X-Git-Url: https://git.saurik.com/apple/xnu.git/blobdiff_plain/c910b4d9d2451126ae3917b931cd4390c11e1d52..6d2010ae8f7a6078e10b361c6962983bab233e0f:/bsd/netinet6/in6_pcb.c?ds=sidebyside

diff --git a/bsd/netinet6/in6_pcb.c b/bsd/netinet6/in6_pcb.c
index 1b481b21f..2ea4d7a5d 100644
--- a/bsd/netinet6/in6_pcb.c
+++ b/bsd/netinet6/in6_pcb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2003-2007 Apple Inc. All rights reserved.
+ * Copyright (c) 2003-2011 Apple Inc. All rights reserved.
  *
  * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
  * 
@@ -102,6 +102,8 @@
 #include <sys/errno.h>
 #include <sys/time.h>
 #include <sys/proc.h>
+#include <sys/kauth.h>
+#include <sys/priv.h>
 
 #include <net/if.h>
 #include <net/if_types.h>
@@ -160,30 +162,32 @@ in6_pcblookup_local_and_cleanup(
 	if (inp && inp->inp_wantcnt == WNT_STOPUSING) {
 		struct socket *so = inp->inp_socket;
 		
-		lck_mtx_lock(inp->inpcb_mtx);
+		lck_mtx_lock(&inp->inpcb_mtx);
 		
 		if (so->so_usecount == 0) {
+			if (inp->inp_state != INPCB_STATE_DEAD)
+				in6_pcbdetach(inp);
 			in_pcbdispose(inp);
 			inp = NULL;
 		}
 		else {
-			lck_mtx_unlock(inp->inpcb_mtx);
+			lck_mtx_unlock(&inp->inpcb_mtx);
 		}
 	}
 	
 	return inp;
 }
+
 int
-in6_pcbbind(
-	struct inpcb *inp,
-	struct sockaddr *nam,
-	struct proc *p)
+in6_pcbbind(struct inpcb *inp, struct sockaddr *nam, struct proc *p)
 {
 	struct socket *so = inp->inp_socket;
 	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)NULL;
 	struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
 	u_short	lport = 0;
 	int wild = 0, reuseport = (so->so_options & SO_REUSEPORT);
+	int error;
+	kauth_cred_t cred;
 
 	if (!in6_ifaddrs) /* XXX broken! */
 		return (EADDRNOTAVAIL);
@@ -194,6 +198,8 @@ in6_pcbbind(
 	socket_unlock(so, 0); /* keep reference */
 	lck_rw_lock_exclusive(pcbinfo->mtx);
 	if (nam) {
+		unsigned int outif = 0;
+
 		sin6 = (struct sockaddr_in6 *)nam;
 		if (nam->sa_len != sizeof(*sin6)) {
 			lck_rw_done(pcbinfo->mtx);
@@ -210,7 +216,8 @@ in6_pcbbind(
 		}
 
 		/* KAME hack: embed scopeid */
-		if (in6_embedscope(&sin6->sin6_addr, sin6, inp, NULL) != 0) {
+		if (in6_embedscope(&sin6->sin6_addr, sin6, inp, NULL,
+		    NULL) != 0) {
 			lck_rw_done(pcbinfo->mtx);
 			socket_lock(so, 0);
 			return EINVAL;
@@ -230,10 +237,10 @@ in6_pcbbind(
 			if (so->so_options & SO_REUSEADDR)
 				reuseport = SO_REUSEADDR|SO_REUSEPORT;
 		} else if (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
-			struct ifaddr *ia = NULL;
+			struct ifaddr *ifa;
 
 			sin6->sin6_port = 0;		/* yech... */
-			if ((ia = ifa_ifwithaddr((struct sockaddr *)sin6)) == 0) {
+			if ((ifa = ifa_ifwithaddr((struct sockaddr *)sin6)) == 0) {
 				lck_rw_done(pcbinfo->mtx);
 				socket_lock(so, 0);
 				return(EADDRNOTAVAIL);
@@ -245,26 +252,34 @@ in6_pcbbind(
 			 * We should allow to bind to a deprecated address, since
 			 * the application dare to use it.
 			 */
-			if (ia &&
-			    ((struct in6_ifaddr *)ia)->ia6_flags &
-			    (IN6_IFF_ANYCAST|IN6_IFF_NOTREADY|IN6_IFF_DETACHED)) {
-			    	ifafree(ia);
-				lck_rw_done(pcbinfo->mtx);
-				socket_lock(so, 0);
-				return(EADDRNOTAVAIL);
+			if (ifa != NULL) {
+				IFA_LOCK_SPIN(ifa);
+				if (((struct in6_ifaddr *)ifa)->ia6_flags &
+				    (IN6_IFF_ANYCAST|IN6_IFF_NOTREADY|IN6_IFF_DETACHED)) {
+					IFA_UNLOCK(ifa);
+					IFA_REMREF(ifa);
+					lck_rw_done(pcbinfo->mtx);
+					socket_lock(so, 0);
+					return(EADDRNOTAVAIL);
+				}
+				outif = ifa->ifa_ifp->if_index;
+				IFA_UNLOCK(ifa);
+				IFA_REMREF(ifa);
 			}
-			ifafree(ia);
-			ia = NULL;
 		}
 		if (lport) {
 			struct inpcb *t;
 
 			/* GROSS */
-			if (ntohs(lport) < IPV6PORT_RESERVED && p &&
-                            ((so->so_state & SS_PRIV) == 0)) {
-				lck_rw_done(pcbinfo->mtx);
-				socket_lock(so, 0);
-				return(EACCES);
+			if (ntohs(lport) < IPV6PORT_RESERVED) {
+				cred = kauth_cred_proc_ref(p);
+				error = priv_check_cred(cred, PRIV_NETINET_RESERVEDPORT, 0);
+				kauth_cred_unref(&cred);
+				if (error != 0) {
+					lck_rw_done(pcbinfo->mtx);
+					socket_lock(so, 0);
+					return(EACCES);
+				}
 			}
 
 			if (so->so_uid &&
@@ -333,6 +348,7 @@ in6_pcbbind(
 			}
 		}
 		inp->in6p_laddr = sin6->sin6_addr;
+		inp->in6p_last_outif = outif;
 	}
 	socket_lock(so, 0);
 	if (lport == 0) {
@@ -347,10 +363,11 @@ in6_pcbbind(
 		if (in_pcbinshash(inp, 1) != 0) {
 			inp->in6p_laddr = in6addr_any;
 			inp->inp_lport = 0;
+			inp->in6p_last_outif = 0;
 			lck_rw_done(pcbinfo->mtx);
 			return (EAGAIN);
 		}
-	}	
+	}
 	lck_rw_done(pcbinfo->mtx);
 	sflt_notify(so, sock_evt_bound, NULL);
 	return(0);
@@ -369,17 +386,14 @@ in6_pcbbind(
  */
 
 int
-in6_pcbladdr(
-	struct inpcb *inp,
-	struct sockaddr *nam,
-	struct in6_addr *plocal_addr6)
+in6_pcbladdr(struct inpcb *inp, struct sockaddr *nam,
+    struct in6_addr *plocal_addr6, unsigned int *poutif)
 {
 	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)nam;
 	struct in6_addr *addr6 = NULL;
 	struct in6_addr src_storage;
-	
-	struct ifnet *ifp = NULL;
 	int error = 0;
+	unsigned int ifscope;
 
 	if (nam->sa_len != sizeof (*sin6))
 		return (EINVAL);
@@ -389,7 +403,7 @@ in6_pcbladdr(
 		return (EADDRNOTAVAIL);
 
 	/* KAME hack: embed scopeid */
-	if (in6_embedscope(&sin6->sin6_addr, sin6, inp, &ifp) != 0)
+	if (in6_embedscope(&sin6->sin6_addr, sin6, inp, NULL, NULL) != 0)
 		return EINVAL;
 
 	if (in6_ifaddrs) {
@@ -400,32 +414,37 @@ in6_pcbladdr(
 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 			sin6->sin6_addr = in6addr_loopback;
 	}
-	{
-		/*
-		 * XXX: in6_selectsrc might replace the bound local address
-		 * with the address specified by setsockopt(IPV6_PKTINFO).
-		 * Is it the intended behavior?
-		 */
-		addr6 = in6_selectsrc(sin6, inp->in6p_outputopts,
-					      inp->in6p_moptions,
-					      &inp->in6p_route,
-					      &inp->in6p_laddr, &src_storage, &error);
-		if (addr6 == 0) {
-			if (error == 0)
-				error = EADDRNOTAVAIL;
-			return(error);
-		}
-		*plocal_addr6 = *addr6;
-		/*
-		 * Don't do pcblookup call here; return interface in
-		 * plocal_addr6
-		 * and exit to caller, that will do the lookup.
-		 */
+
+	ifscope = (inp->inp_flags & INP_BOUND_IF) ?
+	   inp->inp_boundif : IFSCOPE_NONE;
+
+	/*
+	 * XXX: in6_selectsrc might replace the bound local address
+	 * with the address specified by setsockopt(IPV6_PKTINFO).
+	 * Is it the intended behavior?
+	 */
+	addr6 = in6_selectsrc(sin6, inp->in6p_outputopts, inp,
+	    &inp->in6p_route, NULL, &src_storage, ifscope, &error);
+	if (addr6 == 0) {
+		if (error == 0)
+			error = EADDRNOTAVAIL;
+		return(error);
 	}
 
-	if (inp->in6p_route.ro_rt)
-		ifp = inp->in6p_route.ro_rt->rt_ifp;
+	if (poutif != NULL) {
+		struct rtentry *rt;
+		if ((rt = inp->in6p_route.ro_rt) != NULL)
+			*poutif = rt->rt_ifp->if_index;
+		else
+			*poutif = 0;
+	}
 
+	*plocal_addr6 = *addr6;
+	/*
+	 * Don't do pcblookup call here; return interface in
+	 * plocal_addr6
+	 * and exit to caller, that will do the lookup.
+	 */
 	return(0);
 }
 
@@ -437,21 +456,22 @@ in6_pcbladdr(
  * then pick one.
  */
 int
-in6_pcbconnect(inp, nam, p)
-	struct inpcb *inp;
-	struct sockaddr *nam;
-	struct proc *p;
+in6_pcbconnect(
+	struct inpcb *inp,
+	struct sockaddr *nam,
+	struct proc *p)
 {
 	struct in6_addr addr6;
 	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)nam;
 	struct inpcb *pcb;
 	int error;
+	unsigned int outif = 0;
 
 	/*
 	 * Call inner routine, to assign local interface address.
 	 * in6_pcbladdr() may automatically fill in sin6_scope_id.
 	 */
-	if ((error = in6_pcbladdr(inp, nam, &addr6)) != 0)
+	if ((error = in6_pcbladdr(inp, nam, &addr6, &outif)) != 0)
 		return(error);
 	socket_unlock(inp->inp_socket, 0);
 	pcb = in6_pcblookup_hash(inp->inp_pcbinfo, &sin6->sin6_addr,
@@ -461,7 +481,7 @@ in6_pcbconnect(inp, nam, p)
 			      inp->inp_lport, 0, NULL);
 	socket_lock(inp->inp_socket, 0);
 	if (pcb != NULL) {
-		in_pcb_checkstate(pcb, WNT_RELEASE, 0);
+		in_pcb_checkstate(pcb, WNT_RELEASE, pcb == inp ? 1 : 0);
 		return (EADDRINUSE);
 	}
 	if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
@@ -471,6 +491,7 @@ in6_pcbconnect(inp, nam, p)
 				return (error);
 		}
 		inp->in6p_laddr = addr6;
+		inp->in6p_last_outif = outif;
 	}
 	if (!lck_rw_try_lock_exclusive(inp->inp_pcbinfo->mtx)) {
 		/*lock inversion issue, mostly with udp multicast packets */
@@ -491,230 +512,9 @@ in6_pcbconnect(inp, nam, p)
 	return (0);
 }
 
-#if 0
-/*
- * Return an IPv6 address, which is the most appropriate for given
- * destination and user specified options.
- * If necessary, this function lookups the routing table and return
- * an entry to the caller for later use.
- */
-struct in6_addr *
-in6_selectsrc(
-	struct sockaddr_in6 *dstsock,
-	struct ip6_pktopts *opts,
-	struct ip6_moptions *mopts,
-	struct route_in6 *ro,
-	struct in6_addr *laddr,
-	struct in6_addr *src_storage,
-	int *errorp)
-{
-	struct in6_addr *dst;
-	struct in6_ifaddr *ia6 = 0;
-	struct in6_pktinfo *pi = NULL;
-
-	dst = &dstsock->sin6_addr;
-	*errorp = 0;
-
-	/*
-	 * If the source address is explicitly specified by the caller,
-	 * use it.
-	 */
-	if (opts && (pi = opts->ip6po_pktinfo) &&
-	    !IN6_IS_ADDR_UNSPECIFIED(&pi->ipi6_addr))
-		return(&pi->ipi6_addr);
-
-	/*
-	 * If the source address is not specified but the socket(if any)
-	 * is already bound, use the bound address.
-	 */
-	if (laddr && !IN6_IS_ADDR_UNSPECIFIED(laddr))
-		return(laddr);
-
-	/*
-	 * If the caller doesn't specify the source address but
-	 * the outgoing interface, use an address associated with
-	 * the interface.
-	 */
-	if (pi && pi->ipi6_ifindex) {
-		/* XXX boundary check is assumed to be already done. */
-		ia6 = in6_ifawithscope(ifindex2ifnet[pi->ipi6_ifindex],
-				       dst);
-		if (ia6 == 0) {
-			*errorp = EADDRNOTAVAIL;
-			return(0);
-		}
-		*src_storage = satosin6(&ia6->ia_addr)->sin6_addr;
-		ifafree(&ia6->ia_ifa);
-		return(src_storage);
-	}
-
-	/*
-	 * If the destination address is a link-local unicast address or
-	 * a multicast address, and if the outgoing interface is specified
-	 * by the sin6_scope_id filed, use an address associated with the
-	 * interface.
-	 * XXX: We're now trying to define more specific semantics of
-	 *      sin6_scope_id field, so this part will be rewritten in
-	 *      the near future.
-	 */
-	if ((IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst)) &&
-	    dstsock->sin6_scope_id) {
-		/*
-		 * I'm not sure if boundary check for scope_id is done
-		 * somewhere...
-		 */
-		if (dstsock->sin6_scope_id < 0 ||
-		    if_index < dstsock->sin6_scope_id) {
-			*errorp = ENXIO; /* XXX: better error? */
-			return(0);
-		}
-		ia6 = in6_ifawithscope(ifindex2ifnet[dstsock->sin6_scope_id],
-				       dst);
-		if (ia6 == 0) {
-			*errorp = EADDRNOTAVAIL;
-			return(0);
-		}
-		*src_storage = satosin6(&ia6->ia_addr)->sin6_addr;
-		ifafree(&ia6->ia_ifa);
-		return(src_storage);
-	}
-
-	/*
-	 * If the destination address is a multicast address and
-	 * the outgoing interface for the address is specified
-	 * by the caller, use an address associated with the interface.
-	 * There is a sanity check here; if the destination has node-local
-	 * scope, the outgoing interfacde should be a loopback address.
-	 * Even if the outgoing interface is not specified, we also
-	 * choose a loopback interface as the outgoing interface.
-	 */
-	if (IN6_IS_ADDR_MULTICAST(dst)) {
-		struct ifnet *ifp = mopts ? mopts->im6o_multicast_ifp : NULL;
-
-		if (ifp == NULL && IN6_IS_ADDR_MC_NODELOCAL(dst)) {
-			ifp = lo_ifp;
-		}
-
-		if (ifp) {
-			ia6 = in6_ifawithscope(ifp, dst);
-			if (ia6 == 0) {
-				*errorp = EADDRNOTAVAIL;
-				return(0);
-			}
-			*src_storage = ia6->ia_addr.sin6_addr;
-			ifafree(&ia6->ia_ifa);
-			return(src_storage);
-		}
-	}
-
-	/*
-	 * If the next hop address for the packet is specified
-	 * by caller, use an address associated with the route
-	 * to the next hop.
-	 */
-	{
-		struct sockaddr_in6 *sin6_next;
-		struct rtentry *rt;
-
-		if (opts && opts->ip6po_nexthop) {
-			sin6_next = satosin6(opts->ip6po_nexthop);
-			rt = nd6_lookup(&sin6_next->sin6_addr, 1, NULL, 0);
-			if (rt) {
-				ia6 = in6_ifawithscope(rt->rt_ifp, dst);
-				if (ia6 == 0) {
-					ifaref(&rt->rt_ifa);
-					ia6 = ifatoia6(rt->rt_ifa);
-				}
-			}
-			if (ia6 == 0) {
-				*errorp = EADDRNOTAVAIL;
-				return(0);
-			}
-			*src_storage = satosin6(&ia6->ia_addr)->sin6_addr;
-			ifaref(&rt->rt_ifa);
-			return(src_storage);
-		}
-	}
-
-	/*
-	 * If route is known or can be allocated now,
-	 * our src addr is taken from the i/f, else punt.
-	 */
-	if (ro) {
-		if (ro->ro_rt &&
-		    !IN6_ARE_ADDR_EQUAL(&satosin6(&ro->ro_dst)->sin6_addr, dst)) {
-			rtfree(ro->ro_rt);
-			ro->ro_rt = (struct rtentry *)0;
-		}
-		if (ro->ro_rt == (struct rtentry *)0 ||
-		    ro->ro_rt->rt_ifp == (struct ifnet *)0) {
-			struct sockaddr_in6 *dst6;
-
-			/* No route yet, so try to acquire one */
-			bzero(&ro->ro_dst, sizeof(struct sockaddr_in6));
-			dst6 = (struct sockaddr_in6 *)&ro->ro_dst;
-			dst6->sin6_family = AF_INET6;
-			dst6->sin6_len = sizeof(struct sockaddr_in6);
-			dst6->sin6_addr = *dst;
-			if (IN6_IS_ADDR_MULTICAST(dst)) {
-				ro->ro_rt =
-				    rtalloc1(&((struct route *)ro)->ro_dst, 0, 0UL);
-			} else {
-				rtalloc((struct route *)ro);
-			}
-		}
-
-		/*
-		 * in_pcbconnect() checks out IFF_LOOPBACK to skip using
-		 * the address. But we don't know why it does so.
-		 * It is necessary to ensure the scope even for lo0
-		 * so doesn't check out IFF_LOOPBACK.
-		 */
-
-		if (ro->ro_rt) {
-			ia6 = in6_ifawithscope(ro->ro_rt->rt_ifa->ifa_ifp, dst);
-			if (ia6 == 0) { /* xxx scope error ?*/
-				ifaref(ro->ro_rt->rt_ifa);
-				ia6 = ifatoia6(ro->ro_rt->rt_ifa);
-			}
-		}
-		if (ia6 == 0) {
-			*errorp = EHOSTUNREACH;	/* no route */
-			return(0);
-		}
-		*src_storage = satosin6(&ia6->ia_addr)->sin6_addr;
-		ifaref(&rt->rt_ifa);
-		return(src_storage);
-	}
-
-	*errorp = EADDRNOTAVAIL;
-	return(0);
-}
-
-/*
- * Default hop limit selection. The precedence is as follows:
- * 1. Hoplimit valued specified via ioctl.
- * 2. (If the outgoing interface is detected) the current
- *     hop limit of the interface specified by router advertisement.
- * 3. The system default hoplimit.
-*/
-int
-in6_selecthlim(
-	struct in6pcb *in6p,
-	struct ifnet *ifp)
-{
-	if (in6p && in6p->in6p_hops >= 0)
-		return(in6p->in6p_hops);
-	else if (ifp)
-		return(nd_ifinfo[ifp->if_index].chlim);
-	else
-		return(ip6_defhlim);
-}
-#endif
-
 void
-in6_pcbdisconnect(inp)
-	struct inpcb *inp;
+in6_pcbdisconnect(
+	struct inpcb *inp)
 {
 	if (!lck_rw_try_lock_exclusive(inp->inp_pcbinfo->mtx)) {
 		/*lock inversion issue, mostly with udp multicast packets */
@@ -733,8 +533,8 @@ in6_pcbdisconnect(inp)
 }
 
 void
-in6_pcbdetach(inp)
-	struct inpcb *inp;
+in6_pcbdetach(
+	struct inpcb *inp)
 {
 	struct socket *so = inp->inp_socket;
 	struct inpcbinfo *ipi = inp->inp_pcbinfo;
@@ -751,13 +551,15 @@ in6_pcbdetach(inp)
 	inp->inp_state = INPCB_STATE_DEAD;
 
 	if ((so->so_flags & SOF_PCBCLEARING) == 0) {
+		struct ip_moptions *imo;
+		struct ip6_moptions *im6o;
+
 		inp->inp_vflag = 0;
 		so->so_flags |= SOF_PCBCLEARING;
 		inp->inp_gencnt = ++ipi->ipi_gencnt;
 		if (inp->in6p_options)
 			m_freem(inp->in6p_options);
  		ip6_freepcbopts(inp->in6p_outputopts);
- 		ip6_freemoptions(inp->in6p_moptions);
 		if (inp->in6p_route.ro_rt) {
 			rtfree(inp->in6p_route.ro_rt);
 			inp->in6p_route.ro_rt = NULL;
@@ -765,20 +567,29 @@ in6_pcbdetach(inp)
 		/* Check and free IPv4 related resources in case of mapped addr */
 		if (inp->inp_options)
 			(void)m_free(inp->inp_options);
- 		ip_freemoptions(inp->inp_moptions);
+
+		im6o = inp->in6p_moptions;
+		inp->in6p_moptions = NULL;
+		if (im6o != NULL)
+			IM6O_REMREF(im6o);
+
+		imo = inp->inp_moptions;
 		inp->inp_moptions = NULL;
-	
+		if (imo != NULL)
+			IMO_REMREF(imo);
 	}
 }
 
 struct sockaddr *
-in6_sockaddr(port, addr_p)
-	in_port_t port;
-	struct in6_addr *addr_p;
+in6_sockaddr(
+	in_port_t port,
+	struct in6_addr *addr_p)
 {
 	struct sockaddr_in6 *sin6;
 
 	MALLOC(sin6, struct sockaddr_in6 *, sizeof *sin6, M_SONAME, M_WAITOK);
+	if (sin6 == NULL)
+		return NULL;
 	bzero(sin6, sizeof *sin6);
 	sin6->sin6_family = AF_INET6;
 	sin6->sin6_len = sizeof(*sin6);
@@ -795,9 +606,9 @@ in6_sockaddr(port, addr_p)
 }
 
 struct sockaddr *
-in6_v4mapsin6_sockaddr(port, addr_p)
-	in_port_t port;
-	struct in_addr *addr_p;
+in6_v4mapsin6_sockaddr(
+	in_port_t port,
+	struct in_addr *addr_p)
 {
 	struct sockaddr_in sin;
 	struct sockaddr_in6 *sin6_p;
@@ -810,6 +621,8 @@ in6_v4mapsin6_sockaddr(port, addr_p)
 
 	MALLOC(sin6_p, struct sockaddr_in6 *, sizeof *sin6_p, M_SONAME,
 		M_WAITOK);
+	if (sin6_p == NULL)
+		return NULL;
 	in6_sin_2_v4mapsin6(&sin, sin6_p);
 
 	return (struct sockaddr *)sin6_p;
@@ -826,9 +639,9 @@ in6_v4mapsin6_sockaddr(port, addr_p)
  * because there actually /is/ a programming error somewhere... XXX)
  */
 int
-in6_setsockaddr(so, nam)
-	struct socket *so;
-	struct sockaddr **nam;
+in6_setsockaddr(
+	struct socket *so,
+	struct sockaddr **nam)
 {
 	struct inpcb *inp;
 	struct in6_addr addr;
@@ -842,13 +655,15 @@ in6_setsockaddr(so, nam)
 	addr = inp->in6p_laddr;
 
 	*nam = in6_sockaddr(port, &addr);
+	if (*nam == NULL)
+		return ENOBUFS;
 	return 0;
 }
 
 int
-in6_setpeeraddr(so, nam)
-	struct socket *so;
-	struct sockaddr **nam;
+in6_setpeeraddr(
+	struct socket *so,
+	struct sockaddr **nam)
 {
 	struct inpcb *inp;
 	struct in6_addr addr;
@@ -862,6 +677,8 @@ in6_setpeeraddr(so, nam)
 	addr = inp->in6p_faddr;
 
 	*nam = in6_sockaddr(port, &addr);
+	if (*nam == NULL)
+		return ENOBUFS;
 	return 0;
 }
 
@@ -876,11 +693,11 @@ in6_mapped_sockaddr(struct socket *so, struct sockaddr **nam)
 	if (inp->inp_vflag & INP_IPV4) {
 		error = in_setsockaddr(so, nam);
 		if (error == 0)
-			in6_sin_2_v4mapsin6_in_sock(nam);
-	} else
-	/* scope issues will be handled in in6_setsockaddr(). */
-	error = in6_setsockaddr(so, nam);
-
+			error = in6_sin_2_v4mapsin6_in_sock(nam);
+	} else {
+		/* scope issues will be handled in in6_setsockaddr(). */
+		error = in6_setsockaddr(so, nam);
+	}
 	return error;
 }
 
@@ -895,11 +712,11 @@ in6_mapped_peeraddr(struct socket *so, struct sockaddr **nam)
 	if (inp->inp_vflag & INP_IPV4) {
 		error = in_setpeeraddr(so, nam);
 		if (error == 0)
-			in6_sin_2_v4mapsin6_in_sock(nam);
-	} else
-	/* scope issues will be handled in in6_setpeeraddr(). */
-	error = in6_setpeeraddr(so, nam);
-
+			error = in6_sin_2_v4mapsin6_in_sock(nam);
+	} else {
+		/* scope issues will be handled in in6_setpeeraddr(). */
+		error = in6_setpeeraddr(so, nam);
+	}
 	return error;
 }
 
@@ -911,17 +728,15 @@ in6_mapped_peeraddr(struct socket *so, struct sockaddr **nam)
  * cmds that are uninteresting (e.g., no error in the map).
  * Call the protocol specific routine (if any) to report
  * any errors for each matching socket.
- *
- * Must be called at splnet.
  */
 void
-in6_pcbnotify(pcbinfo, dst, fport_arg, src, lport_arg, cmd, notify)
+in6_pcbnotify(pcbinfo, dst, fport_arg, src, lport_arg, cmd, cmdarg, notify)
 	struct inpcbinfo *pcbinfo;
 	struct sockaddr *dst;
 	const struct sockaddr *src;
 	u_int fport_arg, lport_arg;
 	int cmd;
-//	struct inpcb *(*notify)(struct inpcb *, int);
+	void *cmdarg;
 	void (*notify)(struct inpcb *, int);
 {
 	struct inpcb *inp, *ninp;
@@ -968,6 +783,22 @@ in6_pcbnotify(pcbinfo, dst, fport_arg, src, lport_arg, cmd, notify)
  		if ((inp->inp_vflag & INP_IPV6) == 0)
 			continue;
 
+		/*
+		 * If the error designates a new path MTU for a destination
+		 * and the application (associated with this socket) wanted to
+		 * know the value, notify. Note that we notify for all
+		 * disconnected sockets if the corresponding application
+		 * wanted. This is because some UDP applications keep sending
+		 * sockets disconnected.
+		 * XXX: should we avoid to notify the value to TCP sockets?
+		 */
+		if (cmd == PRC_MSGSIZE && (inp->inp_flags & IN6P_MTU) != 0 &&
+		    (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) ||
+		     IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr, &sa6_dst->sin6_addr))) {
+			ip6_notify_pmtu(inp, (struct sockaddr_in6 *)dst,
+					(u_int32_t *)cmdarg);
+		}
+
 		/*
 		 * Detect if we should notify the error. If no source and
 		 * destination ports are specifed, but non-zero flowinfo and
@@ -1009,11 +840,11 @@ in6_pcbnotify(pcbinfo, dst, fport_arg, src, lport_arg, cmd, notify)
  * Lookup a PCB based on the local address and port.
  */
 struct inpcb *
-in6_pcblookup_local(pcbinfo, laddr, lport_arg, wild_okay)
-	struct inpcbinfo *pcbinfo;
-	struct in6_addr *laddr;
-	u_int lport_arg;
-	int wild_okay;
+in6_pcblookup_local(
+	struct inpcbinfo *pcbinfo,
+	struct in6_addr *laddr,
+	u_int lport_arg,
+	int wild_okay)
 {
 	struct inpcb *inp;
 	int matchwild = 3, wildcard;
@@ -1093,47 +924,6 @@ in6_pcblookup_local(pcbinfo, laddr, lport_arg, wild_okay)
 		return (match);
 	}
 }
-#ifndef APPLE
-/* this is not used in Darwin */
-void
-in6_pcbpurgeif0(
-	struct in6pcb *head,
-	struct ifnet *ifp)
-{
-	struct in6pcb *in6p;
-	struct ip6_moptions *im6o;
-	struct in6_multi_mship *imm, *nimm;
-
-	for (in6p = head; in6p != NULL; in6p = LIST_NEXT(in6p, inp_list)) {
-		im6o = in6p->in6p_moptions;
-		if ((in6p->inp_vflag & INP_IPV6) &&
-		    im6o) {
-			/*
-			 * Unselect the outgoing interface if it is being
-			 * detached.
-			 */
-			if (im6o->im6o_multicast_ifp == ifp)
-				im6o->im6o_multicast_ifp = NULL;
-
-			/*
-			 * Drop multicast group membership if we joined
-			 * through the interface being detached.
-			 * XXX controversial - is it really legal for kernel
-			 * to force this?
-			 */
-			for (imm = im6o->im6o_memberships.lh_first;
-			     imm != NULL; imm = nimm) {
-				nimm = imm->i6mm_chain.le_next;
-				if (imm->i6mm_maddr->in6m_ifp == ifp) {
-					LIST_REMOVE(imm, i6mm_chain);
-					in6_delmulti(imm->i6mm_maddr);
-					FREE(imm, M_IPMADDR);
-				}
-			}
-		}
-	}
-}
-#endif
 
 /*
  * Check for alternatives when higher level complains
@@ -1142,32 +932,39 @@ in6_pcbpurgeif0(
  * (by a redirect), time to try a default gateway again.
  */
 void
-in6_losing(in6p)
-	struct inpcb *in6p;
+in6_losing(
+	struct inpcb *in6p)
 {
 	struct rtentry *rt;
 	struct rt_addrinfo info;
 
 	if ((rt = in6p->in6p_route.ro_rt) != NULL) {
-		in6p->in6p_route.ro_rt = 0;
+		in6p->in6p_route.ro_rt = NULL;
+		RT_LOCK(rt);
 		bzero((caddr_t)&info, sizeof(info));
 		info.rti_info[RTAX_DST] =
 			(struct sockaddr *)&in6p->in6p_route.ro_dst;
 		info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
 		info.rti_info[RTAX_NETMASK] = rt_mask(rt);
-		lck_mtx_lock(rt_mtx);
 		rt_missmsg(RTM_LOSING, &info, rt->rt_flags, 0);
-		if (rt->rt_flags & RTF_DYNAMIC)
-			(void)rtrequest_locked(RTM_DELETE, rt_key(rt),
-					rt->rt_gateway, rt_mask(rt), rt->rt_flags,
-					(struct rtentry **)0);
-		else
+		if (rt->rt_flags & RTF_DYNAMIC) {
+			/*
+			 * Prevent another thread from modifying rt_key,
+			 * rt_gateway via rt_setgate() after the rt_lock
+			 * is dropped by marking the route as defunct.
+			 */
+			rt->rt_flags |= RTF_CONDEMNED;
+			RT_UNLOCK(rt);
+			(void) rtrequest(RTM_DELETE, rt_key(rt),
+			    rt->rt_gateway, rt_mask(rt), rt->rt_flags, NULL);
+		} else {
+			RT_UNLOCK(rt);
+		}
 		/*
 		 * A new route can be allocated
 		 * the next time output is attempted.
 		 */
-			rtfree_locked(rt);
-		lck_mtx_unlock(rt_mtx);
+		rtfree(rt);
 	}
 }
 
@@ -1190,6 +987,104 @@ in6_rtchange(
 	}
 }
 
+/*
+ * Check if PCB exists hash list. Also returns uid and gid of socket
+ */
+int
+in6_pcblookup_hash_exists(
+	struct inpcbinfo *pcbinfo,
+	struct in6_addr *faddr,
+	u_int fport_arg,
+	struct in6_addr *laddr,
+	u_int lport_arg,
+	int wildcard,
+	uid_t *uid,
+	gid_t *gid,
+	__unused struct ifnet *ifp)
+{
+	struct inpcbhead *head;
+	struct inpcb *inp;
+	u_short fport = fport_arg, lport = lport_arg;
+	int faith;
+	int found;
+
+#if defined(NFAITH) && NFAITH > 0
+	faith = faithprefix(laddr);
+#else
+	faith = 0;
+#endif
+
+	*uid = UID_MAX;
+	*gid = GID_MAX;
+
+	lck_rw_lock_shared(pcbinfo->mtx);
+
+	/*
+	 * First look for an exact match.
+	 */
+	head = &pcbinfo->hashbase[INP_PCBHASH(faddr->s6_addr32[3] /* XXX */,
+					      lport, fport,
+					      pcbinfo->hashmask)];
+	LIST_FOREACH(inp, head, inp_hash) {
+		if ((inp->inp_vflag & INP_IPV6) == 0)
+			continue;
+		if (IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr, faddr) &&
+		    IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr) &&
+		    inp->inp_fport == fport &&
+		    inp->inp_lport == lport) {
+			if ((found = (inp->inp_socket != NULL))) {
+				/*
+				 * Found. Check if pcb is still valid
+				 */
+				*uid = inp->inp_socket->so_uid;
+				*gid = inp->inp_socket->so_gid;
+			}
+			lck_rw_done(pcbinfo->mtx);
+			return (found);
+		}
+	}
+	if (wildcard) {
+		struct inpcb *local_wild = NULL;
+
+		head = &pcbinfo->hashbase[INP_PCBHASH(INADDR_ANY, lport, 0,
+						      pcbinfo->hashmask)];
+		LIST_FOREACH(inp, head, inp_hash) {
+			if ((inp->inp_vflag & INP_IPV6) == 0)
+				continue;
+			if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) &&
+			    inp->inp_lport == lport) {
+				if (faith && (inp->inp_flags & INP_FAITH) == 0)
+					continue;
+				if (IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr,
+						       laddr)) {
+					if ((found = (inp->inp_socket != NULL))) {
+						*uid = inp->inp_socket->so_uid;
+						*gid = inp->inp_socket->so_gid;
+					}
+					lck_rw_done(pcbinfo->mtx);
+					return (found);
+				}
+				else if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr))
+					local_wild = inp;
+			}
+		}
+		if (local_wild) {
+			if ((found = (local_wild->inp_socket != NULL))) {
+				*uid = local_wild->inp_socket->so_uid;
+				*gid = local_wild->inp_socket->so_gid;
+			}
+			lck_rw_done(pcbinfo->mtx);
+			return (found);
+		}
+	}
+
+	/*
+	 * Not found.
+	 */
+	lck_rw_done(pcbinfo->mtx);
+	return (0);
+}
+
 /*
  * Lookup PCB in hash list.
  */