bsd/netinet6/in6_pcb.c

   1 /*
   2  * Copyright (c) 2003-2013 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /*
  29  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  30  * All rights reserved.
  31  *
  32  * Redistribution and use in source and binary forms, with or without
  33  * modification, are permitted provided that the following conditions
  34  * are met:
  35  * 1. Redistributions of source code must retain the above copyright
  36  *    notice, this list of conditions and the following disclaimer.
  37  * 2. Redistributions in binary form must reproduce the above copyright
  38  *    notice, this list of conditions and the following disclaimer in the
  39  *    documentation and/or other materials provided with the distribution.
  40  * 3. Neither the name of the project nor the names of its contributors
  41  *    may be used to endorse or promote products derived from this software
  42  *    without specific prior written permission.
  43  *
  44  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  45  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  46  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  47  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  48  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  49  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  50  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  51  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  52  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  53  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  54  * SUCH DAMAGE.
  55  *
  56  */
  57
  58 /*
  59  * Copyright (c) 1982, 1986, 1991, 1993
  60  *      The Regents of the University of California.  All rights reserved.
  61  *
  62  * Redistribution and use in source and binary forms, with or without
  63  * modification, are permitted provided that the following conditions
  64  * are met:
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  * 2. Redistributions in binary form must reproduce the above copyright
  68  *    notice, this list of conditions and the following disclaimer in the
  69  *    documentation and/or other materials provided with the distribution.
  70  * 3. All advertising materials mentioning features or use of this software
  71  *    must display the following acknowledgement:
  72  *      This product includes software developed by the University of
  73  *      California, Berkeley and its contributors.
  74  * 4. Neither the name of the University nor the names of its contributors
  75  *    may be used to endorse or promote products derived from this software
  76  *    without specific prior written permission.
  77  *
  78  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  79  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  80  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  81  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  82  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  83  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  84  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  85  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  86  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  87  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  88  * SUCH DAMAGE.
  89  *
  90  *      @(#)in_pcb.c    8.2 (Berkeley) 1/4/94
  91  */
  92
  93 #include <sys/param.h>
  94 #include <sys/systm.h>
  95 #include <sys/malloc.h>
  96 #include <sys/mbuf.h>
  97 #include <sys/domain.h>
  98 #include <sys/protosw.h>
  99 #include <sys/socket.h>
 100 #include <sys/socketvar.h>
 101 #include <sys/sockio.h>
 102 #include <sys/errno.h>
 103 #include <sys/time.h>
 104 #include <sys/proc.h>
 105 #include <sys/kauth.h>
 106 #include <sys/priv.h>
 107
 108 #include <net/if.h>
 109 #include <net/if_types.h>
 110 #include <net/route.h>
 111 #include <net/ntstat.h>
 112
 113 #include <netinet/in.h>
 114 #include <netinet/in_var.h>
 115 #include <netinet/in_systm.h>
 116 #include <netinet/ip6.h>
 117 #include <netinet/ip_var.h>
 118 #include <netinet6/ip6_var.h>
 119 #include <netinet6/nd6.h>
 120 #include <netinet/in_pcb.h>
 121 #include <netinet6/in6_pcb.h>
 122 #include <net/if_types.h>
 123 #include <net/if_var.h>
 124
 125 #include <kern/kern_types.h>
 126 #include <kern/zalloc.h>
 127
 128 #if IPSEC
 129 #include <netinet6/ipsec.h>
 130 #if INET6
 131 #include <netinet6/ipsec6.h>
 132 #endif
 133 #include <netinet6/ah.h>
 134 #if INET6
 135 #include <netinet6/ah6.h>
 136 #endif
 137 #include <netkey/key.h>
 138 #endif /* IPSEC */
 139
 140 #if NECP
 141 #include <net/necp.h>
 142 #endif /* NECP */
 143
 144 /*
 145  * in6_pcblookup_local_and_cleanup does everything
 146  * in6_pcblookup_local does but it checks for a socket
 147  * that's going away. Since we know that the lock is
 148  * held read+write when this function is called, we
 149  * can safely dispose of this socket like the slow
 150  * timer would usually do and return NULL. This is
 151  * great for bind.
 152  */
 153 static struct inpcb *
 154 in6_pcblookup_local_and_cleanup(struct inpcbinfo *pcbinfo,
 155     struct in6_addr *laddr, u_int lport_arg, int wild_okay)
 156 {
 157         struct inpcb *inp;
 158
 159         /* Perform normal lookup */
 160         inp = in6_pcblookup_local(pcbinfo, laddr, lport_arg, wild_okay);
 161
 162         /* Check if we found a match but it's waiting to be disposed */
 163         if (inp != NULL && inp->inp_wantcnt == WNT_STOPUSING) {
 164                 struct socket *so = inp->inp_socket;
 165
 166                 socket_lock(so, 0);
 167
 168                 if (so->so_usecount == 0) {
 169                         if (inp->inp_state != INPCB_STATE_DEAD)
 170                                 in6_pcbdetach(inp);
 171                         in_pcbdispose(inp);     /* will unlock & destroy */
 172                         inp = NULL;
 173                 } else {
 174                         socket_unlock(so, 0);
 175                 }
 176         }
 177
 178         return (inp);
 179 }
 180
 181 /*
 182  * Bind an INPCB to an address and/or port.  This routine should not alter
 183  * the caller-supplied local address "nam".
 184  */
 185 int
 186 in6_pcbbind(struct inpcb *inp, struct sockaddr *nam, struct proc *p)
 187 {
 188         struct socket *so = inp->inp_socket;
 189         struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
 190         u_short lport = 0;
 191         int wild = 0, reuseport = (so->so_options & SO_REUSEPORT);
 192         struct ifnet *outif = NULL;
 193         struct sockaddr_in6 sin6;
 194 #if !CONFIG_EMBEDDED
 195         int error;
 196         kauth_cred_t cred;
 197 #endif /* !CONFIG_EMBEDDED */
 198
 199         if (!in6_ifaddrs) /* XXX broken! */
 200                 return (EADDRNOTAVAIL);
 201         if (inp->inp_lport || !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr))
 202                 return (EINVAL);
 203         if (!(so->so_options & (SO_REUSEADDR|SO_REUSEPORT)))
 204                 wild = 1;
 205
 206         socket_unlock(so, 0); /* keep reference */
 207         lck_rw_lock_exclusive(pcbinfo->ipi_lock);
 208
 209         bzero(&sin6, sizeof (sin6));
 210         if (nam != NULL) {
 211                 if (nam->sa_len != sizeof (struct sockaddr_in6)) {
 212                         lck_rw_done(pcbinfo->ipi_lock);
 213                         socket_lock(so, 0);
 214                         return (EINVAL);
 215                 }
 216                 /*
 217                  * family check.
 218                  */
 219                 if (nam->sa_family != AF_INET6) {
 220                         lck_rw_done(pcbinfo->ipi_lock);
 221                         socket_lock(so, 0);
 222                         return (EAFNOSUPPORT);
 223                 }
 224                 lport = SIN6(nam)->sin6_port;
 225
 226                 *(&sin6) = *SIN6(nam);
 227
 228                 /* KAME hack: embed scopeid */
 229                 if (in6_embedscope(&sin6.sin6_addr, &sin6, inp, NULL,
 230                     NULL) != 0) {
 231                         lck_rw_done(pcbinfo->ipi_lock);
 232                         socket_lock(so, 0);
 233                         return (EINVAL);
 234                 }
 235
 236                 /* Sanitize local copy for address searches */
 237                 sin6.sin6_flowinfo = 0;
 238                 sin6.sin6_scope_id = 0;
 239                 sin6.sin6_port = 0;
 240
 241                 if (IN6_IS_ADDR_MULTICAST(&sin6.sin6_addr)) {
 242                         /*
 243                          * Treat SO_REUSEADDR as SO_REUSEPORT for multicast;
 244                          * allow compepte duplication of binding if
 245                          * SO_REUSEPORT is set, or if SO_REUSEADDR is set
 246                          * and a multicast address is bound on both
 247                          * new and duplicated sockets.
 248                          */
 249                         if (so->so_options & SO_REUSEADDR)
 250                                 reuseport = SO_REUSEADDR|SO_REUSEPORT;
 251                 } else if (!IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr)) {
 252                         struct ifaddr *ifa;
 253
 254                         ifa = ifa_ifwithaddr(SA(&sin6));
 255                         if (ifa == NULL) {
 256                                 lck_rw_done(pcbinfo->ipi_lock);
 257                                 socket_lock(so, 0);
 258                                 return (EADDRNOTAVAIL);
 259                         } else {
 260                                 /*
 261                                  * XXX: bind to an anycast address might
 262                                  * accidentally cause sending a packet with
 263                                  * anycast source address.  We should allow
 264                                  * to bind to a deprecated address, since
 265                                  * the application dare to use it.
 266                                  */
 267                                 IFA_LOCK_SPIN(ifa);
 268                                 if (((struct in6_ifaddr *)ifa)->ia6_flags &
 269                                     (IN6_IFF_ANYCAST|IN6_IFF_NOTREADY|
 270                                     IN6_IFF_DETACHED)) {
 271                                         IFA_UNLOCK(ifa);
 272                                         IFA_REMREF(ifa);
 273                                         lck_rw_done(pcbinfo->ipi_lock);
 274                                         socket_lock(so, 0);
 275                                         return (EADDRNOTAVAIL);
 276                                 }
 277                                 /*
 278                                  * Opportunistically determine the outbound
 279                                  * interface that may be used; this may not
 280                                  * hold true if we end up using a route
 281                                  * going over a different interface, e.g.
 282                                  * when sending to a local address.  This
 283                                  * will get updated again after sending.
 284                                  */
 285                                 outif = ifa->ifa_ifp;
 286                                 IFA_UNLOCK(ifa);
 287                                 IFA_REMREF(ifa);
 288                         }
 289                 }
 290                 if (lport != 0) {
 291                         struct inpcb *t;
 292                         uid_t u;
 293
 294                         /* GROSS */
 295 #if !CONFIG_EMBEDDED
 296                         if (ntohs(lport) < IPV6PORT_RESERVED) {
 297                                 cred = kauth_cred_proc_ref(p);
 298                                 error = priv_check_cred(cred,
 299                                     PRIV_NETINET_RESERVEDPORT, 0);
 300                                 kauth_cred_unref(&cred);
 301                                 if (error != 0) {
 302                                         lck_rw_done(pcbinfo->ipi_lock);
 303                                         socket_lock(so, 0);
 304                                         return (EACCES);
 305                                 }
 306                         }
 307 #endif /* !CONFIG_EMBEDDED */
 308                         if (!IN6_IS_ADDR_MULTICAST(&sin6.sin6_addr) &&
 309                             (u = kauth_cred_getuid(so->so_cred)) != 0) {
 310                                 t = in6_pcblookup_local_and_cleanup(pcbinfo,
 311                                     &sin6.sin6_addr, lport,
 312                                     INPLOOKUP_WILDCARD);
 313                                 if (t != NULL && (!IN6_IS_ADDR_UNSPECIFIED(
 314                                     &sin6.sin6_addr) ||
 315                                     !IN6_IS_ADDR_UNSPECIFIED(&t->in6p_laddr) ||
 316                                     !(t->inp_socket->so_options &
 317                                     SO_REUSEPORT)) && (u != kauth_cred_getuid(
 318                                     t->inp_socket->so_cred)) &&
 319                                     !(t->inp_socket->so_flags &
 320                                     SOF_REUSESHAREUID)) {
 321                                         lck_rw_done(pcbinfo->ipi_lock);
 322                                         socket_lock(so, 0);
 323                                         return (EADDRINUSE);
 324                                 }
 325                                 if (!(inp->inp_flags & IN6P_IPV6_V6ONLY) &&
 326                                     IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr)) {
 327                                         struct sockaddr_in sin;
 328
 329                                         in6_sin6_2_sin(&sin, &sin6);
 330                                         t = in_pcblookup_local_and_cleanup(
 331                                             pcbinfo, sin.sin_addr, lport,
 332                                             INPLOOKUP_WILDCARD);
 333                                         if (t != NULL &&
 334                                             !(t->inp_socket->so_options &
 335                                             SO_REUSEPORT) &&
 336                                             (kauth_cred_getuid(so->so_cred) !=
 337                                             kauth_cred_getuid(t->inp_socket->
 338                                             so_cred)) && (t->inp_laddr.s_addr !=
 339                                             INADDR_ANY || SOCK_DOM(so) ==
 340                                             SOCK_DOM(t->inp_socket))) {
 341                                                 lck_rw_done(pcbinfo->ipi_lock);
 342                                                 socket_lock(so, 0);
 343                                                 return (EADDRINUSE);
 344                                         }
 345                                 }
 346                         }
 347                         t = in6_pcblookup_local_and_cleanup(pcbinfo,
 348                             &sin6.sin6_addr, lport, wild);
 349                         if (t != NULL &&
 350                             (reuseport & t->inp_socket->so_options) == 0) {
 351                                 lck_rw_done(pcbinfo->ipi_lock);
 352                                 socket_lock(so, 0);
 353                                 return (EADDRINUSE);
 354                         }
 355                         if (!(inp->inp_flags & IN6P_IPV6_V6ONLY) &&
 356                             IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr)) {
 357                                 struct sockaddr_in sin;
 358
 359                                 in6_sin6_2_sin(&sin, &sin6);
 360                                 t = in_pcblookup_local_and_cleanup(pcbinfo,
 361                                     sin.sin_addr, lport, wild);
 362                                 if (t != NULL && (reuseport &
 363                                     t->inp_socket->so_options) == 0 &&
 364                                     (t->inp_laddr.s_addr != INADDR_ANY ||
 365                                     SOCK_DOM(so) == SOCK_DOM(t->inp_socket))) {
 366                                         lck_rw_done(pcbinfo->ipi_lock);
 367                                         socket_lock(so, 0);
 368                                         return (EADDRINUSE);
 369                                 }
 370                         }
 371                 }
 372         }
 373
 374         socket_lock(so, 0);
 375         /*
 376          * We unlocked socket's protocol lock for a long time.
 377          * The socket might have been dropped/defuncted.
 378          * Checking if world has changed since.
 379          */
 380         if (inp->inp_state == INPCB_STATE_DEAD) {
 381                 lck_rw_done(pcbinfo->ipi_lock);
 382                 return (ECONNABORTED);
 383         }
 384
 385         /* check if the socket got bound when the lock was released */
 386         if (inp->inp_lport || !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
 387                 lck_rw_done(pcbinfo->ipi_lock);
 388                 return (EINVAL);
 389         }
 390
 391         if (!IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr)) {
 392                 inp->in6p_laddr = sin6.sin6_addr;
 393                 inp->in6p_last_outifp = outif;
 394         }
 395
 396         if (lport == 0) {
 397                 int e;
 398                 if ((e = in6_pcbsetport(&inp->in6p_laddr, inp, p, 1)) != 0) {
 399                         /* Undo any address bind from above. */
 400                         inp->in6p_laddr = in6addr_any;
 401                         inp->in6p_last_outifp = NULL;
 402                         lck_rw_done(pcbinfo->ipi_lock);
 403                         return (e);
 404                 }
 405         } else {
 406                 inp->inp_lport = lport;
 407                 if (in_pcbinshash(inp, 1) != 0) {
 408                         inp->in6p_laddr = in6addr_any;
 409                         inp->inp_lport = 0;
 410                         inp->in6p_last_outifp = NULL;
 411                         lck_rw_done(pcbinfo->ipi_lock);
 412                         return (EAGAIN);
 413                 }
 414         }
 415         lck_rw_done(pcbinfo->ipi_lock);
 416         sflt_notify(so, sock_evt_bound, NULL);
 417         return (0);
 418 }
 419
 420 /*
 421  * Transform old in6_pcbconnect() into an inner subroutine for new
 422  * in6_pcbconnect(); do some validity-checking on the remote address
 423  * (in "nam") and then determine local host address (i.e., which
 424  * interface) to use to access that remote host.
 425  *
 426  * This routine may alter the caller-supplied remote address "nam".
 427  *
 428  * This routine might return an ifp with a reference held if the caller
 429  * provides a non-NULL outif, even in the error case.  The caller is
 430  * responsible for releasing its reference.
 431  */
 432 int
 433 in6_pcbladdr(struct inpcb *inp, struct sockaddr *nam,
 434     struct in6_addr *plocal_addr6, struct ifnet **outif)
 435 {
 436         struct in6_addr *addr6 = NULL;
 437         struct in6_addr src_storage;
 438         int error = 0;
 439         unsigned int ifscope;
 440
 441         if (outif != NULL)
 442                 *outif = NULL;
 443         if (nam->sa_len != sizeof (struct sockaddr_in6))
 444                 return (EINVAL);
 445         if (SIN6(nam)->sin6_family != AF_INET6)
 446                 return (EAFNOSUPPORT);
 447         if (SIN6(nam)->sin6_port == 0)
 448                 return (EADDRNOTAVAIL);
 449
 450         /* KAME hack: embed scopeid */
 451         if (in6_embedscope(&SIN6(nam)->sin6_addr, SIN6(nam), inp, NULL, NULL) != 0)
 452                 return (EINVAL);
 453
 454         if (in6_ifaddrs) {
 455                 /*
 456                  * If the destination address is UNSPECIFIED addr,
 457                  * use the loopback addr, e.g ::1.
 458                  */
 459                 if (IN6_IS_ADDR_UNSPECIFIED(&SIN6(nam)->sin6_addr))
 460                         SIN6(nam)->sin6_addr = in6addr_loopback;
 461         }
 462
 463         ifscope = (inp->inp_flags & INP_BOUND_IF) ?
 464             inp->inp_boundifp->if_index : IFSCOPE_NONE;
 465
 466         /*
 467          * XXX: in6_selectsrc might replace the bound local address
 468          * with the address specified by setsockopt(IPV6_PKTINFO).
 469          * Is it the intended behavior?
 470          *
 471          * in6_selectsrc() might return outif with its reference held
 472          * even in the error case; caller always needs to release it
 473          * if non-NULL.
 474          */
 475         addr6 = in6_selectsrc(SIN6(nam), inp->in6p_outputopts, inp,
 476             &inp->in6p_route, outif, &src_storage, ifscope, &error);
 477
 478         if (outif != NULL) {
 479                 struct rtentry *rt = inp->in6p_route.ro_rt;
 480                 /*
 481                  * If in6_selectsrc() returns a route, it should be one
 482                  * which points to the same ifp as outif.  Just in case
 483                  * it isn't, use the one from the route for consistency.
 484                  * Otherwise if there is no route, leave outif alone as
 485                  * it could still be useful to the caller.
 486                  */
 487                 if (rt != NULL && rt->rt_ifp != *outif) {
 488                         ifnet_reference(rt->rt_ifp);    /* for caller */
 489                         if (*outif != NULL)
 490                                 ifnet_release(*outif);
 491                         *outif = rt->rt_ifp;
 492                 }
 493         }
 494
 495         if (addr6 == NULL) {
 496                 if (outif != NULL && (*outif) != NULL &&
 497                     inp_restricted_send(inp, *outif)) {
 498                         soevent(inp->inp_socket,
 499                             (SO_FILT_HINT_LOCKED | SO_FILT_HINT_IFDENIED));
 500                         error = EHOSTUNREACH;
 501                 }
 502                 if (error == 0)
 503                         error = EADDRNOTAVAIL;
 504                 return (error);
 505         }
 506
 507         *plocal_addr6 = *addr6;
 508         /*
 509          * Don't do pcblookup call here; return interface in
 510          * plocal_addr6 and exit to caller, that will do the lookup.
 511          */
 512         return (0);
 513 }
 514
 515 /*
 516  * Outer subroutine:
 517  * Connect from a socket to a specified address.
 518  * Both address and port must be specified in argument sin.
 519  * If don't have a local address for this socket yet,
 520  * then pick one.
 521  */
 522 int
 523 in6_pcbconnect(struct inpcb *inp, struct sockaddr *nam, struct proc *p)
 524 {
 525         struct in6_addr addr6;
 526         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)(void *)nam;
 527         struct inpcb *pcb;
 528         int error = 0;
 529         struct ifnet *outif = NULL;
 530         struct socket *so = inp->inp_socket;
 531
 532         if (so->so_proto->pr_protocol == IPPROTO_UDP &&
 533             sin6->sin6_port == htons(53) && !(so->so_flags1 & SOF1_DNS_COUNTED)) {
 534                 so->so_flags1 |= SOF1_DNS_COUNTED;
 535                 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_dns);
 536         }
 537
 538         /*
 539          * Call inner routine, to assign local interface address.
 540          * in6_pcbladdr() may automatically fill in sin6_scope_id.
 541          *
 542          * in6_pcbladdr() might return an ifp with its reference held
 543          * even in the error case, so make sure that it's released
 544          * whenever it's non-NULL.
 545          */
 546         if ((error = in6_pcbladdr(inp, nam, &addr6, &outif)) != 0) {
 547                 if (outif != NULL && inp_restricted_send(inp, outif))
 548                         soevent(so,
 549                             (SO_FILT_HINT_LOCKED | SO_FILT_HINT_IFDENIED));
 550                 goto done;
 551         }
 552         socket_unlock(so, 0);
 553         pcb = in6_pcblookup_hash(inp->inp_pcbinfo, &sin6->sin6_addr,
 554             sin6->sin6_port, IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr) ?
 555             &addr6 : &inp->in6p_laddr, inp->inp_lport, 0, NULL);
 556         socket_lock(so, 0);
 557         if (pcb != NULL) {
 558                 in_pcb_checkstate(pcb, WNT_RELEASE, pcb == inp ? 1 : 0);
 559                 error = EADDRINUSE;
 560                 goto done;
 561         }
 562         if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
 563                 if (inp->inp_lport == 0) {
 564                         error = in6_pcbbind(inp, NULL, p);
 565                         if (error)
 566                                 goto done;
 567                 }
 568                 inp->in6p_laddr = addr6;
 569                 inp->in6p_last_outifp = outif;  /* no reference needed */
 570                 inp->in6p_flags |= INP_IN6ADDR_ANY;
 571         }
 572         if (!lck_rw_try_lock_exclusive(inp->inp_pcbinfo->ipi_lock)) {
 573                 /* lock inversion issue, mostly with udp multicast packets */
 574                 socket_unlock(so, 0);
 575                 lck_rw_lock_exclusive(inp->inp_pcbinfo->ipi_lock);
 576                 socket_lock(so, 0);
 577         }
 578         inp->in6p_faddr = sin6->sin6_addr;
 579         inp->inp_fport = sin6->sin6_port;
 580         if (nstat_collect && SOCK_PROTO(so) == IPPROTO_UDP)
 581                 nstat_pcb_invalidate_cache(inp);
 582         in_pcbrehash(inp);
 583         lck_rw_done(inp->inp_pcbinfo->ipi_lock);
 584
 585 done:
 586         if (outif != NULL)
 587                 ifnet_release(outif);
 588
 589         return (error);
 590 }
 591
 592 void
 593 in6_pcbdisconnect(struct inpcb *inp)
 594 {
 595         struct socket *so = inp->inp_socket;
 596
 597         if (!lck_rw_try_lock_exclusive(inp->inp_pcbinfo->ipi_lock)) {
 598                 /* lock inversion issue, mostly with udp multicast packets */
 599                 socket_unlock(so, 0);
 600                 lck_rw_lock_exclusive(inp->inp_pcbinfo->ipi_lock);
 601                 socket_lock(so, 0);
 602         }
 603         if (nstat_collect && SOCK_PROTO(so) == IPPROTO_UDP)
 604                 nstat_pcb_cache(inp);
 605         bzero((caddr_t)&inp->in6p_faddr, sizeof (inp->in6p_faddr));
 606         inp->inp_fport = 0;
 607         /* clear flowinfo - RFC 6437 */
 608         inp->inp_flow &= ~IPV6_FLOWLABEL_MASK;
 609         in_pcbrehash(inp);
 610         lck_rw_done(inp->inp_pcbinfo->ipi_lock);
 611         /*
 612          * A multipath subflow socket would have its SS_NOFDREF set by default,
 613          * so check for SOF_MP_SUBFLOW socket flag before detaching the PCB;
 614          * when the socket is closed for real, SOF_MP_SUBFLOW would be cleared.
 615          */
 616         if (!(so->so_flags & SOF_MP_SUBFLOW) && (so->so_state & SS_NOFDREF))
 617                 in6_pcbdetach(inp);
 618 }
 619
 620 void
 621 in6_pcbdetach(struct inpcb *inp)
 622 {
 623         struct socket *so = inp->inp_socket;
 624
 625         if (so->so_pcb == NULL) {
 626                 /* PCB has been disposed */
 627                 panic("%s: inp=%p so=%p proto=%d so_pcb is null!\n", __func__,
 628                     inp, so, SOCK_PROTO(so));
 629                 /* NOTREACHED */
 630         }
 631
 632 #if IPSEC
 633         if (inp->in6p_sp != NULL) {
 634                 (void) ipsec6_delete_pcbpolicy(inp);
 635         }
 636 #endif /* IPSEC */
 637
 638         if (inp->inp_stat != NULL && SOCK_PROTO(so) == IPPROTO_UDP) {
 639                 if (inp->inp_stat->rxpackets == 0 && inp->inp_stat->txpackets == 0) {
 640                         INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet6_dgram_no_data);
 641                 }
 642         }
 643
 644         /*
 645          * Let NetworkStatistics know this PCB is going away
 646          * before we detach it.
 647          */
 648         if (nstat_collect &&
 649             (SOCK_PROTO(so) == IPPROTO_TCP || SOCK_PROTO(so) == IPPROTO_UDP))
 650                 nstat_pcb_detach(inp);
 651         /* mark socket state as dead */
 652         if (in_pcb_checkstate(inp, WNT_STOPUSING, 1) != WNT_STOPUSING) {
 653                 panic("%s: so=%p proto=%d couldn't set to STOPUSING\n",
 654                     __func__, so, SOCK_PROTO(so));
 655                 /* NOTREACHED */
 656         }
 657
 658         if (!(so->so_flags & SOF_PCBCLEARING)) {
 659                 struct ip_moptions *imo;
 660                 struct ip6_moptions *im6o;
 661
 662                 inp->inp_vflag = 0;
 663                 if (inp->in6p_options != NULL) {
 664                         m_freem(inp->in6p_options);
 665                         inp->in6p_options = NULL;
 666                 }
 667                 ip6_freepcbopts(inp->in6p_outputopts);
 668                 ROUTE_RELEASE(&inp->in6p_route);
 669                 /* free IPv4 related resources in case of mapped addr */
 670                 if (inp->inp_options != NULL) {
 671                         (void) m_free(inp->inp_options);
 672                         inp->inp_options = NULL;
 673                 }
 674                 im6o = inp->in6p_moptions;
 675                 inp->in6p_moptions = NULL;
 676
 677                 imo = inp->inp_moptions;
 678                 inp->inp_moptions = NULL;
 679
 680                 sofreelastref(so, 0);
 681                 inp->inp_state = INPCB_STATE_DEAD;
 682                 /* makes sure we're not called twice from so_close */
 683                 so->so_flags |= SOF_PCBCLEARING;
 684
 685                 inpcb_gc_sched(inp->inp_pcbinfo, INPCB_TIMER_FAST);
 686
 687                 /*
 688                  * See inp_join_group() for why we need to unlock
 689                  */
 690                 if (im6o != NULL || imo != NULL) {
 691                         socket_unlock(so, 0);
 692                         if (im6o != NULL)
 693                                 IM6O_REMREF(im6o);
 694                         if (imo != NULL)
 695                                 IMO_REMREF(imo);
 696                         socket_lock(so, 0);
 697                 }
 698         }
 699 }
 700
 701 struct sockaddr *
 702 in6_sockaddr(in_port_t port, struct in6_addr *addr_p)
 703 {
 704         struct sockaddr_in6 *sin6;
 705
 706         MALLOC(sin6, struct sockaddr_in6 *, sizeof (*sin6), M_SONAME, M_WAITOK);
 707         if (sin6 == NULL)
 708                 return (NULL);
 709         bzero(sin6, sizeof (*sin6));
 710         sin6->sin6_family = AF_INET6;
 711         sin6->sin6_len = sizeof (*sin6);
 712         sin6->sin6_port = port;
 713         sin6->sin6_addr = *addr_p;
 714
 715         /* would be good to use sa6_recoverscope(), except for locking  */
 716         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr))
 717                 sin6->sin6_scope_id = ntohs(sin6->sin6_addr.s6_addr16[1]);
 718         else
 719                 sin6->sin6_scope_id = 0;        /* XXX */
 720         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr))
 721                 sin6->sin6_addr.s6_addr16[1] = 0;
 722
 723         return ((struct sockaddr *)sin6);
 724 }
 725
 726 void
 727 in6_sockaddr_s(in_port_t port, struct in6_addr *addr_p,
 728     struct sockaddr_in6 *sin6)
 729 {
 730         bzero(sin6, sizeof (*sin6));
 731         sin6->sin6_family = AF_INET6;
 732         sin6->sin6_len = sizeof (*sin6);
 733         sin6->sin6_port = port;
 734         sin6->sin6_addr = *addr_p;
 735
 736         /* would be good to use sa6_recoverscope(), except for locking  */
 737         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr))
 738                 sin6->sin6_scope_id = ntohs(sin6->sin6_addr.s6_addr16[1]);
 739         else
 740                 sin6->sin6_scope_id = 0;        /* XXX */
 741         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr))
 742                 sin6->sin6_addr.s6_addr16[1] = 0;
 743 }
 744
 745 /*
 746  * The calling convention of in6_getsockaddr() and in6_getpeeraddr() was
 747  * modified to match the pru_sockaddr() and pru_peeraddr() entry points
 748  * in struct pr_usrreqs, so that protocols can just reference then directly
 749  * without the need for a wrapper function.
 750  */
 751 int
 752 in6_getsockaddr(struct socket *so, struct sockaddr **nam)
 753 {
 754         struct inpcb *inp;
 755         struct in6_addr addr;
 756         in_port_t port;
 757
 758         if ((inp = sotoinpcb(so)) == NULL)
 759                 return (EINVAL);
 760
 761         port = inp->inp_lport;
 762         addr = inp->in6p_laddr;
 763
 764         *nam = in6_sockaddr(port, &addr);
 765         if (*nam == NULL)
 766                 return (ENOBUFS);
 767         return (0);
 768 }
 769
 770 int
 771 in6_getsockaddr_s(struct socket *so, struct sockaddr_in6 *ss)
 772 {
 773         struct inpcb *inp;
 774         struct in6_addr addr;
 775         in_port_t port;
 776
 777         VERIFY(ss != NULL);
 778         bzero(ss, sizeof (*ss));
 779
 780         if ((inp = sotoinpcb(so)) == NULL)
 781                 return (EINVAL);
 782
 783         port = inp->inp_lport;
 784         addr = inp->in6p_laddr;
 785
 786         in6_sockaddr_s(port, &addr, ss);
 787         return (0);
 788 }
 789
 790 int
 791 in6_getpeeraddr(struct socket *so, struct sockaddr **nam)
 792 {
 793         struct inpcb *inp;
 794         struct in6_addr addr;
 795         in_port_t port;
 796
 797         if ((inp = sotoinpcb(so)) == NULL)
 798                 return (EINVAL);
 799
 800         port = inp->inp_fport;
 801         addr = inp->in6p_faddr;
 802
 803         *nam = in6_sockaddr(port, &addr);
 804         if (*nam == NULL)
 805                 return (ENOBUFS);
 806         return (0);
 807 }
 808
 809 int
 810 in6_mapped_sockaddr(struct socket *so, struct sockaddr **nam)
 811 {
 812         struct  inpcb *inp = sotoinpcb(so);
 813         int     error;
 814
 815         if (inp == NULL)
 816                 return (EINVAL);
 817         if (inp->inp_vflag & INP_IPV4) {
 818                 error = in_getsockaddr(so, nam);
 819                 if (error == 0)
 820                         error = in6_sin_2_v4mapsin6_in_sock(nam);
 821         } else {
 822                 /* scope issues will be handled in in6_getsockaddr(). */
 823                 error = in6_getsockaddr(so, nam);
 824         }
 825         return (error);
 826 }
 827
 828 int
 829 in6_mapped_peeraddr(struct socket *so, struct sockaddr **nam)
 830 {
 831         struct  inpcb *inp = sotoinpcb(so);
 832         int     error;
 833
 834         if (inp == NULL)
 835                 return (EINVAL);
 836         if (inp->inp_vflag & INP_IPV4) {
 837                 error = in_getpeeraddr(so, nam);
 838                 if (error == 0)
 839                         error = in6_sin_2_v4mapsin6_in_sock(nam);
 840         } else {
 841                 /* scope issues will be handled in in6_getpeeraddr(). */
 842                 error = in6_getpeeraddr(so, nam);
 843         }
 844         return (error);
 845 }
 846
 847 /*
 848  * Pass some notification to all connections of a protocol
 849  * associated with address dst.  The local address and/or port numbers
 850  * may be specified to limit the search.  The "usual action" will be
 851  * taken, depending on the ctlinput cmd.  The caller must filter any
 852  * cmds that are uninteresting (e.g., no error in the map).
 853  * Call the protocol specific routine (if any) to report
 854  * any errors for each matching socket.
 855  */
 856 void
 857 in6_pcbnotify(struct inpcbinfo *pcbinfo, struct sockaddr *dst, u_int fport_arg,
 858     const struct sockaddr *src, u_int lport_arg, int cmd, void *cmdarg,
 859     void (*notify)(struct inpcb *, int))
 860 {
 861         struct inpcbhead *head = pcbinfo->ipi_listhead;
 862         struct inpcb *inp, *ninp;
 863         struct sockaddr_in6 sa6_src, *sa6_dst;
 864         u_short fport = fport_arg, lport = lport_arg;
 865         u_int32_t flowinfo;
 866         int errno;
 867
 868         if ((unsigned)cmd >= PRC_NCMDS || dst->sa_family != AF_INET6)
 869                 return;
 870
 871         sa6_dst = (struct sockaddr_in6 *)(void *)dst;
 872         if (IN6_IS_ADDR_UNSPECIFIED(&sa6_dst->sin6_addr))
 873                 return;
 874
 875         /*
 876          * note that src can be NULL when we get notify by local fragmentation.
 877          */
 878         sa6_src = (src == NULL) ?
 879             sa6_any : *(struct sockaddr_in6 *)(uintptr_t)(size_t)src;
 880         flowinfo = sa6_src.sin6_flowinfo;
 881
 882         /*
 883          * Redirects go to all references to the destination,
 884          * and use in6_rtchange to invalidate the route cache.
 885          * Dead host indications: also use in6_rtchange to invalidate
 886          * the cache, and deliver the error to all the sockets.
 887          * Otherwise, if we have knowledge of the local port and address,
 888          * deliver only to that socket.
 889          */
 890         if (PRC_IS_REDIRECT(cmd) || cmd == PRC_HOSTDEAD) {
 891                 fport = 0;
 892                 lport = 0;
 893                 bzero((caddr_t)&sa6_src.sin6_addr, sizeof (sa6_src.sin6_addr));
 894
 895                 if (cmd != PRC_HOSTDEAD)
 896                         notify = in6_rtchange;
 897         }
 898         errno = inet6ctlerrmap[cmd];
 899         lck_rw_lock_shared(pcbinfo->ipi_lock);
 900         for (inp = LIST_FIRST(head); inp != NULL; inp = ninp) {
 901                 ninp = LIST_NEXT(inp, inp_list);
 902
 903                 if (!(inp->inp_vflag & INP_IPV6))
 904                         continue;
 905
 906                 /*
 907                  * If the error designates a new path MTU for a destination
 908                  * and the application (associated with this socket) wanted to
 909                  * know the value, notify. Note that we notify for all
 910                  * disconnected sockets if the corresponding application
 911                  * wanted. This is because some UDP applications keep sending
 912                  * sockets disconnected.
 913                  * XXX: should we avoid to notify the value to TCP sockets?
 914                  */
 915                 if (cmd == PRC_MSGSIZE)
 916                         ip6_notify_pmtu(inp, (struct sockaddr_in6 *)(void *)dst,
 917                             (u_int32_t *)cmdarg);
 918
 919                 /*
 920                  * Detect if we should notify the error. If no source and
 921                  * destination ports are specifed, but non-zero flowinfo and
 922                  * local address match, notify the error. This is the case
 923                  * when the error is delivered with an encrypted buffer
 924                  * by ESP. Otherwise, just compare addresses and ports
 925                  * as usual.
 926                  */
 927                 if (lport == 0 && fport == 0 && flowinfo &&
 928                     inp->inp_socket != NULL &&
 929                     flowinfo == (inp->inp_flow & IPV6_FLOWLABEL_MASK) &&
 930                     IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, &sa6_src.sin6_addr))
 931                         goto do_notify;
 932                 else if (!IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr,
 933                     &sa6_dst->sin6_addr) || inp->inp_socket == NULL ||
 934                     (lport && inp->inp_lport != lport) ||
 935                     (!IN6_IS_ADDR_UNSPECIFIED(&sa6_src.sin6_addr) &&
 936                     !IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr,
 937                     &sa6_src.sin6_addr)) || (fport && inp->inp_fport != fport))
 938                         continue;
 939
 940 do_notify:
 941                 if (notify) {
 942                         if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) ==
 943                             WNT_STOPUSING)
 944                                 continue;
 945                         socket_lock(inp->inp_socket, 1);
 946                         (*notify)(inp, errno);
 947                         (void) in_pcb_checkstate(inp, WNT_RELEASE, 1);
 948                         socket_unlock(inp->inp_socket, 1);
 949                 }
 950         }
 951         lck_rw_done(pcbinfo->ipi_lock);
 952 }
 953
 954 /*
 955  * Lookup a PCB based on the local address and port.
 956  */
 957 struct inpcb *
 958 in6_pcblookup_local(struct inpcbinfo *pcbinfo, struct in6_addr *laddr,
 959     u_int lport_arg, int wild_okay)
 960 {
 961         struct inpcb *inp;
 962         int matchwild = 3, wildcard;
 963         u_short lport = lport_arg;
 964         struct inpcbporthead *porthash;
 965         struct inpcb *match = NULL;
 966         struct inpcbport *phd;
 967
 968         if (!wild_okay) {
 969                 struct inpcbhead *head;
 970                 /*
 971                  * Look for an unconnected (wildcard foreign addr) PCB that
 972                  * matches the local address and port we're looking for.
 973                  */
 974                 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(INADDR_ANY, lport, 0,
 975                     pcbinfo->ipi_hashmask)];
 976                 LIST_FOREACH(inp, head, inp_hash) {
 977                         if (!(inp->inp_vflag & INP_IPV6))
 978                                 continue;
 979                         if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) &&
 980                             IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr) &&
 981                             inp->inp_lport == lport) {
 982                                 /*
 983                                  * Found.
 984                                  */
 985                                 return (inp);
 986                         }
 987                 }
 988                 /*
 989                  * Not found.
 990                  */
 991                 return (NULL);
 992         }
 993         /*
 994          * Best fit PCB lookup.
 995          *
 996          * First see if this local port is in use by looking on the
 997          * port hash list.
 998          */
 999         porthash = &pcbinfo->ipi_porthashbase[INP_PCBPORTHASH(lport,
1000             pcbinfo->ipi_porthashmask)];
1001         LIST_FOREACH(phd, porthash, phd_hash) {
1002                 if (phd->phd_port == lport)
1003                         break;
1004         }
1005         if (phd != NULL) {
1006                 /*
1007                  * Port is in use by one or more PCBs. Look for best
1008                  * fit.
1009                  */
1010                 LIST_FOREACH(inp, &phd->phd_pcblist, inp_portlist) {
1011                         wildcard = 0;
1012                         if (!(inp->inp_vflag & INP_IPV6))
1013                                 continue;
1014                         if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr))
1015                                 wildcard++;
1016                         if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
1017                                 if (IN6_IS_ADDR_UNSPECIFIED(laddr))
1018                                         wildcard++;
1019                                 else if (!IN6_ARE_ADDR_EQUAL(
1020                                     &inp->in6p_laddr, laddr))
1021                                         continue;
1022                         } else {
1023                                 if (!IN6_IS_ADDR_UNSPECIFIED(laddr))
1024                                         wildcard++;
1025                         }
1026                         if (wildcard < matchwild) {
1027                                 match = inp;
1028                                 matchwild = wildcard;
1029                                 if (matchwild == 0) {
1030                                         break;
1031                                 }
1032                         }
1033                 }
1034         }
1035         return (match);
1036 }
1037
1038 /*
1039  * Check for alternatives when higher level complains
1040  * about service problems.  For now, invalidate cached
1041  * routing information.  If the route was created dynamically
1042  * (by a redirect), time to try a default gateway again.
1043  */
1044 void
1045 in6_losing(struct inpcb *in6p)
1046 {
1047         struct rtentry *rt;
1048
1049         if ((rt = in6p->in6p_route.ro_rt) != NULL) {
1050                 RT_LOCK(rt);
1051                 if (rt->rt_flags & RTF_DYNAMIC) {
1052                         /*
1053                          * Prevent another thread from modifying rt_key,
1054                          * rt_gateway via rt_setgate() after the rt_lock
1055                          * is dropped by marking the route as defunct.
1056                          */
1057                         rt->rt_flags |= RTF_CONDEMNED;
1058                         RT_UNLOCK(rt);
1059                         (void) rtrequest(RTM_DELETE, rt_key(rt),
1060                             rt->rt_gateway, rt_mask(rt), rt->rt_flags, NULL);
1061                 } else {
1062                         RT_UNLOCK(rt);
1063                 }
1064                 /*
1065                  * A new route can be allocated
1066                  * the next time output is attempted.
1067                  */
1068         }
1069         ROUTE_RELEASE(&in6p->in6p_route);
1070 }
1071
1072 /*
1073  * After a routing change, flush old routing
1074  * and allocate a (hopefully) better one.
1075  */
1076 void
1077 in6_rtchange(struct inpcb *inp, int errno)
1078 {
1079 #pragma unused(errno)
1080         /*
1081          * A new route can be allocated the next time
1082          * output is attempted.
1083          */
1084         ROUTE_RELEASE(&inp->in6p_route);
1085 }
1086
1087 /*
1088  * Check if PCB exists hash list. Also returns uid and gid of socket
1089  */
1090 int
1091 in6_pcblookup_hash_exists(struct inpcbinfo *pcbinfo, struct in6_addr *faddr,
1092     u_int fport_arg, struct in6_addr *laddr, u_int lport_arg, int wildcard,
1093     uid_t *uid, gid_t *gid, struct ifnet *ifp)
1094 {
1095         struct inpcbhead *head;
1096         struct inpcb *inp;
1097         u_short fport = fport_arg, lport = lport_arg;
1098         int found;
1099
1100         *uid = UID_MAX;
1101         *gid = GID_MAX;
1102
1103         lck_rw_lock_shared(pcbinfo->ipi_lock);
1104
1105         /*
1106          * First look for an exact match.
1107          */
1108         head = &pcbinfo->ipi_hashbase[INP_PCBHASH(faddr->s6_addr32[3] /* XXX */,
1109             lport, fport, pcbinfo->ipi_hashmask)];
1110         LIST_FOREACH(inp, head, inp_hash) {
1111                 if (!(inp->inp_vflag & INP_IPV6))
1112                         continue;
1113
1114                 if (inp_restricted_recv(inp, ifp))
1115                         continue;
1116
1117                 if (IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr, faddr) &&
1118                     IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr) &&
1119                     inp->inp_fport == fport &&
1120                     inp->inp_lport == lport) {
1121                         if ((found = (inp->inp_socket != NULL))) {
1122                                 /*
1123                                  * Found. Check if pcb is still valid
1124                                  */
1125                                 *uid = kauth_cred_getuid(
1126                                     inp->inp_socket->so_cred);
1127                                 *gid = kauth_cred_getgid(
1128                                     inp->inp_socket->so_cred);
1129                         }
1130                         lck_rw_done(pcbinfo->ipi_lock);
1131                         return (found);
1132                 }
1133         }
1134         if (wildcard) {
1135                 struct inpcb *local_wild = NULL;
1136
1137                 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(INADDR_ANY, lport, 0,
1138                     pcbinfo->ipi_hashmask)];
1139                 LIST_FOREACH(inp, head, inp_hash) {
1140                         if (!(inp->inp_vflag & INP_IPV6))
1141                                 continue;
1142
1143                         if (inp_restricted_recv(inp, ifp))
1144                                 continue;
1145
1146                         if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) &&
1147                             inp->inp_lport == lport) {
1148                                 if (IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr,
1149                                     laddr)) {
1150                                         found = (inp->inp_socket != NULL);
1151                                         if (found) {
1152                                                 *uid = kauth_cred_getuid(
1153                                                     inp->inp_socket->so_cred);
1154                                                 *gid = kauth_cred_getgid(
1155                                                     inp->inp_socket->so_cred);
1156                                         }
1157                                         lck_rw_done(pcbinfo->ipi_lock);
1158                                         return (found);
1159                                 } else if (IN6_IS_ADDR_UNSPECIFIED(
1160                                     &inp->in6p_laddr)) {
1161                                         local_wild = inp;
1162                                 }
1163                         }
1164                 }
1165                 if (local_wild) {
1166                         if ((found = (local_wild->inp_socket != NULL))) {
1167                                 *uid = kauth_cred_getuid(
1168                                     local_wild->inp_socket->so_cred);
1169                                 *gid = kauth_cred_getgid(
1170                                     local_wild->inp_socket->so_cred);
1171                         }
1172                         lck_rw_done(pcbinfo->ipi_lock);
1173                         return (found);
1174                 }
1175         }
1176
1177         /*
1178          * Not found.
1179          */
1180         lck_rw_done(pcbinfo->ipi_lock);
1181         return (0);
1182 }
1183
1184 /*
1185  * Lookup PCB in hash list.
1186  */
1187 struct inpcb *
1188 in6_pcblookup_hash(struct inpcbinfo *pcbinfo, struct in6_addr *faddr,
1189     u_int fport_arg, struct in6_addr *laddr, u_int lport_arg, int wildcard,
1190     struct ifnet *ifp)
1191 {
1192         struct inpcbhead *head;
1193         struct inpcb *inp;
1194         u_short fport = fport_arg, lport = lport_arg;
1195
1196         lck_rw_lock_shared(pcbinfo->ipi_lock);
1197
1198         /*
1199          * First look for an exact match.
1200          */
1201         head = &pcbinfo->ipi_hashbase[INP_PCBHASH(faddr->s6_addr32[3] /* XXX */,
1202             lport, fport, pcbinfo->ipi_hashmask)];
1203         LIST_FOREACH(inp, head, inp_hash) {
1204                 if (!(inp->inp_vflag & INP_IPV6))
1205                         continue;
1206
1207                 if (inp_restricted_recv(inp, ifp))
1208                         continue;
1209
1210                 if (IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr, faddr) &&
1211                     IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr) &&
1212                     inp->inp_fport == fport &&
1213                     inp->inp_lport == lport) {
1214                         /*
1215                          * Found. Check if pcb is still valid
1216                          */
1217                         if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) !=
1218                             WNT_STOPUSING) {
1219                                 lck_rw_done(pcbinfo->ipi_lock);
1220                                 return (inp);
1221                         } else {
1222                                 /* it's there but dead, say it isn't found */
1223                                 lck_rw_done(pcbinfo->ipi_lock);
1224                                 return (NULL);
1225                         }
1226                 }
1227         }
1228         if (wildcard) {
1229                 struct inpcb *local_wild = NULL;
1230
1231                 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(INADDR_ANY, lport, 0,
1232                     pcbinfo->ipi_hashmask)];
1233                 LIST_FOREACH(inp, head, inp_hash) {
1234                         if (!(inp->inp_vflag & INP_IPV6))
1235                                 continue;
1236
1237                         if (inp_restricted_recv(inp, ifp))
1238                                 continue;
1239
1240                         if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) &&
1241                             inp->inp_lport == lport) {
1242                                 if (IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr,
1243                                     laddr)) {
1244                                         if (in_pcb_checkstate(inp, WNT_ACQUIRE,
1245                                             0) != WNT_STOPUSING) {
1246                                                 lck_rw_done(pcbinfo->ipi_lock);
1247                                                 return (inp);
1248                                         } else {
1249                                                 /* dead; say it isn't found */
1250                                                 lck_rw_done(pcbinfo->ipi_lock);
1251                                                 return (NULL);
1252                                         }
1253                                 } else if (IN6_IS_ADDR_UNSPECIFIED(
1254                                     &inp->in6p_laddr)) {
1255                                         local_wild = inp;
1256                                 }
1257                         }
1258                 }
1259                 if (local_wild && in_pcb_checkstate(local_wild,
1260                     WNT_ACQUIRE, 0) != WNT_STOPUSING) {
1261                         lck_rw_done(pcbinfo->ipi_lock);
1262                         return (local_wild);
1263                 } else {
1264                         lck_rw_done(pcbinfo->ipi_lock);
1265                         return (NULL);
1266                 }
1267         }
1268
1269         /*
1270          * Not found.
1271          */
1272         lck_rw_done(pcbinfo->ipi_lock);
1273         return (NULL);
1274 }
1275
1276 void
1277 init_sin6(struct sockaddr_in6 *sin6, struct mbuf *m)
1278 {
1279         struct ip6_hdr *ip;
1280
1281         ip = mtod(m, struct ip6_hdr *);
1282         bzero(sin6, sizeof (*sin6));
1283         sin6->sin6_len = sizeof (*sin6);
1284         sin6->sin6_family = AF_INET6;
1285         sin6->sin6_addr = ip->ip6_src;
1286         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
1287                 sin6->sin6_addr.s6_addr16[1] = 0;
1288                 if ((m->m_pkthdr.pkt_flags & (PKTF_LOOP|PKTF_IFAINFO)) ==
1289                     (PKTF_LOOP|PKTF_IFAINFO))
1290                         sin6->sin6_scope_id = m->m_pkthdr.src_ifindex;
1291                 else if (m->m_pkthdr.rcvif != NULL)
1292                         sin6->sin6_scope_id = m->m_pkthdr.rcvif->if_index;
1293         }
1294 }
1295
1296 /*
1297  * The following routines implement this scheme:
1298  *
1299  * Callers of ip6_output() that intend to cache the route in the inpcb pass
1300  * a local copy of the struct route to ip6_output().  Using a local copy of
1301  * the cached route significantly simplifies things as IP no longer has to
1302  * worry about having exclusive access to the passed in struct route, since
1303  * it's defined in the caller's stack; in essence, this allows for a lock-
1304  * less operation when updating the struct route at the IP level and below,
1305  * whenever necessary. The scheme works as follows:
1306  *
1307  * Prior to dropping the socket's lock and calling ip6_output(), the caller
1308  * copies the struct route from the inpcb into its stack, and adds a reference
1309  * to the cached route entry, if there was any.  The socket's lock is then
1310  * dropped and ip6_output() is called with a pointer to the copy of struct
1311  * route defined on the stack (not to the one in the inpcb.)
1312  *
1313  * Upon returning from ip6_output(), the caller then acquires the socket's
1314  * lock and synchronizes the cache; if there is no route cached in the inpcb,
1315  * it copies the local copy of struct route (which may or may not contain any
1316  * route) back into the cache; otherwise, if the inpcb has a route cached in
1317  * it, the one in the local copy will be freed, if there's any.  Trashing the
1318  * cached route in the inpcb can be avoided because ip6_output() is single-
1319  * threaded per-PCB (i.e. multiple transmits on a PCB are always serialized
1320  * by the socket/transport layer.)
1321  */
1322 void
1323 in6p_route_copyout(struct inpcb *inp, struct route_in6 *dst)
1324 {
1325         struct route_in6 *src = &inp->in6p_route;
1326
1327         socket_lock_assert_owned(inp->inp_socket);
1328
1329         /* Minor sanity check */
1330         if (src->ro_rt != NULL && rt_key(src->ro_rt)->sa_family != AF_INET6)
1331                 panic("%s: wrong or corrupted route: %p", __func__, src);
1332
1333         route_copyout((struct route *)dst, (struct route *)src, sizeof (*dst));
1334 }
1335
1336 void
1337 in6p_route_copyin(struct inpcb *inp, struct route_in6 *src)
1338 {
1339         struct route_in6 *dst = &inp->in6p_route;
1340
1341         socket_lock_assert_owned(inp->inp_socket);
1342
1343         /* Minor sanity check */
1344         if (src->ro_rt != NULL && rt_key(src->ro_rt)->sa_family != AF_INET6)
1345                 panic("%s: wrong or corrupted route: %p", __func__, src);
1346
1347         route_copyin((struct route *)src, (struct route *)dst, sizeof (*src));
1348 }