Home | History | Annotate | Line # | Download | only in netinet6
raw_ip6.c revision 1.111
      1 /*	$NetBSD: raw_ip6.c,v 1.111 2013/06/05 19:01:26 christos Exp $	*/
      2 /*	$KAME: raw_ip6.c,v 1.82 2001/07/23 18:57:56 jinmei Exp $	*/
      3 
      4 /*
      5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
      6  * All rights reserved.
      7  *
      8  * Redistribution and use in source and binary forms, with or without
      9  * modification, are permitted provided that the following conditions
     10  * are met:
     11  * 1. Redistributions of source code must retain the above copyright
     12  *    notice, this list of conditions and the following disclaimer.
     13  * 2. Redistributions in binary form must reproduce the above copyright
     14  *    notice, this list of conditions and the following disclaimer in the
     15  *    documentation and/or other materials provided with the distribution.
     16  * 3. Neither the name of the project nor the names of its contributors
     17  *    may be used to endorse or promote products derived from this software
     18  *    without specific prior written permission.
     19  *
     20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
     21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
     24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     30  * SUCH DAMAGE.
     31  */
     32 
     33 /*
     34  * Copyright (c) 1982, 1986, 1988, 1993
     35  *	The Regents of the University of California.  All rights reserved.
     36  *
     37  * Redistribution and use in source and binary forms, with or without
     38  * modification, are permitted provided that the following conditions
     39  * are met:
     40  * 1. Redistributions of source code must retain the above copyright
     41  *    notice, this list of conditions and the following disclaimer.
     42  * 2. Redistributions in binary form must reproduce the above copyright
     43  *    notice, this list of conditions and the following disclaimer in the
     44  *    documentation and/or other materials provided with the distribution.
     45  * 3. Neither the name of the University nor the names of its contributors
     46  *    may be used to endorse or promote products derived from this software
     47  *    without specific prior written permission.
     48  *
     49  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
     50  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
     51  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
     52  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
     53  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
     54  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
     55  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
     56  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
     57  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
     58  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
     59  * SUCH DAMAGE.
     60  *
     61  *	@(#)raw_ip.c	8.2 (Berkeley) 1/4/94
     62  */
     63 
     64 #include <sys/cdefs.h>
     65 __KERNEL_RCSID(0, "$NetBSD: raw_ip6.c,v 1.111 2013/06/05 19:01:26 christos Exp $");
     66 
     67 #include "opt_ipsec.h"
     68 
     69 #include <sys/param.h>
     70 #include <sys/sysctl.h>
     71 #include <sys/malloc.h>
     72 #include <sys/mbuf.h>
     73 #include <sys/socket.h>
     74 #include <sys/protosw.h>
     75 #include <sys/socketvar.h>
     76 #include <sys/errno.h>
     77 #include <sys/systm.h>
     78 #include <sys/proc.h>
     79 #include <sys/kauth.h>
     80 
     81 #include <net/if.h>
     82 #include <net/route.h>
     83 #include <net/if_types.h>
     84 #include <net/net_stats.h>
     85 
     86 #include <netinet/in.h>
     87 #include <netinet/in_var.h>
     88 #include <netinet/ip6.h>
     89 #include <netinet6/ip6_var.h>
     90 #include <netinet6/ip6_private.h>
     91 #include <netinet6/ip6_mroute.h>
     92 #include <netinet/icmp6.h>
     93 #include <netinet6/icmp6_private.h>
     94 #include <netinet6/in6_pcb.h>
     95 #include <netinet6/nd6.h>
     96 #include <netinet6/ip6protosw.h>
     97 #include <netinet6/scope6_var.h>
     98 #include <netinet6/raw_ip6.h>
     99 
    100 #ifdef IPSEC
    101 #include <netipsec/ipsec.h>
    102 #include <netipsec/ipsec_var.h>
    103 #include <netipsec/ipsec_private.h>
    104 #include <netipsec/ipsec6.h>
    105 #endif
    106 
    107 #include "faith.h"
    108 #if defined(NFAITH) && 0 < NFAITH
    109 #include <net/if_faith.h>
    110 #endif
    111 
    112 extern struct inpcbtable rawcbtable;
    113 struct	inpcbtable raw6cbtable;
    114 #define ifatoia6(ifa)	((struct in6_ifaddr *)(ifa))
    115 
    116 /*
    117  * Raw interface to IP6 protocol.
    118  */
    119 
    120 static percpu_t *rip6stat_percpu;
    121 
    122 #define	RIP6_STATINC(x)		_NET_STATINC(rip6stat_percpu, x)
    123 
    124 static void sysctl_net_inet6_raw6_setup(struct sysctllog **);
    125 
    126 /*
    127  * Initialize raw connection block queue.
    128  */
    129 void
    130 rip6_init(void)
    131 {
    132 
    133 	sysctl_net_inet6_raw6_setup(NULL);
    134 	in6_pcbinit(&raw6cbtable, 1, 1);
    135 
    136 	rip6stat_percpu = percpu_alloc(sizeof(uint64_t) * RIP6_NSTATS);
    137 }
    138 
    139 /*
    140  * Setup generic address and protocol structures
    141  * for raw_input routine, then pass them along with
    142  * mbuf chain.
    143  */
    144 int
    145 rip6_input(struct mbuf **mp, int *offp, int proto)
    146 {
    147 	struct mbuf *m = *mp;
    148 	struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
    149 	struct inpcb_hdr *inph;
    150 	struct in6pcb *in6p;
    151 	struct in6pcb *last = NULL;
    152 	struct sockaddr_in6 rip6src;
    153 	struct mbuf *opts = NULL;
    154 
    155 	RIP6_STATINC(RIP6_STAT_IPACKETS);
    156 
    157 #if defined(NFAITH) && 0 < NFAITH
    158 	if (faithprefix(&ip6->ip6_dst)) {
    159 		/* send icmp6 host unreach? */
    160 		m_freem(m);
    161 		return IPPROTO_DONE;
    162 	}
    163 #endif
    164 
    165 	/* Be proactive about malicious use of IPv4 mapped address */
    166 	if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
    167 	    IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
    168 		/* XXX stat */
    169 		m_freem(m);
    170 		return IPPROTO_DONE;
    171 	}
    172 
    173 	sockaddr_in6_init(&rip6src, &ip6->ip6_src, 0, 0, 0);
    174 	if (sa6_recoverscope(&rip6src) != 0) {
    175 		/* XXX: should be impossible. */
    176 		m_freem(m);
    177 		return IPPROTO_DONE;
    178 	}
    179 
    180 	CIRCLEQ_FOREACH(inph, &raw6cbtable.inpt_queue, inph_queue) {
    181 		in6p = (struct in6pcb *)inph;
    182 		if (in6p->in6p_af != AF_INET6)
    183 			continue;
    184 		if (in6p->in6p_ip6.ip6_nxt &&
    185 		    in6p->in6p_ip6.ip6_nxt != proto)
    186 			continue;
    187 		if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_laddr) &&
    188 		    !IN6_ARE_ADDR_EQUAL(&in6p->in6p_laddr, &ip6->ip6_dst))
    189 			continue;
    190 		if (!IN6_IS_ADDR_UNSPECIFIED(&in6p->in6p_faddr) &&
    191 		    !IN6_ARE_ADDR_EQUAL(&in6p->in6p_faddr, &ip6->ip6_src))
    192 			continue;
    193 		if (in6p->in6p_cksum != -1) {
    194 			RIP6_STATINC(RIP6_STAT_ISUM);
    195 			if (in6_cksum(m, proto, *offp,
    196 			    m->m_pkthdr.len - *offp)) {
    197 				RIP6_STATINC(RIP6_STAT_BADSUM);
    198 				continue;
    199 			}
    200 		}
    201 		if (last) {
    202 			struct	mbuf *n;
    203 
    204 #ifdef IPSEC
    205 			/*
    206 			 * Check AH/ESP integrity
    207 			 */
    208 			if (!ipsec6_in_reject(m,last))
    209 #endif /* IPSEC */
    210 			if ((n = m_copy(m, 0, (int)M_COPYALL)) != NULL) {
    211 				if (last->in6p_flags & IN6P_CONTROLOPTS)
    212 					ip6_savecontrol(last, &opts, ip6, n);
    213 				/* strip intermediate headers */
    214 				m_adj(n, *offp);
    215 				if (sbappendaddr(&last->in6p_socket->so_rcv,
    216 				    (struct sockaddr *)&rip6src, n, opts) == 0) {
    217 					/* should notify about lost packet */
    218 					m_freem(n);
    219 					if (opts)
    220 						m_freem(opts);
    221 					RIP6_STATINC(RIP6_STAT_FULLSOCK);
    222 				} else
    223 					sorwakeup(last->in6p_socket);
    224 				opts = NULL;
    225 			}
    226 		}
    227 		last = in6p;
    228 	}
    229 #ifdef IPSEC
    230 	if (last && ipsec6_in_reject(m, last)) {
    231 		m_freem(m);
    232 		/*
    233 		 * XXX ipsec6_in_reject update stat if there is an error
    234 		 * so we just need to update stats by hand in the case of last is
    235 		 * NULL
    236 		 */
    237 		if (!last)
    238 			IPSEC6_STATINC(IPSEC_STAT_IN_POLVIO);
    239 			IP6_STATDEC(IP6_STAT_DELIVERED);
    240 			/* do not inject data into pcb */
    241 		} else
    242 #endif /* IPSEC */
    243 	if (last) {
    244 		if (last->in6p_flags & IN6P_CONTROLOPTS)
    245 			ip6_savecontrol(last, &opts, ip6, m);
    246 		/* strip intermediate headers */
    247 		m_adj(m, *offp);
    248 		if (sbappendaddr(&last->in6p_socket->so_rcv,
    249 		    (struct sockaddr *)&rip6src, m, opts) == 0) {
    250 			m_freem(m);
    251 			if (opts)
    252 				m_freem(opts);
    253 			RIP6_STATINC(RIP6_STAT_FULLSOCK);
    254 		} else
    255 			sorwakeup(last->in6p_socket);
    256 	} else {
    257 		RIP6_STATINC(RIP6_STAT_NOSOCK);
    258 		if (m->m_flags & M_MCAST)
    259 			RIP6_STATINC(RIP6_STAT_NOSOCKMCAST);
    260 		if (proto == IPPROTO_NONE)
    261 			m_freem(m);
    262 		else {
    263 			u_int8_t *prvnxtp = ip6_get_prevhdr(m, *offp); /* XXX */
    264 			in6_ifstat_inc(m->m_pkthdr.rcvif, ifs6_in_protounknown);
    265 			icmp6_error(m, ICMP6_PARAM_PROB,
    266 			    ICMP6_PARAMPROB_NEXTHEADER,
    267 			    prvnxtp - mtod(m, u_int8_t *));
    268 		}
    269 		IP6_STATDEC(IP6_STAT_DELIVERED);
    270 	}
    271 	return IPPROTO_DONE;
    272 }
    273 
    274 void *
    275 rip6_ctlinput(int cmd, const struct sockaddr *sa, void *d)
    276 {
    277 	struct ip6_hdr *ip6;
    278 	struct ip6ctlparam *ip6cp = NULL;
    279 	const struct sockaddr_in6 *sa6_src = NULL;
    280 	void *cmdarg;
    281 	void (*notify)(struct in6pcb *, int) = in6_rtchange;
    282 	int nxt;
    283 
    284 	if (sa->sa_family != AF_INET6 ||
    285 	    sa->sa_len != sizeof(struct sockaddr_in6))
    286 		return NULL;
    287 
    288 	if ((unsigned)cmd >= PRC_NCMDS)
    289 		return NULL;
    290 	if (PRC_IS_REDIRECT(cmd))
    291 		notify = in6_rtchange, d = NULL;
    292 	else if (cmd == PRC_HOSTDEAD)
    293 		d = NULL;
    294 	else if (cmd == PRC_MSGSIZE)
    295 		; /* special code is present, see below */
    296 	else if (inet6ctlerrmap[cmd] == 0)
    297 		return NULL;
    298 
    299 	/* if the parameter is from icmp6, decode it. */
    300 	if (d != NULL) {
    301 		ip6cp = (struct ip6ctlparam *)d;
    302 		ip6 = ip6cp->ip6c_ip6;
    303 		cmdarg = ip6cp->ip6c_cmdarg;
    304 		sa6_src = ip6cp->ip6c_src;
    305 		nxt = ip6cp->ip6c_nxt;
    306 	} else {
    307 		ip6 = NULL;
    308 		cmdarg = NULL;
    309 		sa6_src = &sa6_any;
    310 		nxt = -1;
    311 	}
    312 
    313 	if (ip6 && cmd == PRC_MSGSIZE) {
    314 		const struct sockaddr_in6 *sa6 = (const struct sockaddr_in6 *)sa;
    315 		int valid = 0;
    316 		struct in6pcb *in6p;
    317 
    318 		/*
    319 		 * Check to see if we have a valid raw IPv6 socket
    320 		 * corresponding to the address in the ICMPv6 message
    321 		 * payload, and the protocol (ip6_nxt) meets the socket.
    322 		 * XXX chase extension headers, or pass final nxt value
    323 		 * from icmp6_notify_error()
    324 		 */
    325 		in6p = NULL;
    326 		in6p = in6_pcblookup_connect(&raw6cbtable, &sa6->sin6_addr, 0,
    327 					     (const struct in6_addr *)&sa6_src->sin6_addr, 0, 0, 0);
    328 #if 0
    329 		if (!in6p) {
    330 			/*
    331 			 * As the use of sendto(2) is fairly popular,
    332 			 * we may want to allow non-connected pcb too.
    333 			 * But it could be too weak against attacks...
    334 			 * We should at least check if the local
    335 			 * address (= s) is really ours.
    336 			 */
    337 			in6p = in6_pcblookup_bind(&raw6cbtable,
    338 			    &sa6->sin6_addr, 0, 0);
    339 		}
    340 #endif
    341 
    342 		if (in6p && in6p->in6p_ip6.ip6_nxt &&
    343 		    in6p->in6p_ip6.ip6_nxt == nxt)
    344 			valid++;
    345 
    346 		/*
    347 		 * Depending on the value of "valid" and routing table
    348 		 * size (mtudisc_{hi,lo}wat), we will:
    349 		 * - recalculate the new MTU and create the
    350 		 *   corresponding routing entry, or
    351 		 * - ignore the MTU change notification.
    352 		 */
    353 		icmp6_mtudisc_update((struct ip6ctlparam *)d, valid);
    354 
    355 		/*
    356 		 * regardless of if we called icmp6_mtudisc_update(),
    357 		 * we need to call in6_pcbnotify(), to notify path MTU
    358 		 * change to the userland (RFC3542), because some
    359 		 * unconnected sockets may share the same destination
    360 		 * and want to know the path MTU.
    361 		 */
    362 	}
    363 
    364 	(void) in6_pcbnotify(&raw6cbtable, sa, 0,
    365 	    (const struct sockaddr *)sa6_src, 0, cmd, cmdarg, notify);
    366 	return NULL;
    367 }
    368 
    369 /*
    370  * Generate IPv6 header and pass packet to ip6_output.
    371  * Tack on options user may have setup with control call.
    372  */
    373 int
    374 rip6_output(struct mbuf *m, struct socket * const so,
    375     struct sockaddr_in6 * const dstsock, struct mbuf * const control)
    376 {
    377 	struct in6_addr *dst;
    378 	struct ip6_hdr *ip6;
    379 	struct in6pcb *in6p;
    380 	u_int	plen = m->m_pkthdr.len;
    381 	int error = 0;
    382 	struct ip6_pktopts opt, *optp = NULL;
    383 	struct ifnet *oifp = NULL;
    384 	int type, code;		/* for ICMPv6 output statistics only */
    385 	int scope_ambiguous = 0;
    386 	struct in6_addr *in6a;
    387 
    388 	in6p = sotoin6pcb(so);
    389 
    390 	dst = &dstsock->sin6_addr;
    391 	if (control) {
    392 		if ((error = ip6_setpktopts(control, &opt,
    393 		    in6p->in6p_outputopts,
    394 		    kauth_cred_get(), so->so_proto->pr_protocol)) != 0) {
    395 			goto bad;
    396 		}
    397 		optp = &opt;
    398 	} else
    399 		optp = in6p->in6p_outputopts;
    400 
    401 	/*
    402 	 * Check and convert scope zone ID into internal form.
    403 	 * XXX: we may still need to determine the zone later.
    404 	 */
    405 	if (!(so->so_state & SS_ISCONNECTED)) {
    406 		if (dstsock->sin6_scope_id == 0 && !ip6_use_defzone)
    407 			scope_ambiguous = 1;
    408 		if ((error = sa6_embedscope(dstsock, ip6_use_defzone)) != 0)
    409 			goto bad;
    410 	}
    411 
    412 	/*
    413 	 * For an ICMPv6 packet, we should know its type and code
    414 	 * to update statistics.
    415 	 */
    416 	if (so->so_proto->pr_protocol == IPPROTO_ICMPV6) {
    417 		struct icmp6_hdr *icmp6;
    418 		if (m->m_len < sizeof(struct icmp6_hdr) &&
    419 		    (m = m_pullup(m, sizeof(struct icmp6_hdr))) == NULL) {
    420 			error = ENOBUFS;
    421 			goto bad;
    422 		}
    423 		icmp6 = mtod(m, struct icmp6_hdr *);
    424 		type = icmp6->icmp6_type;
    425 		code = icmp6->icmp6_code;
    426 	} else {
    427 		type = 0;
    428 		code = 0;
    429 	}
    430 
    431 	M_PREPEND(m, sizeof(*ip6), M_DONTWAIT);
    432 	if (!m) {
    433 		error = ENOBUFS;
    434 		goto bad;
    435 	}
    436 	ip6 = mtod(m, struct ip6_hdr *);
    437 
    438 	/*
    439 	 * Next header might not be ICMP6 but use its pseudo header anyway.
    440 	 */
    441 	ip6->ip6_dst = *dst;
    442 
    443 	/*
    444 	 * Source address selection.
    445 	 */
    446 	if ((in6a = in6_selectsrc(dstsock, optp, in6p->in6p_moptions,
    447 	    &in6p->in6p_route, &in6p->in6p_laddr, &oifp,
    448 	    &error)) == 0) {
    449 		if (error == 0)
    450 			error = EADDRNOTAVAIL;
    451 		goto bad;
    452 	}
    453 	ip6->ip6_src = *in6a;
    454 
    455 	if (oifp && scope_ambiguous) {
    456 		/*
    457 		 * Application should provide a proper zone ID or the use of
    458 		 * default zone IDs should be enabled.  Unfortunately, some
    459 		 * applications do not behave as it should, so we need a
    460 		 * workaround.  Even if an appropriate ID is not determined
    461 		 * (when it's required), if we can determine the outgoing
    462 		 * interface. determine the zone ID based on the interface.
    463 		 */
    464 		error = in6_setscope(&dstsock->sin6_addr, oifp, NULL);
    465 		if (error != 0)
    466 			goto bad;
    467 	}
    468 	ip6->ip6_dst = dstsock->sin6_addr;
    469 
    470 	/* fill in the rest of the IPv6 header fields */
    471 	ip6->ip6_flow = in6p->in6p_flowinfo & IPV6_FLOWINFO_MASK;
    472 	ip6->ip6_vfc  &= ~IPV6_VERSION_MASK;
    473 	ip6->ip6_vfc  |= IPV6_VERSION;
    474 	/* ip6_plen will be filled in ip6_output, so not fill it here. */
    475 	ip6->ip6_nxt   = in6p->in6p_ip6.ip6_nxt;
    476 	ip6->ip6_hlim = in6_selecthlim(in6p, oifp);
    477 
    478 	if (so->so_proto->pr_protocol == IPPROTO_ICMPV6 ||
    479 	    in6p->in6p_cksum != -1) {
    480 		int off;
    481 		u_int16_t sum;
    482 
    483 		/* compute checksum */
    484 		if (so->so_proto->pr_protocol == IPPROTO_ICMPV6)
    485 			off = offsetof(struct icmp6_hdr, icmp6_cksum);
    486 		else
    487 			off = in6p->in6p_cksum;
    488 		if (plen < off + 1) {
    489 			error = EINVAL;
    490 			goto bad;
    491 		}
    492 		off += sizeof(struct ip6_hdr);
    493 
    494 		sum = 0;
    495 		m = m_copyback_cow(m, off, sizeof(sum), (void *)&sum,
    496 		    M_DONTWAIT);
    497 		if (m == NULL) {
    498 			error = ENOBUFS;
    499 			goto bad;
    500 		}
    501 		sum = in6_cksum(m, ip6->ip6_nxt, sizeof(*ip6), plen);
    502 		m = m_copyback_cow(m, off, sizeof(sum), (void *)&sum,
    503 		    M_DONTWAIT);
    504 		if (m == NULL) {
    505 			error = ENOBUFS;
    506 			goto bad;
    507 		}
    508 	}
    509 
    510 	error = ip6_output(m, optp, &in6p->in6p_route, 0,
    511 	    in6p->in6p_moptions, so, &oifp);
    512 	if (so->so_proto->pr_protocol == IPPROTO_ICMPV6) {
    513 		if (oifp)
    514 			icmp6_ifoutstat_inc(oifp, type, code);
    515 		ICMP6_STATINC(ICMP6_STAT_OUTHIST + type);
    516 	} else
    517 		RIP6_STATINC(RIP6_STAT_OPACKETS);
    518 
    519 	goto freectl;
    520 
    521  bad:
    522 	if (m)
    523 		m_freem(m);
    524 
    525  freectl:
    526 	if (control) {
    527 		ip6_clearpktopts(&opt, -1);
    528 		m_freem(control);
    529 	}
    530 	return error;
    531 }
    532 
    533 /*
    534  * Raw IPv6 socket option processing.
    535  */
    536 int
    537 rip6_ctloutput(int op, struct socket *so, struct sockopt *sopt)
    538 {
    539 	int error = 0;
    540 
    541 	if (sopt->sopt_level == SOL_SOCKET && sopt->sopt_name == SO_NOHEADER) {
    542 		int optval;
    543 
    544 		/* need to fiddle w/ opt(IPPROTO_IPV6, IPV6_CHECKSUM)? */
    545 		if (op == PRCO_GETOPT) {
    546 			optval = 1;
    547 			error = sockopt_set(sopt, &optval, sizeof(optval));
    548 		} else if (op == PRCO_SETOPT) {
    549 			error = sockopt_getint(sopt, &optval);
    550 			if (error)
    551 				goto out;
    552 			if (optval == 0)
    553 				error = EINVAL;
    554 		}
    555 
    556 		goto out;
    557 	} else if (sopt->sopt_level != IPPROTO_IPV6)
    558 		return ip6_ctloutput(op, so, sopt);
    559 
    560 	switch (sopt->sopt_name) {
    561 	case MRT6_INIT:
    562 	case MRT6_DONE:
    563 	case MRT6_ADD_MIF:
    564 	case MRT6_DEL_MIF:
    565 	case MRT6_ADD_MFC:
    566 	case MRT6_DEL_MFC:
    567 	case MRT6_PIM:
    568 		if (op == PRCO_SETOPT)
    569 			error = ip6_mrouter_set(so, sopt);
    570 		else if (op == PRCO_GETOPT)
    571 			error = ip6_mrouter_get(so, sopt);
    572 		else
    573 			error = EINVAL;
    574 		break;
    575 	case IPV6_CHECKSUM:
    576 		return ip6_raw_ctloutput(op, so, sopt);
    577 	default:
    578 		return ip6_ctloutput(op, so, sopt);
    579 	}
    580  out:
    581 	return error;
    582 }
    583 
    584 extern	u_long rip6_sendspace;
    585 extern	u_long rip6_recvspace;
    586 
    587 int
    588 rip6_usrreq(struct socket *so, int req, struct mbuf *m,
    589 	struct mbuf *nam, struct mbuf *control, struct lwp *l)
    590 {
    591 	struct in6pcb *in6p = sotoin6pcb(so);
    592 	int s;
    593 	int error = 0;
    594 
    595 	if (req == PRU_CONTROL)
    596 		return in6_control(so, (u_long)m, (void *)nam,
    597 		    (struct ifnet *)control, l);
    598 
    599 	if (req == PRU_PURGEIF) {
    600 		mutex_enter(softnet_lock);
    601 		in6_pcbpurgeif0(&raw6cbtable, (struct ifnet *)control);
    602 		in6_purgeif((struct ifnet *)control);
    603 		in6_pcbpurgeif(&raw6cbtable, (struct ifnet *)control);
    604 		mutex_exit(softnet_lock);
    605 		return 0;
    606 	}
    607 
    608 	switch (req) {
    609 	case PRU_ATTACH:
    610 		error = kauth_authorize_network(l->l_cred,
    611 		    KAUTH_NETWORK_SOCKET, KAUTH_REQ_NETWORK_SOCKET_RAWSOCK,
    612 		    KAUTH_ARG(AF_INET6),
    613 		    KAUTH_ARG(SOCK_RAW),
    614 		    KAUTH_ARG(so->so_proto->pr_protocol));
    615 		sosetlock(so);
    616 		if (in6p != NULL)
    617 			panic("rip6_attach");
    618 		if (error) {
    619 			break;
    620 		}
    621 		s = splsoftnet();
    622 		error = soreserve(so, rip6_sendspace, rip6_recvspace);
    623 		if (error != 0) {
    624 			splx(s);
    625 			break;
    626 		}
    627 		if ((error = in6_pcballoc(so, &raw6cbtable)) != 0) {
    628 			splx(s);
    629 			break;
    630 		}
    631 		splx(s);
    632 		in6p = sotoin6pcb(so);
    633 		in6p->in6p_ip6.ip6_nxt = (long)nam;
    634 		in6p->in6p_cksum = -1;
    635 
    636 		in6p->in6p_icmp6filt = malloc(sizeof(struct icmp6_filter),
    637 			M_PCB, M_NOWAIT);
    638 		if (in6p->in6p_icmp6filt == NULL) {
    639 			in6_pcbdetach(in6p);
    640 			error = ENOMEM;
    641 			break;
    642 		}
    643 		ICMP6_FILTER_SETPASSALL(in6p->in6p_icmp6filt);
    644 		break;
    645 
    646 	case PRU_DISCONNECT:
    647 		if ((so->so_state & SS_ISCONNECTED) == 0) {
    648 			error = ENOTCONN;
    649 			break;
    650 		}
    651 		in6p->in6p_faddr = in6addr_any;
    652 		so->so_state &= ~SS_ISCONNECTED;	/* XXX */
    653 		break;
    654 
    655 	case PRU_ABORT:
    656 		soisdisconnected(so);
    657 		/* Fallthrough */
    658 	case PRU_DETACH:
    659 		if (in6p == NULL)
    660 			panic("rip6_detach");
    661 		if (so == ip6_mrouter)
    662 			ip6_mrouter_done();
    663 		/* xxx: RSVP */
    664 		if (in6p->in6p_icmp6filt != NULL) {
    665 			free(in6p->in6p_icmp6filt, M_PCB);
    666 			in6p->in6p_icmp6filt = NULL;
    667 		}
    668 		in6_pcbdetach(in6p);
    669 		break;
    670 
    671 	case PRU_BIND:
    672 	    {
    673 		struct sockaddr_in6 *addr = mtod(nam, struct sockaddr_in6 *);
    674 		struct ifaddr *ia = NULL;
    675 
    676 		if (nam->m_len != sizeof(*addr)) {
    677 			error = EINVAL;
    678 			break;
    679 		}
    680 		if (TAILQ_EMPTY(&ifnet) || addr->sin6_family != AF_INET6) {
    681 			error = EADDRNOTAVAIL;
    682 			break;
    683 		}
    684 		if ((error = sa6_embedscope(addr, ip6_use_defzone)) != 0)
    685 			break;
    686 
    687 		/*
    688 		 * we don't support mapped address here, it would confuse
    689 		 * users so reject it
    690 		 */
    691 		if (IN6_IS_ADDR_V4MAPPED(&addr->sin6_addr)) {
    692 			error = EADDRNOTAVAIL;
    693 			break;
    694 		}
    695 		if (!IN6_IS_ADDR_UNSPECIFIED(&addr->sin6_addr) &&
    696 		    (ia = ifa_ifwithaddr((struct sockaddr *)addr)) == 0) {
    697 			error = EADDRNOTAVAIL;
    698 			break;
    699 		}
    700 		if (ia && ((struct in6_ifaddr *)ia)->ia6_flags &
    701 		    (IN6_IFF_ANYCAST|IN6_IFF_NOTREADY|
    702 		     IN6_IFF_DETACHED|IN6_IFF_DEPRECATED)) {
    703 			error = EADDRNOTAVAIL;
    704 			break;
    705 		}
    706 		in6p->in6p_laddr = addr->sin6_addr;
    707 		break;
    708 	    }
    709 
    710 	case PRU_CONNECT:
    711 	{
    712 		struct sockaddr_in6 *addr = mtod(nam, struct sockaddr_in6 *);
    713 		struct in6_addr *in6a = NULL;
    714 		struct ifnet *ifp = NULL;
    715 		int scope_ambiguous = 0;
    716 
    717 		if (nam->m_len != sizeof(*addr)) {
    718 			error = EINVAL;
    719 			break;
    720 		}
    721 		if (TAILQ_EMPTY(&ifnet)) {
    722 			error = EADDRNOTAVAIL;
    723 			break;
    724 		}
    725 		if (addr->sin6_family != AF_INET6) {
    726 			error = EAFNOSUPPORT;
    727 			break;
    728 		}
    729 
    730 		/*
    731 		 * Application should provide a proper zone ID or the use of
    732 		 * default zone IDs should be enabled.  Unfortunately, some
    733 		 * applications do not behave as it should, so we need a
    734 		 * workaround.  Even if an appropriate ID is not determined,
    735 		 * we'll see if we can determine the outgoing interface.  If we
    736 		 * can, determine the zone ID based on the interface below.
    737 		 */
    738 		if (addr->sin6_scope_id == 0 && !ip6_use_defzone)
    739 			scope_ambiguous = 1;
    740 		if ((error = sa6_embedscope(addr, ip6_use_defzone)) != 0)
    741 			return error;
    742 
    743 		/* Source address selection. XXX: need pcblookup? */
    744 		in6a = in6_selectsrc(addr, in6p->in6p_outputopts,
    745 		    in6p->in6p_moptions, &in6p->in6p_route,
    746 		    &in6p->in6p_laddr, &ifp, &error);
    747 		if (in6a == NULL) {
    748 			if (error == 0)
    749 				error = EADDRNOTAVAIL;
    750 			break;
    751 		}
    752 		/* XXX: see above */
    753 		if (ifp && scope_ambiguous &&
    754 		    (error = in6_setscope(&addr->sin6_addr, ifp, NULL)) != 0) {
    755 			break;
    756 		}
    757 		in6p->in6p_laddr = *in6a;
    758 		in6p->in6p_faddr = addr->sin6_addr;
    759 		soisconnected(so);
    760 		break;
    761 	}
    762 
    763 	case PRU_CONNECT2:
    764 		error = EOPNOTSUPP;
    765 		break;
    766 
    767 	/*
    768 	 * Mark the connection as being incapable of futther input.
    769 	 */
    770 	case PRU_SHUTDOWN:
    771 		socantsendmore(so);
    772 		break;
    773 	/*
    774 	 * Ship a packet out. The appropriate raw output
    775 	 * routine handles any messaging necessary.
    776 	 */
    777 	case PRU_SEND:
    778 	{
    779 		struct sockaddr_in6 tmp;
    780 		struct sockaddr_in6 *dst;
    781 
    782 		/* always copy sockaddr to avoid overwrites */
    783 		if (so->so_state & SS_ISCONNECTED) {
    784 			if (nam) {
    785 				error = EISCONN;
    786 				break;
    787 			}
    788 			/* XXX */
    789 			sockaddr_in6_init(&tmp, &in6p->in6p_faddr, 0, 0, 0);
    790 			dst = &tmp;
    791 		} else {
    792 			if (nam == NULL) {
    793 				error = ENOTCONN;
    794 				break;
    795 			}
    796 			if (nam->m_len != sizeof(tmp)) {
    797 				error = EINVAL;
    798 				break;
    799 			}
    800 
    801 			tmp = *mtod(nam, struct sockaddr_in6 *);
    802 			dst = &tmp;
    803 
    804 			if (dst->sin6_family != AF_INET6) {
    805 				error = EAFNOSUPPORT;
    806 				break;
    807 			}
    808 		}
    809 		error = rip6_output(m, so, dst, control);
    810 		m = NULL;
    811 		break;
    812 	}
    813 
    814 	case PRU_SENSE:
    815 		/*
    816 		 * stat: don't bother with a blocksize
    817 		 */
    818 		return 0;
    819 	/*
    820 	 * Not supported.
    821 	 */
    822 	case PRU_RCVOOB:
    823 	case PRU_RCVD:
    824 	case PRU_LISTEN:
    825 	case PRU_ACCEPT:
    826 	case PRU_SENDOOB:
    827 		error = EOPNOTSUPP;
    828 		break;
    829 
    830 	case PRU_SOCKADDR:
    831 		in6_setsockaddr(in6p, nam);
    832 		break;
    833 
    834 	case PRU_PEERADDR:
    835 		in6_setpeeraddr(in6p, nam);
    836 		break;
    837 
    838 	default:
    839 		panic("rip6_usrreq");
    840 	}
    841 	if (m != NULL)
    842 		m_freem(m);
    843 	return error;
    844 }
    845 
    846 static int
    847 sysctl_net_inet6_raw6_stats(SYSCTLFN_ARGS)
    848 {
    849 
    850 	return (NETSTAT_SYSCTL(rip6stat_percpu, RIP6_NSTATS));
    851 }
    852 
    853 static void
    854 sysctl_net_inet6_raw6_setup(struct sysctllog **clog)
    855 {
    856 
    857 	sysctl_createv(clog, 0, NULL, NULL,
    858 		       CTLFLAG_PERMANENT,
    859 		       CTLTYPE_NODE, "net", NULL,
    860 		       NULL, 0, NULL, 0,
    861 		       CTL_NET, CTL_EOL);
    862 	sysctl_createv(clog, 0, NULL, NULL,
    863 		       CTLFLAG_PERMANENT,
    864 		       CTLTYPE_NODE, "inet6", NULL,
    865 		       NULL, 0, NULL, 0,
    866 		       CTL_NET, PF_INET6, CTL_EOL);
    867 	sysctl_createv(clog, 0, NULL, NULL,
    868 		       CTLFLAG_PERMANENT,
    869 		       CTLTYPE_NODE, "raw6",
    870 		       SYSCTL_DESCR("Raw IPv6 settings"),
    871 		       NULL, 0, NULL, 0,
    872 		       CTL_NET, PF_INET6, IPPROTO_RAW, CTL_EOL);
    873 
    874 	sysctl_createv(clog, 0, NULL, NULL,
    875 		       CTLFLAG_PERMANENT,
    876 		       CTLTYPE_STRUCT, "pcblist",
    877 		       SYSCTL_DESCR("Raw IPv6 control block list"),
    878 		       sysctl_inpcblist, 0, &raw6cbtable, 0,
    879 		       CTL_NET, PF_INET6, IPPROTO_RAW,
    880 		       CTL_CREATE, CTL_EOL);
    881 	sysctl_createv(clog, 0, NULL, NULL,
    882 		       CTLFLAG_PERMANENT,
    883 		       CTLTYPE_STRUCT, "stats",
    884 		       SYSCTL_DESCR("Raw IPv6 statistics"),
    885 		       sysctl_net_inet6_raw6_stats, 0, NULL, 0,
    886 		       CTL_NET, PF_INET6, IPPROTO_RAW, RAW6CTL_STATS,
    887 		       CTL_EOL);
    888 }
    889