xref: /freebsd/sys/netinet6/in6_pcb.c (revision fe6060f10f634930ff71b7c50291ddc610da2475)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5  * Copyright (c) 2010-2011 Juniper Networks, Inc.
6  * All rights reserved.
7  *
8  * Portions of this software were developed by Robert N. M. Watson under
9  * contract to Juniper Networks, Inc.
10  *
11  * Redistribution and use in source and binary forms, with or without
12  * modification, are permitted provided that the following conditions
13  * are met:
14  * 1. Redistributions of source code must retain the above copyright
15  *    notice, this list of conditions and the following disclaimer.
16  * 2. Redistributions in binary form must reproduce the above copyright
17  *    notice, this list of conditions and the following disclaimer in the
18  *    documentation and/or other materials provided with the distribution.
19  * 3. Neither the name of the project nor the names of its contributors
20  *    may be used to endorse or promote products derived from this software
21  *    without specific prior written permission.
22  *
23  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33  * SUCH DAMAGE.
34  *
35  *	$KAME: in6_pcb.c,v 1.31 2001/05/21 05:45:10 jinmei Exp $
36  */
37 
38 /*-
39  * Copyright (c) 1982, 1986, 1991, 1993
40  *	The Regents of the University of California.  All rights reserved.
41  *
42  * Redistribution and use in source and binary forms, with or without
43  * modification, are permitted provided that the following conditions
44  * are met:
45  * 1. Redistributions of source code must retain the above copyright
46  *    notice, this list of conditions and the following disclaimer.
47  * 2. Redistributions in binary form must reproduce the above copyright
48  *    notice, this list of conditions and the following disclaimer in the
49  *    documentation and/or other materials provided with the distribution.
50  * 3. Neither the name of the University nor the names of its contributors
51  *    may be used to endorse or promote products derived from this software
52  *    without specific prior written permission.
53  *
54  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
55  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
56  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
57  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
58  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
59  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
60  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
61  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
62  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
63  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
64  * SUCH DAMAGE.
65  *
66  *	@(#)in_pcb.c	8.2 (Berkeley) 1/4/94
67  */
68 
69 #include <sys/cdefs.h>
70 __FBSDID("$FreeBSD$");
71 
72 #include "opt_inet.h"
73 #include "opt_inet6.h"
74 #include "opt_ipsec.h"
75 #include "opt_pcbgroup.h"
76 #include "opt_route.h"
77 #include "opt_rss.h"
78 
79 #include <sys/param.h>
80 #include <sys/systm.h>
81 #include <sys/malloc.h>
82 #include <sys/mbuf.h>
83 #include <sys/domain.h>
84 #include <sys/protosw.h>
85 #include <sys/socket.h>
86 #include <sys/socketvar.h>
87 #include <sys/sockio.h>
88 #include <sys/errno.h>
89 #include <sys/time.h>
90 #include <sys/priv.h>
91 #include <sys/proc.h>
92 #include <sys/jail.h>
93 
94 #include <vm/uma.h>
95 
96 #include <net/if.h>
97 #include <net/if_var.h>
98 #include <net/if_llatbl.h>
99 #include <net/if_types.h>
100 #include <net/route.h>
101 #include <net/route/nhop.h>
102 
103 #include <netinet/in.h>
104 #include <netinet/in_var.h>
105 #include <netinet/in_systm.h>
106 #include <netinet/tcp_var.h>
107 #include <netinet/ip6.h>
108 #include <netinet/ip_var.h>
109 
110 #include <netinet6/ip6_var.h>
111 #include <netinet6/nd6.h>
112 #include <netinet/in_pcb.h>
113 #include <netinet/in_pcb_var.h>
114 #include <netinet6/in6_pcb.h>
115 #include <netinet6/in6_fib.h>
116 #include <netinet6/scope6_var.h>
117 
118 int
119 in6_pcbsetport(struct in6_addr *laddr, struct inpcb *inp, struct ucred *cred)
120 {
121 	struct socket *so = inp->inp_socket;
122 	u_int16_t lport = 0;
123 	int error, lookupflags = 0;
124 #ifdef INVARIANTS
125 	struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
126 #endif
127 
128 	INP_WLOCK_ASSERT(inp);
129 	INP_HASH_WLOCK_ASSERT(pcbinfo);
130 
131 	error = prison_local_ip6(cred, laddr,
132 	    ((inp->inp_flags & IN6P_IPV6_V6ONLY) != 0));
133 	if (error)
134 		return(error);
135 
136 	/* XXX: this is redundant when called from in6_pcbbind */
137 	if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT|SO_REUSEPORT_LB)) == 0)
138 		lookupflags = INPLOOKUP_WILDCARD;
139 
140 	inp->inp_flags |= INP_ANONPORT;
141 
142 	error = in_pcb_lport(inp, NULL, &lport, cred, lookupflags);
143 	if (error != 0)
144 		return (error);
145 
146 	inp->inp_lport = lport;
147 	if (in_pcbinshash(inp) != 0) {
148 		inp->in6p_laddr = in6addr_any;
149 		inp->inp_lport = 0;
150 		return (EAGAIN);
151 	}
152 
153 	return (0);
154 }
155 
156 int
157 in6_pcbbind(struct inpcb *inp, struct sockaddr *nam,
158     struct ucred *cred)
159 {
160 	struct socket *so = inp->inp_socket;
161 	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)NULL;
162 	struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
163 	u_short	lport = 0;
164 	int error, lookupflags = 0;
165 	int reuseport = (so->so_options & SO_REUSEPORT);
166 
167 	/*
168 	 * XXX: Maybe we could let SO_REUSEPORT_LB set SO_REUSEPORT bit here
169 	 * so that we don't have to add to the (already messy) code below.
170 	 */
171 	int reuseport_lb = (so->so_options & SO_REUSEPORT_LB);
172 
173 	INP_WLOCK_ASSERT(inp);
174 	INP_HASH_WLOCK_ASSERT(pcbinfo);
175 
176 	if (inp->inp_lport || !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr))
177 		return (EINVAL);
178 	if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT|SO_REUSEPORT_LB)) == 0)
179 		lookupflags = INPLOOKUP_WILDCARD;
180 	if (nam == NULL) {
181 		if ((error = prison_local_ip6(cred, &inp->in6p_laddr,
182 		    ((inp->inp_flags & IN6P_IPV6_V6ONLY) != 0))) != 0)
183 			return (error);
184 	} else {
185 		sin6 = (struct sockaddr_in6 *)nam;
186 		KASSERT(sin6->sin6_family == AF_INET6,
187 		    ("%s: invalid address family for %p", __func__, sin6));
188 		KASSERT(sin6->sin6_len == sizeof(*sin6),
189 		    ("%s: invalid address length for %p", __func__, sin6));
190 
191 		if ((error = sa6_embedscope(sin6, V_ip6_use_defzone)) != 0)
192 			return(error);
193 
194 		if ((error = prison_local_ip6(cred, &sin6->sin6_addr,
195 		    ((inp->inp_flags & IN6P_IPV6_V6ONLY) != 0))) != 0)
196 			return (error);
197 
198 		lport = sin6->sin6_port;
199 		if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
200 			/*
201 			 * Treat SO_REUSEADDR as SO_REUSEPORT for multicast;
202 			 * allow compepte duplication of binding if
203 			 * SO_REUSEPORT is set, or if SO_REUSEADDR is set
204 			 * and a multicast address is bound on both
205 			 * new and duplicated sockets.
206 			 */
207 			if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) != 0)
208 				reuseport = SO_REUSEADDR|SO_REUSEPORT;
209 			/*
210 			 * XXX: How to deal with SO_REUSEPORT_LB here?
211 			 * Treat same as SO_REUSEPORT for now.
212 			 */
213 			if ((so->so_options &
214 			    (SO_REUSEADDR|SO_REUSEPORT_LB)) != 0)
215 				reuseport_lb = SO_REUSEADDR|SO_REUSEPORT_LB;
216 		} else if (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
217 			struct epoch_tracker et;
218 			struct ifaddr *ifa;
219 
220 			sin6->sin6_port = 0;		/* yech... */
221 			NET_EPOCH_ENTER(et);
222 			if ((ifa = ifa_ifwithaddr((struct sockaddr *)sin6)) ==
223 			    NULL &&
224 			    (inp->inp_flags & INP_BINDANY) == 0) {
225 				NET_EPOCH_EXIT(et);
226 				return (EADDRNOTAVAIL);
227 			}
228 
229 			/*
230 			 * XXX: bind to an anycast address might accidentally
231 			 * cause sending a packet with anycast source address.
232 			 * We should allow to bind to a deprecated address, since
233 			 * the application dares to use it.
234 			 */
235 			if (ifa != NULL &&
236 			    ((struct in6_ifaddr *)ifa)->ia6_flags &
237 			    (IN6_IFF_ANYCAST|IN6_IFF_NOTREADY|IN6_IFF_DETACHED)) {
238 				NET_EPOCH_EXIT(et);
239 				return (EADDRNOTAVAIL);
240 			}
241 			NET_EPOCH_EXIT(et);
242 		}
243 		if (lport) {
244 			struct inpcb *t;
245 			struct tcptw *tw;
246 
247 			/* GROSS */
248 			if (ntohs(lport) <= V_ipport_reservedhigh &&
249 			    ntohs(lport) >= V_ipport_reservedlow &&
250 			    priv_check_cred(cred, PRIV_NETINET_RESERVEDPORT))
251 				return (EACCES);
252 			if (!IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr) &&
253 			    priv_check_cred(inp->inp_cred, PRIV_NETINET_REUSEPORT) != 0) {
254 				t = in6_pcblookup_local(pcbinfo,
255 				    &sin6->sin6_addr, lport,
256 				    INPLOOKUP_WILDCARD, cred);
257 				if (t &&
258 				    ((inp->inp_flags2 & INP_BINDMULTI) == 0) &&
259 				    ((t->inp_flags & INP_TIMEWAIT) == 0) &&
260 				    (so->so_type != SOCK_STREAM ||
261 				     IN6_IS_ADDR_UNSPECIFIED(&t->in6p_faddr)) &&
262 				    (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
263 				     !IN6_IS_ADDR_UNSPECIFIED(&t->in6p_laddr) ||
264 				     (t->inp_flags2 & INP_REUSEPORT) ||
265 				     (t->inp_flags2 & INP_REUSEPORT_LB) == 0) &&
266 				    (inp->inp_cred->cr_uid !=
267 				     t->inp_cred->cr_uid))
268 					return (EADDRINUSE);
269 
270 				/*
271 				 * If the socket is a BINDMULTI socket, then
272 				 * the credentials need to match and the
273 				 * original socket also has to have been bound
274 				 * with BINDMULTI.
275 				 */
276 				if (t && (! in_pcbbind_check_bindmulti(inp, t)))
277 					return (EADDRINUSE);
278 
279 #ifdef INET
280 				if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0 &&
281 				    IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
282 					struct sockaddr_in sin;
283 
284 					in6_sin6_2_sin(&sin, sin6);
285 					t = in_pcblookup_local(pcbinfo,
286 					    sin.sin_addr, lport,
287 					    INPLOOKUP_WILDCARD, cred);
288 					if (t &&
289 					    ((inp->inp_flags2 & INP_BINDMULTI) == 0) &&
290 					    ((t->inp_flags &
291 					      INP_TIMEWAIT) == 0) &&
292 					    (so->so_type != SOCK_STREAM ||
293 					     ntohl(t->inp_faddr.s_addr) ==
294 					      INADDR_ANY) &&
295 					    (inp->inp_cred->cr_uid !=
296 					     t->inp_cred->cr_uid))
297 						return (EADDRINUSE);
298 
299 					if (t && (! in_pcbbind_check_bindmulti(inp, t)))
300 						return (EADDRINUSE);
301 				}
302 #endif
303 			}
304 			t = in6_pcblookup_local(pcbinfo, &sin6->sin6_addr,
305 			    lport, lookupflags, cred);
306 			if (t && (t->inp_flags & INP_TIMEWAIT)) {
307 				/*
308 				 * XXXRW: If an incpb has had its timewait
309 				 * state recycled, we treat the address as
310 				 * being in use (for now).  This is better
311 				 * than a panic, but not desirable.
312 				 */
313 				tw = intotw(t);
314 				if (tw == NULL ||
315 				    ((reuseport & tw->tw_so_options) == 0 &&
316 					 (reuseport_lb & tw->tw_so_options) == 0))
317 					return (EADDRINUSE);
318 			} else if (t && (reuseport & inp_so_options(t)) == 0 &&
319 					   (reuseport_lb & inp_so_options(t)) == 0) {
320 				return (EADDRINUSE);
321 			}
322 #ifdef INET
323 			if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0 &&
324 			    IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
325 				struct sockaddr_in sin;
326 
327 				in6_sin6_2_sin(&sin, sin6);
328 				t = in_pcblookup_local(pcbinfo, sin.sin_addr,
329 				   lport, lookupflags, cred);
330 				if (t && t->inp_flags & INP_TIMEWAIT) {
331 					tw = intotw(t);
332 					if (tw == NULL)
333 						return (EADDRINUSE);
334 					if ((reuseport & tw->tw_so_options) == 0
335 					    && (reuseport_lb & tw->tw_so_options) == 0
336 					    && (ntohl(t->inp_laddr.s_addr) !=
337 					        INADDR_ANY || ((inp->inp_vflag &
338 					                INP_IPV6PROTO) ==
339 					            (t->inp_vflag & INP_IPV6PROTO))))
340 						return (EADDRINUSE);
341 				} else if (t &&
342 				    (reuseport & inp_so_options(t)) == 0 &&
343 				    (reuseport_lb & inp_so_options(t)) == 0 &&
344 				    (ntohl(t->inp_laddr.s_addr) != INADDR_ANY ||
345 				        (t->inp_vflag & INP_IPV6PROTO) != 0)) {
346 					return (EADDRINUSE);
347 				}
348 			}
349 #endif
350 		}
351 		inp->in6p_laddr = sin6->sin6_addr;
352 	}
353 	if (lport == 0) {
354 		if ((error = in6_pcbsetport(&inp->in6p_laddr, inp, cred)) != 0) {
355 			/* Undo an address bind that may have occurred. */
356 			inp->in6p_laddr = in6addr_any;
357 			return (error);
358 		}
359 	} else {
360 		inp->inp_lport = lport;
361 		if (in_pcbinshash(inp) != 0) {
362 			inp->in6p_laddr = in6addr_any;
363 			inp->inp_lport = 0;
364 			return (EAGAIN);
365 		}
366 	}
367 	return (0);
368 }
369 
370 /*
371  *   Transform old in6_pcbconnect() into an inner subroutine for new
372  *   in6_pcbconnect(): Do some validity-checking on the remote
373  *   address (in mbuf 'nam') and then determine local host address
374  *   (i.e., which interface) to use to access that remote host.
375  *
376  *   This preserves definition of in6_pcbconnect(), while supporting a
377  *   slightly different version for T/TCP.  (This is more than
378  *   a bit of a kludge, but cleaning up the internal interfaces would
379  *   have forced minor changes in every protocol).
380  */
381 static int
382 in6_pcbladdr(struct inpcb *inp, struct sockaddr_in6 *sin6,
383     struct in6_addr *plocal_addr6)
384 {
385 	int error = 0;
386 	int scope_ambiguous = 0;
387 	struct in6_addr in6a;
388 	struct epoch_tracker et;
389 
390 	INP_WLOCK_ASSERT(inp);
391 	INP_HASH_WLOCK_ASSERT(inp->inp_pcbinfo);	/* XXXRW: why? */
392 
393 	if (sin6->sin6_port == 0)
394 		return (EADDRNOTAVAIL);
395 
396 	if (sin6->sin6_scope_id == 0 && !V_ip6_use_defzone)
397 		scope_ambiguous = 1;
398 	if ((error = sa6_embedscope(sin6, V_ip6_use_defzone)) != 0)
399 		return(error);
400 
401 	if (!CK_STAILQ_EMPTY(&V_in6_ifaddrhead)) {
402 		/*
403 		 * If the destination address is UNSPECIFIED addr,
404 		 * use the loopback addr, e.g ::1.
405 		 */
406 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
407 			sin6->sin6_addr = in6addr_loopback;
408 	}
409 	if ((error = prison_remote_ip6(inp->inp_cred, &sin6->sin6_addr)) != 0)
410 		return (error);
411 
412 	NET_EPOCH_ENTER(et);
413 	error = in6_selectsrc_socket(sin6, inp->in6p_outputopts,
414 	    inp, inp->inp_cred, scope_ambiguous, &in6a, NULL);
415 	NET_EPOCH_EXIT(et);
416 	if (error)
417 		return (error);
418 
419 	/*
420 	 * Do not update this earlier, in case we return with an error.
421 	 *
422 	 * XXX: this in6_selectsrc_socket result might replace the bound local
423 	 * address with the address specified by setsockopt(IPV6_PKTINFO).
424 	 * Is it the intended behavior?
425 	 */
426 	*plocal_addr6 = in6a;
427 
428 	/*
429 	 * Don't do pcblookup call here; return interface in
430 	 * plocal_addr6
431 	 * and exit to caller, that will do the lookup.
432 	 */
433 
434 	return (0);
435 }
436 
437 /*
438  * Outer subroutine:
439  * Connect from a socket to a specified address.
440  * Both address and port must be specified in argument sin.
441  * If don't have a local address for this socket yet,
442  * then pick one.
443  */
444 int
445 in6_pcbconnect_mbuf(struct inpcb *inp, struct sockaddr *nam,
446     struct ucred *cred, struct mbuf *m, bool rehash)
447 {
448 	struct inpcbinfo *pcbinfo = inp->inp_pcbinfo;
449 	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)nam;
450 	struct sockaddr_in6 laddr6;
451 	int error;
452 
453 	KASSERT(sin6->sin6_family == AF_INET6,
454 	    ("%s: invalid address family for %p", __func__, sin6));
455 	KASSERT(sin6->sin6_len == sizeof(*sin6),
456 	    ("%s: invalid address length for %p", __func__, sin6));
457 
458 	bzero(&laddr6, sizeof(laddr6));
459 	laddr6.sin6_family = AF_INET6;
460 
461 	INP_WLOCK_ASSERT(inp);
462 	INP_HASH_WLOCK_ASSERT(pcbinfo);
463 
464 #ifdef ROUTE_MPATH
465 	if (CALC_FLOWID_OUTBOUND) {
466 		uint32_t hash_type, hash_val;
467 
468 		hash_val = fib6_calc_software_hash(&inp->in6p_laddr,
469 		    &sin6->sin6_addr, 0, sin6->sin6_port,
470 		    inp->inp_socket->so_proto->pr_protocol, &hash_type);
471 		inp->inp_flowid = hash_val;
472 		inp->inp_flowtype = hash_type;
473 	}
474 #endif
475 	/*
476 	 * Call inner routine, to assign local interface address.
477 	 * in6_pcbladdr() may automatically fill in sin6_scope_id.
478 	 */
479 	if ((error = in6_pcbladdr(inp, sin6, &laddr6.sin6_addr)) != 0)
480 		return (error);
481 
482 	if (in6_pcblookup_hash_locked(pcbinfo, &sin6->sin6_addr,
483 			       sin6->sin6_port,
484 			      IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)
485 			      ? &laddr6.sin6_addr : &inp->in6p_laddr,
486 			      inp->inp_lport, 0, NULL, M_NODOM) != NULL) {
487 		return (EADDRINUSE);
488 	}
489 	if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
490 		if (inp->inp_lport == 0) {
491 			/*
492 			 * rehash was required to be true in the past for
493 			 * this case; retain that convention.  However,
494 			 * we now call in_pcb_lport_dest rather than
495 			 * in6_pcbbind; the former does not insert into
496 			 * the hash table, the latter does.  Change rehash
497 			 * to false to do the in_pcbinshash below.
498 			 */
499 			KASSERT(rehash == true,
500 			    ("Rehashing required for unbound inps"));
501 			rehash = false;
502 			error = in_pcb_lport_dest(inp,
503 			    (struct sockaddr *) &laddr6, &inp->inp_lport,
504 			    (struct sockaddr *) sin6, sin6->sin6_port, cred,
505 			    INPLOOKUP_WILDCARD);
506 			if (error)
507 				return (error);
508 		}
509 		inp->in6p_laddr = laddr6.sin6_addr;
510 	}
511 	inp->in6p_faddr = sin6->sin6_addr;
512 	inp->inp_fport = sin6->sin6_port;
513 	/* update flowinfo - draft-itojun-ipv6-flowlabel-api-00 */
514 	inp->inp_flow &= ~IPV6_FLOWLABEL_MASK;
515 	if (inp->inp_flags & IN6P_AUTOFLOWLABEL)
516 		inp->inp_flow |=
517 		    (htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK);
518 
519 	if (rehash) {
520 		in_pcbrehash_mbuf(inp, m);
521 	} else {
522 		in_pcbinshash_mbuf(inp, m);
523 	}
524 
525 	return (0);
526 }
527 
528 int
529 in6_pcbconnect(struct inpcb *inp, struct sockaddr *nam, struct ucred *cred)
530 {
531 
532 	return (in6_pcbconnect_mbuf(inp, nam, cred, NULL, true));
533 }
534 
535 void
536 in6_pcbdisconnect(struct inpcb *inp)
537 {
538 
539 	INP_WLOCK_ASSERT(inp);
540 	INP_HASH_WLOCK_ASSERT(inp->inp_pcbinfo);
541 
542 	bzero((caddr_t)&inp->in6p_faddr, sizeof(inp->in6p_faddr));
543 	inp->inp_fport = 0;
544 	/* clear flowinfo - draft-itojun-ipv6-flowlabel-api-00 */
545 	inp->inp_flow &= ~IPV6_FLOWLABEL_MASK;
546 	in_pcbrehash(inp);
547 }
548 
549 struct sockaddr *
550 in6_sockaddr(in_port_t port, struct in6_addr *addr_p)
551 {
552 	struct sockaddr_in6 *sin6;
553 
554 	sin6 = malloc(sizeof *sin6, M_SONAME, M_WAITOK);
555 	bzero(sin6, sizeof *sin6);
556 	sin6->sin6_family = AF_INET6;
557 	sin6->sin6_len = sizeof(*sin6);
558 	sin6->sin6_port = port;
559 	sin6->sin6_addr = *addr_p;
560 	(void)sa6_recoverscope(sin6); /* XXX: should catch errors */
561 
562 	return (struct sockaddr *)sin6;
563 }
564 
565 struct sockaddr *
566 in6_v4mapsin6_sockaddr(in_port_t port, struct in_addr *addr_p)
567 {
568 	struct sockaddr_in sin;
569 	struct sockaddr_in6 *sin6_p;
570 
571 	bzero(&sin, sizeof sin);
572 	sin.sin_family = AF_INET;
573 	sin.sin_len = sizeof(sin);
574 	sin.sin_port = port;
575 	sin.sin_addr = *addr_p;
576 
577 	sin6_p = malloc(sizeof *sin6_p, M_SONAME,
578 		M_WAITOK);
579 	in6_sin_2_v4mapsin6(&sin, sin6_p);
580 
581 	return (struct sockaddr *)sin6_p;
582 }
583 
584 int
585 in6_getsockaddr(struct socket *so, struct sockaddr **nam)
586 {
587 	struct inpcb *inp;
588 	struct in6_addr addr;
589 	in_port_t port;
590 
591 	inp = sotoinpcb(so);
592 	KASSERT(inp != NULL, ("in6_getsockaddr: inp == NULL"));
593 
594 	INP_RLOCK(inp);
595 	port = inp->inp_lport;
596 	addr = inp->in6p_laddr;
597 	INP_RUNLOCK(inp);
598 
599 	*nam = in6_sockaddr(port, &addr);
600 	return 0;
601 }
602 
603 int
604 in6_getpeeraddr(struct socket *so, struct sockaddr **nam)
605 {
606 	struct inpcb *inp;
607 	struct in6_addr addr;
608 	in_port_t port;
609 
610 	inp = sotoinpcb(so);
611 	KASSERT(inp != NULL, ("in6_getpeeraddr: inp == NULL"));
612 
613 	INP_RLOCK(inp);
614 	port = inp->inp_fport;
615 	addr = inp->in6p_faddr;
616 	INP_RUNLOCK(inp);
617 
618 	*nam = in6_sockaddr(port, &addr);
619 	return 0;
620 }
621 
622 int
623 in6_mapped_sockaddr(struct socket *so, struct sockaddr **nam)
624 {
625 	struct	inpcb *inp;
626 	int	error;
627 
628 	inp = sotoinpcb(so);
629 	KASSERT(inp != NULL, ("in6_mapped_sockaddr: inp == NULL"));
630 
631 #ifdef INET
632 	if ((inp->inp_vflag & (INP_IPV4 | INP_IPV6)) == INP_IPV4) {
633 		error = in_getsockaddr(so, nam);
634 		if (error == 0)
635 			in6_sin_2_v4mapsin6_in_sock(nam);
636 	} else
637 #endif
638 	{
639 		/* scope issues will be handled in in6_getsockaddr(). */
640 		error = in6_getsockaddr(so, nam);
641 	}
642 
643 	return error;
644 }
645 
646 int
647 in6_mapped_peeraddr(struct socket *so, struct sockaddr **nam)
648 {
649 	struct	inpcb *inp;
650 	int	error;
651 
652 	inp = sotoinpcb(so);
653 	KASSERT(inp != NULL, ("in6_mapped_peeraddr: inp == NULL"));
654 
655 #ifdef INET
656 	if ((inp->inp_vflag & (INP_IPV4 | INP_IPV6)) == INP_IPV4) {
657 		error = in_getpeeraddr(so, nam);
658 		if (error == 0)
659 			in6_sin_2_v4mapsin6_in_sock(nam);
660 	} else
661 #endif
662 	/* scope issues will be handled in in6_getpeeraddr(). */
663 	error = in6_getpeeraddr(so, nam);
664 
665 	return error;
666 }
667 
668 /*
669  * Pass some notification to all connections of a protocol
670  * associated with address dst.  The local address and/or port numbers
671  * may be specified to limit the search.  The "usual action" will be
672  * taken, depending on the ctlinput cmd.  The caller must filter any
673  * cmds that are uninteresting (e.g., no error in the map).
674  * Call the protocol specific routine (if any) to report
675  * any errors for each matching socket.
676  */
677 void
678 in6_pcbnotify(struct inpcbinfo *pcbinfo, struct sockaddr *dst,
679     u_int fport_arg, const struct sockaddr *src, u_int lport_arg,
680     int cmd, void *cmdarg,
681     struct inpcb *(*notify)(struct inpcb *, int))
682 {
683 	struct inpcb *inp, *inp_temp;
684 	struct sockaddr_in6 sa6_src, *sa6_dst;
685 	u_short	fport = fport_arg, lport = lport_arg;
686 	u_int32_t flowinfo;
687 	int errno;
688 
689 	if ((unsigned)cmd >= PRC_NCMDS || dst->sa_family != AF_INET6)
690 		return;
691 
692 	sa6_dst = (struct sockaddr_in6 *)dst;
693 	if (IN6_IS_ADDR_UNSPECIFIED(&sa6_dst->sin6_addr))
694 		return;
695 
696 	/*
697 	 * note that src can be NULL when we get notify by local fragmentation.
698 	 */
699 	sa6_src = (src == NULL) ? sa6_any : *(const struct sockaddr_in6 *)src;
700 	flowinfo = sa6_src.sin6_flowinfo;
701 
702 	/*
703 	 * Redirects go to all references to the destination,
704 	 * and use in6_rtchange to invalidate the route cache.
705 	 * Dead host indications: also use in6_rtchange to invalidate
706 	 * the cache, and deliver the error to all the sockets.
707 	 * Otherwise, if we have knowledge of the local port and address,
708 	 * deliver only to that socket.
709 	 */
710 	if (PRC_IS_REDIRECT(cmd) || cmd == PRC_HOSTDEAD) {
711 		fport = 0;
712 		lport = 0;
713 		bzero((caddr_t)&sa6_src.sin6_addr, sizeof(sa6_src.sin6_addr));
714 
715 		if (cmd != PRC_HOSTDEAD)
716 			notify = in6_rtchange;
717 	}
718 	errno = inet6ctlerrmap[cmd];
719 	INP_INFO_WLOCK(pcbinfo);
720 	CK_LIST_FOREACH_SAFE(inp, pcbinfo->ipi_listhead, inp_list, inp_temp) {
721 		INP_WLOCK(inp);
722 		if ((inp->inp_vflag & INP_IPV6) == 0) {
723 			INP_WUNLOCK(inp);
724 			continue;
725 		}
726 
727 		/*
728 		 * If the error designates a new path MTU for a destination
729 		 * and the application (associated with this socket) wanted to
730 		 * know the value, notify.
731 		 * XXX: should we avoid to notify the value to TCP sockets?
732 		 */
733 		if (cmd == PRC_MSGSIZE && cmdarg != NULL)
734 			ip6_notify_pmtu(inp, (struct sockaddr_in6 *)dst,
735 					*(u_int32_t *)cmdarg);
736 
737 		/*
738 		 * Detect if we should notify the error. If no source and
739 		 * destination ports are specified, but non-zero flowinfo and
740 		 * local address match, notify the error. This is the case
741 		 * when the error is delivered with an encrypted buffer
742 		 * by ESP. Otherwise, just compare addresses and ports
743 		 * as usual.
744 		 */
745 		if (lport == 0 && fport == 0 && flowinfo &&
746 		    inp->inp_socket != NULL &&
747 		    flowinfo == (inp->inp_flow & IPV6_FLOWLABEL_MASK) &&
748 		    IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, &sa6_src.sin6_addr))
749 			goto do_notify;
750 		else if (!IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr,
751 					     &sa6_dst->sin6_addr) ||
752 			 inp->inp_socket == 0 ||
753 			 (lport && inp->inp_lport != lport) ||
754 			 (!IN6_IS_ADDR_UNSPECIFIED(&sa6_src.sin6_addr) &&
755 			  !IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr,
756 					      &sa6_src.sin6_addr)) ||
757 			 (fport && inp->inp_fport != fport)) {
758 			INP_WUNLOCK(inp);
759 			continue;
760 		}
761 
762 	  do_notify:
763 		if (notify) {
764 			if ((*notify)(inp, errno))
765 				INP_WUNLOCK(inp);
766 		} else
767 			INP_WUNLOCK(inp);
768 	}
769 	INP_INFO_WUNLOCK(pcbinfo);
770 }
771 
772 /*
773  * Lookup a PCB based on the local address and port.  Caller must hold the
774  * hash lock.  No inpcb locks or references are acquired.
775  */
776 struct inpcb *
777 in6_pcblookup_local(struct inpcbinfo *pcbinfo, struct in6_addr *laddr,
778     u_short lport, int lookupflags, struct ucred *cred)
779 {
780 	struct inpcb *inp;
781 	int matchwild = 3, wildcard;
782 
783 	KASSERT((lookupflags & ~(INPLOOKUP_WILDCARD)) == 0,
784 	    ("%s: invalid lookup flags %d", __func__, lookupflags));
785 
786 	INP_HASH_LOCK_ASSERT(pcbinfo);
787 
788 	if ((lookupflags & INPLOOKUP_WILDCARD) == 0) {
789 		struct inpcbhead *head;
790 		/*
791 		 * Look for an unconnected (wildcard foreign addr) PCB that
792 		 * matches the local address and port we're looking for.
793 		 */
794 		head = &pcbinfo->ipi_hashbase[INP_PCBHASH(
795 		    INP6_PCBHASHKEY(&in6addr_any), lport, 0,
796 		    pcbinfo->ipi_hashmask)];
797 		CK_LIST_FOREACH(inp, head, inp_hash) {
798 			/* XXX inp locking */
799 			if ((inp->inp_vflag & INP_IPV6) == 0)
800 				continue;
801 			if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) &&
802 			    IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr) &&
803 			    inp->inp_lport == lport) {
804 				/* Found. */
805 				if (cred == NULL ||
806 				    prison_equal_ip6(cred->cr_prison,
807 					inp->inp_cred->cr_prison))
808 					return (inp);
809 			}
810 		}
811 		/*
812 		 * Not found.
813 		 */
814 		return (NULL);
815 	} else {
816 		struct inpcbporthead *porthash;
817 		struct inpcbport *phd;
818 		struct inpcb *match = NULL;
819 		/*
820 		 * Best fit PCB lookup.
821 		 *
822 		 * First see if this local port is in use by looking on the
823 		 * port hash list.
824 		 */
825 		porthash = &pcbinfo->ipi_porthashbase[INP_PCBPORTHASH(lport,
826 		    pcbinfo->ipi_porthashmask)];
827 		CK_LIST_FOREACH(phd, porthash, phd_hash) {
828 			if (phd->phd_port == lport)
829 				break;
830 		}
831 		if (phd != NULL) {
832 			/*
833 			 * Port is in use by one or more PCBs. Look for best
834 			 * fit.
835 			 */
836 			CK_LIST_FOREACH(inp, &phd->phd_pcblist, inp_portlist) {
837 				wildcard = 0;
838 				if (cred != NULL &&
839 				    !prison_equal_ip6(cred->cr_prison,
840 					inp->inp_cred->cr_prison))
841 					continue;
842 				/* XXX inp locking */
843 				if ((inp->inp_vflag & INP_IPV6) == 0)
844 					continue;
845 				if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr))
846 					wildcard++;
847 				if (!IN6_IS_ADDR_UNSPECIFIED(
848 					&inp->in6p_laddr)) {
849 					if (IN6_IS_ADDR_UNSPECIFIED(laddr))
850 						wildcard++;
851 					else if (!IN6_ARE_ADDR_EQUAL(
852 					    &inp->in6p_laddr, laddr))
853 						continue;
854 				} else {
855 					if (!IN6_IS_ADDR_UNSPECIFIED(laddr))
856 						wildcard++;
857 				}
858 				if (wildcard < matchwild) {
859 					match = inp;
860 					matchwild = wildcard;
861 					if (matchwild == 0)
862 						break;
863 				}
864 			}
865 		}
866 		return (match);
867 	}
868 }
869 
870 void
871 in6_pcbpurgeif0(struct inpcbinfo *pcbinfo, struct ifnet *ifp)
872 {
873 	struct inpcb *inp;
874 	struct in6_multi *inm;
875 	struct in6_mfilter *imf;
876 	struct ip6_moptions *im6o;
877 
878 	INP_INFO_WLOCK(pcbinfo);
879 	CK_LIST_FOREACH(inp, pcbinfo->ipi_listhead, inp_list) {
880 		INP_WLOCK(inp);
881 		if (__predict_false(inp->inp_flags2 & INP_FREED)) {
882 			INP_WUNLOCK(inp);
883 			continue;
884 		}
885 		im6o = inp->in6p_moptions;
886 		if ((inp->inp_vflag & INP_IPV6) && im6o != NULL) {
887 			/*
888 			 * Unselect the outgoing ifp for multicast if it
889 			 * is being detached.
890 			 */
891 			if (im6o->im6o_multicast_ifp == ifp)
892 				im6o->im6o_multicast_ifp = NULL;
893 			/*
894 			 * Drop multicast group membership if we joined
895 			 * through the interface being detached.
896 			 */
897 restart:
898 			IP6_MFILTER_FOREACH(imf, &im6o->im6o_head) {
899 				if ((inm = imf->im6f_in6m) == NULL)
900 					continue;
901 				if (inm->in6m_ifp != ifp)
902 					continue;
903 				ip6_mfilter_remove(&im6o->im6o_head, imf);
904 				IN6_MULTI_LOCK_ASSERT();
905 				in6_leavegroup_locked(inm, NULL);
906 				ip6_mfilter_free(imf);
907 				goto restart;
908 			}
909 		}
910 		INP_WUNLOCK(inp);
911 	}
912 	INP_INFO_WUNLOCK(pcbinfo);
913 }
914 
915 /*
916  * Check for alternatives when higher level complains
917  * about service problems.  For now, invalidate cached
918  * routing information.  If the route was created dynamically
919  * (by a redirect), time to try a default gateway again.
920  */
921 void
922 in6_losing(struct inpcb *inp)
923 {
924 
925 	RO_INVALIDATE_CACHE(&inp->inp_route6);
926 }
927 
928 /*
929  * After a routing change, flush old routing
930  * and allocate a (hopefully) better one.
931  */
932 struct inpcb *
933 in6_rtchange(struct inpcb *inp, int errno __unused)
934 {
935 
936 	RO_INVALIDATE_CACHE(&inp->inp_route6);
937 	return inp;
938 }
939 
940 static struct inpcb *
941 in6_pcblookup_lbgroup(const struct inpcbinfo *pcbinfo,
942     const struct in6_addr *laddr, uint16_t lport, const struct in6_addr *faddr,
943     uint16_t fport, int lookupflags, uint8_t numa_domain)
944 {
945 	struct inpcb *local_wild, *numa_wild;
946 	const struct inpcblbgrouphead *hdr;
947 	struct inpcblbgroup *grp;
948 	uint32_t idx;
949 
950 	INP_HASH_LOCK_ASSERT(pcbinfo);
951 
952 	hdr = &pcbinfo->ipi_lbgrouphashbase[
953 	    INP_PCBPORTHASH(lport, pcbinfo->ipi_lbgrouphashmask)];
954 
955 	/*
956 	 * Order of socket selection:
957 	 * 1. non-wild.
958 	 * 2. wild (if lookupflags contains INPLOOKUP_WILDCARD).
959 	 *
960 	 * NOTE:
961 	 * - Load balanced group does not contain jailed sockets.
962 	 * - Load balanced does not contain IPv4 mapped INET6 wild sockets.
963 	 */
964 	local_wild = NULL;
965 	numa_wild = NULL;
966 	CK_LIST_FOREACH(grp, hdr, il_list) {
967 #ifdef INET
968 		if (!(grp->il_vflag & INP_IPV6))
969 			continue;
970 #endif
971 		if (grp->il_lport != lport)
972 			continue;
973 
974 		idx = INP_PCBLBGROUP_PKTHASH(INP6_PCBHASHKEY(faddr), lport,
975 		    fport) % grp->il_inpcnt;
976 		if (IN6_ARE_ADDR_EQUAL(&grp->il6_laddr, laddr)) {
977 			if (numa_domain == M_NODOM ||
978 			    grp->il_numa_domain == numa_domain) {
979 				return (grp->il_inp[idx]);
980 			}
981 			else
982 				numa_wild = grp->il_inp[idx];
983 		}
984 		if (IN6_IS_ADDR_UNSPECIFIED(&grp->il6_laddr) &&
985 		    (lookupflags & INPLOOKUP_WILDCARD) != 0 &&
986 		    (local_wild == NULL || numa_domain == M_NODOM ||
987 			grp->il_numa_domain == numa_domain)) {
988 			local_wild = grp->il_inp[idx];
989 		}
990 	}
991 	if (numa_wild != NULL)
992 		return (numa_wild);
993 	return (local_wild);
994 }
995 
996 #ifdef PCBGROUP
997 /*
998  * Lookup PCB in hash list, using pcbgroup tables.
999  */
1000 static struct inpcb *
1001 in6_pcblookup_group(struct inpcbinfo *pcbinfo, struct inpcbgroup *pcbgroup,
1002     struct in6_addr *faddr, u_int fport_arg, struct in6_addr *laddr,
1003     u_int lport_arg, int lookupflags, struct ifnet *ifp)
1004 {
1005 	struct inpcbhead *head;
1006 	struct inpcb *inp, *tmpinp;
1007 	u_short fport = fport_arg, lport = lport_arg;
1008 	bool locked;
1009 
1010 	/*
1011 	 * First look for an exact match.
1012 	 */
1013 	tmpinp = NULL;
1014 	INP_GROUP_LOCK(pcbgroup);
1015 	head = &pcbgroup->ipg_hashbase[INP_PCBHASH(
1016 	    INP6_PCBHASHKEY(faddr), lport, fport, pcbgroup->ipg_hashmask)];
1017 	CK_LIST_FOREACH(inp, head, inp_pcbgrouphash) {
1018 		/* XXX inp locking */
1019 		if ((inp->inp_vflag & INP_IPV6) == 0)
1020 			continue;
1021 		if (IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr, faddr) &&
1022 		    IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr) &&
1023 		    inp->inp_fport == fport &&
1024 		    inp->inp_lport == lport) {
1025 			/*
1026 			 * XXX We should be able to directly return
1027 			 * the inp here, without any checks.
1028 			 * Well unless both bound with SO_REUSEPORT?
1029 			 */
1030 			if (prison_flag(inp->inp_cred, PR_IP6))
1031 				goto found;
1032 			if (tmpinp == NULL)
1033 				tmpinp = inp;
1034 		}
1035 	}
1036 	if (tmpinp != NULL) {
1037 		inp = tmpinp;
1038 		goto found;
1039 	}
1040 
1041 	/*
1042 	 * Then look for a wildcard match in the pcbgroup.
1043 	 */
1044 	if ((lookupflags & INPLOOKUP_WILDCARD) != 0) {
1045 		struct inpcb *local_wild = NULL, *local_exact = NULL;
1046 		struct inpcb *jail_wild = NULL;
1047 		int injail;
1048 
1049 		/*
1050 		 * Order of socket selection - we always prefer jails.
1051 		 *      1. jailed, non-wild.
1052 		 *      2. jailed, wild.
1053 		 *      3. non-jailed, non-wild.
1054 		 *      4. non-jailed, wild.
1055 		 */
1056 		head = &pcbgroup->ipg_hashbase[
1057 		    INP_PCBHASH(INADDR_ANY, lport, 0, pcbgroup->ipg_hashmask)];
1058 		CK_LIST_FOREACH(inp, head, inp_pcbgrouphash) {
1059 			/* XXX inp locking */
1060 			if ((inp->inp_vflag & INP_IPV6) == 0)
1061 				continue;
1062 
1063 			if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) ||
1064 			    inp->inp_lport != lport) {
1065 				continue;
1066 			}
1067 
1068 			injail = prison_flag(inp->inp_cred, PR_IP6);
1069 			if (injail) {
1070 				if (prison_check_ip6(inp->inp_cred,
1071 				    laddr) != 0)
1072 					continue;
1073 			} else {
1074 				if (local_exact != NULL)
1075 					continue;
1076 			}
1077 
1078 			if (IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr)) {
1079 				if (injail)
1080 					goto found;
1081 				else
1082 					local_exact = inp;
1083 			} else if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
1084 				if (injail)
1085 					jail_wild = inp;
1086 				else
1087 					local_wild = inp;
1088 			}
1089 		} /* LIST_FOREACH */
1090 
1091 		inp = jail_wild;
1092 		if (inp == NULL)
1093 			inp = jail_wild;
1094 		if (inp == NULL)
1095 			inp = local_exact;
1096 		if (inp == NULL)
1097 			inp = local_wild;
1098 		if (inp != NULL)
1099 			goto found;
1100 	}
1101 
1102 	/*
1103 	 * Then look for a wildcard match, if requested.
1104 	 */
1105 	if ((lookupflags & INPLOOKUP_WILDCARD) != 0) {
1106 		struct inpcb *local_wild = NULL, *local_exact = NULL;
1107 		struct inpcb *jail_wild = NULL;
1108 		int injail;
1109 
1110 		/*
1111 		 * Order of socket selection - we always prefer jails.
1112 		 *      1. jailed, non-wild.
1113 		 *      2. jailed, wild.
1114 		 *      3. non-jailed, non-wild.
1115 		 *      4. non-jailed, wild.
1116 		 */
1117 		head = &pcbinfo->ipi_wildbase[INP_PCBHASH(
1118 		    INP6_PCBHASHKEY(&in6addr_any), lport, 0,
1119 		    pcbinfo->ipi_wildmask)];
1120 		CK_LIST_FOREACH(inp, head, inp_pcbgroup_wild) {
1121 			/* XXX inp locking */
1122 			if ((inp->inp_vflag & INP_IPV6) == 0)
1123 				continue;
1124 
1125 			if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) ||
1126 			    inp->inp_lport != lport) {
1127 				continue;
1128 			}
1129 
1130 			injail = prison_flag(inp->inp_cred, PR_IP6);
1131 			if (injail) {
1132 				if (prison_check_ip6(inp->inp_cred,
1133 				    laddr) != 0)
1134 					continue;
1135 			} else {
1136 				if (local_exact != NULL)
1137 					continue;
1138 			}
1139 
1140 			if (IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr)) {
1141 				if (injail)
1142 					goto found;
1143 				else
1144 					local_exact = inp;
1145 			} else if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
1146 				if (injail)
1147 					jail_wild = inp;
1148 				else
1149 					local_wild = inp;
1150 			}
1151 		} /* LIST_FOREACH */
1152 
1153 		inp = jail_wild;
1154 		if (inp == NULL)
1155 			inp = jail_wild;
1156 		if (inp == NULL)
1157 			inp = local_exact;
1158 		if (inp == NULL)
1159 			inp = local_wild;
1160 		if (inp != NULL)
1161 			goto found;
1162 	} /* if ((lookupflags & INPLOOKUP_WILDCARD) != 0) */
1163 	INP_GROUP_UNLOCK(pcbgroup);
1164 	return (NULL);
1165 
1166 found:
1167 	if (lookupflags & INPLOOKUP_WLOCKPCB)
1168 		locked = INP_TRY_WLOCK(inp);
1169 	else if (lookupflags & INPLOOKUP_RLOCKPCB)
1170 		locked = INP_TRY_RLOCK(inp);
1171 	else
1172 		panic("%s: locking buf", __func__);
1173 	if (!locked)
1174 		in_pcbref(inp);
1175 	INP_GROUP_UNLOCK(pcbgroup);
1176 	if (!locked) {
1177 		if (lookupflags & INPLOOKUP_WLOCKPCB) {
1178 			INP_WLOCK(inp);
1179 			if (in_pcbrele_wlocked(inp))
1180 				return (NULL);
1181 		} else {
1182 			INP_RLOCK(inp);
1183 			if (in_pcbrele_rlocked(inp))
1184 				return (NULL);
1185 		}
1186 	}
1187 #ifdef INVARIANTS
1188 	if (lookupflags & INPLOOKUP_WLOCKPCB)
1189 		INP_WLOCK_ASSERT(inp);
1190 	else
1191 		INP_RLOCK_ASSERT(inp);
1192 #endif
1193 	return (inp);
1194 }
1195 #endif /* PCBGROUP */
1196 
1197 /*
1198  * Lookup PCB in hash list.  Used in in_pcb.c as well as here.
1199  */
1200 struct inpcb *
1201 in6_pcblookup_hash_locked(struct inpcbinfo *pcbinfo, struct in6_addr *faddr,
1202     u_int fport_arg, struct in6_addr *laddr, u_int lport_arg,
1203     int lookupflags, struct ifnet *ifp, uint8_t numa_domain)
1204 {
1205 	struct inpcbhead *head;
1206 	struct inpcb *inp, *tmpinp;
1207 	u_short fport = fport_arg, lport = lport_arg;
1208 
1209 	KASSERT((lookupflags & ~(INPLOOKUP_WILDCARD)) == 0,
1210 	    ("%s: invalid lookup flags %d", __func__, lookupflags));
1211 
1212 	INP_HASH_LOCK_ASSERT(pcbinfo);
1213 
1214 	/*
1215 	 * First look for an exact match.
1216 	 */
1217 	tmpinp = NULL;
1218 	head = &pcbinfo->ipi_hashbase[INP_PCBHASH(
1219 	    INP6_PCBHASHKEY(faddr), lport, fport, pcbinfo->ipi_hashmask)];
1220 	CK_LIST_FOREACH(inp, head, inp_hash) {
1221 		/* XXX inp locking */
1222 		if ((inp->inp_vflag & INP_IPV6) == 0)
1223 			continue;
1224 		if (IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr, faddr) &&
1225 		    IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr) &&
1226 		    inp->inp_fport == fport &&
1227 		    inp->inp_lport == lport) {
1228 			/*
1229 			 * XXX We should be able to directly return
1230 			 * the inp here, without any checks.
1231 			 * Well unless both bound with SO_REUSEPORT?
1232 			 */
1233 			if (prison_flag(inp->inp_cred, PR_IP6))
1234 				return (inp);
1235 			if (tmpinp == NULL)
1236 				tmpinp = inp;
1237 		}
1238 	}
1239 	if (tmpinp != NULL)
1240 		return (tmpinp);
1241 
1242 	/*
1243 	 * Then look in lb group (for wildcard match).
1244 	 */
1245 	if ((lookupflags & INPLOOKUP_WILDCARD) != 0) {
1246 		inp = in6_pcblookup_lbgroup(pcbinfo, laddr, lport, faddr,
1247 		    fport, lookupflags, numa_domain);
1248 		if (inp != NULL)
1249 			return (inp);
1250 	}
1251 
1252 	/*
1253 	 * Then look for a wildcard match, if requested.
1254 	 */
1255 	if ((lookupflags & INPLOOKUP_WILDCARD) != 0) {
1256 		struct inpcb *local_wild = NULL, *local_exact = NULL;
1257 		struct inpcb *jail_wild = NULL;
1258 		int injail;
1259 
1260 		/*
1261 		 * Order of socket selection - we always prefer jails.
1262 		 *      1. jailed, non-wild.
1263 		 *      2. jailed, wild.
1264 		 *      3. non-jailed, non-wild.
1265 		 *      4. non-jailed, wild.
1266 		 */
1267 		head = &pcbinfo->ipi_hashbase[INP_PCBHASH(
1268 		    INP6_PCBHASHKEY(&in6addr_any), lport, 0,
1269 		    pcbinfo->ipi_hashmask)];
1270 		CK_LIST_FOREACH(inp, head, inp_hash) {
1271 			/* XXX inp locking */
1272 			if ((inp->inp_vflag & INP_IPV6) == 0)
1273 				continue;
1274 
1275 			if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) ||
1276 			    inp->inp_lport != lport) {
1277 				continue;
1278 			}
1279 
1280 			injail = prison_flag(inp->inp_cred, PR_IP6);
1281 			if (injail) {
1282 				if (prison_check_ip6(inp->inp_cred,
1283 				    laddr) != 0)
1284 					continue;
1285 			} else {
1286 				if (local_exact != NULL)
1287 					continue;
1288 			}
1289 
1290 			if (IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr)) {
1291 				if (injail)
1292 					return (inp);
1293 				else
1294 					local_exact = inp;
1295 			} else if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
1296 				if (injail)
1297 					jail_wild = inp;
1298 				else
1299 					local_wild = inp;
1300 			}
1301 		} /* LIST_FOREACH */
1302 
1303 		if (jail_wild != NULL)
1304 			return (jail_wild);
1305 		if (local_exact != NULL)
1306 			return (local_exact);
1307 		if (local_wild != NULL)
1308 			return (local_wild);
1309 	} /* if ((lookupflags & INPLOOKUP_WILDCARD) != 0) */
1310 
1311 	/*
1312 	 * Not found.
1313 	 */
1314 	return (NULL);
1315 }
1316 
1317 /*
1318  * Lookup PCB in hash list, using pcbinfo tables.  This variation locks the
1319  * hash list lock, and will return the inpcb locked (i.e., requires
1320  * INPLOOKUP_LOCKPCB).
1321  */
1322 static struct inpcb *
1323 in6_pcblookup_hash(struct inpcbinfo *pcbinfo, struct in6_addr *faddr,
1324     u_int fport, struct in6_addr *laddr, u_int lport, int lookupflags,
1325     struct ifnet *ifp, uint8_t numa_domain)
1326 {
1327 	struct inpcb *inp;
1328 
1329 	inp = in6_pcblookup_hash_locked(pcbinfo, faddr, fport, laddr, lport,
1330 	    lookupflags & INPLOOKUP_WILDCARD, ifp, numa_domain);
1331 	if (inp != NULL) {
1332 		if (lookupflags & INPLOOKUP_WLOCKPCB) {
1333 			INP_WLOCK(inp);
1334 		} else if (lookupflags & INPLOOKUP_RLOCKPCB) {
1335 			INP_RLOCK(inp);
1336 		} else
1337 			panic("%s: locking bug", __func__);
1338 		if (__predict_false(inp->inp_flags2 & INP_FREED)) {
1339 			INP_UNLOCK(inp);
1340 			inp = NULL;
1341 		}
1342 	}
1343 	return (inp);
1344 }
1345 
1346 /*
1347  * Public inpcb lookup routines, accepting a 4-tuple, and optionally, an mbuf
1348  * from which a pre-calculated hash value may be extracted.
1349  *
1350  * Possibly more of this logic should be in in6_pcbgroup.c.
1351  */
1352 struct inpcb *
1353 in6_pcblookup(struct inpcbinfo *pcbinfo, struct in6_addr *faddr, u_int fport,
1354     struct in6_addr *laddr, u_int lport, int lookupflags, struct ifnet *ifp)
1355 {
1356 #if defined(PCBGROUP) && !defined(RSS)
1357 	struct inpcbgroup *pcbgroup;
1358 #endif
1359 
1360 	KASSERT((lookupflags & ~INPLOOKUP_MASK) == 0,
1361 	    ("%s: invalid lookup flags %d", __func__, lookupflags));
1362 	KASSERT((lookupflags & (INPLOOKUP_RLOCKPCB | INPLOOKUP_WLOCKPCB)) != 0,
1363 	    ("%s: LOCKPCB not set", __func__));
1364 
1365 	/*
1366 	 * When not using RSS, use connection groups in preference to the
1367 	 * reservation table when looking up 4-tuples.  When using RSS, just
1368 	 * use the reservation table, due to the cost of the Toeplitz hash
1369 	 * in software.
1370 	 *
1371 	 * XXXRW: This policy belongs in the pcbgroup code, as in principle
1372 	 * we could be doing RSS with a non-Toeplitz hash that is affordable
1373 	 * in software.
1374 	 */
1375 #if defined(PCBGROUP) && !defined(RSS)
1376 	if (in_pcbgroup_enabled(pcbinfo)) {
1377 		pcbgroup = in6_pcbgroup_bytuple(pcbinfo, laddr, lport, faddr,
1378 		    fport);
1379 		return (in6_pcblookup_group(pcbinfo, pcbgroup, faddr, fport,
1380 		    laddr, lport, lookupflags, ifp));
1381 	}
1382 #endif
1383 	return (in6_pcblookup_hash(pcbinfo, faddr, fport, laddr, lport,
1384 	    lookupflags, ifp, M_NODOM));
1385 }
1386 
1387 struct inpcb *
1388 in6_pcblookup_mbuf(struct inpcbinfo *pcbinfo, struct in6_addr *faddr,
1389     u_int fport, struct in6_addr *laddr, u_int lport, int lookupflags,
1390     struct ifnet *ifp, struct mbuf *m)
1391 {
1392 #ifdef PCBGROUP
1393 	struct inpcbgroup *pcbgroup;
1394 #endif
1395 
1396 	KASSERT((lookupflags & ~INPLOOKUP_MASK) == 0,
1397 	    ("%s: invalid lookup flags %d", __func__, lookupflags));
1398 	KASSERT((lookupflags & (INPLOOKUP_RLOCKPCB | INPLOOKUP_WLOCKPCB)) != 0,
1399 	    ("%s: LOCKPCB not set", __func__));
1400 
1401 #ifdef PCBGROUP
1402 	/*
1403 	 * If we can use a hardware-generated hash to look up the connection
1404 	 * group, use that connection group to find the inpcb.  Otherwise
1405 	 * fall back on a software hash -- or the reservation table if we're
1406 	 * using RSS.
1407 	 *
1408 	 * XXXRW: As above, that policy belongs in the pcbgroup code.
1409 	 */
1410 	if (in_pcbgroup_enabled(pcbinfo) &&
1411 	    M_HASHTYPE_TEST(m, M_HASHTYPE_NONE) == 0) {
1412 		pcbgroup = in6_pcbgroup_byhash(pcbinfo, M_HASHTYPE_GET(m),
1413 		    m->m_pkthdr.flowid);
1414 		if (pcbgroup != NULL)
1415 			return (in6_pcblookup_group(pcbinfo, pcbgroup, faddr,
1416 			    fport, laddr, lport, lookupflags, ifp));
1417 #ifndef RSS
1418 		pcbgroup = in6_pcbgroup_bytuple(pcbinfo, laddr, lport, faddr,
1419 		    fport);
1420 		return (in6_pcblookup_group(pcbinfo, pcbgroup, faddr, fport,
1421 		    laddr, lport, lookupflags, ifp));
1422 #endif
1423 	}
1424 #endif
1425 	return (in6_pcblookup_hash(pcbinfo, faddr, fport, laddr, lport,
1426 	    lookupflags, ifp, m->m_pkthdr.numa_domain));
1427 }
1428 
1429 void
1430 init_sin6(struct sockaddr_in6 *sin6, struct mbuf *m, int srcordst)
1431 {
1432 	struct ip6_hdr *ip;
1433 
1434 	ip = mtod(m, struct ip6_hdr *);
1435 	bzero(sin6, sizeof(*sin6));
1436 	sin6->sin6_len = sizeof(*sin6);
1437 	sin6->sin6_family = AF_INET6;
1438 	sin6->sin6_addr = srcordst ? ip->ip6_dst : ip->ip6_src;
1439 
1440 	(void)sa6_recoverscope(sin6); /* XXX: should catch errors... */
1441 
1442 	return;
1443 }
1444