MFp4: anchie_soc2009 branch:

Add kernel side support for Secure Neighbor Discovery (SeND), RFC 3971.

The implementation consists of a kernel module that gets packets from
the nd6 code, sends them to user space on a dedicated socket and reinjects
them back for further processing.

Hooks are used from nd6 code paths to divert relevant packets to the
send implementation for processing in user space.  The hooks are only
triggered if the send module is loaded. In case no user space
application is connected to the send socket, processing continues
normaly as if the module would not be loaded. Unloading the module
is not possible at this time due to missing nd6 locking.

The native SeND socket is similar to a raw IPv6 socket but with its own,
internal pseudo-protocol.

Approved by:	bz (mentor)

10 files changed, 612 insertions, 14 deletions

diff --git a/sys/modules/Makefile b/sys/modules/Makefile
index 8d8b394fcba9..200d81476c50 100644
--- a/sys/modules/Makefile
+++ b/sys/modules/Makefile
@@ -257,6 +257,7 @@ SUBDIR=	${_3dfx} \
 	${_scsi_low} \
 	sdhci \
 	sem \
+	send \
 	sf \
 	sge \
 	siba_bwn \
diff --git a/sys/modules/send/Makefile b/sys/modules/send/Makefile
new file mode 100644
index 000000000000..1cb976b9b8d8
--- /dev/null
+++ b/sys/modules/send/Makefile
@@ -0,0 +1,7 @@
+# $FreeBSD$
+.PATH: ${.CURDIR}/../../netinet6
+
+KMOD=	send
+SRCS=	send.c
+
+.include <bsd.kmod.mk>
diff --git a/sys/netinet/in.h b/sys/netinet/in.h
index 9eb3b177c169..e453b692e751 100644
--- a/sys/netinet/in.h
+++ b/sys/netinet/in.h
@@ -252,6 +252,7 @@ __END_DECLS
 
 /* Only used internally, so can be outside the range of valid IP protocols. */
 #define	IPPROTO_DIVERT		258		/* divert pseudo-protocol */
+#define	IPPROTO_SEND		259		/* SeND pseudo-protocol */
 
 /*
  * Defined to avoid confusion.  The master value is defined by
diff --git a/sys/netinet6/icmp6.c b/sys/netinet6/icmp6.c
index 87df9c369c8e..47657b2c0c1e 100644
--- a/sys/netinet6/icmp6.c
+++ b/sys/netinet6/icmp6.c
@@ -105,6 +105,7 @@ __FBSDID("$FreeBSD$");
 #include <netinet6/scope6_var.h>
 #include <netinet6/mld6_var.h>
 #include <netinet6/nd6.h>
+#include <netinet6/send.h>
 
 #ifdef IPSEC
 #include <netipsec/ipsec.h>
@@ -414,6 +415,7 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 	int icmp6len = m->m_pkthdr.len - *offp;
 	int code, sum, noff;
 	char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN];
+	int ip6len, error;
 
 	ifp = m->m_pkthdr.rcvif;
 
@@ -428,6 +430,7 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 	 */
 
 	ip6 = mtod(m, struct ip6_hdr *);
+	ip6len = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen);
 	if (icmp6len < sizeof(struct icmp6_hdr)) {
 		ICMP6STAT_INC(icp6s_tooshort);
 		goto freeit;
@@ -766,11 +769,35 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 			goto badlen;
 		if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
 			/* give up local */
-			nd6_rs_input(m, off, icmp6len);
+
+			/* Send incoming SeND packet to user space. */
+			if (send_sendso_input_hook != NULL) {
+				IP6_EXTHDR_CHECK(m, off,
+				    icmp6len, IPPROTO_DONE);
+				error = send_sendso_input_hook(m, ifp,
+				    SND_IN, ip6len);
+				/* -1 == no app on SEND socket */
+				if (error == 0)
+					return (IPPROTO_DONE);
+				nd6_rs_input(m, off, icmp6len);
+			} else
+				nd6_rs_input(m, off, icmp6len);
 			m = NULL;
 			goto freeit;
 		}
-		nd6_rs_input(n, off, icmp6len);
+		if (send_sendso_input_hook != NULL) {
+			IP6_EXTHDR_CHECK(m, off,
+			    icmp6len, IPPROTO_DONE);
+                        error = send_sendso_input_hook(n, ifp,
+			    SND_IN, ip6len);
+			if (error == 0) {
+				m_freem(n);
+				return (IPPROTO_DONE);
+			}
+			/* -1 == no app on SEND socket */
+			nd6_rs_input(n, off, icmp6len);
+		} else
+			nd6_rs_input(n, off, icmp6len);
 		/* m stays. */
 		break;
 
@@ -781,12 +808,28 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 		if (icmp6len < sizeof(struct nd_router_advert))
 			goto badlen;
 		if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
-			/* give up local */
-			nd6_ra_input(m, off, icmp6len);
+
+			/* Send incoming SeND-protected/ND packet to user space. */
+			if (send_sendso_input_hook != NULL) {
+				error = send_sendso_input_hook(m, ifp,
+				    SND_IN, ip6len);
+				if (error == 0)
+					return (IPPROTO_DONE);
+				nd6_ra_input(m, off, icmp6len);
+			} else
+				nd6_ra_input(m, off, icmp6len);
 			m = NULL;
+			m_freem(n);
 			goto freeit;
 		}
-		nd6_ra_input(n, off, icmp6len);
+		if (send_sendso_input_hook != NULL) {
+			error = send_sendso_input_hook(n, ifp,
+			    SND_IN, ip6len);
+			if (error == 0)
+				return (IPPROTO_DONE);
+			nd6_ra_input(n, off, icmp6len);
+		} else
+			nd6_ra_input(n, off, icmp6len);
 		/* m stays. */
 		break;
 
@@ -797,12 +840,26 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 		if (icmp6len < sizeof(struct nd_neighbor_solicit))
 			goto badlen;
 		if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
-			/* give up local */
-			nd6_ns_input(m, off, icmp6len);
+			if (send_sendso_input_hook != NULL) {
+				error = send_sendso_input_hook(m, ifp,
+				    SND_IN, ip6len);
+				if (error == 0)
+					return (IPPROTO_DONE);
+				nd6_ns_input(m, off, icmp6len);
+			} else
+				nd6_ns_input(m, off, icmp6len);
+			m_freem(n);
 			m = NULL;
 			goto freeit;
 		}
-		nd6_ns_input(n, off, icmp6len);
+		if (send_sendso_input_hook != NULL) {
+			error = send_sendso_input_hook(n, ifp,
+			    SND_IN, ip6len);
+			if (error == 0)
+				return (IPPROTO_DONE);
+			nd6_ns_input(n, off, icmp6len);
+		} else
+			nd6_ns_input(n, off, icmp6len);
 		/* m stays. */
 		break;
 
@@ -813,12 +870,28 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 		if (icmp6len < sizeof(struct nd_neighbor_advert))
 			goto badlen;
 		if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
-			/* give up local */
-			nd6_na_input(m, off, icmp6len);
+
+			/* Send incoming SeND-protected/ND packet to user space. */
+			if (send_sendso_input_hook != NULL) {
+				error = send_sendso_input_hook(m, ifp,
+				    SND_IN, ip6len);
+				if (error == 0)
+					return (IPPROTO_DONE);
+				nd6_na_input(m, off, icmp6len);
+			} else
+				nd6_na_input(m, off, icmp6len);
+			m_freem(n);
 			m = NULL;
 			goto freeit;
 		}
-		nd6_na_input(n, off, icmp6len);
+		if (send_sendso_input_hook != NULL) {
+			error = send_sendso_input_hook(n, ifp,
+			    SND_IN, ip6len);
+			if (error == 0)
+				return (IPPROTO_DONE);
+			nd6_na_input(n, off, icmp6len);
+		} else
+			nd6_na_input(n, off, icmp6len);
 		/* m stays. */
 		break;
 
@@ -829,12 +902,26 @@ icmp6_input(struct mbuf **mp, int *offp, int proto)
 		if (icmp6len < sizeof(struct nd_redirect))
 			goto badlen;
 		if ((n = m_copym(m, 0, M_COPYALL, M_DONTWAIT)) == NULL) {
-			/* give up local */
-			icmp6_redirect_input(m, off);
+			if (send_sendso_input_hook != NULL) {
+				error = send_sendso_input_hook(m, ifp,
+				    SND_IN, ip6len);
+		 		if (error == 0)
+					return (IPPROTO_DONE);
+			    icmp6_redirect_input(m, off);
+			} else
+				icmp6_redirect_input(m, off);
+			m_freem(n);
 			m = NULL;
 			goto freeit;
 		}
-		icmp6_redirect_input(n, off);
+		if (send_sendso_input_hook != NULL) {
+			error = send_sendso_input_hook(n, ifp,
+			    SND_IN, ip6len);
+			if (error == 0)
+				return (IPPROTO_DONE);
+			icmp6_redirect_input(n, off);
+		} else
+			icmp6_redirect_input(n, off);
 		/* m stays. */
 		break;
 
@@ -2476,6 +2563,7 @@ icmp6_redirect_output(struct mbuf *m0, struct rtentry *rt)
 	struct in6_addr *router_ll6;
 	struct ip6_hdr *sip6;	/* m0 as struct ip6_hdr */
 	struct mbuf *m = NULL;	/* newly allocated one */
+	struct m_tag *mtag;
 	struct ip6_hdr *ip6;	/* m as struct ip6_hdr */
 	struct nd_redirect *nd_rd;
 	struct llentry *ln = NULL;
@@ -2735,6 +2823,15 @@ noredhdropt:;
 	nd_rd->nd_rd_cksum = in6_cksum(m, IPPROTO_ICMPV6,
 	    sizeof(*ip6), ntohs(ip6->ip6_plen));
 
+        if (send_sendso_input_hook != NULL) {
+		mtag = m_tag_get(PACKET_TAG_ND_OUTGOING, sizeof(unsigned short),
+			M_NOWAIT);
+		if (mtag == NULL)
+			goto fail;
+		*(unsigned short *)(mtag + 1) = nd_rd->nd_rd_type;
+		m_tag_prepend(m, mtag);
+	}
+
 	/* send the packet to outside... */
 	ip6_output(m, NULL, NULL, 0, NULL, &outif, NULL);
 	if (outif) {
diff --git a/sys/netinet6/nd6.c b/sys/netinet6/nd6.c
index e9081c404c3f..c9d9be058696 100644
--- a/sys/netinet6/nd6.c
+++ b/sys/netinet6/nd6.c
@@ -72,6 +72,7 @@ __FBSDID("$FreeBSD$");
 #include <netinet6/nd6.h>
 #include <netinet6/in6_ifattach.h>
 #include <netinet/icmp6.h>
+#include <netinet6/send.h>
 
 #include <sys/limits.h>
 
@@ -121,6 +122,8 @@ VNET_DEFINE(int, nd6_recalc_reachtm_interval) = ND6_RECALC_REACHTM_INTERVAL;
 
 static struct sockaddr_in6 all1_sa;
 
+int	(*send_sendso_input_hook)(struct mbuf *, struct ifnet *, int, int);
+
 static int nd6_is_new_addr_neighbor __P((struct sockaddr_in6 *,
 	struct ifnet *));
 static void nd6_setmtu0(struct ifnet *, struct nd_ifinfo *);
@@ -1758,9 +1761,12 @@ nd6_output_lle(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *m0,
 	struct mbuf **chain)
 {
 	struct mbuf *m = m0;
+	struct m_tag *mtag;
 	struct llentry *ln = lle;
+	struct ip6_hdr *ip6;
 	int error = 0;
 	int flags = 0;
+	int ip6len;
 
 #ifdef INVARIANTS
 	if (lle != NULL) {
@@ -1935,6 +1941,28 @@ nd6_output_lle(struct ifnet *ifp, struct ifnet *origifp, struct mbuf *m0,
 #ifdef MAC
 	mac_netinet6_nd6_send(ifp, m);
 #endif
+
+	/*
+	 * If called from nd6_ns_output() (NS), nd6_na_output() (NA),
+	 * icmp6_redirect_output() (REDIRECT) or from rip6_output() (RS, RA
+	 * as handled by rtsol and rtadvd), mbufs will be tagged for SeND
+	 * to be diverted to user space.  When re-injected into the kernel,
+	 * send_output() will directly dispatch them to the outgoing interface.
+	 */
+	if (send_sendso_input_hook != NULL) {
+		mtag = m_tag_find(m, PACKET_TAG_ND_OUTGOING, NULL);
+		if (mtag != NULL) {
+			ip6 = mtod(m, struct ip6_hdr *);
+			ip6len = sizeof(struct ip6_hdr) + ntohs(ip6->ip6_plen);
+			/* Use the SEND socket */
+			error = send_sendso_input_hook(m, ifp, SND_OUT,
+			    ip6len);
+			/* -1 == no app on SEND socket */
+			if (error == 0 || error != -1)
+			    return (error);
+		}
+	}
+
 	/*
 	 * We were passed in a pointer to an lle with the lock held 
 	 * this means that we can't call if_output as we will
diff --git a/sys/netinet6/nd6_nbr.c b/sys/netinet6/nd6_nbr.c
index 130189d079ba..957e9652843f 100644
--- a/sys/netinet6/nd6_nbr.c
+++ b/sys/netinet6/nd6_nbr.c
@@ -73,6 +73,7 @@ __FBSDID("$FreeBSD$");
 #include <netinet6/nd6.h>
 #include <netinet/icmp6.h>
 #include <netinet/ip_carp.h>
+#include <netinet6/send.h>
 
 #define SDL(s) ((struct sockaddr_dl *)s)
 
@@ -379,6 +380,7 @@ nd6_ns_output(struct ifnet *ifp, const struct in6_addr *daddr6,
     const struct in6_addr *taddr6, struct llentry *ln, int dad)
 {
 	struct mbuf *m;
+	struct m_tag *mtag;
 	struct ip6_hdr *ip6;
 	struct nd_neighbor_solicit *nd_ns;
 	struct in6_addr *src, src_in;
@@ -557,6 +559,15 @@ nd6_ns_output(struct ifnet *ifp, const struct in6_addr *daddr6,
 	nd_ns->nd_ns_cksum =
 	    in6_cksum(m, IPPROTO_ICMPV6, sizeof(*ip6), icmp6len);
 
+	if (send_sendso_input_hook != NULL) {
+		mtag = m_tag_get(PACKET_TAG_ND_OUTGOING,
+			sizeof(unsigned short), M_NOWAIT);
+		if (mtag == NULL)
+			goto bad;
+		*(unsigned short *)(mtag + 1) = nd_ns->nd_ns_type;
+		m_tag_prepend(m, mtag);
+	}
+
 	ip6_output(m, NULL, &ro, dad ? IPV6_UNSPECSRC : 0, &im6o, NULL, NULL);
 	icmp6_ifstat_inc(ifp, ifs6_out_msg);
 	icmp6_ifstat_inc(ifp, ifs6_out_neighborsolicit);
@@ -604,6 +615,7 @@ nd6_na_input(struct mbuf *m, int off, int icmp6len)
 	struct llentry *ln = NULL;
 	union nd_opts ndopts;
 	struct mbuf *chain = NULL;
+	struct m_tag *mtag;
 	struct sockaddr_in6 sin6;
 	char ip6bufs[INET6_ADDRSTRLEN], ip6bufd[INET6_ADDRSTRLEN];
 
@@ -873,6 +885,15 @@ nd6_na_input(struct mbuf *m, int off, int icmp6len)
 			 * we assume ifp is not a loopback here, so just set
 			 * the 2nd argument as the 1st one.
 			 */
+
+			if (send_sendso_input_hook != NULL) {
+				mtag = m_tag_get(PACKET_TAG_ND_OUTGOING,
+				    sizeof(unsigned short), M_NOWAIT);
+				if (mtag == NULL)
+					goto bad;
+				m_tag_prepend(m, mtag);
+			}
+
 			nd6_output_lle(ifp, ifp, m_hold, L3_ADDR_SIN6(ln), NULL, ln, &chain);
 		}
 	}
@@ -917,6 +938,7 @@ nd6_na_output(struct ifnet *ifp, const struct in6_addr *daddr6_0,
     struct sockaddr *sdl0)
 {
 	struct mbuf *m;
+	struct m_tag *mtag;
 	struct ip6_hdr *ip6;
 	struct nd_neighbor_advert *nd_na;
 	struct ip6_moptions im6o;
@@ -1055,6 +1077,15 @@ nd6_na_output(struct ifnet *ifp, const struct in6_addr *daddr6_0,
 	nd_na->nd_na_cksum =
 	    in6_cksum(m, IPPROTO_ICMPV6, sizeof(struct ip6_hdr), icmp6len);
 
+	if (send_sendso_input_hook != NULL) {
+		mtag = m_tag_get(PACKET_TAG_ND_OUTGOING,
+		    sizeof(unsigned short), M_NOWAIT);
+		if (mtag == NULL)
+			goto bad;
+		*(unsigned short *)(mtag + 1) = nd_na->nd_na_type;
+		m_tag_prepend(m, mtag);
+	}
+
 	ip6_output(m, NULL, &ro, 0, &im6o, NULL, NULL);
 	icmp6_ifstat_inc(ifp, ifs6_out_msg);
 	icmp6_ifstat_inc(ifp, ifs6_out_neighboradvert);
diff --git a/sys/netinet6/raw_ip6.c b/sys/netinet6/raw_ip6.c
index 936536087f6e..0e5e8e07e17d 100644
--- a/sys/netinet6/raw_ip6.c
+++ b/sys/netinet6/raw_ip6.c
@@ -92,6 +92,7 @@ __FBSDID("$FreeBSD$");
 
 #include <netinet/icmp6.h>
 #include <netinet/ip6.h>
+#include <netinet/ip_var.h>
 #include <netinet6/ip6protosw.h>
 #include <netinet6/ip6_mroute.h>
 #include <netinet6/in6_pcb.h>
@@ -99,6 +100,7 @@ __FBSDID("$FreeBSD$");
 #include <netinet6/nd6.h>
 #include <netinet6/raw_ip6.h>
 #include <netinet6/scope6_var.h>
+#include <netinet6/send.h>
 
 #ifdef IPSEC
 #include <netipsec/ipsec.h>
@@ -390,6 +392,7 @@ rip6_output(m, va_alist)
 #endif
 {
 	struct mbuf *control;
+	struct m_tag *mtag;
 	struct socket *so;
 	struct sockaddr_in6 *dstsock;
 	struct in6_addr *dst;
@@ -532,6 +535,23 @@ rip6_output(m, va_alist)
 		*p = in6_cksum(m, ip6->ip6_nxt, sizeof(*ip6), plen);
 	}
 
+	/*
+	 * Send RA/RS messages to user land for protection, before sending
+	 * them to rtadvd/rtsol.
+	 */
+	if ((send_sendso_input_hook != NULL) &&
+	    so->so_proto->pr_protocol == IPPROTO_ICMPV6) {
+		switch (type) {
+		case ND_ROUTER_ADVERT:
+		case ND_ROUTER_SOLICIT:
+			mtag = m_tag_get(PACKET_TAG_ND_OUTGOING,
+				sizeof(unsigned short), M_NOWAIT);
+			if (mtag == NULL)
+				goto bad;
+			m_tag_prepend(m, mtag);
+		}
+	}
+
 	error = ip6_output(m, optp, NULL, 0, in6p->in6p_moptions, &oifp, in6p);
 	if (so->so_proto->pr_protocol == IPPROTO_ICMPV6) {
 		if (oifp)
diff --git a/sys/netinet6/send.c b/sys/netinet6/send.c
new file mode 100644
index 000000000000..71d88d07a8a8
--- /dev/null
+++ b/sys/netinet6/send.c
@@ -0,0 +1,367 @@
+/*-
+ * Copyright (c) 2009-2010 Ana Kukec <anchie@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ */
+
+#include <sys/cdefs.h>
+__FBSDID("$FreeBSD$");
+
+#include <sys/param.h>
+#include <sys/kernel.h>
+#include <sys/mbuf.h>
+#include <sys/module.h>
+#include <sys/priv.h>
+#include <sys/protosw.h>
+#include <sys/systm.h>
+#include <sys/socket.h>
+#include <sys/sockstate.h>
+#include <sys/sockbuf.h>
+#include <sys/socketvar.h>
+#include <sys/types.h>
+
+#include <net/route.h>
+#include <net/if.h>
+#include <net/if_var.h>
+#include <net/vnet.h>
+
+#include <netinet/in.h>
+#include <netinet/ip_var.h>
+#include <netinet/ip6.h>
+#include <netinet/icmp6.h>
+
+#include <netinet6/in6_var.h>
+#include <netinet6/nd6.h>
+#include <netinet6/scope6_var.h>
+#include <netinet6/send.h>
+
+MALLOC_DEFINE(M_SEND, "send", "Secure Neighbour Discovery");
+
+/*
+ * The socket used to communicate with the SeND daemon.
+ */
+static VNET_DEFINE(struct socket *, send_so);
+#define	V_send_so	VNET(send_so)
+
+u_long	send_sendspace	= 8 * (1024 + sizeof(struct sockaddr_send));
+u_long	send_recvspace	= 9216;
+
+struct mtx	send_mtx;
+#define SEND_LOCK_INIT()	mtx_init(&send_mtx, "send_mtx", NULL, MTX_DEF)
+#define SEND_LOCK()		mtx_lock(&send_mtx)
+#define SEND_UNLOCK()		mtx_unlock(&send_mtx)
+#define SEND_LOCK_DESTROY()     mtx_destroy(&send_mtx)
+
+static int
+send_attach(struct socket *so, int proto, struct thread *td)
+{
+	int error;
+
+	SEND_LOCK();
+	if (V_send_so != NULL) {
+		SEND_UNLOCK();
+		return (EEXIST);
+	}
+
+	error = priv_check(td, PRIV_NETINET_RAW);
+	if (error) {
+		SEND_UNLOCK();
+		return(error);
+	}
+
+	if (proto != IPPROTO_SEND) {
+		SEND_UNLOCK();
+		return (EPROTONOSUPPORT);
+	}
+	error = soreserve(so, send_sendspace, send_recvspace);
+	if (error) {
+		SEND_UNLOCK();
+		return(error);
+	}
+
+	V_send_so = so;
+	SEND_UNLOCK();
+
+	return (0);
+}
+
+static int
+send_output(struct mbuf *m, struct ifnet *ifp, int direction)
+{
+	struct ip6_hdr *ip6;
+	struct sockaddr_in6 dst;
+	struct icmp6_hdr *icmp6;
+	int icmp6len;
+
+	/*
+	 * Receive incoming (SeND-protected) or outgoing traffic
+	 * (SeND-validated) from the SeND user space application.
+	 */
+
+	switch (direction) {
+	case SND_IN:
+		if (m->m_len < (sizeof(struct ip6_hdr) +
+		    sizeof(struct icmp6_hdr))) {
+			m = m_pullup(m, sizeof(struct ip6_hdr) +
+			    sizeof(struct icmp6_hdr));
+			if (!m)
+				return (ENOBUFS);
+		}
+
+		/* Before passing off the mbuf record the proper interface. */
+		m->m_pkthdr.rcvif = ifp;
+
+		if (m->m_flags & M_PKTHDR)
+			icmp6len = m->m_pkthdr.len - sizeof(struct ip6_hdr);
+		else
+			panic("Doh! not the first mbuf.");
+
+		ip6 = mtod(m, struct ip6_hdr *);
+		icmp6 = (struct icmp6_hdr *)(ip6 + 1);
+
+		/*
+		 * Output the packet as icmp6.c:icpm6_input() would do.
+		 * The mbuf is always consumed, so we do not have to
+		 * care about that.
+		 */
+		switch (icmp6->icmp6_type) {
+		case ND_NEIGHBOR_SOLICIT:
+			nd6_ns_input(m, sizeof(struct ip6_hdr), icmp6len);
+			break;
+		case ND_NEIGHBOR_ADVERT:
+			nd6_na_input(m, sizeof(struct ip6_hdr), icmp6len);
+			break;
+		case ND_REDIRECT:
+			icmp6_redirect_input(m, sizeof(struct ip6_hdr));
+			break;
+		case ND_ROUTER_SOLICIT:
+			nd6_rs_input(m, sizeof(struct ip6_hdr), icmp6len);
+			break;
+		case ND_ROUTER_ADVERT:
+			nd6_ra_input(m, sizeof(struct ip6_hdr), icmp6len);
+			break;
+		default:
+			return (ENOSYS);
+		}
+		return (0);
+
+	case SND_OUT:
+		if (m->m_len < sizeof(struct ip6_hdr)) {
+			m = m_pullup(m, sizeof(struct ip6_hdr));
+			if (!m)
+				return (ENOBUFS);
+		}
+		ip6 = mtod(m, struct ip6_hdr *);
+		if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
+			m->m_flags |= M_MCAST;
+
+		bzero(&dst, sizeof(dst));
+		dst.sin6_family = AF_INET6;
+		dst.sin6_len = sizeof(dst);
+		dst.sin6_addr = ip6->ip6_dst;
+
+		/*
+		 * Output the packet as nd6.c:nd6_output_lle() would do.
+		 * The mbuf is always consumed, so we do not have to care
+		 * about that.
+		 * XXX-BZ as we added data, what about fragmenting,
+		 * if now needed?
+		 */
+		int error;
+		error = ((*ifp->if_output)(ifp, m, (struct sockaddr *)&dst,
+		    NULL));
+		if (error)
+			error = ENOENT;
+		return (error);
+
+	default:
+		panic("%s: direction %d neither SND_IN nor SND_OUT.",
+		     __func__, direction);
+	}
+}
+
+/*
+ * Receive a SeND message from user space to be either send out by the kernel
+ * or, with SeND ICMPv6 options removed, to be further processed by the icmp6
+ * input path.
+ */
+static int
+send_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *nam,
+    struct mbuf *control, struct thread *td)
+{
+	struct sockaddr_send *sendsrc;
+	struct ifnet *ifp;
+	int error;
+
+	KASSERT(V_send_so == so, ("%s: socket %p not send socket %p",
+		__func__, so, V_send_so));
+
+	sendsrc = (struct sockaddr_send *)nam;
+	ifp = ifnet_byindex_ref(sendsrc->send_ifidx);
+	if (ifp == NULL) {
+		error = ENETUNREACH;
+		goto err;
+	}
+
+	error = send_output(m, ifp, sendsrc->send_direction);
+	if_rele(ifp);
+	m = NULL;
+
+err:
+	if (m != NULL)
+		m_freem(m);
+	return (error);
+}
+
+static void
+send_close(struct socket *so)
+{
+
+	SEND_LOCK();
+	if (V_send_so)
+		V_send_so = NULL;
+	SEND_UNLOCK();
+}
+
+/*
+ * Send a SeND message to user space, that was either received and has to be
+ * validated or was about to be send out and has to be handled by the SEND
+ * daemon adding SeND ICMPv6 options.
+ */
+static int
+send_input(struct mbuf *m, struct ifnet *ifp, int direction, int msglen __unused)
+{
+	struct ip6_hdr *ip6;
+	struct sockaddr_send sendsrc;
+
+	SEND_LOCK();
+	if (V_send_so == NULL) {
+		SEND_UNLOCK();
+		return (-1);
+	}
+
+	/*
+	 * Make sure to clear any possible internally embedded scope before
+	 * passing the packet to user space for SeND cryptographic signature
+	 * validation to succeed.
+	 */
+	ip6 = mtod(m, struct ip6_hdr *);
+	in6_clearscope(&ip6->ip6_src);
+	in6_clearscope(&ip6->ip6_dst);
+
+	bzero(&sendsrc, sizeof(sendsrc));
+	sendsrc.send_len = sizeof(sendsrc);
+	sendsrc.send_family = AF_INET6;
+	sendsrc.send_direction = direction;
+	sendsrc.send_ifidx = ifp->if_index;
+
+	/*
+	 * Send incoming or outgoing traffic to user space either to be
+	 * protected (outgoing) or validated (incoming) according to rfc3971.
+	 */
+	SOCKBUF_LOCK(&V_send_so->so_rcv);
+	if (sbappendaddr_locked(&V_send_so->so_rcv,
+	    (struct sockaddr *)&sendsrc, m, NULL) == 0) {
+		SOCKBUF_UNLOCK(&V_send_so->so_rcv);
+		/* XXX stats. */
+		m_freem(m);
+	} else {
+		sorwakeup_locked(V_send_so);
+	}
+
+	SEND_UNLOCK();
+	return (0);
+}
+
+struct pr_usrreqs send_usrreqs = {
+	.pru_attach =		send_attach,
+	.pru_send =		send_send,
+	.pru_detach =		send_close
+};
+struct protosw send_protosw = {
+	.pr_type =		SOCK_RAW,
+	.pr_flags =		PR_ATOMIC|PR_ADDR,
+	.pr_protocol =		IPPROTO_SEND,
+	.pr_usrreqs =		&send_usrreqs
+};
+
+static int
+send_modevent(module_t mod, int type, void *unused)
+{
+#ifdef __notyet__
+	VNET_ITERATOR_DECL(vnet_iter);
+#endif
+	int error;
+
+	switch (type) {
+	case MOD_LOAD:
+		SEND_LOCK_INIT();
+
+		error = pf_proto_register(PF_INET6, &send_protosw);
+		if (error != 0) {
+			printf("%s:%d: MOD_LOAD pf_proto_register(): %d\n",
+			   __func__, __LINE__, error);
+			SEND_LOCK_DESTROY();
+			break;
+		}
+		send_sendso_input_hook = send_input;
+		break;
+	case MOD_UNLOAD:
+		/* Do not allow unloading w/o locking. */
+		return (EBUSY);
+#ifdef __notyet__
+		VNET_LIST_RLOCK_NOSLEEP();
+		SEND_LOCK();
+		VNET_FOREACH(vnet_iter) {
+			CURVNET_SET(vnet_iter);
+			if (V_send_so != NULL) {
+				CURVNET_RESTORE();
+				SEND_UNLOCK();
+				VNET_LIST_RUNLOCK_NOSLEEP();
+				return (EBUSY);
+			}
+			CURVNET_RESTORE();
+		}
+		SEND_UNLOCK();
+		VNET_LIST_RUNLOCK_NOSLEEP();
+		error = pf_proto_unregister(PF_INET6, IPPROTO_SEND, SOCK_RAW);
+		if (error == 0)
+			SEND_LOCK_DESTROY();
+		send_sendso_input_hook = NULL;
+		break;
+#endif
+	default:
+		error = 0;
+		break;
+	}
+
+	return (error);
+}
+
+static moduledata_t sendmod = {
+	"send",
+	send_modevent,
+	0
+};
+
+DECLARE_MODULE(send, sendmod, SI_SUB_PROTO_DOMAIN, SI_ORDER_ANY);
diff --git a/sys/netinet6/send.h b/sys/netinet6/send.h
new file mode 100644
index 000000000000..36ba571a554a
--- /dev/null
+++ b/sys/netinet6/send.h
@@ -0,0 +1,45 @@
+/*-
+ * Copyright (c) 2009-2010 Ana Kukec <anchie@FreeBSD.org>
+ * All rights reserved.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _NETINET6_SEND_H_
+#define _NETINET6_SEND_H_
+
+#define	SND_OUT		0	/* Outgoing traffic */
+#define	SND_IN		1	/* Incoming traffic. */
+
+struct sockaddr_send {
+	unsigned char		send_len;	/* total length */
+	sa_family_t		send_family;	/* address family */
+	int			send_direction;
+	int			send_ifidx;
+	char			send_zero[8];
+};
+
+extern int (*send_sendso_input_hook)(struct mbuf *, struct ifnet *, int, int);
+
+#endif /* _NETINET6_SEND_H_ */
diff --git a/sys/sys/mbuf.h b/sys/sys/mbuf.h
index 95a44a4aecfc..654f1450b5eb 100644
--- a/sys/sys/mbuf.h
+++ b/sys/sys/mbuf.h
@@ -903,6 +903,7 @@ struct mbuf	*m_unshare(struct mbuf *, int how);
 #define	PACKET_TAG_IPOPTIONS			27 /* Saved IP options */
 #define	PACKET_TAG_CARP				28 /* CARP info */
 #define	PACKET_TAG_IPSEC_NAT_T_PORTS		29 /* two uint16_t */
+#define	PACKET_TAG_ND_OUTGOING			30 /* ND outgoing */
 
 /* Specific cookies and tags. */