Home | History | Annotate | Line # | Download | only in netinet6
mld6.c revision 1.40
      1 /*	$NetBSD: mld6.c,v 1.40 2007/08/31 21:40:41 dyoung Exp $	*/
      2 /*	$KAME: mld6.c,v 1.25 2001/01/16 14:14:18 itojun Exp $	*/
      3 
      4 /*
      5  * Copyright (C) 1998 WIDE Project.
      6  * All rights reserved.
      7  *
      8  * Redistribution and use in source and binary forms, with or without
      9  * modification, are permitted provided that the following conditions
     10  * are met:
     11  * 1. Redistributions of source code must retain the above copyright
     12  *    notice, this list of conditions and the following disclaimer.
     13  * 2. Redistributions in binary form must reproduce the above copyright
     14  *    notice, this list of conditions and the following disclaimer in the
     15  *    documentation and/or other materials provided with the distribution.
     16  * 3. Neither the name of the project nor the names of its contributors
     17  *    may be used to endorse or promote products derived from this software
     18  *    without specific prior written permission.
     19  *
     20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
     21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
     24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     30  * SUCH DAMAGE.
     31  */
     32 
     33 /*
     34  * Copyright (c) 1992, 1993
     35  *	The Regents of the University of California.  All rights reserved.
     36  *
     37  * This code is derived from software contributed to Berkeley by
     38  * Stephen Deering of Stanford University.
     39  *
     40  * Redistribution and use in source and binary forms, with or without
     41  * modification, are permitted provided that the following conditions
     42  * are met:
     43  * 1. Redistributions of source code must retain the above copyright
     44  *    notice, this list of conditions and the following disclaimer.
     45  * 2. Redistributions in binary form must reproduce the above copyright
     46  *    notice, this list of conditions and the following disclaimer in the
     47  *    documentation and/or other materials provided with the distribution.
     48  * 3. Neither the name of the University nor the names of its contributors
     49  *    may be used to endorse or promote products derived from this software
     50  *    without specific prior written permission.
     51  *
     52  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
     53  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     54  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     55  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
     56  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     57  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     58  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     59  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     60  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     61  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     62  * SUCH DAMAGE.
     63  *
     64  *	@(#)igmp.c	8.1 (Berkeley) 7/19/93
     65  */
     66 
     67 /*
     68  * Copyright (c) 1988 Stephen Deering.
     69  *
     70  * This code is derived from software contributed to Berkeley by
     71  * Stephen Deering of Stanford University.
     72  *
     73  * Redistribution and use in source and binary forms, with or without
     74  * modification, are permitted provided that the following conditions
     75  * are met:
     76  * 1. Redistributions of source code must retain the above copyright
     77  *    notice, this list of conditions and the following disclaimer.
     78  * 2. Redistributions in binary form must reproduce the above copyright
     79  *    notice, this list of conditions and the following disclaimer in the
     80  *    documentation and/or other materials provided with the distribution.
     81  * 3. All advertising materials mentioning features or use of this software
     82  *    must display the following acknowledgement:
     83  *	This product includes software developed by the University of
     84  *	California, Berkeley and its contributors.
     85  * 4. Neither the name of the University nor the names of its contributors
     86  *    may be used to endorse or promote products derived from this software
     87  *    without specific prior written permission.
     88  *
     89  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
     90  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     91  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     92  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
     93  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     94  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     95  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     96  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     97  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     98  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     99  * SUCH DAMAGE.
    100  *
    101  *	@(#)igmp.c	8.1 (Berkeley) 7/19/93
    102  */
    103 
    104 #include <sys/cdefs.h>
    105 __KERNEL_RCSID(0, "$NetBSD: mld6.c,v 1.40 2007/08/31 21:40:41 dyoung Exp $");
    106 
    107 #include "opt_inet.h"
    108 
    109 #include <sys/param.h>
    110 #include <sys/systm.h>
    111 #include <sys/mbuf.h>
    112 #include <sys/socket.h>
    113 #include <sys/protosw.h>
    114 #include <sys/syslog.h>
    115 #include <sys/sysctl.h>
    116 #include <sys/kernel.h>
    117 #include <sys/callout.h>
    118 
    119 #include <net/if.h>
    120 
    121 #include <netinet/in.h>
    122 #include <netinet/in_var.h>
    123 #include <netinet6/in6_var.h>
    124 #include <netinet/ip6.h>
    125 #include <netinet6/ip6_var.h>
    126 #include <netinet6/scope6_var.h>
    127 #include <netinet/icmp6.h>
    128 #include <netinet6/mld6_var.h>
    129 
    130 #include <net/net_osdep.h>
    131 
    132 
    133 /*
    134  * This structure is used to keep track of in6_multi chains which belong to
    135  * deleted interface addresses.
    136  */
    137 static LIST_HEAD(, multi6_kludge) in6_mk; /* XXX BSS initialization */
    138 
    139 struct multi6_kludge {
    140 	LIST_ENTRY(multi6_kludge) mk_entry;
    141 	struct ifnet *mk_ifp;
    142 	struct in6_multihead mk_head;
    143 };
    144 
    145 
    146 /*
    147  * Protocol constants
    148  */
    149 
    150 /*
    151  * time between repetitions of a node's initial report of interest in a
    152  * multicast address(in seconds)
    153  */
    154 #define MLD_UNSOLICITED_REPORT_INTERVAL	10
    155 
    156 static struct ip6_pktopts ip6_opts;
    157 
    158 static void mld_start_listening(struct in6_multi *);
    159 static void mld_stop_listening(struct in6_multi *);
    160 
    161 static struct mld_hdr * mld_allocbuf(struct mbuf **, int, struct in6_multi *,
    162 	int);
    163 static void mld_sendpkt(struct in6_multi *, int, const struct in6_addr *);
    164 static void mld_starttimer(struct in6_multi *);
    165 static void mld_stoptimer(struct in6_multi *);
    166 static void mld_timeo(struct in6_multi *);
    167 static u_long mld_timerresid(struct in6_multi *);
    168 
    169 void
    170 mld_init()
    171 {
    172 	static u_int8_t hbh_buf[8];
    173 	struct ip6_hbh *hbh = (struct ip6_hbh *)hbh_buf;
    174 	u_int16_t rtalert_code = htons((u_int16_t)IP6OPT_RTALERT_MLD);
    175 
    176 	/* ip6h_nxt will be fill in later */
    177 	hbh->ip6h_len = 0;	/* (8 >> 3) - 1 */
    178 
    179 	/* XXX: grotty hard coding... */
    180 	hbh_buf[2] = IP6OPT_PADN;	/* 2 byte padding */
    181 	hbh_buf[3] = 0;
    182 	hbh_buf[4] = IP6OPT_RTALERT;
    183 	hbh_buf[5] = IP6OPT_RTALERT_LEN - 2;
    184 	bcopy((void *)&rtalert_code, &hbh_buf[6], sizeof(u_int16_t));
    185 
    186 	ip6_opts.ip6po_hbh = hbh;
    187 	/* We will specify the hoplimit by a multicast option. */
    188 	ip6_opts.ip6po_hlim = -1;
    189 }
    190 
    191 static void
    192 mld_starttimer(struct in6_multi *in6m)
    193 {
    194 	struct timeval now;
    195 
    196 	microtime(&now);
    197 	in6m->in6m_timer_expire.tv_sec = now.tv_sec + in6m->in6m_timer / hz;
    198 	in6m->in6m_timer_expire.tv_usec = now.tv_usec +
    199 	    (in6m->in6m_timer % hz) * (1000000 / hz);
    200 	if (in6m->in6m_timer_expire.tv_usec > 1000000) {
    201 		in6m->in6m_timer_expire.tv_sec++;
    202 		in6m->in6m_timer_expire.tv_usec -= 1000000;
    203 	}
    204 
    205 	/* start or restart the timer */
    206 	callout_reset(in6m->in6m_timer_ch, in6m->in6m_timer,
    207 	    (void (*) __P((void *)))mld_timeo, in6m);
    208 }
    209 
    210 static void
    211 mld_stoptimer(struct in6_multi *in6m)
    212 {
    213 	if (in6m->in6m_timer == IN6M_TIMER_UNDEF)
    214 		return;
    215 
    216 	callout_stop(in6m->in6m_timer_ch);
    217 
    218 	in6m->in6m_timer = IN6M_TIMER_UNDEF;
    219 }
    220 
    221 static void
    222 mld_timeo(struct in6_multi *in6m)
    223 {
    224 	int s = splsoftnet();
    225 
    226 	in6m->in6m_timer = IN6M_TIMER_UNDEF;
    227 
    228 	callout_stop(in6m->in6m_timer_ch);
    229 
    230 	switch (in6m->in6m_state) {
    231 	case MLD_REPORTPENDING:
    232 		mld_start_listening(in6m);
    233 		break;
    234 	default:
    235 		mld_sendpkt(in6m, MLD_LISTENER_REPORT, NULL);
    236 		break;
    237 	}
    238 
    239 	splx(s);
    240 }
    241 
    242 static u_long
    243 mld_timerresid(struct in6_multi *in6m)
    244 {
    245 	struct timeval now, diff;
    246 
    247 	microtime(&now);
    248 
    249 	if (now.tv_sec > in6m->in6m_timer_expire.tv_sec ||
    250 	    (now.tv_sec == in6m->in6m_timer_expire.tv_sec &&
    251 	    now.tv_usec > in6m->in6m_timer_expire.tv_usec)) {
    252 		return (0);
    253 	}
    254 	diff = in6m->in6m_timer_expire;
    255 	diff.tv_sec -= now.tv_sec;
    256 	diff.tv_usec -= now.tv_usec;
    257 	if (diff.tv_usec < 0) {
    258 		diff.tv_sec--;
    259 		diff.tv_usec += 1000000;
    260 	}
    261 
    262 	/* return the remaining time in milliseconds */
    263 	return (((u_long)(diff.tv_sec * 1000000 + diff.tv_usec)) / 1000);
    264 }
    265 
    266 static void
    267 mld_start_listening(struct in6_multi *in6m)
    268 {
    269 	struct in6_addr all_in6;
    270 
    271 	/*
    272 	 * RFC2710 page 10:
    273 	 * The node never sends a Report or Done for the link-scope all-nodes
    274 	 * address.
    275 	 * MLD messages are never sent for multicast addresses whose scope is 0
    276 	 * (reserved) or 1 (node-local).
    277 	 */
    278 	all_in6 = in6addr_linklocal_allnodes;
    279 	if (in6_setscope(&all_in6, in6m->in6m_ifp, NULL)) {
    280 		/* XXX: this should not happen! */
    281 		in6m->in6m_timer = 0;
    282 		in6m->in6m_state = MLD_OTHERLISTENER;
    283 	}
    284 	if (IN6_ARE_ADDR_EQUAL(&in6m->in6m_addr, &all_in6) ||
    285 	    IPV6_ADDR_MC_SCOPE(&in6m->in6m_addr) < IPV6_ADDR_SCOPE_LINKLOCAL) {
    286 		in6m->in6m_timer = IN6M_TIMER_UNDEF;
    287 		in6m->in6m_state = MLD_OTHERLISTENER;
    288 	} else {
    289 		mld_sendpkt(in6m, MLD_LISTENER_REPORT, NULL);
    290 		in6m->in6m_timer = arc4random() %
    291 		    (MLD_UNSOLICITED_REPORT_INTERVAL * hz);
    292 		in6m->in6m_state = MLD_IREPORTEDLAST;
    293 
    294 		mld_starttimer(in6m);
    295 	}
    296 }
    297 
    298 static void
    299 mld_stop_listening(struct in6_multi *in6m)
    300 {
    301 	struct in6_addr allnode, allrouter;
    302 
    303 	allnode = in6addr_linklocal_allnodes;
    304 	if (in6_setscope(&allnode, in6m->in6m_ifp, NULL)) {
    305 		/* XXX: this should not happen! */
    306 		return;
    307 	}
    308 	allrouter = in6addr_linklocal_allrouters;
    309 	if (in6_setscope(&allrouter, in6m->in6m_ifp, NULL)) {
    310 		/* XXX impossible */
    311 		return;
    312 	}
    313 
    314 	if (in6m->in6m_state == MLD_IREPORTEDLAST &&
    315 	    (!IN6_ARE_ADDR_EQUAL(&in6m->in6m_addr, &allnode)) &&
    316 	    IPV6_ADDR_MC_SCOPE(&in6m->in6m_addr) >
    317 	    IPV6_ADDR_SCOPE_INTFACELOCAL) {
    318 		mld_sendpkt(in6m, MLD_LISTENER_DONE, &allrouter);
    319 	}
    320 }
    321 
    322 void
    323 mld_input(struct mbuf *m, int off)
    324 {
    325 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
    326 	struct mld_hdr *mldh;
    327 	struct ifnet *ifp = m->m_pkthdr.rcvif;
    328 	struct in6_multi *in6m = NULL;
    329 	struct in6_addr mld_addr, all_in6;
    330 	struct in6_ifaddr *ia;
    331 	int timer = 0;		/* timer value in the MLD query header */
    332 
    333 	IP6_EXTHDR_GET(mldh, struct mld_hdr *, m, off, sizeof(*mldh));
    334 	if (mldh == NULL) {
    335 		icmp6stat.icp6s_tooshort++;
    336 		return;
    337 	}
    338 
    339 	/* source address validation */
    340 	ip6 = mtod(m, struct ip6_hdr *);/* in case mpullup */
    341 	if (!IN6_IS_ADDR_LINKLOCAL(&ip6->ip6_src)) {
    342 		/*
    343 		 * RFC3590 allows the IPv6 unspecified address as the source
    344 		 * address of MLD report and done messages.  However, as this
    345 		 * same document says, this special rule is for snooping
    346 		 * switches and the RFC requires routers to discard MLD packets
    347 		 * with the unspecified source address.  The RFC only talks
    348 		 * about hosts receiving an MLD query or report in Security
    349 		 * Considerations, but this is probably the correct intention.
    350 		 * RFC3590 does not talk about other cases than link-local and
    351 		 * the unspecified source addresses, but we believe the same
    352 		 * rule should be applied.
    353 		 * As a result, we only allow link-local addresses as the
    354 		 * source address; otherwise, simply discard the packet.
    355 		 */
    356 #if 0
    357 		/*
    358 		 * XXX: do not log in an input path to avoid log flooding,
    359 		 * though RFC3590 says "SHOULD log" if the source of a query
    360 		 * is the unspecified address.
    361 		 */
    362 		log(LOG_INFO,
    363 		    "mld_input: src %s is not link-local (grp=%s)\n",
    364 		    ip6_sprintf(&ip6->ip6_src), ip6_sprintf(&mldh->mld_addr));
    365 #endif
    366 		m_freem(m);
    367 		return;
    368 	}
    369 
    370 	/*
    371 	 * make a copy for local work (in6_setscope() may modify the 1st arg)
    372 	 */
    373 	mld_addr = mldh->mld_addr;
    374 	if (in6_setscope(&mld_addr, ifp, NULL)) {
    375 		/* XXX: this should not happen! */
    376 		m_free(m);
    377 		return;
    378 	}
    379 
    380 	/*
    381 	 * In the MLD specification, there are 3 states and a flag.
    382 	 *
    383 	 * In Non-Listener state, we simply don't have a membership record.
    384 	 * In Delaying Listener state, our timer is running (in6m->in6m_timer)
    385 	 * In Idle Listener state, our timer is not running
    386 	 * (in6m->in6m_timer==IN6M_TIMER_UNDEF)
    387 	 *
    388 	 * The flag is in6m->in6m_state, it is set to MLD_OTHERLISTENER if
    389 	 * we have heard a report from another member, or MLD_IREPORTEDLAST
    390 	 * if we sent the last report.
    391 	 */
    392 	switch (mldh->mld_type) {
    393 	case MLD_LISTENER_QUERY:
    394 		if (ifp->if_flags & IFF_LOOPBACK)
    395 			break;
    396 
    397 		if (!IN6_IS_ADDR_UNSPECIFIED(&mld_addr) &&
    398 		    !IN6_IS_ADDR_MULTICAST(&mld_addr))
    399 			break;	/* print error or log stat? */
    400 
    401 		all_in6 = in6addr_linklocal_allnodes;
    402 		if (in6_setscope(&all_in6, ifp, NULL)) {
    403 			/* XXX: this should not happen! */
    404 			break;
    405 		}
    406 
    407 		/*
    408 		 * - Start the timers in all of our membership records
    409 		 *   that the query applies to for the interface on
    410 		 *   which the query arrived excl. those that belong
    411 		 *   to the "all-nodes" group (ff02::1).
    412 		 * - Restart any timer that is already running but has
    413 		 *   a value longer than the requested timeout.
    414 		 * - Use the value specified in the query message as
    415 		 *   the maximum timeout.
    416 		 */
    417 		timer = ntohs(mldh->mld_maxdelay);
    418 
    419 		IFP_TO_IA6(ifp, ia);
    420 		if (ia == NULL)
    421 			break;
    422 
    423 		LIST_FOREACH(in6m, &ia->ia6_multiaddrs, in6m_entry) {
    424 			if (IN6_ARE_ADDR_EQUAL(&in6m->in6m_addr, &all_in6) ||
    425 			    IPV6_ADDR_MC_SCOPE(&in6m->in6m_addr) <
    426 			    IPV6_ADDR_SCOPE_LINKLOCAL)
    427 				continue;
    428 
    429 			if (in6m->in6m_state == MLD_REPORTPENDING)
    430 				continue; /* we are not yet ready */
    431 
    432 			if (!IN6_IS_ADDR_UNSPECIFIED(&mld_addr) &&
    433 			    !IN6_ARE_ADDR_EQUAL(&mld_addr, &in6m->in6m_addr))
    434 				continue;
    435 
    436 			if (timer == 0) {
    437 				/* send a report immediately */
    438 				mld_stoptimer(in6m);
    439 				mld_sendpkt(in6m, MLD_LISTENER_REPORT, NULL);
    440 				in6m->in6m_state = MLD_IREPORTEDLAST;
    441 			} else if (in6m->in6m_timer == IN6M_TIMER_UNDEF ||
    442 			    mld_timerresid(in6m) > (u_long)timer) {
    443 				in6m->in6m_timer = arc4random() %
    444 				    (int)(((long)timer * hz) / 1000);
    445 				mld_starttimer(in6m);
    446 			}
    447 		}
    448 		break;
    449 
    450 	case MLD_LISTENER_REPORT:
    451 		/*
    452 		 * For fast leave to work, we have to know that we are the
    453 		 * last person to send a report for this group.  Reports
    454 		 * can potentially get looped back if we are a multicast
    455 		 * router, so discard reports sourced by me.
    456 		 * Note that it is impossible to check IFF_LOOPBACK flag of
    457 		 * ifp for this purpose, since ip6_mloopback pass the physical
    458 		 * interface to looutput.
    459 		 */
    460 		if (m->m_flags & M_LOOP) /* XXX: grotty flag, but efficient */
    461 			break;
    462 
    463 		if (!IN6_IS_ADDR_MULTICAST(&mldh->mld_addr))
    464 			break;
    465 
    466 		/*
    467 		 * If we belong to the group being reported, stop
    468 		 * our timer for that group.
    469 		 */
    470 		IN6_LOOKUP_MULTI(mld_addr, ifp, in6m);
    471 		if (in6m) {
    472 			mld_stoptimer(in6m); /* transit to idle state */
    473 			in6m->in6m_state = MLD_OTHERLISTENER; /* clear flag */
    474 		}
    475 		break;
    476 	default:		/* this is impossible */
    477 #if 0
    478 		/*
    479 		 * this case should be impossible because of filtering in
    480 		 * icmp6_input().  But we explicitly disabled this part
    481 		 * just in case.
    482 		 */
    483 		log(LOG_ERR, "mld_input: illegal type(%d)", mldh->mld_type);
    484 #endif
    485 		break;
    486 	}
    487 
    488 	m_freem(m);
    489 }
    490 
    491 static void
    492 mld_sendpkt(struct in6_multi *in6m, int type,
    493 	const struct in6_addr *dst)
    494 {
    495 	struct mbuf *mh;
    496 	struct mld_hdr *mldh;
    497 	struct ip6_hdr *ip6 = NULL;
    498 	struct ip6_moptions im6o;
    499 	struct in6_ifaddr *ia = NULL;
    500 	struct ifnet *ifp = in6m->in6m_ifp;
    501 	int ignflags;
    502 
    503 	/*
    504 	 * At first, find a link local address on the outgoing interface
    505 	 * to use as the source address of the MLD packet.
    506 	 * We do not reject tentative addresses for MLD report to deal with
    507 	 * the case where we first join a link-local address.
    508 	 */
    509 	ignflags = (IN6_IFF_NOTREADY|IN6_IFF_ANYCAST) & ~IN6_IFF_TENTATIVE;
    510 	if ((ia = in6ifa_ifpforlinklocal(ifp, ignflags)) == NULL)
    511 		return;
    512 	if ((ia->ia6_flags & IN6_IFF_TENTATIVE))
    513 		ia = NULL;
    514 
    515 	/* Allocate two mbufs to store IPv6 header and MLD header */
    516 	mldh = mld_allocbuf(&mh, sizeof(struct mld_hdr), in6m, type);
    517 	if (mldh == NULL)
    518 		return;
    519 
    520 	/* fill src/dst here */
    521  	ip6 = mtod(mh, struct ip6_hdr *);
    522  	ip6->ip6_src = ia ? ia->ia_addr.sin6_addr : in6addr_any;
    523  	ip6->ip6_dst = dst ? *dst : in6m->in6m_addr;
    524 
    525 	mldh->mld_addr = in6m->in6m_addr;
    526 	in6_clearscope(&mldh->mld_addr); /* XXX */
    527 	mldh->mld_cksum = in6_cksum(mh, IPPROTO_ICMPV6, sizeof(struct ip6_hdr),
    528 	    sizeof(struct mld_hdr));
    529 
    530 	/* construct multicast option */
    531 	memset(&im6o, 0, sizeof(im6o));
    532 	im6o.im6o_multicast_ifp = ifp;
    533 	im6o.im6o_multicast_hlim = 1;
    534 
    535 	/*
    536 	 * Request loopback of the report if we are acting as a multicast
    537 	 * router, so that the process-level routing daemon can hear it.
    538 	 */
    539 	im6o.im6o_multicast_loop = (ip6_mrouter != NULL);
    540 
    541 	/* increment output statictics */
    542 	icmp6stat.icp6s_outhist[type]++;
    543 	icmp6_ifstat_inc(ifp, ifs6_out_msg);
    544 	switch (type) {
    545 	case MLD_LISTENER_QUERY:
    546 		icmp6_ifstat_inc(ifp, ifs6_out_mldquery);
    547 		break;
    548 	case MLD_LISTENER_REPORT:
    549 		icmp6_ifstat_inc(ifp, ifs6_out_mldreport);
    550 		break;
    551 	case MLD_LISTENER_DONE:
    552 		icmp6_ifstat_inc(ifp, ifs6_out_mlddone);
    553 		break;
    554 	}
    555 
    556 	ip6_output(mh, &ip6_opts, NULL, ia ? 0 : IPV6_UNSPECSRC,
    557 	    &im6o, (struct socket *)NULL, NULL);
    558 }
    559 
    560 static struct mld_hdr *
    561 mld_allocbuf(struct mbuf **mh, int len, struct in6_multi *in6m,
    562     int type)
    563 {
    564 	struct mbuf *md;
    565 	struct mld_hdr *mldh;
    566 	struct ip6_hdr *ip6;
    567 
    568 	/*
    569 	 * Allocate mbufs to store ip6 header and MLD header.
    570 	 * We allocate 2 mbufs and make chain in advance because
    571 	 * it is more convenient when inserting the hop-by-hop option later.
    572 	 */
    573 	MGETHDR(*mh, M_DONTWAIT, MT_HEADER);
    574 	if (*mh == NULL)
    575 		return NULL;
    576 	MGET(md, M_DONTWAIT, MT_DATA);
    577 	if (md == NULL) {
    578 		m_free(*mh);
    579 		*mh = NULL;
    580 		return NULL;
    581 	}
    582 	(*mh)->m_next = md;
    583 	md->m_next = NULL;
    584 
    585 	(*mh)->m_pkthdr.rcvif = NULL;
    586 	(*mh)->m_pkthdr.len = sizeof(struct ip6_hdr) + len;
    587 	(*mh)->m_len = sizeof(struct ip6_hdr);
    588 	MH_ALIGN(*mh, sizeof(struct ip6_hdr));
    589 
    590 	/* fill in the ip6 header */
    591 	ip6 = mtod(*mh, struct ip6_hdr *);
    592 	memset(ip6, 0, sizeof(*ip6));
    593 	ip6->ip6_flow = 0;
    594 	ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
    595 	ip6->ip6_vfc |= IPV6_VERSION;
    596 	/* ip6_plen will be set later */
    597 	ip6->ip6_nxt = IPPROTO_ICMPV6;
    598 	/* ip6_hlim will be set by im6o.im6o_multicast_hlim */
    599 	/* ip6_src/dst will be set by mld_sendpkt() or mld_sendbuf() */
    600 
    601 	/* fill in the MLD header as much as possible */
    602 	md->m_len = len;
    603 	mldh = mtod(md, struct mld_hdr *);
    604 	memset(mldh, 0, len);
    605 	mldh->mld_type = type;
    606 	return mldh;
    607 }
    608 
    609 /*
    610  * Add an address to the list of IP6 multicast addresses for a given interface.
    611  */
    612 struct	in6_multi *
    613 in6_addmulti(struct in6_addr *maddr6, struct ifnet *ifp,
    614 	int *errorp, int timer)
    615 {
    616 	struct	in6_ifaddr *ia;
    617 	struct	in6_ifreq ifr;
    618 	struct	in6_multi *in6m;
    619 	int	s = splsoftnet();
    620 
    621 	*errorp = 0;
    622 
    623 	/*
    624 	 * See if address already in list.
    625 	 */
    626 	IN6_LOOKUP_MULTI(*maddr6, ifp, in6m);
    627 	if (in6m != NULL) {
    628 		/*
    629 		 * Found it; just increment the refrence count.
    630 		 */
    631 		in6m->in6m_refcount++;
    632 	} else {
    633 		/*
    634 		 * New address; allocate a new multicast record
    635 		 * and link it into the interface's multicast list.
    636 		 */
    637 		in6m = (struct in6_multi *)
    638 			malloc(sizeof(*in6m), M_IPMADDR, M_NOWAIT);
    639 		if (in6m == NULL) {
    640 			splx(s);
    641 			*errorp = ENOBUFS;
    642 			return (NULL);
    643 		}
    644 
    645 		memset(in6m, 0, sizeof(*in6m));
    646 		in6m->in6m_addr = *maddr6;
    647 		in6m->in6m_ifp = ifp;
    648 		in6m->in6m_refcount = 1;
    649 		in6m->in6m_timer = IN6M_TIMER_UNDEF;
    650 		in6m->in6m_timer_ch =
    651 		    malloc(sizeof(*in6m->in6m_timer_ch), M_IPMADDR, M_NOWAIT);
    652 		if (in6m->in6m_timer_ch == NULL) {
    653 			free(in6m, M_IPMADDR);
    654 			splx(s);
    655 			return (NULL);
    656 		}
    657 		IFP_TO_IA6(ifp, ia);
    658 		if (ia == NULL) {
    659 			/* leaks in6m_timer_ch */
    660 			free(in6m, M_IPMADDR);
    661 			splx(s);
    662 			*errorp = EADDRNOTAVAIL; /* appropriate? */
    663 			return (NULL);
    664 		}
    665 		in6m->in6m_ia = ia;
    666 		IFAREF(&ia->ia_ifa); /* gain a reference */
    667 		LIST_INSERT_HEAD(&ia->ia6_multiaddrs, in6m, in6m_entry);
    668 
    669 		/*
    670 		 * Ask the network driver to update its multicast reception
    671 		 * filter appropriately for the new address.
    672 		 */
    673 		sockaddr_in6_init(&ifr.ifr_addr, maddr6, 0, 0, 0);
    674 		if (ifp->if_ioctl == NULL)
    675 			*errorp = ENXIO; /* XXX: appropriate? */
    676 		else
    677 			*errorp = (*ifp->if_ioctl)(ifp, SIOCADDMULTI,
    678 			    (void *)&ifr);
    679 		if (*errorp) {
    680 			LIST_REMOVE(in6m, in6m_entry);
    681 			/* leaks in6m_timer_ch */
    682 			free(in6m, M_IPMADDR);
    683 			IFAFREE(&ia->ia_ifa);
    684 			splx(s);
    685 			return (NULL);
    686 		}
    687 
    688 		callout_init(in6m->in6m_timer_ch, 0);
    689 		in6m->in6m_timer = timer;
    690 		if (in6m->in6m_timer > 0) {
    691 			in6m->in6m_state = MLD_REPORTPENDING;
    692 			mld_starttimer(in6m);
    693 
    694 			splx(s);
    695 			return (in6m);
    696 		}
    697 
    698 		/*
    699 		 * Let MLD6 know that we have joined a new IP6 multicast
    700 		 * group.
    701 		 */
    702 		mld_start_listening(in6m);
    703 	}
    704 	splx(s);
    705 	return (in6m);
    706 }
    707 
    708 /*
    709  * Delete a multicast address record.
    710  */
    711 void
    712 in6_delmulti(struct in6_multi *in6m)
    713 {
    714 	struct	in6_ifreq ifr;
    715 	struct	in6_ifaddr *ia;
    716 	int	s = splsoftnet();
    717 
    718 	mld_stoptimer(in6m);
    719 
    720 	if (--in6m->in6m_refcount == 0) {
    721 		/*
    722 		 * No remaining claims to this record; let MLD6 know
    723 		 * that we are leaving the multicast group.
    724 		 */
    725 		mld_stop_listening(in6m);
    726 
    727 		/*
    728 		 * Unlink from list.
    729 		 */
    730 		LIST_REMOVE(in6m, in6m_entry);
    731 		if (in6m->in6m_ia != NULL) {
    732 			IFAFREE(&in6m->in6m_ia->ia_ifa); /* release reference */
    733 			in6m->in6m_ia = NULL;
    734 		}
    735 
    736 		/*
    737 		 * Delete all references of this multicasting group from
    738 		 * the membership arrays
    739 		 */
    740 		for (ia = in6_ifaddr; ia; ia = ia->ia_next) {
    741 			struct in6_multi_mship *imm;
    742 			LIST_FOREACH(imm, &ia->ia6_memberships, i6mm_chain) {
    743 				if (imm->i6mm_maddr == in6m)
    744 					imm->i6mm_maddr = NULL;
    745 			}
    746 		}
    747 
    748 		/*
    749 		 * Notify the network driver to update its multicast
    750 		 * reception filter.
    751 		 */
    752 		sockaddr_in6_init(&ifr.ifr_addr, &in6m->in6m_addr, 0, 0, 0);
    753 		(*in6m->in6m_ifp->if_ioctl)(in6m->in6m_ifp,
    754 		    SIOCDELMULTI, (void *)&ifr);
    755 		free(in6m->in6m_timer_ch, M_IPMADDR);
    756 		free(in6m, M_IPMADDR);
    757 	}
    758 	splx(s);
    759 }
    760 
    761 
    762 struct in6_multi_mship *
    763 in6_joingroup(struct ifnet *ifp, struct in6_addr *addr,
    764 	int *errorp, int timer)
    765 {
    766 	struct in6_multi_mship *imm;
    767 
    768 	imm = malloc(sizeof(*imm), M_IPMADDR, M_NOWAIT);
    769 	if (!imm) {
    770 		*errorp = ENOBUFS;
    771 		return NULL;
    772 	}
    773 
    774 	memset(imm, 0, sizeof(*imm));
    775 	imm->i6mm_maddr = in6_addmulti(addr, ifp, errorp, timer);
    776 	if (!imm->i6mm_maddr) {
    777 		/* *errorp is already set */
    778 		free(imm, M_IPMADDR);
    779 		return NULL;
    780 	}
    781 	return imm;
    782 }
    783 
    784 int
    785 in6_leavegroup(struct in6_multi_mship *imm)
    786 {
    787 
    788 	if (imm->i6mm_maddr) {
    789 		in6_delmulti(imm->i6mm_maddr);
    790 	}
    791 	free(imm, M_IPMADDR);
    792 	return 0;
    793 }
    794 
    795 
    796 /*
    797  * Multicast address kludge:
    798  * If there were any multicast addresses attached to this interface address,
    799  * either move them to another address on this interface, or save them until
    800  * such time as this interface is reconfigured for IPv6.
    801  */
    802 void
    803 in6_savemkludge(struct in6_ifaddr *oia)
    804 {
    805 	struct in6_ifaddr *ia;
    806 	struct in6_multi *in6m;
    807 
    808 	IFP_TO_IA6(oia->ia_ifp, ia);
    809 	if (ia) {	/* there is another address */
    810 		KASSERT(ia != oia);
    811 		while ((in6m = LIST_FIRST(&oia->ia6_multiaddrs)) != NULL) {
    812 			LIST_REMOVE(in6m, in6m_entry);
    813 			IFAREF(&ia->ia_ifa);
    814 			IFAFREE(&in6m->in6m_ia->ia_ifa);
    815 			in6m->in6m_ia = ia;
    816 			LIST_INSERT_HEAD(&ia->ia6_multiaddrs, in6m, in6m_entry);
    817 		}
    818 	} else {	/* last address on this if deleted, save */
    819 		struct multi6_kludge *mk;
    820 
    821 		LIST_FOREACH(mk, &in6_mk, mk_entry) {
    822 			if (mk->mk_ifp == oia->ia_ifp)
    823 				break;
    824 		}
    825 		if (mk == NULL) /* this should not happen! */
    826 			panic("in6_savemkludge: no kludge space");
    827 
    828 		while ((in6m = LIST_FIRST(&oia->ia6_multiaddrs)) != NULL) {
    829 			LIST_REMOVE(in6m, in6m_entry);
    830 			IFAFREE(&in6m->in6m_ia->ia_ifa); /* release reference */
    831 			in6m->in6m_ia = NULL;
    832 			LIST_INSERT_HEAD(&mk->mk_head, in6m, in6m_entry);
    833 		}
    834 	}
    835 }
    836 
    837 /*
    838  * Continuation of multicast address hack:
    839  * If there was a multicast group list previously saved for this interface,
    840  * then we re-attach it to the first address configured on the i/f.
    841  */
    842 void
    843 in6_restoremkludge(struct in6_ifaddr *ia, struct ifnet *ifp)
    844 {
    845 	struct multi6_kludge *mk;
    846 	struct in6_multi *in6m;
    847 
    848 	LIST_FOREACH(mk, &in6_mk, mk_entry) {
    849 		if (mk->mk_ifp == ifp)
    850 			break;
    851 	}
    852 	if (mk == NULL)
    853 		return;
    854 	while ((in6m = LIST_FIRST(&mk->mk_head)) != NULL) {
    855 		LIST_REMOVE(in6m, in6m_entry);
    856 		in6m->in6m_ia = ia;
    857 		IFAREF(&ia->ia_ifa);
    858 		LIST_INSERT_HEAD(&ia->ia6_multiaddrs, in6m, in6m_entry);
    859 	}
    860 }
    861 
    862 /*
    863  * Allocate space for the kludge at interface initialization time.
    864  * Formerly, we dynamically allocated the space in in6_savemkludge() with
    865  * malloc(M_WAITOK).  However, it was wrong since the function could be called
    866  * under an interrupt context (software timer on address lifetime expiration).
    867  * Also, we cannot just give up allocating the strucutre, since the group
    868  * membership structure is very complex and we need to keep it anyway.
    869  * Of course, this function MUST NOT be called under an interrupt context.
    870  * Specifically, it is expected to be called only from in6_ifattach(), though
    871  * it is a global function.
    872  */
    873 void
    874 in6_createmkludge(struct ifnet *ifp)
    875 {
    876 	struct multi6_kludge *mk;
    877 
    878 	LIST_FOREACH(mk, &in6_mk, mk_entry) {
    879 		/* If we've already had one, do not allocate. */
    880 		if (mk->mk_ifp == ifp)
    881 			return;
    882 	}
    883 
    884 	mk = malloc(sizeof(*mk), M_IPMADDR, M_WAITOK);
    885 
    886 	memset(mk, 0, sizeof(*mk));
    887 	LIST_INIT(&mk->mk_head);
    888 	mk->mk_ifp = ifp;
    889 	LIST_INSERT_HEAD(&in6_mk, mk, mk_entry);
    890 }
    891 
    892 void
    893 in6_purgemkludge(struct ifnet *ifp)
    894 {
    895 	struct multi6_kludge *mk;
    896 	struct in6_multi *in6m, *next;
    897 
    898 	LIST_FOREACH(mk, &in6_mk, mk_entry) {
    899 		if (mk->mk_ifp == ifp)
    900 			break;
    901 	}
    902 	if (mk == NULL)
    903 		return;
    904 
    905 	/* leave from all multicast groups joined */
    906 	for (in6m = LIST_FIRST(&mk->mk_head); in6m != NULL; in6m = next) {
    907 		next = LIST_NEXT(in6m, in6m_entry);
    908 		in6_delmulti(in6m);
    909 	}
    910 	LIST_REMOVE(mk, mk_entry);
    911 	free(mk, M_IPMADDR);
    912 }
    913