xref: /freebsd/sys/netinet/in_pcb.c (revision bdcbfde31e8e9b343f113a1956384bdf30d1ed62)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1982, 1986, 1991, 1993, 1995
5  *	The Regents of the University of California.
6  * Copyright (c) 2007-2009 Robert N. M. Watson
7  * Copyright (c) 2010-2011 Juniper Networks, Inc.
8  * Copyright (c) 2021-2022 Gleb Smirnoff <glebius@FreeBSD.org>
9  * All rights reserved.
10  *
11  * Portions of this software were developed by Robert N. M. Watson under
12  * contract to Juniper Networks, Inc.
13  *
14  * Redistribution and use in source and binary forms, with or without
15  * modification, are permitted provided that the following conditions
16  * are met:
17  * 1. Redistributions of source code must retain the above copyright
18  *    notice, this list of conditions and the following disclaimer.
19  * 2. Redistributions in binary form must reproduce the above copyright
20  *    notice, this list of conditions and the following disclaimer in the
21  *    documentation and/or other materials provided with the distribution.
22  * 3. Neither the name of the University nor the names of its contributors
23  *    may be used to endorse or promote products derived from this software
24  *    without specific prior written permission.
25  *
26  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
27  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
28  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
29  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
30  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
31  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
32  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
33  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
34  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
35  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
36  * SUCH DAMAGE.
37  */
38 
39 #include <sys/cdefs.h>
40 #include "opt_ddb.h"
41 #include "opt_ipsec.h"
42 #include "opt_inet.h"
43 #include "opt_inet6.h"
44 #include "opt_ratelimit.h"
45 #include "opt_route.h"
46 #include "opt_rss.h"
47 
48 #include <sys/param.h>
49 #include <sys/hash.h>
50 #include <sys/systm.h>
51 #include <sys/libkern.h>
52 #include <sys/lock.h>
53 #include <sys/malloc.h>
54 #include <sys/mbuf.h>
55 #include <sys/eventhandler.h>
56 #include <sys/domain.h>
57 #include <sys/proc.h>
58 #include <sys/protosw.h>
59 #include <sys/smp.h>
60 #include <sys/smr.h>
61 #include <sys/socket.h>
62 #include <sys/socketvar.h>
63 #include <sys/sockio.h>
64 #include <sys/priv.h>
65 #include <sys/proc.h>
66 #include <sys/refcount.h>
67 #include <sys/jail.h>
68 #include <sys/kernel.h>
69 #include <sys/sysctl.h>
70 
71 #ifdef DDB
72 #include <ddb/ddb.h>
73 #endif
74 
75 #include <vm/uma.h>
76 #include <vm/vm.h>
77 
78 #include <net/if.h>
79 #include <net/if_var.h>
80 #include <net/if_private.h>
81 #include <net/if_types.h>
82 #include <net/if_llatbl.h>
83 #include <net/route.h>
84 #include <net/rss_config.h>
85 #include <net/vnet.h>
86 
87 #if defined(INET) || defined(INET6)
88 #include <netinet/in.h>
89 #include <netinet/in_pcb.h>
90 #include <netinet/in_pcb_var.h>
91 #include <netinet/tcp.h>
92 #ifdef INET
93 #include <netinet/in_var.h>
94 #include <netinet/in_fib.h>
95 #endif
96 #include <netinet/ip_var.h>
97 #ifdef INET6
98 #include <netinet/ip6.h>
99 #include <netinet6/in6_pcb.h>
100 #include <netinet6/in6_var.h>
101 #include <netinet6/ip6_var.h>
102 #endif /* INET6 */
103 #include <net/route/nhop.h>
104 #endif
105 
106 #include <netipsec/ipsec_support.h>
107 
108 #include <security/mac/mac_framework.h>
109 
110 #define	INPCBLBGROUP_SIZMIN	8
111 #define	INPCBLBGROUP_SIZMAX	256
112 
113 #define	INP_FREED	0x00000200	/* Went through in_pcbfree(). */
114 #define	INP_INLBGROUP	0x01000000	/* Inserted into inpcblbgroup. */
115 
116 /*
117  * These configure the range of local port addresses assigned to
118  * "unspecified" outgoing connections/packets/whatever.
119  */
120 VNET_DEFINE(int, ipport_lowfirstauto) = IPPORT_RESERVED - 1;	/* 1023 */
121 VNET_DEFINE(int, ipport_lowlastauto) = IPPORT_RESERVEDSTART;	/* 600 */
122 VNET_DEFINE(int, ipport_firstauto) = IPPORT_EPHEMERALFIRST;	/* 10000 */
123 VNET_DEFINE(int, ipport_lastauto) = IPPORT_EPHEMERALLAST;	/* 65535 */
124 VNET_DEFINE(int, ipport_hifirstauto) = IPPORT_HIFIRSTAUTO;	/* 49152 */
125 VNET_DEFINE(int, ipport_hilastauto) = IPPORT_HILASTAUTO;	/* 65535 */
126 
127 /*
128  * Reserved ports accessible only to root. There are significant
129  * security considerations that must be accounted for when changing these,
130  * but the security benefits can be great. Please be careful.
131  */
132 VNET_DEFINE(int, ipport_reservedhigh) = IPPORT_RESERVED - 1;	/* 1023 */
133 VNET_DEFINE(int, ipport_reservedlow);
134 
135 /* Enable random ephemeral port allocation by default. */
136 VNET_DEFINE(int, ipport_randomized) = 1;
137 
138 #ifdef INET
139 static struct inpcb	*in_pcblookup_hash_locked(struct inpcbinfo *pcbinfo,
140 			    struct in_addr faddr, u_int fport_arg,
141 			    struct in_addr laddr, u_int lport_arg,
142 			    int lookupflags, uint8_t numa_domain);
143 
144 #define RANGECHK(var, min, max) \
145 	if ((var) < (min)) { (var) = (min); } \
146 	else if ((var) > (max)) { (var) = (max); }
147 
148 static int
149 sysctl_net_ipport_check(SYSCTL_HANDLER_ARGS)
150 {
151 	int error;
152 
153 	error = sysctl_handle_int(oidp, arg1, arg2, req);
154 	if (error == 0) {
155 		RANGECHK(V_ipport_lowfirstauto, 1, IPPORT_RESERVED - 1);
156 		RANGECHK(V_ipport_lowlastauto, 1, IPPORT_RESERVED - 1);
157 		RANGECHK(V_ipport_firstauto, IPPORT_RESERVED, IPPORT_MAX);
158 		RANGECHK(V_ipport_lastauto, IPPORT_RESERVED, IPPORT_MAX);
159 		RANGECHK(V_ipport_hifirstauto, IPPORT_RESERVED, IPPORT_MAX);
160 		RANGECHK(V_ipport_hilastauto, IPPORT_RESERVED, IPPORT_MAX);
161 	}
162 	return (error);
163 }
164 
165 #undef RANGECHK
166 
167 static SYSCTL_NODE(_net_inet_ip, IPPROTO_IP, portrange,
168     CTLFLAG_RW | CTLFLAG_MPSAFE, 0,
169     "IP Ports");
170 
171 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, lowfirst,
172     CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
173     &VNET_NAME(ipport_lowfirstauto), 0, &sysctl_net_ipport_check, "I",
174     "");
175 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, lowlast,
176     CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
177     &VNET_NAME(ipport_lowlastauto), 0, &sysctl_net_ipport_check, "I",
178     "");
179 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, first,
180     CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
181     &VNET_NAME(ipport_firstauto), 0, &sysctl_net_ipport_check, "I",
182     "");
183 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, last,
184     CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
185     &VNET_NAME(ipport_lastauto), 0, &sysctl_net_ipport_check, "I",
186     "");
187 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hifirst,
188     CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
189     &VNET_NAME(ipport_hifirstauto), 0, &sysctl_net_ipport_check, "I",
190     "");
191 SYSCTL_PROC(_net_inet_ip_portrange, OID_AUTO, hilast,
192     CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW | CTLFLAG_NEEDGIANT,
193     &VNET_NAME(ipport_hilastauto), 0, &sysctl_net_ipport_check, "I",
194     "");
195 SYSCTL_INT(_net_inet_ip_portrange, OID_AUTO, reservedhigh,
196 	CTLFLAG_VNET | CTLFLAG_RW | CTLFLAG_SECURE,
197 	&VNET_NAME(ipport_reservedhigh), 0, "");
198 SYSCTL_INT(_net_inet_ip_portrange, OID_AUTO, reservedlow,
199 	CTLFLAG_RW|CTLFLAG_SECURE, &VNET_NAME(ipport_reservedlow), 0, "");
200 SYSCTL_INT(_net_inet_ip_portrange, OID_AUTO, randomized,
201 	CTLFLAG_VNET | CTLFLAG_RW,
202 	&VNET_NAME(ipport_randomized), 0, "Enable random port allocation");
203 
204 #ifdef RATELIMIT
205 counter_u64_t rate_limit_new;
206 counter_u64_t rate_limit_chg;
207 counter_u64_t rate_limit_active;
208 counter_u64_t rate_limit_alloc_fail;
209 counter_u64_t rate_limit_set_ok;
210 
211 static SYSCTL_NODE(_net_inet_ip, OID_AUTO, rl, CTLFLAG_RD | CTLFLAG_MPSAFE, 0,
212     "IP Rate Limiting");
213 SYSCTL_COUNTER_U64(_net_inet_ip_rl, OID_AUTO, active, CTLFLAG_RD,
214     &rate_limit_active, "Active rate limited connections");
215 SYSCTL_COUNTER_U64(_net_inet_ip_rl, OID_AUTO, alloc_fail, CTLFLAG_RD,
216    &rate_limit_alloc_fail, "Rate limited connection failures");
217 SYSCTL_COUNTER_U64(_net_inet_ip_rl, OID_AUTO, set_ok, CTLFLAG_RD,
218    &rate_limit_set_ok, "Rate limited setting succeeded");
219 SYSCTL_COUNTER_U64(_net_inet_ip_rl, OID_AUTO, newrl, CTLFLAG_RD,
220    &rate_limit_new, "Total Rate limit new attempts");
221 SYSCTL_COUNTER_U64(_net_inet_ip_rl, OID_AUTO, chgrl, CTLFLAG_RD,
222    &rate_limit_chg, "Total Rate limited change attempts");
223 #endif /* RATELIMIT */
224 
225 #endif /* INET */
226 
227 VNET_DEFINE(uint32_t, in_pcbhashseed);
228 static void
229 in_pcbhashseed_init(void)
230 {
231 
232 	V_in_pcbhashseed = arc4random();
233 }
234 VNET_SYSINIT(in_pcbhashseed_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_FIRST,
235     in_pcbhashseed_init, 0);
236 
237 static void in_pcbremhash(struct inpcb *);
238 
239 /*
240  * in_pcb.c: manage the Protocol Control Blocks.
241  *
242  * NOTE: It is assumed that most of these functions will be called with
243  * the pcbinfo lock held, and often, the inpcb lock held, as these utility
244  * functions often modify hash chains or addresses in pcbs.
245  */
246 
247 static struct inpcblbgroup *
248 in_pcblbgroup_alloc(struct inpcblbgrouphead *hdr, struct ucred *cred,
249     u_char vflag, uint16_t port, const union in_dependaddr *addr, int size,
250     uint8_t numa_domain)
251 {
252 	struct inpcblbgroup *grp;
253 	size_t bytes;
254 
255 	bytes = __offsetof(struct inpcblbgroup, il_inp[size]);
256 	grp = malloc(bytes, M_PCB, M_ZERO | M_NOWAIT);
257 	if (grp == NULL)
258 		return (NULL);
259 	grp->il_cred = crhold(cred);
260 	grp->il_vflag = vflag;
261 	grp->il_lport = port;
262 	grp->il_numa_domain = numa_domain;
263 	grp->il_dependladdr = *addr;
264 	grp->il_inpsiz = size;
265 	CK_LIST_INSERT_HEAD(hdr, grp, il_list);
266 	return (grp);
267 }
268 
269 static void
270 in_pcblbgroup_free_deferred(epoch_context_t ctx)
271 {
272 	struct inpcblbgroup *grp;
273 
274 	grp = __containerof(ctx, struct inpcblbgroup, il_epoch_ctx);
275 	crfree(grp->il_cred);
276 	free(grp, M_PCB);
277 }
278 
279 static void
280 in_pcblbgroup_free(struct inpcblbgroup *grp)
281 {
282 
283 	CK_LIST_REMOVE(grp, il_list);
284 	NET_EPOCH_CALL(in_pcblbgroup_free_deferred, &grp->il_epoch_ctx);
285 }
286 
287 static struct inpcblbgroup *
288 in_pcblbgroup_resize(struct inpcblbgrouphead *hdr,
289     struct inpcblbgroup *old_grp, int size)
290 {
291 	struct inpcblbgroup *grp;
292 	int i;
293 
294 	grp = in_pcblbgroup_alloc(hdr, old_grp->il_cred, old_grp->il_vflag,
295 	    old_grp->il_lport, &old_grp->il_dependladdr, size,
296 	    old_grp->il_numa_domain);
297 	if (grp == NULL)
298 		return (NULL);
299 
300 	KASSERT(old_grp->il_inpcnt < grp->il_inpsiz,
301 	    ("invalid new local group size %d and old local group count %d",
302 	     grp->il_inpsiz, old_grp->il_inpcnt));
303 
304 	for (i = 0; i < old_grp->il_inpcnt; ++i)
305 		grp->il_inp[i] = old_grp->il_inp[i];
306 	grp->il_inpcnt = old_grp->il_inpcnt;
307 	in_pcblbgroup_free(old_grp);
308 	return (grp);
309 }
310 
311 /*
312  * PCB at index 'i' is removed from the group. Pull up the ones below il_inp[i]
313  * and shrink group if possible.
314  */
315 static void
316 in_pcblbgroup_reorder(struct inpcblbgrouphead *hdr, struct inpcblbgroup **grpp,
317     int i)
318 {
319 	struct inpcblbgroup *grp, *new_grp;
320 
321 	grp = *grpp;
322 	for (; i + 1 < grp->il_inpcnt; ++i)
323 		grp->il_inp[i] = grp->il_inp[i + 1];
324 	grp->il_inpcnt--;
325 
326 	if (grp->il_inpsiz > INPCBLBGROUP_SIZMIN &&
327 	    grp->il_inpcnt <= grp->il_inpsiz / 4) {
328 		/* Shrink this group. */
329 		new_grp = in_pcblbgroup_resize(hdr, grp, grp->il_inpsiz / 2);
330 		if (new_grp != NULL)
331 			*grpp = new_grp;
332 	}
333 }
334 
335 /*
336  * Add PCB to load balance group for SO_REUSEPORT_LB option.
337  */
338 static int
339 in_pcbinslbgrouphash(struct inpcb *inp, uint8_t numa_domain)
340 {
341 	const static struct timeval interval = { 60, 0 };
342 	static struct timeval lastprint;
343 	struct inpcbinfo *pcbinfo;
344 	struct inpcblbgrouphead *hdr;
345 	struct inpcblbgroup *grp;
346 	uint32_t idx;
347 
348 	pcbinfo = inp->inp_pcbinfo;
349 
350 	INP_WLOCK_ASSERT(inp);
351 	INP_HASH_WLOCK_ASSERT(pcbinfo);
352 
353 #ifdef INET6
354 	/*
355 	 * Don't allow IPv4 mapped INET6 wild socket.
356 	 */
357 	if ((inp->inp_vflag & INP_IPV4) &&
358 	    inp->inp_laddr.s_addr == INADDR_ANY &&
359 	    INP_CHECK_SOCKAF(inp->inp_socket, AF_INET6)) {
360 		return (0);
361 	}
362 #endif
363 
364 	idx = INP_PCBPORTHASH(inp->inp_lport, pcbinfo->ipi_lbgrouphashmask);
365 	hdr = &pcbinfo->ipi_lbgrouphashbase[idx];
366 	CK_LIST_FOREACH(grp, hdr, il_list) {
367 		if (grp->il_cred->cr_prison == inp->inp_cred->cr_prison &&
368 		    grp->il_vflag == inp->inp_vflag &&
369 		    grp->il_lport == inp->inp_lport &&
370 		    grp->il_numa_domain == numa_domain &&
371 		    memcmp(&grp->il_dependladdr,
372 		    &inp->inp_inc.inc_ie.ie_dependladdr,
373 		    sizeof(grp->il_dependladdr)) == 0) {
374 			break;
375 		}
376 	}
377 	if (grp == NULL) {
378 		/* Create new load balance group. */
379 		grp = in_pcblbgroup_alloc(hdr, inp->inp_cred, inp->inp_vflag,
380 		    inp->inp_lport, &inp->inp_inc.inc_ie.ie_dependladdr,
381 		    INPCBLBGROUP_SIZMIN, numa_domain);
382 		if (grp == NULL)
383 			return (ENOBUFS);
384 	} else if (grp->il_inpcnt == grp->il_inpsiz) {
385 		if (grp->il_inpsiz >= INPCBLBGROUP_SIZMAX) {
386 			if (ratecheck(&lastprint, &interval))
387 				printf("lb group port %d, limit reached\n",
388 				    ntohs(grp->il_lport));
389 			return (0);
390 		}
391 
392 		/* Expand this local group. */
393 		grp = in_pcblbgroup_resize(hdr, grp, grp->il_inpsiz * 2);
394 		if (grp == NULL)
395 			return (ENOBUFS);
396 	}
397 
398 	KASSERT(grp->il_inpcnt < grp->il_inpsiz,
399 	    ("invalid local group size %d and count %d", grp->il_inpsiz,
400 	    grp->il_inpcnt));
401 
402 	grp->il_inp[grp->il_inpcnt] = inp;
403 	grp->il_inpcnt++;
404 	inp->inp_flags |= INP_INLBGROUP;
405 	return (0);
406 }
407 
408 /*
409  * Remove PCB from load balance group.
410  */
411 static void
412 in_pcbremlbgrouphash(struct inpcb *inp)
413 {
414 	struct inpcbinfo *pcbinfo;
415 	struct inpcblbgrouphead *hdr;
416 	struct inpcblbgroup *grp;
417 	int i;
418 
419 	pcbinfo = inp->inp_pcbinfo;
420 
421 	INP_WLOCK_ASSERT(inp);
422 	MPASS(inp->inp_flags & INP_INLBGROUP);
423 	INP_HASH_WLOCK_ASSERT(pcbinfo);
424 
425 	hdr = &pcbinfo->ipi_lbgrouphashbase[
426 	    INP_PCBPORTHASH(inp->inp_lport, pcbinfo->ipi_lbgrouphashmask)];
427 	CK_LIST_FOREACH(grp, hdr, il_list) {
428 		for (i = 0; i < grp->il_inpcnt; ++i) {
429 			if (grp->il_inp[i] != inp)
430 				continue;
431 
432 			if (grp->il_inpcnt == 1) {
433 				/* We are the last, free this local group. */
434 				in_pcblbgroup_free(grp);
435 			} else {
436 				/* Pull up inpcbs, shrink group if possible. */
437 				in_pcblbgroup_reorder(hdr, &grp, i);
438 			}
439 			inp->inp_flags &= ~INP_INLBGROUP;
440 			return;
441 		}
442 	}
443 	KASSERT(0, ("%s: did not find %p", __func__, inp));
444 }
445 
446 int
447 in_pcblbgroup_numa(struct inpcb *inp, int arg)
448 {
449 	struct inpcbinfo *pcbinfo;
450 	struct inpcblbgrouphead *hdr;
451 	struct inpcblbgroup *grp;
452 	int err, i;
453 	uint8_t numa_domain;
454 
455 	switch (arg) {
456 	case TCP_REUSPORT_LB_NUMA_NODOM:
457 		numa_domain = M_NODOM;
458 		break;
459 	case TCP_REUSPORT_LB_NUMA_CURDOM:
460 		numa_domain = PCPU_GET(domain);
461 		break;
462 	default:
463 		if (arg < 0 || arg >= vm_ndomains)
464 			return (EINVAL);
465 		numa_domain = arg;
466 	}
467 
468 	err = 0;
469 	pcbinfo = inp->inp_pcbinfo;
470 	INP_WLOCK_ASSERT(inp);
471 	INP_HASH_WLOCK(pcbinfo);
472 	hdr = &pcbinfo->ipi_lbgrouphashbase[
473 	    INP_PCBPORTHASH(inp->inp_lport, pcbinfo->ipi_lbgrouphashmask)];
474 	CK_LIST_FOREACH(grp, hdr, il_list) {
475 		for (i = 0; i < grp->il_inpcnt; ++i) {
476 			if (grp->il_inp[i] != inp)
477 				continue;
478 
479 			if (grp->il_numa_domain == numa_domain) {
480 				goto abort_with_hash_wlock;
481 			}
482 
483 			/* Remove it from the old group. */
484 			in_pcbremlbgrouphash(inp);
485 
486 			/* Add it to the new group based on numa domain. */
487 			in_pcbinslbgrouphash(inp, numa_domain);
488 			goto abort_with_hash_wlock;
489 		}
490 	}
491 	err = ENOENT;
492 abort_with_hash_wlock:
493 	INP_HASH_WUNLOCK(pcbinfo);
494 	return (err);
495 }
496 
497 /* Make sure it is safe to use hashinit(9) on CK_LIST. */
498 CTASSERT(sizeof(struct inpcbhead) == sizeof(LIST_HEAD(, inpcb)));
499 
500 /*
501  * Initialize an inpcbinfo - a per-VNET instance of connections db.
502  */
503 void
504 in_pcbinfo_init(struct inpcbinfo *pcbinfo, struct inpcbstorage *pcbstor,
505     u_int hash_nelements, u_int porthash_nelements)
506 {
507 
508 	mtx_init(&pcbinfo->ipi_lock, pcbstor->ips_infolock_name, NULL, MTX_DEF);
509 	mtx_init(&pcbinfo->ipi_hash_lock, pcbstor->ips_hashlock_name,
510 	    NULL, MTX_DEF);
511 #ifdef VIMAGE
512 	pcbinfo->ipi_vnet = curvnet;
513 #endif
514 	CK_LIST_INIT(&pcbinfo->ipi_listhead);
515 	pcbinfo->ipi_count = 0;
516 	pcbinfo->ipi_hash_exact = hashinit(hash_nelements, M_PCB,
517 	    &pcbinfo->ipi_hashmask);
518 	pcbinfo->ipi_hash_wild = hashinit(hash_nelements, M_PCB,
519 	    &pcbinfo->ipi_hashmask);
520 	porthash_nelements = imin(porthash_nelements, IPPORT_MAX + 1);
521 	pcbinfo->ipi_porthashbase = hashinit(porthash_nelements, M_PCB,
522 	    &pcbinfo->ipi_porthashmask);
523 	pcbinfo->ipi_lbgrouphashbase = hashinit(porthash_nelements, M_PCB,
524 	    &pcbinfo->ipi_lbgrouphashmask);
525 	pcbinfo->ipi_zone = pcbstor->ips_zone;
526 	pcbinfo->ipi_portzone = pcbstor->ips_portzone;
527 	pcbinfo->ipi_smr = uma_zone_get_smr(pcbinfo->ipi_zone);
528 }
529 
530 /*
531  * Destroy an inpcbinfo.
532  */
533 void
534 in_pcbinfo_destroy(struct inpcbinfo *pcbinfo)
535 {
536 
537 	KASSERT(pcbinfo->ipi_count == 0,
538 	    ("%s: ipi_count = %u", __func__, pcbinfo->ipi_count));
539 
540 	hashdestroy(pcbinfo->ipi_hash_exact, M_PCB, pcbinfo->ipi_hashmask);
541 	hashdestroy(pcbinfo->ipi_hash_wild, M_PCB, pcbinfo->ipi_hashmask);
542 	hashdestroy(pcbinfo->ipi_porthashbase, M_PCB,
543 	    pcbinfo->ipi_porthashmask);
544 	hashdestroy(pcbinfo->ipi_lbgrouphashbase, M_PCB,
545 	    pcbinfo->ipi_lbgrouphashmask);
546 	mtx_destroy(&pcbinfo->ipi_hash_lock);
547 	mtx_destroy(&pcbinfo->ipi_lock);
548 }
549 
550 /*
551  * Initialize a pcbstorage - per protocol zones to allocate inpcbs.
552  */
553 static void inpcb_fini(void *, int);
554 void
555 in_pcbstorage_init(void *arg)
556 {
557 	struct inpcbstorage *pcbstor = arg;
558 
559 	pcbstor->ips_zone = uma_zcreate(pcbstor->ips_zone_name,
560 	    pcbstor->ips_size, NULL, NULL, pcbstor->ips_pcbinit,
561 	    inpcb_fini, UMA_ALIGN_CACHE, UMA_ZONE_SMR);
562 	pcbstor->ips_portzone = uma_zcreate(pcbstor->ips_portzone_name,
563 	    sizeof(struct inpcbport), NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, 0);
564 	uma_zone_set_smr(pcbstor->ips_portzone,
565 	    uma_zone_get_smr(pcbstor->ips_zone));
566 }
567 
568 /*
569  * Destroy a pcbstorage - used by unloadable protocols.
570  */
571 void
572 in_pcbstorage_destroy(void *arg)
573 {
574 	struct inpcbstorage *pcbstor = arg;
575 
576 	uma_zdestroy(pcbstor->ips_zone);
577 	uma_zdestroy(pcbstor->ips_portzone);
578 }
579 
580 /*
581  * Allocate a PCB and associate it with the socket.
582  * On success return with the PCB locked.
583  */
584 int
585 in_pcballoc(struct socket *so, struct inpcbinfo *pcbinfo)
586 {
587 	struct inpcb *inp;
588 #if defined(IPSEC) || defined(IPSEC_SUPPORT) || defined(MAC)
589 	int error;
590 #endif
591 
592 	inp = uma_zalloc_smr(pcbinfo->ipi_zone, M_NOWAIT);
593 	if (inp == NULL)
594 		return (ENOBUFS);
595 	bzero(&inp->inp_start_zero, inp_zero_size);
596 #ifdef NUMA
597 	inp->inp_numa_domain = M_NODOM;
598 #endif
599 	inp->inp_pcbinfo = pcbinfo;
600 	inp->inp_socket = so;
601 	inp->inp_cred = crhold(so->so_cred);
602 	inp->inp_inc.inc_fibnum = so->so_fibnum;
603 #ifdef MAC
604 	error = mac_inpcb_init(inp, M_NOWAIT);
605 	if (error != 0)
606 		goto out;
607 	mac_inpcb_create(so, inp);
608 #endif
609 #if defined(IPSEC) || defined(IPSEC_SUPPORT)
610 	error = ipsec_init_pcbpolicy(inp);
611 	if (error != 0) {
612 #ifdef MAC
613 		mac_inpcb_destroy(inp);
614 #endif
615 		goto out;
616 	}
617 #endif /*IPSEC*/
618 #ifdef INET6
619 	if (INP_SOCKAF(so) == AF_INET6) {
620 		inp->inp_vflag |= INP_IPV6PROTO | INP_IPV6;
621 		if (V_ip6_v6only)
622 			inp->inp_flags |= IN6P_IPV6_V6ONLY;
623 #ifdef INET
624 		else
625 			inp->inp_vflag |= INP_IPV4;
626 #endif
627 		if (V_ip6_auto_flowlabel)
628 			inp->inp_flags |= IN6P_AUTOFLOWLABEL;
629 		inp->in6p_hops = -1;	/* use kernel default */
630 	}
631 #endif
632 #if defined(INET) && defined(INET6)
633 	else
634 #endif
635 #ifdef INET
636 		inp->inp_vflag |= INP_IPV4;
637 #endif
638 	inp->inp_smr = SMR_SEQ_INVALID;
639 
640 	/*
641 	 * Routes in inpcb's can cache L2 as well; they are guaranteed
642 	 * to be cleaned up.
643 	 */
644 	inp->inp_route.ro_flags = RT_LLE_CACHE;
645 	refcount_init(&inp->inp_refcount, 1);   /* Reference from socket. */
646 	INP_WLOCK(inp);
647 	INP_INFO_WLOCK(pcbinfo);
648 	pcbinfo->ipi_count++;
649 	inp->inp_gencnt = ++pcbinfo->ipi_gencnt;
650 	CK_LIST_INSERT_HEAD(&pcbinfo->ipi_listhead, inp, inp_list);
651 	INP_INFO_WUNLOCK(pcbinfo);
652 	so->so_pcb = inp;
653 
654 	return (0);
655 
656 #if defined(IPSEC) || defined(IPSEC_SUPPORT) || defined(MAC)
657 out:
658 	uma_zfree_smr(pcbinfo->ipi_zone, inp);
659 	return (error);
660 #endif
661 }
662 
663 #ifdef INET
664 int
665 in_pcbbind(struct inpcb *inp, struct sockaddr_in *sin, struct ucred *cred)
666 {
667 	int anonport, error;
668 
669 	KASSERT(sin == NULL || sin->sin_family == AF_INET,
670 	    ("%s: invalid address family for %p", __func__, sin));
671 	KASSERT(sin == NULL || sin->sin_len == sizeof(struct sockaddr_in),
672 	    ("%s: invalid address length for %p", __func__, sin));
673 	INP_WLOCK_ASSERT(inp);
674 	INP_HASH_WLOCK_ASSERT(inp->inp_pcbinfo);
675 
676 	if (inp->inp_lport != 0 || inp->inp_laddr.s_addr != INADDR_ANY)
677 		return (EINVAL);
678 	anonport = sin == NULL || sin->sin_port == 0;
679 	error = in_pcbbind_setup(inp, sin, &inp->inp_laddr.s_addr,
680 	    &inp->inp_lport, cred);
681 	if (error)
682 		return (error);
683 	if (in_pcbinshash(inp) != 0) {
684 		inp->inp_laddr.s_addr = INADDR_ANY;
685 		inp->inp_lport = 0;
686 		return (EAGAIN);
687 	}
688 	if (anonport)
689 		inp->inp_flags |= INP_ANONPORT;
690 	return (0);
691 }
692 #endif
693 
694 #if defined(INET) || defined(INET6)
695 /*
696  * Assign a local port like in_pcb_lport(), but also used with connect()
697  * and a foreign address and port.  If fsa is non-NULL, choose a local port
698  * that is unused with those, otherwise one that is completely unused.
699  * lsa can be NULL for IPv6.
700  */
701 int
702 in_pcb_lport_dest(struct inpcb *inp, struct sockaddr *lsa, u_short *lportp,
703     struct sockaddr *fsa, u_short fport, struct ucred *cred, int lookupflags)
704 {
705 	struct inpcbinfo *pcbinfo;
706 	struct inpcb *tmpinp;
707 	unsigned short *lastport;
708 	int count, error;
709 	u_short aux, first, last, lport;
710 #ifdef INET
711 	struct in_addr laddr, faddr;
712 #endif
713 #ifdef INET6
714 	struct in6_addr *laddr6, *faddr6;
715 #endif
716 
717 	pcbinfo = inp->inp_pcbinfo;
718 
719 	/*
720 	 * Because no actual state changes occur here, a global write lock on
721 	 * the pcbinfo isn't required.
722 	 */
723 	INP_LOCK_ASSERT(inp);
724 	INP_HASH_LOCK_ASSERT(pcbinfo);
725 
726 	if (inp->inp_flags & INP_HIGHPORT) {
727 		first = V_ipport_hifirstauto;	/* sysctl */
728 		last  = V_ipport_hilastauto;
729 		lastport = &pcbinfo->ipi_lasthi;
730 	} else if (inp->inp_flags & INP_LOWPORT) {
731 		error = priv_check_cred(cred, PRIV_NETINET_RESERVEDPORT);
732 		if (error)
733 			return (error);
734 		first = V_ipport_lowfirstauto;	/* 1023 */
735 		last  = V_ipport_lowlastauto;	/* 600 */
736 		lastport = &pcbinfo->ipi_lastlow;
737 	} else {
738 		first = V_ipport_firstauto;	/* sysctl */
739 		last  = V_ipport_lastauto;
740 		lastport = &pcbinfo->ipi_lastport;
741 	}
742 
743 	/*
744 	 * Instead of having two loops further down counting up or down
745 	 * make sure that first is always <= last and go with only one
746 	 * code path implementing all logic.
747 	 */
748 	if (first > last) {
749 		aux = first;
750 		first = last;
751 		last = aux;
752 	}
753 
754 #ifdef INET
755 	laddr.s_addr = INADDR_ANY;	/* used by INET6+INET below too */
756 	if ((inp->inp_vflag & (INP_IPV4|INP_IPV6)) == INP_IPV4) {
757 		if (lsa != NULL)
758 			laddr = ((struct sockaddr_in *)lsa)->sin_addr;
759 		if (fsa != NULL)
760 			faddr = ((struct sockaddr_in *)fsa)->sin_addr;
761 	}
762 #endif
763 #ifdef INET6
764 	laddr6 = NULL;
765 	if ((inp->inp_vflag & INP_IPV6) != 0) {
766 		if (lsa != NULL)
767 			laddr6 = &((struct sockaddr_in6 *)lsa)->sin6_addr;
768 		if (fsa != NULL)
769 			faddr6 = &((struct sockaddr_in6 *)fsa)->sin6_addr;
770 	}
771 #endif
772 
773 	tmpinp = NULL;
774 	lport = *lportp;
775 
776 	if (V_ipport_randomized)
777 		*lastport = first + (arc4random() % (last - first));
778 
779 	count = last - first;
780 
781 	do {
782 		if (count-- < 0)	/* completely used? */
783 			return (EADDRNOTAVAIL);
784 		++*lastport;
785 		if (*lastport < first || *lastport > last)
786 			*lastport = first;
787 		lport = htons(*lastport);
788 
789 		if (fsa != NULL) {
790 #ifdef INET
791 			if (lsa->sa_family == AF_INET) {
792 				tmpinp = in_pcblookup_hash_locked(pcbinfo,
793 				    faddr, fport, laddr, lport, lookupflags,
794 				    M_NODOM);
795 			}
796 #endif
797 #ifdef INET6
798 			if (lsa->sa_family == AF_INET6) {
799 				tmpinp = in6_pcblookup_hash_locked(pcbinfo,
800 				    faddr6, fport, laddr6, lport, lookupflags,
801 				    M_NODOM);
802 			}
803 #endif
804 		} else {
805 #ifdef INET6
806 			if ((inp->inp_vflag & INP_IPV6) != 0) {
807 				tmpinp = in6_pcblookup_local(pcbinfo,
808 				    &inp->in6p_laddr, lport, lookupflags, cred);
809 #ifdef INET
810 				if (tmpinp == NULL &&
811 				    (inp->inp_vflag & INP_IPV4))
812 					tmpinp = in_pcblookup_local(pcbinfo,
813 					    laddr, lport, lookupflags, cred);
814 #endif
815 			}
816 #endif
817 #if defined(INET) && defined(INET6)
818 			else
819 #endif
820 #ifdef INET
821 				tmpinp = in_pcblookup_local(pcbinfo, laddr,
822 				    lport, lookupflags, cred);
823 #endif
824 		}
825 	} while (tmpinp != NULL);
826 
827 	*lportp = lport;
828 
829 	return (0);
830 }
831 
832 /*
833  * Select a local port (number) to use.
834  */
835 int
836 in_pcb_lport(struct inpcb *inp, struct in_addr *laddrp, u_short *lportp,
837     struct ucred *cred, int lookupflags)
838 {
839 	struct sockaddr_in laddr;
840 
841 	if (laddrp) {
842 		bzero(&laddr, sizeof(laddr));
843 		laddr.sin_family = AF_INET;
844 		laddr.sin_addr = *laddrp;
845 	}
846 	return (in_pcb_lport_dest(inp, laddrp ? (struct sockaddr *) &laddr :
847 	    NULL, lportp, NULL, 0, cred, lookupflags));
848 }
849 #endif /* INET || INET6 */
850 
851 #ifdef INET
852 /*
853  * Set up a bind operation on a PCB, performing port allocation
854  * as required, but do not actually modify the PCB. Callers can
855  * either complete the bind by setting inp_laddr/inp_lport and
856  * calling in_pcbinshash(), or they can just use the resulting
857  * port and address to authorise the sending of a once-off packet.
858  *
859  * On error, the values of *laddrp and *lportp are not changed.
860  */
861 int
862 in_pcbbind_setup(struct inpcb *inp, struct sockaddr_in *sin, in_addr_t *laddrp,
863     u_short *lportp, struct ucred *cred)
864 {
865 	struct socket *so = inp->inp_socket;
866 	struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
867 	struct in_addr laddr;
868 	u_short lport = 0;
869 	int lookupflags = 0, reuseport = (so->so_options & SO_REUSEPORT);
870 	int error;
871 
872 	/*
873 	 * XXX: Maybe we could let SO_REUSEPORT_LB set SO_REUSEPORT bit here
874 	 * so that we don't have to add to the (already messy) code below.
875 	 */
876 	int reuseport_lb = (so->so_options & SO_REUSEPORT_LB);
877 
878 	/*
879 	 * No state changes, so read locks are sufficient here.
880 	 */
881 	INP_LOCK_ASSERT(inp);
882 	INP_HASH_LOCK_ASSERT(pcbinfo);
883 
884 	laddr.s_addr = *laddrp;
885 	if (sin != NULL && laddr.s_addr != INADDR_ANY)
886 		return (EINVAL);
887 	if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT|SO_REUSEPORT_LB)) == 0)
888 		lookupflags = INPLOOKUP_WILDCARD;
889 	if (sin == NULL) {
890 		if ((error = prison_local_ip4(cred, &laddr)) != 0)
891 			return (error);
892 	} else {
893 		KASSERT(sin->sin_family == AF_INET,
894 		    ("%s: invalid family for address %p", __func__, sin));
895 		KASSERT(sin->sin_len == sizeof(*sin),
896 		    ("%s: invalid length for address %p", __func__, sin));
897 
898 		error = prison_local_ip4(cred, &sin->sin_addr);
899 		if (error)
900 			return (error);
901 		if (sin->sin_port != *lportp) {
902 			/* Don't allow the port to change. */
903 			if (*lportp != 0)
904 				return (EINVAL);
905 			lport = sin->sin_port;
906 		}
907 		/* NB: lport is left as 0 if the port isn't being changed. */
908 		if (IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
909 			/*
910 			 * Treat SO_REUSEADDR as SO_REUSEPORT for multicast;
911 			 * allow complete duplication of binding if
912 			 * SO_REUSEPORT is set, or if SO_REUSEADDR is set
913 			 * and a multicast address is bound on both
914 			 * new and duplicated sockets.
915 			 */
916 			if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) != 0)
917 				reuseport = SO_REUSEADDR|SO_REUSEPORT;
918 			/*
919 			 * XXX: How to deal with SO_REUSEPORT_LB here?
920 			 * Treat same as SO_REUSEPORT for now.
921 			 */
922 			if ((so->so_options &
923 			    (SO_REUSEADDR|SO_REUSEPORT_LB)) != 0)
924 				reuseport_lb = SO_REUSEADDR|SO_REUSEPORT_LB;
925 		} else if (sin->sin_addr.s_addr != INADDR_ANY) {
926 			sin->sin_port = 0;		/* yech... */
927 			bzero(&sin->sin_zero, sizeof(sin->sin_zero));
928 			/*
929 			 * Is the address a local IP address?
930 			 * If INP_BINDANY is set, then the socket may be bound
931 			 * to any endpoint address, local or not.
932 			 */
933 			if ((inp->inp_flags & INP_BINDANY) == 0 &&
934 			    ifa_ifwithaddr_check((struct sockaddr *)sin) == 0)
935 				return (EADDRNOTAVAIL);
936 		}
937 		laddr = sin->sin_addr;
938 		if (lport) {
939 			struct inpcb *t;
940 
941 			/* GROSS */
942 			if (ntohs(lport) <= V_ipport_reservedhigh &&
943 			    ntohs(lport) >= V_ipport_reservedlow &&
944 			    priv_check_cred(cred, PRIV_NETINET_RESERVEDPORT))
945 				return (EACCES);
946 			if (!IN_MULTICAST(ntohl(sin->sin_addr.s_addr)) &&
947 			    priv_check_cred(inp->inp_cred, PRIV_NETINET_REUSEPORT) != 0) {
948 				t = in_pcblookup_local(pcbinfo, sin->sin_addr,
949 				    lport, INPLOOKUP_WILDCARD, cred);
950 	/*
951 	 * XXX
952 	 * This entire block sorely needs a rewrite.
953 	 */
954 				if (t != NULL &&
955 				    (so->so_type != SOCK_STREAM ||
956 				     ntohl(t->inp_faddr.s_addr) == INADDR_ANY) &&
957 				    (ntohl(sin->sin_addr.s_addr) != INADDR_ANY ||
958 				     ntohl(t->inp_laddr.s_addr) != INADDR_ANY ||
959 				     (t->inp_socket->so_options & SO_REUSEPORT) ||
960 				     (t->inp_socket->so_options & SO_REUSEPORT_LB) == 0) &&
961 				    (inp->inp_cred->cr_uid !=
962 				     t->inp_cred->cr_uid))
963 					return (EADDRINUSE);
964 			}
965 			t = in_pcblookup_local(pcbinfo, sin->sin_addr,
966 			    lport, lookupflags, cred);
967 			if (t != NULL && (reuseport & t->inp_socket->so_options) == 0 &&
968 			    (reuseport_lb & t->inp_socket->so_options) == 0) {
969 #ifdef INET6
970 				if (ntohl(sin->sin_addr.s_addr) !=
971 				    INADDR_ANY ||
972 				    ntohl(t->inp_laddr.s_addr) !=
973 				    INADDR_ANY ||
974 				    (inp->inp_vflag & INP_IPV6PROTO) == 0 ||
975 				    (t->inp_vflag & INP_IPV6PROTO) == 0)
976 #endif
977 						return (EADDRINUSE);
978 			}
979 		}
980 	}
981 	if (*lportp != 0)
982 		lport = *lportp;
983 	if (lport == 0) {
984 		error = in_pcb_lport(inp, &laddr, &lport, cred, lookupflags);
985 		if (error != 0)
986 			return (error);
987 	}
988 	*laddrp = laddr.s_addr;
989 	*lportp = lport;
990 	return (0);
991 }
992 
993 /*
994  * Connect from a socket to a specified address.
995  * Both address and port must be specified in argument sin.
996  * If don't have a local address for this socket yet,
997  * then pick one.
998  */
999 int
1000 in_pcbconnect(struct inpcb *inp, struct sockaddr_in *sin, struct ucred *cred,
1001     bool rehash __unused)
1002 {
1003 	u_short lport, fport;
1004 	in_addr_t laddr, faddr;
1005 	int anonport, error;
1006 
1007 	INP_WLOCK_ASSERT(inp);
1008 	INP_HASH_WLOCK_ASSERT(inp->inp_pcbinfo);
1009 	KASSERT(in_nullhost(inp->inp_faddr),
1010 	    ("%s: inp is already connected", __func__));
1011 
1012 	lport = inp->inp_lport;
1013 	laddr = inp->inp_laddr.s_addr;
1014 	anonport = (lport == 0);
1015 	error = in_pcbconnect_setup(inp, sin, &laddr, &lport, &faddr, &fport,
1016 	    cred);
1017 	if (error)
1018 		return (error);
1019 
1020 	inp->inp_faddr.s_addr = faddr;
1021 	inp->inp_fport = fport;
1022 
1023 	/* Do the initial binding of the local address if required. */
1024 	if (inp->inp_laddr.s_addr == INADDR_ANY && inp->inp_lport == 0) {
1025 		inp->inp_lport = lport;
1026 		inp->inp_laddr.s_addr = laddr;
1027 		if (in_pcbinshash(inp) != 0) {
1028 			inp->inp_laddr.s_addr = inp->inp_faddr.s_addr =
1029 			    INADDR_ANY;
1030 			inp->inp_lport = inp->inp_fport = 0;
1031 			return (EAGAIN);
1032 		}
1033 	} else {
1034 		inp->inp_lport = lport;
1035 		inp->inp_laddr.s_addr = laddr;
1036 		if ((inp->inp_flags & INP_INHASHLIST) != 0)
1037 			in_pcbrehash(inp);
1038 		else
1039 			in_pcbinshash(inp);
1040 	}
1041 
1042 	if (anonport)
1043 		inp->inp_flags |= INP_ANONPORT;
1044 	return (0);
1045 }
1046 
1047 /*
1048  * Do proper source address selection on an unbound socket in case
1049  * of connect. Take jails into account as well.
1050  */
1051 int
1052 in_pcbladdr(struct inpcb *inp, struct in_addr *faddr, struct in_addr *laddr,
1053     struct ucred *cred)
1054 {
1055 	struct ifaddr *ifa;
1056 	struct sockaddr *sa;
1057 	struct sockaddr_in *sin, dst;
1058 	struct nhop_object *nh;
1059 	int error;
1060 
1061 	NET_EPOCH_ASSERT();
1062 	KASSERT(laddr != NULL, ("%s: laddr NULL", __func__));
1063 
1064 	/*
1065 	 * Bypass source address selection and use the primary jail IP
1066 	 * if requested.
1067 	 */
1068 	if (!prison_saddrsel_ip4(cred, laddr))
1069 		return (0);
1070 
1071 	error = 0;
1072 
1073 	nh = NULL;
1074 	bzero(&dst, sizeof(dst));
1075 	sin = &dst;
1076 	sin->sin_family = AF_INET;
1077 	sin->sin_len = sizeof(struct sockaddr_in);
1078 	sin->sin_addr.s_addr = faddr->s_addr;
1079 
1080 	/*
1081 	 * If route is known our src addr is taken from the i/f,
1082 	 * else punt.
1083 	 *
1084 	 * Find out route to destination.
1085 	 */
1086 	if ((inp->inp_socket->so_options & SO_DONTROUTE) == 0)
1087 		nh = fib4_lookup(inp->inp_inc.inc_fibnum, *faddr,
1088 		    0, NHR_NONE, 0);
1089 
1090 	/*
1091 	 * If we found a route, use the address corresponding to
1092 	 * the outgoing interface.
1093 	 *
1094 	 * Otherwise assume faddr is reachable on a directly connected
1095 	 * network and try to find a corresponding interface to take
1096 	 * the source address from.
1097 	 */
1098 	if (nh == NULL || nh->nh_ifp == NULL) {
1099 		struct in_ifaddr *ia;
1100 		struct ifnet *ifp;
1101 
1102 		ia = ifatoia(ifa_ifwithdstaddr((struct sockaddr *)sin,
1103 					inp->inp_socket->so_fibnum));
1104 		if (ia == NULL) {
1105 			ia = ifatoia(ifa_ifwithnet((struct sockaddr *)sin, 0,
1106 						inp->inp_socket->so_fibnum));
1107 		}
1108 		if (ia == NULL) {
1109 			error = ENETUNREACH;
1110 			goto done;
1111 		}
1112 
1113 		if (!prison_flag(cred, PR_IP4)) {
1114 			laddr->s_addr = ia->ia_addr.sin_addr.s_addr;
1115 			goto done;
1116 		}
1117 
1118 		ifp = ia->ia_ifp;
1119 		ia = NULL;
1120 		CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
1121 			sa = ifa->ifa_addr;
1122 			if (sa->sa_family != AF_INET)
1123 				continue;
1124 			sin = (struct sockaddr_in *)sa;
1125 			if (prison_check_ip4(cred, &sin->sin_addr) == 0) {
1126 				ia = (struct in_ifaddr *)ifa;
1127 				break;
1128 			}
1129 		}
1130 		if (ia != NULL) {
1131 			laddr->s_addr = ia->ia_addr.sin_addr.s_addr;
1132 			goto done;
1133 		}
1134 
1135 		/* 3. As a last resort return the 'default' jail address. */
1136 		error = prison_get_ip4(cred, laddr);
1137 		goto done;
1138 	}
1139 
1140 	/*
1141 	 * If the outgoing interface on the route found is not
1142 	 * a loopback interface, use the address from that interface.
1143 	 * In case of jails do those three steps:
1144 	 * 1. check if the interface address belongs to the jail. If so use it.
1145 	 * 2. check if we have any address on the outgoing interface
1146 	 *    belonging to this jail. If so use it.
1147 	 * 3. as a last resort return the 'default' jail address.
1148 	 */
1149 	if ((nh->nh_ifp->if_flags & IFF_LOOPBACK) == 0) {
1150 		struct in_ifaddr *ia;
1151 		struct ifnet *ifp;
1152 
1153 		/* If not jailed, use the default returned. */
1154 		if (!prison_flag(cred, PR_IP4)) {
1155 			ia = (struct in_ifaddr *)nh->nh_ifa;
1156 			laddr->s_addr = ia->ia_addr.sin_addr.s_addr;
1157 			goto done;
1158 		}
1159 
1160 		/* Jailed. */
1161 		/* 1. Check if the iface address belongs to the jail. */
1162 		sin = (struct sockaddr_in *)nh->nh_ifa->ifa_addr;
1163 		if (prison_check_ip4(cred, &sin->sin_addr) == 0) {
1164 			ia = (struct in_ifaddr *)nh->nh_ifa;
1165 			laddr->s_addr = ia->ia_addr.sin_addr.s_addr;
1166 			goto done;
1167 		}
1168 
1169 		/*
1170 		 * 2. Check if we have any address on the outgoing interface
1171 		 *    belonging to this jail.
1172 		 */
1173 		ia = NULL;
1174 		ifp = nh->nh_ifp;
1175 		CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
1176 			sa = ifa->ifa_addr;
1177 			if (sa->sa_family != AF_INET)
1178 				continue;
1179 			sin = (struct sockaddr_in *)sa;
1180 			if (prison_check_ip4(cred, &sin->sin_addr) == 0) {
1181 				ia = (struct in_ifaddr *)ifa;
1182 				break;
1183 			}
1184 		}
1185 		if (ia != NULL) {
1186 			laddr->s_addr = ia->ia_addr.sin_addr.s_addr;
1187 			goto done;
1188 		}
1189 
1190 		/* 3. As a last resort return the 'default' jail address. */
1191 		error = prison_get_ip4(cred, laddr);
1192 		goto done;
1193 	}
1194 
1195 	/*
1196 	 * The outgoing interface is marked with 'loopback net', so a route
1197 	 * to ourselves is here.
1198 	 * Try to find the interface of the destination address and then
1199 	 * take the address from there. That interface is not necessarily
1200 	 * a loopback interface.
1201 	 * In case of jails, check that it is an address of the jail
1202 	 * and if we cannot find, fall back to the 'default' jail address.
1203 	 */
1204 	if ((nh->nh_ifp->if_flags & IFF_LOOPBACK) != 0) {
1205 		struct in_ifaddr *ia;
1206 
1207 		ia = ifatoia(ifa_ifwithdstaddr(sintosa(&dst),
1208 					inp->inp_socket->so_fibnum));
1209 		if (ia == NULL)
1210 			ia = ifatoia(ifa_ifwithnet(sintosa(&dst), 0,
1211 						inp->inp_socket->so_fibnum));
1212 		if (ia == NULL)
1213 			ia = ifatoia(ifa_ifwithaddr(sintosa(&dst)));
1214 
1215 		if (!prison_flag(cred, PR_IP4)) {
1216 			if (ia == NULL) {
1217 				error = ENETUNREACH;
1218 				goto done;
1219 			}
1220 			laddr->s_addr = ia->ia_addr.sin_addr.s_addr;
1221 			goto done;
1222 		}
1223 
1224 		/* Jailed. */
1225 		if (ia != NULL) {
1226 			struct ifnet *ifp;
1227 
1228 			ifp = ia->ia_ifp;
1229 			ia = NULL;
1230 			CK_STAILQ_FOREACH(ifa, &ifp->if_addrhead, ifa_link) {
1231 				sa = ifa->ifa_addr;
1232 				if (sa->sa_family != AF_INET)
1233 					continue;
1234 				sin = (struct sockaddr_in *)sa;
1235 				if (prison_check_ip4(cred,
1236 				    &sin->sin_addr) == 0) {
1237 					ia = (struct in_ifaddr *)ifa;
1238 					break;
1239 				}
1240 			}
1241 			if (ia != NULL) {
1242 				laddr->s_addr = ia->ia_addr.sin_addr.s_addr;
1243 				goto done;
1244 			}
1245 		}
1246 
1247 		/* 3. As a last resort return the 'default' jail address. */
1248 		error = prison_get_ip4(cred, laddr);
1249 		goto done;
1250 	}
1251 
1252 done:
1253 	if (error == 0 && laddr->s_addr == INADDR_ANY)
1254 		return (EHOSTUNREACH);
1255 	return (error);
1256 }
1257 
1258 /*
1259  * Set up for a connect from a socket to the specified address.
1260  * On entry, *laddrp and *lportp should contain the current local
1261  * address and port for the PCB; these are updated to the values
1262  * that should be placed in inp_laddr and inp_lport to complete
1263  * the connect.
1264  *
1265  * On success, *faddrp and *fportp will be set to the remote address
1266  * and port. These are not updated in the error case.
1267  */
1268 int
1269 in_pcbconnect_setup(struct inpcb *inp, struct sockaddr_in *sin,
1270     in_addr_t *laddrp, u_short *lportp, in_addr_t *faddrp, u_short *fportp,
1271     struct ucred *cred)
1272 {
1273 	struct in_ifaddr *ia;
1274 	struct in_addr laddr, faddr;
1275 	u_short lport, fport;
1276 	int error;
1277 
1278 	KASSERT(sin->sin_family == AF_INET,
1279 	    ("%s: invalid address family for %p", __func__, sin));
1280 	KASSERT(sin->sin_len == sizeof(*sin),
1281 	    ("%s: invalid address length for %p", __func__, sin));
1282 
1283 	/*
1284 	 * Because a global state change doesn't actually occur here, a read
1285 	 * lock is sufficient.
1286 	 */
1287 	NET_EPOCH_ASSERT();
1288 	INP_LOCK_ASSERT(inp);
1289 	INP_HASH_LOCK_ASSERT(inp->inp_pcbinfo);
1290 
1291 	if (sin->sin_port == 0)
1292 		return (EADDRNOTAVAIL);
1293 	laddr.s_addr = *laddrp;
1294 	lport = *lportp;
1295 	faddr = sin->sin_addr;
1296 	fport = sin->sin_port;
1297 #ifdef ROUTE_MPATH
1298 	if (CALC_FLOWID_OUTBOUND) {
1299 		uint32_t hash_val, hash_type;
1300 
1301 		hash_val = fib4_calc_software_hash(laddr, faddr, 0, fport,
1302 		    inp->inp_socket->so_proto->pr_protocol, &hash_type);
1303 
1304 		inp->inp_flowid = hash_val;
1305 		inp->inp_flowtype = hash_type;
1306 	}
1307 #endif
1308 	if (!CK_STAILQ_EMPTY(&V_in_ifaddrhead)) {
1309 		/*
1310 		 * If the destination address is INADDR_ANY,
1311 		 * use the primary local address.
1312 		 * If the supplied address is INADDR_BROADCAST,
1313 		 * and the primary interface supports broadcast,
1314 		 * choose the broadcast address for that interface.
1315 		 */
1316 		if (faddr.s_addr == INADDR_ANY) {
1317 			faddr =
1318 			    IA_SIN(CK_STAILQ_FIRST(&V_in_ifaddrhead))->sin_addr;
1319 			if ((error = prison_get_ip4(cred, &faddr)) != 0)
1320 				return (error);
1321 		} else if (faddr.s_addr == (u_long)INADDR_BROADCAST) {
1322 			if (CK_STAILQ_FIRST(&V_in_ifaddrhead)->ia_ifp->if_flags &
1323 			    IFF_BROADCAST)
1324 				faddr = satosin(&CK_STAILQ_FIRST(
1325 				    &V_in_ifaddrhead)->ia_broadaddr)->sin_addr;
1326 		}
1327 	}
1328 	if (laddr.s_addr == INADDR_ANY) {
1329 		error = in_pcbladdr(inp, &faddr, &laddr, cred);
1330 		/*
1331 		 * If the destination address is multicast and an outgoing
1332 		 * interface has been set as a multicast option, prefer the
1333 		 * address of that interface as our source address.
1334 		 */
1335 		if (IN_MULTICAST(ntohl(faddr.s_addr)) &&
1336 		    inp->inp_moptions != NULL) {
1337 			struct ip_moptions *imo;
1338 			struct ifnet *ifp;
1339 
1340 			imo = inp->inp_moptions;
1341 			if (imo->imo_multicast_ifp != NULL) {
1342 				ifp = imo->imo_multicast_ifp;
1343 				CK_STAILQ_FOREACH(ia, &V_in_ifaddrhead, ia_link) {
1344 					if (ia->ia_ifp == ifp &&
1345 					    prison_check_ip4(cred,
1346 					    &ia->ia_addr.sin_addr) == 0)
1347 						break;
1348 				}
1349 				if (ia == NULL)
1350 					error = EADDRNOTAVAIL;
1351 				else {
1352 					laddr = ia->ia_addr.sin_addr;
1353 					error = 0;
1354 				}
1355 			}
1356 		}
1357 		if (error)
1358 			return (error);
1359 	}
1360 
1361 	if (lport != 0) {
1362 		if (in_pcblookup_hash_locked(inp->inp_pcbinfo, faddr,
1363 		    fport, laddr, lport, 0, M_NODOM) != NULL)
1364 			return (EADDRINUSE);
1365 	} else {
1366 		struct sockaddr_in lsin, fsin;
1367 
1368 		bzero(&lsin, sizeof(lsin));
1369 		bzero(&fsin, sizeof(fsin));
1370 		lsin.sin_family = AF_INET;
1371 		lsin.sin_addr = laddr;
1372 		fsin.sin_family = AF_INET;
1373 		fsin.sin_addr = faddr;
1374 		error = in_pcb_lport_dest(inp, (struct sockaddr *) &lsin,
1375 		    &lport, (struct sockaddr *)& fsin, fport, cred,
1376 		    INPLOOKUP_WILDCARD);
1377 		if (error)
1378 			return (error);
1379 	}
1380 	*laddrp = laddr.s_addr;
1381 	*lportp = lport;
1382 	*faddrp = faddr.s_addr;
1383 	*fportp = fport;
1384 	return (0);
1385 }
1386 
1387 void
1388 in_pcbdisconnect(struct inpcb *inp)
1389 {
1390 
1391 	INP_WLOCK_ASSERT(inp);
1392 	INP_HASH_WLOCK_ASSERT(inp->inp_pcbinfo);
1393 	KASSERT(inp->inp_smr == SMR_SEQ_INVALID,
1394 	    ("%s: inp %p was already disconnected", __func__, inp));
1395 
1396 	in_pcbremhash_locked(inp);
1397 
1398 	/* See the comment in in_pcbinshash(). */
1399 	inp->inp_smr = smr_advance(inp->inp_pcbinfo->ipi_smr);
1400 	inp->inp_laddr.s_addr = INADDR_ANY;
1401 	inp->inp_faddr.s_addr = INADDR_ANY;
1402 	inp->inp_fport = 0;
1403 }
1404 #endif /* INET */
1405 
1406 /*
1407  * in_pcbdetach() is responsibe for disassociating a socket from an inpcb.
1408  * For most protocols, this will be invoked immediately prior to calling
1409  * in_pcbfree().  However, with TCP the inpcb may significantly outlive the
1410  * socket, in which case in_pcbfree() is deferred.
1411  */
1412 void
1413 in_pcbdetach(struct inpcb *inp)
1414 {
1415 
1416 	KASSERT(inp->inp_socket != NULL, ("%s: inp_socket == NULL", __func__));
1417 
1418 #ifdef RATELIMIT
1419 	if (inp->inp_snd_tag != NULL)
1420 		in_pcbdetach_txrtlmt(inp);
1421 #endif
1422 	inp->inp_socket->so_pcb = NULL;
1423 	inp->inp_socket = NULL;
1424 }
1425 
1426 /*
1427  * inpcb hash lookups are protected by SMR section.
1428  *
1429  * Once desired pcb has been found, switching from SMR section to a pcb
1430  * lock is performed with inp_smr_lock(). We can not use INP_(W|R)LOCK
1431  * here because SMR is a critical section.
1432  * In 99%+ cases inp_smr_lock() would obtain the lock immediately.
1433  */
1434 void
1435 inp_lock(struct inpcb *inp, const inp_lookup_t lock)
1436 {
1437 
1438 	lock == INPLOOKUP_RLOCKPCB ?
1439 	    rw_rlock(&inp->inp_lock) : rw_wlock(&inp->inp_lock);
1440 }
1441 
1442 void
1443 inp_unlock(struct inpcb *inp, const inp_lookup_t lock)
1444 {
1445 
1446 	lock == INPLOOKUP_RLOCKPCB ?
1447 	    rw_runlock(&inp->inp_lock) : rw_wunlock(&inp->inp_lock);
1448 }
1449 
1450 int
1451 inp_trylock(struct inpcb *inp, const inp_lookup_t lock)
1452 {
1453 
1454 	return (lock == INPLOOKUP_RLOCKPCB ?
1455 	    rw_try_rlock(&inp->inp_lock) : rw_try_wlock(&inp->inp_lock));
1456 }
1457 
1458 static inline bool
1459 _inp_smr_lock(struct inpcb *inp, const inp_lookup_t lock, const int ignflags)
1460 {
1461 
1462 	MPASS(lock == INPLOOKUP_RLOCKPCB || lock == INPLOOKUP_WLOCKPCB);
1463 	SMR_ASSERT_ENTERED(inp->inp_pcbinfo->ipi_smr);
1464 
1465 	if (__predict_true(inp_trylock(inp, lock))) {
1466 		if (__predict_false(inp->inp_flags & ignflags)) {
1467 			smr_exit(inp->inp_pcbinfo->ipi_smr);
1468 			inp_unlock(inp, lock);
1469 			return (false);
1470 		}
1471 		smr_exit(inp->inp_pcbinfo->ipi_smr);
1472 		return (true);
1473 	}
1474 
1475 	if (__predict_true(refcount_acquire_if_not_zero(&inp->inp_refcount))) {
1476 		smr_exit(inp->inp_pcbinfo->ipi_smr);
1477 		inp_lock(inp, lock);
1478 		if (__predict_false(in_pcbrele(inp, lock)))
1479 			return (false);
1480 		/*
1481 		 * inp acquired through refcount & lock for sure didn't went
1482 		 * through uma_zfree().  However, it may have already went
1483 		 * through in_pcbfree() and has another reference, that
1484 		 * prevented its release by our in_pcbrele().
1485 		 */
1486 		if (__predict_false(inp->inp_flags & ignflags)) {
1487 			inp_unlock(inp, lock);
1488 			return (false);
1489 		}
1490 		return (true);
1491 	} else {
1492 		smr_exit(inp->inp_pcbinfo->ipi_smr);
1493 		return (false);
1494 	}
1495 }
1496 
1497 bool
1498 inp_smr_lock(struct inpcb *inp, const inp_lookup_t lock)
1499 {
1500 
1501 	/*
1502 	 * in_pcblookup() family of functions ignore not only freed entries,
1503 	 * that may be found due to lockless access to the hash, but dropped
1504 	 * entries, too.
1505 	 */
1506 	return (_inp_smr_lock(inp, lock, INP_FREED | INP_DROPPED));
1507 }
1508 
1509 /*
1510  * inp_next() - inpcb hash/list traversal iterator
1511  *
1512  * Requires initialized struct inpcb_iterator for context.
1513  * The structure can be initialized with INP_ITERATOR() or INP_ALL_ITERATOR().
1514  *
1515  * - Iterator can have either write-lock or read-lock semantics, that can not
1516  *   be changed later.
1517  * - Iterator can iterate either over all pcbs list (INP_ALL_LIST), or through
1518  *   a single hash slot.  Note: only rip_input() does the latter.
1519  * - Iterator may have optional bool matching function.  The matching function
1520  *   will be executed for each inpcb in the SMR context, so it can not acquire
1521  *   locks and can safely access only immutable fields of inpcb.
1522  *
1523  * A fresh initialized iterator has NULL inpcb in its context and that
1524  * means that inp_next() call would return the very first inpcb on the list
1525  * locked with desired semantic.  In all following calls the context pointer
1526  * shall hold the current inpcb pointer.  The KPI user is not supposed to
1527  * unlock the current inpcb!  Upon end of traversal inp_next() will return NULL
1528  * and write NULL to its context.  After end of traversal an iterator can be
1529  * reused.
1530  *
1531  * List traversals have the following features/constraints:
1532  * - New entries won't be seen, as they are always added to the head of a list.
1533  * - Removed entries won't stop traversal as long as they are not added to
1534  *   a different list. This is violated by in_pcbrehash().
1535  */
1536 #define	II_LIST_FIRST(ipi, hash)					\
1537 		(((hash) == INP_ALL_LIST) ?				\
1538 		    CK_LIST_FIRST(&(ipi)->ipi_listhead) :		\
1539 		    CK_LIST_FIRST(&(ipi)->ipi_hash_exact[(hash)]))
1540 #define	II_LIST_NEXT(inp, hash)						\
1541 		(((hash) == INP_ALL_LIST) ?				\
1542 		    CK_LIST_NEXT((inp), inp_list) :			\
1543 		    CK_LIST_NEXT((inp), inp_hash_exact))
1544 #define	II_LOCK_ASSERT(inp, lock)					\
1545 		rw_assert(&(inp)->inp_lock,				\
1546 		    (lock) == INPLOOKUP_RLOCKPCB ?  RA_RLOCKED : RA_WLOCKED )
1547 struct inpcb *
1548 inp_next(struct inpcb_iterator *ii)
1549 {
1550 	const struct inpcbinfo *ipi = ii->ipi;
1551 	inp_match_t *match = ii->match;
1552 	void *ctx = ii->ctx;
1553 	inp_lookup_t lock = ii->lock;
1554 	int hash = ii->hash;
1555 	struct inpcb *inp;
1556 
1557 	if (ii->inp == NULL) {		/* First call. */
1558 		smr_enter(ipi->ipi_smr);
1559 		/* This is unrolled CK_LIST_FOREACH(). */
1560 		for (inp = II_LIST_FIRST(ipi, hash);
1561 		    inp != NULL;
1562 		    inp = II_LIST_NEXT(inp, hash)) {
1563 			if (match != NULL && (match)(inp, ctx) == false)
1564 				continue;
1565 			if (__predict_true(_inp_smr_lock(inp, lock, INP_FREED)))
1566 				break;
1567 			else {
1568 				smr_enter(ipi->ipi_smr);
1569 				MPASS(inp != II_LIST_FIRST(ipi, hash));
1570 				inp = II_LIST_FIRST(ipi, hash);
1571 				if (inp == NULL)
1572 					break;
1573 			}
1574 		}
1575 
1576 		if (inp == NULL)
1577 			smr_exit(ipi->ipi_smr);
1578 		else
1579 			ii->inp = inp;
1580 
1581 		return (inp);
1582 	}
1583 
1584 	/* Not a first call. */
1585 	smr_enter(ipi->ipi_smr);
1586 restart:
1587 	inp = ii->inp;
1588 	II_LOCK_ASSERT(inp, lock);
1589 next:
1590 	inp = II_LIST_NEXT(inp, hash);
1591 	if (inp == NULL) {
1592 		smr_exit(ipi->ipi_smr);
1593 		goto found;
1594 	}
1595 
1596 	if (match != NULL && (match)(inp, ctx) == false)
1597 		goto next;
1598 
1599 	if (__predict_true(inp_trylock(inp, lock))) {
1600 		if (__predict_false(inp->inp_flags & INP_FREED)) {
1601 			/*
1602 			 * Entries are never inserted in middle of a list, thus
1603 			 * as long as we are in SMR, we can continue traversal.
1604 			 * Jump to 'restart' should yield in the same result,
1605 			 * but could produce unnecessary looping.  Could this
1606 			 * looping be unbound?
1607 			 */
1608 			inp_unlock(inp, lock);
1609 			goto next;
1610 		} else {
1611 			smr_exit(ipi->ipi_smr);
1612 			goto found;
1613 		}
1614 	}
1615 
1616 	/*
1617 	 * Can't obtain lock immediately, thus going hard.  Once we exit the
1618 	 * SMR section we can no longer jump to 'next', and our only stable
1619 	 * anchoring point is ii->inp, which we keep locked for this case, so
1620 	 * we jump to 'restart'.
1621 	 */
1622 	if (__predict_true(refcount_acquire_if_not_zero(&inp->inp_refcount))) {
1623 		smr_exit(ipi->ipi_smr);
1624 		inp_lock(inp, lock);
1625 		if (__predict_false(in_pcbrele(inp, lock))) {
1626 			smr_enter(ipi->ipi_smr);
1627 			goto restart;
1628 		}
1629 		/*
1630 		 * See comment in inp_smr_lock().
1631 		 */
1632 		if (__predict_false(inp->inp_flags & INP_FREED)) {
1633 			inp_unlock(inp, lock);
1634 			smr_enter(ipi->ipi_smr);
1635 			goto restart;
1636 		}
1637 	} else
1638 		goto next;
1639 
1640 found:
1641 	inp_unlock(ii->inp, lock);
1642 	ii->inp = inp;
1643 
1644 	return (ii->inp);
1645 }
1646 
1647 /*
1648  * in_pcbref() bumps the reference count on an inpcb in order to maintain
1649  * stability of an inpcb pointer despite the inpcb lock being released or
1650  * SMR section exited.
1651  *
1652  * To free a reference later in_pcbrele_(r|w)locked() must be performed.
1653  */
1654 void
1655 in_pcbref(struct inpcb *inp)
1656 {
1657 	u_int old __diagused;
1658 
1659 	old = refcount_acquire(&inp->inp_refcount);
1660 	KASSERT(old > 0, ("%s: refcount 0", __func__));
1661 }
1662 
1663 /*
1664  * Drop a refcount on an inpcb elevated using in_pcbref(), potentially
1665  * freeing the pcb, if the reference was very last.
1666  */
1667 bool
1668 in_pcbrele_rlocked(struct inpcb *inp)
1669 {
1670 
1671 	INP_RLOCK_ASSERT(inp);
1672 
1673 	if (!refcount_release(&inp->inp_refcount))
1674 		return (false);
1675 
1676 	MPASS(inp->inp_flags & INP_FREED);
1677 	MPASS(inp->inp_socket == NULL);
1678 	crfree(inp->inp_cred);
1679 #ifdef INVARIANTS
1680 	inp->inp_cred = NULL;
1681 #endif
1682 	INP_RUNLOCK(inp);
1683 	uma_zfree_smr(inp->inp_pcbinfo->ipi_zone, inp);
1684 	return (true);
1685 }
1686 
1687 bool
1688 in_pcbrele_wlocked(struct inpcb *inp)
1689 {
1690 
1691 	INP_WLOCK_ASSERT(inp);
1692 
1693 	if (!refcount_release(&inp->inp_refcount))
1694 		return (false);
1695 
1696 	MPASS(inp->inp_flags & INP_FREED);
1697 	MPASS(inp->inp_socket == NULL);
1698 	crfree(inp->inp_cred);
1699 #ifdef INVARIANTS
1700 	inp->inp_cred = NULL;
1701 #endif
1702 	INP_WUNLOCK(inp);
1703 	uma_zfree_smr(inp->inp_pcbinfo->ipi_zone, inp);
1704 	return (true);
1705 }
1706 
1707 bool
1708 in_pcbrele(struct inpcb *inp, const inp_lookup_t lock)
1709 {
1710 
1711 	return (lock == INPLOOKUP_RLOCKPCB ?
1712 	    in_pcbrele_rlocked(inp) : in_pcbrele_wlocked(inp));
1713 }
1714 
1715 /*
1716  * Unconditionally schedule an inpcb to be freed by decrementing its
1717  * reference count, which should occur only after the inpcb has been detached
1718  * from its socket.  If another thread holds a temporary reference (acquired
1719  * using in_pcbref()) then the free is deferred until that reference is
1720  * released using in_pcbrele_(r|w)locked(), but the inpcb is still unlocked.
1721  *  Almost all work, including removal from global lists, is done in this
1722  * context, where the pcbinfo lock is held.
1723  */
1724 void
1725 in_pcbfree(struct inpcb *inp)
1726 {
1727 	struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
1728 #ifdef INET
1729 	struct ip_moptions *imo;
1730 #endif
1731 #ifdef INET6
1732 	struct ip6_moptions *im6o;
1733 #endif
1734 
1735 	INP_WLOCK_ASSERT(inp);
1736 	KASSERT(inp->inp_socket == NULL, ("%s: inp_socket != NULL", __func__));
1737 	KASSERT((inp->inp_flags & INP_FREED) == 0,
1738 	    ("%s: called twice for pcb %p", __func__, inp));
1739 
1740 	inp->inp_flags |= INP_FREED;
1741 	INP_INFO_WLOCK(pcbinfo);
1742 	inp->inp_gencnt = ++pcbinfo->ipi_gencnt;
1743 	pcbinfo->ipi_count--;
1744 	CK_LIST_REMOVE(inp, inp_list);
1745 	INP_INFO_WUNLOCK(pcbinfo);
1746 
1747 	if (inp->inp_flags & INP_INHASHLIST)
1748 		in_pcbremhash(inp);
1749 
1750 	RO_INVALIDATE_CACHE(&inp->inp_route);
1751 #ifdef MAC
1752 	mac_inpcb_destroy(inp);
1753 #endif
1754 #if defined(IPSEC) || defined(IPSEC_SUPPORT)
1755 	if (inp->inp_sp != NULL)
1756 		ipsec_delete_pcbpolicy(inp);
1757 #endif
1758 #ifdef INET
1759 	if (inp->inp_options)
1760 		(void)m_free(inp->inp_options);
1761 	imo = inp->inp_moptions;
1762 #endif
1763 #ifdef INET6
1764 	if (inp->inp_vflag & INP_IPV6PROTO) {
1765 		ip6_freepcbopts(inp->in6p_outputopts);
1766 		im6o = inp->in6p_moptions;
1767 	} else
1768 		im6o = NULL;
1769 #endif
1770 
1771 	if (__predict_false(in_pcbrele_wlocked(inp) == false)) {
1772 		INP_WUNLOCK(inp);
1773 	}
1774 #ifdef INET6
1775 	ip6_freemoptions(im6o);
1776 #endif
1777 #ifdef INET
1778 	inp_freemoptions(imo);
1779 #endif
1780 }
1781 
1782 /*
1783  * Different protocols initialize their inpcbs differently - giving
1784  * different name to the lock.  But they all are disposed the same.
1785  */
1786 static void
1787 inpcb_fini(void *mem, int size)
1788 {
1789 	struct inpcb *inp = mem;
1790 
1791 	INP_LOCK_DESTROY(inp);
1792 }
1793 
1794 /*
1795  * in_pcbdrop() removes an inpcb from hashed lists, releasing its address and
1796  * port reservation, and preventing it from being returned by inpcb lookups.
1797  *
1798  * It is used by TCP to mark an inpcb as unused and avoid future packet
1799  * delivery or event notification when a socket remains open but TCP has
1800  * closed.  This might occur as a result of a shutdown()-initiated TCP close
1801  * or a RST on the wire, and allows the port binding to be reused while still
1802  * maintaining the invariant that so_pcb always points to a valid inpcb until
1803  * in_pcbdetach().
1804  *
1805  * XXXRW: Possibly in_pcbdrop() should also prevent future notifications by
1806  * in_pcbpurgeif0()?
1807  */
1808 void
1809 in_pcbdrop(struct inpcb *inp)
1810 {
1811 
1812 	INP_WLOCK_ASSERT(inp);
1813 #ifdef INVARIANTS
1814 	if (inp->inp_socket != NULL && inp->inp_ppcb != NULL)
1815 		MPASS(inp->inp_refcount > 1);
1816 #endif
1817 
1818 	inp->inp_flags |= INP_DROPPED;
1819 	if (inp->inp_flags & INP_INHASHLIST)
1820 		in_pcbremhash(inp);
1821 }
1822 
1823 #ifdef INET
1824 /*
1825  * Common routines to return the socket addresses associated with inpcbs.
1826  */
1827 struct sockaddr *
1828 in_sockaddr(in_port_t port, struct in_addr *addr_p)
1829 {
1830 	struct sockaddr_in *sin;
1831 
1832 	sin = malloc(sizeof *sin, M_SONAME,
1833 		M_WAITOK | M_ZERO);
1834 	sin->sin_family = AF_INET;
1835 	sin->sin_len = sizeof(*sin);
1836 	sin->sin_addr = *addr_p;
1837 	sin->sin_port = port;
1838 
1839 	return (struct sockaddr *)sin;
1840 }
1841 
1842 int
1843 in_getsockaddr(struct socket *so, struct sockaddr **nam)
1844 {
1845 	struct inpcb *inp;
1846 	struct in_addr addr;
1847 	in_port_t port;
1848 
1849 	inp = sotoinpcb(so);
1850 	KASSERT(inp != NULL, ("in_getsockaddr: inp == NULL"));
1851 
1852 	INP_RLOCK(inp);
1853 	port = inp->inp_lport;
1854 	addr = inp->inp_laddr;
1855 	INP_RUNLOCK(inp);
1856 
1857 	*nam = in_sockaddr(port, &addr);
1858 	return 0;
1859 }
1860 
1861 int
1862 in_getpeeraddr(struct socket *so, struct sockaddr **nam)
1863 {
1864 	struct inpcb *inp;
1865 	struct in_addr addr;
1866 	in_port_t port;
1867 
1868 	inp = sotoinpcb(so);
1869 	KASSERT(inp != NULL, ("in_getpeeraddr: inp == NULL"));
1870 
1871 	INP_RLOCK(inp);
1872 	port = inp->inp_fport;
1873 	addr = inp->inp_faddr;
1874 	INP_RUNLOCK(inp);
1875 
1876 	*nam = in_sockaddr(port, &addr);
1877 	return 0;
1878 }
1879 
1880 static bool
1881 inp_v4_multi_match(const struct inpcb *inp, void *v __unused)
1882 {
1883 
1884 	if ((inp->inp_vflag & INP_IPV4) && inp->inp_moptions != NULL)
1885 		return (true);
1886 	else
1887 		return (false);
1888 }
1889 
1890 void
1891 in_pcbpurgeif0(struct inpcbinfo *pcbinfo, struct ifnet *ifp)
1892 {
1893 	struct inpcb_iterator inpi = INP_ITERATOR(pcbinfo, INPLOOKUP_WLOCKPCB,
1894 	    inp_v4_multi_match, NULL);
1895 	struct inpcb *inp;
1896 	struct in_multi *inm;
1897 	struct in_mfilter *imf;
1898 	struct ip_moptions *imo;
1899 
1900 	IN_MULTI_LOCK_ASSERT();
1901 
1902 	while ((inp = inp_next(&inpi)) != NULL) {
1903 		INP_WLOCK_ASSERT(inp);
1904 
1905 		imo = inp->inp_moptions;
1906 		/*
1907 		 * Unselect the outgoing interface if it is being
1908 		 * detached.
1909 		 */
1910 		if (imo->imo_multicast_ifp == ifp)
1911 			imo->imo_multicast_ifp = NULL;
1912 
1913 		/*
1914 		 * Drop multicast group membership if we joined
1915 		 * through the interface being detached.
1916 		 *
1917 		 * XXX This can all be deferred to an epoch_call
1918 		 */
1919 restart:
1920 		IP_MFILTER_FOREACH(imf, &imo->imo_head) {
1921 			if ((inm = imf->imf_inm) == NULL)
1922 				continue;
1923 			if (inm->inm_ifp != ifp)
1924 				continue;
1925 			ip_mfilter_remove(&imo->imo_head, imf);
1926 			in_leavegroup_locked(inm, NULL);
1927 			ip_mfilter_free(imf);
1928 			goto restart;
1929 		}
1930 	}
1931 }
1932 
1933 /*
1934  * Lookup a PCB based on the local address and port.  Caller must hold the
1935  * hash lock.  No inpcb locks or references are acquired.
1936  */
1937 #define INP_LOOKUP_MAPPED_PCB_COST	3
1938 struct inpcb *
1939 in_pcblookup_local(struct inpcbinfo *pcbinfo, struct in_addr laddr,
1940     u_short lport, int lookupflags, struct ucred *cred)
1941 {
1942 	struct inpcb *inp;
1943 #ifdef INET6
1944 	int matchwild = 3 + INP_LOOKUP_MAPPED_PCB_COST;
1945 #else
1946 	int matchwild = 3;
1947 #endif
1948 	int wildcard;
1949 
1950 	KASSERT((lookupflags & ~(INPLOOKUP_WILDCARD)) == 0,
1951 	    ("%s: invalid lookup flags %d", __func__, lookupflags));
1952 	INP_HASH_LOCK_ASSERT(pcbinfo);
1953 
1954 	if ((lookupflags & INPLOOKUP_WILDCARD) == 0) {
1955 		struct inpcbhead *head;
1956 		/*
1957 		 * Look for an unconnected (wildcard foreign addr) PCB that
1958 		 * matches the local address and port we're looking for.
1959 		 */
1960 		head = &pcbinfo->ipi_hash_wild[INP_PCBHASH_WILD(lport,
1961 		    pcbinfo->ipi_hashmask)];
1962 		CK_LIST_FOREACH(inp, head, inp_hash_wild) {
1963 #ifdef INET6
1964 			/* XXX inp locking */
1965 			if ((inp->inp_vflag & INP_IPV4) == 0)
1966 				continue;
1967 #endif
1968 			if (inp->inp_faddr.s_addr == INADDR_ANY &&
1969 			    inp->inp_laddr.s_addr == laddr.s_addr &&
1970 			    inp->inp_lport == lport) {
1971 				/*
1972 				 * Found?
1973 				 */
1974 				if (prison_equal_ip4(cred->cr_prison,
1975 				    inp->inp_cred->cr_prison))
1976 					return (inp);
1977 			}
1978 		}
1979 		/*
1980 		 * Not found.
1981 		 */
1982 		return (NULL);
1983 	} else {
1984 		struct inpcbporthead *porthash;
1985 		struct inpcbport *phd;
1986 		struct inpcb *match = NULL;
1987 		/*
1988 		 * Best fit PCB lookup.
1989 		 *
1990 		 * First see if this local port is in use by looking on the
1991 		 * port hash list.
1992 		 */
1993 		porthash = &pcbinfo->ipi_porthashbase[INP_PCBPORTHASH(lport,
1994 		    pcbinfo->ipi_porthashmask)];
1995 		CK_LIST_FOREACH(phd, porthash, phd_hash) {
1996 			if (phd->phd_port == lport)
1997 				break;
1998 		}
1999 		if (phd != NULL) {
2000 			/*
2001 			 * Port is in use by one or more PCBs. Look for best
2002 			 * fit.
2003 			 */
2004 			CK_LIST_FOREACH(inp, &phd->phd_pcblist, inp_portlist) {
2005 				wildcard = 0;
2006 				if (!prison_equal_ip4(inp->inp_cred->cr_prison,
2007 				    cred->cr_prison))
2008 					continue;
2009 #ifdef INET6
2010 				/* XXX inp locking */
2011 				if ((inp->inp_vflag & INP_IPV4) == 0)
2012 					continue;
2013 				/*
2014 				 * We never select the PCB that has
2015 				 * INP_IPV6 flag and is bound to :: if
2016 				 * we have another PCB which is bound
2017 				 * to 0.0.0.0.  If a PCB has the
2018 				 * INP_IPV6 flag, then we set its cost
2019 				 * higher than IPv4 only PCBs.
2020 				 *
2021 				 * Note that the case only happens
2022 				 * when a socket is bound to ::, under
2023 				 * the condition that the use of the
2024 				 * mapped address is allowed.
2025 				 */
2026 				if ((inp->inp_vflag & INP_IPV6) != 0)
2027 					wildcard += INP_LOOKUP_MAPPED_PCB_COST;
2028 #endif
2029 				if (inp->inp_faddr.s_addr != INADDR_ANY)
2030 					wildcard++;
2031 				if (inp->inp_laddr.s_addr != INADDR_ANY) {
2032 					if (laddr.s_addr == INADDR_ANY)
2033 						wildcard++;
2034 					else if (inp->inp_laddr.s_addr != laddr.s_addr)
2035 						continue;
2036 				} else {
2037 					if (laddr.s_addr != INADDR_ANY)
2038 						wildcard++;
2039 				}
2040 				if (wildcard < matchwild) {
2041 					match = inp;
2042 					matchwild = wildcard;
2043 					if (matchwild == 0)
2044 						break;
2045 				}
2046 			}
2047 		}
2048 		return (match);
2049 	}
2050 }
2051 #undef INP_LOOKUP_MAPPED_PCB_COST
2052 
2053 static bool
2054 in_pcblookup_lb_numa_match(const struct inpcblbgroup *grp, int domain)
2055 {
2056 	return (domain == M_NODOM || domain == grp->il_numa_domain);
2057 }
2058 
2059 static struct inpcb *
2060 in_pcblookup_lbgroup(const struct inpcbinfo *pcbinfo,
2061     const struct in_addr *faddr, uint16_t fport, const struct in_addr *laddr,
2062     uint16_t lport, int domain)
2063 {
2064 	const struct inpcblbgrouphead *hdr;
2065 	struct inpcblbgroup *grp;
2066 	struct inpcblbgroup *jail_exact, *jail_wild, *local_exact, *local_wild;
2067 
2068 	INP_HASH_LOCK_ASSERT(pcbinfo);
2069 
2070 	hdr = &pcbinfo->ipi_lbgrouphashbase[
2071 	    INP_PCBPORTHASH(lport, pcbinfo->ipi_lbgrouphashmask)];
2072 
2073 	/*
2074 	 * Search for an LB group match based on the following criteria:
2075 	 * - prefer jailed groups to non-jailed groups
2076 	 * - prefer exact source address matches to wildcard matches
2077 	 * - prefer groups bound to the specified NUMA domain
2078 	 */
2079 	jail_exact = jail_wild = local_exact = local_wild = NULL;
2080 	CK_LIST_FOREACH(grp, hdr, il_list) {
2081 		bool injail;
2082 
2083 #ifdef INET6
2084 		if (!(grp->il_vflag & INP_IPV4))
2085 			continue;
2086 #endif
2087 		if (grp->il_lport != lport)
2088 			continue;
2089 
2090 		injail = prison_flag(grp->il_cred, PR_IP4) != 0;
2091 		if (injail && prison_check_ip4_locked(grp->il_cred->cr_prison,
2092 		    laddr) != 0)
2093 			continue;
2094 
2095 		if (grp->il_laddr.s_addr == laddr->s_addr) {
2096 			if (injail) {
2097 				jail_exact = grp;
2098 				if (in_pcblookup_lb_numa_match(grp, domain))
2099 					/* This is a perfect match. */
2100 					goto out;
2101 			} else if (local_exact == NULL ||
2102 			    in_pcblookup_lb_numa_match(grp, domain)) {
2103 				local_exact = grp;
2104 			}
2105 		} else if (grp->il_laddr.s_addr == INADDR_ANY) {
2106 			if (injail) {
2107 				if (jail_wild == NULL ||
2108 				    in_pcblookup_lb_numa_match(grp, domain))
2109 					jail_wild = grp;
2110 			} else if (local_wild == NULL ||
2111 			    in_pcblookup_lb_numa_match(grp, domain)) {
2112 				local_wild = grp;
2113 			}
2114 		}
2115 	}
2116 
2117 	if (jail_exact != NULL)
2118 		grp = jail_exact;
2119 	else if (jail_wild != NULL)
2120 		grp = jail_wild;
2121 	else if (local_exact != NULL)
2122 		grp = local_exact;
2123 	else
2124 		grp = local_wild;
2125 	if (grp == NULL)
2126 		return (NULL);
2127 out:
2128 	return (grp->il_inp[INP_PCBLBGROUP_PKTHASH(faddr, lport, fport) %
2129 	    grp->il_inpcnt]);
2130 }
2131 
2132 static bool
2133 in_pcblookup_exact_match(const struct inpcb *inp, struct in_addr faddr,
2134     u_short fport, struct in_addr laddr, u_short lport)
2135 {
2136 #ifdef INET6
2137 	/* XXX inp locking */
2138 	if ((inp->inp_vflag & INP_IPV4) == 0)
2139 		return (false);
2140 #endif
2141 	if (inp->inp_faddr.s_addr == faddr.s_addr &&
2142 	    inp->inp_laddr.s_addr == laddr.s_addr &&
2143 	    inp->inp_fport == fport &&
2144 	    inp->inp_lport == lport)
2145 		return (true);
2146 	return (false);
2147 }
2148 
2149 static struct inpcb *
2150 in_pcblookup_hash_exact(struct inpcbinfo *pcbinfo, struct in_addr faddr,
2151     u_short fport, struct in_addr laddr, u_short lport)
2152 {
2153 	struct inpcbhead *head;
2154 	struct inpcb *inp;
2155 
2156 	INP_HASH_LOCK_ASSERT(pcbinfo);
2157 
2158 	head = &pcbinfo->ipi_hash_exact[INP_PCBHASH(&faddr, lport, fport,
2159 	    pcbinfo->ipi_hashmask)];
2160 	CK_LIST_FOREACH(inp, head, inp_hash_exact) {
2161 		if (in_pcblookup_exact_match(inp, faddr, fport, laddr, lport))
2162 			return (inp);
2163 	}
2164 	return (NULL);
2165 }
2166 
2167 typedef enum {
2168 	INPLOOKUP_MATCH_NONE = 0,
2169 	INPLOOKUP_MATCH_WILD = 1,
2170 	INPLOOKUP_MATCH_LADDR = 2,
2171 } inp_lookup_match_t;
2172 
2173 static inp_lookup_match_t
2174 in_pcblookup_wild_match(const struct inpcb *inp, struct in_addr laddr,
2175     u_short lport)
2176 {
2177 #ifdef INET6
2178 	/* XXX inp locking */
2179 	if ((inp->inp_vflag & INP_IPV4) == 0)
2180 		return (INPLOOKUP_MATCH_NONE);
2181 #endif
2182 	if (inp->inp_faddr.s_addr != INADDR_ANY || inp->inp_lport != lport)
2183 		return (INPLOOKUP_MATCH_NONE);
2184 	if (inp->inp_laddr.s_addr == INADDR_ANY)
2185 		return (INPLOOKUP_MATCH_WILD);
2186 	if (inp->inp_laddr.s_addr == laddr.s_addr)
2187 		return (INPLOOKUP_MATCH_LADDR);
2188 	return (INPLOOKUP_MATCH_NONE);
2189 }
2190 
2191 #define	INP_LOOKUP_AGAIN	((struct inpcb *)(uintptr_t)-1)
2192 
2193 static struct inpcb *
2194 in_pcblookup_hash_wild_smr(struct inpcbinfo *pcbinfo, struct in_addr faddr,
2195     u_short fport, struct in_addr laddr, u_short lport,
2196     const inp_lookup_t lockflags)
2197 {
2198 	struct inpcbhead *head;
2199 	struct inpcb *inp;
2200 
2201 	KASSERT(SMR_ENTERED(pcbinfo->ipi_smr),
2202 	    ("%s: not in SMR read section", __func__));
2203 
2204 	head = &pcbinfo->ipi_hash_wild[INP_PCBHASH_WILD(lport,
2205 	    pcbinfo->ipi_hashmask)];
2206 	CK_LIST_FOREACH(inp, head, inp_hash_wild) {
2207 		inp_lookup_match_t match;
2208 
2209 		match = in_pcblookup_wild_match(inp, laddr, lport);
2210 		if (match == INPLOOKUP_MATCH_NONE)
2211 			continue;
2212 
2213 		if (__predict_true(inp_smr_lock(inp, lockflags))) {
2214 			match = in_pcblookup_wild_match(inp, laddr, lport);
2215 			if (match != INPLOOKUP_MATCH_NONE &&
2216 			    prison_check_ip4_locked(inp->inp_cred->cr_prison,
2217 			    &laddr) == 0)
2218 				return (inp);
2219 			inp_unlock(inp, lockflags);
2220 		}
2221 
2222 		/*
2223 		 * The matching socket disappeared out from under us.  Fall back
2224 		 * to a serialized lookup.
2225 		 */
2226 		return (INP_LOOKUP_AGAIN);
2227 	}
2228 	return (NULL);
2229 }
2230 
2231 static struct inpcb *
2232 in_pcblookup_hash_wild_locked(struct inpcbinfo *pcbinfo, struct in_addr faddr,
2233     u_short fport, struct in_addr laddr, u_short lport)
2234 {
2235 	struct inpcbhead *head;
2236 	struct inpcb *inp, *local_wild, *local_exact, *jail_wild;
2237 #ifdef INET6
2238 	struct inpcb *local_wild_mapped;
2239 #endif
2240 
2241 	INP_HASH_LOCK_ASSERT(pcbinfo);
2242 
2243 	/*
2244 	 * Order of socket selection - we always prefer jails.
2245 	 *      1. jailed, non-wild.
2246 	 *      2. jailed, wild.
2247 	 *      3. non-jailed, non-wild.
2248 	 *      4. non-jailed, wild.
2249 	 */
2250 	head = &pcbinfo->ipi_hash_wild[INP_PCBHASH_WILD(lport,
2251 	    pcbinfo->ipi_hashmask)];
2252 	local_wild = local_exact = jail_wild = NULL;
2253 #ifdef INET6
2254 	local_wild_mapped = NULL;
2255 #endif
2256 	CK_LIST_FOREACH(inp, head, inp_hash_wild) {
2257 		inp_lookup_match_t match;
2258 		bool injail;
2259 
2260 		match = in_pcblookup_wild_match(inp, laddr, lport);
2261 		if (match == INPLOOKUP_MATCH_NONE)
2262 			continue;
2263 
2264 		injail = prison_flag(inp->inp_cred, PR_IP4) != 0;
2265 		if (injail) {
2266 			if (prison_check_ip4_locked(inp->inp_cred->cr_prison,
2267 			    &laddr) != 0)
2268 				continue;
2269 		} else {
2270 			if (local_exact != NULL)
2271 				continue;
2272 		}
2273 
2274 		if (match == INPLOOKUP_MATCH_LADDR) {
2275 			if (injail)
2276 				return (inp);
2277 			local_exact = inp;
2278 		} else {
2279 #ifdef INET6
2280 			/* XXX inp locking, NULL check */
2281 			if (inp->inp_vflag & INP_IPV6PROTO)
2282 				local_wild_mapped = inp;
2283 			else
2284 #endif
2285 				if (injail)
2286 					jail_wild = inp;
2287 				else
2288 					local_wild = inp;
2289 		}
2290 	}
2291 	if (jail_wild != NULL)
2292 		return (jail_wild);
2293 	if (local_exact != NULL)
2294 		return (local_exact);
2295 	if (local_wild != NULL)
2296 		return (local_wild);
2297 #ifdef INET6
2298 	if (local_wild_mapped != NULL)
2299 		return (local_wild_mapped);
2300 #endif
2301 	return (NULL);
2302 }
2303 
2304 /*
2305  * Lookup PCB in hash list, using pcbinfo tables.  This variation assumes
2306  * that the caller has either locked the hash list, which usually happens
2307  * for bind(2) operations, or is in SMR section, which happens when sorting
2308  * out incoming packets.
2309  */
2310 static struct inpcb *
2311 in_pcblookup_hash_locked(struct inpcbinfo *pcbinfo, struct in_addr faddr,
2312     u_int fport_arg, struct in_addr laddr, u_int lport_arg, int lookupflags,
2313     uint8_t numa_domain)
2314 {
2315 	struct inpcb *inp;
2316 	const u_short fport = fport_arg, lport = lport_arg;
2317 
2318 	KASSERT((lookupflags & ~INPLOOKUP_WILDCARD) == 0,
2319 	    ("%s: invalid lookup flags %d", __func__, lookupflags));
2320 	KASSERT(faddr.s_addr != INADDR_ANY,
2321 	    ("%s: invalid foreign address", __func__));
2322 	KASSERT(laddr.s_addr != INADDR_ANY,
2323 	    ("%s: invalid local address", __func__));
2324 	INP_HASH_WLOCK_ASSERT(pcbinfo);
2325 
2326 	inp = in_pcblookup_hash_exact(pcbinfo, faddr, fport, laddr, lport);
2327 	if (inp != NULL)
2328 		return (inp);
2329 
2330 	if ((lookupflags & INPLOOKUP_WILDCARD) != 0) {
2331 		inp = in_pcblookup_lbgroup(pcbinfo, &faddr, fport,
2332 		    &laddr, lport, numa_domain);
2333 		if (inp == NULL) {
2334 			inp = in_pcblookup_hash_wild_locked(pcbinfo, faddr,
2335 			    fport, laddr, lport);
2336 		}
2337 	}
2338 
2339 	return (inp);
2340 }
2341 
2342 static struct inpcb *
2343 in_pcblookup_hash(struct inpcbinfo *pcbinfo, struct in_addr faddr,
2344     u_int fport, struct in_addr laddr, u_int lport, int lookupflags,
2345     uint8_t numa_domain)
2346 {
2347 	struct inpcb *inp;
2348 	const inp_lookup_t lockflags = lookupflags & INPLOOKUP_LOCKMASK;
2349 
2350 	KASSERT((lookupflags & (INPLOOKUP_RLOCKPCB | INPLOOKUP_WLOCKPCB)) != 0,
2351 	    ("%s: LOCKPCB not set", __func__));
2352 
2353 	INP_HASH_WLOCK(pcbinfo);
2354 	inp = in_pcblookup_hash_locked(pcbinfo, faddr, fport, laddr, lport,
2355 	    lookupflags & ~INPLOOKUP_LOCKMASK, numa_domain);
2356 	if (inp != NULL && !inp_trylock(inp, lockflags)) {
2357 		in_pcbref(inp);
2358 		INP_HASH_WUNLOCK(pcbinfo);
2359 		inp_lock(inp, lockflags);
2360 		if (in_pcbrele(inp, lockflags))
2361 			/* XXX-MJ or retry until we get a negative match? */
2362 			inp = NULL;
2363 	} else {
2364 		INP_HASH_WUNLOCK(pcbinfo);
2365 	}
2366 	return (inp);
2367 }
2368 
2369 static struct inpcb *
2370 in_pcblookup_hash_smr(struct inpcbinfo *pcbinfo, struct in_addr faddr,
2371     u_int fport_arg, struct in_addr laddr, u_int lport_arg, int lookupflags,
2372     uint8_t numa_domain)
2373 {
2374 	struct inpcb *inp;
2375 	const inp_lookup_t lockflags = lookupflags & INPLOOKUP_LOCKMASK;
2376 	const u_short fport = fport_arg, lport = lport_arg;
2377 
2378 	KASSERT((lookupflags & ~INPLOOKUP_MASK) == 0,
2379 	    ("%s: invalid lookup flags %d", __func__, lookupflags));
2380 	KASSERT((lookupflags & (INPLOOKUP_RLOCKPCB | INPLOOKUP_WLOCKPCB)) != 0,
2381 	    ("%s: LOCKPCB not set", __func__));
2382 
2383 	smr_enter(pcbinfo->ipi_smr);
2384 	inp = in_pcblookup_hash_exact(pcbinfo, faddr, fport, laddr, lport);
2385 	if (inp != NULL) {
2386 		if (__predict_true(inp_smr_lock(inp, lockflags))) {
2387 			/*
2388 			 * Revalidate the 4-tuple, the socket could have been
2389 			 * disconnected.
2390 			 */
2391 			if (__predict_true(in_pcblookup_exact_match(inp,
2392 			    faddr, fport, laddr, lport)))
2393 				return (inp);
2394 			inp_unlock(inp, lockflags);
2395 		}
2396 
2397 		/*
2398 		 * We failed to lock the inpcb, or its connection state changed
2399 		 * out from under us.  Fall back to a precise search.
2400 		 */
2401 		return (in_pcblookup_hash(pcbinfo, faddr, fport, laddr, lport,
2402 		    lookupflags, numa_domain));
2403 	}
2404 
2405 	if ((lookupflags & INPLOOKUP_WILDCARD) != 0) {
2406 		inp = in_pcblookup_lbgroup(pcbinfo, &faddr, fport,
2407 		    &laddr, lport, numa_domain);
2408 		if (inp != NULL) {
2409 			if (__predict_true(inp_smr_lock(inp, lockflags))) {
2410 				if (__predict_true(in_pcblookup_wild_match(inp,
2411 				    laddr, lport) != INPLOOKUP_MATCH_NONE))
2412 					return (inp);
2413 				inp_unlock(inp, lockflags);
2414 			}
2415 			inp = INP_LOOKUP_AGAIN;
2416 		} else {
2417 			inp = in_pcblookup_hash_wild_smr(pcbinfo, faddr, fport,
2418 			    laddr, lport, lockflags);
2419 		}
2420 		if (inp == INP_LOOKUP_AGAIN) {
2421 			return (in_pcblookup_hash(pcbinfo, faddr, fport, laddr,
2422 			    lport, lookupflags, numa_domain));
2423 		}
2424 	}
2425 
2426 	if (inp == NULL)
2427 		smr_exit(pcbinfo->ipi_smr);
2428 
2429 	return (inp);
2430 }
2431 
2432 /*
2433  * Public inpcb lookup routines, accepting a 4-tuple, and optionally, an mbuf
2434  * from which a pre-calculated hash value may be extracted.
2435  */
2436 struct inpcb *
2437 in_pcblookup(struct inpcbinfo *pcbinfo, struct in_addr faddr, u_int fport,
2438     struct in_addr laddr, u_int lport, int lookupflags,
2439     struct ifnet *ifp __unused)
2440 {
2441 	return (in_pcblookup_hash_smr(pcbinfo, faddr, fport, laddr, lport,
2442 	    lookupflags, M_NODOM));
2443 }
2444 
2445 struct inpcb *
2446 in_pcblookup_mbuf(struct inpcbinfo *pcbinfo, struct in_addr faddr,
2447     u_int fport, struct in_addr laddr, u_int lport, int lookupflags,
2448     struct ifnet *ifp __unused, struct mbuf *m)
2449 {
2450 	return (in_pcblookup_hash_smr(pcbinfo, faddr, fport, laddr, lport,
2451 	    lookupflags, m->m_pkthdr.numa_domain));
2452 }
2453 #endif /* INET */
2454 
2455 static bool
2456 in_pcbjailed(const struct inpcb *inp, unsigned int flag)
2457 {
2458 	return (prison_flag(inp->inp_cred, flag) != 0);
2459 }
2460 
2461 /*
2462  * Insert the PCB into a hash chain using ordering rules which ensure that
2463  * in_pcblookup_hash_wild_*() always encounter the highest-ranking PCB first.
2464  *
2465  * Specifically, keep jailed PCBs in front of non-jailed PCBs, and keep PCBs
2466  * with exact local addresses ahead of wildcard PCBs.  Unbound v4-mapped v6 PCBs
2467  * always appear last no matter whether they are jailed.
2468  */
2469 static void
2470 _in_pcbinshash_wild(struct inpcbhead *pcbhash, struct inpcb *inp)
2471 {
2472 	struct inpcb *last;
2473 	bool bound, injail;
2474 
2475 	INP_LOCK_ASSERT(inp);
2476 	INP_HASH_WLOCK_ASSERT(inp->inp_pcbinfo);
2477 
2478 	last = NULL;
2479 	bound = inp->inp_laddr.s_addr != INADDR_ANY;
2480 	if (!bound && (inp->inp_vflag & INP_IPV6PROTO) != 0) {
2481 		CK_LIST_FOREACH(last, pcbhash, inp_hash_wild) {
2482 			if (CK_LIST_NEXT(last, inp_hash_wild) == NULL) {
2483 				CK_LIST_INSERT_AFTER(last, inp, inp_hash_wild);
2484 				return;
2485 			}
2486 		}
2487 		CK_LIST_INSERT_HEAD(pcbhash, inp, inp_hash_wild);
2488 		return;
2489 	}
2490 
2491 	injail = in_pcbjailed(inp, PR_IP4);
2492 	if (!injail) {
2493 		CK_LIST_FOREACH(last, pcbhash, inp_hash_wild) {
2494 			if (!in_pcbjailed(last, PR_IP4))
2495 				break;
2496 			if (CK_LIST_NEXT(last, inp_hash_wild) == NULL) {
2497 				CK_LIST_INSERT_AFTER(last, inp, inp_hash_wild);
2498 				return;
2499 			}
2500 		}
2501 	} else if (!CK_LIST_EMPTY(pcbhash) &&
2502 	    !in_pcbjailed(CK_LIST_FIRST(pcbhash), PR_IP4)) {
2503 		CK_LIST_INSERT_HEAD(pcbhash, inp, inp_hash_wild);
2504 		return;
2505 	}
2506 	if (!bound) {
2507 		CK_LIST_FOREACH_FROM(last, pcbhash, inp_hash_wild) {
2508 			if (last->inp_laddr.s_addr == INADDR_ANY)
2509 				break;
2510 			if (CK_LIST_NEXT(last, inp_hash_wild) == NULL) {
2511 				CK_LIST_INSERT_AFTER(last, inp, inp_hash_wild);
2512 				return;
2513 			}
2514 		}
2515 	}
2516 	if (last == NULL)
2517 		CK_LIST_INSERT_HEAD(pcbhash, inp, inp_hash_wild);
2518 	else
2519 		CK_LIST_INSERT_BEFORE(last, inp, inp_hash_wild);
2520 }
2521 
2522 #ifdef INET6
2523 /*
2524  * See the comment above _in_pcbinshash_wild().
2525  */
2526 static void
2527 _in6_pcbinshash_wild(struct inpcbhead *pcbhash, struct inpcb *inp)
2528 {
2529 	struct inpcb *last;
2530 	bool bound, injail;
2531 
2532 	INP_LOCK_ASSERT(inp);
2533 	INP_HASH_WLOCK_ASSERT(inp->inp_pcbinfo);
2534 
2535 	last = NULL;
2536 	bound = !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr);
2537 	injail = in_pcbjailed(inp, PR_IP6);
2538 	if (!injail) {
2539 		CK_LIST_FOREACH(last, pcbhash, inp_hash_wild) {
2540 			if (!in_pcbjailed(last, PR_IP6))
2541 				break;
2542 			if (CK_LIST_NEXT(last, inp_hash_wild) == NULL) {
2543 				CK_LIST_INSERT_AFTER(last, inp, inp_hash_wild);
2544 				return;
2545 			}
2546 		}
2547 	} else if (!CK_LIST_EMPTY(pcbhash) &&
2548 	    !in_pcbjailed(CK_LIST_FIRST(pcbhash), PR_IP6)) {
2549 		CK_LIST_INSERT_HEAD(pcbhash, inp, inp_hash_wild);
2550 		return;
2551 	}
2552 	if (!bound) {
2553 		CK_LIST_FOREACH_FROM(last, pcbhash, inp_hash_wild) {
2554 			if (IN6_IS_ADDR_UNSPECIFIED(&last->in6p_laddr))
2555 				break;
2556 			if (CK_LIST_NEXT(last, inp_hash_wild) == NULL) {
2557 				CK_LIST_INSERT_AFTER(last, inp, inp_hash_wild);
2558 				return;
2559 			}
2560 		}
2561 	}
2562 	if (last == NULL)
2563 		CK_LIST_INSERT_HEAD(pcbhash, inp, inp_hash_wild);
2564 	else
2565 		CK_LIST_INSERT_BEFORE(last, inp, inp_hash_wild);
2566 }
2567 #endif
2568 
2569 /*
2570  * Insert PCB onto various hash lists.
2571  */
2572 int
2573 in_pcbinshash(struct inpcb *inp)
2574 {
2575 	struct inpcbhead *pcbhash;
2576 	struct inpcbporthead *pcbporthash;
2577 	struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
2578 	struct inpcbport *phd;
2579 	uint32_t hash;
2580 	bool connected;
2581 
2582 	INP_WLOCK_ASSERT(inp);
2583 	INP_HASH_WLOCK_ASSERT(pcbinfo);
2584 	KASSERT((inp->inp_flags & INP_INHASHLIST) == 0,
2585 	    ("in_pcbinshash: INP_INHASHLIST"));
2586 
2587 #ifdef INET6
2588 	if (inp->inp_vflag & INP_IPV6) {
2589 		hash = INP6_PCBHASH(&inp->in6p_faddr, inp->inp_lport,
2590 		    inp->inp_fport, pcbinfo->ipi_hashmask);
2591 		connected = !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr);
2592 	} else
2593 #endif
2594 	{
2595 		hash = INP_PCBHASH(&inp->inp_faddr, inp->inp_lport,
2596 		    inp->inp_fport, pcbinfo->ipi_hashmask);
2597 		connected = !in_nullhost(inp->inp_faddr);
2598 	}
2599 
2600 	if (connected)
2601 		pcbhash = &pcbinfo->ipi_hash_exact[hash];
2602 	else
2603 		pcbhash = &pcbinfo->ipi_hash_wild[hash];
2604 
2605 	pcbporthash = &pcbinfo->ipi_porthashbase[
2606 	    INP_PCBPORTHASH(inp->inp_lport, pcbinfo->ipi_porthashmask)];
2607 
2608 	/*
2609 	 * Add entry to load balance group.
2610 	 * Only do this if SO_REUSEPORT_LB is set.
2611 	 */
2612 	if ((inp->inp_socket->so_options & SO_REUSEPORT_LB) != 0) {
2613 		int error = in_pcbinslbgrouphash(inp, M_NODOM);
2614 		if (error != 0)
2615 			return (error);
2616 	}
2617 
2618 	/*
2619 	 * Go through port list and look for a head for this lport.
2620 	 */
2621 	CK_LIST_FOREACH(phd, pcbporthash, phd_hash) {
2622 		if (phd->phd_port == inp->inp_lport)
2623 			break;
2624 	}
2625 
2626 	/*
2627 	 * If none exists, malloc one and tack it on.
2628 	 */
2629 	if (phd == NULL) {
2630 		phd = uma_zalloc_smr(pcbinfo->ipi_portzone, M_NOWAIT);
2631 		if (phd == NULL) {
2632 			if ((inp->inp_flags & INP_INLBGROUP) != 0)
2633 				in_pcbremlbgrouphash(inp);
2634 			return (ENOMEM);
2635 		}
2636 		phd->phd_port = inp->inp_lport;
2637 		CK_LIST_INIT(&phd->phd_pcblist);
2638 		CK_LIST_INSERT_HEAD(pcbporthash, phd, phd_hash);
2639 	}
2640 	inp->inp_phd = phd;
2641 	CK_LIST_INSERT_HEAD(&phd->phd_pcblist, inp, inp_portlist);
2642 
2643 	/*
2644 	 * The PCB may have been disconnected in the past.  Before we can safely
2645 	 * make it visible in the hash table, we must wait for all readers which
2646 	 * may be traversing this PCB to finish.
2647 	 */
2648 	if (inp->inp_smr != SMR_SEQ_INVALID) {
2649 		smr_wait(pcbinfo->ipi_smr, inp->inp_smr);
2650 		inp->inp_smr = SMR_SEQ_INVALID;
2651 	}
2652 
2653 	if (connected)
2654 		CK_LIST_INSERT_HEAD(pcbhash, inp, inp_hash_exact);
2655 	else {
2656 #ifdef INET6
2657 		if ((inp->inp_vflag & INP_IPV6) != 0)
2658 			_in6_pcbinshash_wild(pcbhash, inp);
2659 		else
2660 #endif
2661 			_in_pcbinshash_wild(pcbhash, inp);
2662 	}
2663 	inp->inp_flags |= INP_INHASHLIST;
2664 
2665 	return (0);
2666 }
2667 
2668 void
2669 in_pcbremhash_locked(struct inpcb *inp)
2670 {
2671 	struct inpcbport *phd = inp->inp_phd;
2672 
2673 	INP_WLOCK_ASSERT(inp);
2674 	INP_HASH_WLOCK_ASSERT(inp->inp_pcbinfo);
2675 	MPASS(inp->inp_flags & INP_INHASHLIST);
2676 
2677 	if ((inp->inp_flags & INP_INLBGROUP) != 0)
2678 		in_pcbremlbgrouphash(inp);
2679 #ifdef INET6
2680 	if (inp->inp_vflag & INP_IPV6) {
2681 		if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr))
2682 			CK_LIST_REMOVE(inp, inp_hash_wild);
2683 		else
2684 			CK_LIST_REMOVE(inp, inp_hash_exact);
2685 	} else
2686 #endif
2687 	{
2688 		if (in_nullhost(inp->inp_faddr))
2689 			CK_LIST_REMOVE(inp, inp_hash_wild);
2690 		else
2691 			CK_LIST_REMOVE(inp, inp_hash_exact);
2692 	}
2693 	CK_LIST_REMOVE(inp, inp_portlist);
2694 	if (CK_LIST_FIRST(&phd->phd_pcblist) == NULL) {
2695 		CK_LIST_REMOVE(phd, phd_hash);
2696 		uma_zfree_smr(inp->inp_pcbinfo->ipi_portzone, phd);
2697 	}
2698 	inp->inp_flags &= ~INP_INHASHLIST;
2699 }
2700 
2701 static void
2702 in_pcbremhash(struct inpcb *inp)
2703 {
2704 	INP_HASH_WLOCK(inp->inp_pcbinfo);
2705 	in_pcbremhash_locked(inp);
2706 	INP_HASH_WUNLOCK(inp->inp_pcbinfo);
2707 }
2708 
2709 /*
2710  * Move PCB to the proper hash bucket when { faddr, fport } have  been
2711  * changed. NOTE: This does not handle the case of the lport changing (the
2712  * hashed port list would have to be updated as well), so the lport must
2713  * not change after in_pcbinshash() has been called.
2714  */
2715 void
2716 in_pcbrehash(struct inpcb *inp)
2717 {
2718 	struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
2719 	struct inpcbhead *head;
2720 	uint32_t hash;
2721 	bool connected;
2722 
2723 	INP_WLOCK_ASSERT(inp);
2724 	INP_HASH_WLOCK_ASSERT(pcbinfo);
2725 	KASSERT(inp->inp_flags & INP_INHASHLIST,
2726 	    ("%s: !INP_INHASHLIST", __func__));
2727 	KASSERT(inp->inp_smr == SMR_SEQ_INVALID,
2728 	    ("%s: inp was disconnected", __func__));
2729 
2730 #ifdef INET6
2731 	if (inp->inp_vflag & INP_IPV6) {
2732 		hash = INP6_PCBHASH(&inp->in6p_faddr, inp->inp_lport,
2733 		    inp->inp_fport, pcbinfo->ipi_hashmask);
2734 		connected = !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr);
2735 	} else
2736 #endif
2737 	{
2738 		hash = INP_PCBHASH(&inp->inp_faddr, inp->inp_lport,
2739 		    inp->inp_fport, pcbinfo->ipi_hashmask);
2740 		connected = !in_nullhost(inp->inp_faddr);
2741 	}
2742 
2743 	/*
2744 	 * When rehashing, the caller must ensure that either the new or the old
2745 	 * foreign address was unspecified.
2746 	 */
2747 	if (connected)
2748 		CK_LIST_REMOVE(inp, inp_hash_wild);
2749 	else
2750 		CK_LIST_REMOVE(inp, inp_hash_exact);
2751 
2752 	if (connected) {
2753 		head = &pcbinfo->ipi_hash_exact[hash];
2754 		CK_LIST_INSERT_HEAD(head, inp, inp_hash_exact);
2755 	} else {
2756 		head = &pcbinfo->ipi_hash_wild[hash];
2757 		CK_LIST_INSERT_HEAD(head, inp, inp_hash_wild);
2758 	}
2759 }
2760 
2761 /*
2762  * Check for alternatives when higher level complains
2763  * about service problems.  For now, invalidate cached
2764  * routing information.  If the route was created dynamically
2765  * (by a redirect), time to try a default gateway again.
2766  */
2767 void
2768 in_losing(struct inpcb *inp)
2769 {
2770 
2771 	RO_INVALIDATE_CACHE(&inp->inp_route);
2772 	return;
2773 }
2774 
2775 /*
2776  * A set label operation has occurred at the socket layer, propagate the
2777  * label change into the in_pcb for the socket.
2778  */
2779 void
2780 in_pcbsosetlabel(struct socket *so)
2781 {
2782 #ifdef MAC
2783 	struct inpcb *inp;
2784 
2785 	inp = sotoinpcb(so);
2786 	KASSERT(inp != NULL, ("in_pcbsosetlabel: so->so_pcb == NULL"));
2787 
2788 	INP_WLOCK(inp);
2789 	SOCK_LOCK(so);
2790 	mac_inpcb_sosetlabel(so, inp);
2791 	SOCK_UNLOCK(so);
2792 	INP_WUNLOCK(inp);
2793 #endif
2794 }
2795 
2796 void
2797 inp_wlock(struct inpcb *inp)
2798 {
2799 
2800 	INP_WLOCK(inp);
2801 }
2802 
2803 void
2804 inp_wunlock(struct inpcb *inp)
2805 {
2806 
2807 	INP_WUNLOCK(inp);
2808 }
2809 
2810 void
2811 inp_rlock(struct inpcb *inp)
2812 {
2813 
2814 	INP_RLOCK(inp);
2815 }
2816 
2817 void
2818 inp_runlock(struct inpcb *inp)
2819 {
2820 
2821 	INP_RUNLOCK(inp);
2822 }
2823 
2824 #ifdef INVARIANT_SUPPORT
2825 void
2826 inp_lock_assert(struct inpcb *inp)
2827 {
2828 
2829 	INP_WLOCK_ASSERT(inp);
2830 }
2831 
2832 void
2833 inp_unlock_assert(struct inpcb *inp)
2834 {
2835 
2836 	INP_UNLOCK_ASSERT(inp);
2837 }
2838 #endif
2839 
2840 void
2841 inp_apply_all(struct inpcbinfo *pcbinfo,
2842     void (*func)(struct inpcb *, void *), void *arg)
2843 {
2844 	struct inpcb_iterator inpi = INP_ALL_ITERATOR(pcbinfo,
2845 	    INPLOOKUP_WLOCKPCB);
2846 	struct inpcb *inp;
2847 
2848 	while ((inp = inp_next(&inpi)) != NULL)
2849 		func(inp, arg);
2850 }
2851 
2852 struct socket *
2853 inp_inpcbtosocket(struct inpcb *inp)
2854 {
2855 
2856 	INP_WLOCK_ASSERT(inp);
2857 	return (inp->inp_socket);
2858 }
2859 
2860 struct tcpcb *
2861 inp_inpcbtotcpcb(struct inpcb *inp)
2862 {
2863 
2864 	INP_WLOCK_ASSERT(inp);
2865 	return ((struct tcpcb *)inp->inp_ppcb);
2866 }
2867 
2868 int
2869 inp_ip_tos_get(const struct inpcb *inp)
2870 {
2871 
2872 	return (inp->inp_ip_tos);
2873 }
2874 
2875 void
2876 inp_ip_tos_set(struct inpcb *inp, int val)
2877 {
2878 
2879 	inp->inp_ip_tos = val;
2880 }
2881 
2882 void
2883 inp_4tuple_get(struct inpcb *inp, uint32_t *laddr, uint16_t *lp,
2884     uint32_t *faddr, uint16_t *fp)
2885 {
2886 
2887 	INP_LOCK_ASSERT(inp);
2888 	*laddr = inp->inp_laddr.s_addr;
2889 	*faddr = inp->inp_faddr.s_addr;
2890 	*lp = inp->inp_lport;
2891 	*fp = inp->inp_fport;
2892 }
2893 
2894 struct inpcb *
2895 so_sotoinpcb(struct socket *so)
2896 {
2897 
2898 	return (sotoinpcb(so));
2899 }
2900 
2901 /*
2902  * Create an external-format (``xinpcb'') structure using the information in
2903  * the kernel-format in_pcb structure pointed to by inp.  This is done to
2904  * reduce the spew of irrelevant information over this interface, to isolate
2905  * user code from changes in the kernel structure, and potentially to provide
2906  * information-hiding if we decide that some of this information should be
2907  * hidden from users.
2908  */
2909 void
2910 in_pcbtoxinpcb(const struct inpcb *inp, struct xinpcb *xi)
2911 {
2912 
2913 	bzero(xi, sizeof(*xi));
2914 	xi->xi_len = sizeof(struct xinpcb);
2915 	if (inp->inp_socket)
2916 		sotoxsocket(inp->inp_socket, &xi->xi_socket);
2917 	bcopy(&inp->inp_inc, &xi->inp_inc, sizeof(struct in_conninfo));
2918 	xi->inp_gencnt = inp->inp_gencnt;
2919 	xi->inp_ppcb = (uintptr_t)inp->inp_ppcb;
2920 	xi->inp_flow = inp->inp_flow;
2921 	xi->inp_flowid = inp->inp_flowid;
2922 	xi->inp_flowtype = inp->inp_flowtype;
2923 	xi->inp_flags = inp->inp_flags;
2924 	xi->inp_flags2 = inp->inp_flags2;
2925 	xi->in6p_cksum = inp->in6p_cksum;
2926 	xi->in6p_hops = inp->in6p_hops;
2927 	xi->inp_ip_tos = inp->inp_ip_tos;
2928 	xi->inp_vflag = inp->inp_vflag;
2929 	xi->inp_ip_ttl = inp->inp_ip_ttl;
2930 	xi->inp_ip_p = inp->inp_ip_p;
2931 	xi->inp_ip_minttl = inp->inp_ip_minttl;
2932 }
2933 
2934 int
2935 sysctl_setsockopt(SYSCTL_HANDLER_ARGS, struct inpcbinfo *pcbinfo,
2936     int (*ctloutput_set)(struct inpcb *, struct sockopt *))
2937 {
2938 	struct sockopt sopt;
2939 	struct inpcb_iterator inpi = INP_ALL_ITERATOR(pcbinfo,
2940 	    INPLOOKUP_WLOCKPCB);
2941 	struct inpcb *inp;
2942 	struct sockopt_parameters *params;
2943 	struct socket *so;
2944 	int error;
2945 	char buf[1024];
2946 
2947 	if (req->oldptr != NULL || req->oldlen != 0)
2948 		return (EINVAL);
2949 	if (req->newptr == NULL)
2950 		return (EPERM);
2951 	if (req->newlen > sizeof(buf))
2952 		return (ENOMEM);
2953 	error = SYSCTL_IN(req, buf, req->newlen);
2954 	if (error != 0)
2955 		return (error);
2956 	if (req->newlen < sizeof(struct sockopt_parameters))
2957 		return (EINVAL);
2958 	params = (struct sockopt_parameters *)buf;
2959 	sopt.sopt_level = params->sop_level;
2960 	sopt.sopt_name = params->sop_optname;
2961 	sopt.sopt_dir = SOPT_SET;
2962 	sopt.sopt_val = params->sop_optval;
2963 	sopt.sopt_valsize = req->newlen - sizeof(struct sockopt_parameters);
2964 	sopt.sopt_td = NULL;
2965 #ifdef INET6
2966 	if (params->sop_inc.inc_flags & INC_ISIPV6) {
2967 		if (IN6_IS_SCOPE_LINKLOCAL(&params->sop_inc.inc6_laddr))
2968 			params->sop_inc.inc6_laddr.s6_addr16[1] =
2969 			    htons(params->sop_inc.inc6_zoneid & 0xffff);
2970 		if (IN6_IS_SCOPE_LINKLOCAL(&params->sop_inc.inc6_faddr))
2971 			params->sop_inc.inc6_faddr.s6_addr16[1] =
2972 			    htons(params->sop_inc.inc6_zoneid & 0xffff);
2973 	}
2974 #endif
2975 	if (params->sop_inc.inc_lport != htons(0)) {
2976 		if (params->sop_inc.inc_fport == htons(0))
2977 			inpi.hash = INP_PCBHASH_WILD(params->sop_inc.inc_lport,
2978 			    pcbinfo->ipi_hashmask);
2979 		else
2980 #ifdef INET6
2981 			if (params->sop_inc.inc_flags & INC_ISIPV6)
2982 				inpi.hash = INP6_PCBHASH(
2983 				    &params->sop_inc.inc6_faddr,
2984 				    params->sop_inc.inc_lport,
2985 				    params->sop_inc.inc_fport,
2986 				    pcbinfo->ipi_hashmask);
2987 			else
2988 #endif
2989 				inpi.hash = INP_PCBHASH(
2990 				    &params->sop_inc.inc_faddr,
2991 				    params->sop_inc.inc_lport,
2992 				    params->sop_inc.inc_fport,
2993 				    pcbinfo->ipi_hashmask);
2994 	}
2995 	while ((inp = inp_next(&inpi)) != NULL)
2996 		if (inp->inp_gencnt == params->sop_id) {
2997 			if (inp->inp_flags & INP_DROPPED) {
2998 				INP_WUNLOCK(inp);
2999 				return (ECONNRESET);
3000 			}
3001 			so = inp->inp_socket;
3002 			KASSERT(so != NULL, ("inp_socket == NULL"));
3003 			soref(so);
3004 			error = (*ctloutput_set)(inp, &sopt);
3005 			sorele(so);
3006 			break;
3007 		}
3008 	if (inp == NULL)
3009 		error = ESRCH;
3010 	return (error);
3011 }
3012 
3013 #ifdef DDB
3014 static void
3015 db_print_indent(int indent)
3016 {
3017 	int i;
3018 
3019 	for (i = 0; i < indent; i++)
3020 		db_printf(" ");
3021 }
3022 
3023 static void
3024 db_print_inconninfo(struct in_conninfo *inc, const char *name, int indent)
3025 {
3026 	char faddr_str[48], laddr_str[48];
3027 
3028 	db_print_indent(indent);
3029 	db_printf("%s at %p\n", name, inc);
3030 
3031 	indent += 2;
3032 
3033 #ifdef INET6
3034 	if (inc->inc_flags & INC_ISIPV6) {
3035 		/* IPv6. */
3036 		ip6_sprintf(laddr_str, &inc->inc6_laddr);
3037 		ip6_sprintf(faddr_str, &inc->inc6_faddr);
3038 	} else
3039 #endif
3040 	{
3041 		/* IPv4. */
3042 		inet_ntoa_r(inc->inc_laddr, laddr_str);
3043 		inet_ntoa_r(inc->inc_faddr, faddr_str);
3044 	}
3045 	db_print_indent(indent);
3046 	db_printf("inc_laddr %s   inc_lport %u\n", laddr_str,
3047 	    ntohs(inc->inc_lport));
3048 	db_print_indent(indent);
3049 	db_printf("inc_faddr %s   inc_fport %u\n", faddr_str,
3050 	    ntohs(inc->inc_fport));
3051 }
3052 
3053 static void
3054 db_print_inpflags(int inp_flags)
3055 {
3056 	int comma;
3057 
3058 	comma = 0;
3059 	if (inp_flags & INP_RECVOPTS) {
3060 		db_printf("%sINP_RECVOPTS", comma ? ", " : "");
3061 		comma = 1;
3062 	}
3063 	if (inp_flags & INP_RECVRETOPTS) {
3064 		db_printf("%sINP_RECVRETOPTS", comma ? ", " : "");
3065 		comma = 1;
3066 	}
3067 	if (inp_flags & INP_RECVDSTADDR) {
3068 		db_printf("%sINP_RECVDSTADDR", comma ? ", " : "");
3069 		comma = 1;
3070 	}
3071 	if (inp_flags & INP_ORIGDSTADDR) {
3072 		db_printf("%sINP_ORIGDSTADDR", comma ? ", " : "");
3073 		comma = 1;
3074 	}
3075 	if (inp_flags & INP_HDRINCL) {
3076 		db_printf("%sINP_HDRINCL", comma ? ", " : "");
3077 		comma = 1;
3078 	}
3079 	if (inp_flags & INP_HIGHPORT) {
3080 		db_printf("%sINP_HIGHPORT", comma ? ", " : "");
3081 		comma = 1;
3082 	}
3083 	if (inp_flags & INP_LOWPORT) {
3084 		db_printf("%sINP_LOWPORT", comma ? ", " : "");
3085 		comma = 1;
3086 	}
3087 	if (inp_flags & INP_ANONPORT) {
3088 		db_printf("%sINP_ANONPORT", comma ? ", " : "");
3089 		comma = 1;
3090 	}
3091 	if (inp_flags & INP_RECVIF) {
3092 		db_printf("%sINP_RECVIF", comma ? ", " : "");
3093 		comma = 1;
3094 	}
3095 	if (inp_flags & INP_MTUDISC) {
3096 		db_printf("%sINP_MTUDISC", comma ? ", " : "");
3097 		comma = 1;
3098 	}
3099 	if (inp_flags & INP_RECVTTL) {
3100 		db_printf("%sINP_RECVTTL", comma ? ", " : "");
3101 		comma = 1;
3102 	}
3103 	if (inp_flags & INP_DONTFRAG) {
3104 		db_printf("%sINP_DONTFRAG", comma ? ", " : "");
3105 		comma = 1;
3106 	}
3107 	if (inp_flags & INP_RECVTOS) {
3108 		db_printf("%sINP_RECVTOS", comma ? ", " : "");
3109 		comma = 1;
3110 	}
3111 	if (inp_flags & IN6P_IPV6_V6ONLY) {
3112 		db_printf("%sIN6P_IPV6_V6ONLY", comma ? ", " : "");
3113 		comma = 1;
3114 	}
3115 	if (inp_flags & IN6P_PKTINFO) {
3116 		db_printf("%sIN6P_PKTINFO", comma ? ", " : "");
3117 		comma = 1;
3118 	}
3119 	if (inp_flags & IN6P_HOPLIMIT) {
3120 		db_printf("%sIN6P_HOPLIMIT", comma ? ", " : "");
3121 		comma = 1;
3122 	}
3123 	if (inp_flags & IN6P_HOPOPTS) {
3124 		db_printf("%sIN6P_HOPOPTS", comma ? ", " : "");
3125 		comma = 1;
3126 	}
3127 	if (inp_flags & IN6P_DSTOPTS) {
3128 		db_printf("%sIN6P_DSTOPTS", comma ? ", " : "");
3129 		comma = 1;
3130 	}
3131 	if (inp_flags & IN6P_RTHDR) {
3132 		db_printf("%sIN6P_RTHDR", comma ? ", " : "");
3133 		comma = 1;
3134 	}
3135 	if (inp_flags & IN6P_RTHDRDSTOPTS) {
3136 		db_printf("%sIN6P_RTHDRDSTOPTS", comma ? ", " : "");
3137 		comma = 1;
3138 	}
3139 	if (inp_flags & IN6P_TCLASS) {
3140 		db_printf("%sIN6P_TCLASS", comma ? ", " : "");
3141 		comma = 1;
3142 	}
3143 	if (inp_flags & IN6P_AUTOFLOWLABEL) {
3144 		db_printf("%sIN6P_AUTOFLOWLABEL", comma ? ", " : "");
3145 		comma = 1;
3146 	}
3147 	if (inp_flags & INP_ONESBCAST) {
3148 		db_printf("%sINP_ONESBCAST", comma ? ", " : "");
3149 		comma  = 1;
3150 	}
3151 	if (inp_flags & INP_DROPPED) {
3152 		db_printf("%sINP_DROPPED", comma ? ", " : "");
3153 		comma  = 1;
3154 	}
3155 	if (inp_flags & INP_SOCKREF) {
3156 		db_printf("%sINP_SOCKREF", comma ? ", " : "");
3157 		comma  = 1;
3158 	}
3159 	if (inp_flags & IN6P_RFC2292) {
3160 		db_printf("%sIN6P_RFC2292", comma ? ", " : "");
3161 		comma = 1;
3162 	}
3163 	if (inp_flags & IN6P_MTU) {
3164 		db_printf("IN6P_MTU%s", comma ? ", " : "");
3165 		comma = 1;
3166 	}
3167 }
3168 
3169 static void
3170 db_print_inpvflag(u_char inp_vflag)
3171 {
3172 	int comma;
3173 
3174 	comma = 0;
3175 	if (inp_vflag & INP_IPV4) {
3176 		db_printf("%sINP_IPV4", comma ? ", " : "");
3177 		comma  = 1;
3178 	}
3179 	if (inp_vflag & INP_IPV6) {
3180 		db_printf("%sINP_IPV6", comma ? ", " : "");
3181 		comma  = 1;
3182 	}
3183 	if (inp_vflag & INP_IPV6PROTO) {
3184 		db_printf("%sINP_IPV6PROTO", comma ? ", " : "");
3185 		comma  = 1;
3186 	}
3187 }
3188 
3189 static void
3190 db_print_inpcb(struct inpcb *inp, const char *name, int indent)
3191 {
3192 
3193 	db_print_indent(indent);
3194 	db_printf("%s at %p\n", name, inp);
3195 
3196 	indent += 2;
3197 
3198 	db_print_indent(indent);
3199 	db_printf("inp_flow: 0x%x\n", inp->inp_flow);
3200 
3201 	db_print_inconninfo(&inp->inp_inc, "inp_conninfo", indent);
3202 
3203 	db_print_indent(indent);
3204 	db_printf("inp_ppcb: %p   inp_pcbinfo: %p   inp_socket: %p\n",
3205 	    inp->inp_ppcb, inp->inp_pcbinfo, inp->inp_socket);
3206 
3207 	db_print_indent(indent);
3208 	db_printf("inp_label: %p   inp_flags: 0x%x (",
3209 	   inp->inp_label, inp->inp_flags);
3210 	db_print_inpflags(inp->inp_flags);
3211 	db_printf(")\n");
3212 
3213 	db_print_indent(indent);
3214 	db_printf("inp_sp: %p   inp_vflag: 0x%x (", inp->inp_sp,
3215 	    inp->inp_vflag);
3216 	db_print_inpvflag(inp->inp_vflag);
3217 	db_printf(")\n");
3218 
3219 	db_print_indent(indent);
3220 	db_printf("inp_ip_ttl: %d   inp_ip_p: %d   inp_ip_minttl: %d\n",
3221 	    inp->inp_ip_ttl, inp->inp_ip_p, inp->inp_ip_minttl);
3222 
3223 	db_print_indent(indent);
3224 #ifdef INET6
3225 	if (inp->inp_vflag & INP_IPV6) {
3226 		db_printf("in6p_options: %p   in6p_outputopts: %p   "
3227 		    "in6p_moptions: %p\n", inp->in6p_options,
3228 		    inp->in6p_outputopts, inp->in6p_moptions);
3229 		db_printf("in6p_icmp6filt: %p   in6p_cksum %d   "
3230 		    "in6p_hops %u\n", inp->in6p_icmp6filt, inp->in6p_cksum,
3231 		    inp->in6p_hops);
3232 	} else
3233 #endif
3234 	{
3235 		db_printf("inp_ip_tos: %d   inp_ip_options: %p   "
3236 		    "inp_ip_moptions: %p\n", inp->inp_ip_tos,
3237 		    inp->inp_options, inp->inp_moptions);
3238 	}
3239 
3240 	db_print_indent(indent);
3241 	db_printf("inp_phd: %p   inp_gencnt: %ju\n", inp->inp_phd,
3242 	    (uintmax_t)inp->inp_gencnt);
3243 }
3244 
3245 DB_SHOW_COMMAND(inpcb, db_show_inpcb)
3246 {
3247 	struct inpcb *inp;
3248 
3249 	if (!have_addr) {
3250 		db_printf("usage: show inpcb <addr>\n");
3251 		return;
3252 	}
3253 	inp = (struct inpcb *)addr;
3254 
3255 	db_print_inpcb(inp, "inpcb", 0);
3256 }
3257 #endif /* DDB */
3258 
3259 #ifdef RATELIMIT
3260 /*
3261  * Modify TX rate limit based on the existing "inp->inp_snd_tag",
3262  * if any.
3263  */
3264 int
3265 in_pcbmodify_txrtlmt(struct inpcb *inp, uint32_t max_pacing_rate)
3266 {
3267 	union if_snd_tag_modify_params params = {
3268 		.rate_limit.max_rate = max_pacing_rate,
3269 		.rate_limit.flags = M_NOWAIT,
3270 	};
3271 	struct m_snd_tag *mst;
3272 	int error;
3273 
3274 	mst = inp->inp_snd_tag;
3275 	if (mst == NULL)
3276 		return (EINVAL);
3277 
3278 	if (mst->sw->snd_tag_modify == NULL) {
3279 		error = EOPNOTSUPP;
3280 	} else {
3281 		error = mst->sw->snd_tag_modify(mst, &params);
3282 	}
3283 	return (error);
3284 }
3285 
3286 /*
3287  * Query existing TX rate limit based on the existing
3288  * "inp->inp_snd_tag", if any.
3289  */
3290 int
3291 in_pcbquery_txrtlmt(struct inpcb *inp, uint32_t *p_max_pacing_rate)
3292 {
3293 	union if_snd_tag_query_params params = { };
3294 	struct m_snd_tag *mst;
3295 	int error;
3296 
3297 	mst = inp->inp_snd_tag;
3298 	if (mst == NULL)
3299 		return (EINVAL);
3300 
3301 	if (mst->sw->snd_tag_query == NULL) {
3302 		error = EOPNOTSUPP;
3303 	} else {
3304 		error = mst->sw->snd_tag_query(mst, &params);
3305 		if (error == 0 && p_max_pacing_rate != NULL)
3306 			*p_max_pacing_rate = params.rate_limit.max_rate;
3307 	}
3308 	return (error);
3309 }
3310 
3311 /*
3312  * Query existing TX queue level based on the existing
3313  * "inp->inp_snd_tag", if any.
3314  */
3315 int
3316 in_pcbquery_txrlevel(struct inpcb *inp, uint32_t *p_txqueue_level)
3317 {
3318 	union if_snd_tag_query_params params = { };
3319 	struct m_snd_tag *mst;
3320 	int error;
3321 
3322 	mst = inp->inp_snd_tag;
3323 	if (mst == NULL)
3324 		return (EINVAL);
3325 
3326 	if (mst->sw->snd_tag_query == NULL)
3327 		return (EOPNOTSUPP);
3328 
3329 	error = mst->sw->snd_tag_query(mst, &params);
3330 	if (error == 0 && p_txqueue_level != NULL)
3331 		*p_txqueue_level = params.rate_limit.queue_level;
3332 	return (error);
3333 }
3334 
3335 /*
3336  * Allocate a new TX rate limit send tag from the network interface
3337  * given by the "ifp" argument and save it in "inp->inp_snd_tag":
3338  */
3339 int
3340 in_pcbattach_txrtlmt(struct inpcb *inp, struct ifnet *ifp,
3341     uint32_t flowtype, uint32_t flowid, uint32_t max_pacing_rate, struct m_snd_tag **st)
3342 
3343 {
3344 	union if_snd_tag_alloc_params params = {
3345 		.rate_limit.hdr.type = (max_pacing_rate == -1U) ?
3346 		    IF_SND_TAG_TYPE_UNLIMITED : IF_SND_TAG_TYPE_RATE_LIMIT,
3347 		.rate_limit.hdr.flowid = flowid,
3348 		.rate_limit.hdr.flowtype = flowtype,
3349 		.rate_limit.hdr.numa_domain = inp->inp_numa_domain,
3350 		.rate_limit.max_rate = max_pacing_rate,
3351 		.rate_limit.flags = M_NOWAIT,
3352 	};
3353 	int error;
3354 
3355 	INP_WLOCK_ASSERT(inp);
3356 
3357 	/*
3358 	 * If there is already a send tag, or the INP is being torn
3359 	 * down, allocating a new send tag is not allowed. Else send
3360 	 * tags may leak.
3361 	 */
3362 	if (*st != NULL || (inp->inp_flags & INP_DROPPED) != 0)
3363 		return (EINVAL);
3364 
3365 	error = m_snd_tag_alloc(ifp, &params, st);
3366 #ifdef INET
3367 	if (error == 0) {
3368 		counter_u64_add(rate_limit_set_ok, 1);
3369 		counter_u64_add(rate_limit_active, 1);
3370 	} else if (error != EOPNOTSUPP)
3371 		  counter_u64_add(rate_limit_alloc_fail, 1);
3372 #endif
3373 	return (error);
3374 }
3375 
3376 void
3377 in_pcbdetach_tag(struct m_snd_tag *mst)
3378 {
3379 
3380 	m_snd_tag_rele(mst);
3381 #ifdef INET
3382 	counter_u64_add(rate_limit_active, -1);
3383 #endif
3384 }
3385 
3386 /*
3387  * Free an existing TX rate limit tag based on the "inp->inp_snd_tag",
3388  * if any:
3389  */
3390 void
3391 in_pcbdetach_txrtlmt(struct inpcb *inp)
3392 {
3393 	struct m_snd_tag *mst;
3394 
3395 	INP_WLOCK_ASSERT(inp);
3396 
3397 	mst = inp->inp_snd_tag;
3398 	inp->inp_snd_tag = NULL;
3399 
3400 	if (mst == NULL)
3401 		return;
3402 
3403 	m_snd_tag_rele(mst);
3404 #ifdef INET
3405 	counter_u64_add(rate_limit_active, -1);
3406 #endif
3407 }
3408 
3409 int
3410 in_pcboutput_txrtlmt_locked(struct inpcb *inp, struct ifnet *ifp, struct mbuf *mb, uint32_t max_pacing_rate)
3411 {
3412 	int error;
3413 
3414 	/*
3415 	 * If the existing send tag is for the wrong interface due to
3416 	 * a route change, first drop the existing tag.  Set the
3417 	 * CHANGED flag so that we will keep trying to allocate a new
3418 	 * tag if we fail to allocate one this time.
3419 	 */
3420 	if (inp->inp_snd_tag != NULL && inp->inp_snd_tag->ifp != ifp) {
3421 		in_pcbdetach_txrtlmt(inp);
3422 		inp->inp_flags2 |= INP_RATE_LIMIT_CHANGED;
3423 	}
3424 
3425 	/*
3426 	 * NOTE: When attaching to a network interface a reference is
3427 	 * made to ensure the network interface doesn't go away until
3428 	 * all ratelimit connections are gone. The network interface
3429 	 * pointers compared below represent valid network interfaces,
3430 	 * except when comparing towards NULL.
3431 	 */
3432 	if (max_pacing_rate == 0 && inp->inp_snd_tag == NULL) {
3433 		error = 0;
3434 	} else if (!(ifp->if_capenable & IFCAP_TXRTLMT)) {
3435 		if (inp->inp_snd_tag != NULL)
3436 			in_pcbdetach_txrtlmt(inp);
3437 		error = 0;
3438 	} else if (inp->inp_snd_tag == NULL) {
3439 		/*
3440 		 * In order to utilize packet pacing with RSS, we need
3441 		 * to wait until there is a valid RSS hash before we
3442 		 * can proceed:
3443 		 */
3444 		if (M_HASHTYPE_GET(mb) == M_HASHTYPE_NONE) {
3445 			error = EAGAIN;
3446 		} else {
3447 			error = in_pcbattach_txrtlmt(inp, ifp, M_HASHTYPE_GET(mb),
3448 			    mb->m_pkthdr.flowid, max_pacing_rate, &inp->inp_snd_tag);
3449 		}
3450 	} else {
3451 		error = in_pcbmodify_txrtlmt(inp, max_pacing_rate);
3452 	}
3453 	if (error == 0 || error == EOPNOTSUPP)
3454 		inp->inp_flags2 &= ~INP_RATE_LIMIT_CHANGED;
3455 
3456 	return (error);
3457 }
3458 
3459 /*
3460  * This function should be called when the INP_RATE_LIMIT_CHANGED flag
3461  * is set in the fast path and will attach/detach/modify the TX rate
3462  * limit send tag based on the socket's so_max_pacing_rate value.
3463  */
3464 void
3465 in_pcboutput_txrtlmt(struct inpcb *inp, struct ifnet *ifp, struct mbuf *mb)
3466 {
3467 	struct socket *socket;
3468 	uint32_t max_pacing_rate;
3469 	bool did_upgrade;
3470 
3471 	if (inp == NULL)
3472 		return;
3473 
3474 	socket = inp->inp_socket;
3475 	if (socket == NULL)
3476 		return;
3477 
3478 	if (!INP_WLOCKED(inp)) {
3479 		/*
3480 		 * NOTE: If the write locking fails, we need to bail
3481 		 * out and use the non-ratelimited ring for the
3482 		 * transmit until there is a new chance to get the
3483 		 * write lock.
3484 		 */
3485 		if (!INP_TRY_UPGRADE(inp))
3486 			return;
3487 		did_upgrade = 1;
3488 	} else {
3489 		did_upgrade = 0;
3490 	}
3491 
3492 	/*
3493 	 * NOTE: The so_max_pacing_rate value is read unlocked,
3494 	 * because atomic updates are not required since the variable
3495 	 * is checked at every mbuf we send. It is assumed that the
3496 	 * variable read itself will be atomic.
3497 	 */
3498 	max_pacing_rate = socket->so_max_pacing_rate;
3499 
3500 	in_pcboutput_txrtlmt_locked(inp, ifp, mb, max_pacing_rate);
3501 
3502 	if (did_upgrade)
3503 		INP_DOWNGRADE(inp);
3504 }
3505 
3506 /*
3507  * Track route changes for TX rate limiting.
3508  */
3509 void
3510 in_pcboutput_eagain(struct inpcb *inp)
3511 {
3512 	bool did_upgrade;
3513 
3514 	if (inp == NULL)
3515 		return;
3516 
3517 	if (inp->inp_snd_tag == NULL)
3518 		return;
3519 
3520 	if (!INP_WLOCKED(inp)) {
3521 		/*
3522 		 * NOTE: If the write locking fails, we need to bail
3523 		 * out and use the non-ratelimited ring for the
3524 		 * transmit until there is a new chance to get the
3525 		 * write lock.
3526 		 */
3527 		if (!INP_TRY_UPGRADE(inp))
3528 			return;
3529 		did_upgrade = 1;
3530 	} else {
3531 		did_upgrade = 0;
3532 	}
3533 
3534 	/* detach rate limiting */
3535 	in_pcbdetach_txrtlmt(inp);
3536 
3537 	/* make sure new mbuf send tag allocation is made */
3538 	inp->inp_flags2 |= INP_RATE_LIMIT_CHANGED;
3539 
3540 	if (did_upgrade)
3541 		INP_DOWNGRADE(inp);
3542 }
3543 
3544 #ifdef INET
3545 static void
3546 rl_init(void *st)
3547 {
3548 	rate_limit_new = counter_u64_alloc(M_WAITOK);
3549 	rate_limit_chg = counter_u64_alloc(M_WAITOK);
3550 	rate_limit_active = counter_u64_alloc(M_WAITOK);
3551 	rate_limit_alloc_fail = counter_u64_alloc(M_WAITOK);
3552 	rate_limit_set_ok = counter_u64_alloc(M_WAITOK);
3553 }
3554 
3555 SYSINIT(rl, SI_SUB_PROTO_DOMAININIT, SI_ORDER_ANY, rl_init, NULL);
3556 #endif
3557 #endif /* RATELIMIT */
3558