sys/netinet/sctp_pcb.c

   1 /*      $KAME: sctp_pcb.c,v 1.37 2004/08/17 06:28:02 t-momose Exp $     */
   2
   3 /*
   4  * Copyright (c) 2001, 2002, 2003, 2004 Cisco Systems, Inc.
   5  * All rights reserved.
   6  *
   7  * Redistribution and use in source and binary forms, with or without
   8  * modification, are permitted provided that the following conditions
   9  * are met:
  10  * 1. Redistributions of source code must retain the above copyright
  11  *    notice, this list of conditions and the following disclaimer.
  12  * 2. Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in the
  14  *    documentation and/or other materials provided with the distribution.
  15  * 3. All advertising materials mentioning features or use of this software
  16  *    must display the following acknowledgement:
  17  *      This product includes software developed by Cisco Systems, Inc.
  18  * 4. Neither the name of the project nor the names of its contributors
  19  *    may be used to endorse or promote products derived from this software
  20  *    without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY CISCO SYSTEMS AND CONTRIBUTORS ``AS IS'' AND
  23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED.  IN NO EVENT SHALL CISCO SYSTEMS OR CONTRIBUTORS BE LIABLE
  26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  32  * SUCH DAMAGE.
  33  */
  34 #if !(defined(__OpenBSD__) || defined(__APPLE__))
  35 #include "opt_ipsec.h"
  36 #endif
  37 #if defined(__FreeBSD__) || defined(__DragonFly__)
  38 #include "opt_compat.h"
  39 #include "opt_inet6.h"
  40 #include "opt_inet.h"
  41 #endif
  42 #if defined(__NetBSD__)
  43 #include "opt_inet.h"
  44 #endif
  45 #ifdef __APPLE__
  46 #include <sctp.h>
  47 #elif !defined(__OpenBSD__)
  48 #include "opt_sctp.h"
  49 #endif
  50
  51 #include <sys/param.h>
  52 #include <sys/systm.h>
  53 #include <sys/malloc.h>
  54 #include <sys/mbuf.h>
  55 #include <sys/domain.h>
  56 #include <sys/protosw.h>
  57 #include <sys/socket.h>
  58 #include <sys/socketvar.h>
  59 #include <sys/proc.h>
  60 #include <sys/priv.h>
  61 #include <sys/kernel.h>
  62 #include <sys/sysctl.h>
  63 #include <sys/thread2.h>
  64 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
  65 #include <sys/random.h>
  66 #endif
  67 #if defined(__NetBSD__)
  68 #include <sys/rnd.h>
  69 #endif
  70 #if defined(__OpenBSD__)
  71 #include <dev/rndvar.h>
  72 #endif
  73
  74 #if defined(__APPLE__)
  75 #include <netinet/sctp_callout.h>
  76 #elif defined(__OpenBSD__)
  77 #include <sys/timeout.h>
  78 #else
  79 #include <sys/callout.h>
  80 #endif
  81
  82 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000)
  83 #include <sys/limits.h>
  84 #else
  85 #include <machine/limits.h>
  86 #endif
  87 #include <machine/cpu.h>
  88
  89 #include <net/if.h>
  90 #include <net/if_types.h>
  91 #include <net/route.h>
  92 #include <netinet/in.h>
  93 #include <netinet/in_systm.h>
  94 #include <netinet/ip.h>
  95 #include <netinet/in_pcb.h>
  96 #include <netinet/in_var.h>
  97 #include <netinet/ip_var.h>
  98
  99 #ifdef INET6
 100 #include <netinet/ip6.h>
 101 #include <netinet6/ip6_var.h>
 102 #include <netinet6/scope6_var.h>
 103 #if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__DragonFly__)
 104 #include <netinet6/in6_pcb.h>
 105 #elif defined(__OpenBSD__)
 106 #include <netinet/in_pcb.h>
 107 #endif
 108 #endif /* INET6 */
 109
 110 #ifdef IPSEC
 111 #ifndef __OpenBSD__
 112 #include <netinet6/ipsec.h>
 113 #include <netproto/key/key.h>
 114 #else
 115 #undef IPSEC
 116 #endif
 117 #endif /* IPSEC */
 118
 119 #include <netinet/sctp_var.h>
 120 #include <netinet/sctp_pcb.h>
 121 #include <netinet/sctputil.h>
 122 #include <netinet/sctp.h>
 123 #include <netinet/sctp_header.h>
 124 #include <netinet/sctp_asconf.h>
 125 #include <netinet/sctp_output.h>
 126 #include <netinet/sctp_timer.h>
 127
 128 #ifndef SCTP_PCBHASHSIZE
 129 /* default number of association hash buckets in each endpoint */
 130 #define SCTP_PCBHASHSIZE 256
 131 #endif
 132
 133 #ifdef SCTP_DEBUG
 134 u_int32_t sctp_debug_on = 0;
 135 #endif /* SCTP_DEBUG */
 136
 137 u_int32_t sctp_pegs[SCTP_NUMBER_OF_PEGS];
 138
 139 int sctp_pcbtblsize = SCTP_PCBHASHSIZE;
 140
 141 struct sctp_epinfo sctppcbinfo;
 142
 143 /* FIX: we don't handle multiple link local scopes */
 144 /* "scopeless" replacement IN6_ARE_ADDR_EQUAL */
 145 int
 146 SCTP6_ARE_ADDR_EQUAL(struct in6_addr *a, struct in6_addr *b)
 147 {
 148         struct in6_addr tmp_a, tmp_b;
 149         /* use a copy of a and b */
 150         tmp_a = *a;
 151         tmp_b = *b;
 152         in6_clearscope(&tmp_a);
 153         in6_clearscope(&tmp_b);
 154         return (IN6_ARE_ADDR_EQUAL(&tmp_a, &tmp_b));
 155 }
 156
 157 #ifdef __OpenBSD__
 158 extern int ipport_firstauto;
 159 extern int ipport_lastauto;
 160 extern int ipport_hifirstauto;
 161 extern int ipport_hilastauto;
 162 #endif
 163
 164 #if defined(__FreeBSD__) && __FreeBSD_version > 500000
 165
 166 #ifndef xyzzy
 167 void sctp_validate_no_locks(void);
 168
 169 void
 170 SCTP_INP_RLOCK(struct sctp_inpcb *inp)
 171 {
 172         struct sctp_tcb *stcb;
 173         LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
 174                 if (mtx_owned(&(stcb)->tcb_mtx))
 175                         panic("I own TCB lock?");
 176         }
 177         if (mtx_owned(&(inp)->inp_mtx))
 178                 panic("INP Recursive Lock-R");
 179         mtx_lock(&(inp)->inp_mtx);
 180 }
 181
 182 void
 183 SCTP_INP_WLOCK(struct sctp_inpcb *inp)
 184 {
 185         SCTP_INP_RLOCK(inp);
 186 }
 187
 188 void
 189 SCTP_INP_INFO_RLOCK(void)
 190 {
 191         struct sctp_inpcb *inp;
 192         struct sctp_tcb *stcb;
 193         LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) {
 194                 if (mtx_owned(&(inp)->inp_mtx))
 195                         panic("info-lock and own inp lock?");
 196                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
 197                         if (mtx_owned(&(stcb)->tcb_mtx))
 198                                 panic("Info lock and own a tcb lock?");
 199                 }
 200         }
 201         if (mtx_owned(&sctppcbinfo.ipi_ep_mtx))
 202                 panic("INP INFO Recursive Lock-R");
 203         mtx_lock(&sctppcbinfo.ipi_ep_mtx);
 204 }
 205
 206 void
 207 SCTP_INP_INFO_WLOCK(void)
 208 {
 209         SCTP_INP_INFO_RLOCK();
 210 }
 211
 212
 213 void sctp_validate_no_locks(void)
 214 {
 215         struct sctp_inpcb *inp;
 216         struct sctp_tcb *stcb;
 217
 218         if (mtx_owned(&sctppcbinfo.ipi_ep_mtx))
 219                 panic("INP INFO lock is owned?");
 220
 221         LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) {
 222                 if (mtx_owned(&(inp)->inp_mtx))
 223                         panic("You own an INP lock?");
 224                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
 225                         if (mtx_owned(&(stcb)->tcb_mtx))
 226                                 panic("You own a TCB lock?");
 227                 }
 228         }
 229 }
 230
 231 #endif
 232 #endif
 233
 234 void
 235 sctp_fill_pcbinfo(struct sctp_pcbinfo *spcb)
 236 {
 237         /* We really don't need
 238          * to lock this, but I will
 239          * just because it does not hurt.
 240          */
 241         SCTP_INP_INFO_RLOCK();
 242         spcb->ep_count = sctppcbinfo.ipi_count_ep;
 243         spcb->asoc_count = sctppcbinfo.ipi_count_asoc;
 244         spcb->laddr_count = sctppcbinfo.ipi_count_laddr;
 245         spcb->raddr_count = sctppcbinfo.ipi_count_raddr;
 246         spcb->chk_count = sctppcbinfo.ipi_count_chunk;
 247         spcb->sockq_count = sctppcbinfo.ipi_count_sockq;
 248         spcb->mbuf_track = sctppcbinfo.mbuf_track;
 249         SCTP_INP_INFO_RUNLOCK();
 250 }
 251
 252
 253 /*
 254  * Notes on locks for FreeBSD 5 and up. All association
 255  * lookups that have a definte ep, the INP structure is
 256  * assumed to be locked for reading. If we need to go
 257  * find the INP (ususally when a **inp is passed) then
 258  * we must lock the INFO structure first and if needed
 259  * lock the INP too. Note that if we lock it we must
 260  *
 261  */
 262
 263
 264 /*
 265  * Given a endpoint, look and find in its association list any association
 266  * with the "to" address given. This can be a "from" address, too, for
 267  * inbound packets. For outbound packets it is a true "to" address.
 268  */
 269 static struct sctp_tcb *
 270 sctp_tcb_special_locate(struct sctp_inpcb **inp_p, struct sockaddr *from,
 271                         struct sockaddr *to, struct sctp_nets **netp)
 272 {
 273         /**** ASSUMSES THE CALLER holds the INP_INFO_RLOCK */
 274
 275         /*
 276          * Note for this module care must be taken when observing what to is
 277          * for. In most of the rest of the code the TO field represents my
 278          * peer and the FROM field represents my address. For this module it
 279          * is reversed of that.
 280          */
 281         /*
 282          * If we support the TCP model, then we must now dig through to
 283          * see if we can find our endpoint in the list of tcp ep's.
 284          */
 285         uint16_t lport, rport;
 286         struct sctppcbhead *ephead;
 287         struct sctp_inpcb *inp;
 288         struct sctp_laddr *laddr;
 289         struct sctp_tcb *stcb;
 290         struct sctp_nets *net;
 291
 292         if ((to == NULL) || (from == NULL)) {
 293                 return (NULL);
 294         }
 295
 296         if (to->sa_family == AF_INET && from->sa_family == AF_INET) {
 297                 lport = ((struct sockaddr_in *)to)->sin_port;
 298                 rport = ((struct sockaddr_in *)from)->sin_port;
 299         } else if (to->sa_family == AF_INET6 && from->sa_family == AF_INET6) {
 300                 lport = ((struct sockaddr_in6 *)to)->sin6_port;
 301                 rport = ((struct sockaddr_in6 *)from)->sin6_port;
 302         } else {
 303                 return NULL;
 304         }
 305         ephead = &sctppcbinfo.sctp_tcpephash[SCTP_PCBHASH_ALLADDR(
 306                                                      (lport + rport), sctppcbinfo.hashtcpmark)];
 307         /*
 308          * Ok now for each of the guys in this bucket we must look
 309          * and see:
 310          *  - Does the remote port match.
 311          *  - Does there single association's addresses match this
 312          *    address (to).
 313          * If so we update p_ep to point to this ep and return the
 314          * tcb from it.
 315          */
 316         LIST_FOREACH(inp, ephead, sctp_hash) {
 317                 if (lport != inp->sctp_lport) {
 318                         continue;
 319                 }
 320                 SCTP_INP_RLOCK(inp);
 321                 /* check to see if the ep has one of the addresses */
 322                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
 323                         /* We are NOT bound all, so look further */
 324                         int match = 0;
 325
 326                         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
 327                                 if (laddr->ifa == NULL) {
 328 #ifdef SCTP_DEBUG
 329                                         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 330                                                 kprintf("An ounce of prevention is worth a pound of cure\n");
 331                                         }
 332 #endif
 333                                         continue;
 334                                 }
 335                                 if (laddr->ifa->ifa_addr == NULL) {
 336 #ifdef SCTP_DEBUG
 337                                         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 338                                                 kprintf("ifa with a NULL address\n");
 339                                         }
 340 #endif
 341                                         continue;
 342                                 }
 343                                 if (laddr->ifa->ifa_addr->sa_family ==
 344                                     to->sa_family) {
 345                                         /* see if it matches */
 346                                         struct sockaddr_in *intf_addr, *sin;
 347                                         intf_addr = (struct sockaddr_in *)
 348                                                 laddr->ifa->ifa_addr;
 349                                         sin = (struct sockaddr_in *)to;
 350                                         if (from->sa_family == AF_INET) {
 351                                                 if (sin->sin_addr.s_addr ==
 352                                                     intf_addr->sin_addr.s_addr) {
 353                                                         match = 1;
 354                                                         SCTP_INP_RUNLOCK(inp);
 355                                                         break;
 356                                                 }
 357                                         } else {
 358                                                 struct sockaddr_in6 *intf_addr6;
 359                                                 struct sockaddr_in6 *sin6;
 360                                                 sin6 = (struct sockaddr_in6 *)
 361                                                         to;
 362                                                 intf_addr6 = (struct sockaddr_in6 *)
 363                                                         laddr->ifa->ifa_addr;
 364
 365                                                 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
 366                                                                          &intf_addr6->sin6_addr)) {
 367                                                         match = 1;
 368                                                         SCTP_INP_RUNLOCK(inp);
 369                                                         break;
 370                                                 }
 371                                         }
 372                                 }
 373                         }
 374                         if (match == 0) {
 375                                 /* This endpoint does not have this address */
 376                                 SCTP_INP_RUNLOCK(inp);
 377                                 continue;
 378                         }
 379                 }
 380                 /*
 381                  * Ok if we hit here the ep has the address, does it hold the
 382                  * tcb?
 383                  */
 384
 385                 stcb = LIST_FIRST(&inp->sctp_asoc_list);
 386                 if (stcb == NULL) {
 387                         SCTP_INP_RUNLOCK(inp);
 388                         continue;
 389                 }
 390                 SCTP_TCB_LOCK(stcb);
 391                 if (stcb->rport != rport) {
 392                         /* remote port does not match. */
 393                         SCTP_TCB_UNLOCK(stcb);
 394                         SCTP_INP_RUNLOCK(inp);
 395                         continue;
 396                 }
 397                 /* Does this TCB have a matching address? */
 398                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 399                         if (net->ro._l_addr.sa.sa_family != from->sa_family) {
 400                                 /* not the same family, can't be a match */
 401                                 continue;
 402                         }
 403                         if (from->sa_family == AF_INET) {
 404                                 struct sockaddr_in *sin, *rsin;
 405                                 sin = (struct sockaddr_in *)&net->ro._l_addr;
 406                                 rsin = (struct sockaddr_in *)from;
 407                                 if (sin->sin_addr.s_addr ==
 408                                     rsin->sin_addr.s_addr) {
 409                                         /* found it */
 410                                         if (netp != NULL) {
 411                                                 *netp = net;
 412                                         }
 413                                         /* Update the endpoint pointer */
 414                                         *inp_p = inp;
 415                                         SCTP_INP_RUNLOCK(inp);
 416                                         return (stcb);
 417                                 }
 418                         } else {
 419                                 struct sockaddr_in6 *sin6, *rsin6;
 420                                 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
 421                                 rsin6 = (struct sockaddr_in6 *)from;
 422                                 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
 423                                                          &rsin6->sin6_addr)) {
 424                                         /* found it */
 425                                         if (netp != NULL) {
 426                                                 *netp = net;
 427                                         }
 428                                         /* Update the endpoint pointer */
 429                                         *inp_p = inp;
 430                                         SCTP_INP_RUNLOCK(inp);
 431                                         return (stcb);
 432                                 }
 433                         }
 434                 }
 435                 SCTP_TCB_UNLOCK(stcb);
 436
 437                 SCTP_INP_RUNLOCK(inp);
 438         }
 439         return (NULL);
 440 }
 441
 442 struct sctp_tcb *
 443 sctp_findassociation_ep_asconf(struct mbuf *m, int iphlen, int offset,
 444     struct sctphdr *sh, struct sctp_inpcb **inp_p, struct sctp_nets **netp)
 445 {
 446         struct sctp_tcb *stcb;
 447         struct sockaddr_in *sin;
 448         struct sockaddr_in6 *sin6;
 449         struct sockaddr_storage local_store, remote_store;
 450         struct ip *iph;
 451         struct sctp_paramhdr parm_buf, *phdr;
 452         int ptype;
 453
 454         memset(&local_store, 0, sizeof(local_store));
 455         memset(&remote_store, 0, sizeof(remote_store));
 456
 457         /* First get the destination address setup too. */
 458         iph = mtod(m, struct ip *);
 459         if (iph->ip_v == IPVERSION) {
 460                 /* its IPv4 */
 461                 sin = (struct sockaddr_in *)&local_store;
 462                 sin->sin_family = AF_INET;
 463                 sin->sin_len = sizeof(*sin);
 464                 sin->sin_port = sh->dest_port;
 465                 sin->sin_addr.s_addr = iph->ip_dst.s_addr ;
 466         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
 467                 /* its IPv6 */
 468                 struct ip6_hdr *ip6;
 469                 ip6 = mtod(m, struct ip6_hdr *);
 470                 sin6 = (struct sockaddr_in6 *)&local_store;
 471                 sin6->sin6_family = AF_INET6;
 472                 sin6->sin6_len = sizeof(*sin6);
 473                 sin6->sin6_port = sh->dest_port;
 474                 sin6->sin6_addr = ip6->ip6_dst;
 475         } else {
 476                 return NULL;
 477         }
 478
 479         phdr = sctp_get_next_param(m, offset + sizeof(struct sctp_asconf_chunk),
 480             &parm_buf, sizeof(struct sctp_paramhdr));
 481         if (phdr == NULL) {
 482 #ifdef SCTP_DEBUG
 483                 if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
 484                         kprintf("sctp_process_control: failed to get asconf lookup addr\n");
 485                 }
 486 #endif /* SCTP_DEBUG */
 487                 return NULL;
 488         }
 489         ptype = (int)((u_int)ntohs(phdr->param_type));
 490         /* get the correlation address */
 491         if (ptype == SCTP_IPV6_ADDRESS) {
 492                 /* ipv6 address param */
 493                 struct sctp_ipv6addr_param *p6, p6_buf;
 494                 if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv6addr_param)) {
 495                         return NULL;
 496                 }
 497
 498                 p6 = (struct sctp_ipv6addr_param *)sctp_get_next_param(m,
 499                     offset + sizeof(struct sctp_asconf_chunk),
 500                     &p6_buf.ph, sizeof(*p6));
 501                 if (p6 == NULL) {
 502 #ifdef SCTP_DEBUG
 503                         if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
 504                                 kprintf("sctp_process_control: failed to get asconf v6 lookup addr\n");
 505                         }
 506 #endif /* SCTP_DEBUG */
 507                         return (NULL);
 508                 }
 509                 sin6 = (struct sockaddr_in6 *)&remote_store;
 510                 sin6->sin6_family = AF_INET6;
 511                 sin6->sin6_len = sizeof(*sin6);
 512                 sin6->sin6_port = sh->src_port;
 513                 memcpy(&sin6->sin6_addr, &p6->addr, sizeof(struct in6_addr));
 514         } else if (ptype == SCTP_IPV4_ADDRESS) {
 515                 /* ipv4 address param */
 516                 struct sctp_ipv4addr_param *p4, p4_buf;
 517                 if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv4addr_param)) {
 518                         return NULL;
 519                 }
 520
 521                 p4 = (struct sctp_ipv4addr_param *)sctp_get_next_param(m,
 522                     offset + sizeof(struct sctp_asconf_chunk),
 523                     &p4_buf.ph, sizeof(*p4));
 524                 if (p4 == NULL) {
 525 #ifdef SCTP_DEBUG
 526                         if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
 527                                 kprintf("sctp_process_control: failed to get asconf v4 lookup addr\n");
 528                         }
 529 #endif /* SCTP_DEBUG */
 530                         return (NULL);
 531                 }
 532                 sin = (struct sockaddr_in *)&remote_store;
 533                 sin->sin_family = AF_INET;
 534                 sin->sin_len = sizeof(*sin);
 535                 sin->sin_port = sh->src_port;
 536                 memcpy(&sin->sin_addr, &p4->addr, sizeof(struct in_addr));
 537         } else {
 538                 /* invalid address param type */
 539                 return NULL;
 540         }
 541
 542         stcb = sctp_findassociation_ep_addr(inp_p,
 543             (struct sockaddr *)&remote_store, netp,
 544             (struct sockaddr *)&local_store, NULL);
 545         return (stcb);
 546 }
 547
 548 struct sctp_tcb *
 549 sctp_findassociation_ep_addr(struct sctp_inpcb **inp_p, struct sockaddr *remote,
 550     struct sctp_nets **netp, struct sockaddr *local, struct sctp_tcb *locked_tcb)
 551 {
 552         struct sctpasochead *head;
 553         struct sctp_inpcb *inp;
 554         struct sctp_tcb *stcb;
 555         struct sctp_nets *net;
 556         uint16_t rport;
 557
 558         inp = *inp_p;
 559         if (remote->sa_family == AF_INET) {
 560                 rport = (((struct sockaddr_in *)remote)->sin_port);
 561         } else if (remote->sa_family == AF_INET6) {
 562                 rport = (((struct sockaddr_in6 *)remote)->sin6_port);
 563         } else {
 564                 return (NULL);
 565         }
 566         if (locked_tcb) {
 567                 /* UN-lock so we can do proper locking here
 568                  * this occurs when called from load_addresses_from_init.
 569                  */
 570                 SCTP_TCB_UNLOCK(locked_tcb);
 571         }
 572         SCTP_INP_INFO_RLOCK();
 573         if (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
 574                 /*
 575                  * Now either this guy is our listner or it's the connector.
 576                  * If it is the one that issued the connect, then it's only
 577                  * chance is to be the first TCB in the list. If it is the
 578                  * acceptor, then do the special_lookup to hash and find the
 579                  * real inp.
 580                  */
 581                 if (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING) {
 582                         /* to is peer addr, from is my addr */
 583                         stcb = sctp_tcb_special_locate(inp_p, remote, local,
 584                                                        netp);
 585                         if ((stcb != NULL) && (locked_tcb == NULL)){
 586                                 /* we have a locked tcb, lower refcount */
 587                                 SCTP_INP_WLOCK(inp);
 588                                 SCTP_INP_DECR_REF(inp);
 589                                 SCTP_INP_WUNLOCK(inp);
 590                         }
 591                         if (locked_tcb != NULL) {
 592                                 SCTP_INP_RLOCK(locked_tcb->sctp_ep);
 593                                 SCTP_TCB_LOCK(locked_tcb);
 594                                 SCTP_INP_RUNLOCK(locked_tcb->sctp_ep);
 595                                 if (stcb != NULL)
 596                                         SCTP_TCB_UNLOCK(stcb);
 597                         }
 598                         SCTP_INP_INFO_RUNLOCK();
 599                         return (stcb);
 600                 } else {
 601                         SCTP_INP_WLOCK(inp);
 602                         stcb = LIST_FIRST(&inp->sctp_asoc_list);
 603                         if (stcb == NULL) {
 604                                 goto null_return;
 605                         }
 606                         SCTP_TCB_LOCK(stcb);
 607                         if (stcb->rport != rport) {
 608                                 /* remote port does not match. */
 609                                 SCTP_TCB_UNLOCK(stcb);
 610                                 goto null_return;
 611                         }
 612                         /* now look at the list of remote addresses */
 613                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 614                                 if (net->ro._l_addr.sa.sa_family !=
 615                                     remote->sa_family) {
 616                                         /* not the same family */
 617                                         continue;
 618                                 }
 619                                 if (remote->sa_family == AF_INET) {
 620                                         struct sockaddr_in *sin, *rsin;
 621                                         sin = (struct sockaddr_in *)
 622                                                 &net->ro._l_addr;
 623                                         rsin = (struct sockaddr_in *)remote;
 624                                         if (sin->sin_addr.s_addr ==
 625                                             rsin->sin_addr.s_addr) {
 626                                                 /* found it */
 627                                                 if (netp != NULL) {
 628                                                         *netp = net;
 629                                                 }
 630                                                 if (locked_tcb == NULL) {
 631                                                         SCTP_INP_DECR_REF(inp);
 632                                                 }
 633                                                 SCTP_INP_WUNLOCK(inp);
 634                                                 SCTP_INP_INFO_RUNLOCK();
 635                                                 return (stcb);
 636                                         }
 637                                 } else if (remote->sa_family == AF_INET6) {
 638                                         struct sockaddr_in6 *sin6, *rsin6;
 639                                         sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
 640                                         rsin6 = (struct sockaddr_in6 *)remote;
 641                                         if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
 642                                                                  &rsin6->sin6_addr)) {
 643                                                 /* found it */
 644                                                 if (netp != NULL) {
 645                                                         *netp = net;
 646                                                 }
 647                                                 if (locked_tcb == NULL) {
 648                                                         SCTP_INP_DECR_REF(inp);
 649                                                 }
 650                                                 SCTP_INP_WUNLOCK(inp);
 651                                                 SCTP_INP_INFO_RUNLOCK();
 652                                                 return (stcb);
 653                                         }
 654                                 }
 655                         }
 656                         SCTP_TCB_UNLOCK(stcb);
 657                 }
 658         } else {
 659                 SCTP_INP_WLOCK(inp);
 660                 head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(rport,
 661                                                                inp->sctp_hashmark)];
 662                 if (head == NULL) {
 663                         goto null_return;
 664                 }
 665                 LIST_FOREACH(stcb, head, sctp_tcbhash) {
 666                         if (stcb->rport != rport) {
 667                                 /* remote port does not match */
 668                                 continue;
 669                         }
 670                         /* now look at the list of remote addresses */
 671                         SCTP_TCB_LOCK(stcb);
 672                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 673                                 if (net->ro._l_addr.sa.sa_family !=
 674                                     remote->sa_family) {
 675                                         /* not the same family */
 676                                         continue;
 677                                 }
 678                                 if (remote->sa_family == AF_INET) {
 679                                         struct sockaddr_in *sin, *rsin;
 680                                         sin = (struct sockaddr_in *)
 681                                                 &net->ro._l_addr;
 682                                         rsin = (struct sockaddr_in *)remote;
 683                                         if (sin->sin_addr.s_addr ==
 684                                             rsin->sin_addr.s_addr) {
 685                                                 /* found it */
 686                                                 if (netp != NULL) {
 687                                                         *netp = net;
 688                                                 }
 689                                                 if (locked_tcb == NULL) {
 690                                                         SCTP_INP_DECR_REF(inp);
 691                                                 }
 692                                                 SCTP_INP_WUNLOCK(inp);
 693                                                 SCTP_INP_INFO_RUNLOCK();
 694                                                 return (stcb);
 695                                         }
 696                                 } else if (remote->sa_family == AF_INET6) {
 697                                         struct sockaddr_in6 *sin6, *rsin6;
 698                                         sin6 = (struct sockaddr_in6 *)
 699                                                 &net->ro._l_addr;
 700                                         rsin6 = (struct sockaddr_in6 *)remote;
 701                                         if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
 702                                                                  &rsin6->sin6_addr)) {
 703                                                 /* found it */
 704                                                 if (netp != NULL) {
 705                                                         *netp = net;
 706                                                 }
 707                                                 if (locked_tcb == NULL) {
 708                                                         SCTP_INP_DECR_REF(inp);
 709                                                 }
 710                                                 SCTP_INP_WUNLOCK(inp);
 711                                                 SCTP_INP_INFO_RUNLOCK();
 712                                                 return (stcb);
 713                                         }
 714                                 }
 715                         }
 716                         SCTP_TCB_UNLOCK(stcb);
 717                 }
 718         }
 719  null_return:
 720         /* clean up for returning null */
 721         if (locked_tcb){
 722                 if (locked_tcb->sctp_ep != inp) {
 723                         SCTP_INP_RLOCK(locked_tcb->sctp_ep);
 724                         SCTP_TCB_LOCK(locked_tcb);
 725                         SCTP_INP_RUNLOCK(locked_tcb->sctp_ep);
 726                 } else
 727                         SCTP_TCB_LOCK(locked_tcb);
 728         }
 729         SCTP_INP_WUNLOCK(inp);
 730         SCTP_INP_INFO_RUNLOCK();
 731         /* not found */
 732         return (NULL);
 733 }
 734
 735 /*
 736  * Find an association for a specific endpoint using the association id
 737  * given out in the COMM_UP notification
 738  */
 739 struct sctp_tcb *
 740 sctp_findassociation_ep_asocid(struct sctp_inpcb *inp, caddr_t asoc_id)
 741 {
 742         /*
 743          * Use my the assoc_id to find a endpoint
 744          */
 745         struct sctpasochead *head;
 746         struct sctp_tcb *stcb;
 747         u_int32_t vtag;
 748
 749         if (asoc_id == 0 || inp == NULL) {
 750                 return (NULL);
 751         }
 752         SCTP_INP_INFO_RLOCK();
 753         vtag = (u_int32_t)(uintptr_t)asoc_id;
 754         head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(vtag,
 755             sctppcbinfo.hashasocmark)];
 756         if (head == NULL) {
 757                 /* invalid vtag */
 758                 SCTP_INP_INFO_RUNLOCK();
 759                 return (NULL);
 760         }
 761         LIST_FOREACH(stcb, head, sctp_asocs) {
 762                 SCTP_INP_RLOCK(stcb->sctp_ep);
 763                 SCTP_TCB_LOCK(stcb);
 764                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
 765                 if (stcb->asoc.my_vtag == vtag) {
 766                         /* candidate */
 767                         if (inp != stcb->sctp_ep) {
 768                                 /* some other guy has the
 769                                  * same vtag active (vtag collision).
 770                                  */
 771                                 sctp_pegs[SCTP_VTAG_BOGUS]++;
 772                                 SCTP_TCB_UNLOCK(stcb);
 773                                 continue;
 774                         }
 775                         sctp_pegs[SCTP_VTAG_EXPR]++;
 776                         SCTP_INP_INFO_RUNLOCK();
 777                         return (stcb);
 778                 }
 779                 SCTP_TCB_UNLOCK(stcb);
 780         }
 781         SCTP_INP_INFO_RUNLOCK();
 782         return (NULL);
 783 }
 784
 785 static struct sctp_inpcb *
 786 sctp_endpoint_probe(struct sockaddr *nam, struct sctppcbhead *head,
 787                     uint16_t lport)
 788 {
 789         struct sctp_inpcb *inp;
 790         struct sockaddr_in *sin;
 791         struct sockaddr_in6 *sin6;
 792         struct sctp_laddr *laddr;
 793
 794         /* Endpoing probe expects
 795          * that the INP_INFO is locked.
 796          */
 797         if (nam->sa_family == AF_INET) {
 798                 sin = (struct sockaddr_in *)nam;
 799                 sin6 = NULL;
 800         } else if (nam->sa_family == AF_INET6) {
 801                 sin6 = (struct sockaddr_in6 *)nam;
 802                 sin = NULL;
 803         } else {
 804                 /* unsupported family */
 805                 return (NULL);
 806         }
 807         if (head == NULL)
 808                 return (NULL);
 809
 810         LIST_FOREACH(inp, head, sctp_hash) {
 811                 SCTP_INP_RLOCK(inp);
 812
 813                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) &&
 814                     (inp->sctp_lport == lport)) {
 815                         /* got it */
 816                         if ((nam->sa_family == AF_INET) &&
 817                             (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
 818 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
 819                             (((struct inpcb *)inp)->inp_flags & IN6P_IPV6_V6ONLY)
 820 #else
 821 #if defined(__OpenBSD__)
 822                             (0) /* For open bsd we do dual bind only */
 823 #else
 824                             (((struct in6pcb *)inp)->in6p_flags & IN6P_IPV6_V6ONLY)
 825 #endif
 826 #endif
 827                                 ) {
 828                                 /* IPv4 on a IPv6 socket with ONLY IPv6 set */
 829                                 SCTP_INP_RUNLOCK(inp);
 830                                 continue;
 831                         }
 832                         /* A V6 address and the endpoint is NOT bound V6 */
 833                         if (nam->sa_family == AF_INET6 &&
 834                            (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
 835                                 SCTP_INP_RUNLOCK(inp);
 836                                 continue;
 837                         }
 838                         SCTP_INP_RUNLOCK(inp);
 839                         return (inp);
 840                 }
 841                 SCTP_INP_RUNLOCK(inp);
 842         }
 843
 844         if ((nam->sa_family == AF_INET) &&
 845             (sin->sin_addr.s_addr == INADDR_ANY)) {
 846                 /* Can't hunt for one that has no address specified */
 847                 return (NULL);
 848         } else if ((nam->sa_family == AF_INET6) &&
 849                    (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))) {
 850                 /* Can't hunt for one that has no address specified */
 851                 return (NULL);
 852         }
 853         /*
 854          * ok, not bound to all so see if we can find a EP bound to this
 855          * address.
 856          */
 857 #ifdef SCTP_DEBUG
 858         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 859                 kprintf("Ok, there is NO bound-all available for port:%x\n", ntohs(lport));
 860         }
 861 #endif
 862         LIST_FOREACH(inp, head, sctp_hash) {
 863                 SCTP_INP_RLOCK(inp);
 864                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)) {
 865                         SCTP_INP_RUNLOCK(inp);
 866                         continue;
 867                 }
 868                 /*
 869                  * Ok this could be a likely candidate, look at all of
 870                  * its addresses
 871                  */
 872                 if (inp->sctp_lport != lport) {
 873                         SCTP_INP_RUNLOCK(inp);
 874                         continue;
 875                 }
 876 #ifdef SCTP_DEBUG
 877                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 878                         kprintf("Ok, found matching local port\n");
 879                 }
 880 #endif
 881                 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
 882                         if (laddr->ifa == NULL) {
 883 #ifdef SCTP_DEBUG
 884                                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 885                                         kprintf("An ounce of prevention is worth a pound of cure\n");
 886                                 }
 887 #endif
 888                                 continue;
 889                         }
 890 #ifdef SCTP_DEBUG
 891                         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 892                                 kprintf("Ok laddr->ifa:%p is possible, ",
 893                                     laddr->ifa);
 894                         }
 895 #endif
 896                         if (laddr->ifa->ifa_addr == NULL) {
 897 #ifdef SCTP_DEBUG
 898                                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 899                                         kprintf("Huh IFA as an ifa_addr=NULL, ");
 900                                 }
 901 #endif
 902                                 continue;
 903                         }
 904 #ifdef SCTP_DEBUG
 905                         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 906                                 kprintf("Ok laddr->ifa:%p is possible, ",
 907                                     laddr->ifa->ifa_addr);
 908                                 sctp_print_address(laddr->ifa->ifa_addr);
 909                                 kprintf("looking for ");
 910                                 sctp_print_address(nam);
 911                         }
 912 #endif
 913                         if (laddr->ifa->ifa_addr->sa_family == nam->sa_family) {
 914                                 /* possible, see if it matches */
 915                                 struct sockaddr_in *intf_addr;
 916                                 intf_addr = (struct sockaddr_in *)
 917                                     laddr->ifa->ifa_addr;
 918                                 if (nam->sa_family == AF_INET) {
 919                                         if (sin->sin_addr.s_addr ==
 920                                             intf_addr->sin_addr.s_addr) {
 921 #ifdef SCTP_DEBUG
 922                                                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 923                                                         kprintf("YES, return ep:%p\n", inp);
 924                                                 }
 925 #endif
 926                                                 SCTP_INP_RUNLOCK(inp);
 927                                                 return (inp);
 928                                         }
 929                                 } else if (nam->sa_family == AF_INET6) {
 930                                         struct sockaddr_in6 *intf_addr6;
 931                                         intf_addr6 = (struct sockaddr_in6 *)
 932                                             laddr->ifa->ifa_addr;
 933                                         if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
 934                                             &intf_addr6->sin6_addr)) {
 935 #ifdef SCTP_DEBUG
 936                                                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 937                                                         kprintf("YES, return ep:%p\n", inp);
 938                                                 }
 939 #endif
 940                                                 SCTP_INP_RUNLOCK(inp);
 941                                                 return (inp);
 942                                         }
 943                                 }
 944                         }
 945                         SCTP_INP_RUNLOCK(inp);
 946                 }
 947         }
 948 #ifdef SCTP_DEBUG
 949         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 950                 kprintf("NO, Falls out to NULL\n");
 951         }
 952 #endif
 953         return (NULL);
 954 }
 955
 956
 957 struct sctp_inpcb *
 958 sctp_pcb_findep(struct sockaddr *nam, int find_tcp_pool, int have_lock)
 959 {
 960         /*
 961          * First we check the hash table to see if someone has this port
 962          * bound with just the port.
 963          */
 964         struct sctp_inpcb *inp;
 965         struct sctppcbhead *head;
 966         int lport;
 967 #ifdef SCTP_DEBUG
 968         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 969                 kprintf("Looking for endpoint %d :",
 970                        ntohs(((struct sockaddr_in *)nam)->sin_port));
 971                 sctp_print_address(nam);
 972         }
 973 #endif
 974         if (nam->sa_family == AF_INET) {
 975                 lport = ((struct sockaddr_in *)nam)->sin_port;
 976         } else if (nam->sa_family == AF_INET6) {
 977                 lport = ((struct sockaddr_in6 *)nam)->sin6_port;
 978         } else {
 979                 /* unsupported family */
 980                 return (NULL);
 981         }
 982         /*
 983          * I could cheat here and just cast to one of the types but we will
 984          * do it right. It also provides the check against an Unsupported
 985          * type too.
 986          */
 987         /* Find the head of the ALLADDR chain */
 988         if (have_lock == 0)
 989                 SCTP_INP_INFO_RLOCK();
 990         head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport,
 991                                                              sctppcbinfo.hashmark)];
 992 #ifdef SCTP_DEBUG
 993         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 994                 kprintf("Main hash to lookup at head:%p\n", head);
 995         }
 996 #endif
 997         inp = sctp_endpoint_probe(nam, head, lport);
 998
 999         /*
1000          * If the TCP model exists it could be that the main listening
1001          * endpoint is gone but there exists a connected socket for this
1002          * guy yet. If so we can return the first one that we find. This
1003          * may NOT be the correct one but the sctp_findassociation_ep_addr
1004          * has further code to look at all TCP models.
1005          */
1006         if (inp == NULL && find_tcp_pool) {
1007                 unsigned int i;
1008 #ifdef SCTP_DEBUG
1009                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
1010                         kprintf("EP was NULL and TCP model is supported\n");
1011                 }
1012 #endif
1013                 for (i = 0; i < sctppcbinfo.hashtblsize; i++) {
1014                         /*
1015                          * This is real gross, but we do NOT have a remote
1016                          * port at this point depending on who is calling. We
1017                          * must therefore look for ANY one that matches our
1018                          * local port :/
1019                          */
1020                         head = &sctppcbinfo.sctp_tcpephash[i];
1021                         if (LIST_FIRST(head)) {
1022                                 inp = sctp_endpoint_probe(nam, head, lport);
1023                                 if (inp) {
1024                                         /* Found one */
1025                                         break;
1026                                 }
1027                         }
1028                 }
1029         }
1030 #ifdef SCTP_DEBUG
1031         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
1032                 kprintf("EP to return is %p\n", inp);
1033         }
1034 #endif
1035         if (have_lock == 0) {
1036                 if (inp) {
1037                         SCTP_INP_WLOCK(inp);
1038                         SCTP_INP_INCR_REF(inp);
1039                         SCTP_INP_WUNLOCK(inp);
1040                 }
1041                 SCTP_INP_INFO_RUNLOCK();
1042         } else {
1043                 if (inp) {
1044                         SCTP_INP_WLOCK(inp);
1045                         SCTP_INP_INCR_REF(inp);
1046                         SCTP_INP_WUNLOCK(inp);
1047                 }
1048         }
1049         return (inp);
1050 }
1051
1052 /*
1053  * Find an association for an endpoint with the pointer to whom you want
1054  * to send to and the endpoint pointer. The address can be IPv4 or IPv6.
1055  * We may need to change the *to to some other struct like a mbuf...
1056  */
1057 struct sctp_tcb *
1058 sctp_findassociation_addr_sa(struct sockaddr *to, struct sockaddr *from,
1059     struct sctp_inpcb **inp_p, struct sctp_nets **netp, int find_tcp_pool)
1060 {
1061         struct sctp_inpcb *inp;
1062         struct sctp_tcb *retval;
1063
1064         SCTP_INP_INFO_RLOCK();
1065         if (find_tcp_pool) {
1066                 if (inp_p != NULL) {
1067                         retval = sctp_tcb_special_locate(inp_p, from, to, netp);
1068                 } else {
1069                         retval = sctp_tcb_special_locate(&inp, from, to, netp);
1070                 }
1071                 if (retval != NULL) {
1072                         SCTP_INP_INFO_RUNLOCK();
1073                         return (retval);
1074                 }
1075         }
1076         inp = sctp_pcb_findep(to, 0, 1);
1077         if (inp_p != NULL) {
1078                 *inp_p = inp;
1079         }
1080         SCTP_INP_INFO_RUNLOCK();
1081
1082         if (inp == NULL) {
1083                 return (NULL);
1084         }
1085
1086         /*
1087          * ok, we have an endpoint, now lets find the assoc for it (if any)
1088          * we now place the source address or from in the to of the find
1089          * endpoint call. Since in reality this chain is used from the
1090          * inbound packet side.
1091          */
1092         if (inp_p != NULL) {
1093                 return (sctp_findassociation_ep_addr(inp_p, from, netp, to, NULL));
1094         } else {
1095                 return (sctp_findassociation_ep_addr(&inp, from, netp, to, NULL));
1096         }
1097 }
1098
1099
1100 /*
1101  * This routine will grub through the mbuf that is a INIT or INIT-ACK and
1102  * find all addresses that the sender has specified in any address list.
1103  * Each address will be used to lookup the TCB and see if one exits.
1104  */
1105 static struct sctp_tcb *
1106 sctp_findassociation_special_addr(struct mbuf *m, int iphlen, int offset,
1107     struct sctphdr *sh, struct sctp_inpcb **inp_p, struct sctp_nets **netp,
1108     struct sockaddr *dest)
1109 {
1110         struct sockaddr_in sin4;
1111         struct sockaddr_in6 sin6;
1112         struct sctp_paramhdr *phdr, parm_buf;
1113         struct sctp_tcb *retval;
1114         u_int32_t ptype, plen;
1115
1116         memset(&sin4, 0, sizeof(sin4));
1117         memset(&sin6, 0, sizeof(sin6));
1118         sin4.sin_len = sizeof(sin4);
1119         sin4.sin_family = AF_INET;
1120         sin4.sin_port = sh->src_port;
1121         sin6.sin6_len = sizeof(sin6);
1122         sin6.sin6_family = AF_INET6;
1123         sin6.sin6_port = sh->src_port;
1124
1125         retval = NULL;
1126         offset += sizeof(struct sctp_init_chunk);
1127
1128         phdr = sctp_get_next_param(m, offset, &parm_buf, sizeof(parm_buf));
1129         while (phdr != NULL) {
1130                 /* now we must see if we want the parameter */
1131                 ptype = ntohs(phdr->param_type);
1132                 plen = ntohs(phdr->param_length);
1133                 if (plen == 0) {
1134 #ifdef SCTP_DEBUG
1135                         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
1136                                 kprintf("sctp_findassociation_special_addr: Impossible length in parameter\n");
1137                         }
1138 #endif /* SCTP_DEBUG */
1139                         break;
1140                 }
1141                 if (ptype == SCTP_IPV4_ADDRESS &&
1142                     plen == sizeof(struct sctp_ipv4addr_param)) {
1143                         /* Get the rest of the address */
1144                         struct sctp_ipv4addr_param ip4_parm, *p4;
1145
1146                         phdr = sctp_get_next_param(m, offset,
1147                             (struct sctp_paramhdr *)&ip4_parm, plen);
1148                         if (phdr == NULL) {
1149                                 return (NULL);
1150                         }
1151                         p4 = (struct sctp_ipv4addr_param *)phdr;
1152                         memcpy(&sin4.sin_addr, &p4->addr, sizeof(p4->addr));
1153                         /* look it up */
1154                         retval = sctp_findassociation_ep_addr(inp_p,
1155                             (struct sockaddr *)&sin4, netp, dest, NULL);
1156                         if (retval != NULL) {
1157                                 return (retval);
1158                         }
1159                 } else if (ptype == SCTP_IPV6_ADDRESS &&
1160                     plen == sizeof(struct sctp_ipv6addr_param)) {
1161                         /* Get the rest of the address */
1162                         struct sctp_ipv6addr_param ip6_parm, *p6;
1163
1164                         phdr = sctp_get_next_param(m, offset,
1165                             (struct sctp_paramhdr *)&ip6_parm, plen);
1166                         if (phdr == NULL) {
1167                                 return (NULL);
1168                         }
1169                         p6 = (struct sctp_ipv6addr_param *)phdr;
1170                         memcpy(&sin6.sin6_addr, &p6->addr, sizeof(p6->addr));
1171                         /* look it up */
1172                         retval = sctp_findassociation_ep_addr(inp_p,
1173                             (struct sockaddr *)&sin6, netp, dest, NULL);
1174                         if (retval != NULL) {
1175                                 return (retval);
1176                         }
1177                 }
1178                 offset += SCTP_SIZE32(plen);
1179                 phdr = sctp_get_next_param(m, offset, &parm_buf,
1180                     sizeof(parm_buf));
1181         }
1182         return (NULL);
1183 }
1184
1185 static struct sctp_tcb *
1186 sctp_findassoc_by_vtag(struct sockaddr *from, uint32_t vtag,
1187     struct sctp_inpcb **inp_p, struct sctp_nets **netp, uint16_t rport,
1188     uint16_t lport)
1189 {
1190         /*
1191          * Use my vtag to hash. If we find it we then verify the source addr
1192          * is in the assoc. If all goes well we save a bit on rec of a packet.
1193          */
1194         struct sctpasochead *head;
1195         struct sctp_nets *net;
1196         struct sctp_tcb *stcb;
1197
1198         SCTP_INP_INFO_RLOCK();
1199         head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(vtag,
1200             sctppcbinfo.hashasocmark)];
1201         if (head == NULL) {
1202                 /* invalid vtag */
1203                 SCTP_INP_INFO_RUNLOCK();
1204                 return (NULL);
1205         }
1206         LIST_FOREACH(stcb, head, sctp_asocs) {
1207                 SCTP_INP_RLOCK(stcb->sctp_ep);
1208                 SCTP_TCB_LOCK(stcb);
1209                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
1210                 if (stcb->asoc.my_vtag == vtag) {
1211                         /* candidate */
1212                         if (stcb->rport != rport) {
1213                                 /*
1214                                  * we could remove this if vtags are unique
1215                                  * across the system.
1216                                  */
1217                                 SCTP_TCB_UNLOCK(stcb);
1218                                 continue;
1219                         }
1220                         if (stcb->sctp_ep->sctp_lport != lport) {
1221                                 /*
1222                                  * we could remove this if vtags are unique
1223                                  * across the system.
1224                                  */
1225                                 SCTP_TCB_UNLOCK(stcb);
1226                                 continue;
1227                         }
1228                         net = sctp_findnet(stcb, from);
1229                         if (net) {
1230                                 /* yep its him. */
1231                                 *netp = net;
1232                                 sctp_pegs[SCTP_VTAG_EXPR]++;
1233                                 *inp_p = stcb->sctp_ep;
1234                                 SCTP_INP_INFO_RUNLOCK();
1235                                 return (stcb);
1236                         } else {
1237                                 /* not him, this should only
1238                                  * happen in rare cases so
1239                                  * I peg it.
1240                                  */
1241                                 sctp_pegs[SCTP_VTAG_BOGUS]++;
1242                         }
1243                 }
1244                 SCTP_TCB_UNLOCK(stcb);
1245         }
1246         SCTP_INP_INFO_RUNLOCK();
1247         return (NULL);
1248 }
1249
1250 /*
1251  * Find an association with the pointer to the inbound IP packet. This
1252  * can be a IPv4 or IPv6 packet.
1253  */
1254 struct sctp_tcb *
1255 sctp_findassociation_addr(struct mbuf *m, int iphlen, int offset,
1256     struct sctphdr *sh, struct sctp_chunkhdr *ch,
1257     struct sctp_inpcb **inp_p, struct sctp_nets **netp)
1258 {
1259         int find_tcp_pool;
1260         struct ip *iph;
1261         struct sctp_tcb *retval;
1262         struct sockaddr_storage to_store, from_store;
1263         struct sockaddr *to = (struct sockaddr *)&to_store;
1264         struct sockaddr *from = (struct sockaddr *)&from_store;
1265         struct sctp_inpcb *inp;
1266
1267
1268         iph = mtod(m, struct ip *);
1269         if (iph->ip_v == IPVERSION) {
1270                 /* its IPv4 */
1271                 struct sockaddr_in *to4, *from4;
1272
1273                 to4 = (struct sockaddr_in *)&to_store;
1274                 from4 = (struct sockaddr_in *)&from_store;
1275                 bzero(to4, sizeof(*to4));
1276                 bzero(from4, sizeof(*from4));
1277                 from4->sin_family = to4->sin_family = AF_INET;
1278                 from4->sin_len = to4->sin_len = sizeof(struct sockaddr_in);
1279                 from4->sin_addr.s_addr  = iph->ip_src.s_addr;
1280                 to4->sin_addr.s_addr = iph->ip_dst.s_addr ;
1281                 from4->sin_port = sh->src_port;
1282                 to4->sin_port = sh->dest_port;
1283         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
1284                 /* its IPv6 */
1285                 struct ip6_hdr *ip6;
1286                 struct sockaddr_in6 *to6, *from6;
1287
1288                 ip6 = mtod(m, struct ip6_hdr *);
1289                 to6 = (struct sockaddr_in6 *)&to_store;
1290                 from6 = (struct sockaddr_in6 *)&from_store;
1291                 bzero(to6, sizeof(*to6));
1292                 bzero(from6, sizeof(*from6));
1293                 from6->sin6_family = to6->sin6_family = AF_INET6;
1294                 from6->sin6_len = to6->sin6_len = sizeof(struct sockaddr_in6);
1295                 to6->sin6_addr = ip6->ip6_dst;
1296                 from6->sin6_addr = ip6->ip6_src;
1297                 from6->sin6_port = sh->src_port;
1298                 to6->sin6_port = sh->dest_port;
1299                 /* Get the scopes in properly to the sin6 addr's */
1300                 in6_recoverscope(to6, &to6->sin6_addr, NULL);
1301 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) || defined(__DragonFly__)
1302                 in6_embedscope(&to6->sin6_addr, to6, NULL, NULL);
1303 #else
1304                 in6_embedscope(&to6->sin6_addr, to6);
1305 #endif
1306
1307                 in6_recoverscope(from6, &from6->sin6_addr, NULL);
1308 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) || defined(__DragonFly__)
1309                 in6_embedscope(&from6->sin6_addr, from6, NULL, NULL);
1310 #else
1311                 in6_embedscope(&from6->sin6_addr, from6);
1312 #endif
1313         } else {
1314                 /* Currently not supported. */
1315                 return (NULL);
1316         }
1317 #ifdef SCTP_DEBUG
1318         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
1319                 kprintf("Looking for port %d address :",
1320                        ntohs(((struct sockaddr_in *)to)->sin_port));
1321                 sctp_print_address(to);
1322                 kprintf("From for port %d address :",
1323                        ntohs(((struct sockaddr_in *)from)->sin_port));
1324                 sctp_print_address(from);
1325         }
1326 #endif
1327
1328         if (sh->v_tag) {
1329                 /* we only go down this path if vtag is non-zero */
1330                 retval = sctp_findassoc_by_vtag(from, ntohl(sh->v_tag),
1331                     inp_p, netp, sh->src_port, sh->dest_port);
1332                 if (retval) {
1333                         return (retval);
1334                 }
1335         }
1336         find_tcp_pool = 0;
1337         if ((ch->chunk_type != SCTP_INITIATION) &&
1338             (ch->chunk_type != SCTP_INITIATION_ACK) &&
1339             (ch->chunk_type != SCTP_COOKIE_ACK) &&
1340             (ch->chunk_type != SCTP_COOKIE_ECHO)) {
1341                 /* Other chunk types go to the tcp pool. */
1342                 find_tcp_pool = 1;
1343         }
1344         if (inp_p) {
1345                 retval = sctp_findassociation_addr_sa(to, from, inp_p, netp,
1346                     find_tcp_pool);
1347                 inp = *inp_p;
1348         } else {
1349                 retval = sctp_findassociation_addr_sa(to, from, &inp, netp,
1350                     find_tcp_pool);
1351         }
1352 #ifdef SCTP_DEBUG
1353         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
1354                 kprintf("retval:%p inp:%p\n", retval, inp);
1355         }
1356 #endif
1357         if (retval == NULL && inp) {
1358                 /* Found a EP but not this address */
1359 #ifdef SCTP_DEBUG
1360                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
1361                         kprintf("Found endpoint %p but no asoc - ep state:%x\n",
1362                             inp, inp->sctp_flags);
1363                 }
1364 #endif
1365                 if ((ch->chunk_type == SCTP_INITIATION) ||
1366                     (ch->chunk_type == SCTP_INITIATION_ACK)) {
1367                         /*
1368                          * special hook, we do NOT return linp or an
1369                          * association that is linked to an existing
1370                          * association that is under the TCP pool (i.e. no
1371                          * listener exists). The endpoint finding routine
1372                          * will always find a listner before examining the
1373                          * TCP pool.
1374                          */
1375                         if (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) {
1376 #ifdef SCTP_DEBUG
1377                                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
1378                                         kprintf("Gak, its in the TCP pool... return NULL");
1379                                 }
1380 #endif
1381                                 if (inp_p) {
1382                                         *inp_p = NULL;
1383                                 }
1384                                 return (NULL);
1385                         }
1386 #ifdef SCTP_DEBUG
1387                         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
1388                                 kprintf("Now doing SPECIAL find\n");
1389                         }
1390 #endif
1391                         retval = sctp_findassociation_special_addr(m, iphlen,
1392                             offset, sh, inp_p, netp, to);
1393                 }
1394         }
1395 #ifdef SCTP_DEBUG
1396         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
1397             kprintf("retval is %p\n", retval);
1398         }
1399 #endif
1400         return (retval);
1401 }
1402
1403 extern int sctp_max_burst_default;
1404
1405 extern unsigned int sctp_delayed_sack_time_default;
1406 extern unsigned int sctp_heartbeat_interval_default;
1407 extern unsigned int sctp_pmtu_raise_time_default;
1408 extern unsigned int sctp_shutdown_guard_time_default;
1409 extern unsigned int sctp_secret_lifetime_default;
1410
1411 extern unsigned int sctp_rto_max_default;
1412 extern unsigned int sctp_rto_min_default;
1413 extern unsigned int sctp_rto_initial_default;
1414 extern unsigned int sctp_init_rto_max_default;
1415 extern unsigned int sctp_valid_cookie_life_default;
1416 extern unsigned int sctp_init_rtx_max_default;
1417 extern unsigned int sctp_assoc_rtx_max_default;
1418 extern unsigned int sctp_path_rtx_max_default;
1419 extern unsigned int sctp_nr_outgoing_streams_default;
1420
1421 /*
1422  * allocate a sctp_inpcb and setup a temporary binding to a port/all
1423  * addresses. This way if we don't get a bind we by default pick a ephemeral
1424  * port with all addresses bound.
1425  */
1426 int
1427 sctp_inpcb_alloc(struct socket *so)
1428 {
1429         /*
1430          * we get called when a new endpoint starts up. We need to allocate
1431          * the sctp_inpcb structure from the zone and init it. Mark it as
1432          * unbound and find a port that we can use as an ephemeral with
1433          * INADDR_ANY. If the user binds later no problem we can then add
1434          * in the specific addresses. And setup the default parameters for
1435          * the EP.
1436          */
1437         int i, error;
1438         struct sctp_inpcb *inp, *n_inp;
1439         struct sctp_pcb *m;
1440         struct timeval time;
1441
1442         error = 0;
1443
1444         /* Hack alert:
1445          *
1446          * This code audits the entire INP list to see if
1447          * any ep's that are in the GONE state are now
1448          * all free. This should not happen really since when
1449          * the last association if freed we should end up deleting
1450          * the inpcb. This code including the locks should
1451          * be taken out ... since the last set of fixes I
1452          * have not seen the "Found a GONE on list" has not
1453          * came out. But i am paranoid and we will leave this
1454          * in at the cost of efficency on allocation of PCB's.
1455          * Probably we should move this to the invariant
1456          * compile options
1457          */
1458 /* #ifdef INVARIANTS*/
1459         SCTP_INP_INFO_RLOCK();
1460         inp = LIST_FIRST(&sctppcbinfo.listhead);
1461         while (inp) {
1462                 n_inp = LIST_NEXT(inp, sctp_list);
1463                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
1464                         if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
1465                                 /* finish the job now */
1466                                 kprintf("Found a GONE on list\n");
1467                                 SCTP_INP_INFO_RUNLOCK();
1468                                 sctp_inpcb_free(inp, 1);
1469                                 SCTP_INP_INFO_RLOCK();
1470                         }
1471                 }
1472                 inp = n_inp;
1473         }
1474         SCTP_INP_INFO_RUNLOCK();
1475 /* #endif INVARIANTS*/
1476
1477         SCTP_INP_INFO_WLOCK();
1478         inp = (struct sctp_inpcb *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_ep);
1479         if (inp == NULL) {
1480                 kprintf("Out of SCTP-INPCB structures - no resources\n");
1481                 SCTP_INP_INFO_WUNLOCK();
1482                 return (ENOBUFS);
1483         }
1484
1485         /* zap it */
1486         bzero(inp, sizeof(*inp));
1487
1488         /* bump generations */
1489         inp->ip_inp.inp.inp_socket = so;
1490
1491         /* setup socket pointers */
1492         inp->sctp_socket = so;
1493
1494         /* setup inpcb socket too */
1495         inp->ip_inp.inp.inp_socket = so;
1496         inp->sctp_frag_point = SCTP_DEFAULT_MAXSEGMENT;
1497 #ifdef IPSEC
1498 #if !(defined(__OpenBSD__) || defined(__APPLE__))
1499         {
1500                 struct inpcbpolicy *pcb_sp = NULL;
1501                 error = ipsec_init_policy(so, &pcb_sp);
1502                 /* Arrange to share the policy */
1503                 inp->ip_inp.inp.inp_sp = pcb_sp;
1504                 ((struct in6pcb *)(&inp->ip_inp.inp))->in6p_sp = pcb_sp;
1505         }
1506 #else
1507         /* not sure what to do for openbsd here */
1508         error = 0;
1509 #endif
1510         if (error != 0) {
1511                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp);
1512                 SCTP_INP_INFO_WUNLOCK();
1513                 return error;
1514         }
1515 #endif /* IPSEC */
1516         sctppcbinfo.ipi_count_ep++;
1517 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
1518         inp->ip_inp.inp.inp_gencnt = ++sctppcbinfo.ipi_gencnt_ep;
1519         inp->ip_inp.inp.inp_ip_ttl = ip_defttl;
1520 #else
1521         inp->inp_ip_ttl = ip_defttl;
1522         inp->inp_ip_tos = 0;
1523 #endif
1524
1525         so->so_pcb = (caddr_t)inp;
1526
1527         if ((so->so_type == SOCK_DGRAM) ||
1528             (so->so_type == SOCK_SEQPACKET)) {
1529                 /* UDP style socket */
1530                 inp->sctp_flags = (SCTP_PCB_FLAGS_UDPTYPE |
1531                     SCTP_PCB_FLAGS_UNBOUND);
1532                 inp->sctp_flags |= (SCTP_PCB_FLAGS_RECVDATAIOEVNT);
1533         } else if (so->so_type == SOCK_STREAM) {
1534                 /* TCP style socket */
1535                 inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
1536                     SCTP_PCB_FLAGS_UNBOUND);
1537                 inp->sctp_flags |= (SCTP_PCB_FLAGS_RECVDATAIOEVNT);
1538         } else {
1539                 /*
1540                  * unsupported socket type (RAW, etc)- in case we missed
1541                  * it in protosw
1542                  */
1543                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp);
1544                 SCTP_INP_INFO_WUNLOCK();
1545                 return (EOPNOTSUPP);
1546         }
1547         inp->sctp_tcbhash = hashinit(sctp_pcbtblsize,
1548 #ifdef __NetBSD__
1549             HASH_LIST,
1550 #endif
1551             M_PCB,
1552 #if defined(__NetBSD__) || defined(__OpenBSD__)
1553             M_WAITOK,
1554 #endif
1555             &inp->sctp_hashmark);
1556         if (inp->sctp_tcbhash == NULL) {
1557                 kprintf("Out of SCTP-INPCB->hashinit - no resources\n");
1558                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp);
1559                 SCTP_INP_INFO_WUNLOCK();
1560                 return (ENOBUFS);
1561         }
1562         /* LOCK init's */
1563         SCTP_INP_LOCK_INIT(inp);
1564         SCTP_ASOC_CREATE_LOCK_INIT(inp);
1565         /* lock the new ep */
1566         SCTP_INP_WLOCK(inp);
1567
1568         /* add it to the info area */
1569         LIST_INSERT_HEAD(&sctppcbinfo.listhead, inp, sctp_list);
1570         SCTP_INP_INFO_WUNLOCK();
1571
1572         LIST_INIT(&inp->sctp_addr_list);
1573         LIST_INIT(&inp->sctp_asoc_list);
1574         TAILQ_INIT(&inp->sctp_queue_list);
1575         /* Init the timer structure for signature change */
1576 #if defined (__FreeBSD__) && __FreeBSD_version >= 500000
1577         callout_init(&inp->sctp_ep.signature_change.timer, 0);
1578 #else
1579         callout_init(&inp->sctp_ep.signature_change.timer);
1580 #endif
1581         inp->sctp_ep.signature_change.type = SCTP_TIMER_TYPE_NEWCOOKIE;
1582
1583         /* now init the actual endpoint default data */
1584         m = &inp->sctp_ep;
1585
1586         /* setup the base timeout information */
1587         m->sctp_timeoutticks[SCTP_TIMER_SEND] = SEC_TO_TICKS(SCTP_SEND_SEC); /* needed ? */
1588         m->sctp_timeoutticks[SCTP_TIMER_INIT] = SEC_TO_TICKS(SCTP_INIT_SEC); /* needed ? */
1589         m->sctp_timeoutticks[SCTP_TIMER_RECV] = MSEC_TO_TICKS(sctp_delayed_sack_time_default);
1590         m->sctp_timeoutticks[SCTP_TIMER_HEARTBEAT] = sctp_heartbeat_interval_default; /* this is in MSEC */
1591         m->sctp_timeoutticks[SCTP_TIMER_PMTU] = SEC_TO_TICKS(sctp_pmtu_raise_time_default);
1592         m->sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] = SEC_TO_TICKS(sctp_shutdown_guard_time_default);
1593         m->sctp_timeoutticks[SCTP_TIMER_SIGNATURE] = SEC_TO_TICKS(sctp_secret_lifetime_default);
1594         /* all max/min max are in ms */
1595         m->sctp_maxrto = sctp_rto_max_default;
1596         m->sctp_minrto = sctp_rto_min_default;
1597         m->initial_rto = sctp_rto_initial_default;
1598         m->initial_init_rto_max = sctp_init_rto_max_default;
1599
1600         m->max_open_streams_intome = MAX_SCTP_STREAMS;
1601
1602         m->max_init_times = sctp_init_rtx_max_default;
1603         m->max_send_times = sctp_assoc_rtx_max_default;
1604         m->def_net_failure = sctp_path_rtx_max_default;
1605         m->sctp_sws_sender = SCTP_SWS_SENDER_DEF;
1606         m->sctp_sws_receiver = SCTP_SWS_RECEIVER_DEF;
1607         m->max_burst = sctp_max_burst_default;
1608         /* number of streams to pre-open on a association */
1609         m->pre_open_stream_count = sctp_nr_outgoing_streams_default;
1610
1611         /* Add adaption cookie */
1612         m->adaption_layer_indicator = 0x504C5253;
1613
1614         /* seed random number generator */
1615         m->random_counter = 1;
1616         m->store_at = SCTP_SIGNATURE_SIZE;
1617 #if (defined(__FreeBSD__) && (__FreeBSD_version < 500000)) || defined(__DragonFly__)
1618         read_random_unlimited(m->random_numbers, sizeof(m->random_numbers));
1619 #elif defined(__APPLE__) || (defined(__FreeBSD__) && (__FreeBSD_version > 500000))
1620         read_random(m->random_numbers, sizeof(m->random_numbers));
1621 #elif defined(__OpenBSD__)
1622         get_random_bytes(m->random_numbers, sizeof(m->random_numbers));
1623 #elif defined(__NetBSD__) && NRND > 0
1624         rnd_extract_data(m->random_numbers, sizeof(m->random_numbers),
1625                          RND_EXTRACT_ANY);
1626 #else
1627         {
1628                 u_int32_t *ranm, *ranp;
1629                 ranp = (u_int32_t *)&m->random_numbers;
1630                 ranm = ranp + (SCTP_SIGNATURE_ALOC_SIZE/sizeof(u_int32_t));
1631                 if ((u_long)ranp % 4) {
1632                         /* not a even boundary? */
1633                         ranp = (u_int32_t *)SCTP_SIZE32((u_long)ranp);
1634                 }
1635                 while (ranp < ranm) {
1636                         *ranp = random();
1637                         ranp++;
1638                 }
1639         }
1640 #endif
1641         sctp_fill_random_store(m);
1642
1643         /* Minimum cookie size */
1644         m->size_of_a_cookie = (sizeof(struct sctp_init_msg) * 2) +
1645                 sizeof(struct sctp_state_cookie);
1646         m->size_of_a_cookie += SCTP_SIGNATURE_SIZE;
1647
1648         /* Setup the initial secret */
1649         SCTP_GETTIME_TIMEVAL(&time);
1650         m->time_of_secret_change = time.tv_sec;
1651
1652         for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1653                 m->secret_key[0][i] = sctp_select_initial_TSN(m);
1654         }
1655         sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL);
1656
1657         /* How long is a cookie good for ? */
1658         m->def_cookie_life = sctp_valid_cookie_life_default;
1659         SCTP_INP_WUNLOCK(inp);
1660         return (error);
1661 }
1662
1663
1664 void
1665 sctp_move_pcb_and_assoc(struct sctp_inpcb *old_inp, struct sctp_inpcb *new_inp,
1666     struct sctp_tcb *stcb)
1667 {
1668         uint16_t lport, rport;
1669         struct sctppcbhead *head;
1670         struct sctp_laddr *laddr, *oladdr;
1671
1672         SCTP_TCB_UNLOCK(stcb);
1673         SCTP_INP_INFO_WLOCK();
1674         SCTP_INP_WLOCK(old_inp);
1675         SCTP_INP_WLOCK(new_inp);
1676         SCTP_TCB_LOCK(stcb);
1677
1678         new_inp->sctp_ep.time_of_secret_change =
1679             old_inp->sctp_ep.time_of_secret_change;
1680         memcpy(new_inp->sctp_ep.secret_key, old_inp->sctp_ep.secret_key,
1681             sizeof(old_inp->sctp_ep.secret_key));
1682         new_inp->sctp_ep.current_secret_number =
1683             old_inp->sctp_ep.current_secret_number;
1684         new_inp->sctp_ep.last_secret_number =
1685             old_inp->sctp_ep.last_secret_number;
1686         new_inp->sctp_ep.size_of_a_cookie = old_inp->sctp_ep.size_of_a_cookie;
1687
1688         /* Copy the port across */
1689         lport = new_inp->sctp_lport = old_inp->sctp_lport;
1690         rport = stcb->rport;
1691         /* Pull the tcb from the old association */
1692         LIST_REMOVE(stcb, sctp_tcbhash);
1693         LIST_REMOVE(stcb, sctp_tcblist);
1694
1695         /* Now insert the new_inp into the TCP connected hash */
1696         head = &sctppcbinfo.sctp_tcpephash[SCTP_PCBHASH_ALLADDR((lport + rport),
1697             sctppcbinfo.hashtcpmark)];
1698
1699         LIST_INSERT_HEAD(head, new_inp, sctp_hash);
1700
1701         /* Now move the tcb into the endpoint list */
1702         LIST_INSERT_HEAD(&new_inp->sctp_asoc_list, stcb, sctp_tcblist);
1703         /*
1704          * Question, do we even need to worry about the ep-hash since
1705          * we only have one connection? Probably not :> so lets
1706          * get rid of it and not suck up any kernel memory in that.
1707          */
1708         SCTP_INP_INFO_WUNLOCK();
1709         stcb->sctp_socket = new_inp->sctp_socket;
1710         stcb->sctp_ep = new_inp;
1711         if (new_inp->sctp_tcbhash != NULL) {
1712                 hashdestroy(new_inp->sctp_tcbhash, M_PCB,
1713                     new_inp->sctp_hashmark);
1714                 new_inp->sctp_tcbhash = NULL;
1715         }
1716         if ((new_inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
1717                 /* Subset bound, so copy in the laddr list from the old_inp */
1718                 LIST_FOREACH(oladdr, &old_inp->sctp_addr_list, sctp_nxt_addr) {
1719                         laddr = (struct sctp_laddr *)SCTP_ZONE_GET(
1720                             sctppcbinfo.ipi_zone_laddr);
1721                         if (laddr == NULL) {
1722                                 /*
1723                                  * Gak, what can we do? This assoc is really
1724                                  * HOSED. We probably should send an abort
1725                                  * here.
1726                                  */
1727 #ifdef SCTP_DEBUG
1728                                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
1729                                         kprintf("Association hosed in TCP model, out of laddr memory\n");
1730                                 }
1731 #endif /* SCTP_DEBUG */
1732                                 continue;
1733                         }
1734                         sctppcbinfo.ipi_count_laddr++;
1735                         sctppcbinfo.ipi_gencnt_laddr++;
1736                         bzero(laddr, sizeof(*laddr));
1737                         laddr->ifa = oladdr->ifa;
1738                         LIST_INSERT_HEAD(&new_inp->sctp_addr_list, laddr,
1739                             sctp_nxt_addr);
1740                         new_inp->laddr_count++;
1741                 }
1742         }
1743         SCTP_INP_WUNLOCK(new_inp);
1744         SCTP_INP_WUNLOCK(old_inp);
1745 }
1746
1747 static int
1748 sctp_isport_inuse(struct sctp_inpcb *inp, uint16_t lport)
1749 {
1750         struct sctppcbhead *head;
1751         struct sctp_inpcb *t_inp;
1752
1753         head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport,
1754             sctppcbinfo.hashmark)];
1755         LIST_FOREACH(t_inp, head, sctp_hash) {
1756                 if (t_inp->sctp_lport != lport) {
1757                         continue;
1758                 }
1759                 /* This one is in use. */
1760                 /* check the v6/v4 binding issue */
1761                 if ((t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1762 #if defined(__FreeBSD__)
1763                     (((struct inpcb *)t_inp)->inp_flags & IN6P_IPV6_V6ONLY)
1764 #else
1765 #if defined(__OpenBSD__)
1766                     (0) /* For open bsd we do dual bind only */
1767 #else
1768                     (((struct in6pcb *)t_inp)->in6p_flags & IN6P_IPV6_V6ONLY)
1769 #endif
1770 #endif
1771                         ) {
1772                         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1773                                 /* collision in V6 space */
1774                                 return (1);
1775                         } else {
1776                                 /* inp is BOUND_V4 no conflict */
1777                                 continue;
1778                         }
1779                 } else if (t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1780                         /* t_inp is bound v4 and v6, conflict always */
1781                         return (1);
1782                 } else {
1783                         /* t_inp is bound only V4 */
1784                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1785 #if defined(__FreeBSD__)
1786                             (((struct inpcb *)inp)->inp_flags & IN6P_IPV6_V6ONLY)
1787 #else
1788 #if defined(__OpenBSD__)
1789                             (0) /* For open bsd we do dual bind only */
1790 #else
1791                             (((struct in6pcb *)inp)->in6p_flags & IN6P_IPV6_V6ONLY)
1792 #endif
1793 #endif
1794                                 ) {
1795                                 /* no conflict */
1796                                 continue;
1797                         }
1798                         /* else fall through to conflict */
1799                 }
1800                 return (1);
1801         }
1802         return (0);
1803 }
1804
1805 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__))
1806 /*
1807  * Don't know why, but without this there is an unknown reference when
1808  * compiling NetBSD... hmm
1809  */
1810 extern void in6_sin6_2_sin (struct sockaddr_in *, struct sockaddr_in6 *sin6);
1811 #endif
1812
1813
1814 int
1815 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000) || defined(__DragonFly__)
1816 sctp_inpcb_bind(struct socket *so, struct sockaddr *addr, struct thread *p)
1817 #else
1818 sctp_inpcb_bind(struct socket *so, struct sockaddr *addr, struct proc *p)
1819 #endif
1820 {
1821         /* bind a ep to a socket address */
1822         struct sctppcbhead *head;
1823         struct sctp_inpcb *inp, *inp_tmp;
1824         struct inpcb *ip_inp;
1825         int bindall;
1826         uint16_t lport;
1827         int error;
1828
1829         lport = 0;
1830         error = 0;
1831         bindall = 1;
1832         inp = (struct sctp_inpcb *)so->so_pcb;
1833         ip_inp = (struct inpcb *)so->so_pcb;
1834 #ifdef SCTP_DEBUG
1835         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
1836                 if (addr) {
1837                         kprintf("Bind called port:%d\n",
1838                                ntohs(((struct sockaddr_in *)addr)->sin_port));
1839                         kprintf("Addr :");
1840                         sctp_print_address(addr);
1841                 }
1842         }
1843 #endif /* SCTP_DEBUG */
1844         if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) == 0) {
1845                 /* already did a bind, subsequent binds NOT allowed ! */
1846                 return (EINVAL);
1847         }
1848
1849         if (addr != NULL) {
1850                 if (addr->sa_family == AF_INET) {
1851                         struct sockaddr_in *sin;
1852
1853                         /* IPV6_V6ONLY socket? */
1854                         if (
1855 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
1856                                 (ip_inp->inp_flags & IN6P_IPV6_V6ONLY)
1857 #else
1858 #if defined(__OpenBSD__)
1859                                 (0)     /* For openbsd we do dual bind only */
1860 #else
1861                                 (((struct in6pcb *)inp)->in6p_flags & IN6P_IPV6_V6ONLY)
1862 #endif
1863 #endif
1864                                 ) {
1865                                 return (EINVAL);
1866                         }
1867
1868                         if (addr->sa_len != sizeof(*sin))
1869                                 return (EINVAL);
1870
1871                         sin = (struct sockaddr_in *)addr;
1872                         lport = sin->sin_port;
1873
1874                         if (sin->sin_addr.s_addr != INADDR_ANY) {
1875                                 bindall = 0;
1876                         }
1877                 } else if (addr->sa_family == AF_INET6) {
1878                         /* Only for pure IPv6 Address. (No IPv4 Mapped!) */
1879                         struct sockaddr_in6 *sin6;
1880
1881                         sin6 = (struct sockaddr_in6 *)addr;
1882
1883                         if (addr->sa_len != sizeof(*sin6))
1884                                 return (EINVAL);
1885
1886                         lport = sin6->sin6_port;
1887                         if (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1888                                 bindall = 0;
1889                                 /* KAME hack: embed scopeid */
1890 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) || defined(__DragonFly__)
1891                                 if (in6_embedscope(&sin6->sin6_addr, sin6,
1892                                     ip_inp, NULL) != 0)
1893                                         return (EINVAL);
1894 #elif defined(__FreeBSD__)
1895                                 error = scope6_check_id(sin6, ip6_use_defzone);
1896                                 if (error != 0)
1897                                         return (error);
1898 #else
1899                                 if (in6_embedscope(&sin6->sin6_addr, sin6) != 0) {
1900                                         return (EINVAL);
1901                                 }
1902 #endif
1903                         }
1904 #ifndef SCOPEDROUTING
1905                         /* this must be cleared for ifa_ifwithaddr() */
1906                         sin6->sin6_scope_id = 0;
1907 #endif /* SCOPEDROUTING */
1908                 } else {
1909                         return (EAFNOSUPPORT);
1910                 }
1911         }
1912         SCTP_INP_INFO_WLOCK();
1913         SCTP_INP_WLOCK(inp);
1914         /* increase our count due to the unlock we do */
1915         SCTP_INP_INCR_REF(inp);
1916         if (lport) {
1917                 /*
1918                  * Did the caller specify a port? if so we must see if a
1919                  * ep already has this one bound.
1920                  */
1921                 /* got to be root to get at low ports */
1922                 if (ntohs(lport) < IPPORT_RESERVED) {
1923                         if (p && (error =
1924 #ifdef __FreeBSD__
1925 #if __FreeBSD_version >= 500000
1926                             suser_cred(p->td_ucred, 0)
1927 #else
1928                             suser(p)
1929 #endif
1930 #elif defined(__NetBSD__) || defined(__APPLE__)
1931                             suser(p->p_ucred, &p->p_acflag)
1932 #elif defined(__DragonFly__)
1933                             priv_check(p, PRIV_ROOT)
1934 #else
1935                             suser(p, 0)
1936 #endif
1937                             )) {
1938                                 SCTP_INP_DECR_REF(inp);
1939                                 SCTP_INP_WUNLOCK(inp);
1940                                 SCTP_INP_INFO_WUNLOCK();
1941                                 return (error);
1942                         }
1943                 }
1944                 if (p == NULL) {
1945                         SCTP_INP_DECR_REF(inp);
1946                         SCTP_INP_WUNLOCK(inp);
1947                         SCTP_INP_INFO_WUNLOCK();
1948                         return (error);
1949                 }
1950                 SCTP_INP_WUNLOCK(inp);
1951                 inp_tmp = sctp_pcb_findep(addr, 0, 1);
1952                 if (inp_tmp != NULL) {
1953                         /* lock guy returned and lower count
1954                          * note that we are not bound so inp_tmp
1955                          * should NEVER be inp. And it is this
1956                          * inp (inp_tmp) that gets the reference
1957                          * bump, so we must lower it.
1958                          */
1959                         SCTP_INP_WLOCK(inp_tmp);
1960                         SCTP_INP_DECR_REF(inp_tmp);
1961                         SCTP_INP_WUNLOCK(inp_tmp);
1962
1963                         /* unlock info */
1964                         SCTP_INP_INFO_WUNLOCK();
1965                         return (EADDRNOTAVAIL);
1966                 }
1967                 SCTP_INP_WLOCK(inp);
1968                 if (bindall) {
1969                         /* verify that no lport is not used by a singleton */
1970                         if (sctp_isport_inuse(inp, lport)) {
1971                                 /* Sorry someone already has this one bound */
1972                                 SCTP_INP_DECR_REF(inp);
1973                                 SCTP_INP_WUNLOCK(inp);
1974                                 SCTP_INP_INFO_WUNLOCK();
1975                                 return (EADDRNOTAVAIL);
1976                         }
1977                 }
1978         } else {
1979                 /*
1980                  * get any port but lets make sure no one has any address
1981                  * with this port bound
1982                  */
1983
1984                 /*
1985                  * setup the inp to the top (I could use the union but this
1986                  * is just as easy
1987                  */
1988                 uint32_t port_guess;
1989                 uint16_t port_attempt;
1990                 int not_done=1;
1991
1992                 while (not_done) {
1993                         port_guess = sctp_select_initial_TSN(&inp->sctp_ep);
1994                         port_attempt = (port_guess &  0x0000ffff);
1995                         if (port_attempt == 0) {
1996                                 goto next_half;
1997                         }
1998                         if (port_attempt < IPPORT_RESERVED) {
1999                                 port_attempt += IPPORT_RESERVED;
2000                         }
2001
2002                         if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) {
2003                                 /* got a port we can use */
2004                                 not_done = 0;
2005                                 continue;
2006                         }
2007                         /* try upper half */
2008                 next_half:
2009                         port_attempt = ((port_guess >> 16) &  0x0000ffff);
2010                         if (port_attempt == 0) {
2011                                 goto last_try;
2012                         }
2013                         if (port_attempt < IPPORT_RESERVED) {
2014                                 port_attempt += IPPORT_RESERVED;
2015                         }
2016                         if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) {
2017                                 /* got a port we can use */
2018                                 not_done = 0;
2019                                 continue;
2020                         }
2021                         /* try two half's added together */
2022                 last_try:
2023                         port_attempt = (((port_guess >> 16) &  0x0000ffff) + (port_guess & 0x0000ffff));
2024                         if (port_attempt == 0) {
2025                                 /* get a new random number */
2026                                 continue;
2027                         }
2028                         if (port_attempt < IPPORT_RESERVED) {
2029                                 port_attempt += IPPORT_RESERVED;
2030                         }
2031                         if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) {
2032                                 /* got a port we can use */
2033                                 not_done = 0;
2034                                 continue;
2035                         }
2036                 }
2037                 /* we don't get out of the loop until we have a port */
2038                 lport = htons(port_attempt);
2039         }
2040         SCTP_INP_DECR_REF(inp);
2041         if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
2042                 /* this really should not happen. The guy
2043                  * did a non-blocking bind and then did a close
2044                  * at the same time.
2045                  */
2046                 SCTP_INP_WUNLOCK(inp);
2047                 SCTP_INP_INFO_WUNLOCK();
2048                 return (EINVAL);
2049         }
2050         /* ok we look clear to give out this port, so lets setup the binding */
2051         if (bindall) {
2052                 /* binding to all addresses, so just set in the proper flags */
2053                 inp->sctp_flags |= (SCTP_PCB_FLAGS_BOUNDALL |
2054                     SCTP_PCB_FLAGS_DO_ASCONF);
2055                 /* set the automatic addr changes from kernel flag */
2056                 if (sctp_auto_asconf == 0) {
2057                         inp->sctp_flags &= ~SCTP_PCB_FLAGS_AUTO_ASCONF;
2058                 } else {
2059                         inp->sctp_flags |= SCTP_PCB_FLAGS_AUTO_ASCONF;
2060                 }
2061         } else {
2062                 /*
2063                  * bind specific, make sure flags is off and add a new address
2064                  * structure to the sctp_addr_list inside the ep structure.
2065                  *
2066                  * We will need to allocate one and insert it at the head.
2067                  * The socketopt call can just insert new addresses in there
2068                  * as well. It will also have to do the embed scope kame hack
2069                  * too (before adding).
2070                  */
2071                 struct ifaddr *ifa;
2072                 struct sockaddr_storage store_sa;
2073
2074                 memset(&store_sa, 0, sizeof(store_sa));
2075                 if (addr->sa_family == AF_INET) {
2076                         struct sockaddr_in *sin;
2077
2078                         sin = (struct sockaddr_in *)&store_sa;
2079                         memcpy(sin, addr, sizeof(struct sockaddr_in));
2080                         sin->sin_port = 0;
2081                 } else if (addr->sa_family == AF_INET6) {
2082                         struct sockaddr_in6 *sin6;
2083
2084                         sin6 = (struct sockaddr_in6 *)&store_sa;
2085                         memcpy(sin6, addr, sizeof(struct sockaddr_in6));
2086                         sin6->sin6_port = 0;
2087                 }
2088                 /*
2089                  * first find the interface with the bound address
2090                  * need to zero out the port to find the address! yuck!
2091                  * can't do this earlier since need port for sctp_pcb_findep()
2092                  */
2093                 ifa = sctp_find_ifa_by_addr((struct sockaddr *)&store_sa);
2094                 if (ifa == NULL) {
2095                         /* Can't find an interface with that address */
2096                         SCTP_INP_WUNLOCK(inp);
2097                         SCTP_INP_INFO_WUNLOCK();
2098                         return (EADDRNOTAVAIL);
2099                 }
2100                 if (addr->sa_family == AF_INET6) {
2101                         struct in6_ifaddr *ifa6;
2102                         ifa6 = (struct in6_ifaddr *)ifa;
2103                         /*
2104                          * allow binding of deprecated addresses as per
2105                          * RFC 2462 and ipng discussion
2106                          */
2107                         if (ifa6->ia6_flags & (IN6_IFF_DETACHED |
2108                             IN6_IFF_ANYCAST |
2109                             IN6_IFF_NOTREADY)) {
2110                                 /* Can't bind a non-existent addr. */
2111                                 SCTP_INP_WUNLOCK(inp);
2112                                 SCTP_INP_INFO_WUNLOCK();
2113                                 return (EINVAL);
2114                         }
2115                 }
2116                 /* we're not bound all */
2117                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_BOUNDALL;
2118 #if 0 /* use sysctl now */
2119                 /* don't allow automatic addr changes from kernel */
2120                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_AUTO_ASCONF;
2121 #endif
2122                 /* set the automatic addr changes from kernel flag */
2123                 if (sctp_auto_asconf == 0) {
2124                         inp->sctp_flags &= ~SCTP_PCB_FLAGS_AUTO_ASCONF;
2125                 } else {
2126                         inp->sctp_flags |= SCTP_PCB_FLAGS_AUTO_ASCONF;
2127                 }
2128                 /* allow bindx() to send ASCONF's for binding changes */
2129                 inp->sctp_flags |= SCTP_PCB_FLAGS_DO_ASCONF;
2130                 /* add this address to the endpoint list */
2131                 error = sctp_insert_laddr(&inp->sctp_addr_list, ifa);
2132                 if (error != 0) {
2133                         SCTP_INP_WUNLOCK(inp);
2134                         SCTP_INP_INFO_WUNLOCK();
2135                         return (error);
2136                 }
2137                 inp->laddr_count++;
2138         }
2139         /* find the bucket */
2140         head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport,
2141             sctppcbinfo.hashmark)];
2142         /* put it in the bucket */
2143         LIST_INSERT_HEAD(head, inp, sctp_hash);
2144 #ifdef SCTP_DEBUG
2145         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
2146                 kprintf("Main hash to bind at head:%p, bound port:%d\n", head, ntohs(lport));
2147         }
2148 #endif
2149         /* set in the port */
2150         inp->sctp_lport = lport;
2151
2152         /* turn off just the unbound flag */
2153         inp->sctp_flags &= ~SCTP_PCB_FLAGS_UNBOUND;
2154         SCTP_INP_WUNLOCK(inp);
2155         SCTP_INP_INFO_WUNLOCK();
2156         return (0);
2157 }
2158
2159
2160 static void
2161 sctp_iterator_inp_being_freed(struct sctp_inpcb *inp, struct sctp_inpcb *inp_next)
2162 {
2163         struct sctp_iterator *it;
2164         /* We enter with the only the ITERATOR_LOCK in place and
2165          * A write lock on the inp_info stuff.
2166          */
2167
2168         /* Go through all iterators, we must do this since
2169          * it is possible that some iterator does NOT have
2170          * the lock, but is waiting for it. And the one that
2171          * had the lock has either moved in the last iteration
2172          * or we just cleared it above. We need to find all
2173          * of those guys. The list of iterators should never
2174          * be very big though.
2175          */
2176         LIST_FOREACH(it, &sctppcbinfo.iteratorhead, sctp_nxt_itr) {
2177                 if (it == inp->inp_starting_point_for_iterator)
2178                         /* skip this guy, he's special */
2179                         continue;
2180                 if (it->inp == inp) {
2181                         /* This is tricky and we DON'T lock the iterator.
2182                          * Reason is he's running but waiting for me since
2183                          * inp->inp_starting_point_for_iterator has the lock
2184                          * on me (the guy above we skipped). This tells us
2185                          * its is not running but waiting for inp->inp_starting_point_for_iterator
2186                          * to be released by the guy that does have our INP in a lock.
2187                          */
2188                         if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
2189                                 it->inp = NULL;
2190                                 it->stcb = NULL;
2191                         } else {
2192                                 /* set him up to do the next guy not me */
2193                                 it->inp = inp_next;
2194                                 it->stcb = NULL;
2195                         }
2196                 }
2197         }
2198         it = inp->inp_starting_point_for_iterator;
2199         if (it) {
2200                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
2201                         it->inp = NULL;
2202                 } else {
2203                         it->inp = inp_next;
2204                 }
2205                 it->stcb = NULL;
2206         }
2207 }
2208
2209 /* release sctp_inpcb unbind the port */
2210 void
2211 sctp_inpcb_free(struct sctp_inpcb *inp, int immediate)
2212 {
2213         /*
2214          * Here we free a endpoint. We must find it (if it is in the Hash
2215          * table) and remove it from there. Then we must also find it in
2216          * the overall list and remove it from there. After all removals are
2217          * complete then any timer has to be stopped. Then start the actual
2218          * freeing.
2219          * a) Any local lists.
2220          * b) Any associations.
2221          * c) The hash of all associations.
2222          * d) finally the ep itself.
2223          */
2224         struct sctp_inpcb *inp_save;
2225         struct sctp_tcb *asoc, *nasoc;
2226         struct sctp_laddr *laddr, *nladdr;
2227         struct inpcb *ip_pcb;
2228         struct socket *so;
2229         struct sctp_socket_q_list *sq;
2230 #if !defined(__FreeBSD__) || __FreeBSD_version < 500000
2231         struct rtentry *rt;
2232 #endif
2233         int cnt;
2234
2235         SCTP_ASOC_CREATE_LOCK(inp);
2236         SCTP_INP_WLOCK(inp);
2237
2238         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
2239                 /* been here before */
2240                 kprintf("Endpoint was all gone (dup free)?\n");
2241                 SCTP_INP_WUNLOCK(inp);
2242                 SCTP_ASOC_CREATE_UNLOCK(inp);
2243                 return;
2244         }
2245         sctp_timer_stop(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL);
2246
2247         if (inp->control) {
2248                 sctp_m_freem(inp->control);
2249                 inp->control = NULL;
2250         }
2251         if (inp->pkt) {
2252                 sctp_m_freem(inp->pkt);
2253                 inp->pkt = NULL;
2254         }
2255         so  = inp->sctp_socket;
2256         ip_pcb = &inp->ip_inp.inp; /* we could just cast the main
2257                                    * pointer here but I will
2258                                    * be nice :> (i.e. ip_pcb = ep;)
2259                                    */
2260
2261         if (immediate == 0) {
2262                 int cnt_in_sd;
2263                 cnt_in_sd = 0;
2264                 for ((asoc = LIST_FIRST(&inp->sctp_asoc_list)); asoc != NULL;
2265                      asoc = nasoc) {
2266                         nasoc = LIST_NEXT(asoc, sctp_tcblist);
2267                         if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_COOKIE_WAIT) ||
2268                             (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_COOKIE_ECHOED)) {
2269                                 /* Just abandon things in the front states */
2270                                 SCTP_TCB_LOCK(asoc);
2271                                 SCTP_INP_WUNLOCK(inp);
2272                                 sctp_free_assoc(inp, asoc);
2273                                 SCTP_INP_WLOCK(inp);
2274                                 continue;
2275                         } else {
2276                                 asoc->asoc.state |= SCTP_STATE_CLOSED_SOCKET;
2277                         }
2278                         if ((asoc->asoc.size_on_delivery_queue  > 0) ||
2279                             (asoc->asoc.size_on_reasm_queue > 0) ||
2280                             (asoc->asoc.size_on_all_streams > 0) ||
2281                             (so && (so->so_rcv.ssb_cc > 0))
2282                                 ) {
2283                                 /* Left with Data unread */
2284                                 struct mbuf *op_err;
2285                                 MGET(op_err, MB_DONTWAIT, MT_DATA);
2286                                 if (op_err) {
2287                                         /* Fill in the user initiated abort */
2288                                         struct sctp_paramhdr *ph;
2289                                         op_err->m_len =
2290                                             sizeof(struct sctp_paramhdr);
2291                                         ph = mtod(op_err,
2292                                             struct sctp_paramhdr *);
2293                                         ph->param_type = htons(
2294                                             SCTP_CAUSE_USER_INITIATED_ABT);
2295                                         ph->param_length = htons(op_err->m_len);
2296                                 }
2297                                 SCTP_TCB_LOCK(asoc);
2298                                 sctp_send_abort_tcb(asoc, op_err);
2299
2300                                 SCTP_INP_WUNLOCK(inp);
2301                                 sctp_free_assoc(inp, asoc);
2302                                 SCTP_INP_WLOCK(inp);
2303                                 continue;
2304                         } else if (TAILQ_EMPTY(&asoc->asoc.send_queue) &&
2305                             TAILQ_EMPTY(&asoc->asoc.sent_queue)) {
2306                                 if ((SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
2307                                     (SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
2308                                         /* there is nothing queued to send, so I send shutdown */
2309                                         SCTP_TCB_LOCK(asoc);
2310                                         sctp_send_shutdown(asoc, asoc->asoc.primary_destination);
2311                                         asoc->asoc.state = SCTP_STATE_SHUTDOWN_SENT;
2312                                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, asoc->sctp_ep, asoc,
2313                                                          asoc->asoc.primary_destination);
2314                                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, asoc->sctp_ep, asoc,
2315                                                          asoc->asoc.primary_destination);
2316                                         sctp_chunk_output(inp, asoc, 1);
2317                                         SCTP_TCB_UNLOCK(asoc);
2318                                 }
2319                         } else {
2320                                 /* mark into shutdown pending */
2321                                 asoc->asoc.state |= SCTP_STATE_SHUTDOWN_PENDING;
2322                         }
2323                         cnt_in_sd++;
2324                 }
2325                 /* now is there some left in our SHUTDOWN state? */
2326                 if (cnt_in_sd) {
2327                         inp->sctp_flags |= SCTP_PCB_FLAGS_SOCKET_GONE;
2328                         SCTP_INP_WUNLOCK(inp);
2329                         SCTP_ASOC_CREATE_UNLOCK(inp);
2330                         return;
2331                 }
2332         }
2333 #if defined(__FreeBSD__) && __FreeBSD_version >= 503000
2334         if (inp->refcount) {
2335                 sctp_timer_start(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL);
2336                 SCTP_INP_WUNLOCK(inp);
2337                 SCTP_ASOC_CREATE_UNLOCK(inp);
2338                 return;
2339         }
2340 #endif
2341         inp->sctp_flags |= SCTP_PCB_FLAGS_SOCKET_ALLGONE;
2342 #if !defined(__FreeBSD__) || __FreeBSD_version < 500000
2343         rt = ip_pcb->inp_route.ro_rt;
2344 #endif
2345
2346         callout_stop(&inp->sctp_ep.signature_change.timer);
2347
2348         if (so) {
2349         /* First take care of socket level things */
2350 #ifdef IPSEC
2351 #ifdef __OpenBSD__
2352         /* XXX IPsec cleanup here */
2353                 if (ip_pcb->inp_tdb_in)
2354                     TAILQ_REMOVE(&ip_pcb->inp_tdb_in->tdb_inp_in,
2355                                  ip_pcb, inp_tdb_in_next);
2356                 if (ip_pcb->inp_tdb_out)
2357                     TAILQ_REMOVE(&ip_pcb->inp_tdb_out->tdb_inp_out, ip_pcb,
2358                                  inp_tdb_out_next);
2359                 if (ip_pcb->inp_ipsec_localid)
2360                     ipsp_reffree(ip_pcb->inp_ipsec_localid);
2361                 if (ip_pcb->inp_ipsec_remoteid)
2362                     ipsp_reffree(ip_pcb->inp_ipsec_remoteid);
2363                 if (ip_pcb->inp_ipsec_localcred)
2364                     ipsp_reffree(ip_pcb->inp_ipsec_localcred);
2365                 if (ip_pcb->inp_ipsec_remotecred)
2366                     ipsp_reffree(ip_pcb->inp_ipsec_remotecred);
2367                 if (ip_pcb->inp_ipsec_localauth)
2368                     ipsp_reffree(ip_pcb->inp_ipsec_localauth);
2369                 if (ip_pcb->inp_ipsec_remoteauth)
2370                     ipsp_reffree(ip_pcb->inp_ipsec_remoteauth);
2371 #else
2372                 ipsec4_delete_pcbpolicy(ip_pcb);
2373 #endif
2374 #endif /*IPSEC*/
2375 #if defined(__FreeBSD__) && __FreeBSD_version > 500000
2376                 ACCEPT_LOCK();
2377                 SOCK_LOCK(so);
2378 #endif
2379                 so->so_pcb = NULL;
2380                 sofree(so);
2381         }
2382
2383         if (ip_pcb->inp_options) {
2384                 m_free(ip_pcb->inp_options);
2385                 ip_pcb->inp_options = 0;
2386         }
2387 #if !defined(__FreeBSD__) || __FreeBSD_version < 500000
2388         if (rt) {
2389                 RTFREE(rt);
2390                 ip_pcb->inp_route.ro_rt = 0;
2391         }
2392 #endif
2393         if (ip_pcb->inp_moptions) {
2394                 ip_freemoptions(ip_pcb->inp_moptions);
2395                 ip_pcb->inp_moptions = 0;
2396         }
2397 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__))
2398         inp->inp_vflag = 0;
2399 #else
2400         ip_pcb->inp_vflag = 0;
2401 #endif
2402
2403         /* Now the sctp_pcb things */
2404
2405         /*
2406          * free each asoc if it is not already closed/free. we can't use
2407          * the macro here since le_next will get freed as part of the
2408          * sctp_free_assoc() call.
2409          */
2410         cnt = 0;
2411         for ((asoc = LIST_FIRST(&inp->sctp_asoc_list)); asoc != NULL;
2412              asoc = nasoc) {
2413                 nasoc = LIST_NEXT(asoc, sctp_tcblist);
2414                 SCTP_TCB_LOCK(asoc);
2415                 if (SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_COOKIE_WAIT) {
2416                         struct mbuf *op_err;
2417                         MGET(op_err, MB_DONTWAIT, MT_DATA);
2418                         if (op_err) {
2419                                 /* Fill in the user initiated abort */
2420                                 struct sctp_paramhdr *ph;
2421                                 op_err->m_len = sizeof(struct sctp_paramhdr);
2422                                 ph = mtod(op_err, struct sctp_paramhdr *);
2423                                 ph->param_type = htons(
2424                                     SCTP_CAUSE_USER_INITIATED_ABT);
2425                                 ph->param_length = htons(op_err->m_len);
2426                         }
2427                         sctp_send_abort_tcb(asoc, op_err);
2428                 }
2429                 cnt++;
2430                 /*
2431                  * sctp_free_assoc() will call sctp_inpcb_free(),
2432                  * if SCTP_PCB_FLAGS_SOCKET_GONE set.
2433                  * So, we clear it before sctp_free_assoc() making sure
2434                  * no double sctp_inpcb_free().
2435                  */
2436                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_SOCKET_GONE;
2437                 SCTP_INP_WUNLOCK(inp);
2438                 sctp_free_assoc(inp, asoc);
2439                 SCTP_INP_WLOCK(inp);
2440         }
2441         while ((sq = TAILQ_FIRST(&inp->sctp_queue_list)) != NULL) {
2442                 TAILQ_REMOVE(&inp->sctp_queue_list, sq, next_sq);
2443                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_sockq, sq);
2444                 sctppcbinfo.ipi_count_sockq--;
2445                 sctppcbinfo.ipi_gencnt_sockq++;
2446         }
2447         inp->sctp_socket = 0;
2448         /* Now first we remove ourselves from the overall list of all EP's */
2449
2450         /* Unlock inp first, need correct order */
2451         SCTP_INP_WUNLOCK(inp);
2452         /* now iterator lock */
2453         SCTP_ITERATOR_LOCK();
2454         /* now info lock */
2455         SCTP_INP_INFO_WLOCK();
2456         /* now reget the inp lock */
2457         SCTP_INP_WLOCK(inp);
2458
2459         inp_save = LIST_NEXT(inp, sctp_list);
2460         LIST_REMOVE(inp, sctp_list);
2461         /*
2462          * Now the question comes as to if this EP was ever bound at all.
2463          * If it was, then we must pull it out of the EP hash list.
2464          */
2465         if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) !=
2466             SCTP_PCB_FLAGS_UNBOUND) {
2467                 /*
2468                  * ok, this guy has been bound. It's port is somewhere
2469                  * in the sctppcbinfo hash table. Remove it!
2470                  */
2471                 LIST_REMOVE(inp, sctp_hash);
2472         }
2473         /* fix any iterators only after out of the list */
2474         sctp_iterator_inp_being_freed(inp, inp_save);
2475         SCTP_ITERATOR_UNLOCK();
2476         /*
2477          * if we have an address list the following will free the list of
2478          * ifaddr's that are set into this ep. Again macro limitations here,
2479          * since the LIST_FOREACH could be a bad idea.
2480          */
2481         for ((laddr = LIST_FIRST(&inp->sctp_addr_list)); laddr != NULL;
2482              laddr = nladdr) {
2483                 nladdr = LIST_NEXT(laddr, sctp_nxt_addr);
2484                 LIST_REMOVE(laddr, sctp_nxt_addr);
2485                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr);
2486                 sctppcbinfo.ipi_gencnt_laddr++;
2487                 sctppcbinfo.ipi_count_laddr--;
2488         }
2489         /* Now lets see about freeing the EP hash table. */
2490         if (inp->sctp_tcbhash != NULL) {
2491                 hashdestroy(inp->sctp_tcbhash, M_PCB, inp->sctp_hashmark);
2492                 inp->sctp_tcbhash = 0;
2493         }
2494         SCTP_INP_WUNLOCK(inp);
2495         SCTP_ASOC_CREATE_UNLOCK(inp);
2496         SCTP_INP_LOCK_DESTROY(inp);
2497         SCTP_ASOC_CREATE_LOCK_DESTROY(inp);
2498
2499         /* Now we must put the ep memory back into the zone pool */
2500         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp);
2501         sctppcbinfo.ipi_count_ep--;
2502
2503         SCTP_INP_INFO_WUNLOCK();
2504 }
2505
2506
2507 struct sctp_nets *
2508 sctp_findnet(struct sctp_tcb *stcb, struct sockaddr *addr)
2509 {
2510         struct sctp_nets *net;
2511 #if 0
2512         struct sockaddr_in *sin;
2513
2514         /* why do we need to check the port for a nets list on an assoc? */
2515         /* use the peer's/remote port for lookup if unspecified */
2516         sin = (struct sockaddr_in *)addr;
2517         if (stcb->rport != sin->sin_port) {
2518                 /* we cheat and just a sin for this test */
2519                 return (NULL);
2520         }
2521 #endif
2522         /* locate the address */
2523         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2524                 if (sctp_cmpaddr(addr, (struct sockaddr *)&net->ro._l_addr))
2525                         return (net);
2526         }
2527         return (NULL);
2528 }
2529
2530
2531 /*
2532  * add's a remote endpoint address, done with the INIT/INIT-ACK
2533  * as well as when a ASCONF arrives that adds it. It will also
2534  * initialize all the cwnd stats of stuff.
2535  */
2536 int
2537 sctp_is_address_on_local_host(struct sockaddr *addr)
2538 {
2539         struct ifnet *ifn;
2540
2541         TAILQ_FOREACH(ifn, &ifnet, if_list) {
2542                 struct ifaddr_container *ifac;
2543
2544                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
2545                         struct ifaddr *ifa = ifac->ifa;
2546
2547                         if (addr->sa_family == ifa->ifa_addr->sa_family) {
2548                                 /* same family */
2549                                 if (addr->sa_family == AF_INET) {
2550                                         struct sockaddr_in *sin, *sin_c;
2551                                         sin = (struct sockaddr_in *)addr;
2552                                         sin_c = (struct sockaddr_in *)
2553                                             ifa->ifa_addr;
2554                                         if (sin->sin_addr.s_addr ==
2555                                             sin_c->sin_addr.s_addr) {
2556                                                 /* we are on the same machine */
2557                                                 return (1);
2558                                         }
2559                                 } else if (addr->sa_family == AF_INET6) {
2560                                         struct sockaddr_in6 *sin6, *sin_c6;
2561                                         sin6 = (struct sockaddr_in6 *)addr;
2562                                         sin_c6 = (struct sockaddr_in6 *)
2563                                             ifa->ifa_addr;
2564                                         if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
2565                                             &sin_c6->sin6_addr)) {
2566                                                 /* we are on the same machine */
2567                                                 return (1);
2568                                         }
2569                                 }
2570                         }
2571                 }
2572         }
2573         return (0);
2574 }
2575
2576 int
2577 sctp_add_remote_addr(struct sctp_tcb *stcb, struct sockaddr *newaddr,
2578     int set_scope, int from)
2579 {
2580         /*
2581          * The following is redundant to the same lines in the
2582          * sctp_aloc_assoc() but is needed since other's call the add
2583          * address function
2584          */
2585         struct sctp_nets *net, *netfirst;
2586         int addr_inscope;
2587
2588 #ifdef SCTP_DEBUG
2589         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
2590                 kprintf("Adding an address (from:%d) to the peer: ", from);
2591                 sctp_print_address(newaddr);
2592         }
2593 #endif
2594         netfirst = sctp_findnet(stcb, newaddr);
2595         if (netfirst) {
2596                 /*
2597                  * Lie and return ok, we don't want to make the association
2598                  * go away for this behavior. It will happen in the TCP model
2599                  * in a connected socket. It does not reach the hash table
2600                  * until after the association is built so it can't be found.
2601                  * Mark as reachable, since the initial creation will have
2602                  * been cleared and the NOT_IN_ASSOC flag will have been
2603                  * added... and we don't want to end up removing it back out.
2604                  */
2605                 if (netfirst->dest_state & SCTP_ADDR_UNCONFIRMED) {
2606                         netfirst->dest_state = (SCTP_ADDR_REACHABLE|
2607                             SCTP_ADDR_UNCONFIRMED);
2608                 } else {
2609                         netfirst->dest_state = SCTP_ADDR_REACHABLE;
2610                 }
2611
2612                 return (0);
2613         }
2614         addr_inscope = 1;
2615         if (newaddr->sa_family == AF_INET) {
2616                 struct sockaddr_in *sin;
2617                 sin = (struct sockaddr_in *)newaddr;
2618                 if (sin->sin_addr.s_addr == 0) {
2619                         /* Invalid address */
2620                         return (-1);
2621                 }
2622                 /* zero out the bzero area */
2623                 memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
2624
2625                 /* assure len is set */
2626                 sin->sin_len = sizeof(struct sockaddr_in);
2627                 if (set_scope) {
2628 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE
2629                         stcb->ipv4_local_scope = 1;
2630 #else
2631                         if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2632                                 stcb->asoc.ipv4_local_scope = 1;
2633                         }
2634 #endif /* SCTP_DONT_DO_PRIVADDR_SCOPE */
2635
2636                         if (sctp_is_address_on_local_host(newaddr)) {
2637                                 stcb->asoc.loopback_scope = 1;
2638                                 stcb->asoc.ipv4_local_scope = 1;
2639                                 stcb->asoc.local_scope = 1;
2640                                 stcb->asoc.site_scope = 1;
2641                         }
2642                 } else {
2643                         if (from == 8) {
2644                                 /* From connectx */
2645                                 if (sctp_is_address_on_local_host(newaddr)) {
2646                                         stcb->asoc.loopback_scope = 1;
2647                                         stcb->asoc.ipv4_local_scope = 1;
2648                                         stcb->asoc.local_scope = 1;
2649                                         stcb->asoc.site_scope = 1;
2650                                 }
2651                         }
2652                         /* Validate the address is in scope */
2653                         if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) &&
2654                             (stcb->asoc.ipv4_local_scope == 0)) {
2655                                 addr_inscope = 0;
2656                         }
2657                 }
2658         } else if (newaddr->sa_family == AF_INET6) {
2659                 struct sockaddr_in6 *sin6;
2660                 sin6 = (struct sockaddr_in6 *)newaddr;
2661                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2662                         /* Invalid address */
2663                         return (-1);
2664                 }
2665                 /* assure len is set */
2666                 sin6->sin6_len = sizeof(struct sockaddr_in6);
2667                 if (set_scope) {
2668                         if (sctp_is_address_on_local_host(newaddr)) {
2669                                 stcb->asoc.loopback_scope = 1;
2670                                 stcb->asoc.local_scope = 1;
2671                                 stcb->asoc.ipv4_local_scope = 1;
2672                                 stcb->asoc.site_scope = 1;
2673                         } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2674                                 /*
2675                                  * If the new destination is a LINK_LOCAL
2676                                  * we must have common site scope. Don't set
2677                                  * the local scope since we may not share all
2678                                  * links, only loopback can do this.
2679                                  * Links on the local network would also
2680                                  * be on our private network for v4 too.
2681                                  */
2682                                 stcb->asoc.ipv4_local_scope = 1;
2683                                 stcb->asoc.site_scope = 1;
2684                         } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
2685                                 /*
2686                                  * If the new destination is SITE_LOCAL
2687                                  * then we must have site scope in common.
2688                                  */
2689                                 stcb->asoc.site_scope = 1;
2690                         }
2691                 } else {
2692                         if (from == 8) {
2693                                 /* From connectx */
2694                                 if (sctp_is_address_on_local_host(newaddr)) {
2695                                         stcb->asoc.loopback_scope = 1;
2696                                         stcb->asoc.ipv4_local_scope = 1;
2697                                         stcb->asoc.local_scope = 1;
2698                                         stcb->asoc.site_scope = 1;
2699                                 }
2700                         }
2701                         /* Validate the address is in scope */
2702                         if (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr) &&
2703                             (stcb->asoc.loopback_scope == 0)) {
2704                                 addr_inscope = 0;
2705                         } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) &&
2706                                    (stcb->asoc.local_scope == 0)) {
2707                                 addr_inscope = 0;
2708                         } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr) &&
2709                                    (stcb->asoc.site_scope == 0)) {
2710                                 addr_inscope = 0;
2711                         }
2712                 }
2713         } else {
2714                 /* not supported family type */
2715                 return (-1);
2716         }
2717         net = (struct sctp_nets *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_net);
2718         if (net == NULL) {
2719                 return (-1);
2720         }
2721         sctppcbinfo.ipi_count_raddr++;
2722         sctppcbinfo.ipi_gencnt_raddr++;
2723         bzero(net, sizeof(*net));
2724         memcpy(&net->ro._l_addr, newaddr, newaddr->sa_len);
2725         if (newaddr->sa_family == AF_INET) {
2726                 ((struct sockaddr_in *)&net->ro._l_addr)->sin_port = stcb->rport;
2727         } else if (newaddr->sa_family == AF_INET6) {
2728                 ((struct sockaddr_in6 *)&net->ro._l_addr)->sin6_port = stcb->rport;
2729         }
2730         net->addr_is_local = sctp_is_address_on_local_host(newaddr);
2731         net->failure_threshold = stcb->asoc.def_net_failure;
2732         if (addr_inscope == 0) {
2733 #ifdef SCTP_DEBUG
2734                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
2735                         kprintf("Adding an address which is OUT OF SCOPE\n");
2736                 }
2737 #endif /* SCTP_DEBUG */
2738                 net->dest_state = (SCTP_ADDR_REACHABLE |
2739                     SCTP_ADDR_OUT_OF_SCOPE);
2740         } else {
2741                 if (from == 8)
2742                         /* 8 is passed by connect_x */
2743                         net->dest_state = SCTP_ADDR_REACHABLE;
2744                 else
2745                         net->dest_state = SCTP_ADDR_REACHABLE |
2746                             SCTP_ADDR_UNCONFIRMED;
2747         }
2748         net->RTO = stcb->asoc.initial_rto;
2749         stcb->asoc.numnets++;
2750         net->ref_count = 1;
2751
2752         /* Init the timer structure */
2753 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
2754         callout_init(&net->rxt_timer.timer, 0);
2755         callout_init(&net->pmtu_timer.timer, 0);
2756 #else
2757         callout_init(&net->rxt_timer.timer);
2758         callout_init(&net->pmtu_timer.timer);
2759 #endif
2760
2761         /* Now generate a route for this guy */
2762         /* KAME hack: embed scopeid */
2763         if (newaddr->sa_family == AF_INET6) {
2764                 struct sockaddr_in6 *sin6;
2765                 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
2766 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) || defined(__DragonFly__)
2767                 in6_embedscope(&sin6->sin6_addr, sin6,
2768                     &stcb->sctp_ep->ip_inp.inp, NULL);
2769 #else
2770                 in6_embedscope(&sin6->sin6_addr, sin6);
2771 #endif
2772 #ifndef SCOPEDROUTING
2773                 sin6->sin6_scope_id = 0;
2774 #endif
2775         }
2776 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
2777         rtalloc_ign((struct route *)&net->ro, 0UL);
2778 #else
2779         rtalloc((struct route *)&net->ro);
2780 #endif
2781         if (newaddr->sa_family == AF_INET6) {
2782                 struct sockaddr_in6 *sin6;
2783                 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
2784                 in6_recoverscope(sin6, &sin6->sin6_addr, NULL);
2785         }
2786         if ((net->ro.ro_rt) &&
2787             (net->ro.ro_rt->rt_ifp)) {
2788                 net->mtu = net->ro.ro_rt->rt_ifp->if_mtu;
2789                 if (from == 1) {
2790                         stcb->asoc.smallest_mtu = net->mtu;
2791                 }
2792                 /* start things off to match mtu of interface please. */
2793                 net->ro.ro_rt->rt_rmx.rmx_mtu = net->ro.ro_rt->rt_ifp->if_mtu;
2794         } else {
2795                 net->mtu = stcb->asoc.smallest_mtu;
2796         }
2797         if (stcb->asoc.smallest_mtu > net->mtu) {
2798                 stcb->asoc.smallest_mtu = net->mtu;
2799         }
2800         /* We take the max of the burst limit times a MTU or the INITIAL_CWND.
2801          * We then limit this to 4 MTU's of sending.
2802          */
2803         net->cwnd = min((net->mtu * 4), max((stcb->asoc.max_burst * net->mtu), SCTP_INITIAL_CWND));
2804
2805         /* we always get at LEAST 2 MTU's */
2806         if (net->cwnd < (2 * net->mtu)) {
2807                 net->cwnd = 2 * net->mtu;
2808         }
2809
2810         net->ssthresh = stcb->asoc.peers_rwnd;
2811
2812         net->src_addr_selected = 0;
2813         netfirst = TAILQ_FIRST(&stcb->asoc.nets);
2814         if (net->ro.ro_rt == NULL) {
2815                 /* Since we have no route put it at the back */
2816                 TAILQ_INSERT_TAIL(&stcb->asoc.nets, net, sctp_next);
2817         } else if (netfirst == NULL) {
2818                 /* We are the first one in the pool. */
2819                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
2820         } else if (netfirst->ro.ro_rt == NULL) {
2821                 /*
2822                  * First one has NO route. Place this one ahead of the
2823                  * first one.
2824                  */
2825                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
2826         } else if (net->ro.ro_rt->rt_ifp != netfirst->ro.ro_rt->rt_ifp) {
2827                 /*
2828                  * This one has a different interface than the one at the
2829                  * top of the list. Place it ahead.
2830                  */
2831                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
2832         } else {
2833                 /*
2834                  * Ok we have the same interface as the first one. Move
2835                  * forward until we find either
2836                  *   a) one with a NULL route... insert ahead of that
2837                  *   b) one with a different ifp.. insert after that.
2838                  *   c) end of the list.. insert at the tail.
2839                  */
2840                 struct sctp_nets *netlook;
2841                 do {
2842                         netlook = TAILQ_NEXT(netfirst, sctp_next);
2843                         if (netlook == NULL) {
2844                                 /* End of the list */
2845                                 TAILQ_INSERT_TAIL(&stcb->asoc.nets, net,
2846                                     sctp_next);
2847                                 break;
2848                         } else if (netlook->ro.ro_rt == NULL) {
2849                                 /* next one has NO route */
2850                                 TAILQ_INSERT_BEFORE(netfirst, net, sctp_next);
2851                                 break;
2852                         } else if (netlook->ro.ro_rt->rt_ifp !=
2853                                    net->ro.ro_rt->rt_ifp) {
2854                                 TAILQ_INSERT_AFTER(&stcb->asoc.nets, netlook,
2855                                     net, sctp_next);
2856                                 break;
2857                         }
2858                         /* Shift forward */
2859                         netfirst = netlook;
2860                 } while (netlook != NULL);
2861         }
2862         /* got to have a primary set */
2863         if (stcb->asoc.primary_destination == 0) {
2864                 stcb->asoc.primary_destination = net;
2865         } else if ((stcb->asoc.primary_destination->ro.ro_rt == NULL) &&
2866                    (net->ro.ro_rt)) {
2867                 /* No route to current primary adopt new primary */
2868                 stcb->asoc.primary_destination = net;
2869         }
2870         sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb,
2871             net);
2872
2873         return (0);
2874 }
2875
2876
2877 /*
2878  * allocate an association and add it to the endpoint. The caller must
2879  * be careful to add all additional addresses once they are know right
2880  * away or else the assoc will be may experience a blackout scenario.
2881  */
2882 struct sctp_tcb *
2883 sctp_aloc_assoc(struct sctp_inpcb *inp, struct sockaddr *firstaddr,
2884     int for_a_init, int *error,  uint32_t override_tag)
2885 {
2886         struct sctp_tcb *stcb;
2887         struct sctp_association *asoc;
2888         struct sctpasochead *head;
2889         uint16_t rport;
2890         int err;
2891
2892         /*
2893          * Assumption made here:
2894          *  Caller has done a sctp_findassociation_ep_addr(ep, addr's);
2895          *  to make sure the address does not exist already.
2896          */
2897         if (sctppcbinfo.ipi_count_asoc >= SCTP_MAX_NUM_OF_ASOC) {
2898                 /* Hit max assoc, sorry no more */
2899                 *error = ENOBUFS;
2900                 return (NULL);
2901         }
2902         SCTP_INP_RLOCK(inp);
2903         if (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) {
2904                 /*
2905                  * If its in the TCP pool, its NOT allowed to create an
2906                  * association. The parent listener needs to call
2907                  * sctp_aloc_assoc.. or the one-2-many socket. If a
2908                  * peeled off, or connected one does this.. its an error.
2909                  */
2910                 SCTP_INP_RUNLOCK(inp);
2911                 *error = EINVAL;
2912                 return (NULL);
2913         }
2914
2915 #ifdef SCTP_DEBUG
2916         if (sctp_debug_on & SCTP_DEBUG_PCB3) {
2917                 kprintf("Allocate an association for peer:");
2918                 if (firstaddr)
2919                         sctp_print_address(firstaddr);
2920                 else
2921                         kprintf("None\n");
2922                 kprintf("Port:%d\n",
2923                        ntohs(((struct sockaddr_in *)firstaddr)->sin_port));
2924         }
2925 #endif /* SCTP_DEBUG */
2926         if (firstaddr->sa_family == AF_INET) {
2927                 struct sockaddr_in *sin;
2928                 sin = (struct sockaddr_in *)firstaddr;
2929                 if ((sin->sin_port == 0) || (sin->sin_addr.s_addr == 0)) {
2930                         /* Invalid address */
2931 #ifdef SCTP_DEBUG
2932                         if (sctp_debug_on & SCTP_DEBUG_PCB3) {
2933                                 kprintf("peer address invalid\n");
2934                         }
2935 #endif
2936                         SCTP_INP_RUNLOCK(inp);
2937                         *error = EINVAL;
2938                         return (NULL);
2939                 }
2940                 rport = sin->sin_port;
2941         } else if (firstaddr->sa_family == AF_INET6) {
2942                 struct sockaddr_in6 *sin6;
2943                 sin6 = (struct sockaddr_in6 *)firstaddr;
2944                 if ((sin6->sin6_port == 0) ||
2945                     (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))) {
2946                         /* Invalid address */
2947 #ifdef SCTP_DEBUG
2948                         if (sctp_debug_on & SCTP_DEBUG_PCB3) {
2949                                 kprintf("peer address invalid\n");
2950                         }
2951 #endif
2952                         SCTP_INP_RUNLOCK(inp);
2953                         *error = EINVAL;
2954                         return (NULL);
2955                 }
2956                 rport = sin6->sin6_port;
2957         } else {
2958                 /* not supported family type */
2959 #ifdef SCTP_DEBUG
2960                 if (sctp_debug_on & SCTP_DEBUG_PCB3) {
2961                         kprintf("BAD family %d\n", firstaddr->sa_family);
2962                 }
2963 #endif
2964                 SCTP_INP_RUNLOCK(inp);
2965                 *error = EINVAL;
2966                 return (NULL);
2967         }
2968         SCTP_INP_RUNLOCK(inp);
2969         if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
2970                 /*
2971                  * If you have not performed a bind, then we need to do
2972                  * the ephemerial bind for you.
2973                  */
2974 #ifdef SCTP_DEBUG
2975                 if (sctp_debug_on & SCTP_DEBUG_PCB3) {
2976                         kprintf("Doing implicit BIND\n");
2977                 }
2978 #endif
2979
2980                 if ((err = sctp_inpcb_bind(inp->sctp_socket,
2981                     NULL,
2982 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000) || defined(__DragonFly__)
2983                                            NULL
2984 #else
2985                                            NULL
2986 #endif
2987                              ))){
2988                         /* bind error, probably perm */
2989 #ifdef SCTP_DEBUG
2990                         if (sctp_debug_on & SCTP_DEBUG_PCB3) {
2991                                 kprintf("BIND FAILS ret:%d\n", err);
2992                         }
2993 #endif
2994
2995                         *error = err;
2996                         return (NULL);
2997                 }
2998         }
2999         stcb = (struct sctp_tcb *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_asoc);
3000         if (stcb == NULL) {
3001                 /* out of memory? */
3002 #ifdef SCTP_DEBUG
3003                 if (sctp_debug_on & SCTP_DEBUG_PCB3) {
3004                         kprintf("aloc_assoc: no assoc mem left, stcb=NULL\n");
3005                 }
3006 #endif
3007                 *error = ENOMEM;
3008                 return (NULL);
3009         }
3010         sctppcbinfo.ipi_count_asoc++;
3011         sctppcbinfo.ipi_gencnt_asoc++;
3012
3013         bzero(stcb, sizeof(*stcb));
3014         asoc = &stcb->asoc;
3015         SCTP_TCB_LOCK_INIT(stcb);
3016         /* setup back pointer's */
3017         stcb->sctp_ep = inp;
3018         stcb->sctp_socket = inp->sctp_socket;
3019         if ((err = sctp_init_asoc(inp, asoc, for_a_init, override_tag))) {
3020                 /* failed */
3021                 SCTP_TCB_LOCK_DESTROY (stcb);
3022                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb);
3023                 sctppcbinfo.ipi_count_asoc--;
3024 #ifdef SCTP_DEBUG
3025                 if (sctp_debug_on & SCTP_DEBUG_PCB3) {
3026                         kprintf("aloc_assoc: couldn't init asoc, out of mem?!\n");
3027                 }
3028 #endif
3029                 *error = err;
3030                 return (NULL);
3031         }
3032         /* and the port */
3033         stcb->rport = rport;
3034         SCTP_INP_INFO_WLOCK();
3035         SCTP_INP_WLOCK(inp);
3036         if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
3037                 /* inpcb freed while alloc going on */
3038                 SCTP_TCB_LOCK_DESTROY (stcb);
3039                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb);
3040                 SCTP_INP_WUNLOCK(inp);
3041                 SCTP_INP_INFO_WUNLOCK();
3042                 sctppcbinfo.ipi_count_asoc--;
3043 #ifdef SCTP_DEBUG
3044                 if (sctp_debug_on & SCTP_DEBUG_PCB3) {
3045                         kprintf("aloc_assoc: couldn't init asoc, out of mem?!\n");
3046                 }
3047 #endif
3048                 *error = EINVAL;
3049                 return (NULL);
3050         }
3051         SCTP_TCB_LOCK(stcb);
3052
3053         /* now that my_vtag is set, add it to the  hash */
3054         head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag,
3055              sctppcbinfo.hashasocmark)];
3056         /* put it in the bucket in the vtag hash of assoc's for the system */
3057         LIST_INSERT_HEAD(head, stcb, sctp_asocs);
3058         SCTP_INP_INFO_WUNLOCK();
3059
3060
3061         if ((err = sctp_add_remote_addr(stcb, firstaddr, 1, 1))) {
3062                 /* failure.. memory error? */
3063                 if (asoc->strmout)
3064                         kfree(asoc->strmout, M_PCB);
3065                 if (asoc->mapping_array)
3066                         kfree(asoc->mapping_array, M_PCB);
3067
3068                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb);
3069                 sctppcbinfo.ipi_count_asoc--;
3070 #ifdef SCTP_DEBUG
3071                 if (sctp_debug_on & SCTP_DEBUG_PCB3) {
3072                         kprintf("aloc_assoc: couldn't add remote addr!\n");
3073                 }
3074 #endif
3075                 SCTP_TCB_LOCK_DESTROY (stcb);
3076                 *error = ENOBUFS;
3077                 return (NULL);
3078         }
3079         /* Init all the timers */
3080 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
3081         callout_init(&asoc->hb_timer.timer, 0);
3082         callout_init(&asoc->dack_timer.timer, 0);
3083         callout_init(&asoc->asconf_timer.timer, 0);
3084         callout_init(&asoc->shut_guard_timer.timer, 0);
3085         callout_init(&asoc->autoclose_timer.timer, 0);
3086         callout_init(&asoc->delayed_event_timer.timer, 0);
3087 #else
3088         callout_init(&asoc->hb_timer.timer);
3089         callout_init(&asoc->dack_timer.timer);
3090         callout_init(&asoc->asconf_timer.timer);
3091         callout_init(&asoc->shut_guard_timer.timer);
3092         callout_init(&asoc->autoclose_timer.timer);
3093         callout_init(&asoc->delayed_event_timer.timer);
3094 #endif
3095         LIST_INSERT_HEAD(&inp->sctp_asoc_list, stcb, sctp_tcblist);
3096         /* now file the port under the hash as well */
3097         if (inp->sctp_tcbhash != NULL) {
3098                 head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(stcb->rport,
3099                    inp->sctp_hashmark)];
3100                 LIST_INSERT_HEAD(head, stcb, sctp_tcbhash);
3101         }
3102         SCTP_INP_WUNLOCK(inp);
3103 #ifdef SCTP_DEBUG
3104         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
3105                 kprintf("Association %p now allocated\n", stcb);
3106         }
3107 #endif
3108         return (stcb);
3109 }
3110
3111 void
3112 sctp_free_remote_addr(struct sctp_nets *net)
3113 {
3114         if (net == NULL)
3115                 return;
3116         net->ref_count--;
3117         if (net->ref_count <= 0) {
3118                 /* stop timer if running */
3119                 callout_stop(&net->rxt_timer.timer);
3120                 callout_stop(&net->pmtu_timer.timer);
3121                 net->dest_state = SCTP_ADDR_NOT_REACHABLE;
3122                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_net, net);
3123                 sctppcbinfo.ipi_count_raddr--;
3124         }
3125 }
3126
3127 /*
3128  * remove a remote endpoint address from an association, it
3129  * will fail if the address does not exist.
3130  */
3131 int
3132 sctp_del_remote_addr(struct sctp_tcb *stcb, struct sockaddr *remaddr)
3133 {
3134         /*
3135          * Here we need to remove a remote address. This is quite simple, we
3136          * first find it in the list of address for the association
3137          * (tasoc->asoc.nets) and then if it is there, we do a LIST_REMOVE on
3138          * that item.
3139          * Note we do not allow it to be removed if there are no other
3140          * addresses.
3141          */
3142         struct sctp_association *asoc;
3143         struct sctp_nets *net, *net_tmp;
3144         asoc = &stcb->asoc;
3145         if (asoc->numnets < 2) {
3146                 /* Must have at LEAST two remote addresses */
3147                 return (-1);
3148         }
3149         /* locate the address */
3150         for (net = TAILQ_FIRST(&asoc->nets); net != NULL; net = net_tmp) {
3151                 net_tmp = TAILQ_NEXT(net, sctp_next);
3152                 if (net->ro._l_addr.sa.sa_family != remaddr->sa_family) {
3153                         continue;
3154                 }
3155                 if (sctp_cmpaddr((struct sockaddr *)&net->ro._l_addr,
3156                     remaddr)) {
3157                         /* we found the guy */
3158                         asoc->numnets--;
3159                         TAILQ_REMOVE(&asoc->nets, net, sctp_next);
3160                         sctp_free_remote_addr(net);
3161                         if (net == asoc->primary_destination) {
3162                                 /* Reset primary */
3163                                 struct sctp_nets *lnet;
3164                                 lnet = TAILQ_FIRST(&asoc->nets);
3165                                 /* Try to find a confirmed primary */
3166                                 asoc->primary_destination =
3167                                     sctp_find_alternate_net(stcb, lnet);
3168                         }
3169                         if (net == asoc->last_data_chunk_from) {
3170                                 /* Reset primary */
3171                                 asoc->last_data_chunk_from =
3172                                     TAILQ_FIRST(&asoc->nets);
3173                         }
3174                         if (net == asoc->last_control_chunk_from) {
3175                                 /* Reset primary */
3176                                 asoc->last_control_chunk_from =
3177                                     TAILQ_FIRST(&asoc->nets);
3178                         }
3179                         if (net == asoc->asconf_last_sent_to) {
3180                                 /* Reset primary */
3181                                 asoc->asconf_last_sent_to =
3182                                     TAILQ_FIRST(&asoc->nets);
3183                         }
3184                         return (0);
3185                 }
3186         }
3187         /* not found. */
3188         return (-2);
3189 }
3190
3191
3192 static void
3193 sctp_add_vtag_to_timewait(struct sctp_inpcb *inp, u_int32_t tag)
3194 {
3195         struct sctpvtaghead *chain;
3196         struct sctp_tagblock *twait_block;
3197         struct timeval now;
3198         int set, i;
3199         SCTP_GETTIME_TIMEVAL(&now);
3200         chain = &sctppcbinfo.vtag_timewait[(tag % SCTP_STACK_VTAG_HASH_SIZE)];
3201         set = 0;
3202         if (!LIST_EMPTY(chain)) {
3203                 /* Block(s) present, lets find space, and expire on the fly */
3204                 LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) {
3205                         for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) {
3206                                 if ((twait_block->vtag_block[i].v_tag == 0) &&
3207                                     !set) {
3208                                         twait_block->vtag_block[0].tv_sec_at_expire =
3209                                             now.tv_sec + SCTP_TIME_WAIT;
3210                                         twait_block->vtag_block[0].v_tag = tag;
3211                                         set = 1;
3212                                 } else if ((twait_block->vtag_block[i].v_tag) &&
3213                                     ((long)twait_block->vtag_block[i].tv_sec_at_expire >
3214                                     now.tv_sec)) {
3215                                         /* Audit expires this guy */
3216                                         twait_block->vtag_block[i].tv_sec_at_expire = 0;
3217                                         twait_block->vtag_block[i].v_tag = 0;
3218                                         if (set == 0) {
3219                                                 /* Reuse it for my new tag */
3220                                                 twait_block->vtag_block[0].tv_sec_at_expire = now.tv_sec + SCTP_TIME_WAIT;
3221                                                 twait_block->vtag_block[0].v_tag = tag;
3222                                                 set = 1;
3223                                         }
3224                                 }
3225                         }
3226                         if (set) {
3227                                 /*
3228                                  * We only do up to the block where we can
3229                                  * place our tag for audits
3230                                  */
3231                                 break;
3232                         }
3233                 }
3234         }
3235         /* Need to add a new block to chain */
3236         if (!set) {
3237                 twait_block = kmalloc(sizeof(struct sctp_tagblock), M_PCB,
3238                                       M_NOWAIT);
3239                 if (twait_block == NULL) {
3240                         return;
3241                 }
3242                 memset(twait_block, 0, sizeof(struct sctp_timewait));
3243                 LIST_INSERT_HEAD(chain, twait_block, sctp_nxt_tagblock);
3244                 twait_block->vtag_block[0].tv_sec_at_expire = now.tv_sec +
3245                     SCTP_TIME_WAIT;
3246                 twait_block->vtag_block[0].v_tag = tag;
3247         }
3248 }
3249
3250
3251 static void
3252 sctp_iterator_asoc_being_freed(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
3253 {
3254         struct sctp_iterator *it;
3255
3256
3257
3258         /* Unlock the tcb lock we do this so
3259          * we avoid a dead lock scenario where
3260          * the iterator is waiting on the TCB lock
3261          * and the TCB lock is waiting on the iterator
3262          * lock.
3263          */
3264         SCTP_ITERATOR_LOCK();
3265         SCTP_INP_INFO_WLOCK();
3266         SCTP_INP_WLOCK(inp);
3267         SCTP_TCB_LOCK(stcb);
3268
3269         it = stcb->asoc.stcb_starting_point_for_iterator;
3270         if (it == NULL) {
3271                 return;
3272         }
3273         if (it->inp != stcb->sctp_ep) {
3274                 /* hm, focused on the wrong one? */
3275                 return;
3276         }
3277         if (it->stcb != stcb) {
3278                 return;
3279         }
3280         it->stcb = LIST_NEXT(stcb, sctp_tcblist);
3281         if (it->stcb == NULL) {
3282                 /* done with all asoc's in this assoc */
3283                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
3284                         it->inp = NULL;
3285                 } else {
3286
3287                         it->inp = LIST_NEXT(inp, sctp_list);
3288                 }
3289         }
3290 }
3291
3292 /*
3293  * Free the association after un-hashing the remote port.
3294  */
3295 void
3296 sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
3297 {
3298         struct sctp_association *asoc;
3299         struct sctp_nets *net, *prev;
3300         struct sctp_laddr *laddr;
3301         struct sctp_tmit_chunk *chk;
3302         struct sctp_asconf_addr *aparam;
3303         struct sctp_socket_q_list *sq;
3304
3305         /* first, lets purge the entry from the hash table. */
3306         if (stcb->asoc.state == 0) {
3307                 kprintf("Freeing already free association:%p - huh??\n",
3308                     stcb);
3309                 return;
3310         }
3311         asoc = &stcb->asoc;
3312         asoc->state = 0;
3313         /* now clean up any other timers */
3314         callout_stop(&asoc->hb_timer.timer);
3315         callout_stop(&asoc->dack_timer.timer);
3316         callout_stop(&asoc->asconf_timer.timer);
3317         callout_stop(&asoc->shut_guard_timer.timer);
3318         callout_stop(&asoc->autoclose_timer.timer);
3319         callout_stop(&asoc->delayed_event_timer.timer);
3320         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3321                 callout_stop(&net->rxt_timer.timer);
3322                 callout_stop(&net->pmtu_timer.timer);
3323         }
3324
3325         /* Iterator asoc being freed we send an
3326          * unlocked TCB. It returns with INP_INFO
3327          * and INP write locked and the TCB locked
3328          * too and of course the iterator lock
3329          * in place as well..
3330          */
3331         SCTP_TCB_UNLOCK(stcb);
3332         sctp_iterator_asoc_being_freed(inp, stcb);
3333
3334         /* Null all of my entry's on the socket q */
3335         TAILQ_FOREACH(sq, &inp->sctp_queue_list, next_sq) {
3336                 if (sq->tcb == stcb) {
3337                         sq->tcb = NULL;
3338                 }
3339         }
3340
3341         if (inp->sctp_tcb_at_block == (void *)stcb) {
3342                 inp->error_on_block = ECONNRESET;
3343         }
3344
3345         if (inp->sctp_tcbhash) {
3346                 LIST_REMOVE(stcb, sctp_tcbhash);
3347         }
3348         /* Now lets remove it from the list of ALL associations in the EP */
3349         LIST_REMOVE(stcb, sctp_tcblist);
3350         SCTP_INP_WUNLOCK(inp);
3351         SCTP_ITERATOR_UNLOCK();
3352
3353
3354         /* pull from vtag hash */
3355         LIST_REMOVE(stcb, sctp_asocs);
3356
3357         /*
3358          * Now before we can free the assoc, we must  remove all of the
3359          * networks and any other allocated space.. i.e. add removes here
3360          * before the SCTP_ZONE_FREE() of the tasoc entry.
3361          */
3362
3363         sctp_add_vtag_to_timewait(inp, asoc->my_vtag);
3364         SCTP_INP_INFO_WUNLOCK();
3365         prev = NULL;
3366         while (!TAILQ_EMPTY(&asoc->nets)) {
3367                 net = TAILQ_FIRST(&asoc->nets);
3368                 /* pull from list */
3369                 if ((sctppcbinfo.ipi_count_raddr == 0) || (prev == net)) {
3370                         break;
3371                 }
3372                 prev = net;
3373                 TAILQ_REMOVE(&asoc->nets, net, sctp_next);
3374                 /* free it */
3375                 net->ref_count = 0;
3376                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_net, net);
3377                 sctppcbinfo.ipi_count_raddr--;
3378         }
3379         /*
3380          * The chunk lists and such SHOULD be empty but we check them
3381          * just in case.
3382          */
3383         /* anything on the wheel needs to be removed */
3384         while (!TAILQ_EMPTY(&asoc->out_wheel)) {
3385                 struct sctp_stream_out *outs;
3386                 outs = TAILQ_FIRST(&asoc->out_wheel);
3387                 TAILQ_REMOVE(&asoc->out_wheel, outs, next_spoke);
3388                 /* now clean up any chunks here */
3389                 chk = TAILQ_FIRST(&outs->outqueue);
3390                 while (chk) {
3391                         TAILQ_REMOVE(&outs->outqueue, chk, sctp_next);
3392                         if (chk->data) {
3393                                 sctp_m_freem(chk->data);
3394                                 chk->data = NULL;
3395                         }
3396                         chk->whoTo = NULL;
3397                         chk->asoc = NULL;
3398                         /* Free the chunk */
3399                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
3400                         sctppcbinfo.ipi_count_chunk--;
3401                         sctppcbinfo.ipi_gencnt_chunk++;
3402                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
3403                                 panic("Chunk count is negative");
3404                         }
3405                         chk = TAILQ_FIRST(&outs->outqueue);
3406                 }
3407                 outs = TAILQ_FIRST(&asoc->out_wheel);
3408         }
3409
3410         if (asoc->pending_reply) {
3411                 kfree(asoc->pending_reply, M_PCB);
3412                 asoc->pending_reply = NULL;
3413         }
3414         chk = TAILQ_FIRST(&asoc->pending_reply_queue);
3415         while (chk) {
3416                 TAILQ_REMOVE(&asoc->pending_reply_queue, chk, sctp_next);
3417                 if (chk->data) {
3418                         sctp_m_freem(chk->data);
3419                         chk->data = NULL;
3420                 }
3421                 chk->whoTo = NULL;
3422                 chk->asoc = NULL;
3423                 /* Free the chunk */
3424                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
3425                 sctppcbinfo.ipi_count_chunk--;
3426                 sctppcbinfo.ipi_gencnt_chunk++;
3427                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
3428                         panic("Chunk count is negative");
3429                 }
3430                 chk = TAILQ_FIRST(&asoc->pending_reply_queue);
3431         }
3432         /* pending send queue SHOULD be empty */
3433         if (!TAILQ_EMPTY(&asoc->send_queue)) {
3434                 chk = TAILQ_FIRST(&asoc->send_queue);
3435                 while (chk) {
3436                         TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
3437                         if (chk->data) {
3438                                 sctp_m_freem(chk->data);
3439                                 chk->data = NULL;
3440                         }
3441                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
3442                         sctppcbinfo.ipi_count_chunk--;
3443                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
3444                                 panic("Chunk count is negative");
3445                         }
3446                         sctppcbinfo.ipi_gencnt_chunk++;
3447                         chk = TAILQ_FIRST(&asoc->send_queue);
3448                 }
3449         }
3450         /* sent queue SHOULD be empty */
3451         if (!TAILQ_EMPTY(&asoc->sent_queue)) {
3452                 chk = TAILQ_FIRST(&asoc->sent_queue);
3453                 while (chk) {
3454                         TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
3455                         if (chk->data) {
3456                                 sctp_m_freem(chk->data);
3457                                 chk->data = NULL;
3458                         }
3459                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
3460                         sctppcbinfo.ipi_count_chunk--;
3461                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
3462                                 panic("Chunk count is negative");
3463                         }
3464                         sctppcbinfo.ipi_gencnt_chunk++;
3465                         chk = TAILQ_FIRST(&asoc->sent_queue);
3466                 }
3467         }
3468         /* control queue MAY not be empty */
3469         if (!TAILQ_EMPTY(&asoc->control_send_queue)) {
3470                 chk = TAILQ_FIRST(&asoc->control_send_queue);
3471                 while (chk) {
3472                         TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
3473                         if (chk->data) {
3474                                 sctp_m_freem(chk->data);
3475                                 chk->data = NULL;
3476                         }
3477                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
3478                         sctppcbinfo.ipi_count_chunk--;
3479                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
3480                                 panic("Chunk count is negative");
3481                         }
3482                         sctppcbinfo.ipi_gencnt_chunk++;
3483                         chk = TAILQ_FIRST(&asoc->control_send_queue);
3484                 }
3485         }
3486         if (!TAILQ_EMPTY(&asoc->reasmqueue)) {
3487                 chk = TAILQ_FIRST(&asoc->reasmqueue);
3488                 while (chk) {
3489                         TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
3490                         if (chk->data) {
3491                                 sctp_m_freem(chk->data);
3492                                 chk->data = NULL;
3493                         }
3494                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
3495                         sctppcbinfo.ipi_count_chunk--;
3496                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
3497                                 panic("Chunk count is negative");
3498                         }
3499                         sctppcbinfo.ipi_gencnt_chunk++;
3500                         chk = TAILQ_FIRST(&asoc->reasmqueue);
3501                 }
3502         }
3503         if (!TAILQ_EMPTY(&asoc->delivery_queue)) {
3504                 chk = TAILQ_FIRST(&asoc->delivery_queue);
3505                 while (chk) {
3506                         TAILQ_REMOVE(&asoc->delivery_queue, chk, sctp_next);
3507                         if (chk->data) {
3508                                 sctp_m_freem(chk->data);
3509                                 chk->data = NULL;
3510                         }
3511                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
3512                         sctppcbinfo.ipi_count_chunk--;
3513                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
3514                                 panic("Chunk count is negative");
3515                         }
3516                         sctppcbinfo.ipi_gencnt_chunk++;
3517                         chk = TAILQ_FIRST(&asoc->delivery_queue);
3518                 }
3519         }
3520         if (asoc->mapping_array) {
3521                 kfree(asoc->mapping_array, M_PCB);
3522                 asoc->mapping_array = NULL;
3523         }
3524
3525         /* the stream outs */
3526         if (asoc->strmout) {
3527                 kfree(asoc->strmout, M_PCB);
3528                 asoc->strmout = NULL;
3529         }
3530         asoc->streamoutcnt = 0;
3531         if (asoc->strmin) {
3532                 int i;
3533                 for (i = 0; i < asoc->streamincnt; i++) {
3534                         if (!TAILQ_EMPTY(&asoc->strmin[i].inqueue)) {
3535                                 /* We have somethings on the streamin queue */
3536                                 chk = TAILQ_FIRST(&asoc->strmin[i].inqueue);
3537                                 while (chk) {
3538                                         TAILQ_REMOVE(&asoc->strmin[i].inqueue,
3539                                             chk, sctp_next);
3540                                         if (chk->data) {
3541                                                 sctp_m_freem(chk->data);
3542                                                 chk->data = NULL;
3543                                         }
3544                                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk,
3545                                             chk);
3546                                         sctppcbinfo.ipi_count_chunk--;
3547                                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
3548                                                 panic("Chunk count is negative");
3549                                         }
3550                                         sctppcbinfo.ipi_gencnt_chunk++;
3551                                         chk = TAILQ_FIRST(&asoc->strmin[i].inqueue);
3552                                 }
3553                         }
3554                 }
3555                 kfree(asoc->strmin, M_PCB);
3556                 asoc->strmin = NULL;
3557         }
3558         asoc->streamincnt = 0;
3559         /* local addresses, if any */
3560         while (!LIST_EMPTY(&asoc->sctp_local_addr_list)) {
3561                 laddr = LIST_FIRST(&asoc->sctp_local_addr_list);
3562                 LIST_REMOVE(laddr, sctp_nxt_addr);
3563                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr);
3564                 sctppcbinfo.ipi_count_laddr--;
3565         }
3566         /* pending asconf (address) parameters */
3567         while (!TAILQ_EMPTY(&asoc->asconf_queue)) {
3568                 aparam = TAILQ_FIRST(&asoc->asconf_queue);
3569                 TAILQ_REMOVE(&asoc->asconf_queue, aparam, next);
3570                 kfree(aparam, M_PCB);
3571         }
3572         if (asoc->last_asconf_ack_sent != NULL) {
3573                 sctp_m_freem(asoc->last_asconf_ack_sent);
3574                 asoc->last_asconf_ack_sent = NULL;
3575         }
3576         /* Insert new items here :> */
3577
3578         /* Get rid of LOCK */
3579         SCTP_TCB_LOCK_DESTROY(stcb);
3580
3581         /* now clean up the tasoc itself */
3582         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb);
3583         sctppcbinfo.ipi_count_asoc--;
3584         if ((inp->sctp_socket->so_snd.ssb_cc) ||
3585             (inp->sctp_socket->so_snd.ssb_mbcnt)) {
3586                 /* This will happen when a abort is done */
3587                 inp->sctp_socket->so_snd.ssb_cc = 0;
3588                 inp->sctp_socket->so_snd.ssb_mbcnt = 0;
3589         }
3590         if (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
3591                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) {
3592                         if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
3593                                 /*
3594                                  * For the base fd, that is NOT in TCP pool we
3595                                  * turn off the connected flag. This allows
3596                                  * non-listening endpoints to connect/shutdown/
3597                                  * connect.
3598                                  */
3599                                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED;
3600                                 soisdisconnected(inp->sctp_socket);
3601                         }
3602                         /*
3603                          * For those that are in the TCP pool we just leave
3604                          * so it cannot be used. When they close the fd we
3605                          * will free it all.
3606                          */
3607                 }
3608         }
3609         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3610                 sctp_inpcb_free(inp, 0);
3611         }
3612 }
3613
3614
3615 /*
3616  * determine if a destination is "reachable" based upon the addresses
3617  * bound to the current endpoint (e.g. only v4 or v6 currently bound)
3618  */
3619 /*
3620  * FIX: if we allow assoc-level bindx(), then this needs to be fixed
3621  * to use assoc level v4/v6 flags, as the assoc *may* not have the
3622  * same address types bound as its endpoint
3623  */
3624 int
3625 sctp_destination_is_reachable(struct sctp_tcb *stcb, struct sockaddr *destaddr)
3626 {
3627         struct sctp_inpcb *inp;
3628         int answer;
3629
3630         /* No locks here, the TCB, in all cases is already
3631          * locked and an assoc is up. There is either a
3632          * INP lock by the caller applied (in asconf case when
3633          * deleting an address) or NOT in the HB case, however
3634          * if HB then the INP increment is up and the INP
3635          * will not be removed (on top of the fact that
3636          * we have a TCB lock). So we only want to
3637          * read the sctp_flags, which is either bound-all
3638          * or not.. no protection needed since once an
3639          * assoc is up you can't be changing your binding.
3640          */
3641         inp = stcb->sctp_ep;
3642         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3643                 /* if bound all, destination is not restricted */
3644                 /* RRS: Question during lock work: Is this
3645                  * correct? If you are bound-all you still
3646                  * might need to obey the V4--V6 flags???
3647                  * IMO this bound-all stuff needs to be removed!
3648                  */
3649                 return (1);
3650         }
3651         /* NOTE: all "scope" checks are done when local addresses are added */
3652         if (destaddr->sa_family == AF_INET6) {
3653 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__))
3654                 answer = inp->inp_vflag & INP_IPV6;
3655 #else
3656                 answer = inp->ip_inp.inp.inp_vflag & INP_IPV6;
3657 #endif
3658         } else if (destaddr->sa_family == AF_INET) {
3659 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__))
3660                 answer = inp->inp_vflag & INP_IPV4;
3661 #else
3662                 answer = inp->ip_inp.inp.inp_vflag & INP_IPV4;
3663 #endif
3664         } else {
3665                 /* invalid family, so it's unreachable */
3666                 answer = 0;
3667         }
3668         return (answer);
3669 }
3670
3671 /*
3672  * update the inp_vflags on an endpoint
3673  */
3674 static void
3675 sctp_update_ep_vflag(struct sctp_inpcb *inp) {
3676         struct sctp_laddr *laddr;
3677
3678         /* first clear the flag */
3679 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__))
3680         inp->inp_vflag = 0;
3681 #else
3682         inp->ip_inp.inp.inp_vflag = 0;
3683 #endif
3684         /* set the flag based on addresses on the ep list */
3685         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3686                 if (laddr->ifa == NULL) {
3687 #ifdef SCTP_DEBUG
3688                         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
3689                                 kprintf("An ounce of prevention is worth a pound of cure\n");
3690                         }
3691 #endif /* SCTP_DEBUG */
3692                         continue;
3693                 }
3694                 if (laddr->ifa->ifa_addr) {
3695                         continue;
3696                 }
3697                 if (laddr->ifa->ifa_addr->sa_family == AF_INET6) {
3698 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__))
3699                         inp->inp_vflag |= INP_IPV6;
3700 #else
3701                         inp->ip_inp.inp.inp_vflag |= INP_IPV6;
3702 #endif
3703                 } else if (laddr->ifa->ifa_addr->sa_family == AF_INET) {
3704 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__))
3705                         inp->inp_vflag |= INP_IPV4;
3706 #else
3707                         inp->ip_inp.inp.inp_vflag |= INP_IPV4;
3708 #endif
3709                 }
3710         }
3711 }
3712
3713 /*
3714  * Add the address to the endpoint local address list
3715  * There is nothing to be done if we are bound to all addresses
3716  */
3717 int
3718 sctp_add_local_addr_ep(struct sctp_inpcb *inp, struct ifaddr *ifa)
3719 {
3720         struct sctp_laddr *laddr;
3721         int fnd, error;
3722         fnd = 0;
3723
3724         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3725                 /* You are already bound to all. You have it already */
3726                 return (0);
3727         }
3728         if (ifa->ifa_addr->sa_family == AF_INET6) {
3729                 struct in6_ifaddr *ifa6;
3730                 ifa6 = (struct in6_ifaddr *)ifa;
3731                 if (ifa6->ia6_flags & (IN6_IFF_DETACHED |
3732                     IN6_IFF_DEPRECATED | IN6_IFF_ANYCAST | IN6_IFF_NOTREADY))
3733                         /* Can't bind a non-existent addr. */
3734                         return (-1);
3735         }
3736         /* first, is it already present? */
3737         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3738                 if (laddr->ifa == ifa) {
3739                         fnd = 1;
3740                         break;
3741                 }
3742         }
3743
3744         if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && (fnd == 0)) {
3745                 /* Not bound to all */
3746                 error = sctp_insert_laddr(&inp->sctp_addr_list, ifa);
3747                 if (error != 0)
3748                         return (error);
3749                 inp->laddr_count++;
3750                 /* update inp_vflag flags */
3751                 if (ifa->ifa_addr->sa_family == AF_INET6) {
3752 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__))
3753                         inp->inp_vflag |= INP_IPV6;
3754 #else
3755                         inp->ip_inp.inp.inp_vflag |= INP_IPV6;
3756 #endif
3757                 } else if (ifa->ifa_addr->sa_family == AF_INET) {
3758 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__))
3759                         inp->inp_vflag |= INP_IPV4;
3760 #else
3761                         inp->ip_inp.inp.inp_vflag |= INP_IPV4;
3762 #endif
3763                 }
3764         }
3765         return (0);
3766 }
3767
3768
3769 /*
3770  * select a new (hopefully reachable) destination net
3771  * (should only be used when we deleted an ep addr that is the
3772  * only usable source address to reach the destination net)
3773  */
3774 static void
3775 sctp_select_primary_destination(struct sctp_tcb *stcb)
3776 {
3777         struct sctp_nets *net;
3778
3779         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
3780                 /* for now, we'll just pick the first reachable one we find */
3781                 if (net->dest_state & SCTP_ADDR_UNCONFIRMED)
3782                         continue;
3783                 if (sctp_destination_is_reachable(stcb,
3784                     (struct sockaddr *)&net->ro._l_addr)) {
3785                         /* found a reachable destination */
3786                         stcb->asoc.primary_destination = net;
3787                 }
3788         }
3789         /* I can't there from here! ...we're gonna die shortly... */
3790 }
3791
3792
3793 /*
3794  * Delete the address from the endpoint local address list
3795  * There is nothing to be done if we are bound to all addresses
3796  */
3797 int
3798 sctp_del_local_addr_ep(struct sctp_inpcb *inp, struct ifaddr *ifa)
3799 {
3800         struct sctp_laddr *laddr;
3801         int fnd;
3802         fnd = 0;
3803         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3804                 /* You are already bound to all. You have it already */
3805                 return (EINVAL);
3806         }
3807
3808         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3809                 if (laddr->ifa == ifa) {
3810                         fnd = 1;
3811                         break;
3812                 }
3813         }
3814         if (fnd && (inp->laddr_count < 2)) {
3815                 /* can't delete unless there are at LEAST 2 addresses */
3816                 return (-1);
3817         }
3818         if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && (fnd)) {
3819                 /*
3820                  * clean up any use of this address
3821                  * go through our associations and clear any
3822                  *  last_used_address that match this one
3823                  * for each assoc, see if a new primary_destination is needed
3824                  */
3825                 struct sctp_tcb *stcb;
3826
3827                 /* clean up "next_addr_touse" */
3828                 if (inp->next_addr_touse == laddr)
3829                         /* delete this address */
3830                         inp->next_addr_touse = NULL;
3831
3832                 /* clean up "last_used_address" */
3833                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
3834                         if (stcb->asoc.last_used_address == laddr)
3835                                 /* delete this address */
3836                                 stcb->asoc.last_used_address = NULL;
3837                 } /* for each tcb */
3838
3839                 /* remove it from the ep list */
3840                 sctp_remove_laddr(laddr);
3841                 inp->laddr_count--;
3842                 /* update inp_vflag flags */
3843                 sctp_update_ep_vflag(inp);
3844                 /* select a new primary destination if needed */
3845                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
3846                         /* presume caller (sctp_asconf.c) already owns INP lock */
3847                         SCTP_TCB_LOCK(stcb);
3848                         if (sctp_destination_is_reachable(stcb,
3849                             (struct sockaddr *)&stcb->asoc.primary_destination->ro._l_addr) == 0) {
3850                                 sctp_select_primary_destination(stcb);
3851                         }
3852                         SCTP_TCB_UNLOCK(stcb);
3853                 } /* for each tcb */
3854         }
3855         return (0);
3856 }
3857
3858 /*
3859  * Add the addr to the TCB local address list
3860  * For the BOUNDALL or dynamic case, this is a "pending" address list
3861  * (eg. addresses waiting for an ASCONF-ACK response)
3862  * For the subset binding, static case, this is a "valid" address list
3863  */
3864 int
3865 sctp_add_local_addr_assoc(struct sctp_tcb *stcb, struct ifaddr *ifa)
3866 {
3867         struct sctp_laddr *laddr;
3868         int error;
3869
3870         /* Assumes TCP is locked.. and possiblye
3871          * the INP. May need to confirm/fix that if
3872          * we need it and is not the case.
3873          */
3874         if (ifa->ifa_addr->sa_family == AF_INET6) {
3875                 struct in6_ifaddr *ifa6;
3876                 ifa6 = (struct in6_ifaddr *)ifa;
3877                 if (ifa6->ia6_flags & (IN6_IFF_DETACHED |
3878                     /* IN6_IFF_DEPRECATED | */
3879                     IN6_IFF_ANYCAST |
3880                     IN6_IFF_NOTREADY))
3881                         /* Can't bind a non-existent addr. */
3882                         return (-1);
3883         }
3884         /* does the address already exist? */
3885         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
3886                 if (laddr->ifa == ifa) {
3887                         return (-1);
3888                 }
3889         }
3890
3891         /* add to the list */
3892         error = sctp_insert_laddr(&stcb->asoc.sctp_local_addr_list, ifa);
3893         if (error != 0)
3894                 return (error);
3895         return (0);
3896 }
3897
3898 /*
3899  * insert an laddr entry with the given ifa for the desired list
3900  */
3901 int
3902 sctp_insert_laddr(struct sctpladdr *list, struct ifaddr *ifa) {
3903         struct sctp_laddr *laddr;
3904
3905         laddr = (struct sctp_laddr *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_laddr);
3906         if (laddr == NULL) {
3907                 /* out of memory? */
3908                 return (EINVAL);
3909         }
3910         sctppcbinfo.ipi_count_laddr++;
3911         sctppcbinfo.ipi_gencnt_laddr++;
3912         bzero(laddr, sizeof(*laddr));
3913         laddr->ifa = ifa;
3914         /* insert it */
3915         LIST_INSERT_HEAD(list, laddr, sctp_nxt_addr);
3916
3917         return (0);
3918 }
3919
3920 /*
3921  * Remove an laddr entry from the local address list (on an assoc)
3922  */
3923 void
3924 sctp_remove_laddr(struct sctp_laddr *laddr)
3925 {
3926         /* remove from the list */
3927         LIST_REMOVE(laddr, sctp_nxt_addr);
3928         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr);
3929         sctppcbinfo.ipi_count_laddr--;
3930         sctppcbinfo.ipi_gencnt_laddr++;
3931 }
3932
3933 /*
3934  * Remove an address from the TCB local address list
3935  */
3936 int
3937 sctp_del_local_addr_assoc(struct sctp_tcb *stcb, struct ifaddr *ifa)
3938 {
3939         struct sctp_inpcb *inp;
3940         struct sctp_laddr *laddr;
3941
3942         /* This is called by asconf work. It is assumed that
3943          * a) The TCB is locked
3944          * and
3945          * b) The INP is locked.
3946          * This is true in as much as I can trace through
3947          * the entry asconf code where I did these locks.
3948          * Again, the ASCONF code is a bit different in
3949          * that it does lock the INP during its work often
3950          * times. This must be since we don't want other
3951          * proc's looking up things while what they are
3952          * looking up is changing :-D
3953          */
3954
3955         inp = stcb->sctp_ep;
3956         /* if subset bound and don't allow ASCONF's, can't delete last */
3957         if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) &&
3958             ((inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) == 0)) {
3959                 if (stcb->asoc.numnets < 2) {
3960                         /* can't delete last address */
3961                         return (-1);
3962                 }
3963         }
3964
3965         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
3966                 /* remove the address if it exists */
3967                 if (laddr->ifa == NULL)
3968                         continue;
3969                 if (laddr->ifa == ifa) {
3970                         sctp_remove_laddr(laddr);
3971                         return (0);
3972                 }
3973         }
3974
3975         /* address not found! */
3976         return (-1);
3977 }
3978
3979 /*
3980  * Remove an address from the TCB local address list
3981  * lookup using a sockaddr addr
3982  */
3983 int
3984 sctp_del_local_addr_assoc_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
3985 {
3986         struct sctp_inpcb *inp;
3987         struct sctp_laddr *laddr;
3988         struct sockaddr *l_sa;
3989
3990         /*
3991          * This function I find does not seem to have a caller.
3992          * As such we NEED TO DELETE this code. If we do
3993          * find a caller, the caller MUST have locked the TCB
3994          * at the least and probably the INP as well.
3995          */
3996         inp = stcb->sctp_ep;
3997         /* if subset bound and don't allow ASCONF's, can't delete last */
3998         if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) &&
3999             ((inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) == 0)) {
4000                 if (stcb->asoc.numnets < 2) {
4001                         /* can't delete last address */
4002                         return (-1);
4003                 }
4004         }
4005
4006         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
4007                 /* make sure the address exists */
4008                 if (laddr->ifa == NULL)
4009                         continue;
4010                 if (laddr->ifa->ifa_addr == NULL)
4011                         continue;
4012
4013                 l_sa = laddr->ifa->ifa_addr;
4014                 if (l_sa->sa_family == AF_INET6) {
4015                         /* IPv6 address */
4016                         struct sockaddr_in6 *sin1, *sin2;
4017                         sin1 = (struct sockaddr_in6 *)l_sa;
4018                         sin2 = (struct sockaddr_in6 *)sa;
4019                         if (memcmp(&sin1->sin6_addr, &sin2->sin6_addr,
4020                             sizeof(struct in6_addr)) == 0) {
4021                                 /* matched */
4022                                 sctp_remove_laddr(laddr);
4023                                 return (0);
4024                         }
4025                 } else if (l_sa->sa_family == AF_INET) {
4026                         /* IPv4 address */
4027                         struct sockaddr_in *sin1, *sin2;
4028                         sin1 = (struct sockaddr_in *)l_sa;
4029                         sin2 = (struct sockaddr_in *)sa;
4030                         if (sin1->sin_addr.s_addr == sin2->sin_addr.s_addr) {
4031                                 /* matched */
4032                                 sctp_remove_laddr(laddr);
4033                                 return (0);
4034                         }
4035                 } else {
4036                         /* invalid family */
4037                         return (-1);
4038                 }
4039         } /* end foreach */
4040         /* address not found! */
4041         return (-1);
4042 }
4043
4044 static char sctp_pcb_initialized = 0;
4045
4046 #if defined(__FreeBSD__) || defined(__APPLE__)
4047 /* sysctl */
4048 /* not used by DragonFly SCTP_ZONE_INIT macro */
4049 static int sctp_max_number_of_assoc = SCTP_MAX_NUM_OF_ASOC;
4050 static int sctp_scale_up_for_address = SCTP_SCALE_FOR_ADDR;
4051
4052 #endif /* FreeBSD || APPLE || DragonFly */
4053
4054 #ifndef SCTP_TCBHASHSIZE
4055 #define SCTP_TCBHASHSIZE 1024
4056 #endif
4057
4058 #ifndef SCTP_CHUNKQUEUE_SCALE
4059 #define SCTP_CHUNKQUEUE_SCALE 10
4060 #endif
4061
4062 void
4063 sctp_pcb_init(void)
4064 {
4065         /*
4066          * SCTP initialization for the PCB structures
4067          * should be called by the sctp_init() funciton.
4068          */
4069         int i;
4070         int hashtblsize = SCTP_TCBHASHSIZE;
4071
4072 #if defined(__FreeBSD__) || defined(__APPLE__)
4073         /* not used by DragonFly SCTP_ZONE_INIT macro */
4074         int sctp_chunkscale = SCTP_CHUNKQUEUE_SCALE;
4075 #endif
4076
4077         if (sctp_pcb_initialized != 0) {
4078                 /* error I was called twice */
4079                 return;
4080         }
4081         sctp_pcb_initialized = 1;
4082
4083         /* Init all peg counts */
4084         for (i = 0; i < SCTP_NUMBER_OF_PEGS; i++) {
4085                 sctp_pegs[i] = 0;
4086         }
4087
4088         /* init the empty list of (All) Endpoints */
4089         LIST_INIT(&sctppcbinfo.listhead);
4090
4091         /* init the iterator head */
4092         LIST_INIT(&sctppcbinfo.iteratorhead);
4093
4094         /* init the hash table of endpoints */
4095 #if defined(__FreeBSD__)
4096 #if defined(__FreeBSD_cc_version) && __FreeBSD_cc_version >= 440000
4097         TUNABLE_INT_FETCH("net.inet.sctp.tcbhashsize", &hashtblsize);
4098         TUNABLE_INT_FETCH("net.inet.sctp.pcbhashsize", &sctp_pcbtblsize);
4099         TUNABLE_INT_FETCH("net.inet.sctp.chunkscale", &sctp_chunkscale);
4100 #else
4101         TUNABLE_INT_FETCH("net.inet.sctp.tcbhashsize", SCTP_TCBHASHSIZE,
4102             hashtblsize);
4103         TUNABLE_INT_FETCH("net.inet.sctp.pcbhashsize", SCTP_PCBHASHSIZE,
4104             sctp_pcbtblsize);
4105         TUNABLE_INT_FETCH("net.inet.sctp.chunkscale", SCTP_CHUNKQUEUE_SCALE,
4106             sctp_chunkscale);
4107 #endif
4108 #endif
4109
4110         sctppcbinfo.sctp_asochash = hashinit((hashtblsize * 31),
4111 #ifdef __NetBSD__
4112             HASH_LIST,
4113 #endif
4114             M_PCB,
4115 #if defined(__NetBSD__) || defined(__OpenBSD__)
4116             M_WAITOK,
4117 #endif
4118             &sctppcbinfo.hashasocmark);
4119
4120         sctppcbinfo.sctp_ephash = hashinit(hashtblsize,
4121 #ifdef __NetBSD__
4122             HASH_LIST,
4123 #endif
4124             M_PCB,
4125 #if defined(__NetBSD__) || defined(__OpenBSD__)
4126             M_WAITOK,
4127 #endif
4128             &sctppcbinfo.hashmark);
4129
4130         sctppcbinfo.sctp_tcpephash = hashinit(hashtblsize,
4131 #ifdef __NetBSD__
4132             HASH_LIST,
4133 #endif
4134             M_PCB,
4135 #if defined(__NetBSD__) || defined(__OpenBSD__)
4136             M_WAITOK,
4137 #endif
4138             &sctppcbinfo.hashtcpmark);
4139
4140         sctppcbinfo.hashtblsize = hashtblsize;
4141
4142         /* init the zones */
4143         /*
4144          * FIX ME: Should check for NULL returns, but if it does fail we
4145          * are doomed to panic anyways... add later maybe.
4146          */
4147         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_ep, "sctp_ep",
4148             sizeof(struct sctp_inpcb), maxsockets);
4149
4150         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_asoc, "sctp_asoc",
4151             sizeof(struct sctp_tcb), sctp_max_number_of_assoc);
4152
4153         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_laddr, "sctp_laddr",
4154             sizeof(struct sctp_laddr),
4155             (sctp_max_number_of_assoc * sctp_scale_up_for_address));
4156
4157         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_net, "sctp_raddr",
4158             sizeof(struct sctp_nets),
4159             (sctp_max_number_of_assoc * sctp_scale_up_for_address));
4160
4161         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_chunk, "sctp_chunk",
4162             sizeof(struct sctp_tmit_chunk),
4163             (sctp_max_number_of_assoc * sctp_scale_up_for_address *
4164             sctp_chunkscale));
4165
4166         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_sockq, "sctp_sockq",
4167             sizeof(struct sctp_socket_q_list),
4168             (sctp_max_number_of_assoc * sctp_scale_up_for_address *
4169             sctp_chunkscale));
4170
4171         /* Master Lock INIT for info structure */
4172         SCTP_INP_INFO_LOCK_INIT();
4173         SCTP_ITERATOR_LOCK_INIT();
4174         /* not sure if we need all the counts */
4175         sctppcbinfo.ipi_count_ep = 0;
4176         sctppcbinfo.ipi_gencnt_ep = 0;
4177         /* assoc/tcb zone info */
4178         sctppcbinfo.ipi_count_asoc = 0;
4179         sctppcbinfo.ipi_gencnt_asoc = 0;
4180         /* local addrlist zone info */
4181         sctppcbinfo.ipi_count_laddr = 0;
4182         sctppcbinfo.ipi_gencnt_laddr = 0;
4183         /* remote addrlist zone info */
4184         sctppcbinfo.ipi_count_raddr = 0;
4185         sctppcbinfo.ipi_gencnt_raddr = 0;
4186         /* chunk info */
4187         sctppcbinfo.ipi_count_chunk = 0;
4188         sctppcbinfo.ipi_gencnt_chunk = 0;
4189
4190         /* socket queue zone info */
4191         sctppcbinfo.ipi_count_sockq = 0;
4192         sctppcbinfo.ipi_gencnt_sockq = 0;
4193
4194         /* mbuf tracker */
4195         sctppcbinfo.mbuf_track = 0;
4196         /* port stuff */
4197 #if defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__APPLE__) \
4198     || defined(__DragonFly__)
4199         sctppcbinfo.lastlow = ipport_firstauto;
4200 #else
4201         sctppcbinfo.lastlow = anonportmin;
4202 #endif
4203         /* Init the TIMEWAIT list */
4204         for (i = 0; i < SCTP_STACK_VTAG_HASH_SIZE; i++) {
4205                 LIST_INIT(&sctppcbinfo.vtag_timewait[i]);
4206         }
4207
4208 #if defined(_SCTP_NEEDS_CALLOUT_) && !defined(__APPLE__)
4209         TAILQ_INIT(&sctppcbinfo.callqueue);
4210 #endif
4211
4212 }
4213
4214 int
4215 sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m,
4216     int iphlen, int offset, int limit, struct sctphdr *sh,
4217     struct sockaddr *altsa)
4218 {
4219         /*
4220          * grub through the INIT pulling addresses and
4221          * loading them to the nets structure in the asoc.
4222          * The from address in the mbuf should also be loaded
4223          * (if it is not already). This routine can be called
4224          * with either INIT or INIT-ACK's as long as the
4225          * m points to the IP packet and the offset points
4226          * to the beginning of the parameters.
4227          */
4228         struct sctp_inpcb *inp, *l_inp;
4229         struct sctp_nets *net, *net_tmp;
4230         struct ip *iph;
4231         struct sctp_paramhdr *phdr, parm_buf;
4232         struct sctp_tcb *stcb_tmp;
4233         u_int16_t ptype, plen;
4234         struct sockaddr *sa;
4235         struct sockaddr_storage dest_store;
4236         struct sockaddr *local_sa = (struct sockaddr *)&dest_store;
4237         struct sockaddr_in sin;
4238         struct sockaddr_in6 sin6;
4239
4240         /* First get the destination address setup too. */
4241         memset(&sin, 0, sizeof(sin));
4242         memset(&sin6, 0, sizeof(sin6));
4243
4244         sin.sin_family = AF_INET;
4245         sin.sin_len = sizeof(sin);
4246         sin.sin_port = stcb->rport;
4247
4248         sin6.sin6_family = AF_INET6;
4249         sin6.sin6_len = sizeof(struct sockaddr_in6);
4250         sin6.sin6_port = stcb->rport;
4251         if (altsa == NULL) {
4252                 iph = mtod(m, struct ip *);
4253                 if (iph->ip_v == IPVERSION) {
4254                         /* its IPv4 */
4255                         struct sockaddr_in *sin_2;
4256                         sin_2 = (struct sockaddr_in *)(local_sa);
4257                         memset(sin_2, 0, sizeof(sin));
4258                         sin_2->sin_family = AF_INET;
4259                         sin_2->sin_len = sizeof(sin);
4260                         sin_2->sin_port = sh->dest_port;
4261                         sin_2->sin_addr.s_addr = iph->ip_dst.s_addr ;
4262                         sin.sin_addr = iph->ip_src;
4263                         sa = (struct sockaddr *)&sin;
4264                 } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
4265                         /* its IPv6 */
4266                         struct ip6_hdr *ip6;
4267                         struct sockaddr_in6 *sin6_2;
4268
4269                         ip6 = mtod(m, struct ip6_hdr *);
4270                         sin6_2 = (struct sockaddr_in6 *)(local_sa);
4271                         memset(sin6_2, 0, sizeof(sin6));
4272                         sin6_2->sin6_family = AF_INET6;
4273                         sin6_2->sin6_len = sizeof(struct sockaddr_in6);
4274                         sin6_2->sin6_port = sh->dest_port;
4275                         sin6.sin6_addr = ip6->ip6_src;
4276                         sa = (struct sockaddr *)&sin6;
4277                 } else {
4278                         sa = NULL;
4279                 }
4280         } else {
4281                 /*
4282                  * For cookies we use the src address NOT from the packet
4283                  * but from the original INIT
4284                  */
4285                 sa = altsa;
4286         }
4287         /* Turn off ECN until we get through all params */
4288         stcb->asoc.ecn_allowed = 0;
4289
4290         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
4291                 /* mark all addresses that we have currently on the list */
4292                 net->dest_state |= SCTP_ADDR_NOT_IN_ASSOC;
4293         }
4294         /* does the source address already exist? if so skip it */
4295         l_inp = inp = stcb->sctp_ep;
4296         stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net_tmp, local_sa, stcb);
4297         if ((stcb_tmp == NULL && inp == stcb->sctp_ep) || inp == NULL) {
4298                 /* we must add the source address */
4299                 /* no scope set here since we have a tcb already. */
4300                 if ((sa->sa_family == AF_INET) &&
4301                     (stcb->asoc.ipv4_addr_legal)) {
4302                         if (sctp_add_remote_addr(stcb, sa, 0, 2)) {
4303                                 return (-1);
4304                         }
4305                 } else if ((sa->sa_family == AF_INET6) &&
4306                     (stcb->asoc.ipv6_addr_legal)) {
4307                         if (sctp_add_remote_addr(stcb, sa, 0, 3)) {
4308                                 return (-1);
4309                         }
4310                 }
4311         } else {
4312                 if (net_tmp != NULL && stcb_tmp == stcb) {
4313                         net_tmp->dest_state &= ~SCTP_ADDR_NOT_IN_ASSOC;
4314                 } else if (stcb_tmp != stcb) {
4315                         /* It belongs to another association? */
4316                         return (-1);
4317                 }
4318         }
4319         /* since a unlock occured we must check the
4320          * TCB's state and the pcb's gone flags.
4321          */
4322         if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
4323                 /* the user freed the ep */
4324                 return (-1);
4325         }
4326         if (stcb->asoc.state == 0) {
4327                 /* the assoc was freed? */
4328                 return (-1);
4329         }
4330
4331         /* now we must go through each of the params. */
4332         phdr = sctp_get_next_param(m, offset, &parm_buf, sizeof(parm_buf));
4333         while (phdr) {
4334                 ptype = ntohs(phdr->param_type);
4335                 plen = ntohs(phdr->param_length);
4336                 /*kprintf("ptype => %d, plen => %d\n", ptype, plen);*/
4337                 if (offset + plen > limit) {
4338                         break;
4339                 }
4340                 if (plen == 0) {
4341                         break;
4342                 }
4343                 if ((ptype == SCTP_IPV4_ADDRESS) &&
4344                     (stcb->asoc.ipv4_addr_legal)) {
4345                         struct sctp_ipv4addr_param *p4, p4_buf;
4346                         /* ok get the v4 address and check/add */
4347                         phdr = sctp_get_next_param(m, offset,
4348                             (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf));
4349                         if (plen != sizeof(struct sctp_ipv4addr_param) ||
4350                             phdr == NULL) {
4351                                 return (-1);
4352                         }
4353                         p4 = (struct sctp_ipv4addr_param *)phdr;
4354                         sin.sin_addr.s_addr = p4->addr;
4355                         sa = (struct sockaddr *)&sin;
4356                         inp = stcb->sctp_ep;
4357                         stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net,
4358                             local_sa, stcb);
4359
4360                         if ((stcb_tmp== NULL && inp == stcb->sctp_ep) ||
4361                             inp == NULL) {
4362                                 /* we must add the source address */
4363                                 /* no scope set since we have a tcb already */
4364
4365                                 /* we must validate the state again here */
4366                                 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
4367                                         /* the user freed the ep */
4368                                         return (-1);
4369                                 }
4370                                 if (stcb->asoc.state == 0) {
4371                                         /* the assoc was freed? */
4372                                         return (-1);
4373                                 }
4374                                 if (sctp_add_remote_addr(stcb, sa, 0, 4)) {
4375                                         return (-1);
4376                                 }
4377                         } else if (stcb_tmp == stcb) {
4378                                 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
4379                                         /* the user freed the ep */
4380                                         return (-1);
4381                                 }
4382                                 if (stcb->asoc.state == 0) {
4383                                         /* the assoc was freed? */
4384                                         return (-1);
4385                                 }
4386                                 if (net != NULL) {
4387                                         /* clear flag */
4388                                         net->dest_state &=
4389                                             ~SCTP_ADDR_NOT_IN_ASSOC;
4390                                 }
4391                         } else {
4392                                 /* strange, address is in another assoc?
4393                                  * straighten out locks.
4394                                  */
4395                                 SCTP_TCB_UNLOCK(stcb_tmp);
4396                                 SCTP_INP_RLOCK(inp);
4397                                 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
4398                                         /* the user freed the ep */
4399                                         SCTP_INP_RUNLOCK(l_inp);
4400                                         return (-1);
4401                                 }
4402                                 if (stcb->asoc.state == 0) {
4403                                         /* the assoc was freed? */
4404                                         SCTP_INP_RUNLOCK(l_inp);
4405                                         return (-1);
4406                                 }
4407                                 SCTP_TCB_LOCK(stcb);
4408                                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
4409                                 return (-1);
4410                         }
4411                 } else if ((ptype == SCTP_IPV6_ADDRESS) &&
4412                     (stcb->asoc.ipv6_addr_legal)) {
4413                         /* ok get the v6 address and check/add */
4414                         struct sctp_ipv6addr_param *p6, p6_buf;
4415                         phdr = sctp_get_next_param(m, offset,
4416                             (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf));
4417                         if (plen != sizeof(struct sctp_ipv6addr_param) ||
4418                             phdr == NULL) {
4419                                 return (-1);
4420                         }
4421                         p6 = (struct sctp_ipv6addr_param *)phdr;
4422                         memcpy((caddr_t)&sin6.sin6_addr, p6->addr,
4423                             sizeof(p6->addr));
4424                         sa = (struct sockaddr *)&sin6;
4425                         inp = stcb->sctp_ep;
4426                         stcb_tmp= sctp_findassociation_ep_addr(&inp, sa, &net,
4427                             local_sa, stcb);
4428                         if (stcb_tmp == NULL && (inp == stcb->sctp_ep ||
4429                             inp == NULL)) {
4430                                 /* we must validate the state again here */
4431                                 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
4432                                         /* the user freed the ep */
4433                                         return (-1);
4434                                 }
4435                                 if (stcb->asoc.state == 0) {
4436                                         /* the assoc was freed? */
4437                                         return (-1);
4438                                 }
4439                                 /* we must add the address, no scope set */
4440                                 if (sctp_add_remote_addr(stcb, sa, 0, 5)) {
4441                                         return (-1);
4442                                 }
4443                         } else if (stcb_tmp == stcb) {
4444                                 /* we must validate the state again here */
4445                                 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
4446                                         /* the user freed the ep */
4447                                         return (-1);
4448                                 }
4449                                 if (stcb->asoc.state == 0) {
4450                                         /* the assoc was freed? */
4451                                         return (-1);
4452                                 }
4453                                 if (net != NULL) {
4454                                         /* clear flag */
4455                                         net->dest_state &=
4456                                             ~SCTP_ADDR_NOT_IN_ASSOC;
4457                                 }
4458                         } else {
4459                                 /* strange, address is in another assoc?
4460                                  * straighten out locks.
4461                                  */
4462                                 SCTP_TCB_UNLOCK(stcb_tmp);
4463                                 SCTP_INP_RLOCK(l_inp);
4464                                 /* we must validate the state again here */
4465                                 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
4466                                         /* the user freed the ep */
4467                                         SCTP_INP_RUNLOCK(l_inp);
4468                                         return (-1);
4469                                 }
4470                                 if (stcb->asoc.state == 0) {
4471                                         /* the assoc was freed? */
4472                                         SCTP_INP_RUNLOCK(l_inp);
4473                                         return (-1);
4474                                 }
4475                                 SCTP_TCB_LOCK(stcb);
4476                                 SCTP_INP_RUNLOCK(l_inp);
4477                                 return (-1);
4478                         }
4479                 } else if (ptype == SCTP_ECN_CAPABLE) {
4480                         stcb->asoc.ecn_allowed = 1;
4481                 } else if (ptype == SCTP_ULP_ADAPTION) {
4482                         if (stcb->asoc.state != SCTP_STATE_OPEN) {
4483                                 struct sctp_adaption_layer_indication ai, *aip;
4484
4485                                 phdr = sctp_get_next_param(m, offset,
4486                                                            (struct sctp_paramhdr *)&ai, sizeof(ai));
4487                                 aip = (struct sctp_adaption_layer_indication *)phdr;
4488                                 sctp_ulp_notify(SCTP_NOTIFY_ADAPTION_INDICATION,
4489                                                 stcb, ntohl(aip->indication), NULL);
4490                         }
4491                 } else if (ptype == SCTP_SET_PRIM_ADDR) {
4492                         struct sctp_asconf_addr_param lstore, *fee;
4493                         struct sctp_asconf_addrv4_param *fii;
4494                         int lptype;
4495                         struct sockaddr *lsa = NULL;
4496
4497                         stcb->asoc.peer_supports_asconf = 1;
4498                         stcb->asoc.peer_supports_asconf_setprim = 1;
4499                         if (plen > sizeof(lstore)) {
4500                                 return (-1);
4501                         }
4502                         phdr = sctp_get_next_param(m, offset,
4503                             (struct sctp_paramhdr *)&lstore, plen);
4504                         if (phdr == NULL) {
4505                                 return (-1);
4506                         }
4507
4508                         fee  = (struct sctp_asconf_addr_param *)phdr;
4509                         lptype = ntohs(fee->addrp.ph.param_type);
4510                         if (lptype == SCTP_IPV4_ADDRESS) {
4511                                 if (plen !=
4512                                     sizeof(struct sctp_asconf_addrv4_param)) {
4513                                         kprintf("Sizeof setprim in init/init ack not %d but %d - ignored\n",
4514                                            (int)sizeof(struct sctp_asconf_addrv4_param),
4515                                            plen);
4516                                 } else {
4517                                         fii = (struct sctp_asconf_addrv4_param *)fee;
4518                                         sin.sin_addr.s_addr = fii->addrp.addr;
4519                                         lsa = (struct sockaddr *)&sin;
4520                                 }
4521                         } else if (lptype == SCTP_IPV6_ADDRESS) {
4522                                 if (plen !=
4523                                     sizeof(struct sctp_asconf_addr_param)) {
4524                                         kprintf("Sizeof setprim (v6) in init/init ack not %d but %d - ignored\n",
4525                                            (int)sizeof(struct sctp_asconf_addr_param),
4526                                            plen);
4527                                 } else {
4528                                         memcpy(sin6.sin6_addr.s6_addr,
4529                                             fee->addrp.addr,
4530                                             sizeof(fee->addrp.addr));
4531                                         lsa = (struct sockaddr *)&sin6;
4532                                 }
4533                         }
4534                         if (lsa) {
4535                                 sctp_set_primary_addr(stcb, sa, NULL);
4536                         }
4537
4538                 } else if (ptype == SCTP_PRSCTP_SUPPORTED) {
4539                         /* Peer supports pr-sctp */
4540                         stcb->asoc.peer_supports_prsctp = 1;
4541                 } else if (ptype == SCTP_SUPPORTED_CHUNK_EXT) {
4542                         /* A supported extension chunk */
4543                         struct sctp_supported_chunk_types_param *pr_supported;
4544                         uint8_t local_store[128];
4545                         int num_ent, i;
4546
4547                         phdr = sctp_get_next_param(m, offset,
4548                             (struct sctp_paramhdr *)&local_store, plen);
4549                         if (phdr == NULL) {
4550                                 return (-1);
4551                         }
4552                         stcb->asoc.peer_supports_asconf = 0;
4553                         stcb->asoc.peer_supports_asconf_setprim = 0;
4554                         stcb->asoc.peer_supports_prsctp = 0;
4555                         stcb->asoc.peer_supports_pktdrop = 0;
4556                         stcb->asoc.peer_supports_strreset = 0;
4557                         pr_supported = (struct sctp_supported_chunk_types_param *)phdr;
4558                         num_ent = plen - sizeof(struct sctp_paramhdr);
4559                         for (i=0; i<num_ent; i++) {
4560                                 switch (pr_supported->chunk_types[i]) {
4561                                 case SCTP_ASCONF:
4562                                         stcb->asoc.peer_supports_asconf = 1;
4563                                         stcb->asoc.peer_supports_asconf_setprim = 1;
4564                                         break;
4565                                 case SCTP_ASCONF_ACK:
4566                                         stcb->asoc.peer_supports_asconf = 1;
4567                                         stcb->asoc.peer_supports_asconf_setprim = 1;
4568                                         break;
4569                                 case SCTP_FORWARD_CUM_TSN:
4570                                         stcb->asoc.peer_supports_prsctp = 1;
4571                                         break;
4572                                 case SCTP_PACKET_DROPPED:
4573                                         stcb->asoc.peer_supports_pktdrop = 1;
4574                                         break;
4575                                 case SCTP_STREAM_RESET:
4576                                         stcb->asoc.peer_supports_strreset = 1;
4577                                         break;
4578                                 default:
4579                                         /* one I have not learned yet */
4580                                         break;
4581
4582                                 }
4583                         }
4584                 } else if (ptype == SCTP_ECN_NONCE_SUPPORTED) {
4585                         /* Peer supports ECN-nonce */
4586                         stcb->asoc.peer_supports_ecn_nonce = 1;
4587                         stcb->asoc.ecn_nonce_allowed = 1;
4588                 } else if ((ptype == SCTP_HEARTBEAT_INFO) ||
4589                            (ptype == SCTP_STATE_COOKIE) ||
4590                            (ptype == SCTP_UNRECOG_PARAM) ||
4591                            (ptype == SCTP_COOKIE_PRESERVE) ||
4592                            (ptype == SCTP_SUPPORTED_ADDRTYPE) ||
4593                            (ptype == SCTP_ADD_IP_ADDRESS) ||
4594                            (ptype == SCTP_DEL_IP_ADDRESS) ||
4595                            (ptype == SCTP_ERROR_CAUSE_IND) ||
4596                            (ptype == SCTP_SUCCESS_REPORT)) {
4597                         /* don't care */;
4598                 } else {
4599                         if ((ptype & 0x8000) == 0x0000) {
4600                                 /* must stop processing the rest of
4601                                  * the param's. Any report bits were
4602                                  * handled with the call to sctp_arethere_unrecognized_parameters()
4603                                  * when the INIT or INIT-ACK was first seen.
4604                                  */
4605                                 break;
4606                         }
4607                 }
4608                 offset += SCTP_SIZE32(plen);
4609                 if (offset >= limit) {
4610                         break;
4611                 }
4612                 phdr = sctp_get_next_param(m, offset, &parm_buf,
4613                     sizeof(parm_buf));
4614         }
4615         /* Now check to see if we need to purge any addresses */
4616         for (net = TAILQ_FIRST(&stcb->asoc.nets); net != NULL; net = net_tmp) {
4617                 net_tmp = TAILQ_NEXT(net, sctp_next);
4618                 if ((net->dest_state & SCTP_ADDR_NOT_IN_ASSOC) ==
4619                     SCTP_ADDR_NOT_IN_ASSOC) {
4620                         /* This address has been removed from the asoc */
4621                         /* remove and free it */
4622                         stcb->asoc.numnets--;
4623                         TAILQ_REMOVE(&stcb->asoc.nets, net, sctp_next);
4624                         sctp_free_remote_addr(net);
4625                         if (net == stcb->asoc.primary_destination) {
4626                                 stcb->asoc.primary_destination = NULL;
4627                                 sctp_select_primary_destination(stcb);
4628                         }
4629                 }
4630         }
4631         return (0);
4632 }
4633
4634 int
4635 sctp_set_primary_addr(struct sctp_tcb *stcb, struct sockaddr *sa,
4636     struct sctp_nets *net)
4637 {
4638         /* make sure the requested primary address exists in the assoc */
4639         if (net == NULL && sa)
4640                 net = sctp_findnet(stcb, sa);
4641
4642         if (net == NULL) {
4643                 /* didn't find the requested primary address! */
4644                 return (-1);
4645         } else {
4646                 /* set the primary address */
4647                 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {
4648                         /* Must be confirmed */
4649                         return (-1);
4650                 }
4651                 stcb->asoc.primary_destination = net;
4652                 net->dest_state &= ~SCTP_ADDR_WAS_PRIMARY;
4653                 return (0);
4654         }
4655 }
4656
4657
4658 int
4659 sctp_is_vtag_good(struct sctp_inpcb *inp, u_int32_t tag, struct timeval *now)
4660 {
4661         /*
4662          * This function serves two purposes. It will see if a TAG can be
4663          * re-used and return 1 for yes it is ok and 0 for don't use that
4664          * tag.
4665          * A secondary function it will do is purge out old tags that can
4666          * be removed.
4667          */
4668         struct sctpasochead *head;
4669         struct sctpvtaghead *chain;
4670         struct sctp_tagblock *twait_block;
4671         struct sctp_tcb *stcb;
4672
4673         int i;
4674         SCTP_INP_INFO_WLOCK();
4675         chain = &sctppcbinfo.vtag_timewait[(tag % SCTP_STACK_VTAG_HASH_SIZE)];
4676         /* First is the vtag in use ? */
4677
4678         head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(tag,
4679             sctppcbinfo.hashasocmark)];
4680         if (head == NULL) {
4681                 SCTP_INP_INFO_WUNLOCK();
4682                 return (0);
4683         }
4684         LIST_FOREACH(stcb, head, sctp_asocs) {
4685                 if (stcb->asoc.my_vtag == tag) {
4686                         /* We should remove this if and
4687                          * return 0 always if we want vtags
4688                          * unique across all endpoints. For
4689                          * now within a endpoint is ok.
4690                          */
4691                         if (inp == stcb->sctp_ep) {
4692                                 /* bad tag, in use */
4693                                 SCTP_INP_INFO_WUNLOCK();
4694                                 return (0);
4695                         }
4696                 }
4697         }
4698         if (!LIST_EMPTY(chain)) {
4699                 /*
4700                  * Block(s) are present, lets see if we have this tag in
4701                  * the list
4702                  */
4703                 LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) {
4704                         for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) {
4705                                 if (twait_block->vtag_block[i].v_tag == 0) {
4706                                         /* not used */
4707                                         continue;
4708                                 } else if ((long)twait_block->vtag_block[i].tv_sec_at_expire >
4709                                     now->tv_sec) {
4710                                         /* Audit expires this guy */
4711                                         twait_block->vtag_block[i].tv_sec_at_expire = 0;
4712                                         twait_block->vtag_block[i].v_tag = 0;
4713                                 } else if (twait_block->vtag_block[i].v_tag ==
4714                                     tag) {
4715                                         /* Bad tag, sorry :< */
4716                                         SCTP_INP_INFO_WUNLOCK();
4717                                         return (0);
4718                                 }
4719                         }
4720                 }
4721         }
4722         /* Not found, ok to use the tag */
4723         SCTP_INP_INFO_WUNLOCK();
4724         return (1);
4725 }
4726
4727
4728 /*
4729  * Delete the address from the endpoint local address list
4730  * Lookup using a sockaddr address (ie. not an ifaddr)
4731  */
4732 int
4733 sctp_del_local_addr_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa)
4734 {
4735         struct sctp_laddr *laddr;
4736         struct sockaddr *l_sa;
4737         int found = 0;
4738         /* Here is another function I cannot find a
4739          * caller for. As such we SHOULD delete it
4740          * if we have no users. If we find a user that
4741          * user MUST have the INP locked.
4742          *
4743          */
4744
4745         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
4746                 /* You are already bound to all. You have it already */
4747                 return (EINVAL);
4748         }
4749
4750         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
4751                 /* make sure the address exists */
4752                 if (laddr->ifa == NULL)
4753                         continue;
4754                 if (laddr->ifa->ifa_addr == NULL)
4755                         continue;
4756
4757                 l_sa = laddr->ifa->ifa_addr;
4758                 if (l_sa->sa_family == AF_INET6) {
4759                         /* IPv6 address */
4760                         struct sockaddr_in6 *sin1, *sin2;
4761                         sin1 = (struct sockaddr_in6 *)l_sa;
4762                         sin2 = (struct sockaddr_in6 *)sa;
4763                         if (memcmp(&sin1->sin6_addr, &sin2->sin6_addr,
4764                             sizeof(struct in6_addr)) == 0) {
4765                                 /* matched */
4766                                 found = 1;
4767                                 break;
4768                         }
4769                 } else if (l_sa->sa_family == AF_INET) {
4770                         /* IPv4 address */
4771                         struct sockaddr_in *sin1, *sin2;
4772                         sin1 = (struct sockaddr_in *)l_sa;
4773                         sin2 = (struct sockaddr_in *)sa;
4774                         if (sin1->sin_addr.s_addr == sin2->sin_addr.s_addr) {
4775                                 /* matched */
4776                                 found = 1;
4777                                 break;
4778                         }
4779                 } else {
4780                         /* invalid family */
4781                         return (-1);
4782                 }
4783         }
4784
4785         if (found && inp->laddr_count < 2) {
4786                 /* can't delete unless there are at LEAST 2 addresses */
4787                 return (-1);
4788         }
4789
4790         if (found && (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
4791                 /*
4792                  * remove it from the ep list, this should NOT be
4793                  * done until its really gone from the interface list and
4794                  * we won't be receiving more of these. Probably right
4795                  * away. If we do allow a removal of an address from
4796                  * an association (sub-set bind) than this should NOT
4797                  * be called until the all ASCONF come back from this
4798                  * association.
4799                  */
4800                 sctp_remove_laddr(laddr);
4801                 return (0);
4802         } else {
4803                 return (-1);
4804         }
4805 }
4806
4807 static void
4808 sctp_drain_mbufs(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
4809 {
4810         /*
4811          * We must hunt this association for MBUF's past the cumack
4812          * (i.e. out of order data that we can renege on).
4813          */
4814         struct sctp_association *asoc;
4815         struct sctp_tmit_chunk *chk, *nchk;
4816         u_int32_t cumulative_tsn_p1, tsn;
4817         int cnt, strmat, gap;
4818         /* We look for anything larger than the cum-ack + 1 */
4819
4820         asoc = &stcb->asoc;
4821         cumulative_tsn_p1 = asoc->cumulative_tsn + 1;
4822         cnt = 0;
4823         /* First look in the re-assembly queue */
4824         chk = TAILQ_FIRST(&asoc->reasmqueue);
4825         while (chk) {
4826                 /* Get the next one */
4827                 nchk = TAILQ_NEXT(chk, sctp_next);
4828                 if (compare_with_wrap(chk->rec.data.TSN_seq,
4829                     cumulative_tsn_p1, MAX_TSN)) {
4830                         /* Yep it is above cum-ack */
4831                         cnt++;
4832                         tsn = chk->rec.data.TSN_seq;
4833                         if (tsn >= asoc->mapping_array_base_tsn) {
4834                                 gap  = tsn - asoc->mapping_array_base_tsn;
4835                         } else {
4836                                 gap = (MAX_TSN - asoc->mapping_array_base_tsn) +
4837                                     tsn + 1;
4838                         }
4839                         asoc->size_on_reasm_queue -= chk->send_size;
4840                         asoc->cnt_on_reasm_queue--;
4841                         SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap);
4842                         TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
4843                         if (chk->data) {
4844                                 sctp_m_freem(chk->data);
4845                                 chk->data = NULL;
4846                         }
4847                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4848                         sctppcbinfo.ipi_count_chunk--;
4849                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4850                                 panic("Chunk count is negative");
4851                         }
4852                         sctppcbinfo.ipi_gencnt_chunk++;
4853                 }
4854                 chk = nchk;
4855         }
4856         /* Ok that was fun, now we will drain all the inbound streams? */
4857         for (strmat = 0; strmat < asoc->streamincnt; strmat++) {
4858                 chk = TAILQ_FIRST(&asoc->strmin[strmat].inqueue);
4859                 while (chk) {
4860                         nchk = TAILQ_NEXT(chk, sctp_next);
4861                         if (compare_with_wrap(chk->rec.data.TSN_seq,
4862                             cumulative_tsn_p1, MAX_TSN)) {
4863                                 /* Yep it is above cum-ack */
4864                                 cnt++;
4865                                 tsn = chk->rec.data.TSN_seq;
4866                                 if (tsn >= asoc->mapping_array_base_tsn) {
4867                                         gap = tsn -
4868                                             asoc->mapping_array_base_tsn;
4869                                 } else {
4870                                         gap = (MAX_TSN -
4871                                             asoc->mapping_array_base_tsn) +
4872                                             tsn + 1;
4873                                 }
4874                                 asoc->size_on_all_streams -= chk->send_size;
4875                                 asoc->cnt_on_all_streams--;
4876
4877                                 SCTP_UNSET_TSN_PRESENT(asoc->mapping_array,
4878                                     gap);
4879                                 TAILQ_REMOVE(&asoc->strmin[strmat].inqueue,
4880                                     chk, sctp_next);
4881                                 if (chk->data) {
4882                                         sctp_m_freem(chk->data);
4883                                         chk->data = NULL;
4884                                 }
4885                                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4886                                 sctppcbinfo.ipi_count_chunk--;
4887                                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
4888                                         panic("Chunk count is negative");
4889                                 }
4890                                 sctppcbinfo.ipi_gencnt_chunk++;
4891                         }
4892                         chk = nchk;
4893                 }
4894         }
4895         /*
4896          * Question, should we go through the delivery queue?
4897          * The only reason things are on here is the app not reading OR a
4898          * p-d-api up. An attacker COULD send enough in to initiate the
4899          * PD-API and then send a bunch of stuff to other streams... these
4900          * would wind up on the delivery queue.. and then we would not get
4901          * to them. But in order to do this I then have to back-track and
4902          * un-deliver sequence numbers in streams.. el-yucko. I think for
4903          * now we will NOT look at the delivery queue and leave it to be
4904          * something to consider later. An alternative would be to abort
4905          * the P-D-API with a notification and then deliver the data....
4906          * Or another method might be to keep track of how many times the
4907          * situation occurs and if we see a possible attack underway just
4908          * abort the association.
4909          */
4910 #ifdef SCTP_DEBUG
4911         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
4912                 if (cnt) {
4913                         kprintf("Freed %d chunks from reneg harvest\n", cnt);
4914                 }
4915         }
4916 #endif /* SCTP_DEBUG */
4917
4918         /*
4919          * Another issue, in un-setting the TSN's in the mapping array we
4920          * DID NOT adjust the higest_tsn marker.  This will cause one of
4921          * two things to occur. It may cause us to do extra work in checking
4922          * for our mapping array movement. More importantly it may cause us
4923          * to SACK every datagram. This may not be a bad thing though since
4924          * we will recover once we get our cum-ack above and all this stuff
4925          * we dumped recovered.
4926          */
4927 }
4928
4929 void
4930 sctp_drain(void)
4931 {
4932         /*
4933          * We must walk the PCB lists for ALL associations here. The system
4934          * is LOW on MBUF's and needs help. This is where reneging will
4935          * occur. We really hope this does NOT happen!
4936          */
4937         struct sctp_inpcb *inp;
4938         struct sctp_tcb *stcb;
4939
4940         SCTP_INP_INFO_RLOCK();
4941         LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) {
4942                 /* For each endpoint */
4943                 SCTP_INP_RLOCK(inp);
4944                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
4945                         /* For each association */
4946                         SCTP_TCB_LOCK(stcb);
4947                         sctp_drain_mbufs(inp, stcb);
4948                         SCTP_TCB_UNLOCK(stcb);
4949                 }
4950                 SCTP_INP_RUNLOCK(inp);
4951         }
4952         SCTP_INP_INFO_RUNLOCK();
4953 }
4954
4955 int
4956 sctp_add_to_socket_q(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
4957 {
4958         struct sctp_socket_q_list *sq;
4959
4960         /* write lock on INP assumed */
4961         if ((inp == NULL) || (stcb == NULL)) {
4962                 /* I am paranoid */
4963                 return (0);
4964         }
4965         sq = (struct sctp_socket_q_list *)SCTP_ZONE_GET(
4966             sctppcbinfo.ipi_zone_sockq);
4967         if (sq == NULL) {
4968                 /* out of sq structs */
4969                 return (0);
4970         }
4971         sctppcbinfo.ipi_count_sockq++;
4972         sctppcbinfo.ipi_gencnt_sockq++;
4973         if (stcb)
4974                 stcb->asoc.cnt_msg_on_sb++;
4975         sq->tcb = stcb;
4976         TAILQ_INSERT_TAIL(&inp->sctp_queue_list, sq, next_sq);
4977         return (1);
4978 }
4979
4980
4981 struct sctp_tcb *
4982 sctp_remove_from_socket_q(struct sctp_inpcb *inp)
4983 {
4984         struct sctp_tcb *stcb = NULL;
4985         struct sctp_socket_q_list *sq;
4986
4987         /* W-Lock on INP assumed held */
4988         sq = TAILQ_FIRST(&inp->sctp_queue_list);
4989         if (sq == NULL)
4990                 return (NULL);
4991
4992         stcb = sq->tcb;
4993         TAILQ_REMOVE(&inp->sctp_queue_list, sq, next_sq);
4994         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_sockq, sq);
4995         sctppcbinfo.ipi_count_sockq--;
4996         sctppcbinfo.ipi_gencnt_sockq++;
4997         if (stcb) {
4998                 stcb->asoc.cnt_msg_on_sb--;
4999         }
5000         return (stcb);
5001 }
5002
5003 int
5004 sctp_initiate_iterator(asoc_func af, uint32_t pcb_state, uint32_t asoc_state,
5005                        void *argp, uint32_t argi, end_func ef,
5006                        struct sctp_inpcb *s_inp)
5007 {
5008         struct sctp_iterator *it=NULL;
5009
5010         if (af == NULL) {
5011                 return (-1);
5012         }
5013         it = kmalloc(sizeof(struct sctp_iterator), M_PCB, M_WAITOK);
5014         memset(it, 0, sizeof(*it));
5015         it->function_toapply = af;
5016         it->function_atend = ef;
5017         it->pointer = argp;
5018         it->val = argi;
5019         it->pcb_flags = pcb_state;
5020         it->asoc_state = asoc_state;
5021         if (s_inp) {
5022                 it->inp = s_inp;
5023                 it->iterator_flags = SCTP_ITERATOR_DO_SINGLE_INP;
5024         } else {
5025                 SCTP_INP_INFO_RLOCK();
5026                 it->inp = LIST_FIRST(&sctppcbinfo.listhead);
5027                 SCTP_INP_INFO_RUNLOCK();
5028                 it->iterator_flags = SCTP_ITERATOR_DO_ALL_INP;
5029
5030         }
5031         /* Init the timer */
5032 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
5033         callout_init(&it->tmr.timer, 0);
5034 #else
5035         callout_init(&it->tmr.timer);
5036 #endif
5037         /* add to the list of all iterators */
5038         SCTP_INP_INFO_WLOCK();
5039         LIST_INSERT_HEAD(&sctppcbinfo.iteratorhead, it, sctp_nxt_itr);
5040         SCTP_INP_INFO_WUNLOCK();
5041         sctp_iterator_timer(it);
5042         return (0);
5043 }
5044
5045
5046 /*
5047  * Callout/Timer routines for OS that doesn't have them
5048  */
5049 #ifdef _SCTP_NEEDS_CALLOUT_
5050 #ifndef __APPLE__
5051 extern int ticks;
5052 #endif
5053
5054 void
5055 callout_init(struct callout *c)
5056 {
5057         bzero(c, sizeof(*c));
5058 }
5059
5060 void
5061 callout_reset(struct callout *c, int to_ticks, void (*ftn)(void *), void *arg)
5062 {
5063         if (c->c_flags & CALLOUT_PENDING)
5064                 callout_stop(c);
5065
5066         /*
5067          * We could spl down here and back up at the TAILQ_INSERT_TAIL,
5068          * but there's no point since doing this setup doesn't take much
5069          * time.
5070          */
5071         if (to_ticks <= 0)
5072                 to_ticks = 1;
5073
5074         c->c_arg = arg;
5075         c->c_flags = (CALLOUT_ACTIVE | CALLOUT_PENDING);
5076         c->c_func = ftn;
5077 #ifdef __APPLE__
5078         c->c_time = to_ticks;   /* just store the requested timeout */
5079         timeout(ftn, arg, to_ticks);
5080 #else
5081         c->c_time = ticks + to_ticks;
5082         TAILQ_INSERT_TAIL(&sctppcbinfo.callqueue, c, tqe);
5083 #endif
5084 }
5085
5086 int
5087 callout_stop(struct callout *c)
5088 {
5089         /*
5090          * Don't attempt to delete a callout that's not on the queue.
5091          */
5092         if (!(c->c_flags & CALLOUT_PENDING)) {
5093                 c->c_flags &= ~CALLOUT_ACTIVE;
5094                 return (0);
5095         }
5096         c->c_flags &= ~(CALLOUT_ACTIVE | CALLOUT_PENDING| CALLOUT_FIRED);
5097 #ifdef __APPLE__
5098 /*      thread_call_cancel(c->c_call); */
5099         untimeout(c->c_func, c->c_arg);
5100 #else
5101         TAILQ_REMOVE(&sctppcbinfo.callqueue, c, tqe);
5102         c->c_func = NULL;
5103 #endif
5104         return (1);
5105 }
5106
5107 #if !defined(__APPLE__)
5108 void
5109 sctp_fasttim(void)
5110 {
5111         struct callout *c, *n;
5112         struct calloutlist locallist;
5113         int inited = 0;
5114
5115         /* run through and subtract and mark all callouts */
5116         c = TAILQ_FIRST(&sctppcbinfo.callqueue);
5117         while (c) {
5118                 n = TAILQ_NEXT(c, tqe);
5119                 if (c->c_time <= ticks) {
5120                         c->c_flags |= CALLOUT_FIRED;
5121                         c->c_time = 0;
5122                         TAILQ_REMOVE(&sctppcbinfo.callqueue, c, tqe);
5123                         if (inited == 0) {
5124                                 TAILQ_INIT(&locallist);
5125                                 inited = 1;
5126                         }
5127                         /* move off of main list */
5128                         TAILQ_INSERT_TAIL(&locallist, c, tqe);
5129                 }
5130                 c = n;
5131         }
5132         /* Now all the ones on the locallist must be called */
5133         if (inited) {
5134                 c = TAILQ_FIRST(&locallist);
5135                 while (c) {
5136                         /* remove it */
5137                         TAILQ_REMOVE(&locallist, c, tqe);
5138                         /* now validate that it did not get canceled */
5139                         if (c->c_flags & CALLOUT_FIRED) {
5140                                 c->c_flags &= ~CALLOUT_PENDING;
5141                                 (*c->c_func)(c->c_arg);
5142                         }
5143                         c = TAILQ_FIRST(&locallist);
5144                 }
5145         }
5146 }
5147 #endif
5148 #endif /* _SCTP_NEEDS_CALLOUT_ */