xref: /openbsd/sys/netinet/in_pcb.c (revision 6f40fd34)
1 /*	$OpenBSD: in_pcb.c,v 1.222 2017/06/09 12:56:43 mpi Exp $	*/
2 /*	$NetBSD: in_pcb.c,v 1.25 1996/02/13 23:41:53 christos Exp $	*/
3 
4 /*
5  * Copyright (c) 1982, 1986, 1991, 1993
6  *	The Regents of the University of California.  All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions
10  * are met:
11  * 1. Redistributions of source code must retain the above copyright
12  *    notice, this list of conditions and the following disclaimer.
13  * 2. Redistributions in binary form must reproduce the above copyright
14  *    notice, this list of conditions and the following disclaimer in the
15  *    documentation and/or other materials provided with the distribution.
16  * 3. Neither the name of the University nor the names of its contributors
17  *    may be used to endorse or promote products derived from this software
18  *    without specific prior written permission.
19  *
20  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30  * SUCH DAMAGE.
31  *
32  *	@(#)COPYRIGHT	1.1 (NRL) 17 January 1995
33  *
34  * NRL grants permission for redistribution and use in source and binary
35  * forms, with or without modification, of the software and documentation
36  * created at NRL provided that the following conditions are met:
37  *
38  * 1. Redistributions of source code must retain the above copyright
39  *    notice, this list of conditions and the following disclaimer.
40  * 2. Redistributions in binary form must reproduce the above copyright
41  *    notice, this list of conditions and the following disclaimer in the
42  *    documentation and/or other materials provided with the distribution.
43  * 3. All advertising materials mentioning features or use of this software
44  *    must display the following acknowledgements:
45  * 	This product includes software developed by the University of
46  * 	California, Berkeley and its contributors.
47  * 	This product includes software developed at the Information
48  * 	Technology Division, US Naval Research Laboratory.
49  * 4. Neither the name of the NRL nor the names of its contributors
50  *    may be used to endorse or promote products derived from this software
51  *    without specific prior written permission.
52  *
53  * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
54  * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
55  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
56  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL NRL OR
57  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
58  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
59  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
60  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
61  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
62  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
63  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
64  *
65  * The views and conclusions contained in the software and documentation
66  * are those of the authors and should not be interpreted as representing
67  * official policies, either expressed or implied, of the US Naval
68  * Research Laboratory (NRL).
69  */
70 
71 #include "pf.h"
72 
73 #include <sys/param.h>
74 #include <sys/systm.h>
75 #include <sys/mbuf.h>
76 #include <sys/protosw.h>
77 #include <sys/socket.h>
78 #include <sys/socketvar.h>
79 #include <sys/proc.h>
80 #include <sys/pledge.h>
81 #include <sys/domain.h>
82 #include <sys/pool.h>
83 
84 #include <net/if.h>
85 #include <net/if_var.h>
86 #include <net/route.h>
87 
88 #include <netinet/in.h>
89 #include <netinet/ip.h>
90 #include <netinet/in_pcb.h>
91 #include <netinet/in_var.h>
92 #include <netinet/ip_var.h>
93 
94 #include <net/pfvar.h>
95 
96 #include <sys/mount.h>
97 #include <nfs/nfsproto.h>
98 
99 #ifdef INET6
100 #include <netinet6/in6_var.h>
101 #include <netinet6/ip6_var.h>
102 #endif /* INET6 */
103 #ifdef IPSEC
104 #include <netinet/ip_esp.h>
105 #endif /* IPSEC */
106 
107 struct	in_addr zeroin_addr;
108 
109 union {
110 	struct in_addr	za_in;
111 	struct in6_addr	za_in6;
112 } zeroin46_addr;
113 
114 /*
115  * These configure the range of local port addresses assigned to
116  * "unspecified" outgoing connections/packets/whatever.
117  */
118 int ipport_firstauto = IPPORT_RESERVED;
119 int ipport_lastauto = IPPORT_USERRESERVED;
120 int ipport_hifirstauto = IPPORT_HIFIRSTAUTO;
121 int ipport_hilastauto = IPPORT_HILASTAUTO;
122 
123 struct baddynamicports baddynamicports;
124 struct baddynamicports rootonlyports;
125 struct pool inpcb_pool;
126 int inpcb_pool_initialized = 0;
127 
128 int in_pcbresize (struct inpcbtable *, int);
129 
130 #define	INPCBHASH_LOADFACTOR(_x)	(((_x) * 3) / 4)
131 
132 struct inpcbhead *in_pcbhash(struct inpcbtable *, int,
133     const struct in_addr *, u_short, const struct in_addr *, u_short);
134 struct inpcbhead *in6_pcbhash(struct inpcbtable *, int,
135     const struct in6_addr *, u_short, const struct in6_addr *, u_short);
136 struct inpcbhead *in_pcblhash(struct inpcbtable *, int, u_short);
137 
138 struct inpcbhead *
139 in_pcbhash(struct inpcbtable *table, int rdom,
140     const struct in_addr *faddr, u_short fport,
141     const struct in_addr *laddr, u_short lport)
142 {
143 	SIPHASH_CTX ctx;
144 	u_int32_t nrdom = htonl(rdom);
145 
146 	SipHash24_Init(&ctx, &table->inpt_key);
147 	SipHash24_Update(&ctx, &nrdom, sizeof(nrdom));
148 	SipHash24_Update(&ctx, faddr, sizeof(*faddr));
149 	SipHash24_Update(&ctx, &fport, sizeof(fport));
150 	SipHash24_Update(&ctx, laddr, sizeof(*laddr));
151 	SipHash24_Update(&ctx, &lport, sizeof(lport));
152 
153 	return (&table->inpt_hashtbl[SipHash24_End(&ctx) & table->inpt_hash]);
154 }
155 
156 #define	INPCBHASH(table, faddr, fport, laddr, lport, rdom) \
157 	in_pcbhash(table, rdom, faddr, fport, laddr, lport)
158 
159 struct inpcbhead *
160 in6_pcbhash(struct inpcbtable *table, int rdom,
161     const struct in6_addr *faddr, u_short fport,
162     const struct in6_addr *laddr, u_short lport)
163 {
164 	SIPHASH_CTX ctx;
165 	u_int32_t nrdom = htonl(rdom);
166 
167 	SipHash24_Init(&ctx, &table->inpt_key);
168 	SipHash24_Update(&ctx, &nrdom, sizeof(nrdom));
169 	SipHash24_Update(&ctx, faddr, sizeof(*faddr));
170 	SipHash24_Update(&ctx, &fport, sizeof(fport));
171 	SipHash24_Update(&ctx, laddr, sizeof(*laddr));
172 	SipHash24_Update(&ctx, &lport, sizeof(lport));
173 
174 	return (&table->inpt_hashtbl[SipHash24_End(&ctx) & table->inpt_hash]);
175 }
176 
177 #define	IN6PCBHASH(table, faddr, fport, laddr, lport, rdom) \
178 	in6_pcbhash(table, rdom, faddr, fport, laddr, lport)
179 
180 struct inpcbhead *
181 in_pcblhash(struct inpcbtable *table, int rdom, u_short lport)
182 {
183 	SIPHASH_CTX ctx;
184 	u_int32_t nrdom = htonl(rdom);
185 
186 	SipHash24_Init(&ctx, &table->inpt_key);
187 	SipHash24_Update(&ctx, &nrdom, sizeof(nrdom));
188 	SipHash24_Update(&ctx, &lport, sizeof(lport));
189 
190 	return (&table->inpt_lhashtbl[SipHash24_End(&ctx) & table->inpt_lhash]);
191 }
192 
193 #define	INPCBLHASH(table, lport, rdom) in_pcblhash(table, rdom, lport)
194 
195 void
196 in_pcbinit(struct inpcbtable *table, int hashsize)
197 {
198 
199 	TAILQ_INIT(&table->inpt_queue);
200 	table->inpt_hashtbl = hashinit(hashsize, M_PCB, M_NOWAIT,
201 	    &table->inpt_hash);
202 	if (table->inpt_hashtbl == NULL)
203 		panic("in_pcbinit: hashinit failed");
204 	table->inpt_lhashtbl = hashinit(hashsize, M_PCB, M_NOWAIT,
205 	    &table->inpt_lhash);
206 	if (table->inpt_lhashtbl == NULL)
207 		panic("in_pcbinit: hashinit failed for lport");
208 	table->inpt_count = 0;
209 	arc4random_buf(&table->inpt_key, sizeof(table->inpt_key));
210 }
211 
212 /*
213  * Check if the specified port is invalid for dynamic allocation.
214  */
215 int
216 in_baddynamic(u_int16_t port, u_int16_t proto)
217 {
218 	switch (proto) {
219 	case IPPROTO_TCP:
220 		return (DP_ISSET(baddynamicports.tcp, port));
221 	case IPPROTO_UDP:
222 #ifdef IPSEC
223 		/* Cannot preset this as it is a sysctl */
224 		if (port == udpencap_port)
225 			return (1);
226 #endif
227 		return (DP_ISSET(baddynamicports.udp, port));
228 	default:
229 		return (0);
230 	}
231 }
232 
233 int
234 in_rootonly(u_int16_t port, u_int16_t proto)
235 {
236 	switch (proto) {
237 	case IPPROTO_TCP:
238 		return (port < IPPORT_RESERVED ||
239 		    DP_ISSET(rootonlyports.tcp, port));
240 	case IPPROTO_UDP:
241 		return (port < IPPORT_RESERVED ||
242 		    DP_ISSET(rootonlyports.udp, port));
243 	default:
244 		return (0);
245 	}
246 }
247 
248 int
249 in_pcballoc(struct socket *so, struct inpcbtable *table)
250 {
251 	struct inpcb *inp;
252 	struct inpcbhead *head;
253 
254 	NET_ASSERT_LOCKED();
255 
256 	if (inpcb_pool_initialized == 0) {
257 		pool_init(&inpcb_pool, sizeof(struct inpcb), 0,
258 		    IPL_SOFTNET, 0, "inpcbpl", NULL);
259 		inpcb_pool_initialized = 1;
260 	}
261 	inp = pool_get(&inpcb_pool, PR_NOWAIT|PR_ZERO);
262 	if (inp == NULL)
263 		return (ENOBUFS);
264 	inp->inp_table = table;
265 	inp->inp_socket = so;
266 	inp->inp_seclevel[SL_AUTH] = IPSEC_AUTH_LEVEL_DEFAULT;
267 	inp->inp_seclevel[SL_ESP_TRANS] = IPSEC_ESP_TRANS_LEVEL_DEFAULT;
268 	inp->inp_seclevel[SL_ESP_NETWORK] = IPSEC_ESP_NETWORK_LEVEL_DEFAULT;
269 	inp->inp_seclevel[SL_IPCOMP] = IPSEC_IPCOMP_LEVEL_DEFAULT;
270 	inp->inp_rtableid = curproc->p_p->ps_rtableid;
271 	if (table->inpt_hash != 0 &&
272 	    table->inpt_count++ > INPCBHASH_LOADFACTOR(table->inpt_hash))
273 		(void)in_pcbresize(table, (table->inpt_hash + 1) * 2);
274 	TAILQ_INSERT_HEAD(&table->inpt_queue, inp, inp_queue);
275 	head = INPCBLHASH(table, inp->inp_lport, inp->inp_rtableid);
276 	LIST_INSERT_HEAD(head, inp, inp_lhash);
277 #ifdef INET6
278 	if (sotopf(so) == PF_INET6)
279 		head = IN6PCBHASH(table, &inp->inp_faddr6, inp->inp_fport,
280 		    &inp->inp_laddr6, inp->inp_lport,
281 		    rtable_l2(inp->inp_rtableid));
282 	else
283 #endif /* INET6 */
284 		head = INPCBHASH(table, &inp->inp_faddr, inp->inp_fport,
285 		    &inp->inp_laddr, inp->inp_lport,
286 		    rtable_l2(inp->inp_rtableid));
287 	LIST_INSERT_HEAD(head, inp, inp_hash);
288 	so->so_pcb = inp;
289 	inp->inp_hops = -1;
290 
291 #ifdef INET6
292 	/*
293 	 * Small change in this function to set the INP_IPV6 flag so routines
294 	 * outside pcb-specific routines don't need to use sotopf(), and all
295 	 * of its pointer chasing, later.
296 	 */
297 	if (sotopf(so) == PF_INET6)
298 		inp->inp_flags = INP_IPV6;
299 	inp->inp_cksum6 = -1;
300 #endif /* INET6 */
301 	return (0);
302 }
303 
304 int
305 in_pcbbind(struct inpcb *inp, struct mbuf *nam, struct proc *p)
306 {
307 	struct socket *so = inp->inp_socket;
308 	u_int16_t lport = 0;
309 	int wild = 0;
310 	void *laddr = &zeroin46_addr;
311 	int error;
312 
313 	if (inp->inp_lport)
314 		return (EINVAL);
315 
316 	if ((so->so_options & (SO_REUSEADDR|SO_REUSEPORT)) == 0 &&
317 	    ((so->so_proto->pr_flags & PR_CONNREQUIRED) == 0 ||
318 	     (so->so_options & SO_ACCEPTCONN) == 0))
319 		wild = INPLOOKUP_WILDCARD;
320 
321 	switch (sotopf(so)) {
322 #ifdef INET6
323 	case PF_INET6:
324 		if (!IN6_IS_ADDR_UNSPECIFIED(&inp->inp_laddr6))
325 			return (EINVAL);
326 		wild |= INPLOOKUP_IPV6;
327 
328 		if (nam) {
329 			struct sockaddr_in6 *sin6;
330 			sin6 = mtod(nam, struct sockaddr_in6 *);
331 			if (nam->m_len != sizeof(struct sockaddr_in6))
332 				return (EINVAL);
333 			if (sin6->sin6_family != AF_INET6)
334 				return (EAFNOSUPPORT);
335 
336 			if ((error = in6_pcbaddrisavail(inp, sin6, wild, p)))
337 				return (error);
338 			laddr = &sin6->sin6_addr;
339 			lport = sin6->sin6_port;
340 		}
341 		break;
342 #endif
343 	case PF_INET:
344 		if (inp->inp_laddr.s_addr != INADDR_ANY)
345 			return (EINVAL);
346 
347 		if (nam) {
348 			struct sockaddr_in *sin;
349 			sin = mtod(nam, struct sockaddr_in *);
350 			if (nam->m_len != sizeof(*sin))
351 				return (EINVAL);
352 			if (sin->sin_family != AF_INET)
353 				return (EAFNOSUPPORT);
354 
355 			if ((error = in_pcbaddrisavail(inp, sin, wild, p)))
356 				return (error);
357 			laddr = &sin->sin_addr;
358 			lport = sin->sin_port;
359 		}
360 		break;
361 	default:
362 		return (EINVAL);
363 	}
364 
365 	if (lport == 0) {
366 		if ((error = in_pcbpickport(&lport, laddr, wild, inp, p)))
367 			return (error);
368 	} else {
369 		if (in_rootonly(ntohs(lport), so->so_proto->pr_protocol) &&
370 		    suser(p, 0) != 0)
371 			return (EACCES);
372 	}
373 	if (nam) {
374 		switch (sotopf(so)) {
375 #ifdef INET6
376 		case PF_INET6:
377 			inp->inp_laddr6 = *(struct in6_addr *)laddr;
378 			break;
379 #endif
380 		case PF_INET:
381 			inp->inp_laddr = *(struct in_addr *)laddr;
382 			break;
383 		}
384 	}
385 	inp->inp_lport = lport;
386 	in_pcbrehash(inp);
387 	return (0);
388 }
389 
390 int
391 in_pcbaddrisavail(struct inpcb *inp, struct sockaddr_in *sin, int wild,
392     struct proc *p)
393 {
394 	struct socket *so = inp->inp_socket;
395 	struct inpcbtable *table = inp->inp_table;
396 	u_int16_t lport = sin->sin_port;
397 	int reuseport = (so->so_options & SO_REUSEPORT);
398 
399 	if (IN_MULTICAST(sin->sin_addr.s_addr)) {
400 		/*
401 		 * Treat SO_REUSEADDR as SO_REUSEPORT for multicast;
402 		 * allow complete duplication of binding if
403 		 * SO_REUSEPORT is set, or if SO_REUSEADDR is set
404 		 * and a multicast address is bound on both
405 		 * new and duplicated sockets.
406 		 */
407 		if (so->so_options & (SO_REUSEADDR|SO_REUSEPORT))
408 			reuseport = SO_REUSEADDR|SO_REUSEPORT;
409 	} else if (sin->sin_addr.s_addr != INADDR_ANY) {
410 		/*
411 		 * we must check that we are binding to an address we
412 		 * own except when:
413 		 * - SO_BINDANY is set or
414 		 * - we are binding a UDP socket to 255.255.255.255 or
415 		 * - we are binding a UDP socket to one of our broadcast
416 		 *   addresses
417 		 */
418 		if (!ISSET(so->so_options, SO_BINDANY) &&
419 		    !(so->so_type == SOCK_DGRAM &&
420 		    sin->sin_addr.s_addr == INADDR_BROADCAST) &&
421 		    !(so->so_type == SOCK_DGRAM &&
422 		    in_broadcast(sin->sin_addr, inp->inp_rtableid))) {
423 			struct ifaddr *ia;
424 
425 			sin->sin_port = 0;
426 			memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
427 			ia = ifa_ifwithaddr(sintosa(sin), inp->inp_rtableid);
428 			sin->sin_port = lport;
429 
430 			if (ia == NULL)
431 				return (EADDRNOTAVAIL);
432 		}
433 	}
434 	if (lport) {
435 		struct inpcb *t;
436 
437 		if (so->so_euid) {
438 			t = in_pcblookup_local(table, &sin->sin_addr, lport,
439 			    INPLOOKUP_WILDCARD, inp->inp_rtableid);
440 			if (t && (so->so_euid != t->inp_socket->so_euid))
441 				return (EADDRINUSE);
442 		}
443 		t = in_pcblookup_local(table, &sin->sin_addr, lport,
444 		    wild, inp->inp_rtableid);
445 		if (t && (reuseport & t->inp_socket->so_options) == 0)
446 			return (EADDRINUSE);
447 	}
448 
449 	return (0);
450 }
451 
452 int
453 in_pcbpickport(u_int16_t *lport, void *laddr, int wild, struct inpcb *inp,
454     struct proc *p)
455 {
456 	struct socket *so = inp->inp_socket;
457 	struct inpcbtable *table = inp->inp_table;
458 	u_int16_t first, last, lower, higher, candidate, localport;
459 	int count;
460 
461 	if (inp->inp_flags & INP_HIGHPORT) {
462 		first = ipport_hifirstauto;	/* sysctl */
463 		last = ipport_hilastauto;
464 	} else if (inp->inp_flags & INP_LOWPORT) {
465 		if (suser(p, 0))
466 			return (EACCES);
467 		first = IPPORT_RESERVED-1; /* 1023 */
468 		last = 600;		   /* not IPPORT_RESERVED/2 */
469 	} else {
470 		first = ipport_firstauto;	/* sysctl */
471 		last = ipport_lastauto;
472 	}
473 	if (first < last) {
474 		lower = first;
475 		higher = last;
476 	} else {
477 		lower = last;
478 		higher = first;
479 	}
480 
481 	/*
482 	 * Simple check to ensure all ports are not used up causing
483 	 * a deadlock here.
484 	 */
485 
486 	count = higher - lower;
487 	candidate = lower + arc4random_uniform(count);
488 
489 	do {
490 		if (count-- < 0) 	/* completely used? */
491 			return (EADDRNOTAVAIL);
492 		++candidate;
493 		if (candidate < lower || candidate > higher)
494 			candidate = lower;
495 		localport = htons(candidate);
496 	} while (in_baddynamic(candidate, so->so_proto->pr_protocol) ||
497 	    in_pcblookup_local(table, laddr, localport, wild,
498 	    inp->inp_rtableid));
499 	*lport = localport;
500 
501 	return (0);
502 }
503 
504 /*
505  * Connect from a socket to a specified address.
506  * Both address and port must be specified in argument sin.
507  * If don't have a local address for this socket yet,
508  * then pick one.
509  */
510 int
511 in_pcbconnect(struct inpcb *inp, struct mbuf *nam)
512 {
513 	struct in_addr *ina = NULL;
514 	struct sockaddr_in *sin = mtod(nam, struct sockaddr_in *);
515 	int error;
516 
517 #ifdef INET6
518 	if (sotopf(inp->inp_socket) == PF_INET6)
519 		return (in6_pcbconnect(inp, nam));
520 	if ((inp->inp_flags & INP_IPV6) != 0)
521 		panic("IPv6 pcb passed into in_pcbconnect");
522 #endif /* INET6 */
523 
524 	if (nam->m_len != sizeof(*sin))
525 		return (EINVAL);
526 	if (sin->sin_family != AF_INET)
527 		return (EAFNOSUPPORT);
528 	if (sin->sin_port == 0)
529 		return (EADDRNOTAVAIL);
530 
531 	error = in_pcbselsrc(&ina, sin, inp);
532 	if (error)
533 		return (error);
534 
535 	if (in_pcbhashlookup(inp->inp_table, sin->sin_addr, sin->sin_port,
536 	    *ina, inp->inp_lport, inp->inp_rtableid) != 0)
537 		return (EADDRINUSE);
538 
539 	KASSERT(inp->inp_laddr.s_addr == INADDR_ANY || inp->inp_lport);
540 
541 	if (inp->inp_laddr.s_addr == INADDR_ANY) {
542 		if (inp->inp_lport == 0 &&
543 		    in_pcbbind(inp, NULL, curproc) == EADDRNOTAVAIL)
544 			return (EADDRNOTAVAIL);
545 		inp->inp_laddr = *ina;
546 	}
547 	inp->inp_faddr = sin->sin_addr;
548 	inp->inp_fport = sin->sin_port;
549 	in_pcbrehash(inp);
550 #ifdef IPSEC
551 	{
552 		/* Cause an IPsec SA to be established. */
553 	  	/* error is just ignored */
554 		ipsp_spd_inp(NULL, AF_INET, 0, &error, IPSP_DIRECTION_OUT,
555 		    NULL, inp, NULL);
556 	}
557 #endif
558 	return (0);
559 }
560 
561 void
562 in_pcbdisconnect(struct inpcb *inp)
563 {
564 	switch (sotopf(inp->inp_socket)) {
565 #ifdef INET6
566 	case PF_INET6:
567 		inp->inp_faddr6 = in6addr_any;
568 		break;
569 #endif
570 	case PF_INET:
571 		inp->inp_faddr.s_addr = INADDR_ANY;
572 		break;
573 	}
574 
575 	inp->inp_fport = 0;
576 	in_pcbrehash(inp);
577 	if (inp->inp_socket->so_state & SS_NOFDREF)
578 		in_pcbdetach(inp);
579 }
580 
581 void
582 in_pcbdetach(struct inpcb *inp)
583 {
584 	struct socket *so = inp->inp_socket;
585 
586 	NET_ASSERT_LOCKED();
587 
588 	so->so_pcb = 0;
589 	sofree(so);
590 	m_freem(inp->inp_options);
591 	if (inp->inp_route.ro_rt) {
592 		rtfree(inp->inp_route.ro_rt);
593 		inp->inp_route.ro_rt = NULL;
594 	}
595 #ifdef INET6
596 	if (inp->inp_flags & INP_IPV6) {
597 		ip6_freepcbopts(inp->inp_outputopts6);
598 		ip6_freemoptions(inp->inp_moptions6);
599 	} else
600 #endif
601 		ip_freemoptions(inp->inp_moptions);
602 #if NPF > 0
603 	if (inp->inp_pf_sk) {
604 		pf_remove_divert_state(inp->inp_pf_sk);
605 		/* pf_remove_divert_state() may have detached the state */
606 		pf_inp_unlink(inp);
607 	}
608 #endif
609 	LIST_REMOVE(inp, inp_lhash);
610 	LIST_REMOVE(inp, inp_hash);
611 	TAILQ_REMOVE(&inp->inp_table->inpt_queue, inp, inp_queue);
612 	inp->inp_table->inpt_count--;
613 	pool_put(&inpcb_pool, inp);
614 }
615 
616 void
617 in_setsockaddr(struct inpcb *inp, struct mbuf *nam)
618 {
619 	struct sockaddr_in *sin;
620 
621 	nam->m_len = sizeof(*sin);
622 	sin = mtod(nam, struct sockaddr_in *);
623 	memset(sin, 0, sizeof(*sin));
624 	sin->sin_family = AF_INET;
625 	sin->sin_len = sizeof(*sin);
626 	sin->sin_port = inp->inp_lport;
627 	sin->sin_addr = inp->inp_laddr;
628 }
629 
630 void
631 in_setpeeraddr(struct inpcb *inp, struct mbuf *nam)
632 {
633 	struct sockaddr_in *sin;
634 
635 #ifdef INET6
636 	if (sotopf(inp->inp_socket) == PF_INET6) {
637 		in6_setpeeraddr(inp, nam);
638 		return;
639 	}
640 #endif /* INET6 */
641 
642 	nam->m_len = sizeof(*sin);
643 	sin = mtod(nam, struct sockaddr_in *);
644 	memset(sin, 0, sizeof(*sin));
645 	sin->sin_family = AF_INET;
646 	sin->sin_len = sizeof(*sin);
647 	sin->sin_port = inp->inp_fport;
648 	sin->sin_addr = inp->inp_faddr;
649 }
650 
651 /*
652  * Pass some notification to all connections of a protocol
653  * associated with address dst.  The "usual action" will be
654  * taken, depending on the ctlinput cmd.  The caller must filter any
655  * cmds that are uninteresting (e.g., no error in the map).
656  * Call the protocol specific routine (if any) to report
657  * any errors for each matching socket.
658  */
659 void
660 in_pcbnotifyall(struct inpcbtable *table, struct sockaddr *dst, u_int rdomain,
661     int errno, void (*notify)(struct inpcb *, int))
662 {
663 	struct inpcb *inp, *ninp;
664 	struct in_addr faddr;
665 
666 	NET_ASSERT_LOCKED();
667 
668 #ifdef INET6
669 	/*
670 	 * See in6_pcbnotify() for IPv6 codepath.  By the time this
671 	 * gets called, the addresses passed are either definitely IPv4 or
672 	 * IPv6; *_pcbnotify() never gets called with v4-mapped v6 addresses.
673 	 */
674 #endif /* INET6 */
675 
676 	if (dst->sa_family != AF_INET)
677 		return;
678 	faddr = satosin(dst)->sin_addr;
679 	if (faddr.s_addr == INADDR_ANY)
680 		return;
681 
682 	rdomain = rtable_l2(rdomain);
683 	TAILQ_FOREACH_SAFE(inp, &table->inpt_queue, inp_queue, ninp) {
684 #ifdef INET6
685 		if (inp->inp_flags & INP_IPV6)
686 			continue;
687 #endif
688 		if (inp->inp_faddr.s_addr != faddr.s_addr ||
689 		    rtable_l2(inp->inp_rtableid) != rdomain ||
690 		    inp->inp_socket == 0) {
691 			continue;
692 		}
693 		if (notify)
694 			(*notify)(inp, errno);
695 	}
696 }
697 
698 /*
699  * Check for alternatives when higher level complains
700  * about service problems.  For now, invalidate cached
701  * routing information.  If the route was created dynamically
702  * (by a redirect), time to try a default gateway again.
703  */
704 void
705 in_losing(struct inpcb *inp)
706 {
707 	struct rtentry *rt;
708 	struct rt_addrinfo info;
709 	struct sockaddr_in6 sa_mask;
710 
711 	if ((rt = inp->inp_route.ro_rt)) {
712 		inp->inp_route.ro_rt = 0;
713 
714 		memset(&info, 0, sizeof(info));
715 		info.rti_flags = rt->rt_flags;
716 		info.rti_info[RTAX_DST] = &inp->inp_route.ro_dst;
717 		info.rti_info[RTAX_GATEWAY] = rt->rt_gateway;
718 		info.rti_info[RTAX_NETMASK] = rt_plen2mask(rt, &sa_mask);
719 
720 		KERNEL_LOCK();
721 		rtm_miss(RTM_LOSING, &info, rt->rt_flags, rt->rt_priority,
722 		    rt->rt_ifidx, 0, inp->inp_rtableid);
723 		KERNEL_UNLOCK();
724 		if (rt->rt_flags & RTF_DYNAMIC) {
725 			struct ifnet *ifp;
726 
727 			ifp = if_get(rt->rt_ifidx);
728 			/*
729 			 * If the interface is gone, all its attached
730 			 * route entries have been removed from the table,
731 			 * so we're dealing with a stale cache and have
732 			 * nothing to do.
733 			 */
734 			if (ifp != NULL) {
735 				rtrequest_delete(&info, rt->rt_priority, ifp,
736 				    NULL, inp->inp_rtableid);
737 			}
738 			if_put(ifp);
739 		}
740 		/*
741 		 * A new route can be allocated
742 		 * the next time output is attempted.
743 		 * rtfree() needs to be called in anycase because the inp
744 		 * is still holding a reference to rt.
745 		 */
746 		rtfree(rt);
747 	}
748 }
749 
750 /*
751  * After a routing change, flush old routing
752  * and allocate a (hopefully) better one.
753  */
754 void
755 in_rtchange(struct inpcb *inp, int errno)
756 {
757 	if (inp->inp_route.ro_rt) {
758 		rtfree(inp->inp_route.ro_rt);
759 		inp->inp_route.ro_rt = 0;
760 		/*
761 		 * A new route can be allocated the next time
762 		 * output is attempted.
763 		 */
764 	}
765 }
766 
767 struct inpcb *
768 in_pcblookup_local(struct inpcbtable *table, void *laddrp, u_int lport_arg,
769     int flags, u_int rdomain)
770 {
771 	struct inpcb *inp, *match = NULL;
772 	int matchwild = 3, wildcard;
773 	u_int16_t lport = lport_arg;
774 	struct in_addr laddr = *(struct in_addr *)laddrp;
775 #ifdef INET6
776 	struct in6_addr *laddr6 = (struct in6_addr *)laddrp;
777 #endif
778 	struct inpcbhead *head;
779 
780 	rdomain = rtable_l2(rdomain);	/* convert passed rtableid to rdomain */
781 	head = INPCBLHASH(table, lport, rdomain);
782 	LIST_FOREACH(inp, head, inp_lhash) {
783 		if (rtable_l2(inp->inp_rtableid) != rdomain)
784 			continue;
785 		if (inp->inp_lport != lport)
786 			continue;
787 		wildcard = 0;
788 #ifdef INET6
789 		if (ISSET(flags, INPLOOKUP_IPV6)) {
790 			if (!ISSET(inp->inp_flags, INP_IPV6))
791 				continue;
792 
793 			if (!IN6_IS_ADDR_UNSPECIFIED(&inp->inp_faddr6))
794 				wildcard++;
795 
796 			if (!IN6_ARE_ADDR_EQUAL(&inp->inp_laddr6, laddr6)) {
797 				if (IN6_IS_ADDR_UNSPECIFIED(&inp->inp_laddr6) ||
798 				    IN6_IS_ADDR_UNSPECIFIED(laddr6))
799 					wildcard++;
800 				else
801 					continue;
802 			}
803 
804 		} else
805 #endif /* INET6 */
806 		{
807 #ifdef INET6
808 			if (ISSET(inp->inp_flags, INP_IPV6))
809 				continue;
810 #endif /* INET6 */
811 
812 			if (inp->inp_faddr.s_addr != INADDR_ANY)
813 				wildcard++;
814 
815 			if (inp->inp_laddr.s_addr != laddr.s_addr) {
816 				if (inp->inp_laddr.s_addr == INADDR_ANY ||
817 				    laddr.s_addr == INADDR_ANY)
818 					wildcard++;
819 				else
820 					continue;
821 			}
822 
823 		}
824 		if ((!wildcard || (flags & INPLOOKUP_WILDCARD)) &&
825 		    wildcard < matchwild) {
826 			match = inp;
827 			if ((matchwild = wildcard) == 0)
828 				break;
829 		}
830 	}
831 	return (match);
832 }
833 
834 struct rtentry *
835 in_pcbrtentry(struct inpcb *inp)
836 {
837 	struct route *ro;
838 
839 	ro = &inp->inp_route;
840 
841 	/* check if route is still valid */
842 	if (!rtisvalid(ro->ro_rt)) {
843 		rtfree(ro->ro_rt);
844 		ro->ro_rt = NULL;
845 	}
846 
847 	/*
848 	 * No route yet, so try to acquire one.
849 	 */
850 	if (ro->ro_rt == NULL) {
851 #ifdef INET6
852 		memset(ro, 0, sizeof(struct route_in6));
853 #else
854 		memset(ro, 0, sizeof(struct route));
855 #endif
856 
857 		switch(sotopf(inp->inp_socket)) {
858 #ifdef INET6
859 		case PF_INET6:
860 			if (IN6_IS_ADDR_UNSPECIFIED(&inp->inp_faddr6))
861 				break;
862 			ro->ro_dst.sa_family = AF_INET6;
863 			ro->ro_dst.sa_len = sizeof(struct sockaddr_in6);
864 			satosin6(&ro->ro_dst)->sin6_addr = inp->inp_faddr6;
865 			ro->ro_tableid = inp->inp_rtableid;
866 			ro->ro_rt = rtalloc_mpath(&ro->ro_dst,
867 			    &inp->inp_laddr6.s6_addr32[0], ro->ro_tableid);
868 			break;
869 #endif /* INET6 */
870 		case PF_INET:
871 			if (inp->inp_faddr.s_addr == INADDR_ANY)
872 				break;
873 			ro->ro_dst.sa_family = AF_INET;
874 			ro->ro_dst.sa_len = sizeof(struct sockaddr_in);
875 			satosin(&ro->ro_dst)->sin_addr = inp->inp_faddr;
876 			ro->ro_tableid = inp->inp_rtableid;
877 			ro->ro_rt = rtalloc_mpath(&ro->ro_dst,
878 			    &inp->inp_laddr.s_addr, ro->ro_tableid);
879 			break;
880 		}
881 	}
882 	return (ro->ro_rt);
883 }
884 
885 /*
886  * Return an IPv4 address, which is the most appropriate for a given
887  * destination.
888  * If necessary, this function lookups the routing table and returns
889  * an entry to the caller for later use.
890  */
891 int
892 in_pcbselsrc(struct in_addr **insrc, struct sockaddr_in *sin,
893     struct inpcb *inp)
894 {
895 	struct ip_moptions *mopts = inp->inp_moptions;
896 	struct route *ro = &inp->inp_route;
897 	struct in_addr *laddr = &inp->inp_laddr;
898 	u_int rtableid = inp->inp_rtableid;
899 
900 	struct sockaddr_in *sin2;
901 	struct in_ifaddr *ia = NULL;
902 
903 	/*
904 	 * If the socket(if any) is already bound, use that bound address
905 	 * unless it is INADDR_ANY or INADDR_BROADCAST.
906 	 */
907 	if (laddr && laddr->s_addr != INADDR_ANY &&
908 	    laddr->s_addr != INADDR_BROADCAST) {
909 		*insrc = laddr;
910 		return (0);
911 	}
912 
913 	/*
914 	 * If the destination address is multicast and an outgoing
915 	 * interface has been set as a multicast option, use the
916 	 * address of that interface as our source address.
917 	 */
918 	if (IN_MULTICAST(sin->sin_addr.s_addr) && mopts != NULL) {
919 		struct ifnet *ifp;
920 
921 		ifp = if_get(mopts->imo_ifidx);
922 		if (ifp != NULL) {
923 			if (ifp->if_rdomain == rtable_l2(rtableid))
924 				IFP_TO_IA(ifp, ia);
925 			if (ia == NULL) {
926 				if_put(ifp);
927 				return (EADDRNOTAVAIL);
928 			}
929 
930 			*insrc = &ia->ia_addr.sin_addr;
931 			if_put(ifp);
932 			return (0);
933 		}
934 	}
935 	/*
936 	 * If route is known or can be allocated now,
937 	 * our src addr is taken from the i/f, else punt.
938 	 */
939 	if (!rtisvalid(ro->ro_rt) || (ro->ro_tableid != rtableid) ||
940 	    (satosin(&ro->ro_dst)->sin_addr.s_addr != sin->sin_addr.s_addr)) {
941 		rtfree(ro->ro_rt);
942 		ro->ro_rt = NULL;
943 	}
944 	if (ro->ro_rt == NULL) {
945 		/* No route yet, so try to acquire one */
946 		ro->ro_dst.sa_family = AF_INET;
947 		ro->ro_dst.sa_len = sizeof(struct sockaddr_in);
948 		satosin(&ro->ro_dst)->sin_addr = sin->sin_addr;
949 		ro->ro_tableid = rtableid;
950 		ro->ro_rt = rtalloc_mpath(&ro->ro_dst, NULL, ro->ro_tableid);
951 
952 		/*
953 		 * It is important to zero out the rest of the
954 		 * struct sockaddr_in when mixing v6 & v4!
955 		 */
956 		sin2 = satosin(&ro->ro_dst);
957 		memset(sin2->sin_zero, 0, sizeof(sin2->sin_zero));
958 	}
959 	/*
960 	 * If we found a route, use the address
961 	 * corresponding to the outgoing interface.
962 	 */
963 	if (ro->ro_rt != NULL)
964 		ia = ifatoia(ro->ro_rt->rt_ifa);
965 
966 	if (ia == NULL)
967 		return (EADDRNOTAVAIL);
968 
969 	*insrc = &ia->ia_addr.sin_addr;
970 	return (0);
971 }
972 
973 void
974 in_pcbrehash(struct inpcb *inp)
975 {
976 	struct inpcbtable *table = inp->inp_table;
977 	struct inpcbhead *head;
978 
979 	NET_ASSERT_LOCKED();
980 
981 	LIST_REMOVE(inp, inp_lhash);
982 	head = INPCBLHASH(table, inp->inp_lport, inp->inp_rtableid);
983 	LIST_INSERT_HEAD(head, inp, inp_lhash);
984 	LIST_REMOVE(inp, inp_hash);
985 #ifdef INET6
986 	if (inp->inp_flags & INP_IPV6)
987 		head = IN6PCBHASH(table, &inp->inp_faddr6, inp->inp_fport,
988 		    &inp->inp_laddr6, inp->inp_lport,
989 		    rtable_l2(inp->inp_rtableid));
990 	else
991 #endif /* INET6 */
992 		head = INPCBHASH(table, &inp->inp_faddr, inp->inp_fport,
993 		    &inp->inp_laddr, inp->inp_lport,
994 		    rtable_l2(inp->inp_rtableid));
995 	LIST_INSERT_HEAD(head, inp, inp_hash);
996 }
997 
998 int
999 in_pcbresize(struct inpcbtable *table, int hashsize)
1000 {
1001 	u_long nhash, nlhash;
1002 	void *nhashtbl, *nlhashtbl, *ohashtbl, *olhashtbl;
1003 	struct inpcb *inp0, *inp1;
1004 
1005 	ohashtbl = table->inpt_hashtbl;
1006 	olhashtbl = table->inpt_lhashtbl;
1007 
1008 	nhashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, &nhash);
1009 	nlhashtbl = hashinit(hashsize, M_PCB, M_NOWAIT, &nlhash);
1010 	if (nhashtbl == NULL || nlhashtbl == NULL) {
1011 		if (nhashtbl != NULL)
1012 			free(nhashtbl, M_PCB, 0);
1013 		if (nlhashtbl != NULL)
1014 			free(nlhashtbl, M_PCB, 0);
1015 		return (ENOBUFS);
1016 	}
1017 	table->inpt_hashtbl = nhashtbl;
1018 	table->inpt_lhashtbl = nlhashtbl;
1019 	table->inpt_hash = nhash;
1020 	table->inpt_lhash = nlhash;
1021 	arc4random_buf(&table->inpt_key, sizeof(table->inpt_key));
1022 
1023 	TAILQ_FOREACH_SAFE(inp0, &table->inpt_queue, inp_queue, inp1) {
1024 		in_pcbrehash(inp0);
1025 	}
1026 	free(ohashtbl, M_PCB, 0);
1027 	free(olhashtbl, M_PCB, 0);
1028 
1029 	return (0);
1030 }
1031 
1032 #ifdef DIAGNOSTIC
1033 int	in_pcbnotifymiss = 0;
1034 #endif
1035 
1036 /*
1037  * The in(6)_pcbhashlookup functions are used to locate connected sockets
1038  * quickly:
1039  * 		faddr.fport <-> laddr.lport
1040  * No wildcard matching is done so that listening sockets are not found.
1041  * If the functions return NULL in(6)_pcblookup_listen can be used to
1042  * find a listening/bound socket that may accept the connection.
1043  * After those two lookups no other are necessary.
1044  */
1045 struct inpcb *
1046 in_pcbhashlookup(struct inpcbtable *table, struct in_addr faddr,
1047     u_int fport_arg, struct in_addr laddr, u_int lport_arg, u_int rdomain)
1048 {
1049 	struct inpcbhead *head;
1050 	struct inpcb *inp;
1051 	u_int16_t fport = fport_arg, lport = lport_arg;
1052 
1053 	rdomain = rtable_l2(rdomain);	/* convert passed rtableid to rdomain */
1054 	head = INPCBHASH(table, &faddr, fport, &laddr, lport, rdomain);
1055 	LIST_FOREACH(inp, head, inp_hash) {
1056 #ifdef INET6
1057 		if (inp->inp_flags & INP_IPV6)
1058 			continue;	/*XXX*/
1059 #endif
1060 		if (inp->inp_faddr.s_addr == faddr.s_addr &&
1061 		    inp->inp_fport == fport && inp->inp_lport == lport &&
1062 		    inp->inp_laddr.s_addr == laddr.s_addr &&
1063 		    rtable_l2(inp->inp_rtableid) == rdomain) {
1064 			/*
1065 			 * Move this PCB to the head of hash chain so that
1066 			 * repeated accesses are quicker.  This is analogous to
1067 			 * the historic single-entry PCB cache.
1068 			 */
1069 			if (inp != LIST_FIRST(head)) {
1070 				LIST_REMOVE(inp, inp_hash);
1071 				LIST_INSERT_HEAD(head, inp, inp_hash);
1072 			}
1073 			break;
1074 		}
1075 	}
1076 #ifdef DIAGNOSTIC
1077 	if (inp == NULL && in_pcbnotifymiss) {
1078 		printf("in_pcbhashlookup: faddr=%08x fport=%d laddr=%08x lport=%d rdom=%d\n",
1079 		    ntohl(faddr.s_addr), ntohs(fport),
1080 		    ntohl(laddr.s_addr), ntohs(lport), rdomain);
1081 	}
1082 #endif
1083 	return (inp);
1084 }
1085 
1086 #ifdef INET6
1087 struct inpcb *
1088 in6_pcbhashlookup(struct inpcbtable *table, const struct in6_addr *faddr,
1089     u_int fport_arg, const struct in6_addr *laddr, u_int lport_arg,
1090     u_int rtable)
1091 {
1092 	struct inpcbhead *head;
1093 	struct inpcb *inp;
1094 	u_int16_t fport = fport_arg, lport = lport_arg;
1095 
1096 	rtable = rtable_l2(rtable);	/* convert passed rtableid to rdomain */
1097 	head = IN6PCBHASH(table, faddr, fport, laddr, lport, rtable);
1098 	LIST_FOREACH(inp, head, inp_hash) {
1099 		if (!(inp->inp_flags & INP_IPV6))
1100 			continue;
1101 		if (IN6_ARE_ADDR_EQUAL(&inp->inp_faddr6, faddr) &&
1102 		    inp->inp_fport == fport && inp->inp_lport == lport &&
1103 		    IN6_ARE_ADDR_EQUAL(&inp->inp_laddr6, laddr) &&
1104 		    rtable_l2(inp->inp_rtableid) == rtable) {
1105 			/*
1106 			 * Move this PCB to the head of hash chain so that
1107 			 * repeated accesses are quicker.  This is analogous to
1108 			 * the historic single-entry PCB cache.
1109 			 */
1110 			if (inp != LIST_FIRST(head)) {
1111 				LIST_REMOVE(inp, inp_hash);
1112 				LIST_INSERT_HEAD(head, inp, inp_hash);
1113 			}
1114 			break;
1115 		}
1116 	}
1117 #ifdef DIAGNOSTIC
1118 	if (inp == NULL && in_pcbnotifymiss) {
1119 		printf("in6_pcbhashlookup: faddr=");
1120 		printf(" fport=%d laddr=", ntohs(fport));
1121 		printf(" lport=%d\n", ntohs(lport));
1122 	}
1123 #endif
1124 	return (inp);
1125 }
1126 #endif /* INET6 */
1127 
1128 /*
1129  * The in(6)_pcblookup_listen functions are used to locate listening
1130  * sockets quickly.  This are sockets with unspecified foreign address
1131  * and port:
1132  *		*.*     <-> laddr.lport
1133  *		*.*     <->     *.lport
1134  */
1135 struct inpcb *
1136 in_pcblookup_listen(struct inpcbtable *table, struct in_addr laddr,
1137     u_int lport_arg, int reverse, struct mbuf *m, u_int rdomain)
1138 {
1139 	struct inpcbhead *head;
1140 	struct in_addr *key1, *key2;
1141 	struct inpcb *inp;
1142 	u_int16_t lport = lport_arg;
1143 
1144 	rdomain = rtable_l2(rdomain);	/* convert passed rtableid to rdomain */
1145 #if NPF > 0
1146 	if (m && m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) {
1147 		struct pf_divert *divert;
1148 
1149 		if ((divert = pf_find_divert(m)) == NULL)
1150 			return (NULL);
1151 		key1 = key2 = &divert->addr.v4;
1152 		lport = divert->port;
1153 	} else
1154 #endif
1155 	if (reverse) {
1156 		key1 = &zeroin_addr;
1157 		key2 = &laddr;
1158 	} else {
1159 		key1 = &laddr;
1160 		key2 = &zeroin_addr;
1161 	}
1162 
1163 	head = INPCBHASH(table, &zeroin_addr, 0, key1, lport, rdomain);
1164 	LIST_FOREACH(inp, head, inp_hash) {
1165 #ifdef INET6
1166 		if (inp->inp_flags & INP_IPV6)
1167 			continue;	/*XXX*/
1168 #endif
1169 		if (inp->inp_lport == lport && inp->inp_fport == 0 &&
1170 		    inp->inp_laddr.s_addr == key1->s_addr &&
1171 		    inp->inp_faddr.s_addr == INADDR_ANY &&
1172 		    rtable_l2(inp->inp_rtableid) == rdomain)
1173 			break;
1174 	}
1175 	if (inp == NULL && key1->s_addr != key2->s_addr) {
1176 		head = INPCBHASH(table, &zeroin_addr, 0, key2, lport, rdomain);
1177 		LIST_FOREACH(inp, head, inp_hash) {
1178 #ifdef INET6
1179 			if (inp->inp_flags & INP_IPV6)
1180 				continue;	/*XXX*/
1181 #endif
1182 			if (inp->inp_lport == lport && inp->inp_fport == 0 &&
1183 			    inp->inp_laddr.s_addr == key2->s_addr &&
1184 			    inp->inp_faddr.s_addr == INADDR_ANY &&
1185 			    rtable_l2(inp->inp_rtableid) == rdomain)
1186 				break;
1187 		}
1188 	}
1189 #ifdef DIAGNOSTIC
1190 	if (inp == NULL && in_pcbnotifymiss) {
1191 		printf("in_pcblookup_listen: laddr=%08x lport=%d\n",
1192 		    ntohl(laddr.s_addr), ntohs(lport));
1193 	}
1194 #endif
1195 	/*
1196 	 * Move this PCB to the head of hash chain so that
1197 	 * repeated accesses are quicker.  This is analogous to
1198 	 * the historic single-entry PCB cache.
1199 	 */
1200 	if (inp != NULL && inp != LIST_FIRST(head)) {
1201 		LIST_REMOVE(inp, inp_hash);
1202 		LIST_INSERT_HEAD(head, inp, inp_hash);
1203 	}
1204 	return (inp);
1205 }
1206 
1207 #ifdef INET6
1208 struct inpcb *
1209 in6_pcblookup_listen(struct inpcbtable *table, struct in6_addr *laddr,
1210     u_int lport_arg, int reverse, struct mbuf *m, u_int rtable)
1211 {
1212 	struct inpcbhead *head;
1213 	struct in6_addr *key1, *key2;
1214 	struct inpcb *inp;
1215 	u_int16_t lport = lport_arg;
1216 
1217 	rtable = rtable_l2(rtable);	/* convert passed rtableid to rdomain */
1218 #if NPF > 0
1219 	if (m && m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) {
1220 		struct pf_divert *divert;
1221 
1222 		if ((divert = pf_find_divert(m)) == NULL)
1223 			return (NULL);
1224 		key1 = key2 = &divert->addr.v6;
1225 		lport = divert->port;
1226 	} else
1227 #endif
1228 	if (reverse) {
1229 		key1 = &zeroin6_addr;
1230 		key2 = laddr;
1231 	} else {
1232 		key1 = laddr;
1233 		key2 = &zeroin6_addr;
1234 	}
1235 
1236 	head = IN6PCBHASH(table, &zeroin6_addr, 0, key1, lport, rtable);
1237 	LIST_FOREACH(inp, head, inp_hash) {
1238 		if (!(inp->inp_flags & INP_IPV6))
1239 			continue;
1240 		if (inp->inp_lport == lport && inp->inp_fport == 0 &&
1241 		    IN6_ARE_ADDR_EQUAL(&inp->inp_laddr6, key1) &&
1242 		    IN6_IS_ADDR_UNSPECIFIED(&inp->inp_faddr6) &&
1243 		    rtable_l2(inp->inp_rtableid) == rtable)
1244 			break;
1245 	}
1246 	if (inp == NULL && ! IN6_ARE_ADDR_EQUAL(key1, key2)) {
1247 		head = IN6PCBHASH(table, &zeroin6_addr, 0, key2, lport, rtable);
1248 		LIST_FOREACH(inp, head, inp_hash) {
1249 			if (!(inp->inp_flags & INP_IPV6))
1250 				continue;
1251 			if (inp->inp_lport == lport && inp->inp_fport == 0 &&
1252 			    IN6_ARE_ADDR_EQUAL(&inp->inp_laddr6, key2) &&
1253 			    IN6_IS_ADDR_UNSPECIFIED(&inp->inp_faddr6) &&
1254 			    rtable_l2(inp->inp_rtableid) == rtable)
1255 				break;
1256 		}
1257 	}
1258 #ifdef DIAGNOSTIC
1259 	if (inp == NULL && in_pcbnotifymiss) {
1260 		printf("in6_pcblookup_listen: laddr= lport=%d\n",
1261 		    ntohs(lport));
1262 	}
1263 #endif
1264 	/*
1265 	 * Move this PCB to the head of hash chain so that
1266 	 * repeated accesses are quicker.  This is analogous to
1267 	 * the historic single-entry PCB cache.
1268 	 */
1269 	if (inp != NULL && inp != LIST_FIRST(head)) {
1270 		LIST_REMOVE(inp, inp_hash);
1271 		LIST_INSERT_HEAD(head, inp, inp_hash);
1272 	}
1273 	return (inp);
1274 }
1275 #endif /* INET6 */
1276