopt, in6p);
1877 break;
1878
1879 case IPV6_PORTALGO:
1880 optval = ((struct inpcb_hdr *)in6p)->inph_portalgo;
1881 error = sockopt_setint(sopt, optval);
1882 break;
1883
1884 #if defined(IPSEC)
1885 case IPV6_IPSEC_POLICY:
1886 if (ipsec_used) {
1887 struct mbuf *m = NULL;
1888
1889 /*
1890 * XXX: this will return EINVAL as sopt is
1891 * empty
1892 */
1893 error = ipsec6_get_policy(in6p, sopt->sopt_data,
1894 sopt->sopt_size, &m);
1895 if (!error)
1896 error = sockopt_setmbuf(sopt, m);
1897 break;
1898 }
1899 /*FALLTHROUGH*/
1900 #endif /* IPSEC */
1901
1902 default:
1903 error = ENOPROTOOPT;
1904 break;
1905 }
1906 break;
1907 }
1908 return (error);
1909 }
1910
1911 int
1912 ip6_raw_ctloutput(int op, struct socket *so, struct sockopt *sopt)
1913 {
1914 int error = 0, optval;
1915 const int icmp6off = offsetof(struct icmp6_hdr, icmp6_cksum);
1916 struct in6pcb *in6p = sotoin6pcb(so);
1917 int level, optname;
1918
1919 KASSERT(sopt != NULL);
1920
1921 level = sopt->sopt_level;
1922 optname = sopt->sopt_name;
1923
1924 if (level != IPPROTO_IPV6) {
1925 return ENOPROTOOPT;
1926 }
1927
1928 switch (optname) {
1929 case IPV6_CHECKSUM:
1930 /*
1931 * For ICMPv6 sockets, no modification allowed for checksum
1932 * offset, permit "no change" values to help existing apps.
1933 *
1934 * XXX RFC3542 says: "An attempt to set IPV6_CHECKSUM
1935 * for an ICMPv6 socket will fail." The current
1936 * behavior does not meet RFC3542.
1937 */
1938 switch (op) {
1939 case PRCO_SETOPT:
1940 error = sockopt_getint(sopt, &optval);
1941 if (error)
1942 break;
1943 if ((optval % 2) != 0) {
1944 /* the API assumes even offset values */
1945 error = EINVAL;
1946 } else if (so->so_proto->pr_protocol ==
1947 IPPROTO_ICMPV6) {
1948 if (optval != icmp6off)
1949 error = EINVAL;
1950 } else
1951 in6p->in6p_cksum = optval;
1952 break;
1953
1954 case PRCO_GETOPT:
1955 if (so->so_proto->pr_protocol == IPPROTO_ICMPV6)
1956 optval = icmp6off;
1957 else
1958 optval = in6p->in6p_cksum;
1959
1960 error = sockopt_setint(sopt, optval);
1961 break;
1962
1963 default:
1964 error = EINVAL;
1965 break;
1966 }
1967 break;
1968
1969 default:
1970 error = ENOPROTOOPT;
1971 break;
1972 }
1973
1974 return (error);
1975 }
1976
1977 #ifdef RFC2292
1978 /*
1979 * Set up IP6 options in pcb for insertion in output packets or
1980 * specifying behavior of outgoing packets.
1981 */
1982 static int
1983 ip6_pcbopts(struct ip6_pktopts **pktopt, struct socket *so,
1984 struct sockopt *sopt)
1985 {
1986 struct ip6_pktopts *opt = *pktopt;
1987 struct mbuf *m;
1988 int error = 0;
1989
1990 /* turn off any old options. */
1991 if (opt) {
1992 #ifdef DIAGNOSTIC
1993 if (opt->ip6po_pktinfo || opt->ip6po_nexthop ||
1994 opt->ip6po_hbh || opt->ip6po_dest1 || opt->ip6po_dest2 ||
1995 opt->ip6po_rhinfo.ip6po_rhi_rthdr)
1996 printf("ip6_pcbopts: all specified options are cleared.\n");
1997 #endif
1998 ip6_clearpktopts(opt, -1);
1999 } else {
2000 opt = malloc(sizeof(*opt), M_IP6OPT, M_NOWAIT);
2001 if (opt == NULL)
2002 return (ENOBUFS);
2003 }
2004 *pktopt = NULL;
2005
2006 if (sopt == NULL || sopt->sopt_size == 0) {
2007 /*
2008 * Only turning off any previous options, regardless of
2009 * whether the opt is just created or given.
2010 */
2011 free(opt, M_IP6OPT);
2012 return (0);
2013 }
2014
2015 /* set options specified by user. */
2016 m = sockopt_getmbuf(sopt);
2017 if (m == NULL) {
2018 free(opt, M_IP6OPT);
2019 return (ENOBUFS);
2020 }
2021
2022 error = ip6_setpktopts(m, opt, NULL, kauth_cred_get(),
2023 so->so_proto->pr_protocol);
2024 m_freem(m);
2025 if (error != 0) {
2026 ip6_clearpktopts(opt, -1); /* XXX: discard all options */
2027 free(opt, M_IP6OPT);
2028 return (error);
2029 }
2030 *pktopt = opt;
2031 return (0);
2032 }
2033 #endif
2034
2035 /*
2036 * initialize ip6_pktopts. beware that there are non-zero default values in
2037 * the struct.
2038 */
2039 void
2040 ip6_initpktopts(struct ip6_pktopts *opt)
2041 {
2042
2043 memset(opt, 0, sizeof(*opt));
2044 opt->ip6po_hlim = -1; /* -1 means default hop limit */
2045 opt->ip6po_tclass = -1; /* -1 means default traffic class */
2046 opt->ip6po_minmtu = IP6PO_MINMTU_MCASTONLY;
2047 opt->ip6po_prefer_tempaddr = IP6PO_TEMPADDR_SYSTEM;
2048 }
2049
2050 #define sin6tosa(sin6) ((struct sockaddr *)(sin6)) /* XXX */
2051 static int
2052 ip6_pcbopt(int optname, u_char *buf, int len, struct ip6_pktopts **pktopt,
2053 kauth_cred_t cred, int uproto)
2054 {
2055 struct ip6_pktopts *opt;
2056
2057 if (*pktopt == NULL) {
2058 *pktopt = malloc(sizeof(struct ip6_pktopts), M_IP6OPT,
2059 M_NOWAIT);
2060 if (*pktopt == NULL)
2061 return (ENOBUFS);
2062
2063 ip6_initpktopts(*pktopt);
2064 }
2065 opt = *pktopt;
2066
2067 return (ip6_setpktopt(optname, buf, len, opt, cred, 1, 0, uproto));
2068 }
2069
2070 static int
2071 ip6_getpcbopt(struct ip6_pktopts *pktopt, int optname, struct sockopt *sopt)
2072 {
2073 void *optdata = NULL;
2074 int optdatalen = 0;
2075 struct ip6_ext *ip6e;
2076 int error = 0;
2077 struct in6_pktinfo null_pktinfo;
2078 int deftclass = 0, on;
2079 int defminmtu = IP6PO_MINMTU_MCASTONLY;
2080 int defpreftemp = IP6PO_TEMPADDR_SYSTEM;
2081
2082 switch (optname) {
2083 case IPV6_PKTINFO:
2084 if (pktopt && pktopt->ip6po_pktinfo)
2085 optdata = (void *)pktopt->ip6po_pktinfo;
2086 else {
2087 /* XXX: we don't have to do this every time... */
2088 memset(&null_pktinfo, 0, sizeof(null_pktinfo));
2089 optdata = (void *)&null_pktinfo;
2090 }
2091 optdatalen = sizeof(struct in6_pktinfo);
2092 break;
2093 case IPV6_OTCLASS:
2094 /* XXX */
2095 return (EINVAL);
2096 case IPV6_TCLASS:
2097 if (pktopt && pktopt->ip6po_tclass >= 0)
2098 optdata = (void *)&pktopt->ip6po_tclass;
2099 else
2100 optdata = (void *)&deftclass;
2101 optdatalen = sizeof(int);
2102 break;
2103 case IPV6_HOPOPTS:
2104 if (pktopt && pktopt->ip6po_hbh) {
2105 optdata = (void *)pktopt->ip6po_hbh;
2106 ip6e = (struct ip6_ext *)pktopt->ip6po_hbh;
2107 optdatalen = (ip6e->ip6e_len + 1) << 3;
2108 }
2109 break;
2110 case IPV6_RTHDR:
2111 if (pktopt && pktopt->ip6po_rthdr) {
2112 optdata = (void *)pktopt->ip6po_rthdr;
2113 ip6e = (struct ip6_ext *)pktopt->ip6po_rthdr;
2114 optdatalen = (ip6e->ip6e_len + 1) << 3;
2115 }
2116 break;
2117 case IPV6_RTHDRDSTOPTS:
2118 if (pktopt && pktopt->ip6po_dest1) {
2119 optdata = (void *)pktopt->ip6po_dest1;
2120 ip6e = (struct ip6_ext *)pktopt->ip6po_dest1;
2121 optdatalen = (ip6e->ip6e_len + 1) << 3;
2122 }
2123 break;
2124 case IPV6_DSTOPTS:
2125 if (pktopt && pktopt->ip6po_dest2) {
2126 optdata = (void *)pktopt->ip6po_dest2;
2127 ip6e = (struct ip6_ext *)pktopt->ip6po_dest2;
2128 optdatalen = (ip6e->ip6e_len + 1) << 3;
2129 }
2130 break;
2131 case IPV6_NEXTHOP:
2132 if (pktopt && pktopt->ip6po_nexthop) {
2133 optdata = (void *)pktopt->ip6po_nexthop;
2134 optdatalen = pktopt->ip6po_nexthop->sa_len;
2135 }
2136 break;
2137 case IPV6_USE_MIN_MTU:
2138 if (pktopt)
2139 optdata = (void *)&pktopt->ip6po_minmtu;
2140 else
2141 optdata = (void *)&defminmtu;
2142 optdatalen = sizeof(int);
2143 break;
2144 case IPV6_DONTFRAG:
2145 if (pktopt && ((pktopt->ip6po_flags) & IP6PO_DONTFRAG))
2146 on = 1;
2147 else
2148 on = 0;
2149 optdata = (void *)&on;
2150 optdatalen = sizeof(on);
2151 break;
2152 case IPV6_PREFER_TEMPADDR:
2153 if (pktopt)
2154 optdata = (void *)&pktopt->ip6po_prefer_tempaddr;
2155 else
2156 optdata = (void *)&defpreftemp;
2157 optdatalen = sizeof(int);
2158 break;
2159 default: /* should not happen */
2160 #ifdef DIAGNOSTIC
2161 panic("ip6_getpcbopt: unexpected option\n");
2162 #endif
2163 return (ENOPROTOOPT);
2164 }
2165
2166 error = sockopt_set(sopt, optdata, optdatalen);
2167
2168 return (error);
2169 }
2170
2171 void
2172 ip6_clearpktopts(struct ip6_pktopts *pktopt, int optname)
2173 {
2174 if (optname == -1 || optname == IPV6_PKTINFO) {
2175 if (pktopt->ip6po_pktinfo)
2176 free(pktopt->ip6po_pktinfo, M_IP6OPT);
2177 pktopt->ip6po_pktinfo = NULL;
2178 }
2179 if (optname == -1 || optname == IPV6_HOPLIMIT)
2180 pktopt->ip6po_hlim = -1;
2181 if (optname == -1 || optname == IPV6_TCLASS)
2182 pktopt->ip6po_tclass = -1;
2183 if (optname == -1 || optname == IPV6_NEXTHOP) {
2184 rtcache_free(&pktopt->ip6po_nextroute);
2185 if (pktopt->ip6po_nexthop)
2186 free(pktopt->ip6po_nexthop, M_IP6OPT);
2187 pktopt->ip6po_nexthop = NULL;
2188 }
2189 if (optname == -1 || optname == IPV6_HOPOPTS) {
2190 if (pktopt->ip6po_hbh)
2191 free(pktopt->ip6po_hbh, M_IP6OPT);
2192 pktopt->ip6po_hbh = NULL;
2193 }
2194 if (optname == -1 || optname == IPV6_RTHDRDSTOPTS) {
2195 if (pktopt->ip6po_dest1)
2196 free(pktopt->ip6po_dest1, M_IP6OPT);
2197 pktopt->ip6po_dest1 = NULL;
2198 }
2199 if (optname == -1 || optname == IPV6_RTHDR) {
2200 if (pktopt->ip6po_rhinfo.ip6po_rhi_rthdr)
2201 free(pktopt->ip6po_rhinfo.ip6po_rhi_rthdr, M_IP6OPT);
2202 pktopt->ip6po_rhinfo.ip6po_rhi_rthdr = NULL;
2203 rtcache_free(&pktopt->ip6po_route);
2204 }
2205 if (optname == -1 || optname == IPV6_DSTOPTS) {
2206 if (pktopt->ip6po_dest2)
2207 free(pktopt->ip6po_dest2, M_IP6OPT);
2208 pktopt->ip6po_dest2 = NULL;
2209 }
2210 }
2211
2212 #define PKTOPT_EXTHDRCPY(type) \
2213 do { \
2214 if (src->type) { \
2215 int hlen = (((struct ip6_ext *)src->type)->ip6e_len + 1) << 3;\
2216 dst->type = malloc(hlen, M_IP6OPT, canwait); \
2217 if (dst->type == NULL) \
2218 goto bad; \
2219 memcpy(dst->type, src->type, hlen); \
2220 } \
2221 } while (/*CONSTCOND*/ 0)
2222
2223 static int
2224 copypktopts(struct ip6_pktopts *dst, struct ip6_pktopts *src, int canwait)
2225 {
2226 dst->ip6po_hlim = src->ip6po_hlim;
2227 dst->ip6po_tclass = src->ip6po_tclass;
2228 dst->ip6po_flags = src->ip6po_flags;
2229 dst->ip6po_minmtu = src->ip6po_minmtu;
2230 dst->ip6po_prefer_tempaddr = src->ip6po_prefer_tempaddr;
2231 if (src->ip6po_pktinfo) {
2232 dst->ip6po_pktinfo = malloc(sizeof(*dst->ip6po_pktinfo),
2233 M_IP6OPT, canwait);
2234 if (dst->ip6po_pktinfo == NULL)
2235 goto bad;
2236 *dst->ip6po_pktinfo = *src->ip6po_pktinfo;
2237 }
2238 if (src->ip6po_nexthop) {
2239 dst->ip6po_nexthop = malloc(src->ip6po_nexthop->sa_len,
2240 M_IP6OPT, canwait);
2241 if (dst->ip6po_nexthop == NULL)
2242 goto bad;
2243 memcpy(dst->ip6po_nexthop, src->ip6po_nexthop,
2244 src->ip6po_nexthop->sa_len);
2245 }
2246 PKTOPT_EXTHDRCPY(ip6po_hbh);
2247 PKTOPT_EXTHDRCPY(ip6po_dest1);
2248 PKTOPT_EXTHDRCPY(ip6po_dest2);
2249 PKTOPT_EXTHDRCPY(ip6po_rthdr); /* not copy the cached route */
2250 return (0);
2251
2252 bad:
2253 if (dst->ip6po_pktinfo) free(dst->ip6po_pktinfo, M_IP6OPT);
2254 if (dst->ip6po_nexthop) free(dst->ip6po_nexthop, M_IP6OPT);
2255 if (dst->ip6po_hbh) free(dst->ip6po_hbh, M_IP6OPT);
2256 if (dst->ip6po_dest1) free(dst->ip6po_dest1, M_IP6OPT);
2257 if (dst->ip6po_dest2) free(dst->ip6po_dest2, M_IP6OPT);
2258 if (dst->ip6po_rthdr) free(dst->ip6po_rthdr, M_IP6OPT);
2259
2260 return (ENOBUFS);
2261 }
2262 #undef PKTOPT_EXTHDRCPY
2263
2264 struct ip6_pktopts *
2265 ip6_copypktopts(struct ip6_pktopts *src, int canwait)
2266 {
2267 int error;
2268 struct ip6_pktopts *dst;
2269
2270 dst = malloc(sizeof(*dst), M_IP6OPT, canwait);
2271 if (dst == NULL)
2272 return (NULL);
2273 ip6_initpktopts(dst);
2274
2275 if ((error = copypktopts(dst, src, canwait)) != 0) {
2276 free(dst, M_IP6OPT);
2277 return (NULL);
2278 }
2279
2280 return (dst);
2281 }
2282
2283 void
2284 ip6_freepcbopts(struct ip6_pktopts *pktopt)
2285 {
2286 if (pktopt == NULL)
2287 return;
2288
2289 ip6_clearpktopts(pktopt, -1);
2290
2291 free(pktopt, M_IP6OPT);
2292 }
2293
2294 int
2295 ip6_get_membership(const struct sockopt *sopt, struct ifnet **ifp, void *v,
2296 size_t l)
2297 {
2298 struct ipv6_mreq mreq;
2299 int error;
2300 struct in6_addr *ia = &mreq.ipv6mr_multiaddr;
2301 struct in_addr *ia4 = (void *)&ia->s6_addr32[3];
2302 error = sockopt_get(sopt, &mreq, sizeof(mreq));
2303 if (error != 0)
2304 return error;
2305
2306 if (IN6_IS_ADDR_UNSPECIFIED(ia)) {
2307 /*
2308 * We use the unspecified address to specify to accept
2309 * all multicast addresses. Only super user is allowed
2310 * to do this.
2311 */
2312 if (kauth_authorize_network(curlwp->l_cred, KAUTH_NETWORK_IPV6,
2313 KAUTH_REQ_NETWORK_IPV6_JOIN_MULTICAST, NULL, NULL, NULL))
2314 return EACCES;
2315 } else if (IN6_IS_ADDR_V4MAPPED(ia)) {
2316 // Don't bother if we are not going to use ifp.
2317 if (l == sizeof(*ia)) {
2318 memcpy(v, ia, l);
2319 return 0;
2320 }
2321 } else if (!IN6_IS_ADDR_MULTICAST(ia)) {
2322 return EINVAL;
2323 }
2324
2325 /*
2326 * If no interface was explicitly specified, choose an
2327 * appropriate one according to the given multicast address.
2328 */
2329 if (mreq.ipv6mr_interface == 0) {
2330 struct rtentry *rt;
2331 union {
2332 struct sockaddr dst;
2333 struct sockaddr_in dst4;
2334 struct sockaddr_in6 dst6;
2335 } u;
2336 struct route ro;
2337
2338 /*
2339 * Look up the routing table for the
2340 * address, and choose the outgoing interface.
2341 * XXX: is it a good approach?
2342 */
2343 memset(&ro, 0, sizeof(ro));
2344 if (IN6_IS_ADDR_V4MAPPED(ia))
2345 sockaddr_in_init(&u.dst4, ia4, 0);
2346 else
2347 sockaddr_in6_init(&u.dst6, ia, 0, 0, 0);
2348 error = rtcache_setdst(&ro, &u.dst);
2349 if (error != 0)
2350 return error;
2351 *ifp = (rt = rtcache_init(&ro)) != NULL ? rt->rt_ifp : NULL;
2352 rtcache_free(&ro);
2353 } else {
2354 /*
2355 * If the interface is specified, validate it.
2356 */
2357 if ((*ifp = if_byindex(mreq.ipv6mr_interface)) == NULL)
2358 return ENXIO; /* XXX EINVAL? */
2359 }
2360 if (sizeof(*ia) == l)
2361 memcpy(v, ia, l);
2362 else
2363 memcpy(v, ia4, l);
2364 return 0;
2365 }
2366
2367 /*
2368 * Set the IP6 multicast options in response to user setsockopt().
2369 */
2370 static int
2371 ip6_setmoptions(const struct sockopt *sopt, struct in6pcb *in6p)
2372 {
2373 int error = 0;
2374 u_int loop, ifindex;
2375 struct ipv6_mreq mreq;
2376 struct in6_addr ia;
2377 struct ifnet *ifp;
2378 struct ip6_moptions *im6o = in6p->in6p_moptions;
2379 struct in6_multi_mship *imm;
2380
2381 if (im6o == NULL) {
2382 /*
2383 * No multicast option buffer attached to the pcb;
2384 * allocate one and initialize to default values.
2385 */
2386 im6o = malloc(sizeof(*im6o), M_IPMOPTS, M_NOWAIT);
2387 if (im6o == NULL)
2388 return (ENOBUFS);
2389 in6p->in6p_moptions = im6o;
2390 im6o->im6o_multicast_if_index = 0;
2391 im6o->im6o_multicast_hlim = ip6_defmcasthlim;
2392 im6o->im6o_multicast_loop = IPV6_DEFAULT_MULTICAST_LOOP;
2393 LIST_INIT(&im6o->im6o_memberships);
2394 }
2395
2396 switch (sopt->sopt_name) {
2397
2398 case IPV6_MULTICAST_IF:
2399 /*
2400 * Select the interface for outgoing multicast packets.
2401 */
2402 error = sockopt_get(sopt, &ifindex, sizeof(ifindex));
2403 if (error != 0)
2404 break;
2405
2406 if (ifindex != 0) {
2407 if ((ifp = if_byindex(ifindex)) == NULL) {
2408 error = ENXIO; /* XXX EINVAL? */
2409 break;
2410 }
2411 if ((ifp->if_flags & IFF_MULTICAST) == 0) {
2412 error = EADDRNOTAVAIL;
2413 break;
2414 }
2415 } else
2416 ifp = NULL;
2417 im6o->im6o_multicast_if_index = if_get_index(ifp);
2418 break;
2419
2420 case IPV6_MULTICAST_HOPS:
2421 {
2422 /*
2423 * Set the IP6 hoplimit for outgoing multicast packets.
2424 */
2425 int optval;
2426
2427 error = sockopt_getint(sopt, &optval);
2428 if (error != 0)
2429 break;
2430
2431 if (optval < -1 || optval >= 256)
2432 error = EINVAL;
2433 else if (optval == -1)
2434 im6o->im6o_multicast_hlim = ip6_defmcasthlim;
2435 else
2436 im6o->im6o_multicast_hlim = optval;
2437 break;
2438 }
2439
2440 case IPV6_MULTICAST_LOOP:
2441 /*
2442 * Set the loopback flag for outgoing multicast packets.
2443 * Must be zero or one.
2444 */
2445 error = sockopt_get(sopt, &loop, sizeof(loop));
2446 if (error != 0)
2447 break;
2448 if (loop > 1) {
2449 error = EINVAL;
2450 break;
2451 }
2452 im6o->im6o_multicast_loop = loop;
2453 break;
2454
2455 case IPV6_JOIN_GROUP:
2456 /*
2457 * Add a multicast group membership.
2458 * Group must be a valid IP6 multicast address.
2459 */
2460 if ((error = ip6_get_membership(sopt, &ifp, &ia, sizeof(ia))))
2461 return error;
2462
2463 if (IN6_IS_ADDR_V4MAPPED(&ia)) {
2464 error = ip_setmoptions(&in6p->in6p_v4moptions, sopt);
2465 break;
2466 }
2467 /*
2468 * See if we found an interface, and confirm that it
2469 * supports multicast
2470 */
2471 if (ifp == NULL || (ifp->if_flags & IFF_MULTICAST) == 0) {
2472 error = EADDRNOTAVAIL;
2473 break;
2474 }
2475
2476 if (in6_setscope(&ia, ifp, NULL)) {
2477 error = EADDRNOTAVAIL; /* XXX: should not happen */
2478 break;
2479 }
2480
2481 /*
2482 * See if the membership already exists.
2483 */
2484 for (imm = im6o->im6o_memberships.lh_first;
2485 imm != NULL; imm = imm->i6mm_chain.le_next)
2486 if (imm->i6mm_maddr->in6m_ifp == ifp &&
2487 IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
2488 &ia))
2489 break;
2490 if (imm != NULL) {
2491 error = EADDRINUSE;
2492 break;
2493 }
2494 /*
2495 * Everything looks good; add a new record to the multicast
2496 * address list for the given interface.
2497 */
2498 imm = in6_joingroup(ifp, &ia, &error, 0);
2499 if (imm == NULL)
2500 break;
2501 LIST_INSERT_HEAD(&im6o->im6o_memberships, imm, i6mm_chain);
2502 break;
2503
2504 case IPV6_LEAVE_GROUP:
2505 /*
2506 * Drop a multicast group membership.
2507 * Group must be a valid IP6 multicast address.
2508 */
2509 error = sockopt_get(sopt, &mreq, sizeof(mreq));
2510 if (error != 0)
2511 break;
2512
2513 if (IN6_IS_ADDR_V4MAPPED(&mreq.ipv6mr_multiaddr)) {
2514 error = ip_setmoptions(&in6p->in6p_v4moptions, sopt);
2515 break;
2516 }
2517 /*
2518 * If an interface address was specified, get a pointer
2519 * to its ifnet structure.
2520 */
2521 if (mreq.ipv6mr_interface != 0) {
2522 if ((ifp = if_byindex(mreq.ipv6mr_interface)) == NULL) {
2523 error = ENXIO; /* XXX EINVAL? */
2524 break;
2525 }
2526 } else
2527 ifp = NULL;
2528
2529 /* Fill in the scope zone ID */
2530 if (ifp) {
2531 if (in6_setscope(&mreq.ipv6mr_multiaddr, ifp, NULL)) {
2532 /* XXX: should not happen */
2533 error = EADDRNOTAVAIL;
2534 break;
2535 }
2536 } else if (mreq.ipv6mr_interface != 0) {
2537 /*
2538 * XXX: This case would happens when the (positive)
2539 * index is in the valid range, but the corresponding
2540 * interface has been detached dynamically. The above
2541 * check probably avoids such case to happen here, but
2542 * we check it explicitly for safety.
2543 */
2544 error = EADDRNOTAVAIL;
2545 break;
2546 } else { /* ipv6mr_interface == 0 */
2547 struct sockaddr_in6 sa6_mc;
2548
2549 /*
2550 * The API spec says as follows:
2551 * If the interface index is specified as 0, the
2552 * system may choose a multicast group membership to
2553 * drop by matching the multicast address only.
2554 * On the other hand, we cannot disambiguate the scope
2555 * zone unless an interface is provided. Thus, we
2556 * check if there's ambiguity with the default scope
2557 * zone as the last resort.
2558 */
2559 sockaddr_in6_init(&sa6_mc, &mreq.ipv6mr_multiaddr,
2560 0, 0, 0);
2561 error = sa6_embedscope(&sa6_mc, ip6_use_defzone);
2562 if (error != 0)
2563 break;
2564 mreq.ipv6mr_multiaddr = sa6_mc.sin6_addr;
2565 }
2566
2567 /*
2568 * Find the membership in the membership list.
2569 */
2570 for (imm = im6o->im6o_memberships.lh_first;
2571 imm != NULL; imm = imm->i6mm_chain.le_next) {
2572 if ((ifp == NULL || imm->i6mm_maddr->in6m_ifp == ifp) &&
2573 IN6_ARE_ADDR_EQUAL(&imm->i6mm_maddr->in6m_addr,
2574 &mreq.ipv6mr_multiaddr))
2575 break;
2576 }
2577 if (imm == NULL) {
2578 /* Unable to resolve interface */
2579 error = EADDRNOTAVAIL;
2580 break;
2581 }
2582 /*
2583 * Give up the multicast address record to which the
2584 * membership points.
2585 */
2586 LIST_REMOVE(imm, i6mm_chain);
2587 in6_leavegroup(imm);
2588 break;
2589
2590 default:
2591 error = EOPNOTSUPP;
2592 break;
2593 }
2594
2595 /*
2596 * If all options have default values, no need to keep the mbuf.
2597 */
2598 if (im6o->im6o_multicast_if_index == 0 &&
2599 im6o->im6o_multicast_hlim == ip6_defmcasthlim &&
2600 im6o->im6o_multicast_loop == IPV6_DEFAULT_MULTICAST_LOOP &&
2601 im6o->im6o_memberships.lh_first == NULL) {
2602 free(in6p->in6p_moptions, M_IPMOPTS);
2603 in6p->in6p_moptions = NULL;
2604 }
2605
2606 return (error);
2607 }
2608
2609 /*
2610 * Return the IP6 multicast options in response to user getsockopt().
2611 */
2612 static int
2613 ip6_getmoptions(struct sockopt *sopt, struct in6pcb *in6p)
2614 {
2615 u_int optval;
2616 int error;
2617 struct ip6_moptions *im6o = in6p->in6p_moptions;
2618
2619 switch (sopt->sopt_name) {
2620 case IPV6_MULTICAST_IF:
2621 if (im6o == NULL || im6o->im6o_multicast_if_index == 0)
2622 optval = 0;
2623 else
2624 optval = im6o->im6o_multicast_if_index;
2625
2626 error = sockopt_set(sopt, &optval, sizeof(optval));
2627 break;
2628
2629 case IPV6_MULTICAST_HOPS:
2630 if (im6o == NULL)
2631 optval = ip6_defmcasthlim;
2632 else
2633 optval = im6o->im6o_multicast_hlim;
2634
2635 error = sockopt_set(sopt, &optval, sizeof(optval));
2636 break;
2637
2638 case IPV6_MULTICAST_LOOP:
2639 if (im6o == NULL)
2640 optval = IPV6_DEFAULT_MULTICAST_LOOP;
2641 else
2642 optval = im6o->im6o_multicast_loop;
2643
2644 error = sockopt_set(sopt, &optval, sizeof(optval));
2645 break;
2646
2647 default:
2648 error = EOPNOTSUPP;
2649 }
2650
2651 return (error);
2652 }
2653
2654 /*
2655 * Discard the IP6 multicast options.
2656 */
2657 void
2658 ip6_freemoptions(struct ip6_moptions *im6o)
2659 {
2660 struct in6_multi_mship *imm;
2661
2662 if (im6o == NULL)
2663 return;
2664
2665 while ((imm = im6o->im6o_memberships.lh_first) != NULL) {
2666 LIST_REMOVE(imm, i6mm_chain);
2667 in6_leavegroup(imm);
2668 }
2669 free(im6o, M_IPMOPTS);
2670 }
2671
2672 /*
2673 * Set IPv6 outgoing packet options based on advanced API.
2674 */
2675 int
2676 ip6_setpktopts(struct mbuf *control, struct ip6_pktopts *opt,
2677 struct ip6_pktopts *stickyopt, kauth_cred_t cred, int uproto)
2678 {
2679 struct cmsghdr *cm = 0;
2680
2681 if (control == NULL || opt == NULL)
2682 return (EINVAL);
2683
2684 ip6_initpktopts(opt);
2685 if (stickyopt) {
2686 int error;
2687
2688 /*
2689 * If stickyopt is provided, make a local copy of the options
2690 * for this particular packet, then override them by ancillary
2691 * objects.
2692 * XXX: copypktopts() does not copy the cached route to a next
2693 * hop (if any). This is not very good in terms of efficiency,
2694 * but we can allow this since this option should be rarely
2695 * used.
2696 */
2697 if ((error = copypktopts(opt, stickyopt, M_NOWAIT)) != 0)
2698 return (error);
2699 }
2700
2701 /*
2702 * XXX: Currently, we assume all the optional information is stored
2703 * in a single mbuf.
2704 */
2705 if (control->m_next)
2706 return (EINVAL);
2707
2708 /* XXX if cm->cmsg_len is not aligned, control->m_len can become <0 */
2709 for (; control->m_len > 0; control->m_data += CMSG_ALIGN(cm->cmsg_len),
2710 control->m_len -= CMSG_ALIGN(cm->cmsg_len)) {
2711 int error;
2712
2713 if (control->m_len < CMSG_LEN(0))
2714 return (EINVAL);
2715
2716 cm = mtod(control, struct cmsghdr *);
2717 if (cm->cmsg_len == 0 || cm->cmsg_len > control->m_len)
2718 return (EINVAL);
2719 if (cm->cmsg_level != IPPROTO_IPV6)
2720 continue;
2721
2722 error = ip6_setpktopt(cm->cmsg_type, CMSG_DATA(cm),
2723 cm->cmsg_len - CMSG_LEN(0), opt, cred, 0, 1, uproto);
2724 if (error)
2725 return (error);
2726 }
2727
2728 return (0);
2729 }
2730
2731 /*
2732 * Set a particular packet option, as a sticky option or an ancillary data
2733 * item. "len" can be 0 only when it's a sticky option.
2734 * We have 4 cases of combination of "sticky" and "cmsg":
2735 * "sticky=0, cmsg=0": impossible
2736 * "sticky=0, cmsg=1": RFC2292 or RFC3542 ancillary data
2737 * "sticky=1, cmsg=0": RFC3542 socket option
2738 * "sticky=1, cmsg=1": RFC2292 socket option
2739 */
2740 static int
2741 ip6_setpktopt(int optname, u_char *buf, int len, struct ip6_pktopts *opt,
2742 kauth_cred_t cred, int sticky, int cmsg, int uproto)
2743 {
2744 int minmtupolicy;
2745 int error;
2746
2747 if (!sticky && !cmsg) {
2748 #ifdef DIAGNOSTIC
2749 printf("ip6_setpktopt: impossible case\n");
2750 #endif
2751 return (EINVAL);
2752 }
2753
2754 /*
2755 * IPV6_2292xxx is for backward compatibility to RFC2292, and should
2756 * not be specified in the context of RFC3542. Conversely,
2757 * RFC3542 types should not be specified in the context of RFC2292.
2758 */
2759 if (!cmsg) {
2760 switch (optname) {
2761 case IPV6_2292PKTINFO:
2762 case IPV6_2292HOPLIMIT:
2763 case IPV6_2292NEXTHOP:
2764 case IPV6_2292HOPOPTS:
2765 case IPV6_2292DSTOPTS:
2766 case IPV6_2292RTHDR:
2767 case IPV6_2292PKTOPTIONS:
2768 return (ENOPROTOOPT);
2769 }
2770 }
2771 if (sticky && cmsg) {
2772 switch (optname) {
2773 case IPV6_PKTINFO:
2774 case IPV6_HOPLIMIT:
2775 case IPV6_NEXTHOP:
2776 case IPV6_HOPOPTS:
2777 case IPV6_DSTOPTS:
2778 case IPV6_RTHDRDSTOPTS:
2779 case IPV6_RTHDR:
2780 case IPV6_USE_MIN_MTU:
2781 case IPV6_DONTFRAG:
2782 case IPV6_OTCLASS:
2783 case IPV6_TCLASS:
2784 case IPV6_PREFER_TEMPADDR: /* XXX not an RFC3542 option */
2785 return (ENOPROTOOPT);
2786 }
2787 }
2788
2789 switch (optname) {
2790 #ifdef RFC2292
2791 case IPV6_2292PKTINFO:
2792 #endif
2793 case IPV6_PKTINFO:
2794 {
2795 struct in6_pktinfo *pktinfo;
2796
2797 if (len != sizeof(struct in6_pktinfo))
2798 return (EINVAL);
2799
2800 pktinfo = (struct in6_pktinfo *)buf;
2801
2802 /*
2803 * An application can clear any sticky IPV6_PKTINFO option by
2804 * doing a "regular" setsockopt with ipi6_addr being
2805 * in6addr_any and ipi6_ifindex being zero.
2806 * [RFC 3542, Section 6]
2807 */
2808 if (optname == IPV6_PKTINFO && opt->ip6po_pktinfo &&
2809 pktinfo->ipi6_ifindex == 0 &&
2810 IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
2811 ip6_clearpktopts(opt, optname);
2812 break;
2813 }
2814
2815 if (uproto == IPPROTO_TCP && optname == IPV6_PKTINFO &&
2816 sticky && !IN6_IS_ADDR_UNSPECIFIED(&pktinfo->ipi6_addr)) {
2817 return (EINVAL);
2818 }
2819
2820 /* Validate the interface index if specified. */
2821 if (pktinfo->ipi6_ifindex) {
2822 struct ifnet *ifp;
2823 int s = pserialize_read_enter();
2824 ifp = if_byindex(pktinfo->ipi6_ifindex);
2825 if (ifp == NULL) {
2826 pserialize_read_exit(s);
2827 return ENXIO;
2828 }
2829 pserialize_read_exit(s);
2830 }
2831
2832 /*
2833 * We store the address anyway, and let in6_selectsrc()
2834 * validate the specified address. This is because ipi6_addr
2835 * may not have enough information about its scope zone, and
2836 * we may need additional information (such as outgoing
2837 * interface or the scope zone of a destination address) to
2838 * disambiguate the scope.
2839 * XXX: the delay of the validation may confuse the
2840 * application when it is used as a sticky option.
2841 */
2842 if (opt->ip6po_pktinfo == NULL) {
2843 opt->ip6po_pktinfo = malloc(sizeof(*pktinfo),
2844 M_IP6OPT, M_NOWAIT);
2845 if (opt->ip6po_pktinfo == NULL)
2846 return (ENOBUFS);
2847 }
2848 memcpy(opt->ip6po_pktinfo, pktinfo, sizeof(*pktinfo));
2849 break;
2850 }
2851
2852 #ifdef RFC2292
2853 case IPV6_2292HOPLIMIT:
2854 #endif
2855 case IPV6_HOPLIMIT:
2856 {
2857 int *hlimp;
2858
2859 /*
2860 * RFC 3542 deprecated the usage of sticky IPV6_HOPLIMIT
2861 * to simplify the ordering among hoplimit options.
2862 */
2863 if (optname == IPV6_HOPLIMIT && sticky)
2864 return (ENOPROTOOPT);
2865
2866 if (len != sizeof(int))
2867 return (EINVAL);
2868 hlimp = (int *)buf;
2869 if (*hlimp < -1 || *hlimp > 255)
2870 return (EINVAL);
2871
2872 opt->ip6po_hlim = *hlimp;
2873 break;
2874 }
2875
2876 case IPV6_OTCLASS:
2877 if (len != sizeof(u_int8_t))
2878 return (EINVAL);
2879
2880 opt->ip6po_tclass = *(u_int8_t *)buf;
2881 break;
2882
2883 case IPV6_TCLASS:
2884 {
2885 int tclass;
2886
2887 if (len != sizeof(int))
2888 return (EINVAL);
2889 tclass = *(int *)buf;
2890 if (tclass < -1 || tclass > 255)
2891 return (EINVAL);
2892
2893 opt->ip6po_tclass = tclass;
2894 break;
2895 }
2896
2897 #ifdef RFC2292
2898 case IPV6_2292NEXTHOP:
2899 #endif
2900 case IPV6_NEXTHOP:
2901 error = kauth_authorize_network(cred, KAUTH_NETWORK_IPV6,
2902 KAUTH_REQ_NETWORK_IPV6_HOPBYHOP, NULL, NULL, NULL);
2903 if (error)
2904 return (error);
2905
2906 if (len == 0) { /* just remove the option */
2907 ip6_clearpktopts(opt, IPV6_NEXTHOP);
2908 break;
2909 }
2910
2911 /* check if cmsg_len is large enough for sa_len */
2912 if (len < sizeof(struct sockaddr) || len < *buf)
2913 return (EINVAL);
2914
2915 switch (((struct sockaddr *)buf)->sa_family) {
2916 case AF_INET6:
2917 {
2918 struct sockaddr_in6 *sa6 = (struct sockaddr_in6 *)buf;
2919
2920 if (sa6->sin6_len != sizeof(struct sockaddr_in6))
2921 return (EINVAL);
2922
2923 if (IN6_IS_ADDR_UNSPECIFIED(&sa6->sin6_addr) ||
2924 IN6_IS_ADDR_MULTICAST(&sa6->sin6_addr)) {
2925 return (EINVAL);
2926 }
2927 if ((error = sa6_embedscope(sa6, ip6_use_defzone))
2928 != 0) {
2929 return (error);
2930 }
2931 break;
2932 }
2933 case AF_LINK: /* eventually be supported? */
2934 default:
2935 return (EAFNOSUPPORT);
2936 }
2937
2938 /* turn off the previous option, then set the new option. */
2939 ip6_clearpktopts(opt, IPV6_NEXTHOP);
2940 opt->ip6po_nexthop = malloc(*buf, M_IP6OPT, M_NOWAIT);
2941 if (opt->ip6po_nexthop == NULL)
2942 return (ENOBUFS);
2943 memcpy(opt->ip6po_nexthop, buf, *buf);
2944 break;
2945
2946 #ifdef RFC2292
2947 case IPV6_2292HOPOPTS:
2948 #endif
2949 case IPV6_HOPOPTS:
2950 {
2951 struct ip6_hbh *hbh;
2952 int hbhlen;
2953
2954 /*
2955 * XXX: We don't allow a non-privileged user to set ANY HbH
2956 * options, since per-option restriction has too much
2957 * overhead.
2958 */
2959 error = kauth_authorize_network(cred, KAUTH_NETWORK_IPV6,
2960 KAUTH_REQ_NETWORK_IPV6_HOPBYHOP, NULL, NULL, NULL);
2961 if (error)
2962 return (error);
2963
2964 if (len == 0) {
2965 ip6_clearpktopts(opt, IPV6_HOPOPTS);
2966 break; /* just remove the option */
2967 }
2968
2969 /* message length validation */
2970 if (len < sizeof(struct ip6_hbh))
2971 return (EINVAL);
2972 hbh = (struct ip6_hbh *)buf;
2973 hbhlen = (hbh->ip6h_len + 1) << 3;
2974 if (len != hbhlen)
2975 return (EINVAL);
2976
2977 /* turn off the previous option, then set the new option. */
2978 ip6_clearpktopts(opt, IPV6_HOPOPTS);
2979 opt->ip6po_hbh = malloc(hbhlen, M_IP6OPT, M_NOWAIT);
2980 if (opt->ip6po_hbh == NULL)
2981 return (ENOBUFS);
2982 memcpy(opt->ip6po_hbh, hbh, hbhlen);
2983
2984 break;
2985 }
2986
2987 #ifdef RFC2292
2988 case IPV6_2292DSTOPTS:
2989 #endif
2990 case IPV6_DSTOPTS:
2991 case IPV6_RTHDRDSTOPTS:
2992 {
2993 struct ip6_dest *dest, **newdest = NULL;
2994 int destlen;
2995
2996 /* XXX: see the comment for IPV6_HOPOPTS */
2997 error = kauth_authorize_network(cred, KAUTH_NETWORK_IPV6,
2998 KAUTH_REQ_NETWORK_IPV6_HOPBYHOP, NULL, NULL, NULL);
2999 if (error)
3000 return (error);
3001
3002 if (len == 0) {
3003 ip6_clearpktopts(opt, optname);
3004 break; /* just remove the option */
3005 }
3006
3007 /* message length validation */
3008 if (len < sizeof(struct ip6_dest))
3009 return (EINVAL);
3010 dest = (struct ip6_dest *)buf;
3011 destlen = (dest->ip6d_len + 1) << 3;
3012 if (len != destlen)
3013 return (EINVAL);
3014 /*
3015 * Determine the position that the destination options header
3016 * should be inserted; before or after the routing header.
3017 */
3018 switch (optname) {
3019 case IPV6_2292DSTOPTS:
3020 /*
3021 * The old advanced API is ambiguous on this point.
3022 * Our approach is to determine the position based
3023 * according to the existence of a routing header.
3024 * Note, however, that this depends on the order of the
3025 * extension headers in the ancillary data; the 1st
3026 * part of the destination options header must appear
3027 * before the routing header in the ancillary data,
3028 * too.
3029 * RFC3542 solved the ambiguity by introducing
3030 * separate ancillary data or option types.
3031 */
3032 if (opt->ip6po_rthdr == NULL)
3033 newdest = &opt->ip6po_dest1;
3034 else
3035 newdest = &opt->ip6po_dest2;
3036 break;
3037 case IPV6_RTHDRDSTOPTS:
3038 newdest = &opt->ip6po_dest1;
3039 break;
3040 case IPV6_DSTOPTS:
3041 newdest = &opt->ip6po_dest2;
3042 break;
3043 }
3044
3045 /* turn off the previous option, then set the new option. */
3046 ip6_clearpktopts(opt, optname);
3047 *newdest = malloc(destlen, M_IP6OPT, M_NOWAIT);
3048 if (*newdest == NULL)
3049 return (ENOBUFS);
3050 memcpy(*newdest, dest, destlen);
3051
3052 break;
3053 }
3054
3055 #ifdef RFC2292
3056 case IPV6_2292RTHDR:
3057 #endif
3058 case IPV6_RTHDR:
3059 {
3060 struct ip6_rthdr *rth;
3061 int rthlen;
3062
3063 if (len == 0) {
3064 ip6_clearpktopts(opt, IPV6_RTHDR);
3065 break; /* just remove the option */
3066 }
3067
3068 /* message length validation */
3069 if (len < sizeof(struct ip6_rthdr))
3070 return (EINVAL);
3071 rth = (struct ip6_rthdr *)buf;
3072 rthlen = (rth->ip6r_len + 1) << 3;
3073 if (len != rthlen)
3074 return (EINVAL);
3075 switch (rth->ip6r_type) {
3076 case IPV6_RTHDR_TYPE_0:
3077 if (rth->ip6r_len == 0) /* must contain one addr */
3078 return (EINVAL);
3079 if (rth->ip6r_len % 2) /* length must be even */
3080 return (EINVAL);
3081 if (rth->ip6r_len / 2 != rth->ip6r_segleft)
3082 return (EINVAL);
3083 break;
3084 default:
3085 return (EINVAL); /* not supported */
3086 }
3087 /* turn off the previous option */
3088 ip6_clearpktopts(opt, IPV6_RTHDR);
3089 opt->ip6po_rthdr = malloc(rthlen, M_IP6OPT, M_NOWAIT);
3090 if (opt->ip6po_rthdr == NULL)
3091 return (ENOBUFS);
3092 memcpy(opt->ip6po_rthdr, rth, rthlen);
3093 break;
3094 }
3095
3096 case IPV6_USE_MIN_MTU:
3097 if (len != sizeof(int))
3098 return (EINVAL);
3099 minmtupolicy = *(int *)buf;
3100 if (minmtupolicy != IP6PO_MINMTU_MCASTONLY &&
3101 minmtupolicy != IP6PO_MINMTU_DISABLE &&
3102 minmtupolicy != IP6PO_MINMTU_ALL) {
3103 return (EINVAL);
3104 }
3105 opt->ip6po_minmtu = minmtupolicy;
3106 break;
3107
3108 case IPV6_DONTFRAG:
3109 if (len != sizeof(int))
3110 return (EINVAL);
3111
3112 if (uproto == IPPROTO_TCP || *(int *)buf == 0) {
3113 /*
3114 * we ignore this option for TCP sockets.
3115 * (RFC3542 leaves this case unspecified.)
3116 */
3117 opt->ip6po_flags &= ~IP6PO_DONTFRAG;
3118 } else
3119 opt->ip6po_flags |= IP6PO_DONTFRAG;
3120 break;
3121
3122 case IPV6_PREFER_TEMPADDR:
3123 {
3124 int preftemp;
3125
3126 if (len != sizeof(int))
3127 return (EINVAL);
3128 preftemp = *(int *)buf;
3129 switch (preftemp) {
3130 case IP6PO_TEMPADDR_SYSTEM:
3131 case IP6PO_TEMPADDR_NOTPREFER:
3132 case IP6PO_TEMPADDR_PREFER:
3133 break;
3134 default:
3135 return (EINVAL);
3136 }
3137 opt->ip6po_prefer_tempaddr = preftemp;
3138 break;
3139 }
3140
3141 default:
3142 return (ENOPROTOOPT);
3143 } /* end of switch */
3144
3145 return (0);
3146 }
3147
3148 /*
3149 * Routine called from ip6_output() to loop back a copy of an IP6 multicast
3150 * packet to the input queue of a specified interface. Note that this
3151 * calls the output routine of the loopback "driver", but with an interface
3152 * pointer that might NOT be lo0ifp -- easier than replicating that code here.
3153 */
3154 void
3155 ip6_mloopback(struct ifnet *ifp, struct mbuf *m,
3156 const struct sockaddr_in6 *dst)
3157 {
3158 struct mbuf *copym;
3159 struct ip6_hdr *ip6;
3160
3161 copym = m_copy(m, 0, M_COPYALL);
3162 if (copym == NULL)
3163 return;
3164
3165 /*
3166 * Make sure to deep-copy IPv6 header portion in case the data
3167 * is in an mbuf cluster, so that we can safely override the IPv6
3168 * header portion later.
3169 */
3170 if ((copym->m_flags & M_EXT) != 0 ||
3171 copym->m_len < sizeof(struct ip6_hdr)) {
3172 copym = m_pullup(copym, sizeof(struct ip6_hdr));
3173 if (copym == NULL)
3174 return;
3175 }
3176
3177 #ifdef DIAGNOSTIC
3178 if (copym->m_len < sizeof(*ip6)) {
3179 m_freem(copym);
3180 return;
3181 }
3182 #endif
3183
3184 ip6 = mtod(copym, struct ip6_hdr *);
3185 /*
3186 * clear embedded scope identifiers if necessary.
3187 * in6_clearscope will touch the addresses only when necessary.
3188 */
3189 in6_clearscope(&ip6->ip6_src);
3190 in6_clearscope(&ip6->ip6_dst);
3191
3192 (void)looutput(ifp, copym, (const struct sockaddr *)dst, NULL);
3193 }
3194
3195 /*
3196 * Chop IPv6 header off from the payload.
3197 */
3198 static int
3199 ip6_splithdr(struct mbuf *m, struct ip6_exthdrs *exthdrs)
3200 {
3201 struct mbuf *mh;
3202 struct ip6_hdr *ip6;
3203
3204 ip6 = mtod(m, struct ip6_hdr *);
3205 if (m->m_len > sizeof(*ip6)) {
3206 MGETHDR(mh, M_DONTWAIT, MT_HEADER);
3207 if (mh == 0) {
3208 m_freem(m);
3209 return ENOBUFS;
3210 }
3211 M_MOVE_PKTHDR(mh, m);
3212 MH_ALIGN(mh, sizeof(*ip6));
3213 m->m_len -= sizeof(*ip6);
3214 m->m_data += sizeof(*ip6);
3215 mh->m_next = m;
3216 m = mh;
3217 m->m_len = sizeof(*ip6);
3218 bcopy((void *)ip6, mtod(m, void *), sizeof(*ip6));
3219 }
3220 exthdrs->ip6e_ip6 = m;
3221 return 0;
3222 }
3223
3224 /*
3225 * Compute IPv6 extension header length.
3226 */
3227 int
3228 ip6_optlen(struct in6pcb *in6p)
3229 {
3230 int len;
3231
3232 if (!in6p->in6p_outputopts)
3233 return 0;
3234
3235 len = 0;
3236 #define elen(x) \
3237 (((struct ip6_ext *)(x)) ? (((struct ip6_ext *)(x))->ip6e_len + 1) << 3 : 0)
3238
3239 len += elen(in6p->in6p_outputopts->ip6po_hbh);
3240 len += elen(in6p->in6p_outputopts->ip6po_dest1);
3241 len += elen(in6p->in6p_outputopts->ip6po_rthdr);
3242 len += elen(in6p->in6p_outputopts->ip6po_dest2);
3243 return len;
3244 #undef elen
3245 }
3246