xref: /freebsd/sys/netinet6/udp6_usrreq.c (revision 9e5787d2284e187abb5b654d924394a65772e004)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5  * Copyright (c) 2010-2011 Juniper Networks, Inc.
6  * Copyright (c) 2014 Kevin Lo
7  * All rights reserved.
8  *
9  * Portions of this software were developed by Robert N. M. Watson under
10  * contract to Juniper Networks, Inc.
11  *
12  * Redistribution and use in source and binary forms, with or without
13  * modification, are permitted provided that the following conditions
14  * are met:
15  * 1. Redistributions of source code must retain the above copyright
16  *    notice, this list of conditions and the following disclaimer.
17  * 2. Redistributions in binary form must reproduce the above copyright
18  *    notice, this list of conditions and the following disclaimer in the
19  *    documentation and/or other materials provided with the distribution.
20  * 3. Neither the name of the project nor the names of its contributors
21  *    may be used to endorse or promote products derived from this software
22  *    without specific prior written permission.
23  *
24  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
25  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
26  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
27  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
28  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
29  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
30  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
31  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
32  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
33  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
34  * SUCH DAMAGE.
35  *
36  *	$KAME: udp6_usrreq.c,v 1.27 2001/05/21 05:45:10 jinmei Exp $
37  *	$KAME: udp6_output.c,v 1.31 2001/05/21 16:39:15 jinmei Exp $
38  */
39 
40 /*-
41  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
42  *	The Regents of the University of California.
43  * All rights reserved.
44  *
45  * Redistribution and use in source and binary forms, with or without
46  * modification, are permitted provided that the following conditions
47  * are met:
48  * 1. Redistributions of source code must retain the above copyright
49  *    notice, this list of conditions and the following disclaimer.
50  * 2. Redistributions in binary form must reproduce the above copyright
51  *    notice, this list of conditions and the following disclaimer in the
52  *    documentation and/or other materials provided with the distribution.
53  * 3. Neither the name of the University nor the names of its contributors
54  *    may be used to endorse or promote products derived from this software
55  *    without specific prior written permission.
56  *
57  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
58  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
59  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
60  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
61  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
62  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
63  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
64  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
65  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
66  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
67  * SUCH DAMAGE.
68  *
69  *	@(#)udp_usrreq.c	8.6 (Berkeley) 5/23/95
70  */
71 
72 #include <sys/cdefs.h>
73 __FBSDID("$FreeBSD$");
74 
75 #include "opt_inet.h"
76 #include "opt_inet6.h"
77 #include "opt_ipsec.h"
78 #include "opt_rss.h"
79 
80 #include <sys/param.h>
81 #include <sys/jail.h>
82 #include <sys/kernel.h>
83 #include <sys/lock.h>
84 #include <sys/mbuf.h>
85 #include <sys/priv.h>
86 #include <sys/proc.h>
87 #include <sys/protosw.h>
88 #include <sys/sdt.h>
89 #include <sys/signalvar.h>
90 #include <sys/socket.h>
91 #include <sys/socketvar.h>
92 #include <sys/sx.h>
93 #include <sys/sysctl.h>
94 #include <sys/syslog.h>
95 #include <sys/systm.h>
96 
97 #include <net/if.h>
98 #include <net/if_var.h>
99 #include <net/if_types.h>
100 #include <net/route.h>
101 #include <net/rss_config.h>
102 
103 #include <netinet/in.h>
104 #include <netinet/in_kdtrace.h>
105 #include <netinet/in_pcb.h>
106 #include <netinet/in_systm.h>
107 #include <netinet/in_var.h>
108 #include <netinet/ip.h>
109 #include <netinet/ip6.h>
110 #include <netinet/icmp6.h>
111 #include <netinet/ip_var.h>
112 #include <netinet/udp.h>
113 #include <netinet/udp_var.h>
114 #include <netinet/udplite.h>
115 
116 #include <netinet6/ip6protosw.h>
117 #include <netinet6/ip6_var.h>
118 #include <netinet6/in6_pcb.h>
119 #include <netinet6/in6_rss.h>
120 #include <netinet6/udp6_var.h>
121 #include <netinet6/scope6_var.h>
122 
123 #include <netipsec/ipsec_support.h>
124 
125 #include <security/mac/mac_framework.h>
126 
127 /*
128  * UDP protocol implementation.
129  * Per RFC 768, August, 1980.
130  */
131 
132 extern struct protosw	inetsw[];
133 static void		udp6_detach(struct socket *so);
134 
135 static int
136 udp6_append(struct inpcb *inp, struct mbuf *n, int off,
137     struct sockaddr_in6 *fromsa)
138 {
139 	struct socket *so;
140 	struct mbuf *opts = NULL, *tmp_opts;
141 	struct udpcb *up;
142 
143 	INP_LOCK_ASSERT(inp);
144 
145 	/*
146 	 * Engage the tunneling protocol.
147 	 */
148 	up = intoudpcb(inp);
149 	if (up->u_tun_func != NULL) {
150 		in_pcbref(inp);
151 		INP_RUNLOCK(inp);
152 		(*up->u_tun_func)(n, off, inp, (struct sockaddr *)&fromsa[0],
153 		    up->u_tun_ctx);
154 		INP_RLOCK(inp);
155 		return (in_pcbrele_rlocked(inp));
156 	}
157 #if defined(IPSEC) || defined(IPSEC_SUPPORT)
158 	/* Check AH/ESP integrity. */
159 	if (IPSEC_ENABLED(ipv6)) {
160 		if (IPSEC_CHECK_POLICY(ipv6, n, inp) != 0) {
161 			m_freem(n);
162 			return (0);
163 		}
164 	}
165 #endif /* IPSEC */
166 #ifdef MAC
167 	if (mac_inpcb_check_deliver(inp, n) != 0) {
168 		m_freem(n);
169 		return (0);
170 	}
171 #endif
172 	opts = NULL;
173 	if (inp->inp_flags & INP_CONTROLOPTS ||
174 	    inp->inp_socket->so_options & SO_TIMESTAMP)
175 		ip6_savecontrol(inp, n, &opts);
176 	if ((inp->inp_vflag & INP_IPV6) && (inp->inp_flags2 & INP_ORIGDSTADDR)) {
177 		tmp_opts = sbcreatecontrol((caddr_t)&fromsa[1],
178                         sizeof(struct sockaddr_in6), IPV6_ORIGDSTADDR, IPPROTO_IPV6);
179                 if (tmp_opts) {
180                         if (opts) {
181                                 tmp_opts->m_next = opts;
182                                 opts = tmp_opts;
183                         } else
184                                 opts = tmp_opts;
185                 }
186 
187 	}
188 	m_adj(n, off + sizeof(struct udphdr));
189 
190 	so = inp->inp_socket;
191 	SOCKBUF_LOCK(&so->so_rcv);
192 	if (sbappendaddr_locked(&so->so_rcv, (struct sockaddr *)&fromsa[0], n,
193 	    opts) == 0) {
194 		SOCKBUF_UNLOCK(&so->so_rcv);
195 		m_freem(n);
196 		if (opts)
197 			m_freem(opts);
198 		UDPSTAT_INC(udps_fullsock);
199 	} else
200 		sorwakeup_locked(so);
201 	return (0);
202 }
203 
204 int
205 udp6_input(struct mbuf **mp, int *offp, int proto)
206 {
207 	struct mbuf *m = *mp;
208 	struct ifnet *ifp;
209 	struct ip6_hdr *ip6;
210 	struct udphdr *uh;
211 	struct inpcb *inp;
212 	struct inpcbinfo *pcbinfo;
213 	struct udpcb *up;
214 	int off = *offp;
215 	int cscov_partial;
216 	int plen, ulen;
217 	struct sockaddr_in6 fromsa[2];
218 	struct m_tag *fwd_tag;
219 	uint16_t uh_sum;
220 	uint8_t nxt;
221 
222 	NET_EPOCH_ASSERT();
223 
224 	ifp = m->m_pkthdr.rcvif;
225 
226 	if (m->m_len < off + sizeof(struct udphdr)) {
227 		m = m_pullup(m, off + sizeof(struct udphdr));
228 		if (m == NULL) {
229 			IP6STAT_INC(ip6s_exthdrtoolong);
230 			*mp = NULL;
231 			return (IPPROTO_DONE);
232 		}
233 	}
234 	ip6 = mtod(m, struct ip6_hdr *);
235 	uh = (struct udphdr *)((caddr_t)ip6 + off);
236 
237 	UDPSTAT_INC(udps_ipackets);
238 
239 	/*
240 	 * Destination port of 0 is illegal, based on RFC768.
241 	 */
242 	if (uh->uh_dport == 0)
243 		goto badunlocked;
244 
245 	plen = ntohs(ip6->ip6_plen) - off + sizeof(*ip6);
246 	ulen = ntohs((u_short)uh->uh_ulen);
247 
248 	nxt = proto;
249 	cscov_partial = (nxt == IPPROTO_UDPLITE) ? 1 : 0;
250 	if (nxt == IPPROTO_UDPLITE) {
251 		/* Zero means checksum over the complete packet. */
252 		if (ulen == 0)
253 			ulen = plen;
254 		if (ulen == plen)
255 			cscov_partial = 0;
256 		if ((ulen < sizeof(struct udphdr)) || (ulen > plen)) {
257 			/* XXX: What is the right UDPLite MIB counter? */
258 			goto badunlocked;
259 		}
260 		if (uh->uh_sum == 0) {
261 			/* XXX: What is the right UDPLite MIB counter? */
262 			goto badunlocked;
263 		}
264 	} else {
265 		if ((ulen < sizeof(struct udphdr)) || (plen != ulen)) {
266 			UDPSTAT_INC(udps_badlen);
267 			goto badunlocked;
268 		}
269 		if (uh->uh_sum == 0) {
270 			UDPSTAT_INC(udps_nosum);
271 			goto badunlocked;
272 		}
273 	}
274 
275 	if ((m->m_pkthdr.csum_flags & CSUM_DATA_VALID_IPV6) &&
276 	    !cscov_partial) {
277 		if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
278 			uh_sum = m->m_pkthdr.csum_data;
279 		else
280 			uh_sum = in6_cksum_pseudo(ip6, ulen, nxt,
281 			    m->m_pkthdr.csum_data);
282 		uh_sum ^= 0xffff;
283 	} else
284 		uh_sum = in6_cksum_partial(m, nxt, off, plen, ulen);
285 
286 	if (uh_sum != 0) {
287 		UDPSTAT_INC(udps_badsum);
288 		goto badunlocked;
289 	}
290 
291 	/*
292 	 * Construct sockaddr format source address.
293 	 */
294 	init_sin6(&fromsa[0], m, 0);
295 	fromsa[0].sin6_port = uh->uh_sport;
296 	init_sin6(&fromsa[1], m, 1);
297 	fromsa[1].sin6_port = uh->uh_dport;
298 
299 	pcbinfo = udp_get_inpcbinfo(nxt);
300 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
301 		struct inpcb *last;
302 		struct inpcbhead *pcblist;
303 		struct ip6_moptions *imo;
304 
305 		/*
306 		 * In the event that laddr should be set to the link-local
307 		 * address (this happens in RIPng), the multicast address
308 		 * specified in the received packet will not match laddr.  To
309 		 * handle this situation, matching is relaxed if the
310 		 * receiving interface is the same as one specified in the
311 		 * socket and if the destination multicast address matches
312 		 * one of the multicast groups specified in the socket.
313 		 */
314 
315 		/*
316 		 * KAME note: traditionally we dropped udpiphdr from mbuf
317 		 * here.  We need udphdr for IPsec processing so we do that
318 		 * later.
319 		 */
320 		pcblist = udp_get_pcblist(nxt);
321 		last = NULL;
322 		CK_LIST_FOREACH(inp, pcblist, inp_list) {
323 			if ((inp->inp_vflag & INP_IPV6) == 0)
324 				continue;
325 			if (inp->inp_lport != uh->uh_dport)
326 				continue;
327 			if (inp->inp_fport != 0 &&
328 			    inp->inp_fport != uh->uh_sport)
329 				continue;
330 			if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
331 				if (!IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr,
332 							&ip6->ip6_dst))
333 					continue;
334 			}
335 			if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
336 				if (!IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr,
337 							&ip6->ip6_src) ||
338 				    inp->inp_fport != uh->uh_sport)
339 					continue;
340 			}
341 
342 			/*
343 			 * XXXRW: Because we weren't holding either the inpcb
344 			 * or the hash lock when we checked for a match
345 			 * before, we should probably recheck now that the
346 			 * inpcb lock is (supposed to be) held.
347 			 */
348 
349 			/*
350 			 * Handle socket delivery policy for any-source
351 			 * and source-specific multicast. [RFC3678]
352 			 */
353 			imo = inp->in6p_moptions;
354 			if (imo && IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
355 				struct sockaddr_in6	 mcaddr;
356 				int			 blocked;
357 
358 				INP_RLOCK(inp);
359 				if (__predict_false(inp->inp_flags2 & INP_FREED)) {
360 					INP_RUNLOCK(inp);
361 					continue;
362 				}
363 
364 				bzero(&mcaddr, sizeof(struct sockaddr_in6));
365 				mcaddr.sin6_len = sizeof(struct sockaddr_in6);
366 				mcaddr.sin6_family = AF_INET6;
367 				mcaddr.sin6_addr = ip6->ip6_dst;
368 
369 				blocked = im6o_mc_filter(imo, ifp,
370 					(struct sockaddr *)&mcaddr,
371 					(struct sockaddr *)&fromsa[0]);
372 				if (blocked != MCAST_PASS) {
373 					if (blocked == MCAST_NOTGMEMBER)
374 						IP6STAT_INC(ip6s_notmember);
375 					if (blocked == MCAST_NOTSMEMBER ||
376 					    blocked == MCAST_MUTED)
377 						UDPSTAT_INC(udps_filtermcast);
378 					INP_RUNLOCK(inp); /* XXX */
379 					continue;
380 				}
381 
382 				INP_RUNLOCK(inp);
383 			}
384 			if (last != NULL) {
385 				struct mbuf *n;
386 
387 				if ((n = m_copym(m, 0, M_COPYALL, M_NOWAIT)) !=
388 				    NULL) {
389 					INP_RLOCK(last);
390 					if (__predict_true(last->inp_flags2 & INP_FREED) == 0) {
391 						if (nxt == IPPROTO_UDPLITE)
392 							UDPLITE_PROBE(receive, NULL, last,
393 							    ip6, last, uh);
394 						else
395 							UDP_PROBE(receive, NULL, last,
396 							    ip6, last, uh);
397 						if (udp6_append(last, n, off, fromsa)) {
398 							/* XXX-BZ do we leak m here? */
399 							*mp = NULL;
400 							return (IPPROTO_DONE);
401 						}
402 					}
403 					INP_RUNLOCK(last);
404 				}
405 			}
406 			last = inp;
407 			/*
408 			 * Don't look for additional matches if this one does
409 			 * not have either the SO_REUSEPORT or SO_REUSEADDR
410 			 * socket options set.  This heuristic avoids
411 			 * searching through all pcbs in the common case of a
412 			 * non-shared port.  It assumes that an application
413 			 * will never clear these options after setting them.
414 			 */
415 			if ((last->inp_socket->so_options &
416 			     (SO_REUSEPORT|SO_REUSEPORT_LB|SO_REUSEADDR)) == 0)
417 				break;
418 		}
419 
420 		if (last == NULL) {
421 			/*
422 			 * No matching pcb found; discard datagram.  (No need
423 			 * to send an ICMP Port Unreachable for a broadcast
424 			 * or multicast datgram.)
425 			 */
426 			UDPSTAT_INC(udps_noport);
427 			UDPSTAT_INC(udps_noportmcast);
428 			goto badunlocked;
429 		}
430 		INP_RLOCK(last);
431 		if (__predict_true(last->inp_flags2 & INP_FREED) == 0) {
432 			if (nxt == IPPROTO_UDPLITE)
433 				UDPLITE_PROBE(receive, NULL, last, ip6, last, uh);
434 			else
435 				UDP_PROBE(receive, NULL, last, ip6, last, uh);
436 			if (udp6_append(last, m, off, fromsa) == 0)
437 				INP_RUNLOCK(last);
438 		} else
439 			INP_RUNLOCK(last);
440 		*mp = NULL;
441 		return (IPPROTO_DONE);
442 	}
443 	/*
444 	 * Locate pcb for datagram.
445 	 */
446 
447 	/*
448 	 * Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain.
449 	 */
450 	if ((m->m_flags & M_IP6_NEXTHOP) &&
451 	    (fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL)) != NULL) {
452 		struct sockaddr_in6 *next_hop6;
453 
454 		next_hop6 = (struct sockaddr_in6 *)(fwd_tag + 1);
455 
456 		/*
457 		 * Transparently forwarded. Pretend to be the destination.
458 		 * Already got one like this?
459 		 */
460 		inp = in6_pcblookup_mbuf(pcbinfo, &ip6->ip6_src,
461 		    uh->uh_sport, &ip6->ip6_dst, uh->uh_dport,
462 		    INPLOOKUP_RLOCKPCB, m->m_pkthdr.rcvif, m);
463 		if (!inp) {
464 			/*
465 			 * It's new.  Try to find the ambushing socket.
466 			 * Because we've rewritten the destination address,
467 			 * any hardware-generated hash is ignored.
468 			 */
469 			inp = in6_pcblookup(pcbinfo, &ip6->ip6_src,
470 			    uh->uh_sport, &next_hop6->sin6_addr,
471 			    next_hop6->sin6_port ? htons(next_hop6->sin6_port) :
472 			    uh->uh_dport, INPLOOKUP_WILDCARD |
473 			    INPLOOKUP_RLOCKPCB, m->m_pkthdr.rcvif);
474 		}
475 		/* Remove the tag from the packet. We don't need it anymore. */
476 		m_tag_delete(m, fwd_tag);
477 		m->m_flags &= ~M_IP6_NEXTHOP;
478 	} else
479 		inp = in6_pcblookup_mbuf(pcbinfo, &ip6->ip6_src,
480 		    uh->uh_sport, &ip6->ip6_dst, uh->uh_dport,
481 		    INPLOOKUP_WILDCARD | INPLOOKUP_RLOCKPCB,
482 		    m->m_pkthdr.rcvif, m);
483 	if (inp == NULL) {
484 		if (V_udp_log_in_vain) {
485 			char ip6bufs[INET6_ADDRSTRLEN];
486 			char ip6bufd[INET6_ADDRSTRLEN];
487 
488 			log(LOG_INFO,
489 			    "Connection attempt to UDP [%s]:%d from [%s]:%d\n",
490 			    ip6_sprintf(ip6bufd, &ip6->ip6_dst),
491 			    ntohs(uh->uh_dport),
492 			    ip6_sprintf(ip6bufs, &ip6->ip6_src),
493 			    ntohs(uh->uh_sport));
494 		}
495 		if (nxt == IPPROTO_UDPLITE)
496 			UDPLITE_PROBE(receive, NULL, NULL, ip6, NULL, uh);
497 		else
498 			UDP_PROBE(receive, NULL, NULL, ip6, NULL, uh);
499 		UDPSTAT_INC(udps_noport);
500 		if (m->m_flags & M_MCAST) {
501 			printf("UDP6: M_MCAST is set in a unicast packet.\n");
502 			UDPSTAT_INC(udps_noportmcast);
503 			goto badunlocked;
504 		}
505 		if (V_udp_blackhole)
506 			goto badunlocked;
507 		icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_NOPORT, 0);
508 		*mp = NULL;
509 		return (IPPROTO_DONE);
510 	}
511 	INP_RLOCK_ASSERT(inp);
512 	up = intoudpcb(inp);
513 	if (cscov_partial) {
514 		if (up->u_rxcslen == 0 || up->u_rxcslen > ulen) {
515 			INP_RUNLOCK(inp);
516 			m_freem(m);
517 			*mp = NULL;
518 			return (IPPROTO_DONE);
519 		}
520 	}
521 	if (nxt == IPPROTO_UDPLITE)
522 		UDPLITE_PROBE(receive, NULL, inp, ip6, inp, uh);
523 	else
524 		UDP_PROBE(receive, NULL, inp, ip6, inp, uh);
525 	if (udp6_append(inp, m, off, fromsa) == 0)
526 		INP_RUNLOCK(inp);
527 	*mp = NULL;
528 	return (IPPROTO_DONE);
529 
530 badunlocked:
531 	m_freem(m);
532 	*mp = NULL;
533 	return (IPPROTO_DONE);
534 }
535 
536 static void
537 udp6_common_ctlinput(int cmd, struct sockaddr *sa, void *d,
538     struct inpcbinfo *pcbinfo)
539 {
540 	struct udphdr uh;
541 	struct ip6_hdr *ip6;
542 	struct mbuf *m;
543 	int off = 0;
544 	struct ip6ctlparam *ip6cp = NULL;
545 	const struct sockaddr_in6 *sa6_src = NULL;
546 	void *cmdarg;
547 	struct inpcb *(*notify)(struct inpcb *, int) = udp_notify;
548 	struct udp_portonly {
549 		u_int16_t uh_sport;
550 		u_int16_t uh_dport;
551 	} *uhp;
552 
553 	if (sa->sa_family != AF_INET6 ||
554 	    sa->sa_len != sizeof(struct sockaddr_in6))
555 		return;
556 
557 	if ((unsigned)cmd >= PRC_NCMDS)
558 		return;
559 	if (PRC_IS_REDIRECT(cmd))
560 		notify = in6_rtchange, d = NULL;
561 	else if (cmd == PRC_HOSTDEAD)
562 		d = NULL;
563 	else if (inet6ctlerrmap[cmd] == 0)
564 		return;
565 
566 	/* if the parameter is from icmp6, decode it. */
567 	if (d != NULL) {
568 		ip6cp = (struct ip6ctlparam *)d;
569 		m = ip6cp->ip6c_m;
570 		ip6 = ip6cp->ip6c_ip6;
571 		off = ip6cp->ip6c_off;
572 		cmdarg = ip6cp->ip6c_cmdarg;
573 		sa6_src = ip6cp->ip6c_src;
574 	} else {
575 		m = NULL;
576 		ip6 = NULL;
577 		cmdarg = NULL;
578 		sa6_src = &sa6_any;
579 	}
580 
581 	if (ip6) {
582 		/*
583 		 * XXX: We assume that when IPV6 is non NULL,
584 		 * M and OFF are valid.
585 		 */
586 
587 		/* Check if we can safely examine src and dst ports. */
588 		if (m->m_pkthdr.len < off + sizeof(*uhp))
589 			return;
590 
591 		bzero(&uh, sizeof(uh));
592 		m_copydata(m, off, sizeof(*uhp), (caddr_t)&uh);
593 
594 		if (!PRC_IS_REDIRECT(cmd)) {
595 			/* Check to see if its tunneled */
596 			struct inpcb *inp;
597 			inp = in6_pcblookup_mbuf(pcbinfo, &ip6->ip6_dst,
598 			    uh.uh_dport, &ip6->ip6_src, uh.uh_sport,
599 			    INPLOOKUP_WILDCARD | INPLOOKUP_RLOCKPCB,
600 			    m->m_pkthdr.rcvif, m);
601 			if (inp != NULL) {
602 				struct udpcb *up;
603 
604 				up = intoudpcb(inp);
605 				if (up->u_icmp_func) {
606 					/* Yes it is. */
607 					INP_RUNLOCK(inp);
608 					(*up->u_icmp_func)(cmd, (struct sockaddr *)ip6cp->ip6c_src,
609 					      d, up->u_tun_ctx);
610 					return;
611 				} else {
612 					/* Can't find it. */
613 					INP_RUNLOCK(inp);
614 				}
615 			}
616 		}
617 		(void)in6_pcbnotify(pcbinfo, sa, uh.uh_dport,
618 		    (struct sockaddr *)ip6cp->ip6c_src, uh.uh_sport, cmd,
619 		    cmdarg, notify);
620 	} else
621 		(void)in6_pcbnotify(pcbinfo, sa, 0,
622 		    (const struct sockaddr *)sa6_src, 0, cmd, cmdarg, notify);
623 }
624 
625 void
626 udp6_ctlinput(int cmd, struct sockaddr *sa, void *d)
627 {
628 
629 	return (udp6_common_ctlinput(cmd, sa, d, &V_udbinfo));
630 }
631 
632 void
633 udplite6_ctlinput(int cmd, struct sockaddr *sa, void *d)
634 {
635 
636 	return (udp6_common_ctlinput(cmd, sa, d, &V_ulitecbinfo));
637 }
638 
639 static int
640 udp6_getcred(SYSCTL_HANDLER_ARGS)
641 {
642 	struct xucred xuc;
643 	struct sockaddr_in6 addrs[2];
644 	struct epoch_tracker et;
645 	struct inpcb *inp;
646 	int error;
647 
648 	error = priv_check(req->td, PRIV_NETINET_GETCRED);
649 	if (error)
650 		return (error);
651 
652 	if (req->newlen != sizeof(addrs))
653 		return (EINVAL);
654 	if (req->oldlen != sizeof(struct xucred))
655 		return (EINVAL);
656 	error = SYSCTL_IN(req, addrs, sizeof(addrs));
657 	if (error)
658 		return (error);
659 	if ((error = sa6_embedscope(&addrs[0], V_ip6_use_defzone)) != 0 ||
660 	    (error = sa6_embedscope(&addrs[1], V_ip6_use_defzone)) != 0) {
661 		return (error);
662 	}
663 	NET_EPOCH_ENTER(et);
664 	inp = in6_pcblookup(&V_udbinfo, &addrs[1].sin6_addr,
665 	    addrs[1].sin6_port, &addrs[0].sin6_addr, addrs[0].sin6_port,
666 	    INPLOOKUP_WILDCARD | INPLOOKUP_RLOCKPCB, NULL);
667 	NET_EPOCH_EXIT(et);
668 	if (inp != NULL) {
669 		INP_RLOCK_ASSERT(inp);
670 		if (inp->inp_socket == NULL)
671 			error = ENOENT;
672 		if (error == 0)
673 			error = cr_canseesocket(req->td->td_ucred,
674 			    inp->inp_socket);
675 		if (error == 0)
676 			cru2x(inp->inp_cred, &xuc);
677 		INP_RUNLOCK(inp);
678 	} else
679 		error = ENOENT;
680 	if (error == 0)
681 		error = SYSCTL_OUT(req, &xuc, sizeof(struct xucred));
682 	return (error);
683 }
684 
685 SYSCTL_PROC(_net_inet6_udp6, OID_AUTO, getcred,
686     CTLTYPE_OPAQUE | CTLFLAG_RW | CTLFLAG_MPSAFE,
687     0, 0, udp6_getcred, "S,xucred",
688     "Get the xucred of a UDP6 connection");
689 
690 static int
691 udp6_output(struct socket *so, int flags_arg, struct mbuf *m,
692     struct sockaddr *addr6, struct mbuf *control, struct thread *td)
693 {
694 	struct inpcb *inp;
695 	struct ip6_hdr *ip6;
696 	struct udphdr *udp6;
697 	struct in6_addr *laddr, *faddr, in6a;
698 	struct ip6_pktopts *optp, opt;
699 	struct sockaddr_in6 *sin6, tmp;
700 	struct epoch_tracker et;
701 	int cscov_partial, error, flags, hlen, scope_ambiguous;
702 	u_int32_t ulen, plen;
703 	uint16_t cscov;
704 	u_short fport;
705 	uint8_t nxt;
706 
707 	/* addr6 has been validated in udp6_send(). */
708 	sin6 = (struct sockaddr_in6 *)addr6;
709 
710 	/*
711 	 * In contrast to to IPv4 we do not validate the max. packet length
712 	 * here due to IPv6 Jumbograms (RFC2675).
713 	 */
714 
715 	scope_ambiguous = 0;
716 	if (sin6) {
717 		/* Protect *addr6 from overwrites. */
718 		tmp = *sin6;
719 		sin6 = &tmp;
720 
721 		/*
722 		 * Application should provide a proper zone ID or the use of
723 		 * default zone IDs should be enabled.  Unfortunately, some
724 		 * applications do not behave as it should, so we need a
725 		 * workaround.  Even if an appropriate ID is not determined,
726 		 * we'll see if we can determine the outgoing interface.  If we
727 		 * can, determine the zone ID based on the interface below.
728 		 */
729 		if (sin6->sin6_scope_id == 0 && !V_ip6_use_defzone)
730 			scope_ambiguous = 1;
731 		if ((error = sa6_embedscope(sin6, V_ip6_use_defzone)) != 0) {
732 			if (control)
733 				m_freem(control);
734 			m_freem(m);
735 			return (error);
736 		}
737 	}
738 
739 	inp = sotoinpcb(so);
740 	KASSERT(inp != NULL, ("%s: inp == NULL", __func__));
741 	/*
742 	 * In the following cases we want a write lock on the inp for either
743 	 * local operations or for possible route cache updates in the IPv6
744 	 * output path:
745 	 * - on connected sockets (sin6 is NULL) for route cache updates,
746 	 * - when we are not bound to an address and source port (it is
747 	 *   in6_pcbsetport() which will require the write lock).
748 	 *
749 	 * We check the inp fields before actually locking the inp, so
750 	 * here exists a race, and we may WLOCK the inp and end with already
751 	 * bound one by other thread. This is fine.
752 	 */
753 	if (sin6 == NULL || (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr) &&
754 	    inp->inp_lport == 0))
755 		INP_WLOCK(inp);
756 	else
757 		INP_RLOCK(inp);
758 
759 	nxt = (inp->inp_socket->so_proto->pr_protocol == IPPROTO_UDP) ?
760 	    IPPROTO_UDP : IPPROTO_UDPLITE;
761 
762 #ifdef INET
763 	if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
764 		int hasv4addr;
765 
766 		if (sin6 == NULL)
767 			hasv4addr = (inp->inp_vflag & INP_IPV4);
768 		else
769 			hasv4addr = IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)
770 			    ? 1 : 0;
771 		if (hasv4addr) {
772 			struct pr_usrreqs *pru;
773 
774 			/*
775 			 * XXXRW: We release UDP-layer locks before calling
776 			 * udp_send() in order to avoid recursion.  However,
777 			 * this does mean there is a short window where inp's
778 			 * fields are unstable.  Could this lead to a
779 			 * potential race in which the factors causing us to
780 			 * select the UDPv4 output routine are invalidated?
781 			 */
782 			INP_UNLOCK(inp);
783 			if (sin6)
784 				in6_sin6_2_sin_in_sock((struct sockaddr *)sin6);
785 			pru = inetsw[ip_protox[nxt]].pr_usrreqs;
786 			/* addr will just be freed in sendit(). */
787 			return ((*pru->pru_send)(so, flags_arg | PRUS_IPV6, m,
788 			    (struct sockaddr *)sin6, control, td));
789 		}
790 	} else
791 #endif
792 	if (sin6 && IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
793 		/*
794 		 * Given this is either an IPv6-only socket or no INET is
795 		 * supported we will fail the send if the given destination
796 		 * address is a v4mapped address.
797 		 *
798 		 * XXXGL: do we leak m and control?
799 		 */
800 		INP_UNLOCK(inp);
801 		return (EINVAL);
802 	}
803 
804 	if (control) {
805 		if ((error = ip6_setpktopts(control, &opt,
806 		    inp->in6p_outputopts, td->td_ucred, nxt)) != 0) {
807 			INP_UNLOCK(inp);
808 			ip6_clearpktopts(&opt, -1);
809 			if (control)
810 				m_freem(control);
811 			m_freem(m);
812 			return (error);
813 		}
814 		optp = &opt;
815 	} else
816 		optp = inp->in6p_outputopts;
817 
818 	NET_EPOCH_ENTER(et);
819 	if (sin6) {
820 
821 		/*
822 		 * Since we saw no essential reason for calling in_pcbconnect,
823 		 * we get rid of such kind of logic, and call in6_selectsrc
824 		 * and in6_pcbsetport in order to fill in the local address
825 		 * and the local port.
826 		 */
827 		if (sin6->sin6_port == 0) {
828 			error = EADDRNOTAVAIL;
829 			goto release;
830 		}
831 
832 		if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
833 			/* how about ::ffff:0.0.0.0 case? */
834 			error = EISCONN;
835 			goto release;
836 		}
837 
838 		/*
839 		 * Given we handle the v4mapped case in the INET block above
840 		 * assert here that it must not happen anymore.
841 		 */
842 		KASSERT(!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr),
843 		    ("%s: sin6(%p)->sin6_addr is v4mapped which we "
844 		    "should have handled.", __func__, sin6));
845 
846 		/* This only requires read-locking. */
847 		error = in6_selectsrc_socket(sin6, optp, inp,
848 		    td->td_ucred, scope_ambiguous, &in6a, NULL);
849 		if (error)
850 			goto release;
851 		laddr = &in6a;
852 
853 		if (inp->inp_lport == 0) {
854 			struct inpcbinfo *pcbinfo;
855 
856 			INP_WLOCK_ASSERT(inp);
857 
858 			pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
859 			INP_HASH_WLOCK(pcbinfo);
860 			error = in6_pcbsetport(laddr, inp, td->td_ucred);
861 			INP_HASH_WUNLOCK(pcbinfo);
862 			if (error != 0) {
863 				/* Undo an address bind that may have occurred. */
864 				inp->in6p_laddr = in6addr_any;
865 				goto release;
866 			}
867 		}
868 		faddr = &sin6->sin6_addr;
869 		fport = sin6->sin6_port; /* allow 0 port */
870 
871 	} else {
872 		if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
873 			error = ENOTCONN;
874 			goto release;
875 		}
876 		laddr = &inp->in6p_laddr;
877 		faddr = &inp->in6p_faddr;
878 		fport = inp->inp_fport;
879 	}
880 
881 	ulen = m->m_pkthdr.len;
882 	plen = sizeof(struct udphdr) + ulen;
883 	hlen = sizeof(struct ip6_hdr);
884 
885 	/*
886 	 * Calculate data length and get a mbuf
887 	 * for UDP and IP6 headers.
888 	 */
889 	M_PREPEND(m, hlen + sizeof(struct udphdr), M_NOWAIT);
890 	if (m == NULL) {
891 		error = ENOBUFS;
892 		goto release;
893 	}
894 
895 	/*
896 	 * Stuff checksum and output datagram.
897 	 */
898 	cscov = cscov_partial = 0;
899 	udp6 = (struct udphdr *)(mtod(m, caddr_t) + hlen);
900 	udp6->uh_sport = inp->inp_lport; /* lport is always set in the PCB */
901 	udp6->uh_dport = fport;
902 	if (nxt == IPPROTO_UDPLITE) {
903 		struct udpcb *up;
904 
905 		up = intoudpcb(inp);
906 		cscov = up->u_txcslen;
907 		if (cscov >= plen)
908 			cscov = 0;
909 		udp6->uh_ulen = htons(cscov);
910 		/*
911 		 * For UDP-Lite, checksum coverage length of zero means
912 		 * the entire UDPLite packet is covered by the checksum.
913 		 */
914 		cscov_partial = (cscov == 0) ? 0 : 1;
915 	} else if (plen <= 0xffff)
916 		udp6->uh_ulen = htons((u_short)plen);
917 	else
918 		udp6->uh_ulen = 0;
919 	udp6->uh_sum = 0;
920 
921 	ip6 = mtod(m, struct ip6_hdr *);
922 	ip6->ip6_flow	= inp->inp_flow & IPV6_FLOWINFO_MASK;
923 	ip6->ip6_vfc	&= ~IPV6_VERSION_MASK;
924 	ip6->ip6_vfc	|= IPV6_VERSION;
925 	ip6->ip6_plen	= htons((u_short)plen);
926 	ip6->ip6_nxt	= nxt;
927 	ip6->ip6_hlim	= in6_selecthlim(inp, NULL);
928 	ip6->ip6_src	= *laddr;
929 	ip6->ip6_dst	= *faddr;
930 
931 #ifdef MAC
932 	mac_inpcb_create_mbuf(inp, m);
933 #endif
934 
935 	if (cscov_partial) {
936 		if ((udp6->uh_sum = in6_cksum_partial(m, nxt,
937 		    sizeof(struct ip6_hdr), plen, cscov)) == 0)
938 			udp6->uh_sum = 0xffff;
939 	} else {
940 		udp6->uh_sum = in6_cksum_pseudo(ip6, plen, nxt, 0);
941 		m->m_pkthdr.csum_flags = CSUM_UDP_IPV6;
942 		m->m_pkthdr.csum_data = offsetof(struct udphdr, uh_sum);
943 	}
944 
945 	flags = 0;
946 #ifdef	RSS
947 	{
948 		uint32_t hash_val, hash_type;
949 		uint8_t pr;
950 
951 		pr = inp->inp_socket->so_proto->pr_protocol;
952 		/*
953 		 * Calculate an appropriate RSS hash for UDP and
954 		 * UDP Lite.
955 		 *
956 		 * The called function will take care of figuring out
957 		 * whether a 2-tuple or 4-tuple hash is required based
958 		 * on the currently configured scheme.
959 		 *
960 		 * Later later on connected socket values should be
961 		 * cached in the inpcb and reused, rather than constantly
962 		 * re-calculating it.
963 		 *
964 		 * UDP Lite is a different protocol number and will
965 		 * likely end up being hashed as a 2-tuple until
966 		 * RSS / NICs grow UDP Lite protocol awareness.
967 		 */
968 		if (rss_proto_software_hash_v6(faddr, laddr, fport,
969 		    inp->inp_lport, pr, &hash_val, &hash_type) == 0) {
970 			m->m_pkthdr.flowid = hash_val;
971 			M_HASHTYPE_SET(m, hash_type);
972 		}
973 
974 		/*
975 		 * Don't override with the inp cached flowid.
976 		 *
977 		 * Until the whole UDP path is vetted, it may actually
978 		 * be incorrect.
979 		 */
980 		flags |= IP_NODEFAULTFLOWID;
981 	}
982 #endif
983 
984 	UDPSTAT_INC(udps_opackets);
985 	if (nxt == IPPROTO_UDPLITE)
986 		UDPLITE_PROBE(send, NULL, inp, ip6, inp, udp6);
987 	else
988 		UDP_PROBE(send, NULL, inp, ip6, inp, udp6);
989 	error = ip6_output(m, optp,
990 	    INP_WLOCKED(inp) ? &inp->inp_route6 : NULL, flags,
991 	    inp->in6p_moptions, NULL, inp);
992 	INP_UNLOCK(inp);
993 	NET_EPOCH_EXIT(et);
994 
995 	if (control) {
996 		ip6_clearpktopts(&opt, -1);
997 		m_freem(control);
998 	}
999 	return (error);
1000 
1001 release:
1002 	INP_UNLOCK(inp);
1003 	NET_EPOCH_EXIT(et);
1004 	if (control) {
1005 		ip6_clearpktopts(&opt, -1);
1006 		m_freem(control);
1007 	}
1008 	m_freem(m);
1009 
1010 	return (error);
1011 }
1012 
1013 static void
1014 udp6_abort(struct socket *so)
1015 {
1016 	struct inpcb *inp;
1017 	struct inpcbinfo *pcbinfo;
1018 
1019 	pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
1020 	inp = sotoinpcb(so);
1021 	KASSERT(inp != NULL, ("udp6_abort: inp == NULL"));
1022 
1023 	INP_WLOCK(inp);
1024 #ifdef INET
1025 	if (inp->inp_vflag & INP_IPV4) {
1026 		struct pr_usrreqs *pru;
1027 		uint8_t nxt;
1028 
1029 		nxt = (inp->inp_socket->so_proto->pr_protocol == IPPROTO_UDP) ?
1030 		    IPPROTO_UDP : IPPROTO_UDPLITE;
1031 		INP_WUNLOCK(inp);
1032 		pru = inetsw[ip_protox[nxt]].pr_usrreqs;
1033 		(*pru->pru_abort)(so);
1034 		return;
1035 	}
1036 #endif
1037 
1038 	if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
1039 		INP_HASH_WLOCK(pcbinfo);
1040 		in6_pcbdisconnect(inp);
1041 		inp->in6p_laddr = in6addr_any;
1042 		INP_HASH_WUNLOCK(pcbinfo);
1043 		soisdisconnected(so);
1044 	}
1045 	INP_WUNLOCK(inp);
1046 }
1047 
1048 static int
1049 udp6_attach(struct socket *so, int proto, struct thread *td)
1050 {
1051 	struct inpcb *inp;
1052 	struct inpcbinfo *pcbinfo;
1053 	int error;
1054 
1055 	pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
1056 	inp = sotoinpcb(so);
1057 	KASSERT(inp == NULL, ("udp6_attach: inp != NULL"));
1058 
1059 	if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
1060 		error = soreserve(so, udp_sendspace, udp_recvspace);
1061 		if (error)
1062 			return (error);
1063 	}
1064 	INP_INFO_WLOCK(pcbinfo);
1065 	error = in_pcballoc(so, pcbinfo);
1066 	if (error) {
1067 		INP_INFO_WUNLOCK(pcbinfo);
1068 		return (error);
1069 	}
1070 	inp = (struct inpcb *)so->so_pcb;
1071 	inp->inp_vflag |= INP_IPV6;
1072 	if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0)
1073 		inp->inp_vflag |= INP_IPV4;
1074 	inp->in6p_hops = -1;	/* use kernel default */
1075 	inp->in6p_cksum = -1;	/* just to be sure */
1076 	/*
1077 	 * XXX: ugly!!
1078 	 * IPv4 TTL initialization is necessary for an IPv6 socket as well,
1079 	 * because the socket may be bound to an IPv6 wildcard address,
1080 	 * which may match an IPv4-mapped IPv6 address.
1081 	 */
1082 	inp->inp_ip_ttl = V_ip_defttl;
1083 
1084 	error = udp_newudpcb(inp);
1085 	if (error) {
1086 		in_pcbdetach(inp);
1087 		in_pcbfree(inp);
1088 		INP_INFO_WUNLOCK(pcbinfo);
1089 		return (error);
1090 	}
1091 	INP_WUNLOCK(inp);
1092 	INP_INFO_WUNLOCK(pcbinfo);
1093 	return (0);
1094 }
1095 
1096 static int
1097 udp6_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
1098 {
1099 	struct inpcb *inp;
1100 	struct inpcbinfo *pcbinfo;
1101 	int error;
1102 	u_char vflagsav;
1103 
1104 	pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
1105 	inp = sotoinpcb(so);
1106 	KASSERT(inp != NULL, ("udp6_bind: inp == NULL"));
1107 
1108 	INP_WLOCK(inp);
1109 	INP_HASH_WLOCK(pcbinfo);
1110 	vflagsav = inp->inp_vflag;
1111 	inp->inp_vflag &= ~INP_IPV4;
1112 	inp->inp_vflag |= INP_IPV6;
1113 	if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
1114 		struct sockaddr_in6 *sin6_p;
1115 
1116 		sin6_p = (struct sockaddr_in6 *)nam;
1117 
1118 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6_p->sin6_addr))
1119 			inp->inp_vflag |= INP_IPV4;
1120 #ifdef INET
1121 		else if (IN6_IS_ADDR_V4MAPPED(&sin6_p->sin6_addr)) {
1122 			struct sockaddr_in sin;
1123 
1124 			in6_sin6_2_sin(&sin, sin6_p);
1125 			inp->inp_vflag |= INP_IPV4;
1126 			inp->inp_vflag &= ~INP_IPV6;
1127 			error = in_pcbbind(inp, (struct sockaddr *)&sin,
1128 			    td->td_ucred);
1129 			goto out;
1130 		}
1131 #endif
1132 	}
1133 
1134 	error = in6_pcbbind(inp, nam, td->td_ucred);
1135 #ifdef INET
1136 out:
1137 #endif
1138 	if (error != 0)
1139 		inp->inp_vflag = vflagsav;
1140 	INP_HASH_WUNLOCK(pcbinfo);
1141 	INP_WUNLOCK(inp);
1142 	return (error);
1143 }
1144 
1145 static void
1146 udp6_close(struct socket *so)
1147 {
1148 	struct inpcb *inp;
1149 	struct inpcbinfo *pcbinfo;
1150 
1151 	pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
1152 	inp = sotoinpcb(so);
1153 	KASSERT(inp != NULL, ("udp6_close: inp == NULL"));
1154 
1155 	INP_WLOCK(inp);
1156 #ifdef INET
1157 	if (inp->inp_vflag & INP_IPV4) {
1158 		struct pr_usrreqs *pru;
1159 		uint8_t nxt;
1160 
1161 		nxt = (inp->inp_socket->so_proto->pr_protocol == IPPROTO_UDP) ?
1162 		    IPPROTO_UDP : IPPROTO_UDPLITE;
1163 		INP_WUNLOCK(inp);
1164 		pru = inetsw[ip_protox[nxt]].pr_usrreqs;
1165 		(*pru->pru_disconnect)(so);
1166 		return;
1167 	}
1168 #endif
1169 	if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
1170 		INP_HASH_WLOCK(pcbinfo);
1171 		in6_pcbdisconnect(inp);
1172 		inp->in6p_laddr = in6addr_any;
1173 		INP_HASH_WUNLOCK(pcbinfo);
1174 		soisdisconnected(so);
1175 	}
1176 	INP_WUNLOCK(inp);
1177 }
1178 
1179 static int
1180 udp6_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
1181 {
1182 #ifdef INET
1183 	struct epoch_tracker et;
1184 #endif
1185 	struct inpcb *inp;
1186 	struct inpcbinfo *pcbinfo;
1187 	struct sockaddr_in6 *sin6;
1188 	int error;
1189 	u_char vflagsav;
1190 
1191 	pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
1192 	inp = sotoinpcb(so);
1193 	sin6 = (struct sockaddr_in6 *)nam;
1194 	KASSERT(inp != NULL, ("udp6_connect: inp == NULL"));
1195 
1196 	/*
1197 	 * XXXRW: Need to clarify locking of v4/v6 flags.
1198 	 */
1199 	INP_WLOCK(inp);
1200 #ifdef INET
1201 	if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
1202 		struct sockaddr_in sin;
1203 
1204 		if ((inp->inp_flags & IN6P_IPV6_V6ONLY) != 0) {
1205 			error = EINVAL;
1206 			goto out;
1207 		}
1208 		if ((inp->inp_vflag & INP_IPV4) == 0) {
1209 			error = EAFNOSUPPORT;
1210 			goto out;
1211 		}
1212 		if (inp->inp_faddr.s_addr != INADDR_ANY) {
1213 			error = EISCONN;
1214 			goto out;
1215 		}
1216 		in6_sin6_2_sin(&sin, sin6);
1217 		error = prison_remote_ip4(td->td_ucred, &sin.sin_addr);
1218 		if (error != 0)
1219 			goto out;
1220 		vflagsav = inp->inp_vflag;
1221 		inp->inp_vflag |= INP_IPV4;
1222 		inp->inp_vflag &= ~INP_IPV6;
1223 		NET_EPOCH_ENTER(et);
1224 		INP_HASH_WLOCK(pcbinfo);
1225 		error = in_pcbconnect(inp, (struct sockaddr *)&sin,
1226 		    td->td_ucred);
1227 		INP_HASH_WUNLOCK(pcbinfo);
1228 		NET_EPOCH_EXIT(et);
1229 		/*
1230 		 * If connect succeeds, mark socket as connected. If
1231 		 * connect fails and socket is unbound, reset inp_vflag
1232 		 * field.
1233 		 */
1234 		if (error == 0)
1235 			soisconnected(so);
1236 		else if (inp->inp_laddr.s_addr == INADDR_ANY &&
1237 		    inp->inp_lport == 0)
1238 			inp->inp_vflag = vflagsav;
1239 		goto out;
1240 	} else {
1241 		if ((inp->inp_vflag & INP_IPV6) == 0) {
1242 			error = EAFNOSUPPORT;
1243 			goto out;
1244 		}
1245 	}
1246 #endif
1247 	if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
1248 		error = EISCONN;
1249 		goto out;
1250 	}
1251 	error = prison_remote_ip6(td->td_ucred, &sin6->sin6_addr);
1252 	if (error != 0)
1253 		goto out;
1254 	vflagsav = inp->inp_vflag;
1255 	inp->inp_vflag &= ~INP_IPV4;
1256 	inp->inp_vflag |= INP_IPV6;
1257 	INP_HASH_WLOCK(pcbinfo);
1258 	error = in6_pcbconnect(inp, nam, td->td_ucred);
1259 	INP_HASH_WUNLOCK(pcbinfo);
1260 	/*
1261 	 * If connect succeeds, mark socket as connected. If
1262 	 * connect fails and socket is unbound, reset inp_vflag
1263 	 * field.
1264 	 */
1265 	if (error == 0)
1266 		soisconnected(so);
1267 	else if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr) &&
1268 	    inp->inp_lport == 0)
1269 		inp->inp_vflag = vflagsav;
1270 out:
1271 	INP_WUNLOCK(inp);
1272 	return (error);
1273 }
1274 
1275 static void
1276 udp6_detach(struct socket *so)
1277 {
1278 	struct inpcb *inp;
1279 	struct inpcbinfo *pcbinfo;
1280 	struct udpcb *up;
1281 
1282 	pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
1283 	inp = sotoinpcb(so);
1284 	KASSERT(inp != NULL, ("udp6_detach: inp == NULL"));
1285 
1286 	INP_INFO_WLOCK(pcbinfo);
1287 	INP_WLOCK(inp);
1288 	up = intoudpcb(inp);
1289 	KASSERT(up != NULL, ("%s: up == NULL", __func__));
1290 	in_pcbdetach(inp);
1291 	in_pcbfree(inp);
1292 	INP_INFO_WUNLOCK(pcbinfo);
1293 	udp_discardcb(up);
1294 }
1295 
1296 static int
1297 udp6_disconnect(struct socket *so)
1298 {
1299 	struct inpcb *inp;
1300 	struct inpcbinfo *pcbinfo;
1301 
1302 	pcbinfo = udp_get_inpcbinfo(so->so_proto->pr_protocol);
1303 	inp = sotoinpcb(so);
1304 	KASSERT(inp != NULL, ("udp6_disconnect: inp == NULL"));
1305 
1306 	INP_WLOCK(inp);
1307 #ifdef INET
1308 	if (inp->inp_vflag & INP_IPV4) {
1309 		struct pr_usrreqs *pru;
1310 		uint8_t nxt;
1311 
1312 		nxt = (inp->inp_socket->so_proto->pr_protocol == IPPROTO_UDP) ?
1313 		    IPPROTO_UDP : IPPROTO_UDPLITE;
1314 		INP_WUNLOCK(inp);
1315 		pru = inetsw[ip_protox[nxt]].pr_usrreqs;
1316 		(void)(*pru->pru_disconnect)(so);
1317 		return (0);
1318 	}
1319 #endif
1320 
1321 	if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
1322 		INP_WUNLOCK(inp);
1323 		return (ENOTCONN);
1324 	}
1325 
1326 	INP_HASH_WLOCK(pcbinfo);
1327 	in6_pcbdisconnect(inp);
1328 	inp->in6p_laddr = in6addr_any;
1329 	INP_HASH_WUNLOCK(pcbinfo);
1330 	SOCK_LOCK(so);
1331 	so->so_state &= ~SS_ISCONNECTED;		/* XXX */
1332 	SOCK_UNLOCK(so);
1333 	INP_WUNLOCK(inp);
1334 	return (0);
1335 }
1336 
1337 static int
1338 udp6_send(struct socket *so, int flags, struct mbuf *m,
1339     struct sockaddr *addr, struct mbuf *control, struct thread *td)
1340 {
1341 	int error;
1342 
1343 	if (addr) {
1344 		if (addr->sa_len != sizeof(struct sockaddr_in6)) {
1345 			error = EINVAL;
1346 			goto bad;
1347 		}
1348 		if (addr->sa_family != AF_INET6) {
1349 			error = EAFNOSUPPORT;
1350 			goto bad;
1351 		}
1352 	}
1353 
1354 	return (udp6_output(so, flags, m, addr, control, td));
1355 
1356 bad:
1357 	if (control)
1358 		m_freem(control);
1359 	m_freem(m);
1360 	return (error);
1361 }
1362 
1363 struct pr_usrreqs udp6_usrreqs = {
1364 	.pru_abort =		udp6_abort,
1365 	.pru_attach =		udp6_attach,
1366 	.pru_bind =		udp6_bind,
1367 	.pru_connect =		udp6_connect,
1368 	.pru_control =		in6_control,
1369 	.pru_detach =		udp6_detach,
1370 	.pru_disconnect =	udp6_disconnect,
1371 	.pru_peeraddr =		in6_mapped_peeraddr,
1372 	.pru_send =		udp6_send,
1373 	.pru_shutdown =		udp_shutdown,
1374 	.pru_sockaddr =		in6_mapped_sockaddr,
1375 	.pru_soreceive =	soreceive_dgram,
1376 	.pru_sosend =		sosend_dgram,
1377 	.pru_sosetlabel =	in_pcbsosetlabel,
1378 	.pru_close =		udp6_close
1379 };
1380