bsd/netinet6/in6_pcb.c

   1 /*
   2  * Copyright (c) 2003-2017 Apple Inc. All rights reserved.
   3  *
   4  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
   5  *
   6  * This file contains Original Code and/or Modifications of Original Code
   7  * as defined in and that are subject to the Apple Public Source License
   8  * Version 2.0 (the 'License'). You may not use this file except in
   9  * compliance with the License. The rights granted to you under the License
  10  * may not be used to create, or enable the creation or redistribution of,
  11  * unlawful or unlicensed copies of an Apple operating system, or to
  12  * circumvent, violate, or enable the circumvention or violation of, any
  13  * terms of an Apple operating system software license agreement.
  14  *
  15  * Please obtain a copy of the License at
  16  * http://www.opensource.apple.com/apsl/ and read it before using this file.
  17  *
  18  * The Original Code and all software distributed under the License are
  19  * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
  20  * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
  21  * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
  22  * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
  23  * Please see the License for the specific language governing rights and
  24  * limitations under the License.
  25  *
  26  * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
  27  */
  28 /*
  29  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  30  * All rights reserved.
  31  *
  32  * Redistribution and use in source and binary forms, with or without
  33  * modification, are permitted provided that the following conditions
  34  * are met:
  35  * 1. Redistributions of source code must retain the above copyright
  36  *    notice, this list of conditions and the following disclaimer.
  37  * 2. Redistributions in binary form must reproduce the above copyright
  38  *    notice, this list of conditions and the following disclaimer in the
  39  *    documentation and/or other materials provided with the distribution.
  40  * 3. Neither the name of the project nor the names of its contributors
  41  *    may be used to endorse or promote products derived from this software
  42  *    without specific prior written permission.
  43  *
  44  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  45  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  46  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  47  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  48  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  49  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  50  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  51  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  52  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  53  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  54  * SUCH DAMAGE.
  55  *
  56  */
  57
  58 /*
  59  * Copyright (c) 1982, 1986, 1991, 1993
  60  *      The Regents of the University of California.  All rights reserved.
  61  *
  62  * Redistribution and use in source and binary forms, with or without
  63  * modification, are permitted provided that the following conditions
  64  * are met:
  65  * 1. Redistributions of source code must retain the above copyright
  66  *    notice, this list of conditions and the following disclaimer.
  67  * 2. Redistributions in binary form must reproduce the above copyright
  68  *    notice, this list of conditions and the following disclaimer in the
  69  *    documentation and/or other materials provided with the distribution.
  70  * 3. All advertising materials mentioning features or use of this software
  71  *    must display the following acknowledgement:
  72  *      This product includes software developed by the University of
  73  *      California, Berkeley and its contributors.
  74  * 4. Neither the name of the University nor the names of its contributors
  75  *    may be used to endorse or promote products derived from this software
  76  *    without specific prior written permission.
  77  *
  78  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  79  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  80  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  81  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  82  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  83  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  84  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  85  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  86  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  87  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  88  * SUCH DAMAGE.
  89  *
  90  *      @(#)in_pcb.c    8.2 (Berkeley) 1/4/94
  91  */
  92
  93 #include <sys/param.h>
  94 #include <sys/systm.h>
  95 #include <sys/malloc.h>
  96 #include <sys/mbuf.h>
  97 #include <sys/domain.h>
  98 #include <sys/protosw.h>
  99 #include <sys/socket.h>
 100 #include <sys/socketvar.h>
 101 #include <sys/sockio.h>
 102 #include <sys/errno.h>
 103 #include <sys/time.h>
 104 #include <sys/proc.h>
 105 #include <sys/kauth.h>
 106 #include <sys/priv.h>
 107
 108 #include <net/if.h>
 109 #include <net/if_types.h>
 110 #include <net/route.h>
 111 #include <net/ntstat.h>
 112
 113 #include <netinet/in.h>
 114 #include <netinet/in_var.h>
 115 #include <netinet/in_systm.h>
 116 #include <netinet/ip6.h>
 117 #include <netinet/ip_var.h>
 118 #include <netinet6/ip6_var.h>
 119 #include <netinet6/nd6.h>
 120 #include <netinet/in_pcb.h>
 121 #include <netinet6/in6_pcb.h>
 122 #include <net/if_types.h>
 123 #include <net/if_var.h>
 124
 125 #include <kern/kern_types.h>
 126 #include <kern/zalloc.h>
 127
 128 #if IPSEC
 129 #include <netinet6/ipsec.h>
 130 #if INET6
 131 #include <netinet6/ipsec6.h>
 132 #endif
 133 #include <netinet6/ah.h>
 134 #if INET6
 135 #include <netinet6/ah6.h>
 136 #endif
 137 #include <netkey/key.h>
 138 #endif /* IPSEC */
 139
 140 #if NECP
 141 #include <net/necp.h>
 142 #endif /* NECP */
 143
 144 /*
 145  * in6_pcblookup_local_and_cleanup does everything
 146  * in6_pcblookup_local does but it checks for a socket
 147  * that's going away. Since we know that the lock is
 148  * held read+write when this function is called, we
 149  * can safely dispose of this socket like the slow
 150  * timer would usually do and return NULL. This is
 151  * great for bind.
 152  */
 153 static struct inpcb *
 154 in6_pcblookup_local_and_cleanup(struct inpcbinfo *pcbinfo,
 155     struct in6_addr *laddr, u_int lport_arg, int wild_okay)
 156 {
 157         struct inpcb *inp;
 158
 159         /* Perform normal lookup */
 160         inp = in6_pcblookup_local(pcbinfo, laddr, lport_arg, wild_okay);
 161
 162         /* Check if we found a match but it's waiting to be disposed */
 163         if (inp != NULL && inp->inp_wantcnt == WNT_STOPUSING) {
 164                 struct socket *so = inp->inp_socket;
 165
 166                 socket_lock(so, 0);
 167
 168                 if (so->so_usecount == 0) {
 169                         if (inp->inp_state != INPCB_STATE_DEAD)
 170                                 in6_pcbdetach(inp);
 171                         in_pcbdispose(inp);     /* will unlock & destroy */
 172                         inp = NULL;
 173                 } else {
 174                         socket_unlock(so, 0);
 175                 }
 176         }
 177
 178         return (inp);
 179 }
 180
 181 /*
 182  * Bind an INPCB to an address and/or port.  This routine should not alter
 183  * the caller-supplied local address "nam".
 184  */
 185 int
 186 in6_pcbbind(struct inpcb *inp, struct sockaddr *nam, struct proc *p)
 187 {
 188         struct socket *so = inp->inp_socket;
 189         struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
 190         u_short lport = 0;
 191         int wild = 0, reuseport = (so->so_options & SO_REUSEPORT);
 192         struct ifnet *outif = NULL;
 193         struct sockaddr_in6 sin6;
 194 #if !CONFIG_EMBEDDED
 195         int error;
 196         kauth_cred_t cred;
 197 #endif /* !CONFIG_EMBEDDED */
 198
 199         if (!in6_ifaddrs) /* XXX broken! */
 200                 return (EADDRNOTAVAIL);
 201         if (!(so->so_options & (SO_REUSEADDR|SO_REUSEPORT)))
 202                 wild = 1;
 203
 204         socket_unlock(so, 0); /* keep reference */
 205         lck_rw_lock_exclusive(pcbinfo->ipi_lock);
 206         if (inp->inp_lport || !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
 207                 /* another thread completed the bind */
 208                 lck_rw_done(pcbinfo->ipi_lock);
 209                 socket_lock(so, 0);
 210                 return (EINVAL);
 211         }
 212
 213         bzero(&sin6, sizeof (sin6));
 214         if (nam != NULL) {
 215                 if (nam->sa_len != sizeof (struct sockaddr_in6)) {
 216                         lck_rw_done(pcbinfo->ipi_lock);
 217                         socket_lock(so, 0);
 218                         return (EINVAL);
 219                 }
 220                 /*
 221                  * family check.
 222                  */
 223                 if (nam->sa_family != AF_INET6) {
 224                         lck_rw_done(pcbinfo->ipi_lock);
 225                         socket_lock(so, 0);
 226                         return (EAFNOSUPPORT);
 227                 }
 228                 lport = SIN6(nam)->sin6_port;
 229
 230                 *(&sin6) = *SIN6(nam);
 231
 232                 /* KAME hack: embed scopeid */
 233                 if (in6_embedscope(&sin6.sin6_addr, &sin6, inp, NULL,
 234                     NULL) != 0) {
 235                         lck_rw_done(pcbinfo->ipi_lock);
 236                         socket_lock(so, 0);
 237                         return (EINVAL);
 238                 }
 239
 240                 /* Sanitize local copy for address searches */
 241                 sin6.sin6_flowinfo = 0;
 242                 sin6.sin6_scope_id = 0;
 243                 sin6.sin6_port = 0;
 244
 245                 if (IN6_IS_ADDR_MULTICAST(&sin6.sin6_addr)) {
 246                         /*
 247                          * Treat SO_REUSEADDR as SO_REUSEPORT for multicast;
 248                          * allow compepte duplication of binding if
 249                          * SO_REUSEPORT is set, or if SO_REUSEADDR is set
 250                          * and a multicast address is bound on both
 251                          * new and duplicated sockets.
 252                          */
 253                         if (so->so_options & SO_REUSEADDR)
 254                                 reuseport = SO_REUSEADDR|SO_REUSEPORT;
 255                 } else if (!IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr)) {
 256                         struct ifaddr *ifa;
 257
 258                         ifa = ifa_ifwithaddr(SA(&sin6));
 259                         if (ifa == NULL) {
 260                                 lck_rw_done(pcbinfo->ipi_lock);
 261                                 socket_lock(so, 0);
 262                                 return (EADDRNOTAVAIL);
 263                         } else {
 264                                 /*
 265                                  * XXX: bind to an anycast address might
 266                                  * accidentally cause sending a packet with
 267                                  * anycast source address.  We should allow
 268                                  * to bind to a deprecated address, since
 269                                  * the application dare to use it.
 270                                  */
 271                                 IFA_LOCK_SPIN(ifa);
 272                                 if (((struct in6_ifaddr *)ifa)->ia6_flags &
 273                                     (IN6_IFF_ANYCAST | IN6_IFF_NOTREADY|
 274                                     IN6_IFF_DETACHED | IN6_IFF_CLAT46)) {
 275                                         IFA_UNLOCK(ifa);
 276                                         IFA_REMREF(ifa);
 277                                         lck_rw_done(pcbinfo->ipi_lock);
 278                                         socket_lock(so, 0);
 279                                         return (EADDRNOTAVAIL);
 280                                 }
 281                                 /*
 282                                  * Opportunistically determine the outbound
 283                                  * interface that may be used; this may not
 284                                  * hold true if we end up using a route
 285                                  * going over a different interface, e.g.
 286                                  * when sending to a local address.  This
 287                                  * will get updated again after sending.
 288                                  */
 289                                 outif = ifa->ifa_ifp;
 290                                 IFA_UNLOCK(ifa);
 291                                 IFA_REMREF(ifa);
 292                         }
 293                 }
 294                 if (lport != 0) {
 295                         struct inpcb *t;
 296                         uid_t u;
 297
 298 #if !CONFIG_EMBEDDED
 299                         if (ntohs(lport) < IPV6PORT_RESERVED &&
 300                                 !IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr)) {
 301                                 cred = kauth_cred_proc_ref(p);
 302                                 error = priv_check_cred(cred,
 303                                     PRIV_NETINET_RESERVEDPORT, 0);
 304                                 kauth_cred_unref(&cred);
 305                                 if (error != 0) {
 306                                         lck_rw_done(pcbinfo->ipi_lock);
 307                                         socket_lock(so, 0);
 308                                         return (EACCES);
 309                                 }
 310                         }
 311 #endif /* !CONFIG_EMBEDDED */
 312                         if (!IN6_IS_ADDR_MULTICAST(&sin6.sin6_addr) &&
 313                             (u = kauth_cred_getuid(so->so_cred)) != 0) {
 314                                 t = in6_pcblookup_local_and_cleanup(pcbinfo,
 315                                     &sin6.sin6_addr, lport,
 316                                     INPLOOKUP_WILDCARD);
 317                                 if (t != NULL && (!IN6_IS_ADDR_UNSPECIFIED(
 318                                     &sin6.sin6_addr) ||
 319                                     !IN6_IS_ADDR_UNSPECIFIED(&t->in6p_laddr) ||
 320                                     !(t->inp_socket->so_options &
 321                                     SO_REUSEPORT)) && (u != kauth_cred_getuid(
 322                                     t->inp_socket->so_cred)) &&
 323                                     !(t->inp_socket->so_flags &
 324                                     SOF_REUSESHAREUID)) {
 325                                         lck_rw_done(pcbinfo->ipi_lock);
 326                                         socket_lock(so, 0);
 327                                         return (EADDRINUSE);
 328                                 }
 329                                 if (!(inp->inp_flags & IN6P_IPV6_V6ONLY) &&
 330                                     IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr)) {
 331                                         struct sockaddr_in sin;
 332
 333                                         in6_sin6_2_sin(&sin, &sin6);
 334                                         t = in_pcblookup_local_and_cleanup(
 335                                             pcbinfo, sin.sin_addr, lport,
 336                                             INPLOOKUP_WILDCARD);
 337                                         if (t != NULL &&
 338                                             !(t->inp_socket->so_options &
 339                                             SO_REUSEPORT) &&
 340                                             (kauth_cred_getuid(so->so_cred) !=
 341                                             kauth_cred_getuid(t->inp_socket->
 342                                             so_cred)) && (t->inp_laddr.s_addr !=
 343                                             INADDR_ANY || SOCK_DOM(so) ==
 344                                             SOCK_DOM(t->inp_socket))) {
 345                                                 lck_rw_done(pcbinfo->ipi_lock);
 346                                                 socket_lock(so, 0);
 347                                                 return (EADDRINUSE);
 348                                         }
 349                                 }
 350                         }
 351                         t = in6_pcblookup_local_and_cleanup(pcbinfo,
 352                             &sin6.sin6_addr, lport, wild);
 353                         if (t != NULL &&
 354                             (reuseport & t->inp_socket->so_options) == 0) {
 355                                 lck_rw_done(pcbinfo->ipi_lock);
 356                                 socket_lock(so, 0);
 357                                 return (EADDRINUSE);
 358                         }
 359                         if (!(inp->inp_flags & IN6P_IPV6_V6ONLY) &&
 360                             IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr)) {
 361                                 struct sockaddr_in sin;
 362
 363                                 in6_sin6_2_sin(&sin, &sin6);
 364                                 t = in_pcblookup_local_and_cleanup(pcbinfo,
 365                                     sin.sin_addr, lport, wild);
 366                                 if (t != NULL && (reuseport &
 367                                     t->inp_socket->so_options) == 0 &&
 368                                     (t->inp_laddr.s_addr != INADDR_ANY ||
 369                                     SOCK_DOM(so) == SOCK_DOM(t->inp_socket))) {
 370                                         lck_rw_done(pcbinfo->ipi_lock);
 371                                         socket_lock(so, 0);
 372                                         return (EADDRINUSE);
 373                                 }
 374                         }
 375                 }
 376         }
 377
 378         socket_lock(so, 0);
 379         /*
 380          * We unlocked socket's protocol lock for a long time.
 381          * The socket might have been dropped/defuncted.
 382          * Checking if world has changed since.
 383          */
 384         if (inp->inp_state == INPCB_STATE_DEAD) {
 385                 lck_rw_done(pcbinfo->ipi_lock);
 386                 return (ECONNABORTED);
 387         }
 388
 389         /* check if the socket got bound when the lock was released */
 390         if (inp->inp_lport || !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
 391                 lck_rw_done(pcbinfo->ipi_lock);
 392                 return (EINVAL);
 393         }
 394
 395         if (!IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr)) {
 396                 inp->in6p_laddr = sin6.sin6_addr;
 397                 inp->in6p_last_outifp = outif;
 398         }
 399
 400         if (lport == 0) {
 401                 int e;
 402                 if ((e = in6_pcbsetport(&inp->in6p_laddr, inp, p, 1)) != 0) {
 403                         /* Undo any address bind from above. */
 404                         inp->in6p_laddr = in6addr_any;
 405                         inp->in6p_last_outifp = NULL;
 406                         lck_rw_done(pcbinfo->ipi_lock);
 407                         return (e);
 408                 }
 409         } else {
 410                 inp->inp_lport = lport;
 411                 if (in_pcbinshash(inp, 1) != 0) {
 412                         inp->in6p_laddr = in6addr_any;
 413                         inp->inp_lport = 0;
 414                         inp->in6p_last_outifp = NULL;
 415                         lck_rw_done(pcbinfo->ipi_lock);
 416                         return (EAGAIN);
 417                 }
 418         }
 419         lck_rw_done(pcbinfo->ipi_lock);
 420         sflt_notify(so, sock_evt_bound, NULL);
 421         return (0);
 422 }
 423
 424 /*
 425  * Transform old in6_pcbconnect() into an inner subroutine for new
 426  * in6_pcbconnect(); do some validity-checking on the remote address
 427  * (in "nam") and then determine local host address (i.e., which
 428  * interface) to use to access that remote host.
 429  *
 430  * This routine may alter the caller-supplied remote address "nam".
 431  *
 432  * This routine might return an ifp with a reference held if the caller
 433  * provides a non-NULL outif, even in the error case.  The caller is
 434  * responsible for releasing its reference.
 435  */
 436 int
 437 in6_pcbladdr(struct inpcb *inp, struct sockaddr *nam,
 438     struct in6_addr *plocal_addr6, struct ifnet **outif)
 439 {
 440         struct in6_addr *addr6 = NULL;
 441         struct in6_addr src_storage;
 442         int error = 0;
 443         unsigned int ifscope;
 444
 445         if (outif != NULL)
 446                 *outif = NULL;
 447         if (nam->sa_len != sizeof (struct sockaddr_in6))
 448                 return (EINVAL);
 449         if (SIN6(nam)->sin6_family != AF_INET6)
 450                 return (EAFNOSUPPORT);
 451         if (SIN6(nam)->sin6_port == 0)
 452                 return (EADDRNOTAVAIL);
 453
 454         /* KAME hack: embed scopeid */
 455         if (in6_embedscope(&SIN6(nam)->sin6_addr, SIN6(nam), inp, NULL, NULL) != 0)
 456                 return (EINVAL);
 457
 458         if (in6_ifaddrs) {
 459                 /*
 460                  * If the destination address is UNSPECIFIED addr,
 461                  * use the loopback addr, e.g ::1.
 462                  */
 463                 if (IN6_IS_ADDR_UNSPECIFIED(&SIN6(nam)->sin6_addr))
 464                         SIN6(nam)->sin6_addr = in6addr_loopback;
 465         }
 466
 467         ifscope = (inp->inp_flags & INP_BOUND_IF) ?
 468             inp->inp_boundifp->if_index : IFSCOPE_NONE;
 469
 470         /*
 471          * XXX: in6_selectsrc might replace the bound local address
 472          * with the address specified by setsockopt(IPV6_PKTINFO).
 473          * Is it the intended behavior?
 474          *
 475          * in6_selectsrc() might return outif with its reference held
 476          * even in the error case; caller always needs to release it
 477          * if non-NULL.
 478          */
 479         addr6 = in6_selectsrc(SIN6(nam), inp->in6p_outputopts, inp,
 480             &inp->in6p_route, outif, &src_storage, ifscope, &error);
 481
 482         if (outif != NULL) {
 483                 struct rtentry *rt = inp->in6p_route.ro_rt;
 484                 /*
 485                  * If in6_selectsrc() returns a route, it should be one
 486                  * which points to the same ifp as outif.  Just in case
 487                  * it isn't, use the one from the route for consistency.
 488                  * Otherwise if there is no route, leave outif alone as
 489                  * it could still be useful to the caller.
 490                  */
 491                 if (rt != NULL && rt->rt_ifp != *outif) {
 492                         ifnet_reference(rt->rt_ifp);    /* for caller */
 493                         if (*outif != NULL)
 494                                 ifnet_release(*outif);
 495                         *outif = rt->rt_ifp;
 496                 }
 497         }
 498
 499         if (addr6 == NULL) {
 500                 if (outif != NULL && (*outif) != NULL &&
 501                     inp_restricted_send(inp, *outif)) {
 502                         soevent(inp->inp_socket,
 503                             (SO_FILT_HINT_LOCKED | SO_FILT_HINT_IFDENIED));
 504                         error = EHOSTUNREACH;
 505                 }
 506                 if (error == 0)
 507                         error = EADDRNOTAVAIL;
 508                 return (error);
 509         }
 510
 511         *plocal_addr6 = *addr6;
 512         /*
 513          * Don't do pcblookup call here; return interface in
 514          * plocal_addr6 and exit to caller, that will do the lookup.
 515          */
 516         return (0);
 517 }
 518
 519 /*
 520  * Outer subroutine:
 521  * Connect from a socket to a specified address.
 522  * Both address and port must be specified in argument sin.
 523  * If don't have a local address for this socket yet,
 524  * then pick one.
 525  */
 526 int
 527 in6_pcbconnect(struct inpcb *inp, struct sockaddr *nam, struct proc *p)
 528 {
 529         struct in6_addr addr6;
 530         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)(void *)nam;
 531         struct inpcb *pcb;
 532         int error = 0;
 533         struct ifnet *outif = NULL;
 534         struct socket *so = inp->inp_socket;
 535
 536 #if CONTENT_FILTER
 537         if (so)
 538                 so->so_state_change_cnt++;
 539 #endif
 540
 541         if (so->so_proto->pr_protocol == IPPROTO_UDP &&
 542             sin6->sin6_port == htons(53) && !(so->so_flags1 & SOF1_DNS_COUNTED)) {
 543                 so->so_flags1 |= SOF1_DNS_COUNTED;
 544                 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_dns);
 545         }
 546
 547         /*
 548          * Call inner routine, to assign local interface address.
 549          * in6_pcbladdr() may automatically fill in sin6_scope_id.
 550          *
 551          * in6_pcbladdr() might return an ifp with its reference held
 552          * even in the error case, so make sure that it's released
 553          * whenever it's non-NULL.
 554          */
 555         if ((error = in6_pcbladdr(inp, nam, &addr6, &outif)) != 0) {
 556                 if (outif != NULL && inp_restricted_send(inp, outif))
 557                         soevent(so,
 558                             (SO_FILT_HINT_LOCKED | SO_FILT_HINT_IFDENIED));
 559                 goto done;
 560         }
 561         socket_unlock(so, 0);
 562         pcb = in6_pcblookup_hash(inp->inp_pcbinfo, &sin6->sin6_addr,
 563             sin6->sin6_port, IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr) ?
 564             &addr6 : &inp->in6p_laddr, inp->inp_lport, 0, NULL);
 565         socket_lock(so, 0);
 566         if (pcb != NULL) {
 567                 in_pcb_checkstate(pcb, WNT_RELEASE, pcb == inp ? 1 : 0);
 568                 error = EADDRINUSE;
 569                 goto done;
 570         }
 571         if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
 572                 if (inp->inp_lport == 0) {
 573                         error = in6_pcbbind(inp, NULL, p);
 574                         if (error)
 575                                 goto done;
 576                 }
 577                 inp->in6p_laddr = addr6;
 578                 inp->in6p_last_outifp = outif;  /* no reference needed */
 579                 inp->in6p_flags |= INP_IN6ADDR_ANY;
 580         }
 581         if (!lck_rw_try_lock_exclusive(inp->inp_pcbinfo->ipi_lock)) {
 582                 /* lock inversion issue, mostly with udp multicast packets */
 583                 socket_unlock(so, 0);
 584                 lck_rw_lock_exclusive(inp->inp_pcbinfo->ipi_lock);
 585                 socket_lock(so, 0);
 586         }
 587         inp->in6p_faddr = sin6->sin6_addr;
 588         inp->inp_fport = sin6->sin6_port;
 589         if (nstat_collect && SOCK_PROTO(so) == IPPROTO_UDP)
 590                 nstat_pcb_invalidate_cache(inp);
 591         in_pcbrehash(inp);
 592         lck_rw_done(inp->inp_pcbinfo->ipi_lock);
 593
 594 done:
 595         if (outif != NULL)
 596                 ifnet_release(outif);
 597
 598         return (error);
 599 }
 600
 601 void
 602 in6_pcbdisconnect(struct inpcb *inp)
 603 {
 604         struct socket *so = inp->inp_socket;
 605
 606 #if CONTENT_FILTER
 607         if (so)
 608                 so->so_state_change_cnt++;
 609 #endif
 610
 611         if (!lck_rw_try_lock_exclusive(inp->inp_pcbinfo->ipi_lock)) {
 612                 /* lock inversion issue, mostly with udp multicast packets */
 613                 socket_unlock(so, 0);
 614                 lck_rw_lock_exclusive(inp->inp_pcbinfo->ipi_lock);
 615                 socket_lock(so, 0);
 616         }
 617         if (nstat_collect && SOCK_PROTO(so) == IPPROTO_UDP)
 618                 nstat_pcb_cache(inp);
 619         bzero((caddr_t)&inp->in6p_faddr, sizeof (inp->in6p_faddr));
 620         inp->inp_fport = 0;
 621         /* clear flowinfo - RFC 6437 */
 622         inp->inp_flow &= ~IPV6_FLOWLABEL_MASK;
 623         in_pcbrehash(inp);
 624         lck_rw_done(inp->inp_pcbinfo->ipi_lock);
 625         /*
 626          * A multipath subflow socket would have its SS_NOFDREF set by default,
 627          * so check for SOF_MP_SUBFLOW socket flag before detaching the PCB;
 628          * when the socket is closed for real, SOF_MP_SUBFLOW would be cleared.
 629          */
 630         if (!(so->so_flags & SOF_MP_SUBFLOW) && (so->so_state & SS_NOFDREF))
 631                 in6_pcbdetach(inp);
 632 }
 633
 634 void
 635 in6_pcbdetach(struct inpcb *inp)
 636 {
 637         struct socket *so = inp->inp_socket;
 638
 639         if (so->so_pcb == NULL) {
 640                 /* PCB has been disposed */
 641                 panic("%s: inp=%p so=%p proto=%d so_pcb is null!\n", __func__,
 642                     inp, so, SOCK_PROTO(so));
 643                 /* NOTREACHED */
 644         }
 645
 646 #if IPSEC
 647         if (inp->in6p_sp != NULL) {
 648                 (void) ipsec6_delete_pcbpolicy(inp);
 649         }
 650 #endif /* IPSEC */
 651
 652         if (inp->inp_stat != NULL && SOCK_PROTO(so) == IPPROTO_UDP) {
 653                 if (inp->inp_stat->rxpackets == 0 && inp->inp_stat->txpackets == 0) {
 654                         INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet6_dgram_no_data);
 655                 }
 656         }
 657
 658         /*
 659          * Let NetworkStatistics know this PCB is going away
 660          * before we detach it.
 661          */
 662         if (nstat_collect &&
 663             (SOCK_PROTO(so) == IPPROTO_TCP || SOCK_PROTO(so) == IPPROTO_UDP))
 664                 nstat_pcb_detach(inp);
 665         /* mark socket state as dead */
 666         if (in_pcb_checkstate(inp, WNT_STOPUSING, 1) != WNT_STOPUSING) {
 667                 panic("%s: so=%p proto=%d couldn't set to STOPUSING\n",
 668                     __func__, so, SOCK_PROTO(so));
 669                 /* NOTREACHED */
 670         }
 671
 672         if (!(so->so_flags & SOF_PCBCLEARING)) {
 673                 struct ip_moptions *imo;
 674                 struct ip6_moptions *im6o;
 675
 676                 inp->inp_vflag = 0;
 677                 if (inp->in6p_options != NULL) {
 678                         m_freem(inp->in6p_options);
 679                         inp->in6p_options = NULL;
 680                 }
 681                 ip6_freepcbopts(inp->in6p_outputopts);
 682                 ROUTE_RELEASE(&inp->in6p_route);
 683                 /* free IPv4 related resources in case of mapped addr */
 684                 if (inp->inp_options != NULL) {
 685                         (void) m_free(inp->inp_options);
 686                         inp->inp_options = NULL;
 687                 }
 688                 im6o = inp->in6p_moptions;
 689                 inp->in6p_moptions = NULL;
 690
 691                 imo = inp->inp_moptions;
 692                 inp->inp_moptions = NULL;
 693
 694                 sofreelastref(so, 0);
 695                 inp->inp_state = INPCB_STATE_DEAD;
 696                 /* makes sure we're not called twice from so_close */
 697                 so->so_flags |= SOF_PCBCLEARING;
 698
 699                 inpcb_gc_sched(inp->inp_pcbinfo, INPCB_TIMER_FAST);
 700
 701                 /*
 702                  * See inp_join_group() for why we need to unlock
 703                  */
 704                 if (im6o != NULL || imo != NULL) {
 705                         socket_unlock(so, 0);
 706                         if (im6o != NULL)
 707                                 IM6O_REMREF(im6o);
 708                         if (imo != NULL)
 709                                 IMO_REMREF(imo);
 710                         socket_lock(so, 0);
 711                 }
 712         }
 713 }
 714
 715 struct sockaddr *
 716 in6_sockaddr(in_port_t port, struct in6_addr *addr_p)
 717 {
 718         struct sockaddr_in6 *sin6;
 719
 720         MALLOC(sin6, struct sockaddr_in6 *, sizeof (*sin6), M_SONAME, M_WAITOK);
 721         if (sin6 == NULL)
 722                 return (NULL);
 723         bzero(sin6, sizeof (*sin6));
 724         sin6->sin6_family = AF_INET6;
 725         sin6->sin6_len = sizeof (*sin6);
 726         sin6->sin6_port = port;
 727         sin6->sin6_addr = *addr_p;
 728
 729         /* would be good to use sa6_recoverscope(), except for locking  */
 730         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr))
 731                 sin6->sin6_scope_id = ntohs(sin6->sin6_addr.s6_addr16[1]);
 732         else
 733                 sin6->sin6_scope_id = 0;        /* XXX */
 734         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr))
 735                 sin6->sin6_addr.s6_addr16[1] = 0;
 736
 737         return ((struct sockaddr *)sin6);
 738 }
 739
 740 void
 741 in6_sockaddr_s(in_port_t port, struct in6_addr *addr_p,
 742     struct sockaddr_in6 *sin6)
 743 {
 744         bzero(sin6, sizeof (*sin6));
 745         sin6->sin6_family = AF_INET6;
 746         sin6->sin6_len = sizeof (*sin6);
 747         sin6->sin6_port = port;
 748         sin6->sin6_addr = *addr_p;
 749
 750         /* would be good to use sa6_recoverscope(), except for locking  */
 751         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr))
 752                 sin6->sin6_scope_id = ntohs(sin6->sin6_addr.s6_addr16[1]);
 753         else
 754                 sin6->sin6_scope_id = 0;        /* XXX */
 755         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr))
 756                 sin6->sin6_addr.s6_addr16[1] = 0;
 757 }
 758
 759 /*
 760  * The calling convention of in6_getsockaddr() and in6_getpeeraddr() was
 761  * modified to match the pru_sockaddr() and pru_peeraddr() entry points
 762  * in struct pr_usrreqs, so that protocols can just reference then directly
 763  * without the need for a wrapper function.
 764  */
 765 int
 766 in6_getsockaddr(struct socket *so, struct sockaddr **nam)
 767 {
 768         struct inpcb *inp;
 769         struct in6_addr addr;
 770         in_port_t port;
 771
 772         if ((inp = sotoinpcb(so)) == NULL)
 773                 return (EINVAL);
 774
 775         port = inp->inp_lport;
 776         addr = inp->in6p_laddr;
 777
 778         *nam = in6_sockaddr(port, &addr);
 779         if (*nam == NULL)
 780                 return (ENOBUFS);
 781         return (0);
 782 }
 783
 784 int
 785 in6_getsockaddr_s(struct socket *so, struct sockaddr_in6 *ss)
 786 {
 787         struct inpcb *inp;
 788         struct in6_addr addr;
 789         in_port_t port;
 790
 791         VERIFY(ss != NULL);
 792         bzero(ss, sizeof (*ss));
 793
 794         if ((inp = sotoinpcb(so)) == NULL)
 795                 return (EINVAL);
 796
 797         port = inp->inp_lport;
 798         addr = inp->in6p_laddr;
 799
 800         in6_sockaddr_s(port, &addr, ss);
 801         return (0);
 802 }
 803
 804 int
 805 in6_getpeeraddr(struct socket *so, struct sockaddr **nam)
 806 {
 807         struct inpcb *inp;
 808         struct in6_addr addr;
 809         in_port_t port;
 810
 811         if ((inp = sotoinpcb(so)) == NULL)
 812                 return (EINVAL);
 813
 814         port = inp->inp_fport;
 815         addr = inp->in6p_faddr;
 816
 817         *nam = in6_sockaddr(port, &addr);
 818         if (*nam == NULL)
 819                 return (ENOBUFS);
 820         return (0);
 821 }
 822
 823 int
 824 in6_mapped_sockaddr(struct socket *so, struct sockaddr **nam)
 825 {
 826         struct  inpcb *inp = sotoinpcb(so);
 827         int     error;
 828
 829         if (inp == NULL)
 830                 return (EINVAL);
 831         if (inp->inp_vflag & INP_IPV4) {
 832                 error = in_getsockaddr(so, nam);
 833                 if (error == 0)
 834                         error = in6_sin_2_v4mapsin6_in_sock(nam);
 835         } else {
 836                 /* scope issues will be handled in in6_getsockaddr(). */
 837                 error = in6_getsockaddr(so, nam);
 838         }
 839         return (error);
 840 }
 841
 842 int
 843 in6_mapped_peeraddr(struct socket *so, struct sockaddr **nam)
 844 {
 845         struct  inpcb *inp = sotoinpcb(so);
 846         int     error;
 847
 848         if (inp == NULL)
 849                 return (EINVAL);
 850         if (inp->inp_vflag & INP_IPV4) {
 851                 error = in_getpeeraddr(so, nam);
 852                 if (error == 0)
 853                         error = in6_sin_2_v4mapsin6_in_sock(nam);
 854         } else {
 855                 /* scope issues will be handled in in6_getpeeraddr(). */
 856                 error = in6_getpeeraddr(so, nam);
 857         }
 858         return (error);
 859 }
 860
 861 /*
 862  * Pass some notification to all connections of a protocol
 863  * associated with address dst.  The local address and/or port numbers
 864  * may be specified to limit the search.  The "usual action" will be
 865  * taken, depending on the ctlinput cmd.  The caller must filter any
 866  * cmds that are uninteresting (e.g., no error in the map).
 867  * Call the protocol specific routine (if any) to report
 868  * any errors for each matching socket.
 869  */
 870 void
 871 in6_pcbnotify(struct inpcbinfo *pcbinfo, struct sockaddr *dst, u_int fport_arg,
 872     const struct sockaddr *src, u_int lport_arg, int cmd, void *cmdarg,
 873     void (*notify)(struct inpcb *, int))
 874 {
 875         struct inpcbhead *head = pcbinfo->ipi_listhead;
 876         struct inpcb *inp, *ninp;
 877         struct sockaddr_in6 sa6_src, *sa6_dst;
 878         u_short fport = fport_arg, lport = lport_arg;
 879         u_int32_t flowinfo;
 880         int errno;
 881
 882         if ((unsigned)cmd >= PRC_NCMDS || dst->sa_family != AF_INET6)
 883                 return;
 884
 885         sa6_dst = (struct sockaddr_in6 *)(void *)dst;
 886         if (IN6_IS_ADDR_UNSPECIFIED(&sa6_dst->sin6_addr))
 887                 return;
 888
 889         /*
 890          * note that src can be NULL when we get notify by local fragmentation.
 891          */
 892         sa6_src = (src == NULL) ?
 893             sa6_any : *(struct sockaddr_in6 *)(uintptr_t)(size_t)src;
 894         flowinfo = sa6_src.sin6_flowinfo;
 895
 896         /*
 897          * Redirects go to all references to the destination,
 898          * and use in6_rtchange to invalidate the route cache.
 899          * Dead host indications: also use in6_rtchange to invalidate
 900          * the cache, and deliver the error to all the sockets.
 901          * Otherwise, if we have knowledge of the local port and address,
 902          * deliver only to that socket.
 903          */
 904         if (PRC_IS_REDIRECT(cmd) || cmd == PRC_HOSTDEAD) {
 905                 fport = 0;
 906                 lport = 0;
 907                 bzero((caddr_t)&sa6_src.sin6_addr, sizeof (sa6_src.sin6_addr));
 908
 909                 if (cmd != PRC_HOSTDEAD)
 910                         notify = in6_rtchange;
 911         }
 912         errno = inet6ctlerrmap[cmd];
 913         lck_rw_lock_shared(pcbinfo->ipi_lock);
 914         for (inp = LIST_FIRST(head); inp != NULL; inp = ninp) {
 915                 ninp = LIST_NEXT(inp, inp_list);
 916
 917                 if (!(inp->inp_vflag & INP_IPV6))
 918                         continue;
 919
 920                 /*
 921                  * If the error designates a new path MTU for a destination
 922                  * and the application (associated with this socket) wanted to
 923                  * know the value, notify. Note that we notify for all
 924                  * disconnected sockets if the corresponding application
 925                  * wanted. This is because some UDP applications keep sending
 926                  * sockets disconnected.
 927                  * XXX: should we avoid to notify the value to TCP sockets?
 928                  */
 929                 if (cmd == PRC_MSGSIZE)
 930                         ip6_notify_pmtu(inp, (struct sockaddr_in6 *)(void *)dst,
 931                             (u_int32_t *)cmdarg);
 932
 933                 /*
 934                  * Detect if we should notify the error. If no source and
 935                  * destination ports are specifed, but non-zero flowinfo and
 936                  * local address match, notify the error. This is the case
 937                  * when the error is delivered with an encrypted buffer
 938                  * by ESP. Otherwise, just compare addresses and ports
 939                  * as usual.
 940                  */
 941                 if (lport == 0 && fport == 0 && flowinfo &&
 942                     inp->inp_socket != NULL &&
 943                     flowinfo == (inp->inp_flow & IPV6_FLOWLABEL_MASK) &&
 944                     IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, &sa6_src.sin6_addr))
 945                         goto do_notify;
 946                 else if (!IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr,
 947                     &sa6_dst->sin6_addr) || inp->inp_socket == NULL ||
 948                     (lport && inp->inp_lport != lport) ||
 949                     (!IN6_IS_ADDR_UNSPECIFIED(&sa6_src.sin6_addr) &&
 950                     !IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr,
 951                     &sa6_src.sin6_addr)) || (fport && inp->inp_fport != fport))
 952                         continue;
 953
 954 do_notify:
 955                 if (notify) {
 956                         if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) ==
 957                             WNT_STOPUSING)
 958                                 continue;
 959                         socket_lock(inp->inp_socket, 1);
 960                         (*notify)(inp, errno);
 961                         (void) in_pcb_checkstate(inp, WNT_RELEASE, 1);
 962                         socket_unlock(inp->inp_socket, 1);
 963                 }
 964         }
 965         lck_rw_done(pcbinfo->ipi_lock);
 966 }
 967
 968 /*
 969  * Lookup a PCB based on the local address and port.
 970  */
 971 struct inpcb *
 972 in6_pcblookup_local(struct inpcbinfo *pcbinfo, struct in6_addr *laddr,
 973     u_int lport_arg, int wild_okay)
 974 {
 975         struct inpcb *inp;
 976         int matchwild = 3, wildcard;
 977         u_short lport = lport_arg;
 978         struct inpcbporthead *porthash;
 979         struct inpcb *match = NULL;
 980         struct inpcbport *phd;
 981
 982         if (!wild_okay) {
 983                 struct inpcbhead *head;
 984                 /*
 985                  * Look for an unconnected (wildcard foreign addr) PCB that
 986                  * matches the local address and port we're looking for.
 987                  */
 988                 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(INADDR_ANY, lport, 0,
 989                     pcbinfo->ipi_hashmask)];
 990                 LIST_FOREACH(inp, head, inp_hash) {
 991                         if (!(inp->inp_vflag & INP_IPV6))
 992                                 continue;
 993                         if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) &&
 994                             IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr) &&
 995                             inp->inp_lport == lport) {
 996                                 /*
 997                                  * Found.
 998                                  */
 999                                 return (inp);
1000                         }
1001                 }
1002                 /*
1003                  * Not found.
1004                  */
1005                 return (NULL);
1006         }
1007         /*
1008          * Best fit PCB lookup.
1009          *
1010          * First see if this local port is in use by looking on the
1011          * port hash list.
1012          */
1013         porthash = &pcbinfo->ipi_porthashbase[INP_PCBPORTHASH(lport,
1014             pcbinfo->ipi_porthashmask)];
1015         LIST_FOREACH(phd, porthash, phd_hash) {
1016                 if (phd->phd_port == lport)
1017                         break;
1018         }
1019         if (phd != NULL) {
1020                 /*
1021                  * Port is in use by one or more PCBs. Look for best
1022                  * fit.
1023                  */
1024                 LIST_FOREACH(inp, &phd->phd_pcblist, inp_portlist) {
1025                         wildcard = 0;
1026                         if (!(inp->inp_vflag & INP_IPV6))
1027                                 continue;
1028                         if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr))
1029                                 wildcard++;
1030                         if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
1031                                 if (IN6_IS_ADDR_UNSPECIFIED(laddr))
1032                                         wildcard++;
1033                                 else if (!IN6_ARE_ADDR_EQUAL(
1034                                     &inp->in6p_laddr, laddr))
1035                                         continue;
1036                         } else {
1037                                 if (!IN6_IS_ADDR_UNSPECIFIED(laddr))
1038                                         wildcard++;
1039                         }
1040                         if (wildcard < matchwild) {
1041                                 match = inp;
1042                                 matchwild = wildcard;
1043                                 if (matchwild == 0) {
1044                                         break;
1045                                 }
1046                         }
1047                 }
1048         }
1049         return (match);
1050 }
1051
1052 /*
1053  * Check for alternatives when higher level complains
1054  * about service problems.  For now, invalidate cached
1055  * routing information.  If the route was created dynamically
1056  * (by a redirect), time to try a default gateway again.
1057  */
1058 void
1059 in6_losing(struct inpcb *in6p)
1060 {
1061         struct rtentry *rt;
1062
1063         if ((rt = in6p->in6p_route.ro_rt) != NULL) {
1064                 RT_LOCK(rt);
1065                 if (rt->rt_flags & RTF_DYNAMIC) {
1066                         /*
1067                          * Prevent another thread from modifying rt_key,
1068                          * rt_gateway via rt_setgate() after the rt_lock
1069                          * is dropped by marking the route as defunct.
1070                          */
1071                         rt->rt_flags |= RTF_CONDEMNED;
1072                         RT_UNLOCK(rt);
1073                         (void) rtrequest(RTM_DELETE, rt_key(rt),
1074                             rt->rt_gateway, rt_mask(rt), rt->rt_flags, NULL);
1075                 } else {
1076                         RT_UNLOCK(rt);
1077                 }
1078                 /*
1079                  * A new route can be allocated
1080                  * the next time output is attempted.
1081                  */
1082         }
1083         ROUTE_RELEASE(&in6p->in6p_route);
1084 }
1085
1086 /*
1087  * After a routing change, flush old routing
1088  * and allocate a (hopefully) better one.
1089  */
1090 void
1091 in6_rtchange(struct inpcb *inp, int errno)
1092 {
1093 #pragma unused(errno)
1094         /*
1095          * A new route can be allocated the next time
1096          * output is attempted.
1097          */
1098         ROUTE_RELEASE(&inp->in6p_route);
1099 }
1100
1101 /*
1102  * Check if PCB exists hash list. Also returns uid and gid of socket
1103  */
1104 int
1105 in6_pcblookup_hash_exists(struct inpcbinfo *pcbinfo, struct in6_addr *faddr,
1106     u_int fport_arg, struct in6_addr *laddr, u_int lport_arg, int wildcard,
1107     uid_t *uid, gid_t *gid, struct ifnet *ifp)
1108 {
1109         struct inpcbhead *head;
1110         struct inpcb *inp;
1111         u_short fport = fport_arg, lport = lport_arg;
1112         int found;
1113
1114         *uid = UID_MAX;
1115         *gid = GID_MAX;
1116
1117         lck_rw_lock_shared(pcbinfo->ipi_lock);
1118
1119         /*
1120          * First look for an exact match.
1121          */
1122         head = &pcbinfo->ipi_hashbase[INP_PCBHASH(faddr->s6_addr32[3] /* XXX */,
1123             lport, fport, pcbinfo->ipi_hashmask)];
1124         LIST_FOREACH(inp, head, inp_hash) {
1125                 if (!(inp->inp_vflag & INP_IPV6))
1126                         continue;
1127
1128                 if (inp_restricted_recv(inp, ifp))
1129                         continue;
1130
1131                 if (IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr, faddr) &&
1132                     IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr) &&
1133                     inp->inp_fport == fport &&
1134                     inp->inp_lport == lport) {
1135                         if ((found = (inp->inp_socket != NULL))) {
1136                                 /*
1137                                  * Found. Check if pcb is still valid
1138                                  */
1139                                 *uid = kauth_cred_getuid(
1140                                     inp->inp_socket->so_cred);
1141                                 *gid = kauth_cred_getgid(
1142                                     inp->inp_socket->so_cred);
1143                         }
1144                         lck_rw_done(pcbinfo->ipi_lock);
1145                         return (found);
1146                 }
1147         }
1148         if (wildcard) {
1149                 struct inpcb *local_wild = NULL;
1150
1151                 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(INADDR_ANY, lport, 0,
1152                     pcbinfo->ipi_hashmask)];
1153                 LIST_FOREACH(inp, head, inp_hash) {
1154                         if (!(inp->inp_vflag & INP_IPV6))
1155                                 continue;
1156
1157                         if (inp_restricted_recv(inp, ifp))
1158                                 continue;
1159
1160                         if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) &&
1161                             inp->inp_lport == lport) {
1162                                 if (IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr,
1163                                     laddr)) {
1164                                         found = (inp->inp_socket != NULL);
1165                                         if (found) {
1166                                                 *uid = kauth_cred_getuid(
1167                                                     inp->inp_socket->so_cred);
1168                                                 *gid = kauth_cred_getgid(
1169                                                     inp->inp_socket->so_cred);
1170                                         }
1171                                         lck_rw_done(pcbinfo->ipi_lock);
1172                                         return (found);
1173                                 } else if (IN6_IS_ADDR_UNSPECIFIED(
1174                                     &inp->in6p_laddr)) {
1175                                         local_wild = inp;
1176                                 }
1177                         }
1178                 }
1179                 if (local_wild) {
1180                         if ((found = (local_wild->inp_socket != NULL))) {
1181                                 *uid = kauth_cred_getuid(
1182                                     local_wild->inp_socket->so_cred);
1183                                 *gid = kauth_cred_getgid(
1184                                     local_wild->inp_socket->so_cred);
1185                         }
1186                         lck_rw_done(pcbinfo->ipi_lock);
1187                         return (found);
1188                 }
1189         }
1190
1191         /*
1192          * Not found.
1193          */
1194         lck_rw_done(pcbinfo->ipi_lock);
1195         return (0);
1196 }
1197
1198 /*
1199  * Lookup PCB in hash list.
1200  */
1201 struct inpcb *
1202 in6_pcblookup_hash(struct inpcbinfo *pcbinfo, struct in6_addr *faddr,
1203     u_int fport_arg, struct in6_addr *laddr, u_int lport_arg, int wildcard,
1204     struct ifnet *ifp)
1205 {
1206         struct inpcbhead *head;
1207         struct inpcb *inp;
1208         u_short fport = fport_arg, lport = lport_arg;
1209
1210         lck_rw_lock_shared(pcbinfo->ipi_lock);
1211
1212         /*
1213          * First look for an exact match.
1214          */
1215         head = &pcbinfo->ipi_hashbase[INP_PCBHASH(faddr->s6_addr32[3] /* XXX */,
1216             lport, fport, pcbinfo->ipi_hashmask)];
1217         LIST_FOREACH(inp, head, inp_hash) {
1218                 if (!(inp->inp_vflag & INP_IPV6))
1219                         continue;
1220
1221                 if (inp_restricted_recv(inp, ifp))
1222                         continue;
1223
1224                 if (IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr, faddr) &&
1225                     IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr) &&
1226                     inp->inp_fport == fport &&
1227                     inp->inp_lport == lport) {
1228                         /*
1229                          * Found. Check if pcb is still valid
1230                          */
1231                         if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) !=
1232                             WNT_STOPUSING) {
1233                                 lck_rw_done(pcbinfo->ipi_lock);
1234                                 return (inp);
1235                         } else {
1236                                 /* it's there but dead, say it isn't found */
1237                                 lck_rw_done(pcbinfo->ipi_lock);
1238                                 return (NULL);
1239                         }
1240                 }
1241         }
1242         if (wildcard) {
1243                 struct inpcb *local_wild = NULL;
1244
1245                 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(INADDR_ANY, lport, 0,
1246                     pcbinfo->ipi_hashmask)];
1247                 LIST_FOREACH(inp, head, inp_hash) {
1248                         if (!(inp->inp_vflag & INP_IPV6))
1249                                 continue;
1250
1251                         if (inp_restricted_recv(inp, ifp))
1252                                 continue;
1253
1254                         if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) &&
1255                             inp->inp_lport == lport) {
1256                                 if (IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr,
1257                                     laddr)) {
1258                                         if (in_pcb_checkstate(inp, WNT_ACQUIRE,
1259                                             0) != WNT_STOPUSING) {
1260                                                 lck_rw_done(pcbinfo->ipi_lock);
1261                                                 return (inp);
1262                                         } else {
1263                                                 /* dead; say it isn't found */
1264                                                 lck_rw_done(pcbinfo->ipi_lock);
1265                                                 return (NULL);
1266                                         }
1267                                 } else if (IN6_IS_ADDR_UNSPECIFIED(
1268                                     &inp->in6p_laddr)) {
1269                                         local_wild = inp;
1270                                 }
1271                         }
1272                 }
1273                 if (local_wild && in_pcb_checkstate(local_wild,
1274                     WNT_ACQUIRE, 0) != WNT_STOPUSING) {
1275                         lck_rw_done(pcbinfo->ipi_lock);
1276                         return (local_wild);
1277                 } else {
1278                         lck_rw_done(pcbinfo->ipi_lock);
1279                         return (NULL);
1280                 }
1281         }
1282
1283         /*
1284          * Not found.
1285          */
1286         lck_rw_done(pcbinfo->ipi_lock);
1287         return (NULL);
1288 }
1289
1290 void
1291 init_sin6(struct sockaddr_in6 *sin6, struct mbuf *m)
1292 {
1293         struct ip6_hdr *ip;
1294
1295         ip = mtod(m, struct ip6_hdr *);
1296         bzero(sin6, sizeof (*sin6));
1297         sin6->sin6_len = sizeof (*sin6);
1298         sin6->sin6_family = AF_INET6;
1299         sin6->sin6_addr = ip->ip6_src;
1300         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
1301                 sin6->sin6_addr.s6_addr16[1] = 0;
1302                 if ((m->m_pkthdr.pkt_flags & (PKTF_LOOP|PKTF_IFAINFO)) ==
1303                     (PKTF_LOOP|PKTF_IFAINFO))
1304                         sin6->sin6_scope_id = m->m_pkthdr.src_ifindex;
1305                 else if (m->m_pkthdr.rcvif != NULL)
1306                         sin6->sin6_scope_id = m->m_pkthdr.rcvif->if_index;
1307         }
1308 }
1309
1310 /*
1311  * The following routines implement this scheme:
1312  *
1313  * Callers of ip6_output() that intend to cache the route in the inpcb pass
1314  * a local copy of the struct route to ip6_output().  Using a local copy of
1315  * the cached route significantly simplifies things as IP no longer has to
1316  * worry about having exclusive access to the passed in struct route, since
1317  * it's defined in the caller's stack; in essence, this allows for a lock-
1318  * less operation when updating the struct route at the IP level and below,
1319  * whenever necessary. The scheme works as follows:
1320  *
1321  * Prior to dropping the socket's lock and calling ip6_output(), the caller
1322  * copies the struct route from the inpcb into its stack, and adds a reference
1323  * to the cached route entry, if there was any.  The socket's lock is then
1324  * dropped and ip6_output() is called with a pointer to the copy of struct
1325  * route defined on the stack (not to the one in the inpcb.)
1326  *
1327  * Upon returning from ip6_output(), the caller then acquires the socket's
1328  * lock and synchronizes the cache; if there is no route cached in the inpcb,
1329  * it copies the local copy of struct route (which may or may not contain any
1330  * route) back into the cache; otherwise, if the inpcb has a route cached in
1331  * it, the one in the local copy will be freed, if there's any.  Trashing the
1332  * cached route in the inpcb can be avoided because ip6_output() is single-
1333  * threaded per-PCB (i.e. multiple transmits on a PCB are always serialized
1334  * by the socket/transport layer.)
1335  */
1336 void
1337 in6p_route_copyout(struct inpcb *inp, struct route_in6 *dst)
1338 {
1339         struct route_in6 *src = &inp->in6p_route;
1340
1341         socket_lock_assert_owned(inp->inp_socket);
1342
1343         /* Minor sanity check */
1344         if (src->ro_rt != NULL && rt_key(src->ro_rt)->sa_family != AF_INET6)
1345                 panic("%s: wrong or corrupted route: %p", __func__, src);
1346
1347         route_copyout((struct route *)dst, (struct route *)src, sizeof (*dst));
1348 }
1349
1350 void
1351 in6p_route_copyin(struct inpcb *inp, struct route_in6 *src)
1352 {
1353         struct route_in6 *dst = &inp->in6p_route;
1354
1355         socket_lock_assert_owned(inp->inp_socket);
1356
1357         /* Minor sanity check */
1358         if (src->ro_rt != NULL && rt_key(src->ro_rt)->sa_family != AF_INET6)
1359                 panic("%s: wrong or corrupted route: %p", __func__, src);
1360
1361         route_copyin((struct route *)src, (struct route *)dst, sizeof (*src));
1362 }