1/*
2 * Copyright (c) 2003-2017 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/*
29 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
30 * All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. Neither the name of the project nor the names of its contributors
41 * may be used to endorse or promote products derived from this software
42 * without specific prior written permission.
43 *
44 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
45 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
46 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
47 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
48 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
49 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
50 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
51 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
52 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
53 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
54 * SUCH DAMAGE.
55 *
56 */
57
58/*
59 * Copyright (c) 1982, 1986, 1991, 1993
60 * The Regents of the University of California. All rights reserved.
61 *
62 * Redistribution and use in source and binary forms, with or without
63 * modification, are permitted provided that the following conditions
64 * are met:
65 * 1. Redistributions of source code must retain the above copyright
66 * notice, this list of conditions and the following disclaimer.
67 * 2. Redistributions in binary form must reproduce the above copyright
68 * notice, this list of conditions and the following disclaimer in the
69 * documentation and/or other materials provided with the distribution.
70 * 3. All advertising materials mentioning features or use of this software
71 * must display the following acknowledgement:
72 * This product includes software developed by the University of
73 * California, Berkeley and its contributors.
74 * 4. Neither the name of the University nor the names of its contributors
75 * may be used to endorse or promote products derived from this software
76 * without specific prior written permission.
77 *
78 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
79 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
80 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
81 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
82 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
83 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
84 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
85 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
86 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
87 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
88 * SUCH DAMAGE.
89 *
90 * @(#)in_pcb.c 8.2 (Berkeley) 1/4/94
91 */
92
93#include <sys/param.h>
94#include <sys/systm.h>
95#include <sys/malloc.h>
96#include <sys/mbuf.h>
97#include <sys/domain.h>
98#include <sys/protosw.h>
99#include <sys/socket.h>
100#include <sys/socketvar.h>
101#include <sys/sockio.h>
102#include <sys/errno.h>
103#include <sys/time.h>
104#include <sys/proc.h>
105#include <sys/kauth.h>
106#include <sys/priv.h>
107
108#include <net/if.h>
109#include <net/if_types.h>
110#include <net/route.h>
111#include <net/ntstat.h>
112
113#include <netinet/in.h>
114#include <netinet/in_var.h>
115#include <netinet/in_systm.h>
116#include <netinet/ip6.h>
117#include <netinet/ip_var.h>
118#include <netinet6/ip6_var.h>
119#include <netinet6/nd6.h>
120#include <netinet/in_pcb.h>
121#include <netinet6/in6_pcb.h>
122#include <net/if_types.h>
123#include <net/if_var.h>
124
125#include <kern/kern_types.h>
126#include <kern/zalloc.h>
127
128#if IPSEC
129#include <netinet6/ipsec.h>
130#if INET6
131#include <netinet6/ipsec6.h>
132#endif
133#include <netinet6/ah.h>
134#if INET6
135#include <netinet6/ah6.h>
136#endif
137#include <netkey/key.h>
138#endif /* IPSEC */
139
140#if NECP
141#include <net/necp.h>
142#endif /* NECP */
143
144/*
145 * in6_pcblookup_local_and_cleanup does everything
146 * in6_pcblookup_local does but it checks for a socket
147 * that's going away. Since we know that the lock is
148 * held read+write when this function is called, we
149 * can safely dispose of this socket like the slow
150 * timer would usually do and return NULL. This is
151 * great for bind.
152 */
153static struct inpcb *
154in6_pcblookup_local_and_cleanup(struct inpcbinfo *pcbinfo,
155 struct in6_addr *laddr, u_int lport_arg, int wild_okay)
156{
157 struct inpcb *inp;
158
159 /* Perform normal lookup */
160 inp = in6_pcblookup_local(pcbinfo, laddr, lport_arg, wild_okay);
161
162 /* Check if we found a match but it's waiting to be disposed */
163 if (inp != NULL && inp->inp_wantcnt == WNT_STOPUSING) {
164 struct socket *so = inp->inp_socket;
165
166 socket_lock(so, 0);
167
168 if (so->so_usecount == 0) {
169 if (inp->inp_state != INPCB_STATE_DEAD)
170 in6_pcbdetach(inp);
171 in_pcbdispose(inp); /* will unlock & destroy */
172 inp = NULL;
173 } else {
174 socket_unlock(so, 0);
175 }
176 }
177
178 return (inp);
179}
180
181/*
182 * Bind an INPCB to an address and/or port. This routine should not alter
183 * the caller-supplied local address "nam".
184 */
185int
186in6_pcbbind(struct inpcb *inp, struct sockaddr *nam, struct proc *p)
187{
188 struct socket *so = inp->inp_socket;
189 struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
190 u_short lport = 0;
191 int wild = 0, reuseport = (so->so_options & SO_REUSEPORT);
192 struct ifnet *outif = NULL;
193 struct sockaddr_in6 sin6;
194#if !CONFIG_EMBEDDED
195 int error;
196 kauth_cred_t cred;
197#endif /* !CONFIG_EMBEDDED */
198
199 if (!in6_ifaddrs) /* XXX broken! */
200 return (EADDRNOTAVAIL);
201 if (!(so->so_options & (SO_REUSEADDR|SO_REUSEPORT)))
202 wild = 1;
203
204 socket_unlock(so, 0); /* keep reference */
205 lck_rw_lock_exclusive(pcbinfo->ipi_lock);
206 if (inp->inp_lport || !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
207 /* another thread completed the bind */
208 lck_rw_done(pcbinfo->ipi_lock);
209 socket_lock(so, 0);
210 return (EINVAL);
211 }
212
213 bzero(&sin6, sizeof (sin6));
214 if (nam != NULL) {
215 if (nam->sa_len != sizeof (struct sockaddr_in6)) {
216 lck_rw_done(pcbinfo->ipi_lock);
217 socket_lock(so, 0);
218 return (EINVAL);
219 }
220 /*
221 * family check.
222 */
223 if (nam->sa_family != AF_INET6) {
224 lck_rw_done(pcbinfo->ipi_lock);
225 socket_lock(so, 0);
226 return (EAFNOSUPPORT);
227 }
228 lport = SIN6(nam)->sin6_port;
229
230 *(&sin6) = *SIN6(nam);
231
232 /* KAME hack: embed scopeid */
233 if (in6_embedscope(&sin6.sin6_addr, &sin6, inp, NULL,
234 NULL) != 0) {
235 lck_rw_done(pcbinfo->ipi_lock);
236 socket_lock(so, 0);
237 return (EINVAL);
238 }
239
240 /* Sanitize local copy for address searches */
241 sin6.sin6_flowinfo = 0;
242 sin6.sin6_scope_id = 0;
243 sin6.sin6_port = 0;
244
245 if (IN6_IS_ADDR_MULTICAST(&sin6.sin6_addr)) {
246 /*
247 * Treat SO_REUSEADDR as SO_REUSEPORT for multicast;
248 * allow compepte duplication of binding if
249 * SO_REUSEPORT is set, or if SO_REUSEADDR is set
250 * and a multicast address is bound on both
251 * new and duplicated sockets.
252 */
253 if (so->so_options & SO_REUSEADDR)
254 reuseport = SO_REUSEADDR|SO_REUSEPORT;
255 } else if (!IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr)) {
256 struct ifaddr *ifa;
257
258 ifa = ifa_ifwithaddr(SA(&sin6));
259 if (ifa == NULL) {
260 lck_rw_done(pcbinfo->ipi_lock);
261 socket_lock(so, 0);
262 return (EADDRNOTAVAIL);
263 } else {
264 /*
265 * XXX: bind to an anycast address might
266 * accidentally cause sending a packet with
267 * anycast source address. We should allow
268 * to bind to a deprecated address, since
269 * the application dare to use it.
270 */
271 IFA_LOCK_SPIN(ifa);
272 if (((struct in6_ifaddr *)ifa)->ia6_flags &
273 (IN6_IFF_ANYCAST | IN6_IFF_NOTREADY|
274 IN6_IFF_DETACHED | IN6_IFF_CLAT46)) {
275 IFA_UNLOCK(ifa);
276 IFA_REMREF(ifa);
277 lck_rw_done(pcbinfo->ipi_lock);
278 socket_lock(so, 0);
279 return (EADDRNOTAVAIL);
280 }
281 /*
282 * Opportunistically determine the outbound
283 * interface that may be used; this may not
284 * hold true if we end up using a route
285 * going over a different interface, e.g.
286 * when sending to a local address. This
287 * will get updated again after sending.
288 */
289 outif = ifa->ifa_ifp;
290 IFA_UNLOCK(ifa);
291 IFA_REMREF(ifa);
292 }
293 }
294 if (lport != 0) {
295 struct inpcb *t;
296 uid_t u;
297
298#if !CONFIG_EMBEDDED
299 if (ntohs(lport) < IPV6PORT_RESERVED &&
300 !IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr)) {
301 cred = kauth_cred_proc_ref(p);
302 error = priv_check_cred(cred,
303 PRIV_NETINET_RESERVEDPORT, 0);
304 kauth_cred_unref(&cred);
305 if (error != 0) {
306 lck_rw_done(pcbinfo->ipi_lock);
307 socket_lock(so, 0);
308 return (EACCES);
309 }
310 }
311#endif /* !CONFIG_EMBEDDED */
312 if (!IN6_IS_ADDR_MULTICAST(&sin6.sin6_addr) &&
313 (u = kauth_cred_getuid(so->so_cred)) != 0) {
314 t = in6_pcblookup_local_and_cleanup(pcbinfo,
315 &sin6.sin6_addr, lport,
316 INPLOOKUP_WILDCARD);
317 if (t != NULL && (!IN6_IS_ADDR_UNSPECIFIED(
318 &sin6.sin6_addr) ||
319 !IN6_IS_ADDR_UNSPECIFIED(&t->in6p_laddr) ||
320 !(t->inp_socket->so_options &
321 SO_REUSEPORT)) && (u != kauth_cred_getuid(
322 t->inp_socket->so_cred)) &&
323 !(t->inp_socket->so_flags &
324 SOF_REUSESHAREUID)) {
325 lck_rw_done(pcbinfo->ipi_lock);
326 socket_lock(so, 0);
327 return (EADDRINUSE);
328 }
329 if (!(inp->inp_flags & IN6P_IPV6_V6ONLY) &&
330 IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr)) {
331 struct sockaddr_in sin;
332
333 in6_sin6_2_sin(&sin, &sin6);
334 t = in_pcblookup_local_and_cleanup(
335 pcbinfo, sin.sin_addr, lport,
336 INPLOOKUP_WILDCARD);
337 if (t != NULL &&
338 !(t->inp_socket->so_options &
339 SO_REUSEPORT) &&
340 (kauth_cred_getuid(so->so_cred) !=
341 kauth_cred_getuid(t->inp_socket->
342 so_cred)) && (t->inp_laddr.s_addr !=
343 INADDR_ANY || SOCK_DOM(so) ==
344 SOCK_DOM(t->inp_socket))) {
345 lck_rw_done(pcbinfo->ipi_lock);
346 socket_lock(so, 0);
347 return (EADDRINUSE);
348 }
349 }
350 }
351 t = in6_pcblookup_local_and_cleanup(pcbinfo,
352 &sin6.sin6_addr, lport, wild);
353 if (t != NULL &&
354 (reuseport & t->inp_socket->so_options) == 0) {
355 lck_rw_done(pcbinfo->ipi_lock);
356 socket_lock(so, 0);
357 return (EADDRINUSE);
358 }
359 if (!(inp->inp_flags & IN6P_IPV6_V6ONLY) &&
360 IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr)) {
361 struct sockaddr_in sin;
362
363 in6_sin6_2_sin(&sin, &sin6);
364 t = in_pcblookup_local_and_cleanup(pcbinfo,
365 sin.sin_addr, lport, wild);
366 if (t != NULL && (reuseport &
367 t->inp_socket->so_options) == 0 &&
368 (t->inp_laddr.s_addr != INADDR_ANY ||
369 SOCK_DOM(so) == SOCK_DOM(t->inp_socket))) {
370 lck_rw_done(pcbinfo->ipi_lock);
371 socket_lock(so, 0);
372 return (EADDRINUSE);
373 }
374 }
375 }
376 }
377
378 socket_lock(so, 0);
379 /*
380 * We unlocked socket's protocol lock for a long time.
381 * The socket might have been dropped/defuncted.
382 * Checking if world has changed since.
383 */
384 if (inp->inp_state == INPCB_STATE_DEAD) {
385 lck_rw_done(pcbinfo->ipi_lock);
386 return (ECONNABORTED);
387 }
388
389 /* check if the socket got bound when the lock was released */
390 if (inp->inp_lport || !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
391 lck_rw_done(pcbinfo->ipi_lock);
392 return (EINVAL);
393 }
394
395 if (!IN6_IS_ADDR_UNSPECIFIED(&sin6.sin6_addr)) {
396 inp->in6p_laddr = sin6.sin6_addr;
397 inp->in6p_last_outifp = outif;
398 }
399
400 if (lport == 0) {
401 int e;
402 if ((e = in6_pcbsetport(&inp->in6p_laddr, inp, p, 1)) != 0) {
403 /* Undo any address bind from above. */
404 inp->in6p_laddr = in6addr_any;
405 inp->in6p_last_outifp = NULL;
406 lck_rw_done(pcbinfo->ipi_lock);
407 return (e);
408 }
409 } else {
410 inp->inp_lport = lport;
411 if (in_pcbinshash(inp, 1) != 0) {
412 inp->in6p_laddr = in6addr_any;
413 inp->inp_lport = 0;
414 inp->in6p_last_outifp = NULL;
415 lck_rw_done(pcbinfo->ipi_lock);
416 return (EAGAIN);
417 }
418 }
419 lck_rw_done(pcbinfo->ipi_lock);
420 sflt_notify(so, sock_evt_bound, NULL);
421 return (0);
422}
423
424/*
425 * Transform old in6_pcbconnect() into an inner subroutine for new
426 * in6_pcbconnect(); do some validity-checking on the remote address
427 * (in "nam") and then determine local host address (i.e., which
428 * interface) to use to access that remote host.
429 *
430 * This routine may alter the caller-supplied remote address "nam".
431 *
432 * This routine might return an ifp with a reference held if the caller
433 * provides a non-NULL outif, even in the error case. The caller is
434 * responsible for releasing its reference.
435 */
436int
437in6_pcbladdr(struct inpcb *inp, struct sockaddr *nam,
438 struct in6_addr *plocal_addr6, struct ifnet **outif)
439{
440 struct in6_addr *addr6 = NULL;
441 struct in6_addr src_storage;
442 int error = 0;
443 unsigned int ifscope;
444
445 if (outif != NULL)
446 *outif = NULL;
447 if (nam->sa_len != sizeof (struct sockaddr_in6))
448 return (EINVAL);
449 if (SIN6(nam)->sin6_family != AF_INET6)
450 return (EAFNOSUPPORT);
451 if (SIN6(nam)->sin6_port == 0)
452 return (EADDRNOTAVAIL);
453
454 /* KAME hack: embed scopeid */
455 if (in6_embedscope(&SIN6(nam)->sin6_addr, SIN6(nam), inp, NULL, NULL) != 0)
456 return (EINVAL);
457
458 if (in6_ifaddrs) {
459 /*
460 * If the destination address is UNSPECIFIED addr,
461 * use the loopback addr, e.g ::1.
462 */
463 if (IN6_IS_ADDR_UNSPECIFIED(&SIN6(nam)->sin6_addr))
464 SIN6(nam)->sin6_addr = in6addr_loopback;
465 }
466
467 ifscope = (inp->inp_flags & INP_BOUND_IF) ?
468 inp->inp_boundifp->if_index : IFSCOPE_NONE;
469
470 /*
471 * XXX: in6_selectsrc might replace the bound local address
472 * with the address specified by setsockopt(IPV6_PKTINFO).
473 * Is it the intended behavior?
474 *
475 * in6_selectsrc() might return outif with its reference held
476 * even in the error case; caller always needs to release it
477 * if non-NULL.
478 */
479 addr6 = in6_selectsrc(SIN6(nam), inp->in6p_outputopts, inp,
480 &inp->in6p_route, outif, &src_storage, ifscope, &error);
481
482 if (outif != NULL) {
483 struct rtentry *rt = inp->in6p_route.ro_rt;
484 /*
485 * If in6_selectsrc() returns a route, it should be one
486 * which points to the same ifp as outif. Just in case
487 * it isn't, use the one from the route for consistency.
488 * Otherwise if there is no route, leave outif alone as
489 * it could still be useful to the caller.
490 */
491 if (rt != NULL && rt->rt_ifp != *outif) {
492 ifnet_reference(rt->rt_ifp); /* for caller */
493 if (*outif != NULL)
494 ifnet_release(*outif);
495 *outif = rt->rt_ifp;
496 }
497 }
498
499 if (addr6 == NULL) {
500 if (outif != NULL && (*outif) != NULL &&
501 inp_restricted_send(inp, *outif)) {
502 soevent(inp->inp_socket,
503 (SO_FILT_HINT_LOCKED | SO_FILT_HINT_IFDENIED));
504 error = EHOSTUNREACH;
505 }
506 if (error == 0)
507 error = EADDRNOTAVAIL;
508 return (error);
509 }
510
511 *plocal_addr6 = *addr6;
512 /*
513 * Don't do pcblookup call here; return interface in
514 * plocal_addr6 and exit to caller, that will do the lookup.
515 */
516 return (0);
517}
518
519/*
520 * Outer subroutine:
521 * Connect from a socket to a specified address.
522 * Both address and port must be specified in argument sin.
523 * If don't have a local address for this socket yet,
524 * then pick one.
525 */
526int
527in6_pcbconnect(struct inpcb *inp, struct sockaddr *nam, struct proc *p)
528{
529 struct in6_addr addr6;
530 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)(void *)nam;
531 struct inpcb *pcb;
532 int error = 0;
533 struct ifnet *outif = NULL;
534 struct socket *so = inp->inp_socket;
535
536#if CONTENT_FILTER
537 if (so)
538 so->so_state_change_cnt++;
539#endif
540
541 if (so->so_proto->pr_protocol == IPPROTO_UDP &&
542 sin6->sin6_port == htons(53) && !(so->so_flags1 & SOF1_DNS_COUNTED)) {
543 so->so_flags1 |= SOF1_DNS_COUNTED;
544 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet_dgram_dns);
545 }
546
547 /*
548 * Call inner routine, to assign local interface address.
549 * in6_pcbladdr() may automatically fill in sin6_scope_id.
550 *
551 * in6_pcbladdr() might return an ifp with its reference held
552 * even in the error case, so make sure that it's released
553 * whenever it's non-NULL.
554 */
555 if ((error = in6_pcbladdr(inp, nam, &addr6, &outif)) != 0) {
556 if (outif != NULL && inp_restricted_send(inp, outif))
557 soevent(so,
558 (SO_FILT_HINT_LOCKED | SO_FILT_HINT_IFDENIED));
559 goto done;
560 }
561 socket_unlock(so, 0);
562 pcb = in6_pcblookup_hash(inp->inp_pcbinfo, &sin6->sin6_addr,
563 sin6->sin6_port, IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr) ?
564 &addr6 : &inp->in6p_laddr, inp->inp_lport, 0, NULL);
565 socket_lock(so, 0);
566 if (pcb != NULL) {
567 in_pcb_checkstate(pcb, WNT_RELEASE, pcb == inp ? 1 : 0);
568 error = EADDRINUSE;
569 goto done;
570 }
571 if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
572 if (inp->inp_lport == 0) {
573 error = in6_pcbbind(inp, NULL, p);
574 if (error)
575 goto done;
576 }
577 inp->in6p_laddr = addr6;
578 inp->in6p_last_outifp = outif; /* no reference needed */
579 inp->in6p_flags |= INP_IN6ADDR_ANY;
580 }
581 if (!lck_rw_try_lock_exclusive(inp->inp_pcbinfo->ipi_lock)) {
582 /* lock inversion issue, mostly with udp multicast packets */
583 socket_unlock(so, 0);
584 lck_rw_lock_exclusive(inp->inp_pcbinfo->ipi_lock);
585 socket_lock(so, 0);
586 }
587 inp->in6p_faddr = sin6->sin6_addr;
588 inp->inp_fport = sin6->sin6_port;
589 if (nstat_collect && SOCK_PROTO(so) == IPPROTO_UDP)
590 nstat_pcb_invalidate_cache(inp);
591 in_pcbrehash(inp);
592 lck_rw_done(inp->inp_pcbinfo->ipi_lock);
593
594done:
595 if (outif != NULL)
596 ifnet_release(outif);
597
598 return (error);
599}
600
601void
602in6_pcbdisconnect(struct inpcb *inp)
603{
604 struct socket *so = inp->inp_socket;
605
606#if CONTENT_FILTER
607 if (so)
608 so->so_state_change_cnt++;
609#endif
610
611 if (!lck_rw_try_lock_exclusive(inp->inp_pcbinfo->ipi_lock)) {
612 /* lock inversion issue, mostly with udp multicast packets */
613 socket_unlock(so, 0);
614 lck_rw_lock_exclusive(inp->inp_pcbinfo->ipi_lock);
615 socket_lock(so, 0);
616 }
617 if (nstat_collect && SOCK_PROTO(so) == IPPROTO_UDP)
618 nstat_pcb_cache(inp);
619 bzero((caddr_t)&inp->in6p_faddr, sizeof (inp->in6p_faddr));
620 inp->inp_fport = 0;
621 /* clear flowinfo - RFC 6437 */
622 inp->inp_flow &= ~IPV6_FLOWLABEL_MASK;
623 in_pcbrehash(inp);
624 lck_rw_done(inp->inp_pcbinfo->ipi_lock);
625 /*
626 * A multipath subflow socket would have its SS_NOFDREF set by default,
627 * so check for SOF_MP_SUBFLOW socket flag before detaching the PCB;
628 * when the socket is closed for real, SOF_MP_SUBFLOW would be cleared.
629 */
630 if (!(so->so_flags & SOF_MP_SUBFLOW) && (so->so_state & SS_NOFDREF))
631 in6_pcbdetach(inp);
632}
633
634void
635in6_pcbdetach(struct inpcb *inp)
636{
637 struct socket *so = inp->inp_socket;
638
639 if (so->so_pcb == NULL) {
640 /* PCB has been disposed */
641 panic("%s: inp=%p so=%p proto=%d so_pcb is null!\n", __func__,
642 inp, so, SOCK_PROTO(so));
643 /* NOTREACHED */
644 }
645
646#if IPSEC
647 if (inp->in6p_sp != NULL) {
648 (void) ipsec6_delete_pcbpolicy(inp);
649 }
650#endif /* IPSEC */
651
652 if (inp->inp_stat != NULL && SOCK_PROTO(so) == IPPROTO_UDP) {
653 if (inp->inp_stat->rxpackets == 0 && inp->inp_stat->txpackets == 0) {
654 INC_ATOMIC_INT64_LIM(net_api_stats.nas_socket_inet6_dgram_no_data);
655 }
656 }
657
658 /*
659 * Let NetworkStatistics know this PCB is going away
660 * before we detach it.
661 */
662 if (nstat_collect &&
663 (SOCK_PROTO(so) == IPPROTO_TCP || SOCK_PROTO(so) == IPPROTO_UDP))
664 nstat_pcb_detach(inp);
665 /* mark socket state as dead */
666 if (in_pcb_checkstate(inp, WNT_STOPUSING, 1) != WNT_STOPUSING) {
667 panic("%s: so=%p proto=%d couldn't set to STOPUSING\n",
668 __func__, so, SOCK_PROTO(so));
669 /* NOTREACHED */
670 }
671
672 if (!(so->so_flags & SOF_PCBCLEARING)) {
673 struct ip_moptions *imo;
674 struct ip6_moptions *im6o;
675
676 inp->inp_vflag = 0;
677 if (inp->in6p_options != NULL) {
678 m_freem(inp->in6p_options);
679 inp->in6p_options = NULL;
680 }
681 ip6_freepcbopts(inp->in6p_outputopts);
682 ROUTE_RELEASE(&inp->in6p_route);
683 /* free IPv4 related resources in case of mapped addr */
684 if (inp->inp_options != NULL) {
685 (void) m_free(inp->inp_options);
686 inp->inp_options = NULL;
687 }
688 im6o = inp->in6p_moptions;
689 inp->in6p_moptions = NULL;
690
691 imo = inp->inp_moptions;
692 inp->inp_moptions = NULL;
693
694 sofreelastref(so, 0);
695 inp->inp_state = INPCB_STATE_DEAD;
696 /* makes sure we're not called twice from so_close */
697 so->so_flags |= SOF_PCBCLEARING;
698
699 inpcb_gc_sched(inp->inp_pcbinfo, INPCB_TIMER_FAST);
700
701 /*
702 * See inp_join_group() for why we need to unlock
703 */
704 if (im6o != NULL || imo != NULL) {
705 socket_unlock(so, 0);
706 if (im6o != NULL)
707 IM6O_REMREF(im6o);
708 if (imo != NULL)
709 IMO_REMREF(imo);
710 socket_lock(so, 0);
711 }
712 }
713}
714
715struct sockaddr *
716in6_sockaddr(in_port_t port, struct in6_addr *addr_p)
717{
718 struct sockaddr_in6 *sin6;
719
720 MALLOC(sin6, struct sockaddr_in6 *, sizeof (*sin6), M_SONAME, M_WAITOK);
721 if (sin6 == NULL)
722 return (NULL);
723 bzero(sin6, sizeof (*sin6));
724 sin6->sin6_family = AF_INET6;
725 sin6->sin6_len = sizeof (*sin6);
726 sin6->sin6_port = port;
727 sin6->sin6_addr = *addr_p;
728
729 /* would be good to use sa6_recoverscope(), except for locking */
730 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr))
731 sin6->sin6_scope_id = ntohs(sin6->sin6_addr.s6_addr16[1]);
732 else
733 sin6->sin6_scope_id = 0; /* XXX */
734 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr))
735 sin6->sin6_addr.s6_addr16[1] = 0;
736
737 return ((struct sockaddr *)sin6);
738}
739
740void
741in6_sockaddr_s(in_port_t port, struct in6_addr *addr_p,
742 struct sockaddr_in6 *sin6)
743{
744 bzero(sin6, sizeof (*sin6));
745 sin6->sin6_family = AF_INET6;
746 sin6->sin6_len = sizeof (*sin6);
747 sin6->sin6_port = port;
748 sin6->sin6_addr = *addr_p;
749
750 /* would be good to use sa6_recoverscope(), except for locking */
751 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr))
752 sin6->sin6_scope_id = ntohs(sin6->sin6_addr.s6_addr16[1]);
753 else
754 sin6->sin6_scope_id = 0; /* XXX */
755 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr))
756 sin6->sin6_addr.s6_addr16[1] = 0;
757}
758
759/*
760 * The calling convention of in6_getsockaddr() and in6_getpeeraddr() was
761 * modified to match the pru_sockaddr() and pru_peeraddr() entry points
762 * in struct pr_usrreqs, so that protocols can just reference then directly
763 * without the need for a wrapper function.
764 */
765int
766in6_getsockaddr(struct socket *so, struct sockaddr **nam)
767{
768 struct inpcb *inp;
769 struct in6_addr addr;
770 in_port_t port;
771
772 if ((inp = sotoinpcb(so)) == NULL)
773 return (EINVAL);
774
775 port = inp->inp_lport;
776 addr = inp->in6p_laddr;
777
778 *nam = in6_sockaddr(port, &addr);
779 if (*nam == NULL)
780 return (ENOBUFS);
781 return (0);
782}
783
784int
785in6_getsockaddr_s(struct socket *so, struct sockaddr_in6 *ss)
786{
787 struct inpcb *inp;
788 struct in6_addr addr;
789 in_port_t port;
790
791 VERIFY(ss != NULL);
792 bzero(ss, sizeof (*ss));
793
794 if ((inp = sotoinpcb(so)) == NULL)
795 return (EINVAL);
796
797 port = inp->inp_lport;
798 addr = inp->in6p_laddr;
799
800 in6_sockaddr_s(port, &addr, ss);
801 return (0);
802}
803
804int
805in6_getpeeraddr(struct socket *so, struct sockaddr **nam)
806{
807 struct inpcb *inp;
808 struct in6_addr addr;
809 in_port_t port;
810
811 if ((inp = sotoinpcb(so)) == NULL)
812 return (EINVAL);
813
814 port = inp->inp_fport;
815 addr = inp->in6p_faddr;
816
817 *nam = in6_sockaddr(port, &addr);
818 if (*nam == NULL)
819 return (ENOBUFS);
820 return (0);
821}
822
823int
824in6_mapped_sockaddr(struct socket *so, struct sockaddr **nam)
825{
826 struct inpcb *inp = sotoinpcb(so);
827 int error;
828
829 if (inp == NULL)
830 return (EINVAL);
831 if (inp->inp_vflag & INP_IPV4) {
832 error = in_getsockaddr(so, nam);
833 if (error == 0)
834 error = in6_sin_2_v4mapsin6_in_sock(nam);
835 } else {
836 /* scope issues will be handled in in6_getsockaddr(). */
837 error = in6_getsockaddr(so, nam);
838 }
839 return (error);
840}
841
842int
843in6_mapped_peeraddr(struct socket *so, struct sockaddr **nam)
844{
845 struct inpcb *inp = sotoinpcb(so);
846 int error;
847
848 if (inp == NULL)
849 return (EINVAL);
850 if (inp->inp_vflag & INP_IPV4) {
851 error = in_getpeeraddr(so, nam);
852 if (error == 0)
853 error = in6_sin_2_v4mapsin6_in_sock(nam);
854 } else {
855 /* scope issues will be handled in in6_getpeeraddr(). */
856 error = in6_getpeeraddr(so, nam);
857 }
858 return (error);
859}
860
861/*
862 * Pass some notification to all connections of a protocol
863 * associated with address dst. The local address and/or port numbers
864 * may be specified to limit the search. The "usual action" will be
865 * taken, depending on the ctlinput cmd. The caller must filter any
866 * cmds that are uninteresting (e.g., no error in the map).
867 * Call the protocol specific routine (if any) to report
868 * any errors for each matching socket.
869 */
870void
871in6_pcbnotify(struct inpcbinfo *pcbinfo, struct sockaddr *dst, u_int fport_arg,
872 const struct sockaddr *src, u_int lport_arg, int cmd, void *cmdarg,
873 void (*notify)(struct inpcb *, int))
874{
875 struct inpcbhead *head = pcbinfo->ipi_listhead;
876 struct inpcb *inp, *ninp;
877 struct sockaddr_in6 sa6_src, *sa6_dst;
878 u_short fport = fport_arg, lport = lport_arg;
879 u_int32_t flowinfo;
880 int errno;
881
882 if ((unsigned)cmd >= PRC_NCMDS || dst->sa_family != AF_INET6)
883 return;
884
885 sa6_dst = (struct sockaddr_in6 *)(void *)dst;
886 if (IN6_IS_ADDR_UNSPECIFIED(&sa6_dst->sin6_addr))
887 return;
888
889 /*
890 * note that src can be NULL when we get notify by local fragmentation.
891 */
892 sa6_src = (src == NULL) ?
893 sa6_any : *(struct sockaddr_in6 *)(uintptr_t)(size_t)src;
894 flowinfo = sa6_src.sin6_flowinfo;
895
896 /*
897 * Redirects go to all references to the destination,
898 * and use in6_rtchange to invalidate the route cache.
899 * Dead host indications: also use in6_rtchange to invalidate
900 * the cache, and deliver the error to all the sockets.
901 * Otherwise, if we have knowledge of the local port and address,
902 * deliver only to that socket.
903 */
904 if (PRC_IS_REDIRECT(cmd) || cmd == PRC_HOSTDEAD) {
905 fport = 0;
906 lport = 0;
907 bzero((caddr_t)&sa6_src.sin6_addr, sizeof (sa6_src.sin6_addr));
908
909 if (cmd != PRC_HOSTDEAD)
910 notify = in6_rtchange;
911 }
912 errno = inet6ctlerrmap[cmd];
913 lck_rw_lock_shared(pcbinfo->ipi_lock);
914 for (inp = LIST_FIRST(head); inp != NULL; inp = ninp) {
915 ninp = LIST_NEXT(inp, inp_list);
916
917 if (!(inp->inp_vflag & INP_IPV6))
918 continue;
919
920 /*
921 * If the error designates a new path MTU for a destination
922 * and the application (associated with this socket) wanted to
923 * know the value, notify. Note that we notify for all
924 * disconnected sockets if the corresponding application
925 * wanted. This is because some UDP applications keep sending
926 * sockets disconnected.
927 * XXX: should we avoid to notify the value to TCP sockets?
928 */
929 if (cmd == PRC_MSGSIZE)
930 ip6_notify_pmtu(inp, (struct sockaddr_in6 *)(void *)dst,
931 (u_int32_t *)cmdarg);
932
933 /*
934 * Detect if we should notify the error. If no source and
935 * destination ports are specifed, but non-zero flowinfo and
936 * local address match, notify the error. This is the case
937 * when the error is delivered with an encrypted buffer
938 * by ESP. Otherwise, just compare addresses and ports
939 * as usual.
940 */
941 if (lport == 0 && fport == 0 && flowinfo &&
942 inp->inp_socket != NULL &&
943 flowinfo == (inp->inp_flow & IPV6_FLOWLABEL_MASK) &&
944 IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, &sa6_src.sin6_addr))
945 goto do_notify;
946 else if (!IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr,
947 &sa6_dst->sin6_addr) || inp->inp_socket == NULL ||
948 (lport && inp->inp_lport != lport) ||
949 (!IN6_IS_ADDR_UNSPECIFIED(&sa6_src.sin6_addr) &&
950 !IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr,
951 &sa6_src.sin6_addr)) || (fport && inp->inp_fport != fport))
952 continue;
953
954do_notify:
955 if (notify) {
956 if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) ==
957 WNT_STOPUSING)
958 continue;
959 socket_lock(inp->inp_socket, 1);
960 (*notify)(inp, errno);
961 (void) in_pcb_checkstate(inp, WNT_RELEASE, 1);
962 socket_unlock(inp->inp_socket, 1);
963 }
964 }
965 lck_rw_done(pcbinfo->ipi_lock);
966}
967
968/*
969 * Lookup a PCB based on the local address and port.
970 */
971struct inpcb *
972in6_pcblookup_local(struct inpcbinfo *pcbinfo, struct in6_addr *laddr,
973 u_int lport_arg, int wild_okay)
974{
975 struct inpcb *inp;
976 int matchwild = 3, wildcard;
977 u_short lport = lport_arg;
978 struct inpcbporthead *porthash;
979 struct inpcb *match = NULL;
980 struct inpcbport *phd;
981
982 if (!wild_okay) {
983 struct inpcbhead *head;
984 /*
985 * Look for an unconnected (wildcard foreign addr) PCB that
986 * matches the local address and port we're looking for.
987 */
988 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(INADDR_ANY, lport, 0,
989 pcbinfo->ipi_hashmask)];
990 LIST_FOREACH(inp, head, inp_hash) {
991 if (!(inp->inp_vflag & INP_IPV6))
992 continue;
993 if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) &&
994 IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr) &&
995 inp->inp_lport == lport) {
996 /*
997 * Found.
998 */
999 return (inp);
1000 }
1001 }
1002 /*
1003 * Not found.
1004 */
1005 return (NULL);
1006 }
1007 /*
1008 * Best fit PCB lookup.
1009 *
1010 * First see if this local port is in use by looking on the
1011 * port hash list.
1012 */
1013 porthash = &pcbinfo->ipi_porthashbase[INP_PCBPORTHASH(lport,
1014 pcbinfo->ipi_porthashmask)];
1015 LIST_FOREACH(phd, porthash, phd_hash) {
1016 if (phd->phd_port == lport)
1017 break;
1018 }
1019 if (phd != NULL) {
1020 /*
1021 * Port is in use by one or more PCBs. Look for best
1022 * fit.
1023 */
1024 LIST_FOREACH(inp, &phd->phd_pcblist, inp_portlist) {
1025 wildcard = 0;
1026 if (!(inp->inp_vflag & INP_IPV6))
1027 continue;
1028 if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr))
1029 wildcard++;
1030 if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
1031 if (IN6_IS_ADDR_UNSPECIFIED(laddr))
1032 wildcard++;
1033 else if (!IN6_ARE_ADDR_EQUAL(
1034 &inp->in6p_laddr, laddr))
1035 continue;
1036 } else {
1037 if (!IN6_IS_ADDR_UNSPECIFIED(laddr))
1038 wildcard++;
1039 }
1040 if (wildcard < matchwild) {
1041 match = inp;
1042 matchwild = wildcard;
1043 if (matchwild == 0) {
1044 break;
1045 }
1046 }
1047 }
1048 }
1049 return (match);
1050}
1051
1052/*
1053 * Check for alternatives when higher level complains
1054 * about service problems. For now, invalidate cached
1055 * routing information. If the route was created dynamically
1056 * (by a redirect), time to try a default gateway again.
1057 */
1058void
1059in6_losing(struct inpcb *in6p)
1060{
1061 struct rtentry *rt;
1062
1063 if ((rt = in6p->in6p_route.ro_rt) != NULL) {
1064 RT_LOCK(rt);
1065 if (rt->rt_flags & RTF_DYNAMIC) {
1066 /*
1067 * Prevent another thread from modifying rt_key,
1068 * rt_gateway via rt_setgate() after the rt_lock
1069 * is dropped by marking the route as defunct.
1070 */
1071 rt->rt_flags |= RTF_CONDEMNED;
1072 RT_UNLOCK(rt);
1073 (void) rtrequest(RTM_DELETE, rt_key(rt),
1074 rt->rt_gateway, rt_mask(rt), rt->rt_flags, NULL);
1075 } else {
1076 RT_UNLOCK(rt);
1077 }
1078 /*
1079 * A new route can be allocated
1080 * the next time output is attempted.
1081 */
1082 }
1083 ROUTE_RELEASE(&in6p->in6p_route);
1084}
1085
1086/*
1087 * After a routing change, flush old routing
1088 * and allocate a (hopefully) better one.
1089 */
1090void
1091in6_rtchange(struct inpcb *inp, int errno)
1092{
1093#pragma unused(errno)
1094 /*
1095 * A new route can be allocated the next time
1096 * output is attempted.
1097 */
1098 ROUTE_RELEASE(&inp->in6p_route);
1099}
1100
1101/*
1102 * Check if PCB exists hash list. Also returns uid and gid of socket
1103 */
1104int
1105in6_pcblookup_hash_exists(struct inpcbinfo *pcbinfo, struct in6_addr *faddr,
1106 u_int fport_arg, struct in6_addr *laddr, u_int lport_arg, int wildcard,
1107 uid_t *uid, gid_t *gid, struct ifnet *ifp)
1108{
1109 struct inpcbhead *head;
1110 struct inpcb *inp;
1111 u_short fport = fport_arg, lport = lport_arg;
1112 int found;
1113
1114 *uid = UID_MAX;
1115 *gid = GID_MAX;
1116
1117 lck_rw_lock_shared(pcbinfo->ipi_lock);
1118
1119 /*
1120 * First look for an exact match.
1121 */
1122 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(faddr->s6_addr32[3] /* XXX */,
1123 lport, fport, pcbinfo->ipi_hashmask)];
1124 LIST_FOREACH(inp, head, inp_hash) {
1125 if (!(inp->inp_vflag & INP_IPV6))
1126 continue;
1127
1128 if (inp_restricted_recv(inp, ifp))
1129 continue;
1130
1131 if (IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr, faddr) &&
1132 IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr) &&
1133 inp->inp_fport == fport &&
1134 inp->inp_lport == lport) {
1135 if ((found = (inp->inp_socket != NULL))) {
1136 /*
1137 * Found. Check if pcb is still valid
1138 */
1139 *uid = kauth_cred_getuid(
1140 inp->inp_socket->so_cred);
1141 *gid = kauth_cred_getgid(
1142 inp->inp_socket->so_cred);
1143 }
1144 lck_rw_done(pcbinfo->ipi_lock);
1145 return (found);
1146 }
1147 }
1148 if (wildcard) {
1149 struct inpcb *local_wild = NULL;
1150
1151 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(INADDR_ANY, lport, 0,
1152 pcbinfo->ipi_hashmask)];
1153 LIST_FOREACH(inp, head, inp_hash) {
1154 if (!(inp->inp_vflag & INP_IPV6))
1155 continue;
1156
1157 if (inp_restricted_recv(inp, ifp))
1158 continue;
1159
1160 if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) &&
1161 inp->inp_lport == lport) {
1162 if (IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr,
1163 laddr)) {
1164 found = (inp->inp_socket != NULL);
1165 if (found) {
1166 *uid = kauth_cred_getuid(
1167 inp->inp_socket->so_cred);
1168 *gid = kauth_cred_getgid(
1169 inp->inp_socket->so_cred);
1170 }
1171 lck_rw_done(pcbinfo->ipi_lock);
1172 return (found);
1173 } else if (IN6_IS_ADDR_UNSPECIFIED(
1174 &inp->in6p_laddr)) {
1175 local_wild = inp;
1176 }
1177 }
1178 }
1179 if (local_wild) {
1180 if ((found = (local_wild->inp_socket != NULL))) {
1181 *uid = kauth_cred_getuid(
1182 local_wild->inp_socket->so_cred);
1183 *gid = kauth_cred_getgid(
1184 local_wild->inp_socket->so_cred);
1185 }
1186 lck_rw_done(pcbinfo->ipi_lock);
1187 return (found);
1188 }
1189 }
1190
1191 /*
1192 * Not found.
1193 */
1194 lck_rw_done(pcbinfo->ipi_lock);
1195 return (0);
1196}
1197
1198/*
1199 * Lookup PCB in hash list.
1200 */
1201struct inpcb *
1202in6_pcblookup_hash(struct inpcbinfo *pcbinfo, struct in6_addr *faddr,
1203 u_int fport_arg, struct in6_addr *laddr, u_int lport_arg, int wildcard,
1204 struct ifnet *ifp)
1205{
1206 struct inpcbhead *head;
1207 struct inpcb *inp;
1208 u_short fport = fport_arg, lport = lport_arg;
1209
1210 lck_rw_lock_shared(pcbinfo->ipi_lock);
1211
1212 /*
1213 * First look for an exact match.
1214 */
1215 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(faddr->s6_addr32[3] /* XXX */,
1216 lport, fport, pcbinfo->ipi_hashmask)];
1217 LIST_FOREACH(inp, head, inp_hash) {
1218 if (!(inp->inp_vflag & INP_IPV6))
1219 continue;
1220
1221 if (inp_restricted_recv(inp, ifp))
1222 continue;
1223
1224 if (IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr, faddr) &&
1225 IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr) &&
1226 inp->inp_fport == fport &&
1227 inp->inp_lport == lport) {
1228 /*
1229 * Found. Check if pcb is still valid
1230 */
1231 if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) !=
1232 WNT_STOPUSING) {
1233 lck_rw_done(pcbinfo->ipi_lock);
1234 return (inp);
1235 } else {
1236 /* it's there but dead, say it isn't found */
1237 lck_rw_done(pcbinfo->ipi_lock);
1238 return (NULL);
1239 }
1240 }
1241 }
1242 if (wildcard) {
1243 struct inpcb *local_wild = NULL;
1244
1245 head = &pcbinfo->ipi_hashbase[INP_PCBHASH(INADDR_ANY, lport, 0,
1246 pcbinfo->ipi_hashmask)];
1247 LIST_FOREACH(inp, head, inp_hash) {
1248 if (!(inp->inp_vflag & INP_IPV6))
1249 continue;
1250
1251 if (inp_restricted_recv(inp, ifp))
1252 continue;
1253
1254 if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) &&
1255 inp->inp_lport == lport) {
1256 if (IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr,
1257 laddr)) {
1258 if (in_pcb_checkstate(inp, WNT_ACQUIRE,
1259 0) != WNT_STOPUSING) {
1260 lck_rw_done(pcbinfo->ipi_lock);
1261 return (inp);
1262 } else {
1263 /* dead; say it isn't found */
1264 lck_rw_done(pcbinfo->ipi_lock);
1265 return (NULL);
1266 }
1267 } else if (IN6_IS_ADDR_UNSPECIFIED(
1268 &inp->in6p_laddr)) {
1269 local_wild = inp;
1270 }
1271 }
1272 }
1273 if (local_wild && in_pcb_checkstate(local_wild,
1274 WNT_ACQUIRE, 0) != WNT_STOPUSING) {
1275 lck_rw_done(pcbinfo->ipi_lock);
1276 return (local_wild);
1277 } else {
1278 lck_rw_done(pcbinfo->ipi_lock);
1279 return (NULL);
1280 }
1281 }
1282
1283 /*
1284 * Not found.
1285 */
1286 lck_rw_done(pcbinfo->ipi_lock);
1287 return (NULL);
1288}
1289
1290void
1291init_sin6(struct sockaddr_in6 *sin6, struct mbuf *m)
1292{
1293 struct ip6_hdr *ip;
1294
1295 ip = mtod(m, struct ip6_hdr *);
1296 bzero(sin6, sizeof (*sin6));
1297 sin6->sin6_len = sizeof (*sin6);
1298 sin6->sin6_family = AF_INET6;
1299 sin6->sin6_addr = ip->ip6_src;
1300 if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
1301 sin6->sin6_addr.s6_addr16[1] = 0;
1302 if ((m->m_pkthdr.pkt_flags & (PKTF_LOOP|PKTF_IFAINFO)) ==
1303 (PKTF_LOOP|PKTF_IFAINFO))
1304 sin6->sin6_scope_id = m->m_pkthdr.src_ifindex;
1305 else if (m->m_pkthdr.rcvif != NULL)
1306 sin6->sin6_scope_id = m->m_pkthdr.rcvif->if_index;
1307 }
1308}
1309
1310/*
1311 * The following routines implement this scheme:
1312 *
1313 * Callers of ip6_output() that intend to cache the route in the inpcb pass
1314 * a local copy of the struct route to ip6_output(). Using a local copy of
1315 * the cached route significantly simplifies things as IP no longer has to
1316 * worry about having exclusive access to the passed in struct route, since
1317 * it's defined in the caller's stack; in essence, this allows for a lock-
1318 * less operation when updating the struct route at the IP level and below,
1319 * whenever necessary. The scheme works as follows:
1320 *
1321 * Prior to dropping the socket's lock and calling ip6_output(), the caller
1322 * copies the struct route from the inpcb into its stack, and adds a reference
1323 * to the cached route entry, if there was any. The socket's lock is then
1324 * dropped and ip6_output() is called with a pointer to the copy of struct
1325 * route defined on the stack (not to the one in the inpcb.)
1326 *
1327 * Upon returning from ip6_output(), the caller then acquires the socket's
1328 * lock and synchronizes the cache; if there is no route cached in the inpcb,
1329 * it copies the local copy of struct route (which may or may not contain any
1330 * route) back into the cache; otherwise, if the inpcb has a route cached in
1331 * it, the one in the local copy will be freed, if there's any. Trashing the
1332 * cached route in the inpcb can be avoided because ip6_output() is single-
1333 * threaded per-PCB (i.e. multiple transmits on a PCB are always serialized
1334 * by the socket/transport layer.)
1335 */
1336void
1337in6p_route_copyout(struct inpcb *inp, struct route_in6 *dst)
1338{
1339 struct route_in6 *src = &inp->in6p_route;
1340
1341 socket_lock_assert_owned(inp->inp_socket);
1342
1343 /* Minor sanity check */
1344 if (src->ro_rt != NULL && rt_key(src->ro_rt)->sa_family != AF_INET6)
1345 panic("%s: wrong or corrupted route: %p", __func__, src);
1346
1347 route_copyout((struct route *)dst, (struct route *)src, sizeof (*dst));
1348}
1349
1350void
1351in6p_route_copyin(struct inpcb *inp, struct route_in6 *src)
1352{
1353 struct route_in6 *dst = &inp->in6p_route;
1354
1355 socket_lock_assert_owned(inp->inp_socket);
1356
1357 /* Minor sanity check */
1358 if (src->ro_rt != NULL && rt_key(src->ro_rt)->sa_family != AF_INET6)
1359 panic("%s: wrong or corrupted route: %p", __func__, src);
1360
1361 route_copyin((struct route *)src, (struct route *)dst, sizeof (*src));
1362}
1363