sys/netinet6/in6_pcb.c

   1 /*      $FreeBSD: src/sys/netinet6/in6_pcb.c,v 1.10.2.9 2003/01/24 05:11:35 sam Exp $   */
   2 /*      $KAME: in6_pcb.c,v 1.31 2001/05/21 05:45:10 jinmei Exp $        */
   3
   4 /*
   5  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
   6  * All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions
  10  * are met:
  11  * 1. Redistributions of source code must retain the above copyright
  12  *    notice, this list of conditions and the following disclaimer.
  13  * 2. Redistributions in binary form must reproduce the above copyright
  14  *    notice, this list of conditions and the following disclaimer in the
  15  *    documentation and/or other materials provided with the distribution.
  16  * 3. Neither the name of the project nor the names of its contributors
  17  *    may be used to endorse or promote products derived from this software
  18  *    without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
  21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30  * SUCH DAMAGE.
  31  *
  32  */
  33
  34 /*
  35  * Copyright (c) 1982, 1986, 1991, 1993
  36  *      The Regents of the University of California.  All rights reserved.
  37  *
  38  * Redistribution and use in source and binary forms, with or without
  39  * modification, are permitted provided that the following conditions
  40  * are met:
  41  * 1. Redistributions of source code must retain the above copyright
  42  *    notice, this list of conditions and the following disclaimer.
  43  * 2. Redistributions in binary form must reproduce the above copyright
  44  *    notice, this list of conditions and the following disclaimer in the
  45  *    documentation and/or other materials provided with the distribution.
  46  * 3. Neither the name of the University nor the names of its contributors
  47  *    may be used to endorse or promote products derived from this software
  48  *    without specific prior written permission.
  49  *
  50  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  51  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  52  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  53  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  54  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  55  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  56  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  57  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  58  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  59  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  60  * SUCH DAMAGE.
  61  *
  62  *      @(#)in_pcb.c    8.2 (Berkeley) 1/4/94
  63  */
  64
  65 #include "opt_inet.h"
  66 #include "opt_inet6.h"
  67 #include "opt_ipsec.h"
  68
  69 #include <sys/param.h>
  70 #include <sys/systm.h>
  71 #include <sys/malloc.h>
  72 #include <sys/mbuf.h>
  73 #include <sys/domain.h>
  74 #include <sys/protosw.h>
  75 #include <sys/socket.h>
  76 #include <sys/socketvar.h>
  77 #include <sys/sockio.h>
  78 #include <sys/errno.h>
  79 #include <sys/time.h>
  80 #include <sys/proc.h>
  81 #include <sys/priv.h>
  82 #include <sys/jail.h>
  83
  84 #include <sys/thread2.h>
  85 #include <sys/msgport2.h>
  86
  87 #include <vm/vm_zone.h>
  88
  89 #include <net/if.h>
  90 #include <net/if_types.h>
  91 #include <net/route.h>
  92 #include <net/netisr2.h>
  93
  94 #include <netinet/in.h>
  95 #include <netinet/in_var.h>
  96 #include <netinet/in_systm.h>
  97 #include <netinet/ip6.h>
  98 #include <netinet/ip_var.h>
  99 #include <netinet6/ip6_var.h>
 100 #include <netinet6/nd6.h>
 101 #include <netinet/in_pcb.h>
 102 #include <netinet6/in6_pcb.h>
 103
 104 #ifdef IPSEC
 105 #include <netinet6/ipsec.h>
 106 #ifdef INET6
 107 #include <netinet6/ipsec6.h>
 108 #endif
 109 #include <netinet6/ah.h>
 110 #ifdef INET6
 111 #include <netinet6/ah6.h>
 112 #endif
 113 #include <netproto/key/key.h>
 114 #endif /* IPSEC */
 115
 116 #ifdef FAST_IPSEC
 117 #include <netproto/ipsec/ipsec.h>
 118 #include <netproto/ipsec/ipsec6.h>
 119 #include <netproto/ipsec/key.h>
 120 #define IPSEC
 121 #endif /* FAST_IPSEC */
 122
 123 struct  in6_addr zeroin6_addr;
 124
 125 int
 126 in6_pcbbind(struct inpcb *inp, struct sockaddr *nam, struct thread *td)
 127 {
 128         struct socket *so = inp->inp_socket;
 129         struct sockaddr_in6 jsin6;
 130         int error;
 131
 132         if (!in6_ifaddr) /* XXX broken! */
 133                 return (EADDRNOTAVAIL);
 134         if (inp->inp_lport || !IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr))
 135                 return (EINVAL);
 136
 137         if (nam) {
 138                 struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)nam;
 139                 struct inpcbinfo *pcbinfo;
 140                 struct inpcbportinfo *portinfo;
 141                 int wild = 0, reuseport = (so->so_options & SO_REUSEPORT);
 142                 struct ucred *cred = NULL;
 143                 struct inpcb *t;
 144                 u_short lport, lport_ho;
 145
 146                 if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) == 0)
 147                         wild = 1;
 148                 if (td->td_proc != NULL)
 149                         cred = td->td_proc->p_ucred;
 150
 151                 if (nam->sa_len != sizeof(*sin6))
 152                         return (EINVAL);
 153                 /*
 154                  * family check.
 155                  */
 156                 if (nam->sa_family != AF_INET6)
 157                         return (EAFNOSUPPORT);
 158
 159                 /* Reject v4-mapped address */
 160                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr))
 161                         return (EADDRNOTAVAIL);
 162
 163                 if (!prison_replace_wildcards(td, nam))
 164                         return (EINVAL);
 165
 166                 /* KAME hack: embed scopeid */
 167                 if (in6_embedscope(&sin6->sin6_addr, sin6, inp, NULL) != 0)
 168                         return (EINVAL);
 169                 /* this must be cleared for ifa_ifwithaddr() */
 170                 sin6->sin6_scope_id = 0;
 171
 172                 lport = sin6->sin6_port;
 173                 if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
 174                         /*
 175                          * Treat SO_REUSEADDR as SO_REUSEPORT for multicast;
 176                          * allow compepte duplication of binding if
 177                          * SO_REUSEPORT is set, or if SO_REUSEADDR is set
 178                          * and a multicast address is bound on both
 179                          * new and duplicated sockets.
 180                          */
 181                         if (so->so_options & SO_REUSEADDR)
 182                                 reuseport = SO_REUSEADDR|SO_REUSEPORT;
 183                 } else if (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
 184                         struct ifaddr *ia = NULL;
 185
 186                         sin6->sin6_port = 0;            /* yech... */
 187                         if (!prison_replace_wildcards(td, (struct sockaddr *)sin6)) {
 188                                 sin6->sin6_addr = kin6addr_any;
 189                                 return (EINVAL);
 190                         }
 191                         if ((ia = ifa_ifwithaddr((struct sockaddr *)sin6)) == NULL)
 192                                 return (EADDRNOTAVAIL);
 193
 194                         /*
 195                          * XXX: bind to an anycast address might accidentally
 196                          * cause sending a packet with anycast source address.
 197                          * We should allow to bind to a deprecated address, since
 198                          * the application dare to use it.
 199                          */
 200                         if (ia &&
 201                             ((struct in6_ifaddr *)ia)->ia6_flags &
 202                             (IN6_IFF_ANYCAST|IN6_IFF_NOTREADY|IN6_IFF_DETACHED))
 203                                 return (EADDRNOTAVAIL);
 204                 }
 205
 206                 inp->in6p_laddr = sin6->sin6_addr;
 207
 208                 if (lport == 0)
 209                         goto auto_select;
 210                 lport_ho = ntohs(lport);
 211
 212                 /* GROSS */
 213                 if (lport_ho < IPV6PORT_RESERVED && cred &&
 214                     priv_check_cred(cred, PRIV_NETINET_RESERVEDPORT, 0)) {
 215                         inp->in6p_laddr = kin6addr_any;
 216                         return (EACCES);
 217                 }
 218
 219                 /*
 220                  * Locate the proper portinfo based on lport
 221                  */
 222                 pcbinfo = inp->inp_pcbinfo;
 223                 portinfo =
 224                     &pcbinfo->portinfo[lport_ho & pcbinfo->portinfo_mask];
 225                 KKASSERT((lport_ho & pcbinfo->portinfo_mask) ==
 226                     portinfo->offset);
 227
 228                 /*
 229                  * This has to be atomic.  If the porthash is shared across
 230                  * multiple protocol threads (aka tcp) then the token must
 231                  * be held.
 232                  */
 233                 GET_PORT_TOKEN(portinfo);
 234
 235                 if (so->so_cred->cr_uid != 0 &&
 236                     !IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
 237                         t = in6_pcblookup_local(portinfo,
 238                             &sin6->sin6_addr, lport, INPLOOKUP_WILDCARD, cred);
 239                         if (t &&
 240                             (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
 241                              !IN6_IS_ADDR_UNSPECIFIED(&t->in6p_laddr) ||
 242                              (t->inp_socket->so_options & SO_REUSEPORT) == 0) &&
 243                             (so->so_cred->cr_uid !=
 244                              t->inp_socket->so_cred->cr_uid)) {
 245                                 inp->in6p_laddr = kin6addr_any;
 246                                 error = EADDRINUSE;
 247                                 goto done;
 248                         }
 249                 }
 250                 if (cred && cred->cr_prison &&
 251                     !prison_replace_wildcards(td, nam)) {
 252                         inp->in6p_laddr = kin6addr_any;
 253                         error = EADDRNOTAVAIL;
 254                         goto done;
 255                 }
 256                 t = in6_pcblookup_local(portinfo, &sin6->sin6_addr, lport,
 257                     wild, cred);
 258                 if (t && (reuseport & t->inp_socket->so_options) == 0) {
 259                         inp->in6p_laddr = kin6addr_any;
 260                         error = EADDRINUSE;
 261                         goto done;
 262                 }
 263
 264                 inp->inp_lport = lport;
 265                 in_pcbinsporthash(portinfo, inp);
 266                 error = 0;
 267 done:
 268                 REL_PORT_TOKEN(portinfo);
 269                 return (error);
 270         } else {
 271 auto_select:
 272                 jsin6.sin6_addr = inp->in6p_laddr;
 273                 jsin6.sin6_family = AF_INET6;
 274                 if (!prison_replace_wildcards(td, (struct sockaddr*)&jsin6)) {
 275                         inp->in6p_laddr = kin6addr_any;
 276                         inp->inp_lport = 0;
 277                         return (EINVAL);
 278                 }
 279
 280                 return in6_pcbsetlport(&inp->in6p_laddr, inp, td);
 281         }
 282 }
 283
 284 /*
 285  *   Transform old in6_pcbconnect() into an inner subroutine for new
 286  *   in6_pcbconnect(): Do some validity-checking on the remote
 287  *   address (in mbuf 'nam') and then determine local host address
 288  *   (i.e., which interface) to use to access that remote host.
 289  *
 290  *   This preserves definition of in6_pcbconnect(), while supporting a
 291  *   slightly different version for T/TCP.  (This is more than
 292  *   a bit of a kludge, but cleaning up the internal interfaces would
 293  *   have forced minor changes in every protocol).
 294  */
 295
 296 int
 297 in6_pcbladdr(struct inpcb *inp, struct sockaddr *nam,
 298              struct in6_addr **plocal_addr6, struct thread *td)
 299 {
 300         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)nam;
 301         struct ifnet *ifp = NULL;
 302         int error = 0;
 303
 304         if (nam->sa_len != sizeof (*sin6))
 305                 return (EINVAL);
 306         if (sin6->sin6_family != AF_INET6)
 307                 return (EAFNOSUPPORT);
 308         if (sin6->sin6_port == 0)
 309                 return (EADDRNOTAVAIL);
 310
 311         /* KAME hack: embed scopeid */
 312         if (in6_embedscope(&sin6->sin6_addr, sin6, inp, &ifp) != 0)
 313                 return EINVAL;
 314
 315         if (in6_ifaddr) {
 316                 /*
 317                  * If the destination address is UNSPECIFIED addr,
 318                  * use the loopback addr, e.g ::1.
 319                  */
 320                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
 321                         sin6->sin6_addr = kin6addr_loopback;
 322         }
 323         {
 324                 /*
 325                  * XXX: in6_selectsrc might replace the bound local address
 326                  * with the address specified by setsockopt(IPV6_PKTINFO).
 327                  * Is it the intended behavior?
 328                  */
 329                 *plocal_addr6 = in6_selectsrc(sin6, inp->in6p_outputopts,
 330                                               inp->in6p_moptions,
 331                                               &inp->in6p_route,
 332                                               &inp->in6p_laddr, &error, td);
 333                 if (*plocal_addr6 == NULL) {
 334                         if (error == 0)
 335                                 error = EADDRNOTAVAIL;
 336                         return (error);
 337                 }
 338                 /*
 339                  * Don't do pcblookup call here; return interface in
 340                  * plocal_addr6
 341                  * and exit to caller, that will do the lookup.
 342                  */
 343         }
 344
 345         if (inp->in6p_route.ro_rt)
 346                 ifp = inp->in6p_route.ro_rt->rt_ifp;
 347
 348         return (0);
 349 }
 350
 351 /*
 352  * Outer subroutine:
 353  * Connect from a socket to a specified address.
 354  * Both address and port must be specified in argument sin.
 355  * If don't have a local address for this socket yet,
 356  * then pick one.
 357  */
 358 int
 359 in6_pcbconnect(struct inpcb *inp, struct sockaddr *nam, struct thread *td)
 360 {
 361         struct in6_addr *addr6;
 362         struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)nam;
 363         int error;
 364
 365         /* Reject v4-mapped address */
 366         if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr))
 367                 return EADDRNOTAVAIL;
 368
 369         /*
 370          * Call inner routine, to assign local interface address.
 371          * in6_pcbladdr() may automatically fill in sin6_scope_id.
 372          */
 373         if ((error = in6_pcbladdr(inp, nam, &addr6, td)) != 0)
 374                 return (error);
 375
 376         if (in6_pcblookup_hash(inp->inp_pcbinfo, &sin6->sin6_addr,
 377                                sin6->sin6_port,
 378                               IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)
 379                               ? addr6 : &inp->in6p_laddr,
 380                               inp->inp_lport, 0, NULL) != NULL) {
 381                 return (EADDRINUSE);
 382         }
 383         if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
 384                 if (inp->inp_lport == 0) {
 385                         error = in6_pcbbind(inp, NULL, td);
 386                         if (error)
 387                                 return (error);
 388                 }
 389                 inp->in6p_laddr = *addr6;
 390         }
 391         inp->in6p_faddr = sin6->sin6_addr;
 392         inp->inp_fport = sin6->sin6_port;
 393         /* update flowinfo - draft-itojun-ipv6-flowlabel-api-00 */
 394         inp->in6p_flowinfo &= ~IPV6_FLOWLABEL_MASK;
 395         if (inp->in6p_flags & IN6P_AUTOFLOWLABEL)
 396                 inp->in6p_flowinfo |=
 397                     (htonl(ip6_flow_seq++) & IPV6_FLOWLABEL_MASK);
 398
 399         in_pcbinsconnhash(inp);
 400         return (0);
 401 }
 402
 403 #if 0
 404 /*
 405  * Return an IPv6 address, which is the most appropriate for given
 406  * destination and user specified options.
 407  * If necessary, this function lookups the routing table and return
 408  * an entry to the caller for later use.
 409  */
 410 struct in6_addr *
 411 in6_selectsrc(struct sockaddr_in6 *dstsock, struct ip6_pktopts *opts,
 412               struct ip6_moptions *mopts, struct route_in6 *ro,
 413               struct in6_addr *laddr, int *errorp, struct thread *td)
 414 {
 415         struct sockaddr_in6 jsin6;
 416         struct ucred *cred = NULL;
 417         struct in6_addr *dst;
 418         struct in6_ifaddr *ia6 = 0;
 419         struct in6_pktinfo *pi = NULL;
 420         int jailed = 0;
 421
 422         if (td && td->td_proc && td->td_proc->p_ucred)
 423                 cred = td->td_proc->p_ucred;
 424         if (cred && cred->cr_prison)
 425                 jailed = 1;
 426         jsin6.sin6_family = AF_INET6;
 427         dst = &dstsock->sin6_addr;
 428         *errorp = 0;
 429
 430         /*
 431          * If the source address is explicitly specified by the caller,
 432          * use it.
 433          */
 434         if (opts && (pi = opts->ip6po_pktinfo) &&
 435             !IN6_IS_ADDR_UNSPECIFIED(&pi->ipi6_addr)) {
 436                 jsin6.sin6_addr = pi->ipi6_addr;
 437                 if (jailed && !jailed_ip(cred->cr_prison,
 438                     (struct sockaddr *)&jsin6)) {
 439                         return(0);
 440                 } else {
 441                         return (&pi->ipi6_addr);
 442                 }
 443         }
 444
 445         /*
 446          * If the source address is not specified but the socket(if any)
 447          * is already bound, use the bound address.
 448          */
 449         if (laddr && !IN6_IS_ADDR_UNSPECIFIED(laddr)) {
 450                 jsin6.sin6_addr = *laddr;
 451                 if (jailed && !jailed_ip(cred->cr_prison,
 452                     (struct sockaddr *)&jsin6)) {
 453                         return(0);
 454                 } else {
 455                         return (laddr);
 456                 }
 457         }
 458
 459         /*
 460          * If the caller doesn't specify the source address but
 461          * the outgoing interface, use an address associated with
 462          * the interface.
 463          */
 464         if (pi && pi->ipi6_ifindex) {
 465                 /* XXX boundary check is assumed to be already done. */
 466                 ia6 = in6_ifawithscope(ifindex2ifnet[pi->ipi6_ifindex],
 467                                        dst, cred);
 468
 469                 if (ia6 && jailed) {
 470                         jsin6.sin6_addr = (&ia6->ia_addr)->sin6_addr;
 471                         if (!jailed_ip(cred->cr_prison,
 472                                 (struct sockaddr *)&jsin6))
 473                                 ia6 = 0;
 474                 }
 475
 476                 if (ia6 == 0) {
 477                         *errorp = EADDRNOTAVAIL;
 478                         return (0);
 479                 }
 480                 return (&satosin6(&ia6->ia_addr)->sin6_addr);
 481         }
 482
 483         /*
 484          * If the destination address is a link-local unicast address or
 485          * a multicast address, and if the outgoing interface is specified
 486          * by the sin6_scope_id filed, use an address associated with the
 487          * interface.
 488          * XXX: We're now trying to define more specific semantics of
 489          *      sin6_scope_id field, so this part will be rewritten in
 490          *      the near future.
 491          */
 492         if ((IN6_IS_ADDR_LINKLOCAL(dst) || IN6_IS_ADDR_MULTICAST(dst)) &&
 493             dstsock->sin6_scope_id) {
 494                 /*
 495                  * I'm not sure if boundary check for scope_id is done
 496                  * somewhere...
 497                  */
 498                 if (dstsock->sin6_scope_id < 0 ||
 499                     if_index < dstsock->sin6_scope_id) {
 500                         *errorp = ENXIO; /* XXX: better error? */
 501                         return (0);
 502                 }
 503                 ia6 = in6_ifawithscope(ifindex2ifnet[dstsock->sin6_scope_id],
 504                                        dst, cred);
 505
 506                 if (ia6 && jailed) {
 507                         jsin6.sin6_addr = (&ia6->ia_addr)->sin6_addr;
 508                         if (!jailed_ip(cred->cr_prison,
 509                                 (struct sockaddr *)&jsin6))
 510                                 ia6 = 0;
 511                 }
 512
 513                 if (ia6 == 0) {
 514                         *errorp = EADDRNOTAVAIL;
 515                         return (0);
 516                 }
 517                 return (&satosin6(&ia6->ia_addr)->sin6_addr);
 518         }
 519
 520         /*
 521          * If the destination address is a multicast address and
 522          * the outgoing interface for the address is specified
 523          * by the caller, use an address associated with the interface.
 524          * There is a sanity check here; if the destination has node-local
 525          * scope, the outgoing interfacde should be a loopback address.
 526          * Even if the outgoing interface is not specified, we also
 527          * choose a loopback interface as the outgoing interface.
 528          */
 529         if (!jailed && IN6_IS_ADDR_MULTICAST(dst)) {
 530                 struct ifnet *ifp = mopts ? mopts->im6o_multicast_ifp : NULL;
 531
 532                 if (ifp == NULL && IN6_IS_ADDR_MC_NODELOCAL(dst)) {
 533                         ifp = &loif[0];
 534                 }
 535
 536                 if (ifp) {
 537                         ia6 = in6_ifawithscope(ifp, dst, cred);
 538                         if (ia6 == 0) {
 539                                 *errorp = EADDRNOTAVAIL;
 540                                 return (0);
 541                         }
 542                         return (&ia6->ia_addr.sin6_addr);
 543                 }
 544         }
 545
 546         /*
 547          * If the next hop address for the packet is specified
 548          * by caller, use an address associated with the route
 549          * to the next hop.
 550          */
 551         {
 552                 struct sockaddr_in6 *sin6_next;
 553                 struct rtentry *rt;
 554
 555                 if (opts && opts->ip6po_nexthop) {
 556                         sin6_next = satosin6(opts->ip6po_nexthop);
 557                         rt = nd6_lookup(&sin6_next->sin6_addr, 1, NULL);
 558                         if (rt) {
 559                                 ia6 = in6_ifawithscope(rt->rt_ifp, dst, cred);
 560                                 if (ia6 == 0)
 561                                         ia6 = ifatoia6(rt->rt_ifa);
 562                         }
 563                         if (ia6 && jailed) {
 564                                 jsin6.sin6_addr = (&ia6->ia_addr)->sin6_addr;
 565                                 if (!jailed_ip(cred->cr_prison,
 566                                         (struct sockaddr *)&jsin6))
 567                                         ia6 = 0;
 568                         }
 569
 570                         if (ia6 == 0) {
 571                                 *errorp = EADDRNOTAVAIL;
 572                                 return (0);
 573                         }
 574                         return (&satosin6(&ia6->ia_addr)->sin6_addr);
 575                 }
 576         }
 577
 578         /*
 579          * If route is known or can be allocated now,
 580          * our src addr is taken from the i/f, else punt.
 581          */
 582         if (ro) {
 583                 if (ro->ro_rt &&
 584                     !IN6_ARE_ADDR_EQUAL(&satosin6(&ro->ro_dst)->sin6_addr, dst)) {
 585                         RTFREE(ro->ro_rt);
 586                         ro->ro_rt = NULL;
 587                 }
 588                 if (ro->ro_rt == NULL || ro->ro_rt->rt_ifp == NULL) {
 589                         struct sockaddr_in6 *dst6;
 590
 591                         /* No route yet, so try to acquire one */
 592                         bzero(&ro->ro_dst, sizeof(struct sockaddr_in6));
 593                         dst6 = &ro->ro_dst;
 594                         dst6->sin6_family = AF_INET6;
 595                         dst6->sin6_len = sizeof(struct sockaddr_in6);
 596                         dst6->sin6_addr = *dst;
 597                         if (!jailed && IN6_IS_ADDR_MULTICAST(dst)) {
 598                                 ro->ro_rt =
 599                                   rtpurelookup((struct sockaddr *)&ro->ro_dst);
 600                         } else {
 601                                 rtalloc((struct route *)ro);
 602                         }
 603                 }
 604
 605                 /*
 606                  * in_pcbconnect() checks out IFF_LOOPBACK to skip using
 607                  * the address. But we don't know why it does so.
 608                  * It is necessary to ensure the scope even for lo0
 609                  * so doesn't check out IFF_LOOPBACK.
 610                  */
 611
 612                 if (ro->ro_rt) {
 613                         ia6 = in6_ifawithscope(ro->ro_rt->rt_ifa->ifa_ifp, dst, cred);
 614                         if (ia6 && jailed) {
 615                                 jsin6.sin6_addr = (&ia6->ia_addr)->sin6_addr;
 616                                 if (!jailed_ip(cred->cr_prison,
 617                                         (struct sockaddr *)&jsin6))
 618                                         ia6 = 0;
 619                         }
 620
 621                         if (ia6 == 0) /* xxx scope error ?*/
 622                                 ia6 = ifatoia6(ro->ro_rt->rt_ifa);
 623
 624                         if (ia6 && jailed) {
 625                                 jsin6.sin6_addr = (&ia6->ia_addr)->sin6_addr;
 626                                 if (!jailed_ip(cred->cr_prison,
 627                                         (struct sockaddr *)&jsin6))
 628                                         ia6 = 0;
 629                         }
 630                 }
 631                 if (ia6 == 0) {
 632                         *errorp = EHOSTUNREACH; /* no route */
 633                         return (0);
 634                 }
 635                 return (&satosin6(&ia6->ia_addr)->sin6_addr);
 636         }
 637
 638         *errorp = EADDRNOTAVAIL;
 639         return (0);
 640 }
 641
 642 /*
 643  * Default hop limit selection. The precedence is as follows:
 644  * 1. Hoplimit valued specified via ioctl.
 645  * 2. (If the outgoing interface is detected) the current
 646  *     hop limit of the interface specified by router advertisement.
 647  * 3. The system default hoplimit.
 648 */
 649 int
 650 in6_selecthlim(struct in6pcb *in6p, struct ifnet *ifp)
 651 {
 652         if (in6p && in6p->in6p_hops >= 0)
 653                 return (in6p->in6p_hops);
 654         else if (ifp)
 655                 return (ND_IFINFO(ifp)->chlim);
 656         else
 657                 return (ip6_defhlim);
 658 }
 659 #endif
 660
 661 void
 662 in6_pcbdisconnect(struct inpcb *inp)
 663 {
 664         bzero((caddr_t)&inp->in6p_faddr, sizeof(inp->in6p_faddr));
 665         inp->inp_fport = 0;
 666         /* clear flowinfo - draft-itojun-ipv6-flowlabel-api-00 */
 667         inp->in6p_flowinfo &= ~IPV6_FLOWLABEL_MASK;
 668         in_pcbremconnhash(inp);
 669         if (inp->inp_socket->so_state & SS_NOFDREF)
 670                 in6_pcbdetach(inp);
 671 }
 672
 673 void
 674 in6_pcbdetach(struct inpcb *inp)
 675 {
 676         struct socket *so = inp->inp_socket;
 677         struct inpcbinfo *ipi = inp->inp_pcbinfo;
 678
 679 #ifdef IPSEC
 680         if (inp->in6p_sp != NULL)
 681                 ipsec6_delete_pcbpolicy(inp);
 682 #endif /* IPSEC */
 683         inp->inp_gencnt = ++ipi->ipi_gencnt;
 684         in_pcbremlists(inp);
 685         so->so_pcb = NULL;
 686         KKASSERT((so->so_state & SS_ASSERTINPROG) == 0);
 687         sofree(so);             /* remove pcb ref */
 688
 689         if (inp->in6p_options)
 690                 m_freem(inp->in6p_options);
 691         ip6_freepcbopts(inp->in6p_outputopts);
 692         ip6_freemoptions(inp->in6p_moptions);
 693         if (inp->in6p_route.ro_rt)
 694                 rtfree(inp->in6p_route.ro_rt);
 695         /* Check and free IPv4 related resources in case of mapped addr */
 696         if (inp->inp_options)
 697                 m_free(inp->inp_options);
 698         ip_freemoptions(inp->inp_moptions);
 699
 700         kfree(inp, M_PCB);
 701 }
 702
 703 /*
 704  * The calling convention of in6_setsockaddr() and in6_setpeeraddr() was
 705  * modified to match the pru_sockaddr() and pru_peeraddr() entry points
 706  * in struct pr_usrreqs, so that protocols can just reference then directly
 707  * without the need for a wrapper function.  The socket must have a valid
 708  * (i.e., non-nil) PCB, but it should be impossible to get an invalid one
 709  * except through a kernel programming error, so it is acceptable to panic
 710  * (or in this case trap) if the PCB is invalid.  (Actually, we don't trap
 711  * because there actually /is/ a programming error somewhere... XXX)
 712  */
 713 void
 714 in6_setsockaddr_dispatch(netmsg_t msg)
 715 {
 716         int error;
 717
 718         error = in6_setsockaddr(msg->sockaddr.base.nm_so, msg->sockaddr.nm_nam);
 719         lwkt_replymsg(&msg->sockaddr.base.lmsg, error);
 720 }
 721
 722 int
 723 in6_setsockaddr(struct socket *so, struct sockaddr **nam)
 724 {
 725         struct inpcb *inp;
 726         struct sockaddr_in6 *sin6;
 727
 728         /*
 729          * Do the malloc first in case it blocks.
 730          */
 731         sin6 = kmalloc(sizeof *sin6, M_SONAME, M_WAITOK | M_ZERO);
 732         sin6->sin6_family = AF_INET6;
 733         sin6->sin6_len = sizeof(*sin6);
 734
 735         crit_enter();
 736         inp = so->so_pcb;
 737         if (!inp) {
 738                 crit_exit();
 739                 kfree(sin6, M_SONAME);
 740                 return EINVAL;
 741         }
 742         sin6->sin6_port = inp->inp_lport;
 743         sin6->sin6_addr = inp->in6p_laddr;
 744         crit_exit();
 745         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr))
 746                 sin6->sin6_scope_id = ntohs(sin6->sin6_addr.s6_addr16[1]);
 747         else
 748                 sin6->sin6_scope_id = 0;        /*XXX*/
 749         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr))
 750                 sin6->sin6_addr.s6_addr16[1] = 0;
 751
 752         *nam = (struct sockaddr *)sin6;
 753         return 0;
 754 }
 755
 756 void
 757 in6_setpeeraddr_dispatch(netmsg_t msg)
 758 {
 759         int error;
 760
 761         error = in6_setpeeraddr(msg->peeraddr.base.nm_so, msg->peeraddr.nm_nam);
 762         lwkt_replymsg(&msg->peeraddr.base.lmsg, error);
 763 }
 764
 765 int
 766 in6_setpeeraddr(struct socket *so, struct sockaddr **nam)
 767 {
 768         struct inpcb *inp;
 769         struct sockaddr_in6 *sin6;
 770
 771         /*
 772          * Do the malloc first in case it blocks.
 773          */
 774         sin6 = kmalloc(sizeof(*sin6), M_SONAME, M_WAITOK | M_ZERO);
 775         sin6->sin6_family = AF_INET6;
 776         sin6->sin6_len = sizeof(struct sockaddr_in6);
 777
 778         crit_enter();
 779         inp = so->so_pcb;
 780         if (!inp) {
 781                 crit_exit();
 782                 kfree(sin6, M_SONAME);
 783                 return EINVAL;
 784         }
 785         sin6->sin6_port = inp->inp_fport;
 786         sin6->sin6_addr = inp->in6p_faddr;
 787         crit_exit();
 788         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr))
 789                 sin6->sin6_scope_id = ntohs(sin6->sin6_addr.s6_addr16[1]);
 790         else
 791                 sin6->sin6_scope_id = 0;        /*XXX*/
 792         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr))
 793                 sin6->sin6_addr.s6_addr16[1] = 0;
 794
 795         *nam = (struct sockaddr *)sin6;
 796         return 0;
 797 }
 798
 799 /*
 800  * Pass some notification to all connections of a protocol
 801  * associated with address dst.  The local address and/or port numbers
 802  * may be specified to limit the search.  The "usual action" will be
 803  * taken, depending on the ctlinput cmd.  The caller must filter any
 804  * cmds that are uninteresting (e.g., no error in the map).
 805  * Call the protocol specific routine (if any) to report
 806  * any errors for each matching socket.
 807  */
 808 void
 809 in6_pcbnotify(struct inpcbinfo *pcbinfo, struct sockaddr *dst, in_port_t fport,
 810     const struct sockaddr *src, in_port_t lport, int cmd, int arg,
 811     inp_notify_t notify)
 812 {
 813         struct inpcb *inp, *marker;
 814         struct sockaddr_in6 sa6_src, *sa6_dst;
 815         u_int32_t flowinfo;
 816
 817         if ((unsigned)cmd >= PRC_NCMDS || dst->sa_family != AF_INET6)
 818                 return;
 819
 820         sa6_dst = (struct sockaddr_in6 *)dst;
 821         if (IN6_IS_ADDR_UNSPECIFIED(&sa6_dst->sin6_addr))
 822                 return;
 823
 824         /*
 825          * note that src can be NULL when we get notify by local fragmentation.
 826          */
 827         sa6_src = (src == NULL) ? sa6_any : *(const struct sockaddr_in6 *)src;
 828         flowinfo = sa6_src.sin6_flowinfo;
 829
 830         /*
 831          * Redirects go to all references to the destination,
 832          * and use in6_rtchange to invalidate the route cache.
 833          * Dead host indications: also use in6_rtchange to invalidate
 834          * the cache, and deliver the error to all the sockets.
 835          * Otherwise, if we have knowledge of the local port and address,
 836          * deliver only to that socket.
 837          */
 838         if (PRC_IS_REDIRECT(cmd) || cmd == PRC_HOSTDEAD) {
 839                 fport = 0;
 840                 lport = 0;
 841                 bzero((caddr_t)&sa6_src.sin6_addr, sizeof(sa6_src.sin6_addr));
 842
 843                 if (cmd != PRC_HOSTDEAD)
 844                         notify = in6_rtchange;
 845         }
 846         if (cmd != PRC_MSGSIZE)
 847                 arg = inet6ctlerrmap[cmd];
 848
 849         marker = in_pcbmarker(mycpuid);
 850
 851         GET_PCBINFO_TOKEN(pcbinfo);
 852
 853         LIST_INSERT_HEAD(&pcbinfo->pcblisthead, marker, inp_list);
 854         while ((inp = LIST_NEXT(marker, inp_list)) != NULL) {
 855                 LIST_REMOVE(marker, inp_list);
 856                 LIST_INSERT_AFTER(inp, marker, inp_list);
 857
 858                 if (inp->inp_flags & INP_PLACEMARKER)
 859                         continue;
 860
 861                 if (!INP_ISIPV6(inp))
 862                         continue;
 863                 /*
 864                  * If the error designates a new path MTU for a destination
 865                  * and the application (associated with this socket) wanted to
 866                  * know the value, notify. Note that we notify for all
 867                  * disconnected sockets if the corresponding application
 868                  * wanted. This is because some UDP applications keep sending
 869                  * sockets disconnected.
 870                  * XXX: should we avoid to notify the value to TCP sockets?
 871                  */
 872                 if (cmd == PRC_MSGSIZE && (inp->inp_flags & IN6P_MTU) != 0 &&
 873                     (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) ||
 874                      IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr, &sa6_dst->sin6_addr))) {
 875                         ip6_notify_pmtu(inp, (struct sockaddr_in6 *)dst, &arg);
 876                 }
 877
 878                 /*
 879                  * Detect if we should notify the error. If no source and
 880                  * destination ports are specifed, but non-zero flowinfo and
 881                  * local address match, notify the error. This is the case
 882                  * when the error is delivered with an encrypted buffer
 883                  * by ESP. Otherwise, just compare addresses and ports
 884                  * as usual.
 885                  */
 886                 if (lport == 0 && fport == 0 && flowinfo &&
 887                     inp->inp_socket != NULL &&
 888                     flowinfo == (inp->in6p_flowinfo & IPV6_FLOWLABEL_MASK) &&
 889                     IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, &sa6_src.sin6_addr))
 890                         goto do_notify;
 891                 else if (!IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr,
 892                                              &sa6_dst->sin6_addr) ||
 893                          inp->inp_socket == 0 ||
 894                          (lport && inp->inp_lport != lport) ||
 895                          (!IN6_IS_ADDR_UNSPECIFIED(&sa6_src.sin6_addr) &&
 896                           !IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr,
 897                                               &sa6_src.sin6_addr)) ||
 898                          (fport && inp->inp_fport != fport))
 899                         continue;
 900
 901 do_notify:
 902                 if (notify)
 903                         (*notify)(inp, arg);
 904         }
 905         LIST_REMOVE(marker, inp_list);
 906
 907         REL_PCBINFO_TOKEN(pcbinfo);
 908 }
 909
 910 /*
 911  * Lookup a PCB based on the local address and port.
 912  */
 913 struct inpcb *
 914 in6_pcblookup_local(struct inpcbportinfo *portinfo,
 915     const struct in6_addr *laddr, u_int lport_arg, int wild_okay,
 916     struct ucred *cred)
 917 {
 918         struct inpcb *inp;
 919         int matchwild = 3, wildcard;
 920         u_short lport = lport_arg;
 921         struct inpcbporthead *porthash;
 922         struct inpcbport *phd;
 923         struct inpcb *match = NULL;
 924
 925         /*
 926          * If the porthashbase is shared across several cpus, it must
 927          * have been locked.
 928          */
 929         ASSERT_PORT_TOKEN_HELD(portinfo);
 930
 931         /*
 932          * Best fit PCB lookup.
 933          *
 934          * First see if this local port is in use by looking on the
 935          * port hash list.
 936          */
 937         porthash = &portinfo->porthashbase[
 938                                 INP_PCBPORTHASH(lport, portinfo->porthashmask)];
 939         LIST_FOREACH(phd, porthash, phd_hash) {
 940                 if (phd->phd_port == lport)
 941                         break;
 942         }
 943
 944         if (phd != NULL) {
 945                 /*
 946                  * Port is in use by one or more PCBs. Look for best
 947                  * fit.
 948                  */
 949                 LIST_FOREACH(inp, &phd->phd_pcblist, inp_portlist) {
 950                         wildcard = 0;
 951                         if (!INP_ISIPV6(inp))
 952                                 continue;
 953                         if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr))
 954                                 wildcard++;
 955                         if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
 956                                 if (IN6_IS_ADDR_UNSPECIFIED(laddr))
 957                                         wildcard++;
 958                                 else if (!IN6_ARE_ADDR_EQUAL(
 959                                         &inp->in6p_laddr, laddr))
 960                                         continue;
 961                         } else {
 962                                 if (!IN6_IS_ADDR_UNSPECIFIED(laddr))
 963                                         wildcard++;
 964                         }
 965                         if (wildcard && !wild_okay)
 966                                 continue;
 967                         if (wildcard < matchwild &&
 968                             (cred == NULL ||
 969                              cred->cr_prison ==
 970                                         inp->inp_socket->so_cred->cr_prison)) {
 971                                 match = inp;
 972                                 matchwild = wildcard;
 973                                 if (wildcard == 0)
 974                                         break;
 975                                 else
 976                                         matchwild = wildcard;
 977                         }
 978                 }
 979         }
 980         return (match);
 981 }
 982
 983 void
 984 in6_pcbpurgeif0(struct inpcbinfo *pcbinfo, struct ifnet *ifp)
 985 {
 986         struct in6pcb *in6p, *marker;
 987         struct ip6_moptions *im6o;
 988         struct in6_multi_mship *imm, *nimm;
 989
 990         /*
 991          * We only need to make sure that we are in netisr0, where all
 992          * multicast operation happen.  We could check inpcbinfo which
 993          * does not belong to netisr0 by holding the inpcbinfo's token.
 994          * In this case, the pcbinfo must be able to be shared, i.e.
 995          * pcbinfo->infotoken is not NULL.
 996          */
 997         KASSERT(&curthread->td_msgport == netisr_cpuport(0),
 998             ("not in netisr0"));
 999         KASSERT(pcbinfo->cpu == 0 || pcbinfo->infotoken != NULL,
1000             ("pcbinfo could not be shared"));
1001
1002         /*
1003          * Get a marker for the current netisr (netisr0).
1004          *
1005          * It is possible that the multicast address deletion blocks,
1006          * which could cause temporary token releasing.  So we use
1007          * inpcb marker here to get a coherent view of the inpcb list.
1008          *
1009          * While, on the other hand, moptions are only added and deleted
1010          * in netisr0, so we would not see staled moption or miss moption
1011          * even if the token was released due to the blocking multicast
1012          * address deletion.
1013          */
1014         marker = in_pcbmarker(mycpuid);
1015
1016         GET_PCBINFO_TOKEN(pcbinfo);
1017
1018         LIST_INSERT_HEAD(&pcbinfo->pcblisthead, marker, inp_list);
1019         while ((in6p = LIST_NEXT(marker, inp_list)) != NULL) {
1020                 LIST_REMOVE(marker, inp_list);
1021                 LIST_INSERT_AFTER(in6p, marker, inp_list);
1022
1023                 if (in6p->in6p_flags & INP_PLACEMARKER)
1024                         continue;
1025                 im6o = in6p->in6p_moptions;
1026                 if (INP_ISIPV6(in6p) && im6o) {
1027                         /*
1028                          * Unselect the outgoing interface if it is being
1029                          * detached.
1030                          */
1031                         if (im6o->im6o_multicast_ifp == ifp)
1032                                 im6o->im6o_multicast_ifp = NULL;
1033
1034                         /*
1035                          * Drop multicast group membership if we joined
1036                          * through the interface being detached.
1037                          * XXX controversial - is it really legal for kernel
1038                          * to force this?
1039                          */
1040                         for (imm = im6o->im6o_memberships.lh_first;
1041                              imm != NULL; imm = nimm) {
1042                                 nimm = imm->i6mm_chain.le_next;
1043                                 if (imm->i6mm_maddr->in6m_ifp == ifp) {
1044                                         LIST_REMOVE(imm, i6mm_chain);
1045                                         in6_delmulti(imm->i6mm_maddr);
1046                                         kfree(imm, M_IPMADDR);
1047                                 }
1048                         }
1049                 }
1050         }
1051         LIST_REMOVE(marker, inp_list);
1052
1053         REL_PCBINFO_TOKEN(pcbinfo);
1054 }
1055
1056 /*
1057  * Check for alternatives when higher level complains
1058  * about service problems.  For now, invalidate cached
1059  * routing information.  If the route was created dynamically
1060  * (by a redirect), time to try a default gateway again.
1061  */
1062 void
1063 in6_losing(struct inpcb *in6p)
1064 {
1065         struct rtentry *rt;
1066         struct rt_addrinfo info;
1067
1068         if ((rt = in6p->in6p_route.ro_rt) != NULL) {
1069                 bzero((caddr_t)&info, sizeof(info));
1070                 info.rti_flags = rt->rt_flags;
1071                 info.rti_info[RTAX_DST] = rt_key(rt);
1072                 info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
1073                 info.rti_info[RTAX_NETMASK] = rt_mask(rt);
1074                 rt_missmsg(RTM_LOSING, &info, rt->rt_flags, 0);
1075                 if (rt->rt_flags & RTF_DYNAMIC) {
1076                         rtrequest(RTM_DELETE, rt_key(rt), rt->rt_gateway,
1077                             rt_mask(rt), rt->rt_flags, NULL);
1078                 }
1079                 in6p->in6p_route.ro_rt = NULL;
1080                 rtfree(rt);
1081                 /*
1082                  * A new route can be allocated
1083                  * the next time output is attempted.
1084                  */
1085         }
1086 }
1087
1088 /*
1089  * After a routing change, flush old routing
1090  * and allocate a (hopefully) better one.
1091  */
1092 void
1093 in6_rtchange(struct inpcb *inp, int error)
1094 {
1095         if (inp->in6p_route.ro_rt) {
1096                 rtfree(inp->in6p_route.ro_rt);
1097                 inp->in6p_route.ro_rt = 0;
1098                 /*
1099                  * A new route can be allocated the next time
1100                  * output is attempted.
1101                  */
1102         }
1103 }
1104
1105 /*
1106  * Lookup PCB in hash list.
1107  */
1108 struct inpcb *
1109 in6_pcblookup_hash(struct inpcbinfo *pcbinfo, struct in6_addr *faddr,
1110                    u_int fport_arg, struct in6_addr *laddr, u_int lport_arg,
1111                    int wildcard, struct ifnet *ifp)
1112 {
1113         struct inpcbhead *head;
1114         struct inpcb *inp;
1115         struct inpcb *jinp = NULL;
1116         u_short fport = fport_arg, lport = lport_arg;
1117         int faith;
1118
1119         if (faithprefix_p != NULL)
1120                 faith = (*faithprefix_p)(laddr);
1121         else
1122                 faith = 0;
1123
1124         /*
1125          * First look for an exact match.
1126          */
1127         head = &pcbinfo->hashbase[INP_PCBCONNHASH(faddr->s6_addr32[3] /* XXX */,
1128                                               fport,
1129                                               laddr->s6_addr32[3], /* XXX JH */
1130                                               lport,
1131                                               pcbinfo->hashmask)];
1132         LIST_FOREACH(inp, head, inp_hash) {
1133                 if (!INP_ISIPV6(inp))
1134                         continue;
1135                 if (IN6_ARE_ADDR_EQUAL(&inp->in6p_faddr, faddr) &&
1136                     IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr, laddr) &&
1137                     inp->inp_fport == fport &&
1138                     inp->inp_lport == lport) {
1139                         /*
1140                          * Found.
1141                          */
1142                         if (inp->inp_socket == NULL ||
1143                         inp->inp_socket->so_cred->cr_prison == NULL) {
1144                                 return (inp);
1145                         } else {
1146                                 if  (jinp == NULL)
1147                                         jinp = inp;
1148                         }
1149                 }
1150         }
1151         if (jinp != NULL)
1152                 return(jinp);
1153
1154         if (wildcard) {
1155                 struct inpcontainerhead *chead;
1156                 struct inpcontainer *ic;
1157                 struct inpcb *local_wild = NULL;
1158                 struct inpcb *jinp_wild = NULL;
1159                 struct sockaddr_in6 jsin6;
1160                 struct ucred *cred;
1161
1162                 /*
1163                  * Order of socket selection:
1164                  * 1. non-jailed, non-wild.
1165                  * 2. non-jailed, wild.
1166                  * 3. jailed, non-wild.
1167                  * 4. jailed, wild.
1168                  */
1169                 jsin6.sin6_family = AF_INET6;
1170                 chead = &pcbinfo->wildcardhashbase[INP_PCBWILDCARDHASH(lport,
1171                     pcbinfo->wildcardhashmask)];
1172
1173                 GET_PCBINFO_TOKEN(pcbinfo);
1174                 LIST_FOREACH(ic, chead, ic_list) {
1175                         inp = ic->ic_inp;
1176                         if (inp->inp_flags & INP_PLACEMARKER)
1177                                 continue;
1178
1179                         if (!INP_ISIPV6(inp))
1180                                 continue;
1181                         if (inp->inp_socket != NULL)
1182                                 cred = inp->inp_socket->so_cred;
1183                         else
1184                                 cred = NULL;
1185
1186                         if (cred != NULL && jailed(cred)) {
1187                                 if (jinp != NULL) {
1188                                         continue;
1189                                 } else {
1190                                         jsin6.sin6_addr = *laddr;
1191                                         if (!jailed_ip(cred->cr_prison,
1192                                             (struct sockaddr *)&jsin6))
1193                                                 continue;
1194                                 }
1195                         }
1196                         if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr) &&
1197                             inp->inp_lport == lport) {
1198                                 if (faith && (inp->inp_flags & INP_FAITH) == 0)
1199                                         continue;
1200                                 if (IN6_ARE_ADDR_EQUAL(&inp->in6p_laddr,
1201                                                        laddr)) {
1202                                         if (cred != NULL && jailed(cred)) {
1203                                                 jinp = inp;
1204                                         } else {
1205                                                 REL_PCBINFO_TOKEN(pcbinfo);
1206                                                 return (inp);
1207                                         }
1208                                 } else if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) {
1209                                         if (cred != NULL && jailed(cred))
1210                                                 jinp_wild = inp;
1211                                         else
1212                                                 local_wild = inp;
1213                                 }
1214                         }
1215                 }
1216                 REL_PCBINFO_TOKEN(pcbinfo);
1217
1218                 if (local_wild != NULL)
1219                         return (local_wild);
1220                 if (jinp != NULL)
1221                         return (jinp);
1222                 return (jinp_wild);
1223         }
1224
1225         /*
1226          * Not found.
1227          */
1228         return (NULL);
1229 }
1230
1231 void
1232 init_sin6(struct sockaddr_in6 *sin6, struct mbuf *m)
1233 {
1234         struct ip6_hdr *ip;
1235
1236         ip = mtod(m, struct ip6_hdr *);
1237         bzero(sin6, sizeof(*sin6));
1238         sin6->sin6_len = sizeof(*sin6);
1239         sin6->sin6_family = AF_INET6;
1240         sin6->sin6_addr = ip->ip6_src;
1241         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr))
1242                 sin6->sin6_addr.s6_addr16[1] = 0;
1243         sin6->sin6_scope_id =
1244                 (m->m_pkthdr.rcvif && IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr))
1245                 ? m->m_pkthdr.rcvif->if_index : 0;
1246
1247         return;
1248 }
1249
1250 void
1251 in6_savefaddr(struct socket *so, const struct sockaddr *faddr)
1252 {
1253         struct sockaddr_in6 *sin6;
1254
1255         KASSERT(faddr->sa_family == AF_INET6,
1256             ("not AF_INET6 faddr %d", faddr->sa_family));
1257
1258         sin6 = kmalloc(sizeof(*sin6), M_SONAME, M_WAITOK | M_ZERO);
1259         sin6->sin6_family = AF_INET6;
1260         sin6->sin6_len = sizeof(*sin6);
1261
1262         sin6->sin6_port = ((const struct sockaddr_in6 *)faddr)->sin6_port;
1263         sin6->sin6_addr = ((const struct sockaddr_in6 *)faddr)->sin6_addr;
1264
1265         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr))
1266                 sin6->sin6_scope_id = ntohs(sin6->sin6_addr.s6_addr16[1]);
1267         else
1268                 sin6->sin6_scope_id = 0;        /*XXX*/
1269         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr))
1270                 sin6->sin6_addr.s6_addr16[1] = 0;
1271
1272         so->so_faddr = (struct sockaddr *)sin6;
1273 }