]> git.saurik.com Git - apple/xnu.git/blobdiff - bsd/netinet6/in6_pcb.c
xnu-1699.22.73.tar.gz
[apple/xnu.git] / bsd / netinet6 / in6_pcb.c
index 1b481b21fa1b32d59d2f8b364d4a51c35bdbc2c4..2ea4d7a5d5d656b2c98c1bb8c664f505e80342c3 100644 (file)
@@ -1,5 +1,5 @@
 /*
 /*
- * Copyright (c) 2003-2007 Apple Inc. All rights reserved.
+ * Copyright (c) 2003-2011 Apple Inc. All rights reserved.
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  * 
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  * 
 #include <sys/errno.h>
 #include <sys/time.h>
 #include <sys/proc.h>
 #include <sys/errno.h>
 #include <sys/time.h>
 #include <sys/proc.h>
+#include <sys/kauth.h>
+#include <sys/priv.h>
 
 #include <net/if.h>
 #include <net/if_types.h>
 
 #include <net/if.h>
 #include <net/if_types.h>
@@ -160,30 +162,32 @@ in6_pcblookup_local_and_cleanup(
        if (inp && inp->inp_wantcnt == WNT_STOPUSING) {
                struct socket *so = inp->inp_socket;
                
        if (inp && inp->inp_wantcnt == WNT_STOPUSING) {
                struct socket *so = inp->inp_socket;
                
-               lck_mtx_lock(inp->inpcb_mtx);
+               lck_mtx_lock(&inp->inpcb_mtx);
                
                if (so->so_usecount == 0) {
                
                if (so->so_usecount == 0) {
+                       if (inp->inp_state != INPCB_STATE_DEAD)
+                               in6_pcbdetach(inp);
                        in_pcbdispose(inp);
                        inp = NULL;
                }
                else {
                        in_pcbdispose(inp);
                        inp = NULL;
                }
                else {
-                       lck_mtx_unlock(inp->inpcb_mtx);
+                       lck_mtx_unlock(&inp->inpcb_mtx);
                }
        }
        
        return inp;
 }
                }
        }
        
        return inp;
 }
+
 int
 int
-in6_pcbbind(
-       struct inpcb *inp,
-       struct sockaddr *nam,
-       struct proc *p)
+in6_pcbbind(struct inpcb *inp, struct sockaddr *nam, struct proc *p)
 {
        struct socket *so = inp->inp_socket;
        struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)NULL;
        struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
        u_short lport = 0;
        int wild = 0, reuseport = (so->so_options & SO_REUSEPORT);
 {
        struct socket *so = inp->inp_socket;
        struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)NULL;
        struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
        u_short lport = 0;
        int wild = 0, reuseport = (so->so_options & SO_REUSEPORT);
+       int error;
+       kauth_cred_t cred;
 
        if (!in6_ifaddrs) /* XXX broken! */
                return (EADDRNOTAVAIL);
 
        if (!in6_ifaddrs) /* XXX broken! */
                return (EADDRNOTAVAIL);
@@ -194,6 +198,8 @@ in6_pcbbind(
        socket_unlock(so, 0); /* keep reference */
        lck_rw_lock_exclusive(pcbinfo->mtx);
        if (nam) {
        socket_unlock(so, 0); /* keep reference */
        lck_rw_lock_exclusive(pcbinfo->mtx);
        if (nam) {
+               unsigned int outif = 0;
+
                sin6 = (struct sockaddr_in6 *)nam;
                if (nam->sa_len != sizeof(*sin6)) {
                        lck_rw_done(pcbinfo->mtx);
                sin6 = (struct sockaddr_in6 *)nam;
                if (nam->sa_len != sizeof(*sin6)) {
                        lck_rw_done(pcbinfo->mtx);
@@ -210,7 +216,8 @@ in6_pcbbind(
                }
 
                /* KAME hack: embed scopeid */
                }
 
                /* KAME hack: embed scopeid */
-               if (in6_embedscope(&sin6->sin6_addr, sin6, inp, NULL) != 0) {
+               if (in6_embedscope(&sin6->sin6_addr, sin6, inp, NULL,
+                   NULL) != 0) {
                        lck_rw_done(pcbinfo->mtx);
                        socket_lock(so, 0);
                        return EINVAL;
                        lck_rw_done(pcbinfo->mtx);
                        socket_lock(so, 0);
                        return EINVAL;
@@ -230,10 +237,10 @@ in6_pcbbind(
                        if (so->so_options & SO_REUSEADDR)
                                reuseport = SO_REUSEADDR|SO_REUSEPORT;
                } else if (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
                        if (so->so_options & SO_REUSEADDR)
                                reuseport = SO_REUSEADDR|SO_REUSEPORT;
                } else if (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
-                       struct ifaddr *ia = NULL;
+                       struct ifaddr *ifa;
 
                        sin6->sin6_port = 0;            /* yech... */
 
                        sin6->sin6_port = 0;            /* yech... */
-                       if ((ia = ifa_ifwithaddr((struct sockaddr *)sin6)) == 0) {
+                       if ((ifa = ifa_ifwithaddr((struct sockaddr *)sin6)) == 0) {
                                lck_rw_done(pcbinfo->mtx);
                                socket_lock(so, 0);
                                return(EADDRNOTAVAIL);
                                lck_rw_done(pcbinfo->mtx);
                                socket_lock(so, 0);
                                return(EADDRNOTAVAIL);
@@ -245,26 +252,34 @@ in6_pcbbind(
                         * We should allow to bind to a deprecated address, since
                         * the application dare to use it.
                         */
                         * We should allow to bind to a deprecated address, since
                         * the application dare to use it.
                         */
-                       if (ia &&
-                           ((struct in6_ifaddr *)ia)->ia6_flags &
-                           (IN6_IFF_ANYCAST|IN6_IFF_NOTREADY|IN6_IFF_DETACHED)) {
-                               ifafree(ia);
-                               lck_rw_done(pcbinfo->mtx);
-                               socket_lock(so, 0);
-                               return(EADDRNOTAVAIL);
+                       if (ifa != NULL) {
+                               IFA_LOCK_SPIN(ifa);
+                               if (((struct in6_ifaddr *)ifa)->ia6_flags &
+                                   (IN6_IFF_ANYCAST|IN6_IFF_NOTREADY|IN6_IFF_DETACHED)) {
+                                       IFA_UNLOCK(ifa);
+                                       IFA_REMREF(ifa);
+                                       lck_rw_done(pcbinfo->mtx);
+                                       socket_lock(so, 0);
+                                       return(EADDRNOTAVAIL);
+                               }
+                               outif = ifa->ifa_ifp->if_index;
+                               IFA_UNLOCK(ifa);
+                               IFA_REMREF(ifa);
                        }
                        }
-                       ifafree(ia);
-                       ia = NULL;
                }
                if (lport) {
                        struct inpcb *t;
 
                        /* GROSS */
                }
                if (lport) {
                        struct inpcb *t;
 
                        /* GROSS */
-                       if (ntohs(lport) < IPV6PORT_RESERVED && p &&
-                            ((so->so_state & SS_PRIV) == 0)) {
-                               lck_rw_done(pcbinfo->mtx);
-                               socket_lock(so, 0);
-                               return(EACCES);
+                       if (ntohs(lport) < IPV6PORT_RESERVED) {
+                               cred = kauth_cred_proc_ref(p);
+                               error = priv_check_cred(cred, PRIV_NETINET_RESERVEDPORT, 0);
+                               kauth_cred_unref(&cred);
+                               if (error != 0) {
+                                       lck_rw_done(pcbinfo->mtx);
+                                       socket_lock(so, 0);
+                                       return(EACCES);
+                               }
                        }
 
                        if (so->so_uid &&
                        }
 
                        if (so->so_uid &&
@@ -333,6 +348,7 @@ in6_pcbbind(
                        }
                }
                inp->in6p_laddr = sin6->sin6_addr;
                        }
                }
                inp->in6p_laddr = sin6->sin6_addr;
+               inp->in6p_last_outif = outif;
        }
        socket_lock(so, 0);
        if (lport == 0) {
        }
        socket_lock(so, 0);
        if (lport == 0) {
@@ -347,10 +363,11 @@ in6_pcbbind(
                if (in_pcbinshash(inp, 1) != 0) {
                        inp->in6p_laddr = in6addr_any;
                        inp->inp_lport = 0;
                if (in_pcbinshash(inp, 1) != 0) {
                        inp->in6p_laddr = in6addr_any;
                        inp->inp_lport = 0;
+                       inp->in6p_last_outif = 0;
                        lck_rw_done(pcbinfo->mtx);
                        return (EAGAIN);
                }
                        lck_rw_done(pcbinfo->mtx);
                        return (EAGAIN);
                }
-       }       
+       }
        lck_rw_done(pcbinfo->mtx);
        sflt_notify(so, sock_evt_bound, NULL);
        return(0);
        lck_rw_done(pcbinfo->mtx);
        sflt_notify(so, sock_evt_bound, NULL);
        return(0);
@@ -369,17 +386,14 @@ in6_pcbbind(
  */
 
 int
  */
 
 int
-in6_pcbladdr(
-       struct inpcb *inp,
-       struct sockaddr *nam,
-       struct in6_addr *plocal_addr6)
+in6_pcbladdr(struct inpcb *inp, struct sockaddr *nam,
+    struct in6_addr *plocal_addr6, unsigned int *poutif)
 {
        struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)nam;
        struct in6_addr *addr6 = NULL;
        struct in6_addr src_storage;
 {
        struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)nam;
        struct in6_addr *addr6 = NULL;
        struct in6_addr src_storage;
-       
-       struct ifnet *ifp = NULL;
        int error = 0;
        int error = 0;
+       unsigned int ifscope;
 
        if (nam->sa_len != sizeof (*sin6))
                return (EINVAL);
 
        if (nam->sa_len != sizeof (*sin6))
                return (EINVAL);
@@ -389,7 +403,7 @@ in6_pcbladdr(
                return (EADDRNOTAVAIL);
 
        /* KAME hack: embed scopeid */
                return (EADDRNOTAVAIL);
 
        /* KAME hack: embed scopeid */
-       if (in6_embedscope(&sin6->sin6_addr, sin6, inp, &ifp) != 0)
+       if (in6_embedscope(&sin6->sin6_addr, sin6, inp, NULL, NULL) != 0)
                return EINVAL;
 
        if (in6_ifaddrs) {
                return EINVAL;
 
        if (in6_ifaddrs) {
@@ -400,32 +414,37 @@ in6_pcbladdr(
                if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
                        sin6->sin6_addr = in6addr_loopback;
        }
                if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
                        sin6->sin6_addr = in6addr_loopback;
        }
-       {
-               /*
-                * XXX: in6_selectsrc might replace the bound local address
-                * with the address specified by setsockopt(IPV6_PKTINFO).
-                * Is it the intended behavior?
-                */
-               addr6 = in6_selectsrc(sin6, inp->in6p_outputopts,
-                                             inp->in6p_moptions,
-                                             &inp->in6p_route,
-                                             &inp->in6p_laddr, &src_storage, &error);
-               if (addr6 == 0) {
-                       if (error == 0)
-                               error = EADDRNOTAVAIL;
-                       return(error);
-               }
-               *plocal_addr6 = *addr6;
-               /*
-                * Don't do pcblookup call here; return interface in
-                * plocal_addr6
-                * and exit to caller, that will do the lookup.
-                */
+
+       ifscope = (inp->inp_flags & INP_BOUND_IF) ?
+          inp->inp_boundif : IFSCOPE_NONE;
+
+       /*
+        * XXX: in6_selectsrc might replace the bound local address
+        * with the address specified by setsockopt(IPV6_PKTINFO).
+        * Is it the intended behavior?
+        */
+       addr6 = in6_selectsrc(sin6, inp->in6p_outputopts, inp,
+           &inp->in6p_route, NULL, &src_storage, ifscope, &error);
+       if (addr6 == 0) {
+               if (error == 0)
+                       error = EADDRNOTAVAIL;
+               return(error);
        }
 
        }
 
-       if (inp->in6p_route.ro_rt)
-               ifp = inp->in6p_route.ro_rt->rt_ifp;
+       if (poutif != NULL) {
+               struct rtentry *rt;
+               if ((rt = inp->in6p_route.ro_rt) != NULL)
+                       *poutif = rt->rt_ifp->if_index;
+               else
+                       *poutif = 0;
+       }
 
 
+       *plocal_addr6 = *addr6;
+       /*
+        * Don't do pcblookup call here; return interface in
+        * plocal_addr6
+        * and exit to caller, that will do the lookup.
+        */
        return(0);
 }
 
        return(0);
 }
 
@@ -437,21 +456,22 @@ in6_pcbladdr(
  * then pick one.
  */
 int
  * then pick one.
  */
 int
-in6_pcbconnect(inp, nam, p)
-       struct inpcb *inp;
-       struct sockaddr *nam;
-       struct proc *p;
+in6_pcbconnect(
+       struct inpcb *inp,
+       struct sockaddr *nam,
+       struct proc *p)
 {
        struct in6_addr addr6;
        struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)nam;
        struct inpcb *pcb;
        int error;
 {
        struct in6_addr addr6;
        struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)nam;
        struct inpcb *pcb;
        int error;
+       unsigned int outif = 0;
 
        /*
         * Call inner routine, to assign local interface address.
         * in6_pcbladdr() may automatically fill in sin6_scope_id.
         */
 
        /*
         * Call inner routine, to assign local interface address.
         * in6_pcbladdr() may automatically fill in sin6_scope_id.
         */
-       if ((error = in6_pcbladdr(inp, nam, &addr6)) != 0)
+       if ((error = in6_pcbladdr(inp, nam, &addr6, &outif)) != 0)
                return(error);
        socket_unlock(inp->inp_socket, 0);
        pcb = in6_pcblookup_hash(inp->inp_pcbinfo, &sin6->sin6_addr,
                return(error);
        socket_unlock(inp->inp_socket, 0);
        pcb = in6_pcblookup_hash(inp->inp_pcbinfo, &sin6->sin6_addr,
@@ -461,7 +481,7 @@ in6_pcbconnect(inp, nam, p)
                              inp->inp_lport, 0, NULL);
        socket_lock(inp->inp_socket, 0);
        if (pcb != NULL) {
                              inp->inp_lport, 0, NULL);
        socket_lock(inp->inp_socket, 0);
        if (pcb != NULL) {
-               in_pcb_checkstate(pcb, WNT_RELEASE, 0);
+               in_pcb_checkstate(pcb, WNT_RELEASE, pcb == inp ? 1 : 0);
                return (EADDRINUSE);
        }
        if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
                return (EADDRINUSE);
        }
        if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
@@ -471,6 +491,7 @@ in6_pcbconnect(inp, nam, p)
                                return (error);
                }
                inp->in6p_laddr = addr6;
                                return (error);
                }
                inp->in6p_laddr = addr6;
+               inp->in6p_last_outif = outif;
        }
        if (!lck_rw_try_lock_exclusive(inp->inp_pcbinfo->mtx)) {
                /*lock inversion issue, mostly with udp multicast packets */
        }
        if (!lck_rw_try_lock_exclusive(inp->inp_pcbinfo->mtx)) {
                /*lock inversion issue, mostly with udp multicast packets */
@@ -491,230 +512,9 @@ in6_pcbconnect(inp, nam, p)
        return (0);
 }
 
        return (0);
 }
 
-#if 0
-/*
- * Return an IPv6 address, which is the most appropriate for given
- * destination and user specified options.
- * If necessary, this function lookups the routing table and return
- * an entry to the caller for later use.
- */
-struct in6_addr *
-in6_selectsrc(
-       struct sockaddr_in6 *dstsock,
-       struct ip6_pktopts *opts,
-       struct ip6_moptions *mopts,
-       struct route_in6 *ro,
-       struct in6_addr *laddr,
-       struct in6_addr *src_storage,
-       int *errorp)
-{
-       struct in6_addr *dst;
-       struct in6_ifaddr *ia6 = 0;
-       struct in6_pktinfo *pi = NULL;
-
-       dst = &dstsock->sin6_addr;
-       *errorp = 0;
-
-       /*
-        * If the source address is explicitly specified by the caller,
-        * use it.
-        */
-       if (opts && (pi = opts->ip6po_pktinfo) &&
-           !IN6_IS_ADDR_UNSPECIFIED(&pi->ipi6_addr))
-               return(&pi->ipi6_addr);
-
-       /*
-        * If the source address is not specified but the socket(if any)
-        * is already bound, use the bound address.
-        */
-       if (laddr && !IN6_IS_ADDR_UNSPECIFIED(laddr))
-               return(laddr);
-
-       /*
-        * If the caller doesn't specify the source address but
-        * the outgoing interface, use an address associated with
-        * the interface.
-        */
-       if (pi && pi->ipi6_ifindex) {
-               /* XXX boundary check is assumed to be already done. */
-               ia6 = in6_ifawithscope(ifindex2ifnet[pi->ipi6_ifindex],
-                                      dst);
-               if (ia6 == 0) {
-                       *errorp = EADDRNOTAVAIL;
-                       return(0);
-               }
-               *src_storage = satosin6(&ia6->ia_addr)->sin6_addr;
-               ifafree(&ia6->ia_ifa);
-               return(src_storage);
-       }
-
-       /*
-        * If the destination address is a link-local unicast address or
-        * a multicast address, and if the outgoing interface is specified
-        * by the sin6_scope_id filed, use an address associated with the
-        * interface.
-        * XXX: We're now trying to define more specific semantics of
-        *      sin6_scope_id field, so this part will be rewritten in
-        *      the near future.
-        */
-       if ((IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst)) &&
-           dstsock->sin6_scope_id) {
-               /*
-                * I'm not sure if boundary check for scope_id is done
-                * somewhere...
-                */
-               if (dstsock->sin6_scope_id < 0 ||
-                   if_index < dstsock->sin6_scope_id) {
-                       *errorp = ENXIO; /* XXX: better error? */
-                       return(0);
-               }
-               ia6 = in6_ifawithscope(ifindex2ifnet[dstsock->sin6_scope_id],
-                                      dst);
-               if (ia6 == 0) {
-                       *errorp = EADDRNOTAVAIL;
-                       return(0);
-               }
-               *src_storage = satosin6(&ia6->ia_addr)->sin6_addr;
-               ifafree(&ia6->ia_ifa);
-               return(src_storage);
-       }
-
-       /*
-        * If the destination address is a multicast address and
-        * the outgoing interface for the address is specified
-        * by the caller, use an address associated with the interface.
-        * There is a sanity check here; if the destination has node-local
-        * scope, the outgoing interfacde should be a loopback address.
-        * Even if the outgoing interface is not specified, we also
-        * choose a loopback interface as the outgoing interface.
-        */
-       if (IN6_IS_ADDR_MULTICAST(dst)) {
-               struct ifnet *ifp = mopts ? mopts->im6o_multicast_ifp : NULL;
-
-               if (ifp == NULL && IN6_IS_ADDR_MC_NODELOCAL(dst)) {
-                       ifp = lo_ifp;
-               }
-
-               if (ifp) {
-                       ia6 = in6_ifawithscope(ifp, dst);
-                       if (ia6 == 0) {
-                               *errorp = EADDRNOTAVAIL;
-                               return(0);
-                       }
-                       *src_storage = ia6->ia_addr.sin6_addr;
-                       ifafree(&ia6->ia_ifa);
-                       return(src_storage);
-               }
-       }
-
-       /*
-        * If the next hop address for the packet is specified
-        * by caller, use an address associated with the route
-        * to the next hop.
-        */
-       {
-               struct sockaddr_in6 *sin6_next;
-               struct rtentry *rt;
-
-               if (opts && opts->ip6po_nexthop) {
-                       sin6_next = satosin6(opts->ip6po_nexthop);
-                       rt = nd6_lookup(&sin6_next->sin6_addr, 1, NULL, 0);
-                       if (rt) {
-                               ia6 = in6_ifawithscope(rt->rt_ifp, dst);
-                               if (ia6 == 0) {
-                                       ifaref(&rt->rt_ifa);
-                                       ia6 = ifatoia6(rt->rt_ifa);
-                               }
-                       }
-                       if (ia6 == 0) {
-                               *errorp = EADDRNOTAVAIL;
-                               return(0);
-                       }
-                       *src_storage = satosin6(&ia6->ia_addr)->sin6_addr;
-                       ifaref(&rt->rt_ifa);
-                       return(src_storage);
-               }
-       }
-
-       /*
-        * If route is known or can be allocated now,
-        * our src addr is taken from the i/f, else punt.
-        */
-       if (ro) {
-               if (ro->ro_rt &&
-                   !IN6_ARE_ADDR_EQUAL(&satosin6(&ro->ro_dst)->sin6_addr, dst)) {
-                       rtfree(ro->ro_rt);
-                       ro->ro_rt = (struct rtentry *)0;
-               }
-               if (ro->ro_rt == (struct rtentry *)0 ||
-                   ro->ro_rt->rt_ifp == (struct ifnet *)0) {
-                       struct sockaddr_in6 *dst6;
-
-                       /* No route yet, so try to acquire one */
-                       bzero(&ro->ro_dst, sizeof(struct sockaddr_in6));
-                       dst6 = (struct sockaddr_in6 *)&ro->ro_dst;
-                       dst6->sin6_family = AF_INET6;
-                       dst6->sin6_len = sizeof(struct sockaddr_in6);
-                       dst6->sin6_addr = *dst;
-                       if (IN6_IS_ADDR_MULTICAST(dst)) {
-                               ro->ro_rt =
-                                   rtalloc1(&((struct route *)ro)->ro_dst, 0, 0UL);
-                       } else {
-                               rtalloc((struct route *)ro);
-                       }
-               }
-
-               /*
-                * in_pcbconnect() checks out IFF_LOOPBACK to skip using
-                * the address. But we don't know why it does so.
-                * It is necessary to ensure the scope even for lo0
-                * so doesn't check out IFF_LOOPBACK.
-                */
-
-               if (ro->ro_rt) {
-                       ia6 = in6_ifawithscope(ro->ro_rt->rt_ifa->ifa_ifp, dst);
-                       if (ia6 == 0) { /* xxx scope error ?*/
-                               ifaref(ro->ro_rt->rt_ifa);
-                               ia6 = ifatoia6(ro->ro_rt->rt_ifa);
-                       }
-               }
-               if (ia6 == 0) {
-                       *errorp = EHOSTUNREACH; /* no route */
-                       return(0);
-               }
-               *src_storage = satosin6(&ia6->ia_addr)->sin6_addr;
-               ifaref(&rt->rt_ifa);
-               return(src_storage);
-       }
-
-       *errorp = EADDRNOTAVAIL;
-       return(0);
-}
-
-/*
- * Default hop limit selection. The precedence is as follows:
- * 1. Hoplimit valued specified via ioctl.
- * 2. (If the outgoing interface is detected) the current
- *     hop limit of the interface specified by router advertisement.
- * 3. The system default hoplimit.
-*/
-int
-in6_selecthlim(
-       struct in6pcb *in6p,
-       struct ifnet *ifp)
-{
-       if (in6p && in6p->in6p_hops >= 0)
-               return(in6p->in6p_hops);
-       else if (ifp)
-               return(nd_ifinfo[ifp->if_index].chlim);
-       else
-               return(ip6_defhlim);
-}
-#endif
-
 void
 void
-in6_pcbdisconnect(inp)
-       struct inpcb *inp;
+in6_pcbdisconnect(
+       struct inpcb *inp)
 {
        if (!lck_rw_try_lock_exclusive(inp->inp_pcbinfo->mtx)) {
                /*lock inversion issue, mostly with udp multicast packets */
 {
        if (!lck_rw_try_lock_exclusive(inp->inp_pcbinfo->mtx)) {
                /*lock inversion issue, mostly with udp multicast packets */
@@ -733,8 +533,8 @@ in6_pcbdisconnect(inp)
 }
 
 void
 }
 
 void
-in6_pcbdetach(inp)
-       struct inpcb *inp;
+in6_pcbdetach(
+       struct inpcb *inp)
 {
        struct socket *so = inp->inp_socket;
        struct inpcbinfo *ipi = inp->inp_pcbinfo;
 {
        struct socket *so = inp->inp_socket;
        struct inpcbinfo *ipi = inp->inp_pcbinfo;
@@ -751,13 +551,15 @@ in6_pcbdetach(inp)
        inp->inp_state = INPCB_STATE_DEAD;
 
        if ((so->so_flags & SOF_PCBCLEARING) == 0) {
        inp->inp_state = INPCB_STATE_DEAD;
 
        if ((so->so_flags & SOF_PCBCLEARING) == 0) {
+               struct ip_moptions *imo;
+               struct ip6_moptions *im6o;
+
                inp->inp_vflag = 0;
                so->so_flags |= SOF_PCBCLEARING;
                inp->inp_gencnt = ++ipi->ipi_gencnt;
                if (inp->in6p_options)
                        m_freem(inp->in6p_options);
                ip6_freepcbopts(inp->in6p_outputopts);
                inp->inp_vflag = 0;
                so->so_flags |= SOF_PCBCLEARING;
                inp->inp_gencnt = ++ipi->ipi_gencnt;
                if (inp->in6p_options)
                        m_freem(inp->in6p_options);
                ip6_freepcbopts(inp->in6p_outputopts);
-               ip6_freemoptions(inp->in6p_moptions);
                if (inp->in6p_route.ro_rt) {
                        rtfree(inp->in6p_route.ro_rt);
                        inp->in6p_route.ro_rt = NULL;
                if (inp->in6p_route.ro_rt) {
                        rtfree(inp->in6p_route.ro_rt);
                        inp->in6p_route.ro_rt = NULL;
@@ -765,20 +567,29 @@ in6_pcbdetach(inp)
                /* Check and free IPv4 related resources in case of mapped addr */
                if (inp->inp_options)
                        (void)m_free(inp->inp_options);
                /* Check and free IPv4 related resources in case of mapped addr */
                if (inp->inp_options)
                        (void)m_free(inp->inp_options);
-               ip_freemoptions(inp->inp_moptions);
+
+               im6o = inp->in6p_moptions;
+               inp->in6p_moptions = NULL;
+               if (im6o != NULL)
+                       IM6O_REMREF(im6o);
+
+               imo = inp->inp_moptions;
                inp->inp_moptions = NULL;
                inp->inp_moptions = NULL;
-       
+               if (imo != NULL)
+                       IMO_REMREF(imo);
        }
 }
 
 struct sockaddr *
        }
 }
 
 struct sockaddr *
-in6_sockaddr(port, addr_p)
-       in_port_t port;
-       struct in6_addr *addr_p;
+in6_sockaddr(
+       in_port_t port,
+       struct in6_addr *addr_p)
 {
        struct sockaddr_in6 *sin6;
 
        MALLOC(sin6, struct sockaddr_in6 *, sizeof *sin6, M_SONAME, M_WAITOK);
 {
        struct sockaddr_in6 *sin6;
 
        MALLOC(sin6, struct sockaddr_in6 *, sizeof *sin6, M_SONAME, M_WAITOK);
+       if (sin6 == NULL)
+               return NULL;
        bzero(sin6, sizeof *sin6);
        sin6->sin6_family = AF_INET6;
        sin6->sin6_len = sizeof(*sin6);
        bzero(sin6, sizeof *sin6);
        sin6->sin6_family = AF_INET6;
        sin6->sin6_len = sizeof(*sin6);
@@ -795,9 +606,9 @@ in6_sockaddr(port, addr_p)
 }
 
 struct sockaddr *
 }
 
 struct sockaddr *
-in6_v4mapsin6_sockaddr(port, addr_p)
-       in_port_t port;
-       struct in_addr *addr_p;
+in6_v4mapsin6_sockaddr(
+       in_port_t port,
+       struct in_addr *addr_p)
 {
        struct sockaddr_in sin;
        struct sockaddr_in6 *sin6_p;
 {
        struct sockaddr_in sin;
        struct sockaddr_in6 *sin6_p;
@@ -810,6 +621,8 @@ in6_v4mapsin6_sockaddr(port, addr_p)
 
        MALLOC(sin6_p, struct sockaddr_in6 *, sizeof *sin6_p, M_SONAME,
                M_WAITOK);
 
        MALLOC(sin6_p, struct sockaddr_in6 *, sizeof *sin6_p, M_SONAME,
                M_WAITOK);
+       if (sin6_p == NULL)
+               return NULL;
        in6_sin_2_v4mapsin6(&sin, sin6_p);
 
        return (struct sockaddr *)sin6_p;
        in6_sin_2_v4mapsin6(&sin, sin6_p);
 
        return (struct sockaddr *)sin6_p;
@@ -826,9 +639,9 @@ in6_v4mapsin6_sockaddr(port, addr_p)
  * because there actually /is/ a programming error somewhere... XXX)
  */
 int
  * because there actually /is/ a programming error somewhere... XXX)
  */
 int
-in6_setsockaddr(so, nam)
-       struct socket *so;
-       struct sockaddr **nam;
+in6_setsockaddr(
+       struct socket *so,
+       struct sockaddr **nam)
 {
        struct inpcb *inp;
        struct in6_addr addr;
 {
        struct inpcb *inp;
        struct in6_addr addr;
@@ -842,13 +655,15 @@ in6_setsockaddr(so, nam)
        addr = inp->in6p_laddr;
 
        *nam = in6_sockaddr(port, &addr);
        addr = inp->in6p_laddr;
 
        *nam = in6_sockaddr(port, &addr);
+       if (*nam == NULL)
+               return ENOBUFS;
        return 0;
 }
 
 int
        return 0;
 }
 
 int
-in6_setpeeraddr(so, nam)
-       struct socket *so;
-       struct sockaddr **nam;
+in6_setpeeraddr(
+       struct socket *so,
+       struct sockaddr **nam)
 {
        struct inpcb *inp;
        struct in6_addr addr;
 {
        struct inpcb *inp;
        struct in6_addr addr;
@@ -862,6 +677,8 @@ in6_setpeeraddr(so, nam)
        addr = inp->in6p_faddr;
 
        *nam = in6_sockaddr(port, &addr);
        addr = inp->in6p_faddr;
 
        *nam = in6_sockaddr(port, &addr);
+       if (*nam == NULL)
+               return ENOBUFS;
        return 0;
 }
 
        return 0;
 }
 
@@ -876,11 +693,11 @@ in6_mapped_sockaddr(struct socket *so, struct sockaddr **nam)
        if (inp->inp_vflag & INP_IPV4) {
                error = in_setsockaddr(so, nam);
                if (error == 0)
        if (inp->inp_vflag & INP_IPV4) {
                error = in_setsockaddr(so, nam);
                if (error == 0)
-                       in6_sin_2_v4mapsin6_in_sock(nam);
-       } else
-       /* scope issues will be handled in in6_setsockaddr(). */
-       error = in6_setsockaddr(so, nam);
-
+                       error = in6_sin_2_v4mapsin6_in_sock(nam);
+       } else {
+               /* scope issues will be handled in in6_setsockaddr(). */
+               error = in6_setsockaddr(so, nam);
+       }
        return error;
 }
 
        return error;
 }
 
@@ -895,11 +712,11 @@ in6_mapped_peeraddr(struct socket *so, struct sockaddr **nam)
        if (inp->inp_vflag & INP_IPV4) {
                error = in_setpeeraddr(so, nam);
                if (error == 0)
        if (inp->inp_vflag & INP_IPV4) {
                error = in_setpeeraddr(so, nam);
                if (error == 0)
-                       in6_sin_2_v4mapsin6_in_sock(nam);
-       } else
-       /* scope issues will be handled in in6_setpeeraddr(). */
-       error = in6_setpeeraddr(so, nam);
-
+                       error = in6_sin_2_v4mapsin6_in_sock(nam);
+       } else {
+               /* scope issues will be handled in in6_setpeeraddr(). */
+               error = in6_setpeeraddr(so, nam);
+       }
        return error;
 }
 
        return error;
 }
 
@@ -911,17 +728,15 @@ in6_mapped_peeraddr(struct socket *so, struct sockaddr **nam)
  * cmds that are uninteresting (e.g., no error in the map).
  * Call the protocol specific routine (if any) to report
  * any errors for each matching socket.
  * cmds that are uninteresting (e.g., no error in the map).
  * Call the protocol specific routine (if any) to report
  * any errors for each matching socket.
- *
- * Must be called at splnet.
  */
 void
  */
 void
-in6_pcbnotify(pcbinfo, dst, fport_arg, src, lport_arg, cmd, notify)
+in6_pcbnotify(pcbinfo, dst, fport_arg, src, lport_arg, cmd, cmdarg, notify)
        struct inpcbinfo *pcbinfo;
        struct sockaddr *dst;
        const struct sockaddr *src;
        u_int fport_arg, lport_arg;
        int cmd;
        struct inpcbinfo *pcbinfo;
        struct sockaddr *dst;
        const struct sockaddr *src;
        u_int fport_arg, lport_arg;
        int cmd;
-//     struct inpcb *(*notify)(struct inpcb *, int);
+       void *cmdarg;
        void (*notify)(struct inpcb *, int);
 {
        struct inpcb *inp, *ninp;
        void (*notify)(struct inpcb *, int);
 {
        struct inpcb *inp, *ninp;
@@ -968,6 +783,22 @@ in6_pcbnotify(pcbinfo, dst, fport_arg, src, lport_arg, cmd, notify)
                if ((inp->inp_vflag & INP_IPV6) == 0)
                        continue;
 
                if ((inp->inp_vflag & INP_IPV6) == 0)
                        continue;
 
+               /*
+                * If the error designates a new path MTU for a destination
+                * and the application (associated with this socket) wanted to
+                * know the value, notify. Note that we notify for all
+                * disconnected sockets if the corresponding application
+                * wanted. This is because some UDP applications keep sending
+                * sockets disconnected.
+                * XXX: should we avoid to notify the value to TCP sockets?
+                */
+               if (cmd == PRC_MSGSIZE && (inp->inp_flags & IN6P_MTU) != 0 &&
+                   (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) ||
+                    IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr, &sa6_dst->sin6_addr))) {
+                       ip6_notify_pmtu(inp, (struct sockaddr_in6 *)dst,
+                                       (u_int32_t *)cmdarg);
+               }
+
                /*
                 * Detect if we should notify the error. If no source and
                 * destination ports are specifed, but non-zero flowinfo and
                /*
                 * Detect if we should notify the error. If no source and
                 * destination ports are specifed, but non-zero flowinfo and
@@ -1009,11 +840,11 @@ in6_pcbnotify(pcbinfo, dst, fport_arg, src, lport_arg, cmd, notify)
  * Lookup a PCB based on the local address and port.
  */
 struct inpcb *
  * Lookup a PCB based on the local address and port.
  */
 struct inpcb *
-in6_pcblookup_local(pcbinfo, laddr, lport_arg, wild_okay)
-       struct inpcbinfo *pcbinfo;
-       struct in6_addr *laddr;
-       u_int lport_arg;
-       int wild_okay;
+in6_pcblookup_local(
+       struct inpcbinfo *pcbinfo,
+       struct in6_addr *laddr,
+       u_int lport_arg,
+       int wild_okay)
 {
        struct inpcb *inp;
        int matchwild = 3, wildcard;
 {
        struct inpcb *inp;
        int matchwild = 3, wildcard;
@@ -1093,47 +924,6 @@ in6_pcblookup_local(pcbinfo, laddr, lport_arg, wild_okay)
                return (match);
        }
 }
                return (match);
        }
 }
-#ifndef APPLE
-/* this is not used in Darwin */
-void
-in6_pcbpurgeif0(
-       struct in6pcb *head,
-       struct ifnet *ifp)
-{
-       struct in6pcb *in6p;
-       struct ip6_moptions *im6o;
-       struct in6_multi_mship *imm, *nimm;
-
-       for (in6p = head; in6p != NULL; in6p = LIST_NEXT(in6p, inp_list)) {
-               im6o = in6p->in6p_moptions;
-               if ((in6p->inp_vflag & INP_IPV6) &&
-                   im6o) {
-                       /*
-                        * Unselect the outgoing interface if it is being
-                        * detached.
-                        */
-                       if (im6o->im6o_multicast_ifp == ifp)
-                               im6o->im6o_multicast_ifp = NULL;
-
-                       /*
-                        * Drop multicast group membership if we joined
-                        * through the interface being detached.
-                        * XXX controversial - is it really legal for kernel
-                        * to force this?
-                        */
-                       for (imm = im6o->im6o_memberships.lh_first;
-                            imm != NULL; imm = nimm) {
-                               nimm = imm->i6mm_chain.le_next;
-                               if (imm->i6mm_maddr->in6m_ifp == ifp) {
-                                       LIST_REMOVE(imm, i6mm_chain);
-                                       in6_delmulti(imm->i6mm_maddr);
-                                       FREE(imm, M_IPMADDR);
-                               }
-                       }
-               }
-       }
-}
-#endif
 
 /*
  * Check for alternatives when higher level complains
 
 /*
  * Check for alternatives when higher level complains
@@ -1142,32 +932,39 @@ in6_pcbpurgeif0(
  * (by a redirect), time to try a default gateway again.
  */
 void
  * (by a redirect), time to try a default gateway again.
  */
 void
-in6_losing(in6p)
-       struct inpcb *in6p;
+in6_losing(
+       struct inpcb *in6p)
 {
        struct rtentry *rt;
        struct rt_addrinfo info;
 
        if ((rt = in6p->in6p_route.ro_rt) != NULL) {
 {
        struct rtentry *rt;
        struct rt_addrinfo info;
 
        if ((rt = in6p->in6p_route.ro_rt) != NULL) {
-               in6p->in6p_route.ro_rt = 0;
+               in6p->in6p_route.ro_rt = NULL;
+               RT_LOCK(rt);
                bzero((caddr_t)&info, sizeof(info));
                info.rti_info[RTAX_DST] =
                        (struct sockaddr *)&in6p->in6p_route.ro_dst;
                info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
                info.rti_info[RTAX_NETMASK] = rt_mask(rt);
                bzero((caddr_t)&info, sizeof(info));
                info.rti_info[RTAX_DST] =
                        (struct sockaddr *)&in6p->in6p_route.ro_dst;
                info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
                info.rti_info[RTAX_NETMASK] = rt_mask(rt);
-               lck_mtx_lock(rt_mtx);
                rt_missmsg(RTM_LOSING, &info, rt->rt_flags, 0);
                rt_missmsg(RTM_LOSING, &info, rt->rt_flags, 0);
-               if (rt->rt_flags & RTF_DYNAMIC)
-                       (void)rtrequest_locked(RTM_DELETE, rt_key(rt),
-                                       rt->rt_gateway, rt_mask(rt), rt->rt_flags,
-                                       (struct rtentry **)0);
-               else
+               if (rt->rt_flags & RTF_DYNAMIC) {
+                       /*
+                        * Prevent another thread from modifying rt_key,
+                        * rt_gateway via rt_setgate() after the rt_lock
+                        * is dropped by marking the route as defunct.
+                        */
+                       rt->rt_flags |= RTF_CONDEMNED;
+                       RT_UNLOCK(rt);
+                       (void) rtrequest(RTM_DELETE, rt_key(rt),
+                           rt->rt_gateway, rt_mask(rt), rt->rt_flags, NULL);
+               } else {
+                       RT_UNLOCK(rt);
+               }
                /*
                 * A new route can be allocated
                 * the next time output is attempted.
                 */
                /*
                 * A new route can be allocated
                 * the next time output is attempted.
                 */
-                       rtfree_locked(rt);
-               lck_mtx_unlock(rt_mtx);
+               rtfree(rt);
        }
 }
 
        }
 }
 
@@ -1190,6 +987,104 @@ in6_rtchange(
        }
 }
 
        }
 }
 
+/*
+ * Check if PCB exists hash list. Also returns uid and gid of socket
+ */
+int
+in6_pcblookup_hash_exists(
+       struct inpcbinfo *pcbinfo,
+       struct in6_addr *faddr,
+       u_int fport_arg,
+       struct in6_addr *laddr,
+       u_int lport_arg,
+       int wildcard,
+       uid_t *uid,
+       gid_t *gid,
+       __unused struct ifnet *ifp)
+{
+       struct inpcbhead *head;
+       struct inpcb *inp;
+       u_short fport = fport_arg, lport = lport_arg;
+       int faith;
+       int found;
+
+#if defined(NFAITH) && NFAITH > 0
+       faith = faithprefix(laddr);
+#else
+       faith = 0;
+#endif
+
+       *uid = UID_MAX;
+       *gid = GID_MAX;
+
+       lck_rw_lock_shared(pcbinfo->mtx);
+
+       /*
+        * First look for an exact match.
+        */
+       head = &pcbinfo->hashbase[INP_PCBHASH(faddr->s6_addr32[3] /* XXX */,
+                                             lport, fport,
+                                             pcbinfo->hashmask)];
+       LIST_FOREACH(inp, head, inp_hash) {
+               if ((inp->inp_vflag & INP_IPV6) == 0)
+                       continue;
+               if (IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr, faddr) &&
+                   IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr) &&
+                   inp->inp_fport == fport &&
+                   inp->inp_lport == lport) {
+                       if ((found = (inp->inp_socket != NULL))) {
+                               /*
+                                * Found. Check if pcb is still valid
+                                */
+                               *uid = inp->inp_socket->so_uid;
+                               *gid = inp->inp_socket->so_gid;
+                       }
+                       lck_rw_done(pcbinfo->mtx);
+                       return (found);
+               }
+       }
+       if (wildcard) {
+               struct inpcb *local_wild = NULL;
+
+               head = &pcbinfo->hashbase[INP_PCBHASH(INADDR_ANY, lport, 0,
+                                                     pcbinfo->hashmask)];
+               LIST_FOREACH(inp, head, inp_hash) {
+                       if ((inp->inp_vflag & INP_IPV6) == 0)
+                               continue;
+                       if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) &&
+                           inp->inp_lport == lport) {
+                               if (faith && (inp->inp_flags & INP_FAITH) == 0)
+                                       continue;
+                               if (IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr,
+                                                      laddr)) {
+                                       if ((found = (inp->inp_socket != NULL))) {
+                                               *uid = inp->inp_socket->so_uid;
+                                               *gid = inp->inp_socket->so_gid;
+                                       }
+                                       lck_rw_done(pcbinfo->mtx);
+                                       return (found);
+                               }
+                               else if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr))
+                                       local_wild = inp;
+                       }
+               }
+               if (local_wild) {
+                       if ((found = (local_wild->inp_socket != NULL))) {
+                               *uid = local_wild->inp_socket->so_uid;
+                               *gid = local_wild->inp_socket->so_gid;
+                       }
+                       lck_rw_done(pcbinfo->mtx);
+                       return (found);
+               }
+       }
+
+       /*
+        * Not found.
+        */
+       lck_rw_done(pcbinfo->mtx);
+       return (0);
+}
+
 /*
  * Lookup PCB in hash list.
  */
 /*
  * Lookup PCB in hash list.
  */