xref: /openbsd-src/sys/netinet6/in6_pcb.c (revision a28daedfc357b214be5c701aa8ba8adb29a7f1c2)
1 /*	$OpenBSD: in6_pcb.c,v 1.48 2008/11/23 13:30:59 claudio Exp $	*/
2 
3 /*
4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5  * All rights reserved.
6  *
7  * Redistribution and use in source and binary forms, with or without
8  * modification, are permitted provided that the following conditions
9  * are met:
10  * 1. Redistributions of source code must retain the above copyright
11  *    notice, this list of conditions and the following disclaimer.
12  * 2. Redistributions in binary form must reproduce the above copyright
13  *    notice, this list of conditions and the following disclaimer in the
14  *    documentation and/or other materials provided with the distribution.
15  * 3. Neither the name of the project nor the names of its contributors
16  *    may be used to endorse or promote products derived from this software
17  *    without specific prior written permission.
18  *
19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29  * SUCH DAMAGE.
30  */
31 
32 /*
33  *	@(#)COPYRIGHT	1.1 (NRL) 17 January 1995
34  *
35  * NRL grants permission for redistribution and use in source and binary
36  * forms, with or without modification, of the software and documentation
37  * created at NRL provided that the following conditions are met:
38  *
39  * 1. Redistributions of source code must retain the above copyright
40  *    notice, this list of conditions and the following disclaimer.
41  * 2. Redistributions in binary form must reproduce the above copyright
42  *    notice, this list of conditions and the following disclaimer in the
43  *    documentation and/or other materials provided with the distribution.
44  * 3. All advertising materials mentioning features or use of this software
45  *    must display the following acknowledgements:
46  * 	This product includes software developed by the University of
47  * 	California, Berkeley and its contributors.
48  * 	This product includes software developed at the Information
49  * 	Technology Division, US Naval Research Laboratory.
50  * 4. Neither the name of the NRL nor the names of its contributors
51  *    may be used to endorse or promote products derived from this software
52  *    without specific prior written permission.
53  *
54  * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
55  * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
56  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
57  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL NRL OR
58  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
59  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
60  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
61  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
62  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
63  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
64  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
65  *
66  * The views and conclusions contained in the software and documentation
67  * are those of the authors and should not be interpreted as representing
68  * official policies, either expressed or implied, of the US Naval
69  * Research Laboratory (NRL).
70  */
71 
72 /*
73  * Copyright (c) 1982, 1986, 1990, 1993, 1995
74  *	Regents of the University of California.  All rights reserved.
75  *
76  * Redistribution and use in source and binary forms, with or without
77  * modification, are permitted provided that the following conditions
78  * are met:
79  * 1. Redistributions of source code must retain the above copyright
80  *    notice, this list of conditions and the following disclaimer.
81  * 2. Redistributions in binary form must reproduce the above copyright
82  *    notice, this list of conditions and the following disclaimer in the
83  *    documentation and/or other materials provided with the distribution.
84  * 3. Neither the name of the University nor the names of its contributors
85  *    may be used to endorse or promote products derived from this software
86  *    without specific prior written permission.
87  *
88  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
89  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
90  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
91  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
92  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
93  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
94  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
95  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
96  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
97  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
98  * SUCH DAMAGE.
99  *
100  */
101 
102 #include <sys/param.h>
103 #include <sys/systm.h>
104 #include <sys/malloc.h>
105 #include <sys/mbuf.h>
106 #include <sys/domain.h>
107 #include <sys/protosw.h>
108 #include <sys/socket.h>
109 #include <sys/socketvar.h>
110 #include <sys/errno.h>
111 #include <sys/time.h>
112 #include <sys/proc.h>
113 
114 #include <net/if.h>
115 #include <net/route.h>
116 
117 #include <netinet/in.h>
118 #include <netinet/in_systm.h>
119 #include <netinet/ip.h>
120 #include <netinet/in_pcb.h>
121 
122 #include <netinet6/in6_var.h>
123 #include <netinet/ip6.h>
124 #include <netinet6/ip6_var.h>
125 
126 /*
127  * External globals
128  */
129 
130 #include <dev/rndvar.h>
131 
132 extern struct in6_ifaddr *in6_ifaddr;
133 
134 /*
135  * Globals
136  */
137 
138 struct in6_addr zeroin6_addr;
139 
140 extern int ipport_firstauto;
141 extern int ipport_lastauto;
142 extern int ipport_hifirstauto;
143 extern int ipport_hilastauto;
144 
145 /*
146  * Keep separate inet6ctlerrmap, because I may remap some of these.
147  * I also put it here, because, quite frankly, it belongs here, not in
148  * ip{v6,}_input().
149  */
150 #if 0
151 u_char inet6ctlerrmap[PRC_NCMDS] = {
152 	0,		0,		0,		0,
153 	0,		EMSGSIZE,	EHOSTDOWN,	EHOSTUNREACH,
154 	EHOSTUNREACH,	EHOSTUNREACH,	ECONNREFUSED,	ECONNREFUSED,
155 	EMSGSIZE,	EHOSTUNREACH,	0,		0,
156 	0,		0,		0,		0,
157 	ENOPROTOOPT
158 };
159 #endif
160 
161 /*
162  * Bind an address (or at least a port) to an PF_INET6 socket.
163  */
164 int
165 in6_pcbbind(struct inpcb *inp, struct mbuf *nam, struct proc *p)
166 {
167 	struct socket *so = inp->inp_socket;
168 
169 	struct inpcbtable *head = inp->inp_table;
170 	struct sockaddr_in6 *sin6;
171 	u_short lport = 0;
172 	int wild = INPLOOKUP_IPV6, reuseport = (so->so_options & SO_REUSEPORT);
173 	int error;
174 
175 	/*
176 	 * REMINDER:  Once up to speed, flow label processing should go here,
177 	 * too.  (Same with in6_pcbconnect.)
178 	 */
179 	if (in6_ifaddr == 0)
180 		return EADDRNOTAVAIL;
181 
182 	if (inp->inp_lport != 0 || !IN6_IS_ADDR_UNSPECIFIED(&inp->inp_laddr6))
183 		return EINVAL;	/* If already bound, EINVAL! */
184 
185 	if ((so->so_options & (SO_REUSEADDR | SO_REUSEPORT)) == 0 &&
186 	    ((so->so_proto->pr_flags & PR_CONNREQUIRED) == 0 ||
187 	     (so->so_options & SO_ACCEPTCONN) == 0))
188 		wild |= INPLOOKUP_WILDCARD;
189 
190 	/*
191 	 * If I did get a sockaddr passed in...
192 	 */
193 	if (nam) {
194 		sin6 = mtod(nam, struct sockaddr_in6 *);
195 		if (nam->m_len != sizeof (*sin6))
196 			return EINVAL;
197 
198 		/*
199 		 * Unlike v4, I have no qualms about EAFNOSUPPORT if the
200 		 * wretched family is not filled in!
201 		 */
202 		if (sin6->sin6_family != AF_INET6)
203 			return EAFNOSUPPORT;
204 
205 		/* KAME hack: embed scopeid */
206 		if (in6_embedscope(&sin6->sin6_addr, sin6, inp, NULL) != 0)
207 			return EINVAL;
208 		/* this must be cleared for ifa_ifwithaddr() */
209 		sin6->sin6_scope_id = 0;
210 
211 		lport = sin6->sin6_port;
212 
213 		/* reject IPv4 mapped address, we have no support for it */
214 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr))
215 			return EADDRNOTAVAIL;
216 
217 		if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
218 			/*
219 			 * Treat SO_REUSEADDR as SO_REUSEPORT for multicast;
220 			 * allow complete duplication of binding if
221 			 * SO_REUSEPORT is set, or if SO_REUSEADDR is set
222 			 * and a multicast address is bound on both
223 			 * new and duplicated sockets.
224 			 */
225 			if (so->so_options & SO_REUSEADDR)
226 				reuseport = SO_REUSEADDR | SO_REUSEPORT;
227 		} else if (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
228 			struct ifaddr *ia = NULL;
229 
230 			sin6->sin6_port = 0;  /*
231 					       * Yechhhh, because of upcoming
232 					       * call to ifa_ifwithaddr(), which
233 					       * does bcmp's over the PORTS as
234 					       * well.  (What about flow?)
235 					       */
236 			sin6->sin6_flowinfo = 0;
237 			if (!(so->so_options & SO_BINDANY) &&
238 			    ((ia = ifa_ifwithaddr((struct sockaddr *)sin6))
239 			    == NULL))
240 				return EADDRNOTAVAIL;
241 
242 			/*
243 			 * bind to an anycast address might accidentally
244 			 * cause sending a packet with an anycast source
245 			 * address, so we forbid it.
246 			 *
247 			 * We should allow to bind to a deprecated address,
248 			 * since the application dare to use it.
249 			 * But, can we assume that they are careful enough
250 			 * to check if the address is deprecated or not?
251 			 * Maybe, as a safeguard, we should have a setsockopt
252 			 * flag to control the bind(2) behavior against
253 			 * deprecated addresses (default: forbid bind(2)).
254 			 */
255 			if (ia &&
256 			    ((struct in6_ifaddr *)ia)->ia6_flags &
257 			    (IN6_IFF_ANYCAST|IN6_IFF_NOTREADY|IN6_IFF_DETACHED))
258 				return (EADDRNOTAVAIL);
259 		}
260 		if (lport) {
261 			struct inpcb *t;
262 
263 			/*
264 			 * Question:  Do we wish to continue the Berkeley
265 			 * tradition of ports < IPPORT_RESERVED be only for
266 			 * root?
267 			 * Answer: For now yes, but IMHO, it should be REMOVED!
268 			 * OUCH: One other thing, is there no better way of
269 			 * finding a process for a socket instead of using
270 			 * curproc?  (Marked with BSD's {in,}famous XXX ?
271 			 */
272 			if (ntohs(lport) < IPPORT_RESERVED &&
273 			    (error = suser(p, 0)))
274 				return error;
275 
276 			t = in_pcblookup(head,
277 			    (struct in_addr *)&zeroin6_addr, 0,
278 			    (struct in_addr *)&sin6->sin6_addr, lport,
279 			    wild);
280 
281 			if (t && (reuseport & t->inp_socket->so_options) == 0)
282 				return EADDRINUSE;
283 		}
284 		inp->inp_laddr6 = sin6->sin6_addr;
285 	}
286 
287 	if (lport == 0) {
288 		error = in6_pcbsetport(&inp->inp_laddr6, inp, p);
289 		if (error != 0)
290 			return error;
291 	} else {
292 		inp->inp_lport = lport;
293 		in_pcbrehash(inp);
294 	}
295 
296 	return 0;
297 }
298 
299 int
300 in6_pcbsetport(struct in6_addr *laddr, struct inpcb *inp, struct proc *p)
301 {
302 	struct socket *so = inp->inp_socket;
303 	struct inpcbtable *table = inp->inp_table;
304 	u_int16_t first, last;
305 	u_int16_t *lastport = &inp->inp_table->inpt_lastport;
306 	u_int16_t lport = 0;
307 	int count;
308 	int wild = INPLOOKUP_IPV6;
309 	int error;
310 
311 	/* XXX we no longer support IPv4 mapped address, so no tweaks here */
312 
313 	if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) == 0 &&
314 	    ((so->so_proto->pr_flags & PR_CONNREQUIRED) == 0 ||
315 	     (so->so_options & SO_ACCEPTCONN) == 0))
316 		wild |= INPLOOKUP_WILDCARD;
317 
318 	if (inp->inp_flags & INP_HIGHPORT) {
319 		first = ipport_hifirstauto;	/* sysctl */
320 		last = ipport_hilastauto;
321 	} else if (inp->inp_flags & INP_LOWPORT) {
322 		if ((error = suser(p, 0)))
323 			return (EACCES);
324 		first = IPPORT_RESERVED-1; /* 1023 */
325 		last = 600;		   /* not IPPORT_RESERVED/2 */
326 	} else {
327 		first = ipport_firstauto;	/* sysctl */
328 		last  = ipport_lastauto;
329 	}
330 
331 	/*
332 	 * Simple check to ensure all ports are not used up causing
333 	 * a deadlock here.
334 	 *
335 	 * We split the two cases (up and down) so that the direction
336 	 * is not being tested on each round of the loop.
337 	 */
338 
339 	if (first > last) {
340 		/*
341 		 * counting down
342 		 */
343 		count = first - last;
344 		if (count)
345 			*lastport = first - arc4random_uniform(count);
346 
347 		do {
348 			if (count-- < 0)	/* completely used? */
349 				return (EADDRNOTAVAIL);
350 			--*lastport;
351 			if (*lastport > first || *lastport < last)
352 				*lastport = first;
353 			lport = htons(*lastport);
354 		} while (in_baddynamic(*lastport, so->so_proto->pr_protocol) ||
355 		    in_pcblookup(table, &zeroin6_addr, 0,
356 		    &inp->inp_laddr6, lport, wild));
357 	} else {
358 		/*
359 		 * counting up
360 		 */
361 		count = last - first;
362 		if (count)
363 			*lastport = first + arc4random_uniform(count);
364 
365 		do {
366 			if (count-- < 0)	/* completely used? */
367 				return (EADDRNOTAVAIL);
368 			++*lastport;
369 			if (*lastport < first || *lastport > last)
370 				*lastport = first;
371 			lport = htons(*lastport);
372 		} while (in_baddynamic(*lastport, so->so_proto->pr_protocol) ||
373 		    in_pcblookup(table, &zeroin6_addr, 0,
374 		    &inp->inp_laddr6, lport, wild));
375 	}
376 
377 	inp->inp_lport = lport;
378 	in_pcbrehash(inp);
379 
380 #if 0
381 	inp->inp_flowinfo = 0;	/* XXX */
382 #endif
383 
384 	return 0;
385 }
386 
387 /*
388  * Connect from a socket to a specified address.
389  * Both address and port must be specified in argument sin6.
390  * Eventually, flow labels will have to be dealt with here, as well.
391  *
392  * If don't have a local address for this socket yet,
393  * then pick one.
394  *
395  * I believe this has to be called at splnet().
396  */
397 int
398 in6_pcbconnect(struct inpcb *inp, struct mbuf *nam)
399 {
400 	struct in6_addr *in6a = NULL;
401 	struct sockaddr_in6 *sin6 = mtod(nam, struct sockaddr_in6 *);
402 	struct ifnet *ifp = NULL;	/* outgoing interface */
403 	int error = 0;
404 	struct sockaddr_in6 tmp;
405 
406 	(void)&in6a;				/* XXX fool gcc */
407 
408 	if (nam->m_len != sizeof(*sin6))
409 		return (EINVAL);
410 	if (sin6->sin6_family != AF_INET6)
411 		return (EAFNOSUPPORT);
412 	if (sin6->sin6_port == 0)
413 		return (EADDRNOTAVAIL);
414 
415 	/* reject IPv4 mapped address, we have no support for it */
416 	if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr))
417 		return EADDRNOTAVAIL;
418 
419 	/* sanity check for mapped address case */
420 	if (IN6_IS_ADDR_V4MAPPED(&inp->inp_laddr6))
421 		return EINVAL;
422 
423 	/* protect *sin6 from overwrites */
424 	tmp = *sin6;
425 	sin6 = &tmp;
426 
427 	/* KAME hack: embed scopeid */
428 	if (in6_embedscope(&sin6->sin6_addr, sin6, inp, &ifp) != 0)
429 		return EINVAL;
430 	/* this must be cleared for ifa_ifwithaddr() */
431 	sin6->sin6_scope_id = 0;
432 
433 	/* Source address selection. */
434 	/*
435 	 * XXX: in6_selectsrc might replace the bound local address
436 	 * with the address specified by setsockopt(IPV6_PKTINFO).
437 	 * Is it the intended behavior?
438 	 */
439 	in6a = in6_selectsrc(sin6, inp->inp_outputopts6,
440 	    inp->inp_moptions6, &inp->inp_route6, &inp->inp_laddr6,
441 	    &error);
442 	if (in6a == 0) {
443 		if (error == 0)
444 			error = EADDRNOTAVAIL;
445 		return (error);
446 	}
447 
448 	if (inp->inp_route6.ro_rt && inp->inp_route6.ro_rt->rt_flags & RTF_UP)
449 		ifp = inp->inp_route6.ro_rt->rt_ifp;
450 
451 	inp->inp_ipv6.ip6_hlim = (u_int8_t)in6_selecthlim(inp, ifp);
452 
453 	if (in_pcblookup(inp->inp_table, &sin6->sin6_addr, sin6->sin6_port,
454 	    IN6_IS_ADDR_UNSPECIFIED(&inp->inp_laddr6) ? in6a : &inp->inp_laddr6,
455 	    inp->inp_lport, INPLOOKUP_IPV6)) {
456 		return (EADDRINUSE);
457 	}
458 	if (IN6_IS_ADDR_UNSPECIFIED(&inp->inp_laddr6)) {
459 		if (inp->inp_lport == 0)
460 			(void)in6_pcbbind(inp, NULL, curproc);
461 		inp->inp_laddr6 = *in6a;
462 	}
463 	inp->inp_faddr6 = sin6->sin6_addr;
464 	inp->inp_fport = sin6->sin6_port;
465 	inp->inp_flowinfo &= ~IPV6_FLOWLABEL_MASK;
466 	if (ip6_auto_flowlabel)
467 		inp->inp_flowinfo |=
468 		    (htonl(ip6_randomflowlabel()) & IPV6_FLOWLABEL_MASK);
469 	in_pcbrehash(inp);
470 	return (0);
471 }
472 
473 /*
474  * Pass some notification to all connections of a protocol
475  * associated with address dst.  The local address and/or port numbers
476  * may be specified to limit the search.  The "usual action" will be
477  * taken, depending on the ctlinput cmd.  The caller must filter any
478  * cmds that are uninteresting (e.g., no error in the map).
479  * Call the protocol specific routine (if any) to report
480  * any errors for each matching socket.
481  *
482  * Also perform input-side security policy check
483  *    once PCB to be notified has been located.
484  *
485  * Must be called at splnet.
486  */
487 int
488 in6_pcbnotify(struct inpcbtable *head, struct sockaddr *dst,
489 	uint fport_arg, struct sockaddr *src, uint lport_arg, int cmd,
490 	void *cmdarg, void (*notify)(struct inpcb *, int))
491 {
492 	struct inpcb *inp, *ninp;
493 	u_short fport = fport_arg, lport = lport_arg;
494 	struct sockaddr_in6 sa6_src, *sa6_dst;
495 	int errno, nmatch = 0;
496 	u_int32_t flowinfo;
497 
498 	if ((unsigned)cmd >= PRC_NCMDS || dst->sa_family != AF_INET6)
499 		return (0);
500 
501 	sa6_dst = (struct sockaddr_in6 *)dst;
502 	if (IN6_IS_ADDR_UNSPECIFIED(&sa6_dst->sin6_addr))
503 		return (0);
504 	if (IN6_IS_ADDR_V4MAPPED(&sa6_dst->sin6_addr)) {
505 #ifdef DIAGNOSTIC
506 		printf("Huh?  Thought in6_pcbnotify() never got "
507 		       "called with mapped!\n");
508 #endif
509 		return (0);
510 	}
511 
512 	/*
513 	 * note that src can be NULL when we get notify by local fragmentation.
514 	 */
515 	sa6_src = (src == NULL) ? sa6_any : *(struct sockaddr_in6 *)src;
516 	flowinfo = sa6_src.sin6_flowinfo;
517 
518 	/*
519 	 * Redirects go to all references to the destination,
520 	 * and use in_rtchange to invalidate the route cache.
521 	 * Dead host indications: also use in_rtchange to invalidate
522 	 * the cache, and deliver the error to all the sockets.
523 	 * Otherwise, if we have knowledge of the local port and address,
524 	 * deliver only to that socket.
525 	 */
526 	if (PRC_IS_REDIRECT(cmd) || cmd == PRC_HOSTDEAD) {
527 		fport = 0;
528 		lport = 0;
529 		sa6_src.sin6_addr = in6addr_any;
530 
531 		if (cmd != PRC_HOSTDEAD)
532 			notify = in_rtchange;
533 	}
534 	errno = inet6ctlerrmap[cmd];
535 
536 	for (inp = CIRCLEQ_FIRST(&head->inpt_queue);
537 	     inp != CIRCLEQ_END(&head->inpt_queue); inp = ninp) {
538 		ninp = CIRCLEQ_NEXT(inp, inp_queue);
539 
540 		if ((inp->inp_flags & INP_IPV6) == 0)
541 			continue;
542 
543 		/*
544 		 * Under the following condition, notify of redirects
545 		 * to the pcb, without making address matches against inpcb.
546 		 * - redirect notification is arrived.
547 		 * - the inpcb is unconnected.
548 		 * - the inpcb is caching !RTF_HOST routing entry.
549 		 * - the ICMPv6 notification is from the gateway cached in the
550 		 *   inpcb.  i.e. ICMPv6 notification is from nexthop gateway
551 		 *   the inpcb used very recently.
552 		 *
553 		 * This is to improve interaction between netbsd/openbsd
554 		 * redirect handling code, and inpcb route cache code.
555 		 * without the clause, !RTF_HOST routing entry (which carries
556 		 * gateway used by inpcb right before the ICMPv6 redirect)
557 		 * will be cached forever in unconnected inpcb.
558 		 *
559 		 * There still is a question regarding to what is TRT:
560 		 * - On bsdi/freebsd, RTF_HOST (cloned) routing entry will be
561 		 *   generated on packet output.  inpcb will always cache
562 		 *   RTF_HOST routing entry so there's no need for the clause
563 		 *   (ICMPv6 redirect will update RTF_HOST routing entry,
564 		 *   and inpcb is caching it already).
565 		 *   However, bsdi/freebsd are vulnerable to local DoS attacks
566 		 *   due to the cloned routing entries.
567 		 * - Specwise, "destination cache" is mentioned in RFC2461.
568 		 *   Jinmei says that it implies bsdi/freebsd behavior, itojun
569 		 *   is not really convinced.
570 		 * - Having hiwat/lowat on # of cloned host route (redirect/
571 		 *   pmtud) may be a good idea.  netbsd/openbsd has it.  see
572 		 *   icmp6_mtudisc_update().
573 		 */
574 		if ((PRC_IS_REDIRECT(cmd) || cmd == PRC_HOSTDEAD) &&
575 		    IN6_IS_ADDR_UNSPECIFIED(&inp->inp_laddr6) &&
576 		    inp->inp_route.ro_rt &&
577 		    !(inp->inp_route.ro_rt->rt_flags & RTF_HOST)) {
578 			struct sockaddr_in6 *dst6;
579 
580 			dst6 = (struct sockaddr_in6 *)&inp->inp_route.ro_dst;
581 			if (IN6_ARE_ADDR_EQUAL(&dst6->sin6_addr,
582 			    &sa6_dst->sin6_addr))
583 				goto do_notify;
584 		}
585 
586 		/*
587 		 * Detect if we should notify the error. If no source and
588 		 * destination ports are specified, but non-zero flowinfo and
589 		 * local address match, notify the error. This is the case
590 		 * when the error is delivered with an encrypted buffer
591 		 * by ESP. Otherwise, just compare addresses and ports
592 		 * as usual.
593 		 */
594 		if (lport == 0 && fport == 0 && flowinfo &&
595 		    inp->inp_socket != NULL &&
596 		    flowinfo == (inp->inp_flowinfo & IPV6_FLOWLABEL_MASK) &&
597 		    IN6_ARE_ADDR_EQUAL(&inp->inp_laddr6, &sa6_src.sin6_addr))
598 			goto do_notify;
599 		else if (!IN6_ARE_ADDR_EQUAL(&inp->inp_faddr6,
600 					     &sa6_dst->sin6_addr) ||
601 			 inp->inp_socket == 0 ||
602 			 (lport && inp->inp_lport != lport) ||
603 			 (!IN6_IS_ADDR_UNSPECIFIED(&sa6_src.sin6_addr) &&
604 			  !IN6_ARE_ADDR_EQUAL(&inp->inp_laddr6,
605 					      &sa6_src.sin6_addr)) ||
606 			 (fport && inp->inp_fport != fport)) {
607 			continue;
608 		}
609 	  do_notify:
610 		nmatch++;
611 		if (notify)
612 			(*notify)(inp, errno);
613 	}
614 	return (nmatch);
615 }
616 
617 /*
618  * Get the local address/port, and put it in a sockaddr_in6.
619  * This services the getsockname(2) call.
620  */
621 int
622 in6_setsockaddr(struct inpcb *inp, struct mbuf *nam)
623 {
624 	struct sockaddr_in6 *sin6;
625 
626 	nam->m_len = sizeof(struct sockaddr_in6);
627 	sin6 = mtod(nam,struct sockaddr_in6 *);
628 
629 	bzero ((caddr_t)sin6,sizeof(struct sockaddr_in6));
630 	sin6->sin6_family = AF_INET6;
631 	sin6->sin6_len = sizeof(struct sockaddr_in6);
632 	sin6->sin6_port = inp->inp_lport;
633 	sin6->sin6_addr = inp->inp_laddr6;
634 	/* KAME hack: recover scopeid */
635 	(void)in6_recoverscope(sin6, &inp->inp_laddr6, NULL);
636 
637 	return 0;
638 }
639 
640 /*
641  * Get the foreign address/port, and put it in a sockaddr_in6.
642  * This services the getpeername(2) call.
643  */
644 int
645 in6_setpeeraddr(struct inpcb *inp, struct mbuf *nam)
646 {
647 	struct sockaddr_in6 *sin6;
648 
649 	nam->m_len = sizeof(struct sockaddr_in6);
650 	sin6 = mtod(nam,struct sockaddr_in6 *);
651 
652 	bzero ((caddr_t)sin6,sizeof(struct sockaddr_in6));
653 	sin6->sin6_family = AF_INET6;
654 	sin6->sin6_len = sizeof(struct sockaddr_in6);
655 	sin6->sin6_port = inp->inp_fport;
656 	sin6->sin6_addr = inp->inp_faddr6;
657 	/* KAME hack: recover scopeid */
658 	(void)in6_recoverscope(sin6, &inp->inp_faddr6, NULL);
659 
660 	return 0;
661 }
662