src/third_party/usrsctp/usrsctplib/netinet/sctp_pcb.c

   1 /*-
   2  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #ifdef __FreeBSD__
  34 #include <sys/cdefs.h>
  35 __FBSDID("$FreeBSD: head/sys/netinet/sctp_pcb.c 267674 2014-06-20 13:26:49Z tuexen $");
  36 #endif
  37
  38 #include <netinet/sctp_os.h>
  39 #ifdef __FreeBSD__
  40 #include <sys/proc.h>
  41 #endif
  42 #include <netinet/sctp_var.h>
  43 #include <netinet/sctp_sysctl.h>
  44 #include <netinet/sctp_pcb.h>
  45 #include <netinet/sctputil.h>
  46 #include <netinet/sctp.h>
  47 #include <netinet/sctp_header.h>
  48 #include <netinet/sctp_asconf.h>
  49 #include <netinet/sctp_output.h>
  50 #include <netinet/sctp_timer.h>
  51 #include <netinet/sctp_bsd_addr.h>
  52 #if defined(__FreeBSD__) && __FreeBSD_version >= 803000
  53 #include <netinet/sctp_dtrace_define.h>
  54 #endif
  55 #if defined INET || defined INET6
  56 #if !defined(__Userspace_os_Windows)
  57 #include <netinet/udp.h>
  58 #endif
  59 #endif
  60 #ifdef INET6
  61 #if defined(__Userspace__)
  62 #include "user_ip6_var.h"
  63 #else
  64 #include <netinet6/ip6_var.h>
  65 #endif
  66 #endif
  67 #if defined(__FreeBSD__)
  68 #include <sys/sched.h>
  69 #include <sys/smp.h>
  70 #include <sys/unistd.h>
  71 #endif
  72 #if defined(__Userspace__)
  73 #include <user_socketvar.h>
  74 #endif
  75
  76 #if defined(__APPLE__)
  77 #define APPLE_FILE_NO 4
  78 #endif
  79
  80 #if defined(__FreeBSD__) && __FreeBSD_version >= 801000
  81 VNET_DEFINE(struct sctp_base_info, system_base_info);
  82 #else
  83 struct sctp_base_info system_base_info;
  84 #endif
  85
  86 #if defined(__Userspace__)
  87 #if defined(INET) || defined(INET6)
  88 struct ifaddrs *g_interfaces;
  89 #endif
  90 #endif
  91 /* FIX: we don't handle multiple link local scopes */
  92 /* "scopeless" replacement IN6_ARE_ADDR_EQUAL */
  93 #ifdef INET6
  94 int
  95 SCTP6_ARE_ADDR_EQUAL(struct sockaddr_in6 *a, struct sockaddr_in6 *b)
  96 {
  97 #ifdef SCTP_EMBEDDED_V6_SCOPE
  98 #if defined(__APPLE__)
  99         struct in6_addr tmp_a, tmp_b;
 100
 101         tmp_a = a->sin6_addr;
 102 #if defined(APPLE_LEOPARD) || defined(APPLE_SNOWLEOPARD)
 103         if (in6_embedscope(&tmp_a, a, NULL, NULL) != 0) {
 104 #else
 105         if (in6_embedscope(&tmp_a, a, NULL, NULL, NULL) != 0) {
 106 #endif
 107                 return (0);
 108         }
 109         tmp_b = b->sin6_addr;
 110 #if defined(APPLE_LEOPARD) || defined(APPLE_SNOWLEOPARD)
 111         if (in6_embedscope(&tmp_b, b, NULL, NULL) != 0) {
 112 #else
 113         if (in6_embedscope(&tmp_b, b, NULL, NULL, NULL) != 0) {
 114 #endif
 115                 return (0);
 116         }
 117         return (IN6_ARE_ADDR_EQUAL(&tmp_a, &tmp_b));
 118 #elif defined(SCTP_KAME)
 119         struct sockaddr_in6 tmp_a, tmp_b;
 120
 121         memcpy(&tmp_a, a, sizeof(struct sockaddr_in6));
 122         if (sa6_embedscope(&tmp_a, MODULE_GLOBAL(ip6_use_defzone)) != 0) {
 123                 return (0);
 124         }
 125         memcpy(&tmp_b, b, sizeof(struct sockaddr_in6));
 126         if (sa6_embedscope(&tmp_b, MODULE_GLOBAL(ip6_use_defzone)) != 0) {
 127                 return (0);
 128         }
 129         return (IN6_ARE_ADDR_EQUAL(&tmp_a.sin6_addr, &tmp_b.sin6_addr));
 130 #else
 131         struct in6_addr tmp_a, tmp_b;
 132
 133         tmp_a = a->sin6_addr;
 134         if (in6_embedscope(&tmp_a, a) != 0) {
 135                 return (0);
 136         }
 137         tmp_b = b->sin6_addr;
 138         if (in6_embedscope(&tmp_b, b) != 0) {
 139                 return (0);
 140         }
 141         return (IN6_ARE_ADDR_EQUAL(&tmp_a, &tmp_b));
 142 #endif
 143 #else
 144         return (IN6_ARE_ADDR_EQUAL(&(a->sin6_addr), &(b->sin6_addr)));
 145 #endif /* SCTP_EMBEDDED_V6_SCOPE */
 146 }
 147 #endif
 148
 149 void
 150 sctp_fill_pcbinfo(struct sctp_pcbinfo *spcb)
 151 {
 152         /*
 153          * We really don't need to lock this, but I will just because it
 154          * does not hurt.
 155          */
 156         SCTP_INP_INFO_RLOCK();
 157         spcb->ep_count = SCTP_BASE_INFO(ipi_count_ep);
 158         spcb->asoc_count = SCTP_BASE_INFO(ipi_count_asoc);
 159         spcb->laddr_count = SCTP_BASE_INFO(ipi_count_laddr);
 160         spcb->raddr_count = SCTP_BASE_INFO(ipi_count_raddr);
 161         spcb->chk_count = SCTP_BASE_INFO(ipi_count_chunk);
 162         spcb->readq_count = SCTP_BASE_INFO(ipi_count_readq);
 163         spcb->stream_oque = SCTP_BASE_INFO(ipi_count_strmoq);
 164         spcb->free_chunks = SCTP_BASE_INFO(ipi_free_chunks);
 165         SCTP_INP_INFO_RUNLOCK();
 166 }
 167
 168 /*-
 169  * Addresses are added to VRF's (Virtual Router's). For BSD we
 170  * have only the default VRF 0. We maintain a hash list of
 171  * VRF's. Each VRF has its own list of sctp_ifn's. Each of
 172  * these has a list of addresses. When we add a new address
 173  * to a VRF we lookup the ifn/ifn_index, if the ifn does
 174  * not exist we create it and add it to the list of IFN's
 175  * within the VRF. Once we have the sctp_ifn, we add the
 176  * address to the list. So we look something like:
 177  *
 178  * hash-vrf-table
 179  *   vrf-> ifn-> ifn -> ifn
 180  *   vrf    |
 181  *    ...   +--ifa-> ifa -> ifa
 182  *   vrf
 183  *
 184  * We keep these separate lists since the SCTP subsystem will
 185  * point to these from its source address selection nets structure.
 186  * When an address is deleted it does not happen right away on
 187  * the SCTP side, it gets scheduled. What we do when a
 188  * delete happens is immediately remove the address from
 189  * the master list and decrement the refcount. As our
 190  * addip iterator works through and frees the src address
 191  * selection pointing to the sctp_ifa, eventually the refcount
 192  * will reach 0 and we will delete it. Note that it is assumed
 193  * that any locking on system level ifn/ifa is done at the
 194  * caller of these functions and these routines will only
 195  * lock the SCTP structures as they add or delete things.
 196  *
 197  * Other notes on VRF concepts.
 198  *  - An endpoint can be in multiple VRF's
 199  *  - An association lives within a VRF and only one VRF.
 200  *  - Any incoming packet we can deduce the VRF for by
 201  *    looking at the mbuf/pak inbound (for BSD its VRF=0 :D)
 202  *  - Any downward send call or connect call must supply the
 203  *    VRF via ancillary data or via some sort of set default
 204  *    VRF socket option call (again for BSD no brainer since
 205  *    the VRF is always 0).
 206  *  - An endpoint may add multiple VRF's to it.
 207  *  - Listening sockets can accept associations in any
 208  *    of the VRF's they are in but the assoc will end up
 209  *    in only one VRF (gotten from the packet or connect/send).
 210  *
 211  */
 212
 213 struct sctp_vrf *
 214 sctp_allocate_vrf(int vrf_id)
 215 {
 216         struct sctp_vrf *vrf = NULL;
 217         struct sctp_vrflist *bucket;
 218
 219         /* First allocate the VRF structure */
 220         vrf = sctp_find_vrf(vrf_id);
 221         if (vrf) {
 222                 /* Already allocated */
 223                 return (vrf);
 224         }
 225         SCTP_MALLOC(vrf, struct sctp_vrf *, sizeof(struct sctp_vrf),
 226                     SCTP_M_VRF);
 227         if (vrf == NULL) {
 228                 /* No memory */
 229 #ifdef INVARIANTS
 230                 panic("No memory for VRF:%d", vrf_id);
 231 #endif
 232                 return (NULL);
 233         }
 234         /* setup the VRF */
 235         memset(vrf, 0, sizeof(struct sctp_vrf));
 236         vrf->vrf_id = vrf_id;
 237         LIST_INIT(&vrf->ifnlist);
 238         vrf->total_ifa_count = 0;
 239         vrf->refcount = 0;
 240         /* now also setup table ids */
 241         SCTP_INIT_VRF_TABLEID(vrf);
 242         /* Init the HASH of addresses */
 243         vrf->vrf_addr_hash = SCTP_HASH_INIT(SCTP_VRF_ADDR_HASH_SIZE,
 244                                             &vrf->vrf_addr_hashmark);
 245         if (vrf->vrf_addr_hash == NULL) {
 246                 /* No memory */
 247 #ifdef INVARIANTS
 248                 panic("No memory for VRF:%d", vrf_id);
 249 #endif
 250                 SCTP_FREE(vrf, SCTP_M_VRF);
 251                 return (NULL);
 252         }
 253
 254         /* Add it to the hash table */
 255         bucket = &SCTP_BASE_INFO(sctp_vrfhash)[(vrf_id & SCTP_BASE_INFO(hashvrfmark))];
 256         LIST_INSERT_HEAD(bucket, vrf, next_vrf);
 257         atomic_add_int(&SCTP_BASE_INFO(ipi_count_vrfs), 1);
 258         return (vrf);
 259 }
 260
 261
 262 struct sctp_ifn *
 263 sctp_find_ifn(void *ifn, uint32_t ifn_index)
 264 {
 265         struct sctp_ifn *sctp_ifnp;
 266         struct sctp_ifnlist *hash_ifn_head;
 267
 268         /* We assume the lock is held for the addresses
 269          * if that's wrong problems could occur :-)
 270          */
 271         hash_ifn_head = &SCTP_BASE_INFO(vrf_ifn_hash)[(ifn_index & SCTP_BASE_INFO(vrf_ifn_hashmark))];
 272         LIST_FOREACH(sctp_ifnp, hash_ifn_head, next_bucket) {
 273                 if (sctp_ifnp->ifn_index == ifn_index) {
 274                         return (sctp_ifnp);
 275                 }
 276                 if (sctp_ifnp->ifn_p && ifn && (sctp_ifnp->ifn_p == ifn)) {
 277                         return (sctp_ifnp);
 278                 }
 279         }
 280         return (NULL);
 281 }
 282
 283
 284 struct sctp_vrf *
 285 sctp_find_vrf(uint32_t vrf_id)
 286 {
 287         struct sctp_vrflist *bucket;
 288         struct sctp_vrf *liste;
 289
 290         bucket = &SCTP_BASE_INFO(sctp_vrfhash)[(vrf_id & SCTP_BASE_INFO(hashvrfmark))];
 291         LIST_FOREACH(liste, bucket, next_vrf) {
 292                 if (vrf_id == liste->vrf_id) {
 293                         return (liste);
 294                 }
 295         }
 296         return (NULL);
 297 }
 298
 299
 300 void
 301 sctp_free_vrf(struct sctp_vrf *vrf)
 302 {
 303         if (SCTP_DECREMENT_AND_CHECK_REFCOUNT(&vrf->refcount)) {
 304                 if (vrf->vrf_addr_hash) {
 305                     SCTP_HASH_FREE(vrf->vrf_addr_hash, vrf->vrf_addr_hashmark);
 306                     vrf->vrf_addr_hash = NULL;
 307                 }
 308                 /* We zero'd the count */
 309                 LIST_REMOVE(vrf, next_vrf);
 310                 SCTP_FREE(vrf, SCTP_M_VRF);
 311                 atomic_subtract_int(&SCTP_BASE_INFO(ipi_count_vrfs), 1);
 312         }
 313 }
 314
 315
 316 void
 317 sctp_free_ifn(struct sctp_ifn *sctp_ifnp)
 318 {
 319         if (SCTP_DECREMENT_AND_CHECK_REFCOUNT(&sctp_ifnp->refcount)) {
 320                 /* We zero'd the count */
 321                 if (sctp_ifnp->vrf) {
 322                         sctp_free_vrf(sctp_ifnp->vrf);
 323                 }
 324                 SCTP_FREE(sctp_ifnp, SCTP_M_IFN);
 325                 atomic_subtract_int(&SCTP_BASE_INFO(ipi_count_ifns), 1);
 326         }
 327 }
 328
 329
 330 void
 331 sctp_update_ifn_mtu(uint32_t ifn_index, uint32_t mtu)
 332 {
 333         struct sctp_ifn *sctp_ifnp;
 334
 335         sctp_ifnp = sctp_find_ifn((void *)NULL, ifn_index);
 336         if (sctp_ifnp != NULL) {
 337                 sctp_ifnp->ifn_mtu = mtu;
 338         }
 339 }
 340
 341
 342 void
 343 sctp_free_ifa(struct sctp_ifa *sctp_ifap)
 344 {
 345         if (SCTP_DECREMENT_AND_CHECK_REFCOUNT(&sctp_ifap->refcount)) {
 346                 /* We zero'd the count */
 347                 if (sctp_ifap->ifn_p) {
 348                         sctp_free_ifn(sctp_ifap->ifn_p);
 349                 }
 350                 SCTP_FREE(sctp_ifap, SCTP_M_IFA);
 351                 atomic_subtract_int(&SCTP_BASE_INFO(ipi_count_ifas), 1);
 352         }
 353 }
 354
 355
 356 static void
 357 sctp_delete_ifn(struct sctp_ifn *sctp_ifnp, int hold_addr_lock)
 358 {
 359         struct sctp_ifn *found;
 360
 361         found = sctp_find_ifn(sctp_ifnp->ifn_p, sctp_ifnp->ifn_index);
 362         if (found == NULL) {
 363                 /* Not in the list.. sorry */
 364                 return;
 365         }
 366         if (hold_addr_lock == 0)
 367                 SCTP_IPI_ADDR_WLOCK();
 368         LIST_REMOVE(sctp_ifnp, next_bucket);
 369         LIST_REMOVE(sctp_ifnp, next_ifn);
 370         SCTP_DEREGISTER_INTERFACE(sctp_ifnp->ifn_index,
 371                                   sctp_ifnp->registered_af);
 372         if (hold_addr_lock == 0)
 373                 SCTP_IPI_ADDR_WUNLOCK();
 374         /* Take away the reference, and possibly free it */
 375         sctp_free_ifn(sctp_ifnp);
 376 }
 377
 378
 379 void
 380 sctp_mark_ifa_addr_down(uint32_t vrf_id, struct sockaddr *addr,
 381                         const char *if_name, uint32_t ifn_index)
 382 {
 383         struct sctp_vrf *vrf;
 384         struct sctp_ifa *sctp_ifap;
 385
 386         SCTP_IPI_ADDR_RLOCK();
 387         vrf = sctp_find_vrf(vrf_id);
 388         if (vrf == NULL) {
 389                 SCTPDBG(SCTP_DEBUG_PCB4, "Can't find vrf_id 0x%x\n", vrf_id);
 390                 goto out;
 391
 392         }
 393         sctp_ifap = sctp_find_ifa_by_addr(addr, vrf->vrf_id, SCTP_ADDR_LOCKED);
 394         if (sctp_ifap == NULL) {
 395                 SCTPDBG(SCTP_DEBUG_PCB4, "Can't find sctp_ifap for address\n");
 396                 goto out;
 397         }
 398         if (sctp_ifap->ifn_p == NULL) {
 399                 SCTPDBG(SCTP_DEBUG_PCB4, "IFA has no IFN - can't mark unuseable\n");
 400                 goto out;
 401         }
 402         if (if_name) {
 403                 if (strncmp(if_name, sctp_ifap->ifn_p->ifn_name, SCTP_IFNAMSIZ) != 0) {
 404                         SCTPDBG(SCTP_DEBUG_PCB4, "IFN %s of IFA not the same as %s\n",
 405                                 sctp_ifap->ifn_p->ifn_name, if_name);
 406                         goto out;
 407                 }
 408         } else {
 409                 if (sctp_ifap->ifn_p->ifn_index != ifn_index) {
 410                         SCTPDBG(SCTP_DEBUG_PCB4, "IFA owned by ifn_index:%d down command for ifn_index:%d - ignored\n",
 411                                 sctp_ifap->ifn_p->ifn_index, ifn_index);
 412                         goto out;
 413                 }
 414         }
 415
 416         sctp_ifap->localifa_flags &= (~SCTP_ADDR_VALID);
 417         sctp_ifap->localifa_flags |= SCTP_ADDR_IFA_UNUSEABLE;
 418  out:
 419         SCTP_IPI_ADDR_RUNLOCK();
 420 }
 421
 422
 423 void
 424 sctp_mark_ifa_addr_up(uint32_t vrf_id, struct sockaddr *addr,
 425                       const char *if_name, uint32_t ifn_index)
 426 {
 427         struct sctp_vrf *vrf;
 428         struct sctp_ifa *sctp_ifap;
 429
 430         SCTP_IPI_ADDR_RLOCK();
 431         vrf = sctp_find_vrf(vrf_id);
 432         if (vrf == NULL) {
 433                 SCTPDBG(SCTP_DEBUG_PCB4, "Can't find vrf_id 0x%x\n", vrf_id);
 434                 goto out;
 435
 436         }
 437         sctp_ifap = sctp_find_ifa_by_addr(addr, vrf->vrf_id, SCTP_ADDR_LOCKED);
 438         if (sctp_ifap == NULL) {
 439                 SCTPDBG(SCTP_DEBUG_PCB4, "Can't find sctp_ifap for address\n");
 440                 goto out;
 441         }
 442         if (sctp_ifap->ifn_p == NULL) {
 443                 SCTPDBG(SCTP_DEBUG_PCB4, "IFA has no IFN - can't mark unuseable\n");
 444                 goto out;
 445         }
 446         if (if_name) {
 447                 if (strncmp(if_name, sctp_ifap->ifn_p->ifn_name, SCTP_IFNAMSIZ) != 0) {
 448                         SCTPDBG(SCTP_DEBUG_PCB4, "IFN %s of IFA not the same as %s\n",
 449                                 sctp_ifap->ifn_p->ifn_name, if_name);
 450                         goto out;
 451                 }
 452         } else {
 453                 if (sctp_ifap->ifn_p->ifn_index != ifn_index) {
 454                         SCTPDBG(SCTP_DEBUG_PCB4, "IFA owned by ifn_index:%d down command for ifn_index:%d - ignored\n",
 455                                 sctp_ifap->ifn_p->ifn_index, ifn_index);
 456                         goto out;
 457                 }
 458         }
 459
 460         sctp_ifap->localifa_flags &= (~SCTP_ADDR_IFA_UNUSEABLE);
 461         sctp_ifap->localifa_flags |= SCTP_ADDR_VALID;
 462  out:
 463         SCTP_IPI_ADDR_RUNLOCK();
 464 }
 465
 466
 467 /*-
 468  * Add an ifa to an ifn.
 469  * Register the interface as necessary.
 470  * NOTE: ADDR write lock MUST be held.
 471  */
 472 static void
 473 sctp_add_ifa_to_ifn(struct sctp_ifn *sctp_ifnp, struct sctp_ifa *sctp_ifap)
 474 {
 475         int ifa_af;
 476
 477         LIST_INSERT_HEAD(&sctp_ifnp->ifalist, sctp_ifap, next_ifa);
 478         sctp_ifap->ifn_p = sctp_ifnp;
 479         atomic_add_int(&sctp_ifap->ifn_p->refcount, 1);
 480         /* update address counts */
 481         sctp_ifnp->ifa_count++;
 482         ifa_af = sctp_ifap->address.sa.sa_family;
 483         switch (ifa_af) {
 484 #ifdef INET
 485         case AF_INET:
 486                 sctp_ifnp->num_v4++;
 487                 break;
 488 #endif
 489 #ifdef INET6
 490         case AF_INET6:
 491                 sctp_ifnp->num_v6++;
 492                 break;
 493 #endif
 494         default:
 495                 break;
 496         }
 497         if (sctp_ifnp->ifa_count == 1) {
 498                 /* register the new interface */
 499                 SCTP_REGISTER_INTERFACE(sctp_ifnp->ifn_index, ifa_af);
 500                 sctp_ifnp->registered_af = ifa_af;
 501         }
 502 }
 503
 504
 505 /*-
 506  * Remove an ifa from its ifn.
 507  * If no more addresses exist, remove the ifn too. Otherwise, re-register
 508  * the interface based on the remaining address families left.
 509  * NOTE: ADDR write lock MUST be held.
 510  */
 511 static void
 512 sctp_remove_ifa_from_ifn(struct sctp_ifa *sctp_ifap)
 513 {
 514         LIST_REMOVE(sctp_ifap, next_ifa);
 515         if (sctp_ifap->ifn_p) {
 516                 /* update address counts */
 517                 sctp_ifap->ifn_p->ifa_count--;
 518                 switch (sctp_ifap->address.sa.sa_family) {
 519 #ifdef INET
 520                 case AF_INET:
 521                         sctp_ifap->ifn_p->num_v4--;
 522                         break;
 523 #endif
 524 #ifdef INET6
 525                 case AF_INET6:
 526                         sctp_ifap->ifn_p->num_v6--;
 527                         break;
 528 #endif
 529                 default:
 530                         break;
 531                 }
 532
 533                 if (LIST_EMPTY(&sctp_ifap->ifn_p->ifalist)) {
 534                         /* remove the ifn, possibly freeing it */
 535                         sctp_delete_ifn(sctp_ifap->ifn_p, SCTP_ADDR_LOCKED);
 536                 } else {
 537                         /* re-register address family type, if needed */
 538                         if ((sctp_ifap->ifn_p->num_v6 == 0) &&
 539                             (sctp_ifap->ifn_p->registered_af == AF_INET6)) {
 540                                 SCTP_DEREGISTER_INTERFACE(sctp_ifap->ifn_p->ifn_index, AF_INET6);
 541                                 SCTP_REGISTER_INTERFACE(sctp_ifap->ifn_p->ifn_index, AF_INET);
 542                                 sctp_ifap->ifn_p->registered_af = AF_INET;
 543                         } else if ((sctp_ifap->ifn_p->num_v4 == 0) &&
 544                                    (sctp_ifap->ifn_p->registered_af == AF_INET)) {
 545                                 SCTP_DEREGISTER_INTERFACE(sctp_ifap->ifn_p->ifn_index, AF_INET);
 546                                 SCTP_REGISTER_INTERFACE(sctp_ifap->ifn_p->ifn_index, AF_INET6);
 547                                 sctp_ifap->ifn_p->registered_af = AF_INET6;
 548                         }
 549                         /* free the ifn refcount */
 550                         sctp_free_ifn(sctp_ifap->ifn_p);
 551                 }
 552                 sctp_ifap->ifn_p = NULL;
 553         }
 554 }
 555
 556
 557 struct sctp_ifa *
 558 sctp_add_addr_to_vrf(uint32_t vrf_id, void *ifn, uint32_t ifn_index,
 559                      uint32_t ifn_type, const char *if_name, void *ifa,
 560                      struct sockaddr *addr, uint32_t ifa_flags,
 561                      int dynamic_add)
 562 {
 563         struct sctp_vrf *vrf;
 564         struct sctp_ifn *sctp_ifnp = NULL;
 565         struct sctp_ifa *sctp_ifap = NULL;
 566         struct sctp_ifalist *hash_addr_head;
 567         struct sctp_ifnlist *hash_ifn_head;
 568         uint32_t hash_of_addr;
 569         int new_ifn_af = 0;
 570
 571 #ifdef SCTP_DEBUG
 572         SCTPDBG(SCTP_DEBUG_PCB4, "vrf_id 0x%x: adding address: ", vrf_id);
 573         SCTPDBG_ADDR(SCTP_DEBUG_PCB4, addr);
 574 #endif
 575         SCTP_IPI_ADDR_WLOCK();
 576         sctp_ifnp = sctp_find_ifn(ifn, ifn_index);
 577         if (sctp_ifnp) {
 578                 vrf = sctp_ifnp->vrf;
 579         } else {
 580                 vrf = sctp_find_vrf(vrf_id);
 581                 if (vrf == NULL) {
 582                         vrf = sctp_allocate_vrf(vrf_id);
 583                         if (vrf == NULL) {
 584                                 SCTP_IPI_ADDR_WUNLOCK();
 585                                 return (NULL);
 586                         }
 587                 }
 588         }
 589         if (sctp_ifnp == NULL) {
 590                 /* build one and add it, can't hold lock
 591                  * until after malloc done though.
 592                  */
 593                 SCTP_IPI_ADDR_WUNLOCK();
 594                 SCTP_MALLOC(sctp_ifnp, struct sctp_ifn *,
 595                             sizeof(struct sctp_ifn), SCTP_M_IFN);
 596                 if (sctp_ifnp == NULL) {
 597 #ifdef INVARIANTS
 598                         panic("No memory for IFN");
 599 #endif
 600                         return (NULL);
 601                 }
 602                 memset(sctp_ifnp, 0, sizeof(struct sctp_ifn));
 603                 sctp_ifnp->ifn_index = ifn_index;
 604                 sctp_ifnp->ifn_p = ifn;
 605                 sctp_ifnp->ifn_type = ifn_type;
 606                 sctp_ifnp->refcount = 0;
 607                 sctp_ifnp->vrf = vrf;
 608                 atomic_add_int(&vrf->refcount, 1);
 609                 sctp_ifnp->ifn_mtu = SCTP_GATHER_MTU_FROM_IFN_INFO(ifn, ifn_index, addr->sa_family);
 610                 if (if_name != NULL) {
 611                         snprintf(sctp_ifnp->ifn_name, SCTP_IFNAMSIZ, "%s", if_name);
 612                 } else {
 613                         snprintf(sctp_ifnp->ifn_name, SCTP_IFNAMSIZ, "%s", "unknown");
 614                 }
 615                 hash_ifn_head = &SCTP_BASE_INFO(vrf_ifn_hash)[(ifn_index & SCTP_BASE_INFO(vrf_ifn_hashmark))];
 616                 LIST_INIT(&sctp_ifnp->ifalist);
 617                 SCTP_IPI_ADDR_WLOCK();
 618                 LIST_INSERT_HEAD(hash_ifn_head, sctp_ifnp, next_bucket);
 619                 LIST_INSERT_HEAD(&vrf->ifnlist, sctp_ifnp, next_ifn);
 620                 atomic_add_int(&SCTP_BASE_INFO(ipi_count_ifns), 1);
 621                 new_ifn_af = 1;
 622         }
 623         sctp_ifap = sctp_find_ifa_by_addr(addr, vrf->vrf_id, SCTP_ADDR_LOCKED);
 624         if (sctp_ifap) {
 625                 /* Hmm, it already exists? */
 626                 if ((sctp_ifap->ifn_p) &&
 627                     (sctp_ifap->ifn_p->ifn_index == ifn_index)) {
 628                         SCTPDBG(SCTP_DEBUG_PCB4, "Using existing ifn %s (0x%x) for ifa %p\n",
 629                                 sctp_ifap->ifn_p->ifn_name, ifn_index,
 630                                 (void *)sctp_ifap);
 631                         if (new_ifn_af) {
 632                                 /* Remove the created one that we don't want */
 633                                 sctp_delete_ifn(sctp_ifnp, SCTP_ADDR_LOCKED);
 634                         }
 635                         if (sctp_ifap->localifa_flags & SCTP_BEING_DELETED) {
 636                                 /* easy to solve, just switch back to active */
 637                                 SCTPDBG(SCTP_DEBUG_PCB4, "Clearing deleted ifa flag\n");
 638                                 sctp_ifap->localifa_flags = SCTP_ADDR_VALID;
 639                                 sctp_ifap->ifn_p = sctp_ifnp;
 640                                 atomic_add_int(&sctp_ifap->ifn_p->refcount, 1);
 641                         }
 642                 exit_stage_left:
 643                         SCTP_IPI_ADDR_WUNLOCK();
 644                         return (sctp_ifap);
 645                 } else {
 646                         if (sctp_ifap->ifn_p) {
 647                                 /*
 648                                  * The last IFN gets the address, remove the
 649                                  * old one
 650                                  */
 651                                 SCTPDBG(SCTP_DEBUG_PCB4, "Moving ifa %p from %s (0x%x) to %s (0x%x)\n",
 652                                         (void *)sctp_ifap, sctp_ifap->ifn_p->ifn_name,
 653                                         sctp_ifap->ifn_p->ifn_index, if_name,
 654                                         ifn_index);
 655                                 /* remove the address from the old ifn */
 656                                 sctp_remove_ifa_from_ifn(sctp_ifap);
 657                                 /* move the address over to the new ifn */
 658                                 sctp_add_ifa_to_ifn(sctp_ifnp, sctp_ifap);
 659                                 goto exit_stage_left;
 660                         } else {
 661                                 /* repair ifnp which was NULL ? */
 662                                 sctp_ifap->localifa_flags = SCTP_ADDR_VALID;
 663                                 SCTPDBG(SCTP_DEBUG_PCB4, "Repairing ifn %p for ifa %p\n",
 664                                         (void *)sctp_ifnp, (void *)sctp_ifap);
 665                                 sctp_add_ifa_to_ifn(sctp_ifnp, sctp_ifap);
 666                         }
 667                         goto exit_stage_left;
 668                 }
 669         }
 670         SCTP_IPI_ADDR_WUNLOCK();
 671         SCTP_MALLOC(sctp_ifap, struct sctp_ifa *, sizeof(struct sctp_ifa), SCTP_M_IFA);
 672         if (sctp_ifap == NULL) {
 673 #ifdef INVARIANTS
 674                 panic("No memory for IFA");
 675 #endif
 676                 return (NULL);
 677         }
 678         memset(sctp_ifap, 0, sizeof(struct sctp_ifa));
 679         sctp_ifap->ifn_p = sctp_ifnp;
 680         atomic_add_int(&sctp_ifnp->refcount, 1);
 681         sctp_ifap->vrf_id = vrf_id;
 682         sctp_ifap->ifa = ifa;
 683 #ifdef HAVE_SA_LEN
 684         memcpy(&sctp_ifap->address, addr, addr->sa_len);
 685 #else
 686         switch (addr->sa_family) {
 687 #ifdef INET
 688         case AF_INET:
 689                 memcpy(&sctp_ifap->address, addr, sizeof(struct sockaddr_in));
 690                 break;
 691 #endif
 692 #ifdef INET6
 693         case AF_INET6:
 694                 memcpy(&sctp_ifap->address, addr, sizeof(struct sockaddr_in6));
 695                 break;
 696 #endif
 697 #if defined(__Userspace__)
 698         case AF_CONN:
 699                 memcpy(&sctp_ifap->address, addr, sizeof(struct sockaddr_conn));
 700                 break;
 701 #endif
 702         default:
 703                 /* TSNH */
 704                 break;
 705         }
 706 #endif
 707         sctp_ifap->localifa_flags = SCTP_ADDR_VALID | SCTP_ADDR_DEFER_USE;
 708         sctp_ifap->flags = ifa_flags;
 709         /* Set scope */
 710         switch (sctp_ifap->address.sa.sa_family) {
 711 #ifdef INET
 712         case AF_INET:
 713         {
 714                 struct sockaddr_in *sin;
 715
 716                 sin = (struct sockaddr_in *)&sctp_ifap->address.sin;
 717                 if (SCTP_IFN_IS_IFT_LOOP(sctp_ifap->ifn_p) ||
 718                     (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
 719                         sctp_ifap->src_is_loop = 1;
 720                 }
 721                 if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
 722                         sctp_ifap->src_is_priv = 1;
 723                 }
 724                 sctp_ifnp->num_v4++;
 725                 if (new_ifn_af)
 726                     new_ifn_af = AF_INET;
 727                 break;
 728         }
 729 #endif
 730 #ifdef INET6
 731         case AF_INET6:
 732         {
 733                 /* ok to use deprecated addresses? */
 734                 struct sockaddr_in6 *sin6;
 735
 736                 sin6 = (struct sockaddr_in6 *)&sctp_ifap->address.sin6;
 737                 if (SCTP_IFN_IS_IFT_LOOP(sctp_ifap->ifn_p) ||
 738                     (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr))) {
 739                         sctp_ifap->src_is_loop = 1;
 740                 }
 741                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
 742                         sctp_ifap->src_is_priv = 1;
 743                 }
 744                 sctp_ifnp->num_v6++;
 745                 if (new_ifn_af)
 746                         new_ifn_af = AF_INET6;
 747                 break;
 748         }
 749 #endif
 750 #if defined(__Userspace__)
 751         case AF_CONN:
 752                 if (new_ifn_af)
 753                         new_ifn_af = AF_CONN;
 754                 break;
 755 #endif
 756         default:
 757                 new_ifn_af = 0;
 758                 break;
 759         }
 760         hash_of_addr = sctp_get_ifa_hash_val(&sctp_ifap->address.sa);
 761
 762         if ((sctp_ifap->src_is_priv == 0) &&
 763             (sctp_ifap->src_is_loop == 0)) {
 764                 sctp_ifap->src_is_glob = 1;
 765         }
 766         SCTP_IPI_ADDR_WLOCK();
 767         hash_addr_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)];
 768         LIST_INSERT_HEAD(hash_addr_head, sctp_ifap, next_bucket);
 769         sctp_ifap->refcount = 1;
 770         LIST_INSERT_HEAD(&sctp_ifnp->ifalist, sctp_ifap, next_ifa);
 771         sctp_ifnp->ifa_count++;
 772         vrf->total_ifa_count++;
 773         atomic_add_int(&SCTP_BASE_INFO(ipi_count_ifas), 1);
 774         if (new_ifn_af) {
 775                 SCTP_REGISTER_INTERFACE(ifn_index, new_ifn_af);
 776                 sctp_ifnp->registered_af = new_ifn_af;
 777         }
 778         SCTP_IPI_ADDR_WUNLOCK();
 779         if (dynamic_add) {
 780                 /* Bump up the refcount so that when the timer
 781                  * completes it will drop back down.
 782                  */
 783                 struct sctp_laddr *wi;
 784
 785                 atomic_add_int(&sctp_ifap->refcount, 1);
 786                 wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
 787                 if (wi == NULL) {
 788                         /*
 789                          * Gak, what can we do? We have lost an address
 790                          * change can you say HOSED?
 791                          */
 792                         SCTPDBG(SCTP_DEBUG_PCB4, "Lost an address change?\n");
 793                         /* Opps, must decrement the count */
 794                         sctp_del_addr_from_vrf(vrf_id, addr, ifn_index,
 795                                                if_name);
 796                         return (NULL);
 797                 }
 798                 SCTP_INCR_LADDR_COUNT();
 799                 bzero(wi, sizeof(*wi));
 800                 (void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
 801                 wi->ifa = sctp_ifap;
 802                 wi->action = SCTP_ADD_IP_ADDRESS;
 803
 804                 SCTP_WQ_ADDR_LOCK();
 805                 LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
 806                 SCTP_WQ_ADDR_UNLOCK();
 807
 808                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
 809                                  (struct sctp_inpcb *)NULL,
 810                                  (struct sctp_tcb *)NULL,
 811                                  (struct sctp_nets *)NULL);
 812         } else {
 813                 /* it's ready for use */
 814                 sctp_ifap->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
 815         }
 816         return (sctp_ifap);
 817 }
 818
 819 void
 820 sctp_del_addr_from_vrf(uint32_t vrf_id, struct sockaddr *addr,
 821                        uint32_t ifn_index, const char *if_name)
 822 {
 823         struct sctp_vrf *vrf;
 824         struct sctp_ifa *sctp_ifap = NULL;
 825
 826         SCTP_IPI_ADDR_WLOCK();
 827         vrf = sctp_find_vrf(vrf_id);
 828         if (vrf == NULL) {
 829                 SCTPDBG(SCTP_DEBUG_PCB4, "Can't find vrf_id 0x%x\n", vrf_id);
 830                 goto out_now;
 831         }
 832
 833 #ifdef SCTP_DEBUG
 834         SCTPDBG(SCTP_DEBUG_PCB4, "vrf_id 0x%x: deleting address:", vrf_id);
 835         SCTPDBG_ADDR(SCTP_DEBUG_PCB4, addr);
 836 #endif
 837         sctp_ifap = sctp_find_ifa_by_addr(addr, vrf->vrf_id, SCTP_ADDR_LOCKED);
 838         if (sctp_ifap) {
 839                 /* Validate the delete */
 840                 if (sctp_ifap->ifn_p) {
 841                         int valid = 0;
 842                         /*-
 843                          * The name has priority over the ifn_index
 844                          * if its given. We do this especially for
 845                          * panda who might recycle indexes fast.
 846                          */
 847                         if (if_name) {
 848                                 if (strncmp(if_name, sctp_ifap->ifn_p->ifn_name, SCTP_IFNAMSIZ) == 0) {
 849                                         /* They match its a correct delete */
 850                                         valid = 1;
 851                                 }
 852                         }
 853                         if (!valid) {
 854                                 /* last ditch check ifn_index */
 855                                 if (ifn_index == sctp_ifap->ifn_p->ifn_index) {
 856                                         valid = 1;
 857                                 }
 858                         }
 859                         if (!valid) {
 860                                 SCTPDBG(SCTP_DEBUG_PCB4, "ifn:%d ifname:%s does not match addresses\n",
 861                                         ifn_index, ((if_name == NULL) ? "NULL" : if_name));
 862                                 SCTPDBG(SCTP_DEBUG_PCB4, "ifn:%d ifname:%s - ignoring delete\n",
 863                                         sctp_ifap->ifn_p->ifn_index, sctp_ifap->ifn_p->ifn_name);
 864                                 SCTP_IPI_ADDR_WUNLOCK();
 865                                 return;
 866                         }
 867                 }
 868                 SCTPDBG(SCTP_DEBUG_PCB4, "Deleting ifa %p\n", (void *)sctp_ifap);
 869                 sctp_ifap->localifa_flags &= SCTP_ADDR_VALID;
 870                 /*
 871                  * We don't set the flag. This means that the structure will
 872                  * hang around in EP's that have bound specific to it until
 873                  * they close. This gives us TCP like behavior if someone
 874                  * removes an address (or for that matter adds it right back).
 875                  */
 876                 /* sctp_ifap->localifa_flags |= SCTP_BEING_DELETED; */
 877                 vrf->total_ifa_count--;
 878                 LIST_REMOVE(sctp_ifap, next_bucket);
 879                 sctp_remove_ifa_from_ifn(sctp_ifap);
 880         }
 881 #ifdef SCTP_DEBUG
 882         else {
 883                 SCTPDBG(SCTP_DEBUG_PCB4, "Del Addr-ifn:%d Could not find address:",
 884                         ifn_index);
 885                 SCTPDBG_ADDR(SCTP_DEBUG_PCB1, addr);
 886         }
 887 #endif
 888
 889  out_now:
 890         SCTP_IPI_ADDR_WUNLOCK();
 891         if (sctp_ifap) {
 892                 struct sctp_laddr *wi;
 893
 894                 wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
 895                 if (wi == NULL) {
 896                         /*
 897                          * Gak, what can we do? We have lost an address
 898                          * change can you say HOSED?
 899                          */
 900                         SCTPDBG(SCTP_DEBUG_PCB4, "Lost an address change?\n");
 901
 902                         /* Oops, must decrement the count */
 903                         sctp_free_ifa(sctp_ifap);
 904                         return;
 905                 }
 906                 SCTP_INCR_LADDR_COUNT();
 907                 bzero(wi, sizeof(*wi));
 908                 (void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
 909                 wi->ifa = sctp_ifap;
 910                 wi->action = SCTP_DEL_IP_ADDRESS;
 911                 SCTP_WQ_ADDR_LOCK();
 912                 /*
 913                  * Should this really be a tailq? As it is we will process the
 914                  * newest first :-0
 915                  */
 916                 LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
 917                 SCTP_WQ_ADDR_UNLOCK();
 918
 919                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
 920                                  (struct sctp_inpcb *)NULL,
 921                                  (struct sctp_tcb *)NULL,
 922                                  (struct sctp_nets *)NULL);
 923         }
 924         return;
 925 }
 926
 927
 928 static int
 929 sctp_does_stcb_own_this_addr(struct sctp_tcb *stcb, struct sockaddr *to)
 930 {
 931         int loopback_scope;
 932 #if defined(INET)
 933         int ipv4_local_scope, ipv4_addr_legal;
 934 #endif
 935 #if defined(INET6)
 936         int local_scope, site_scope, ipv6_addr_legal;
 937 #endif
 938 #if defined(__Userspace__)
 939         int conn_addr_legal;
 940 #endif
 941         struct sctp_vrf *vrf;
 942         struct sctp_ifn *sctp_ifn;
 943         struct sctp_ifa *sctp_ifa;
 944
 945         loopback_scope = stcb->asoc.scope.loopback_scope;
 946 #if defined(INET)
 947         ipv4_local_scope = stcb->asoc.scope.ipv4_local_scope;
 948         ipv4_addr_legal = stcb->asoc.scope.ipv4_addr_legal;
 949 #endif
 950 #if defined(INET6)
 951         local_scope = stcb->asoc.scope.local_scope;
 952         site_scope = stcb->asoc.scope.site_scope;
 953         ipv6_addr_legal = stcb->asoc.scope.ipv6_addr_legal;
 954 #endif
 955 #if defined(__Userspace__)
 956         conn_addr_legal = stcb->asoc.scope.conn_addr_legal;
 957 #endif
 958
 959         SCTP_IPI_ADDR_RLOCK();
 960         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
 961         if (vrf == NULL) {
 962                 /* no vrf, no addresses */
 963                 SCTP_IPI_ADDR_RUNLOCK();
 964                 return (0);
 965         }
 966
 967         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
 968                 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
 969                         if ((loopback_scope == 0) &&
 970                             SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
 971                                 continue;
 972                         }
 973                         LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
 974                                 if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
 975                                     (!sctp_is_addr_pending(stcb, sctp_ifa))) {
 976                                         /* We allow pending addresses, where we
 977                                          * have sent an asconf-add to be considered
 978                                          * valid.
 979                                          */
 980                                         continue;
 981                                 }
 982                                 if (sctp_ifa->address.sa.sa_family != to->sa_family) {
 983                                         continue;
 984                                 }
 985                                 switch (sctp_ifa->address.sa.sa_family) {
 986 #ifdef INET
 987                                 case AF_INET:
 988                                         if (ipv4_addr_legal) {
 989                                                 struct sockaddr_in *sin, *rsin;
 990
 991                                                 sin = &sctp_ifa->address.sin;
 992                                                 rsin = (struct sockaddr_in *)to;
 993                                                 if ((ipv4_local_scope == 0) &&
 994                                                     IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
 995                                                         continue;
 996                                                 }
 997 #if defined(__FreeBSD__)
 998                                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
 999                                                                      &sin->sin_addr) != 0) {
1000                                                         continue;
1001                                                 }
1002 #endif
1003                                                 if (sin->sin_addr.s_addr == rsin->sin_addr.s_addr) {
1004                                                         SCTP_IPI_ADDR_RUNLOCK();
1005                                                         return (1);
1006                                                 }
1007                                         }
1008                                         break;
1009 #endif
1010 #ifdef INET6
1011                                 case AF_INET6:
1012                                         if (ipv6_addr_legal) {
1013                                                 struct sockaddr_in6 *sin6, *rsin6;
1014 #if defined(SCTP_EMBEDDED_V6_SCOPE) && !defined(SCTP_KAME)
1015                                                 struct sockaddr_in6 lsa6;
1016 #endif
1017                                                 sin6 = &sctp_ifa->address.sin6;
1018                                                 rsin6 = (struct sockaddr_in6 *)to;
1019 #if defined(__FreeBSD__)
1020                                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
1021                                                                      &sin6->sin6_addr) != 0) {
1022                                                         continue;
1023                                                 }
1024 #endif
1025                                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
1026                                                         if (local_scope == 0)
1027                                                                 continue;
1028 #if defined(SCTP_EMBEDDED_V6_SCOPE)
1029                                                         if (sin6->sin6_scope_id == 0) {
1030 #ifdef SCTP_KAME
1031                                                                 if (sa6_recoverscope(sin6) != 0)
1032                                                                         continue;
1033 #else
1034                                                                 lsa6 = *sin6;
1035                                                                 if (in6_recoverscope(&lsa6,
1036                                                                                      &lsa6.sin6_addr,
1037                                                                                      NULL))
1038                                                                         continue;
1039                                                                 sin6 = &lsa6;
1040 #endif /* SCTP_KAME */
1041                                                         }
1042 #endif /* SCTP_EMBEDDED_V6_SCOPE */
1043                                                 }
1044                                                 if ((site_scope == 0) &&
1045                                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
1046                                                         continue;
1047                                                 }
1048                                                 if (SCTP6_ARE_ADDR_EQUAL(sin6, rsin6)) {
1049                                                         SCTP_IPI_ADDR_RUNLOCK();
1050                                                         return (1);
1051                                                 }
1052                                         }
1053                                         break;
1054 #endif
1055 #if defined(__Userspace__)
1056                                 case AF_CONN:
1057                                         if (conn_addr_legal) {
1058                                                 struct sockaddr_conn *sconn, *rsconn;
1059
1060                                                 sconn = &sctp_ifa->address.sconn;
1061                                                 rsconn = (struct sockaddr_conn *)to;
1062                                                 if (sconn->sconn_addr == rsconn->sconn_addr) {
1063                                                         SCTP_IPI_ADDR_RUNLOCK();
1064                                                         return (1);
1065                                                 }
1066                                         }
1067                                         break;
1068 #endif
1069                                 default:
1070                                         /* TSNH */
1071                                         break;
1072                                 }
1073                         }
1074                 }
1075         } else {
1076                 struct sctp_laddr *laddr;
1077
1078                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
1079                         if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) {
1080                                 SCTPDBG(SCTP_DEBUG_PCB1, "ifa being deleted\n");
1081                                 continue;
1082                         }
1083                         if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
1084                             (!sctp_is_addr_pending(stcb, laddr->ifa))) {
1085                                 /* We allow pending addresses, where we
1086                                  * have sent an asconf-add to be considered
1087                                  * valid.
1088                                  */
1089                                 continue;
1090                         }
1091                         if (laddr->ifa->address.sa.sa_family != to->sa_family) {
1092                                 continue;
1093                         }
1094                         switch (to->sa_family) {
1095 #ifdef INET
1096                         case AF_INET:
1097                         {
1098                                 struct sockaddr_in *sin, *rsin;
1099
1100                                 sin = (struct sockaddr_in *)&laddr->ifa->address.sin;
1101                                 rsin = (struct sockaddr_in *)to;
1102                                 if (sin->sin_addr.s_addr == rsin->sin_addr.s_addr) {
1103                                         SCTP_IPI_ADDR_RUNLOCK();
1104                                         return (1);
1105                                 }
1106                                 break;
1107                         }
1108 #endif
1109 #ifdef INET6
1110                         case AF_INET6:
1111                         {
1112                                 struct sockaddr_in6 *sin6, *rsin6;
1113
1114                                 sin6 = (struct sockaddr_in6 *)&laddr->ifa->address.sin6;
1115                                 rsin6 = (struct sockaddr_in6 *)to;
1116                                 if (SCTP6_ARE_ADDR_EQUAL(sin6, rsin6)) {
1117                                         SCTP_IPI_ADDR_RUNLOCK();
1118                                         return (1);
1119                                 }
1120                                 break;
1121                         }
1122
1123 #endif
1124 #if defined(__Userspace__)
1125                         case AF_CONN:
1126                         {
1127                                 struct sockaddr_conn *sconn, *rsconn;
1128
1129                                 sconn = (struct sockaddr_conn *)&laddr->ifa->address.sconn;
1130                                 rsconn = (struct sockaddr_conn *)to;
1131                                 if (sconn->sconn_addr == rsconn->sconn_addr) {
1132                                         SCTP_IPI_ADDR_RUNLOCK();
1133                                         return (1);
1134                                 }
1135                                 break;
1136                         }
1137 #endif
1138                         default:
1139                                 /* TSNH */
1140                                 break;
1141                         }
1142
1143                 }
1144         }
1145         SCTP_IPI_ADDR_RUNLOCK();
1146         return (0);
1147 }
1148
1149
1150 static struct sctp_tcb *
1151 sctp_tcb_special_locate(struct sctp_inpcb **inp_p, struct sockaddr *from,
1152     struct sockaddr *to, struct sctp_nets **netp, uint32_t vrf_id)
1153 {
1154         /**** ASSUMES THE CALLER holds the INP_INFO_RLOCK */
1155         /*
1156          * If we support the TCP model, then we must now dig through to see
1157          * if we can find our endpoint in the list of tcp ep's.
1158          */
1159         uint16_t lport, rport;
1160         struct sctppcbhead *ephead;
1161         struct sctp_inpcb *inp;
1162         struct sctp_laddr *laddr;
1163         struct sctp_tcb *stcb;
1164         struct sctp_nets *net;
1165 #ifdef SCTP_MVRF
1166         int fnd, i;
1167 #endif
1168
1169         if ((to == NULL) || (from == NULL)) {
1170                 return (NULL);
1171         }
1172
1173         switch (to->sa_family) {
1174 #ifdef INET
1175         case AF_INET:
1176                 if (from->sa_family == AF_INET) {
1177                         lport = ((struct sockaddr_in *)to)->sin_port;
1178                         rport = ((struct sockaddr_in *)from)->sin_port;
1179                 } else {
1180                         return (NULL);
1181                 }
1182                 break;
1183 #endif
1184 #ifdef INET6
1185         case AF_INET6:
1186                 if (from->sa_family == AF_INET6) {
1187                         lport = ((struct sockaddr_in6 *)to)->sin6_port;
1188                         rport = ((struct sockaddr_in6 *)from)->sin6_port;
1189                 } else {
1190                         return (NULL);
1191                 }
1192                 break;
1193 #endif
1194 #if defined(__Userspace__)
1195         case AF_CONN:
1196                 if (from->sa_family == AF_CONN) {
1197                         lport = ((struct sockaddr_conn *)to)->sconn_port;
1198                         rport = ((struct sockaddr_conn *)from)->sconn_port;
1199                 } else {
1200                         return (NULL);
1201                 }
1202                 break;
1203 #endif
1204         default:
1205                 return (NULL);
1206         }
1207         ephead = &SCTP_BASE_INFO(sctp_tcpephash)[SCTP_PCBHASH_ALLADDR((lport | rport), SCTP_BASE_INFO(hashtcpmark))];
1208         /*
1209          * Ok now for each of the guys in this bucket we must look and see:
1210          * - Does the remote port match. - Does there single association's
1211          * addresses match this address (to). If so we update p_ep to point
1212          * to this ep and return the tcb from it.
1213          */
1214         LIST_FOREACH(inp, ephead, sctp_hash) {
1215                 SCTP_INP_RLOCK(inp);
1216                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1217                         SCTP_INP_RUNLOCK(inp);
1218                         continue;
1219                 }
1220                 if (lport != inp->sctp_lport) {
1221                         SCTP_INP_RUNLOCK(inp);
1222                         continue;
1223                 }
1224 #if defined(__FreeBSD__)
1225                 switch (to->sa_family) {
1226 #ifdef INET
1227                 case AF_INET:
1228                 {
1229                         struct sockaddr_in *sin;
1230
1231                         sin = (struct sockaddr_in *)to;
1232                         if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
1233                                              &sin->sin_addr) != 0) {
1234                                 SCTP_INP_RUNLOCK(inp);
1235                                 continue;
1236                         }
1237                         break;
1238                 }
1239 #endif
1240 #ifdef INET6
1241                 case AF_INET6:
1242                 {
1243                         struct sockaddr_in6 *sin6;
1244
1245                         sin6 = (struct sockaddr_in6 *)to;
1246                         if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
1247                                              &sin6->sin6_addr) != 0) {
1248                                 SCTP_INP_RUNLOCK(inp);
1249                                 continue;
1250                         }
1251                         break;
1252                 }
1253 #endif
1254                 default:
1255                         SCTP_INP_RUNLOCK(inp);
1256                         continue;
1257                 }
1258 #endif
1259 #ifdef SCTP_MVRF
1260                 fnd = 0;
1261                 for (i = 0; i < inp->num_vrfs; i++) {
1262                         if (inp->m_vrf_ids[i] == vrf_id) {
1263                                 fnd = 1;
1264                                 break;
1265                         }
1266                 }
1267                 if (fnd == 0) {
1268                         SCTP_INP_RUNLOCK(inp);
1269                         continue;
1270                 }
1271 #else
1272                 if (inp->def_vrf_id != vrf_id) {
1273                         SCTP_INP_RUNLOCK(inp);
1274                         continue;
1275                 }
1276 #endif
1277                 /* check to see if the ep has one of the addresses */
1278                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
1279                         /* We are NOT bound all, so look further */
1280                         int match = 0;
1281
1282                         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
1283
1284                                 if (laddr->ifa == NULL) {
1285                                         SCTPDBG(SCTP_DEBUG_PCB1, "%s: NULL ifa\n", __FUNCTION__);
1286                                         continue;
1287                                 }
1288                                 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) {
1289                                         SCTPDBG(SCTP_DEBUG_PCB1, "ifa being deleted\n");
1290                                         continue;
1291                                 }
1292                                 if (laddr->ifa->address.sa.sa_family ==
1293                                     to->sa_family) {
1294                                         /* see if it matches */
1295 #ifdef INET
1296                                         if (from->sa_family == AF_INET) {
1297                                                 struct sockaddr_in *intf_addr, *sin;
1298
1299                                                 intf_addr = &laddr->ifa->address.sin;
1300                                                 sin = (struct sockaddr_in *)to;
1301                                                 if (sin->sin_addr.s_addr ==
1302                                                     intf_addr->sin_addr.s_addr) {
1303                                                         match = 1;
1304                                                         break;
1305                                                 }
1306                                         }
1307 #endif
1308 #ifdef INET6
1309                                         if (from->sa_family == AF_INET6) {
1310                                                 struct sockaddr_in6 *intf_addr6;
1311                                                 struct sockaddr_in6 *sin6;
1312
1313                                                 sin6 = (struct sockaddr_in6 *)
1314                                                     to;
1315                                                 intf_addr6 = &laddr->ifa->address.sin6;
1316
1317                                                 if (SCTP6_ARE_ADDR_EQUAL(sin6,
1318                                                     intf_addr6)) {
1319                                                         match = 1;
1320                                                         break;
1321                                                 }
1322                                         }
1323 #endif
1324 #if defined(__Userspace__)
1325                                         if (from->sa_family == AF_CONN) {
1326                                                 struct sockaddr_conn *intf_addr, *sconn;
1327
1328                                                 intf_addr = &laddr->ifa->address.sconn;
1329                                                 sconn = (struct sockaddr_conn *)to;
1330                                                 if (sconn->sconn_addr ==
1331                                                     intf_addr->sconn_addr) {
1332                                                         match = 1;
1333                                                         break;
1334                                                 }
1335                                         }
1336 #endif
1337                                 }
1338                         }
1339                         if (match == 0) {
1340                                 /* This endpoint does not have this address */
1341                                 SCTP_INP_RUNLOCK(inp);
1342                                 continue;
1343                         }
1344                 }
1345                 /*
1346                  * Ok if we hit here the ep has the address, does it hold
1347                  * the tcb?
1348                  */
1349                 /* XXX: Why don't we TAILQ_FOREACH through sctp_asoc_list? */
1350                 stcb = LIST_FIRST(&inp->sctp_asoc_list);
1351                 if (stcb == NULL) {
1352                         SCTP_INP_RUNLOCK(inp);
1353                         continue;
1354                 }
1355                 SCTP_TCB_LOCK(stcb);
1356                 if (!sctp_does_stcb_own_this_addr(stcb, to)) {
1357                         SCTP_TCB_UNLOCK(stcb);
1358                         SCTP_INP_RUNLOCK(inp);
1359                         continue;
1360                 }
1361                 if (stcb->rport != rport) {
1362                         /* remote port does not match. */
1363                         SCTP_TCB_UNLOCK(stcb);
1364                         SCTP_INP_RUNLOCK(inp);
1365                         continue;
1366                 }
1367                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
1368                         SCTP_TCB_UNLOCK(stcb);
1369                         SCTP_INP_RUNLOCK(inp);
1370                         continue;
1371                 }
1372                 if (!sctp_does_stcb_own_this_addr(stcb, to)) {
1373                         SCTP_TCB_UNLOCK(stcb);
1374                         SCTP_INP_RUNLOCK(inp);
1375                         continue;
1376                 }
1377                 /* Does this TCB have a matching address? */
1378                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1379
1380                         if (net->ro._l_addr.sa.sa_family != from->sa_family) {
1381                                 /* not the same family, can't be a match */
1382                                 continue;
1383                         }
1384                         switch (from->sa_family) {
1385 #ifdef INET
1386                         case AF_INET:
1387                         {
1388                                 struct sockaddr_in *sin, *rsin;
1389
1390                                 sin = (struct sockaddr_in *)&net->ro._l_addr;
1391                                 rsin = (struct sockaddr_in *)from;
1392                                 if (sin->sin_addr.s_addr ==
1393                                     rsin->sin_addr.s_addr) {
1394                                         /* found it */
1395                                         if (netp != NULL) {
1396                                                 *netp = net;
1397                                         }
1398                                         /* Update the endpoint pointer */
1399                                         *inp_p = inp;
1400                                         SCTP_INP_RUNLOCK(inp);
1401                                         return (stcb);
1402                                 }
1403                                 break;
1404                         }
1405 #endif
1406 #ifdef INET6
1407                         case AF_INET6:
1408                         {
1409                                 struct sockaddr_in6 *sin6, *rsin6;
1410
1411                                 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1412                                 rsin6 = (struct sockaddr_in6 *)from;
1413                                 if (SCTP6_ARE_ADDR_EQUAL(sin6,
1414                                     rsin6)) {
1415                                         /* found it */
1416                                         if (netp != NULL) {
1417                                                 *netp = net;
1418                                         }
1419                                         /* Update the endpoint pointer */
1420                                         *inp_p = inp;
1421                                         SCTP_INP_RUNLOCK(inp);
1422                                         return (stcb);
1423                                 }
1424                                 break;
1425                         }
1426 #endif
1427 #if defined(__Userspace__)
1428                         case AF_CONN:
1429                         {
1430                                 struct sockaddr_conn *sconn, *rsconn;
1431
1432                                 sconn = (struct sockaddr_conn *)&net->ro._l_addr;
1433                                 rsconn = (struct sockaddr_conn *)from;
1434                                 if (sconn->sconn_addr == rsconn->sconn_addr) {
1435                                         /* found it */
1436                                         if (netp != NULL) {
1437                                                 *netp = net;
1438                                         }
1439                                         /* Update the endpoint pointer */
1440                                         *inp_p = inp;
1441                                         SCTP_INP_RUNLOCK(inp);
1442                                         return (stcb);
1443                                 }
1444                                 break;
1445                         }
1446 #endif
1447                         default:
1448                                 /* TSNH */
1449                                 break;
1450                         }
1451                 }
1452                 SCTP_TCB_UNLOCK(stcb);
1453                 SCTP_INP_RUNLOCK(inp);
1454         }
1455         return (NULL);
1456 }
1457
1458
1459 /*
1460  * rules for use
1461  *
1462  * 1) If I return a NULL you must decrement any INP ref cnt. 2) If I find an
1463  * stcb, both will be locked (locked_tcb and stcb) but decrement will be done
1464  * (if locked == NULL). 3) Decrement happens on return ONLY if locked ==
1465  * NULL.
1466  */
1467
1468 struct sctp_tcb *
1469 sctp_findassociation_ep_addr(struct sctp_inpcb **inp_p, struct sockaddr *remote,
1470     struct sctp_nets **netp, struct sockaddr *local, struct sctp_tcb *locked_tcb)
1471 {
1472         struct sctpasochead *head;
1473         struct sctp_inpcb *inp;
1474         struct sctp_tcb *stcb = NULL;
1475         struct sctp_nets *net;
1476         uint16_t rport;
1477
1478         inp = *inp_p;
1479         switch (remote->sa_family) {
1480 #ifdef INET
1481         case AF_INET:
1482                 rport = (((struct sockaddr_in *)remote)->sin_port);
1483                 break;
1484 #endif
1485 #ifdef INET6
1486         case AF_INET6:
1487                 rport = (((struct sockaddr_in6 *)remote)->sin6_port);
1488                 break;
1489 #endif
1490 #if defined(__Userspace__)
1491         case AF_CONN:
1492                 rport = (((struct sockaddr_in6 *)remote)->sin6_port);
1493                 break;
1494 #endif
1495         default:
1496                 return (NULL);
1497         }
1498         if (locked_tcb) {
1499                 /*
1500                  * UN-lock so we can do proper locking here this occurs when
1501                  * called from load_addresses_from_init.
1502                  */
1503                 atomic_add_int(&locked_tcb->asoc.refcnt, 1);
1504                 SCTP_TCB_UNLOCK(locked_tcb);
1505         }
1506         SCTP_INP_INFO_RLOCK();
1507         if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1508             (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
1509                 /*-
1510                  * Now either this guy is our listener or it's the
1511                  * connector. If it is the one that issued the connect, then
1512                  * it's only chance is to be the first TCB in the list. If
1513                  * it is the acceptor, then do the special_lookup to hash
1514                  * and find the real inp.
1515                  */
1516                 if ((inp->sctp_socket) && (inp->sctp_socket->so_qlimit)) {
1517                         /* to is peer addr, from is my addr */
1518 #ifndef SCTP_MVRF
1519                         stcb = sctp_tcb_special_locate(inp_p, remote, local,
1520                             netp, inp->def_vrf_id);
1521                         if ((stcb != NULL) && (locked_tcb == NULL)) {
1522                                 /* we have a locked tcb, lower refcount */
1523                                 SCTP_INP_DECR_REF(inp);
1524                         }
1525                         if ((locked_tcb != NULL) && (locked_tcb != stcb)) {
1526                                 SCTP_INP_RLOCK(locked_tcb->sctp_ep);
1527                                 SCTP_TCB_LOCK(locked_tcb);
1528                                 atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1529                                 SCTP_INP_RUNLOCK(locked_tcb->sctp_ep);
1530                         }
1531 #else
1532                         /*-
1533                          * MVRF is tricky, we must look in every VRF
1534                          * the endpoint has.
1535                          */
1536                         int i;
1537
1538                         for (i = 0; i < inp->num_vrfs; i++) {
1539                                 stcb = sctp_tcb_special_locate(inp_p, remote, local,
1540                                                                netp, inp->m_vrf_ids[i]);
1541                                 if ((stcb != NULL) && (locked_tcb == NULL)) {
1542                                         /* we have a locked tcb, lower refcount */
1543                                         SCTP_INP_DECR_REF(inp);
1544                                         break;
1545                                 }
1546                                 if ((locked_tcb != NULL) && (locked_tcb != stcb)) {
1547                                         SCTP_INP_RLOCK(locked_tcb->sctp_ep);
1548                                         SCTP_TCB_LOCK(locked_tcb);
1549                                         atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1550                                         SCTP_INP_RUNLOCK(locked_tcb->sctp_ep);
1551                                         break;
1552                                 }
1553                         }
1554 #endif
1555                         SCTP_INP_INFO_RUNLOCK();
1556                         return (stcb);
1557                 } else {
1558                         SCTP_INP_WLOCK(inp);
1559                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1560                                 goto null_return;
1561                         }
1562                         stcb = LIST_FIRST(&inp->sctp_asoc_list);
1563                         if (stcb == NULL) {
1564                                 goto null_return;
1565                         }
1566                         SCTP_TCB_LOCK(stcb);
1567
1568                         if (stcb->rport != rport) {
1569                                 /* remote port does not match. */
1570                                 SCTP_TCB_UNLOCK(stcb);
1571                                 goto null_return;
1572                         }
1573                         if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
1574                                 SCTP_TCB_UNLOCK(stcb);
1575                                 goto null_return;
1576                         }
1577                         if (local && !sctp_does_stcb_own_this_addr(stcb, local)) {
1578                                 SCTP_TCB_UNLOCK(stcb);
1579                                 goto null_return;
1580                         }
1581                         /* now look at the list of remote addresses */
1582                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1583 #ifdef INVARIANTS
1584                                 if (net == (TAILQ_NEXT(net, sctp_next))) {
1585                                         panic("Corrupt net list");
1586                                 }
1587 #endif
1588                                 if (net->ro._l_addr.sa.sa_family !=
1589                                     remote->sa_family) {
1590                                         /* not the same family */
1591                                         continue;
1592                                 }
1593                                 switch (remote->sa_family) {
1594 #ifdef INET
1595                                 case AF_INET:
1596                                 {
1597                                         struct sockaddr_in *sin, *rsin;
1598
1599                                         sin = (struct sockaddr_in *)
1600                                             &net->ro._l_addr;
1601                                         rsin = (struct sockaddr_in *)remote;
1602                                         if (sin->sin_addr.s_addr ==
1603                                             rsin->sin_addr.s_addr) {
1604                                                 /* found it */
1605                                                 if (netp != NULL) {
1606                                                         *netp = net;
1607                                                 }
1608                                                 if (locked_tcb == NULL) {
1609                                                         SCTP_INP_DECR_REF(inp);
1610                                                 } else if (locked_tcb != stcb) {
1611                                                         SCTP_TCB_LOCK(locked_tcb);
1612                                                 }
1613                                                 if (locked_tcb) {
1614                                                         atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1615                                                 }
1616
1617                                                 SCTP_INP_WUNLOCK(inp);
1618                                                 SCTP_INP_INFO_RUNLOCK();
1619                                                 return (stcb);
1620                                         }
1621                                         break;
1622                                 }
1623 #endif
1624 #ifdef INET6
1625                                 case AF_INET6:
1626                                 {
1627                                         struct sockaddr_in6 *sin6, *rsin6;
1628
1629                                         sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1630                                         rsin6 = (struct sockaddr_in6 *)remote;
1631                                         if (SCTP6_ARE_ADDR_EQUAL(sin6,
1632                                             rsin6)) {
1633                                                 /* found it */
1634                                                 if (netp != NULL) {
1635                                                         *netp = net;
1636                                                 }
1637                                                 if (locked_tcb == NULL) {
1638                                                         SCTP_INP_DECR_REF(inp);
1639                                                 } else if (locked_tcb != stcb) {
1640                                                         SCTP_TCB_LOCK(locked_tcb);
1641                                                 }
1642                                                 if (locked_tcb) {
1643                                                         atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1644                                                 }
1645                                                 SCTP_INP_WUNLOCK(inp);
1646                                                 SCTP_INP_INFO_RUNLOCK();
1647                                                 return (stcb);
1648                                         }
1649                                         break;
1650                                 }
1651 #endif
1652 #if defined(__Userspace__)
1653                                 case AF_CONN:
1654                                 {
1655                                         struct sockaddr_conn *sconn, *rsconn;
1656
1657                                         sconn = (struct sockaddr_conn *)&net->ro._l_addr;
1658                                         rsconn = (struct sockaddr_conn *)remote;
1659                                         if (sconn->sconn_addr == rsconn->sconn_addr) {
1660                                                 /* found it */
1661                                                 if (netp != NULL) {
1662                                                         *netp = net;
1663                                                 }
1664                                                 if (locked_tcb == NULL) {
1665                                                         SCTP_INP_DECR_REF(inp);
1666                                                 } else if (locked_tcb != stcb) {
1667                                                         SCTP_TCB_LOCK(locked_tcb);
1668                                                 }
1669                                                 if (locked_tcb) {
1670                                                         atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1671                                                 }
1672                                                 SCTP_INP_WUNLOCK(inp);
1673                                                 SCTP_INP_INFO_RUNLOCK();
1674                                                 return (stcb);
1675                                         }
1676                                         break;
1677                                 }
1678 #endif
1679                                 default:
1680                                         /* TSNH */
1681                                         break;
1682                                 }
1683                         }
1684                         SCTP_TCB_UNLOCK(stcb);
1685                 }
1686         } else {
1687                 SCTP_INP_WLOCK(inp);
1688                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1689                         goto null_return;
1690                 }
1691                 head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(rport,
1692                     inp->sctp_hashmark)];
1693                 if (head == NULL) {
1694                         goto null_return;
1695                 }
1696                 LIST_FOREACH(stcb, head, sctp_tcbhash) {
1697                         if (stcb->rport != rport) {
1698                                 /* remote port does not match */
1699                                 continue;
1700                         }
1701                         SCTP_TCB_LOCK(stcb);
1702                         if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
1703                                 SCTP_TCB_UNLOCK(stcb);
1704                                 continue;
1705                         }
1706                         if (local && !sctp_does_stcb_own_this_addr(stcb, local)) {
1707                                 SCTP_TCB_UNLOCK(stcb);
1708                                 continue;
1709                         }
1710                         /* now look at the list of remote addresses */
1711                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1712 #ifdef INVARIANTS
1713                                 if (net == (TAILQ_NEXT(net, sctp_next))) {
1714                                         panic("Corrupt net list");
1715                                 }
1716 #endif
1717                                 if (net->ro._l_addr.sa.sa_family !=
1718                                     remote->sa_family) {
1719                                         /* not the same family */
1720                                         continue;
1721                                 }
1722                                 switch (remote->sa_family) {
1723 #ifdef INET
1724                                 case AF_INET:
1725                                 {
1726                                         struct sockaddr_in *sin, *rsin;
1727
1728                                         sin = (struct sockaddr_in *)
1729                                             &net->ro._l_addr;
1730                                         rsin = (struct sockaddr_in *)remote;
1731                                         if (sin->sin_addr.s_addr ==
1732                                             rsin->sin_addr.s_addr) {
1733                                                 /* found it */
1734                                                 if (netp != NULL) {
1735                                                         *netp = net;
1736                                                 }
1737                                                 if (locked_tcb == NULL) {
1738                                                         SCTP_INP_DECR_REF(inp);
1739                                                 } else if (locked_tcb != stcb) {
1740                                                         SCTP_TCB_LOCK(locked_tcb);
1741                                                 }
1742                                                 if (locked_tcb) {
1743                                                         atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1744                                                 }
1745                                                 SCTP_INP_WUNLOCK(inp);
1746                                                 SCTP_INP_INFO_RUNLOCK();
1747                                                 return (stcb);
1748                                         }
1749                                         break;
1750                                 }
1751 #endif
1752 #ifdef INET6
1753                                 case AF_INET6:
1754                                 {
1755                                         struct sockaddr_in6 *sin6, *rsin6;
1756
1757                                         sin6 = (struct sockaddr_in6 *)
1758                                             &net->ro._l_addr;
1759                                         rsin6 = (struct sockaddr_in6 *)remote;
1760                                         if (SCTP6_ARE_ADDR_EQUAL(sin6,
1761                                             rsin6)) {
1762                                                 /* found it */
1763                                                 if (netp != NULL) {
1764                                                         *netp = net;
1765                                                 }
1766                                                 if (locked_tcb == NULL) {
1767                                                         SCTP_INP_DECR_REF(inp);
1768                                                 } else if (locked_tcb != stcb) {
1769                                                         SCTP_TCB_LOCK(locked_tcb);
1770                                                 }
1771                                                 if (locked_tcb) {
1772                                                         atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1773                                                 }
1774                                                 SCTP_INP_WUNLOCK(inp);
1775                                                 SCTP_INP_INFO_RUNLOCK();
1776                                                 return (stcb);
1777                                         }
1778                                         break;
1779                                 }
1780 #endif
1781 #if defined(__Userspace__)
1782                                 case AF_CONN:
1783                                 {
1784                                         struct sockaddr_conn *sconn, *rsconn;
1785
1786                                         sconn = (struct sockaddr_conn *)&net->ro._l_addr;
1787                                         rsconn = (struct sockaddr_conn *)remote;
1788                                         if (sconn->sconn_addr == rsconn->sconn_addr) {
1789                                                 /* found it */
1790                                                 if (netp != NULL) {
1791                                                         *netp = net;
1792                                                 }
1793                                                 if (locked_tcb == NULL) {
1794                                                         SCTP_INP_DECR_REF(inp);
1795                                                 } else if (locked_tcb != stcb) {
1796                                                         SCTP_TCB_LOCK(locked_tcb);
1797                                                 }
1798                                                 if (locked_tcb) {
1799                                                         atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1800                                                 }
1801                                                 SCTP_INP_WUNLOCK(inp);
1802                                                 SCTP_INP_INFO_RUNLOCK();
1803                                                 return (stcb);
1804                                         }
1805                                         break;
1806                                 }
1807 #endif
1808                                 default:
1809                                         /* TSNH */
1810                                         break;
1811                                 }
1812                         }
1813                         SCTP_TCB_UNLOCK(stcb);
1814                 }
1815         }
1816 null_return:
1817         /* clean up for returning null */
1818         if (locked_tcb) {
1819                 SCTP_TCB_LOCK(locked_tcb);
1820                 atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1821         }
1822         SCTP_INP_WUNLOCK(inp);
1823         SCTP_INP_INFO_RUNLOCK();
1824         /* not found */
1825         return (NULL);
1826 }
1827
1828
1829 /*
1830  * Find an association for a specific endpoint using the association id given
1831  * out in the COMM_UP notification
1832  */
1833 struct sctp_tcb *
1834 sctp_findasoc_ep_asocid_locked(struct sctp_inpcb *inp, sctp_assoc_t asoc_id, int want_lock)
1835 {
1836         /*
1837          * Use my the assoc_id to find a endpoint
1838          */
1839         struct sctpasochead *head;
1840         struct sctp_tcb *stcb;
1841         uint32_t id;
1842
1843         if (inp == NULL) {
1844                 SCTP_PRINTF("TSNH ep_associd\n");
1845                 return (NULL);
1846         }
1847         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1848                 SCTP_PRINTF("TSNH ep_associd0\n");
1849                 return (NULL);
1850         }
1851         id = (uint32_t)asoc_id;
1852         head = &inp->sctp_asocidhash[SCTP_PCBHASH_ASOC(id, inp->hashasocidmark)];
1853         if (head == NULL) {
1854                 /* invalid id TSNH */
1855                 SCTP_PRINTF("TSNH ep_associd1\n");
1856                 return (NULL);
1857         }
1858         LIST_FOREACH(stcb, head, sctp_tcbasocidhash) {
1859                 if (stcb->asoc.assoc_id == id) {
1860                         if (inp != stcb->sctp_ep) {
1861                                 /*
1862                                  * some other guy has the same id active (id
1863                                  * collision ??).
1864                                  */
1865                                 SCTP_PRINTF("TSNH ep_associd2\n");
1866                                 continue;
1867                         }
1868                         if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
1869                                 continue;
1870                         }
1871                         if (want_lock) {
1872                                 SCTP_TCB_LOCK(stcb);
1873                         }
1874                         return (stcb);
1875                 }
1876         }
1877         return (NULL);
1878 }
1879
1880
1881 struct sctp_tcb *
1882 sctp_findassociation_ep_asocid(struct sctp_inpcb *inp, sctp_assoc_t asoc_id, int want_lock)
1883 {
1884         struct sctp_tcb *stcb;
1885
1886         SCTP_INP_RLOCK(inp);
1887         stcb = sctp_findasoc_ep_asocid_locked(inp, asoc_id, want_lock);
1888         SCTP_INP_RUNLOCK(inp);
1889         return (stcb);
1890 }
1891
1892
1893 /*
1894  * Endpoint probe expects that the INP_INFO is locked.
1895  */
1896 static struct sctp_inpcb *
1897 sctp_endpoint_probe(struct sockaddr *nam, struct sctppcbhead *head,
1898                     uint16_t lport, uint32_t vrf_id)
1899 {
1900         struct sctp_inpcb *inp;
1901         struct sctp_laddr *laddr;
1902 #ifdef INET
1903         struct sockaddr_in *sin;
1904 #endif
1905 #ifdef INET6
1906         struct sockaddr_in6 *sin6;
1907         struct sockaddr_in6 *intf_addr6;
1908 #endif
1909 #if defined(__Userspace__)
1910         struct sockaddr_conn *sconn;
1911 #endif
1912 #ifdef SCTP_MVRF
1913         int i;
1914 #endif
1915         int  fnd;
1916
1917 #ifdef INET
1918         sin = NULL;
1919 #endif
1920 #ifdef INET6
1921         sin6 = NULL;
1922 #endif
1923 #if defined(__Userspace__)
1924         sconn = NULL;
1925 #endif
1926         switch (nam->sa_family) {
1927 #ifdef INET
1928         case AF_INET:
1929                 sin = (struct sockaddr_in *)nam;
1930                 break;
1931 #endif
1932 #ifdef INET6
1933         case AF_INET6:
1934                 sin6 = (struct sockaddr_in6 *)nam;
1935                 break;
1936 #endif
1937 #if defined(__Userspace__)
1938         case AF_CONN:
1939                 sconn = (struct sockaddr_conn *)nam;
1940                 break;
1941 #endif
1942         default:
1943                 /* unsupported family */
1944                 return (NULL);
1945         }
1946
1947         if (head == NULL)
1948                 return (NULL);
1949
1950         LIST_FOREACH(inp, head, sctp_hash) {
1951                 SCTP_INP_RLOCK(inp);
1952                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1953                         SCTP_INP_RUNLOCK(inp);
1954                         continue;
1955                 }
1956                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) &&
1957                     (inp->sctp_lport == lport)) {
1958                         /* got it */
1959                         switch (nam->sa_family) {
1960 #ifdef INET
1961                         case AF_INET:
1962                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1963                                     SCTP_IPV6_V6ONLY(inp)) {
1964                                         /* IPv4 on a IPv6 socket with ONLY IPv6 set */
1965                                         SCTP_INP_RUNLOCK(inp);
1966                                         continue;
1967                                 }
1968 #if defined(__FreeBSD__)
1969                                 if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
1970                                                      &sin->sin_addr) != 0) {
1971                                         SCTP_INP_RUNLOCK(inp);
1972                                         continue;
1973                                 }
1974 #endif
1975                                 break;
1976 #endif
1977 #ifdef INET6
1978                         case AF_INET6:
1979                                 /* A V6 address and the endpoint is NOT bound V6 */
1980                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
1981                                         SCTP_INP_RUNLOCK(inp);
1982                                         continue;
1983                                 }
1984 #if defined(__FreeBSD__)
1985                                 if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
1986                                                      &sin6->sin6_addr) != 0) {
1987                                         SCTP_INP_RUNLOCK(inp);
1988                                         continue;
1989                                 }
1990 #endif
1991                                 break;
1992 #endif
1993                         default:
1994                                 break;
1995                         }
1996                         /* does a VRF id match? */
1997                         fnd = 0;
1998 #ifdef SCTP_MVRF
1999                         for (i = 0; i < inp->num_vrfs; i++) {
2000                                 if (inp->m_vrf_ids[i] == vrf_id) {
2001                                         fnd = 1;
2002                                         break;
2003                                 }
2004                         }
2005 #else
2006                         if (inp->def_vrf_id == vrf_id)
2007                                 fnd = 1;
2008 #endif
2009
2010                         SCTP_INP_RUNLOCK(inp);
2011                         if (!fnd)
2012                                 continue;
2013                         return (inp);
2014                 }
2015                 SCTP_INP_RUNLOCK(inp);
2016         }
2017         switch (nam->sa_family) {
2018 #ifdef INET
2019         case AF_INET:
2020                 if (sin->sin_addr.s_addr == INADDR_ANY) {
2021                         /* Can't hunt for one that has no address specified */
2022                         return (NULL);
2023                 }
2024                 break;
2025 #endif
2026 #ifdef INET6
2027         case AF_INET6:
2028                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2029                         /* Can't hunt for one that has no address specified */
2030                         return (NULL);
2031                 }
2032                 break;
2033 #endif
2034 #if defined(__Userspace__)
2035         case AF_CONN:
2036                 if (sconn->sconn_addr == NULL) {
2037                         return (NULL);
2038                 }
2039                 break;
2040 #endif
2041         default:
2042                 break;
2043         }
2044         /*
2045          * ok, not bound to all so see if we can find a EP bound to this
2046          * address.
2047          */
2048         LIST_FOREACH(inp, head, sctp_hash) {
2049                 SCTP_INP_RLOCK(inp);
2050                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
2051                         SCTP_INP_RUNLOCK(inp);
2052                         continue;
2053                 }
2054                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)) {
2055                         SCTP_INP_RUNLOCK(inp);
2056                         continue;
2057                 }
2058                 /*
2059                  * Ok this could be a likely candidate, look at all of its
2060                  * addresses
2061                  */
2062                 if (inp->sctp_lport != lport) {
2063                         SCTP_INP_RUNLOCK(inp);
2064                         continue;
2065                 }
2066                 /* does a VRF id match? */
2067                 fnd = 0;
2068 #ifdef SCTP_MVRF
2069                 for (i = 0; i < inp->num_vrfs; i++) {
2070                         if (inp->m_vrf_ids[i] == vrf_id) {
2071                                 fnd = 1;
2072                                 break;
2073                         }
2074                 }
2075 #else
2076                 if (inp->def_vrf_id == vrf_id)
2077                         fnd = 1;
2078
2079 #endif
2080                 if (!fnd) {
2081                         SCTP_INP_RUNLOCK(inp);
2082                         continue;
2083                 }
2084                 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
2085                         if (laddr->ifa == NULL) {
2086                                 SCTPDBG(SCTP_DEBUG_PCB1, "%s: NULL ifa\n",
2087                                         __FUNCTION__);
2088                                 continue;
2089                         }
2090                         SCTPDBG(SCTP_DEBUG_PCB1, "Ok laddr->ifa:%p is possible, ",
2091                                 (void *)laddr->ifa);
2092                         if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) {
2093                                 SCTPDBG(SCTP_DEBUG_PCB1, "Huh IFA being deleted\n");
2094                                 continue;
2095                         }
2096                         if (laddr->ifa->address.sa.sa_family == nam->sa_family) {
2097                                 /* possible, see if it matches */
2098                                 switch (nam->sa_family) {
2099 #ifdef INET
2100                                 case AF_INET:
2101 #if defined(__APPLE__)
2102                                         if (sin == NULL) {
2103                                                 /* TSNH */
2104                                                 break;
2105                                         }
2106 #endif
2107                                         if (sin->sin_addr.s_addr ==
2108                                             laddr->ifa->address.sin.sin_addr.s_addr) {
2109                                                 SCTP_INP_RUNLOCK(inp);
2110                                                 return (inp);
2111                                         }
2112                                         break;
2113 #endif
2114 #ifdef INET6
2115                                 case AF_INET6:
2116                                         intf_addr6 = &laddr->ifa->address.sin6;
2117                                         if (SCTP6_ARE_ADDR_EQUAL(sin6,
2118                                             intf_addr6)) {
2119                                                 SCTP_INP_RUNLOCK(inp);
2120                                                 return (inp);
2121                                         }
2122                                         break;
2123 #endif
2124 #if defined(__Userspace__)
2125                                 case AF_CONN:
2126                                         if (sconn->sconn_addr == laddr->ifa->address.sconn.sconn_addr) {
2127                                                 SCTP_INP_RUNLOCK(inp);
2128                                                 return (inp);
2129                                         }
2130                                         break;
2131 #endif
2132                                 }
2133                         }
2134                 }
2135                 SCTP_INP_RUNLOCK(inp);
2136         }
2137         return (NULL);
2138 }
2139
2140
2141 static struct sctp_inpcb *
2142 sctp_isport_inuse(struct sctp_inpcb *inp, uint16_t lport, uint32_t vrf_id)
2143 {
2144         struct sctppcbhead *head;
2145         struct sctp_inpcb *t_inp;
2146 #ifdef SCTP_MVRF
2147         int i;
2148 #endif
2149         int fnd;
2150
2151         head = &SCTP_BASE_INFO(sctp_ephash)[SCTP_PCBHASH_ALLADDR(lport,
2152             SCTP_BASE_INFO(hashmark))];
2153         LIST_FOREACH(t_inp, head, sctp_hash) {
2154                 if (t_inp->sctp_lport != lport) {
2155                         continue;
2156                 }
2157                 /* is it in the VRF in question */
2158                 fnd = 0;
2159 #ifdef SCTP_MVRF
2160                 for (i = 0; i < inp->num_vrfs; i++) {
2161                         if (t_inp->m_vrf_ids[i] == vrf_id) {
2162                                 fnd = 1;
2163                                 break;
2164                         }
2165                 }
2166 #else
2167                 if (t_inp->def_vrf_id == vrf_id)
2168                         fnd = 1;
2169 #endif
2170                 if (!fnd)
2171                         continue;
2172
2173                 /* This one is in use. */
2174                 /* check the v6/v4 binding issue */
2175                 if ((t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2176                     SCTP_IPV6_V6ONLY(t_inp)) {
2177                         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2178                                 /* collision in V6 space */
2179                                 return (t_inp);
2180                         } else {
2181                                 /* inp is BOUND_V4 no conflict */
2182                                 continue;
2183                         }
2184                 } else if (t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2185                         /* t_inp is bound v4 and v6, conflict always */
2186                         return (t_inp);
2187                 } else {
2188                         /* t_inp is bound only V4 */
2189                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2190                             SCTP_IPV6_V6ONLY(inp)) {
2191                                 /* no conflict */
2192                                 continue;
2193                         }
2194                         /* else fall through to conflict */
2195                 }
2196                 return (t_inp);
2197         }
2198         return (NULL);
2199 }
2200
2201
2202 int
2203 sctp_swap_inpcb_for_listen(struct sctp_inpcb *inp)
2204 {
2205         /* For 1-2-1 with port reuse */
2206         struct sctppcbhead *head;
2207         struct sctp_inpcb *tinp;
2208
2209         if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_PORTREUSE)) {
2210                 /* only works with port reuse on */
2211                 return (-1);
2212         }
2213         if ((inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) {
2214                 return (0);
2215         }
2216         SCTP_INP_RUNLOCK(inp);
2217         head = &SCTP_BASE_INFO(sctp_ephash)[SCTP_PCBHASH_ALLADDR(inp->sctp_lport,
2218                                             SCTP_BASE_INFO(hashmark))];
2219         /* Kick out all non-listeners to the TCP hash */
2220         LIST_FOREACH(tinp, head, sctp_hash) {
2221                 if (tinp->sctp_lport != inp->sctp_lport) {
2222                         continue;
2223                 }
2224                 if (tinp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
2225                         continue;
2226                 }
2227                 if (tinp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
2228                         continue;
2229                 }
2230                 if (tinp->sctp_socket->so_qlimit) {
2231                         continue;
2232                 }
2233                 SCTP_INP_WLOCK(tinp);
2234                 LIST_REMOVE(tinp, sctp_hash);
2235                 head = &SCTP_BASE_INFO(sctp_tcpephash)[SCTP_PCBHASH_ALLADDR(tinp->sctp_lport, SCTP_BASE_INFO(hashtcpmark))];
2236                 tinp->sctp_flags |= SCTP_PCB_FLAGS_IN_TCPPOOL;
2237                 LIST_INSERT_HEAD(head, tinp, sctp_hash);
2238                 SCTP_INP_WUNLOCK(tinp);
2239         }
2240         SCTP_INP_WLOCK(inp);
2241         /* Pull from where he was */
2242         LIST_REMOVE(inp, sctp_hash);
2243         inp->sctp_flags &= ~SCTP_PCB_FLAGS_IN_TCPPOOL;
2244         head = &SCTP_BASE_INFO(sctp_ephash)[SCTP_PCBHASH_ALLADDR(inp->sctp_lport, SCTP_BASE_INFO(hashmark))];
2245         LIST_INSERT_HEAD(head, inp, sctp_hash);
2246         SCTP_INP_WUNLOCK(inp);
2247         SCTP_INP_RLOCK(inp);
2248         return (0);
2249 }
2250
2251
2252 struct sctp_inpcb *
2253 sctp_pcb_findep(struct sockaddr *nam, int find_tcp_pool, int have_lock,
2254                 uint32_t vrf_id)
2255 {
2256         /*
2257          * First we check the hash table to see if someone has this port
2258          * bound with just the port.
2259          */
2260         struct sctp_inpcb *inp;
2261         struct sctppcbhead *head;
2262         int lport;
2263         unsigned int i;
2264 #ifdef INET
2265         struct sockaddr_in *sin;
2266 #endif
2267 #ifdef INET6
2268         struct sockaddr_in6 *sin6;
2269 #endif
2270 #if defined(__Userspace__)
2271         struct sockaddr_conn *sconn;
2272 #endif
2273
2274         switch (nam->sa_family) {
2275 #ifdef INET
2276         case AF_INET:
2277                 sin = (struct sockaddr_in *)nam;
2278                 lport = sin->sin_port;
2279                 break;
2280 #endif
2281 #ifdef INET6
2282         case AF_INET6:
2283                 sin6 = (struct sockaddr_in6 *)nam;
2284                 lport = sin6->sin6_port;
2285                 break;
2286 #endif
2287 #if defined(__Userspace__)
2288         case AF_CONN:
2289                 sconn = (struct sockaddr_conn *)nam;
2290                 lport = sconn->sconn_port;
2291                 break;
2292 #endif
2293         default:
2294                 return (NULL);
2295         }
2296         /*
2297          * I could cheat here and just cast to one of the types but we will
2298          * do it right. It also provides the check against an Unsupported
2299          * type too.
2300          */
2301         /* Find the head of the ALLADDR chain */
2302         if (have_lock == 0) {
2303                 SCTP_INP_INFO_RLOCK();
2304         }
2305         head = &SCTP_BASE_INFO(sctp_ephash)[SCTP_PCBHASH_ALLADDR(lport,
2306             SCTP_BASE_INFO(hashmark))];
2307         inp = sctp_endpoint_probe(nam, head, lport, vrf_id);
2308
2309         /*
2310          * If the TCP model exists it could be that the main listening
2311          * endpoint is gone but there still exists a connected socket for this
2312          * guy. If so we can return the first one that we find. This may NOT
2313          * be the correct one so the caller should be wary on the returned INP.
2314          * Currently the only caller that sets find_tcp_pool is in bindx where
2315          * we are verifying that a user CAN bind the address. He either
2316          * has bound it already, or someone else has, or its open to bind,
2317          * so this is good enough.
2318          */
2319         if (inp == NULL && find_tcp_pool) {
2320                 for (i = 0; i < SCTP_BASE_INFO(hashtcpmark) + 1; i++) {
2321                         head = &SCTP_BASE_INFO(sctp_tcpephash)[i];
2322                         inp = sctp_endpoint_probe(nam, head, lport, vrf_id);
2323                         if (inp) {
2324                                 break;
2325                         }
2326                 }
2327         }
2328         if (inp) {
2329                 SCTP_INP_INCR_REF(inp);
2330         }
2331         if (have_lock == 0) {
2332                 SCTP_INP_INFO_RUNLOCK();
2333         }
2334         return (inp);
2335 }
2336
2337
2338 /*
2339  * Find an association for an endpoint with the pointer to whom you want to
2340  * send to and the endpoint pointer. The address can be IPv4 or IPv6. We may
2341  * need to change the *to to some other struct like a mbuf...
2342  */
2343 struct sctp_tcb *
2344 sctp_findassociation_addr_sa(struct sockaddr *from, struct sockaddr *to,
2345     struct sctp_inpcb **inp_p, struct sctp_nets **netp, int find_tcp_pool,
2346     uint32_t vrf_id)
2347 {
2348         struct sctp_inpcb *inp = NULL;
2349         struct sctp_tcb *stcb;
2350
2351         SCTP_INP_INFO_RLOCK();
2352         if (find_tcp_pool) {
2353                 if (inp_p != NULL) {
2354                         stcb = sctp_tcb_special_locate(inp_p, from, to, netp,
2355                                                        vrf_id);
2356                 } else {
2357                         stcb = sctp_tcb_special_locate(&inp, from, to, netp,
2358                                                        vrf_id);
2359                 }
2360                 if (stcb != NULL) {
2361                         SCTP_INP_INFO_RUNLOCK();
2362                         return (stcb);
2363                 }
2364         }
2365         inp = sctp_pcb_findep(to, 0, 1, vrf_id);
2366         if (inp_p != NULL) {
2367                 *inp_p = inp;
2368         }
2369         SCTP_INP_INFO_RUNLOCK();
2370         if (inp == NULL) {
2371                 return (NULL);
2372         }
2373         /*
2374          * ok, we have an endpoint, now lets find the assoc for it (if any)
2375          * we now place the source address or from in the to of the find
2376          * endpoint call. Since in reality this chain is used from the
2377          * inbound packet side.
2378          */
2379         if (inp_p != NULL) {
2380                 stcb = sctp_findassociation_ep_addr(inp_p, from, netp, to,
2381                                                     NULL);
2382         } else {
2383                 stcb = sctp_findassociation_ep_addr(&inp, from, netp, to,
2384                                                     NULL);
2385         }
2386         return (stcb);
2387 }
2388
2389
2390 /*
2391  * This routine will grub through the mbuf that is a INIT or INIT-ACK and
2392  * find all addresses that the sender has specified in any address list. Each
2393  * address will be used to lookup the TCB and see if one exits.
2394  */
2395 static struct sctp_tcb *
2396 sctp_findassociation_special_addr(struct mbuf *m, int offset,
2397     struct sctphdr *sh, struct sctp_inpcb **inp_p, struct sctp_nets **netp,
2398     struct sockaddr *dst)
2399 {
2400         struct sctp_paramhdr *phdr, parm_buf;
2401 #if defined(INET) || defined(INET6)
2402         struct sctp_tcb *stcb;
2403         uint16_t ptype;
2404 #endif
2405         uint16_t plen;
2406 #ifdef INET
2407         struct sockaddr_in sin4;
2408 #endif
2409 #ifdef INET6
2410         struct sockaddr_in6 sin6;
2411 #endif
2412
2413 #ifdef INET
2414         memset(&sin4, 0, sizeof(sin4));
2415 #ifdef HAVE_SIN_LEN
2416         sin4.sin_len = sizeof(sin4);
2417 #endif
2418         sin4.sin_family = AF_INET;
2419         sin4.sin_port = sh->src_port;
2420 #endif
2421 #ifdef INET6
2422         memset(&sin6, 0, sizeof(sin6));
2423 #ifdef HAVE_SIN6_LEN
2424         sin6.sin6_len = sizeof(sin6);
2425 #endif
2426         sin6.sin6_family = AF_INET6;
2427         sin6.sin6_port = sh->src_port;
2428 #endif
2429
2430         offset += sizeof(struct sctp_init_chunk);
2431
2432         phdr = sctp_get_next_param(m, offset, &parm_buf, sizeof(parm_buf));
2433         while (phdr != NULL) {
2434                 /* now we must see if we want the parameter */
2435 #if defined(INET) || defined(INET6)
2436                 ptype = ntohs(phdr->param_type);
2437 #endif
2438                 plen = ntohs(phdr->param_length);
2439                 if (plen == 0) {
2440                         break;
2441                 }
2442 #ifdef INET
2443                 if (ptype == SCTP_IPV4_ADDRESS &&
2444                     plen == sizeof(struct sctp_ipv4addr_param)) {
2445                         /* Get the rest of the address */
2446                         struct sctp_ipv4addr_param ip4_parm, *p4;
2447
2448                         phdr = sctp_get_next_param(m, offset,
2449                             (struct sctp_paramhdr *)&ip4_parm, min(plen, sizeof(ip4_parm)));
2450                         if (phdr == NULL) {
2451                                 return (NULL);
2452                         }
2453                         p4 = (struct sctp_ipv4addr_param *)phdr;
2454                         memcpy(&sin4.sin_addr, &p4->addr, sizeof(p4->addr));
2455                         /* look it up */
2456                         stcb = sctp_findassociation_ep_addr(inp_p,
2457                             (struct sockaddr *)&sin4, netp, dst, NULL);
2458                         if (stcb != NULL) {
2459                                 return (stcb);
2460                         }
2461                 }
2462 #endif
2463 #ifdef INET6
2464                 if (ptype == SCTP_IPV6_ADDRESS &&
2465                     plen == sizeof(struct sctp_ipv6addr_param)) {
2466                         /* Get the rest of the address */
2467                         struct sctp_ipv6addr_param ip6_parm, *p6;
2468
2469                         phdr = sctp_get_next_param(m, offset,
2470                             (struct sctp_paramhdr *)&ip6_parm, min(plen,sizeof(ip6_parm)));
2471                         if (phdr == NULL) {
2472                                 return (NULL);
2473                         }
2474                         p6 = (struct sctp_ipv6addr_param *)phdr;
2475                         memcpy(&sin6.sin6_addr, &p6->addr, sizeof(p6->addr));
2476                         /* look it up */
2477                         stcb = sctp_findassociation_ep_addr(inp_p,
2478                             (struct sockaddr *)&sin6, netp, dst, NULL);
2479                         if (stcb != NULL) {
2480                                 return (stcb);
2481                         }
2482                 }
2483 #endif
2484                 offset += SCTP_SIZE32(plen);
2485                 phdr = sctp_get_next_param(m, offset, &parm_buf,
2486                                            sizeof(parm_buf));
2487         }
2488         return (NULL);
2489 }
2490
2491 static struct sctp_tcb *
2492 sctp_findassoc_by_vtag(struct sockaddr *from, struct sockaddr *to, uint32_t vtag,
2493                        struct sctp_inpcb **inp_p, struct sctp_nets **netp, uint16_t rport,
2494                        uint16_t lport, int skip_src_check, uint32_t vrf_id, uint32_t remote_tag)
2495 {
2496         /*
2497          * Use my vtag to hash. If we find it we then verify the source addr
2498          * is in the assoc. If all goes well we save a bit on rec of a
2499          * packet.
2500          */
2501         struct sctpasochead *head;
2502         struct sctp_nets *net;
2503         struct sctp_tcb *stcb;
2504 #ifdef SCTP_MVRF
2505         unsigned int i;
2506 #endif
2507
2508         SCTP_INP_INFO_RLOCK();
2509         head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(vtag,
2510             SCTP_BASE_INFO(hashasocmark))];
2511         if (head == NULL) {
2512                 /* invalid vtag */
2513                 SCTP_INP_INFO_RUNLOCK();
2514                 return (NULL);
2515         }
2516         LIST_FOREACH(stcb, head, sctp_asocs) {
2517                 SCTP_INP_RLOCK(stcb->sctp_ep);
2518                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
2519                         SCTP_INP_RUNLOCK(stcb->sctp_ep);
2520                         continue;
2521                 }
2522 #ifdef SCTP_MVRF
2523                 for (i = 0; i < stcb->sctp_ep->num_vrfs; i++) {
2524                         if (stcb->sctp_ep->m_vrf_ids[i] == vrf_id) {
2525                                 break;
2526                         }
2527                 }
2528                 if (i == stcb->sctp_ep->num_vrfs) {
2529                         SCTP_INP_RUNLOCK(inp);
2530                         continue;
2531                 }
2532 #else
2533                 if (stcb->sctp_ep->def_vrf_id != vrf_id) {
2534                         SCTP_INP_RUNLOCK(stcb->sctp_ep);
2535                         continue;
2536                 }
2537 #endif
2538                 SCTP_TCB_LOCK(stcb);
2539                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
2540                 if (stcb->asoc.my_vtag == vtag) {
2541                         /* candidate */
2542                         if (stcb->rport != rport) {
2543                                 SCTP_TCB_UNLOCK(stcb);
2544                                 continue;
2545                         }
2546                         if (stcb->sctp_ep->sctp_lport != lport) {
2547                                 SCTP_TCB_UNLOCK(stcb);
2548                                 continue;
2549                         }
2550                         if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
2551                                 SCTP_TCB_UNLOCK(stcb);
2552                                 continue;
2553                         }
2554                         /* RRS:Need toaddr check here */
2555                         if (sctp_does_stcb_own_this_addr(stcb, to) == 0) {
2556                                 /* Endpoint does not own this address */
2557                                 SCTP_TCB_UNLOCK(stcb);
2558                                 continue;
2559                         }
2560                         if (remote_tag) {
2561                                 /* If we have both vtags that's all we match on */
2562                                 if (stcb->asoc.peer_vtag == remote_tag) {
2563                                         /* If both tags match we consider it conclusive
2564                                          * and check NO source/destination addresses
2565                                          */
2566                                         goto conclusive;
2567                                 }
2568                         }
2569                         if (skip_src_check) {
2570                         conclusive:
2571                                 if (from) {
2572                                         *netp = sctp_findnet(stcb, from);
2573                                 } else {
2574                                         *netp = NULL;   /* unknown */
2575                                 }
2576                                 if (inp_p)
2577                                         *inp_p = stcb->sctp_ep;
2578                                 SCTP_INP_INFO_RUNLOCK();
2579                                 return (stcb);
2580                         }
2581                         net = sctp_findnet(stcb, from);
2582                         if (net) {
2583                                 /* yep its him. */
2584                                 *netp = net;
2585                                 SCTP_STAT_INCR(sctps_vtagexpress);
2586                                 *inp_p = stcb->sctp_ep;
2587                                 SCTP_INP_INFO_RUNLOCK();
2588                                 return (stcb);
2589                         } else {
2590                                 /*
2591                                  * not him, this should only happen in rare
2592                                  * cases so I peg it.
2593                                  */
2594                                 SCTP_STAT_INCR(sctps_vtagbogus);
2595                         }
2596                 }
2597                 SCTP_TCB_UNLOCK(stcb);
2598         }
2599         SCTP_INP_INFO_RUNLOCK();
2600         return (NULL);
2601 }
2602
2603
2604 /*
2605  * Find an association with the pointer to the inbound IP packet. This can be
2606  * a IPv4 or IPv6 packet.
2607  */
2608 struct sctp_tcb *
2609 sctp_findassociation_addr(struct mbuf *m, int offset,
2610     struct sockaddr *src, struct sockaddr *dst,
2611     struct sctphdr *sh, struct sctp_chunkhdr *ch,
2612     struct sctp_inpcb **inp_p, struct sctp_nets **netp, uint32_t vrf_id)
2613 {
2614         int find_tcp_pool;
2615         struct sctp_tcb *stcb;
2616         struct sctp_inpcb *inp;
2617
2618         if (sh->v_tag) {
2619                 /* we only go down this path if vtag is non-zero */
2620                 stcb = sctp_findassoc_by_vtag(src, dst, ntohl(sh->v_tag),
2621                                               inp_p, netp, sh->src_port, sh->dest_port, 0, vrf_id, 0);
2622                 if (stcb) {
2623                         return (stcb);
2624                 }
2625         }
2626
2627         find_tcp_pool = 0;
2628         if ((ch->chunk_type != SCTP_INITIATION) &&
2629             (ch->chunk_type != SCTP_INITIATION_ACK) &&
2630             (ch->chunk_type != SCTP_COOKIE_ACK) &&
2631             (ch->chunk_type != SCTP_COOKIE_ECHO)) {
2632                 /* Other chunk types go to the tcp pool. */
2633                 find_tcp_pool = 1;
2634         }
2635         if (inp_p) {
2636                 stcb = sctp_findassociation_addr_sa(src, dst, inp_p, netp,
2637                                                     find_tcp_pool, vrf_id);
2638                 inp = *inp_p;
2639         } else {
2640                 stcb = sctp_findassociation_addr_sa(src, dst, &inp, netp,
2641                                                     find_tcp_pool, vrf_id);
2642         }
2643         SCTPDBG(SCTP_DEBUG_PCB1, "stcb:%p inp:%p\n", (void *)stcb, (void *)inp);
2644         if (stcb == NULL && inp) {
2645                 /* Found a EP but not this address */
2646                 if ((ch->chunk_type == SCTP_INITIATION) ||
2647                     (ch->chunk_type == SCTP_INITIATION_ACK)) {
2648                         /*-
2649                          * special hook, we do NOT return linp or an
2650                          * association that is linked to an existing
2651                          * association that is under the TCP pool (i.e. no
2652                          * listener exists). The endpoint finding routine
2653                          * will always find a listener before examining the
2654                          * TCP pool.
2655                          */
2656                         if (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) {
2657                                 if (inp_p) {
2658                                         *inp_p = NULL;
2659                                 }
2660                                 return (NULL);
2661                         }
2662                         stcb = sctp_findassociation_special_addr(m,
2663                             offset, sh, &inp, netp, dst);
2664                         if (inp_p != NULL) {
2665                                 *inp_p = inp;
2666                         }
2667                 }
2668         }
2669         SCTPDBG(SCTP_DEBUG_PCB1, "stcb is %p\n", (void *)stcb);
2670         return (stcb);
2671 }
2672
2673 /*
2674  * lookup an association by an ASCONF lookup address.
2675  * if the lookup address is 0.0.0.0 or ::0, use the vtag to do the lookup
2676  */
2677 struct sctp_tcb *
2678 sctp_findassociation_ep_asconf(struct mbuf *m, int offset,
2679                                struct sockaddr *dst, struct sctphdr *sh,
2680                                struct sctp_inpcb **inp_p, struct sctp_nets **netp, uint32_t vrf_id)
2681 {
2682         struct sctp_tcb *stcb;
2683         struct sockaddr_storage remote_store;
2684         struct sctp_paramhdr parm_buf, *phdr;
2685         int ptype;
2686         int zero_address = 0;
2687 #ifdef INET
2688         struct sockaddr_in *sin;
2689 #endif
2690 #ifdef INET6
2691         struct sockaddr_in6 *sin6;
2692 #endif
2693
2694         memset(&remote_store, 0, sizeof(remote_store));
2695         phdr = sctp_get_next_param(m, offset + sizeof(struct sctp_asconf_chunk),
2696                                    &parm_buf, sizeof(struct sctp_paramhdr));
2697         if (phdr == NULL) {
2698                 SCTPDBG(SCTP_DEBUG_INPUT3, "%s: failed to get asconf lookup addr\n",
2699                         __FUNCTION__);
2700                 return NULL;
2701         }
2702         ptype = (int)((uint32_t) ntohs(phdr->param_type));
2703         /* get the correlation address */
2704         switch (ptype) {
2705 #ifdef INET6
2706         case SCTP_IPV6_ADDRESS:
2707         {
2708                 /* ipv6 address param */
2709                 struct sctp_ipv6addr_param *p6, p6_buf;
2710
2711                 if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv6addr_param)) {
2712                         return NULL;
2713                 }
2714                 p6 = (struct sctp_ipv6addr_param *)sctp_get_next_param(m,
2715                                                                        offset + sizeof(struct sctp_asconf_chunk),
2716                                                                        &p6_buf.ph, sizeof(*p6));
2717                 if (p6 == NULL) {
2718                         SCTPDBG(SCTP_DEBUG_INPUT3, "%s: failed to get asconf v6 lookup addr\n",
2719                                 __FUNCTION__);
2720                         return (NULL);
2721                 }
2722                 sin6 = (struct sockaddr_in6 *)&remote_store;
2723                 sin6->sin6_family = AF_INET6;
2724 #ifdef HAVE_SIN6_LEN
2725                 sin6->sin6_len = sizeof(*sin6);
2726 #endif
2727                 sin6->sin6_port = sh->src_port;
2728                 memcpy(&sin6->sin6_addr, &p6->addr, sizeof(struct in6_addr));
2729                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
2730                         zero_address = 1;
2731                 break;
2732         }
2733 #endif
2734 #ifdef INET
2735         case SCTP_IPV4_ADDRESS:
2736         {
2737                 /* ipv4 address param */
2738                 struct sctp_ipv4addr_param *p4, p4_buf;
2739
2740                 if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv4addr_param)) {
2741                         return NULL;
2742                 }
2743                 p4 = (struct sctp_ipv4addr_param *)sctp_get_next_param(m,
2744                                                                        offset + sizeof(struct sctp_asconf_chunk),
2745                                                                        &p4_buf.ph, sizeof(*p4));
2746                 if (p4 == NULL) {
2747                         SCTPDBG(SCTP_DEBUG_INPUT3, "%s: failed to get asconf v4 lookup addr\n",
2748                                 __FUNCTION__);
2749                         return (NULL);
2750                 }
2751                 sin = (struct sockaddr_in *)&remote_store;
2752                 sin->sin_family = AF_INET;
2753 #ifdef HAVE_SIN_LEN
2754                 sin->sin_len = sizeof(*sin);
2755 #endif
2756                 sin->sin_port = sh->src_port;
2757                 memcpy(&sin->sin_addr, &p4->addr, sizeof(struct in_addr));
2758                 if (sin->sin_addr.s_addr == INADDR_ANY)
2759                         zero_address = 1;
2760                 break;
2761         }
2762 #endif
2763         default:
2764                 /* invalid address param type */
2765                 return NULL;
2766         }
2767
2768         if (zero_address) {
2769                 stcb = sctp_findassoc_by_vtag(NULL, dst, ntohl(sh->v_tag), inp_p,
2770                                               netp, sh->src_port, sh->dest_port, 1, vrf_id, 0);
2771                 if (stcb != NULL) {
2772                         SCTP_INP_DECR_REF(*inp_p);
2773                 }
2774         } else {
2775                 stcb = sctp_findassociation_ep_addr(inp_p,
2776                     (struct sockaddr *)&remote_store, netp,
2777                     dst, NULL);
2778         }
2779         return (stcb);
2780 }
2781
2782
2783 /*
2784  * allocate a sctp_inpcb and setup a temporary binding to a port/all
2785  * addresses. This way if we don't get a bind we by default pick a ephemeral
2786  * port with all addresses bound.
2787  */
2788 int
2789 sctp_inpcb_alloc(struct socket *so, uint32_t vrf_id)
2790 {
2791         /*
2792          * we get called when a new endpoint starts up. We need to allocate
2793          * the sctp_inpcb structure from the zone and init it. Mark it as
2794          * unbound and find a port that we can use as an ephemeral with
2795          * INADDR_ANY. If the user binds later no problem we can then add in
2796          * the specific addresses. And setup the default parameters for the
2797          * EP.
2798          */
2799         int i, error;
2800         struct sctp_inpcb *inp;
2801         struct sctp_pcb *m;
2802         struct timeval time;
2803         sctp_sharedkey_t *null_key;
2804
2805         error = 0;
2806
2807         SCTP_INP_INFO_WLOCK();
2808         inp = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_ep), struct sctp_inpcb);
2809         if (inp == NULL) {
2810                 SCTP_PRINTF("Out of SCTP-INPCB structures - no resources\n");
2811                 SCTP_INP_INFO_WUNLOCK();
2812                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOBUFS);
2813                 return (ENOBUFS);
2814         }
2815         /* zap it */
2816         bzero(inp, sizeof(*inp));
2817
2818         /* bump generations */
2819 #if defined(__APPLE__)
2820         inp->ip_inp.inp.inp_state = INPCB_STATE_INUSE;
2821 #endif
2822         /* setup socket pointers */
2823         inp->sctp_socket = so;
2824         inp->ip_inp.inp.inp_socket = so;
2825 #if defined(__FreeBSD__)
2826         inp->ip_inp.inp.inp_cred = crhold(so->so_cred);
2827 #endif
2828 #ifdef INET6
2829 #if !defined(__Userspace__) && !defined(__Windows__)
2830         if (INP_SOCKAF(so) == AF_INET6) {
2831                 if (MODULE_GLOBAL(ip6_auto_flowlabel)) {
2832                         inp->ip_inp.inp.inp_flags |= IN6P_AUTOFLOWLABEL;
2833                 }
2834                 if (MODULE_GLOBAL(ip6_v6only)) {
2835                         inp->ip_inp.inp.inp_flags |= IN6P_IPV6_V6ONLY;
2836                 }
2837         }
2838 #endif
2839 #endif
2840         inp->sctp_associd_counter = 1;
2841         inp->partial_delivery_point = SCTP_SB_LIMIT_RCV(so) >> SCTP_PARTIAL_DELIVERY_SHIFT;
2842         inp->sctp_frag_point = SCTP_DEFAULT_MAXSEGMENT;
2843         inp->sctp_cmt_on_off = SCTP_BASE_SYSCTL(sctp_cmt_on_off);
2844         inp->sctp_ecn_enable = SCTP_BASE_SYSCTL(sctp_ecn_enable);
2845 #if defined(__Userspace__)
2846         inp->ulp_info = NULL;
2847         inp->recv_callback = NULL;
2848         inp->send_callback = NULL;
2849         inp->send_sb_threshold = 0;
2850 #endif
2851         /* init the small hash table we use to track asocid <-> tcb */
2852         inp->sctp_asocidhash = SCTP_HASH_INIT(SCTP_STACK_VTAG_HASH_SIZE, &inp->hashasocidmark);
2853         if (inp->sctp_asocidhash == NULL) {
2854 #if defined(__FreeBSD__)
2855                 crfree(inp->ip_inp.inp.inp_cred);
2856 #endif
2857                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_ep), inp);
2858                 SCTP_INP_INFO_WUNLOCK();
2859                 return (ENOBUFS);
2860         }
2861 #ifdef IPSEC
2862 #if !(defined(__APPLE__))
2863         {
2864                 struct inpcbpolicy *pcb_sp = NULL;
2865
2866                 error = ipsec_init_policy(so, &pcb_sp);
2867                 /* Arrange to share the policy */
2868                 inp->ip_inp.inp.inp_sp = pcb_sp;
2869                 ((struct in6pcb *)(&inp->ip_inp.inp))->in6p_sp = pcb_sp;
2870         }
2871 #else
2872         /* not sure what to do for openbsd here */
2873         error = 0;
2874 #endif
2875         if (error != 0) {
2876 #if defined(__FreeBSD__)
2877                 crfree(inp->ip_inp.inp.inp_cred);
2878 #endif
2879                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_ep), inp);
2880                 SCTP_INP_INFO_WUNLOCK();
2881                 return error;
2882         }
2883 #endif                          /* IPSEC */
2884         SCTP_INCR_EP_COUNT();
2885         inp->ip_inp.inp.inp_ip_ttl = MODULE_GLOBAL(ip_defttl);
2886         SCTP_INP_INFO_WUNLOCK();
2887
2888         so->so_pcb = (caddr_t)inp;
2889
2890 #if defined(__FreeBSD__) && __FreeBSD_version < 803000
2891         if ((SCTP_SO_TYPE(so) == SOCK_DGRAM) ||
2892             (SCTP_SO_TYPE(so) == SOCK_SEQPACKET)) {
2893 #else
2894         if (SCTP_SO_TYPE(so) == SOCK_SEQPACKET) {
2895 #endif
2896                 /* UDP style socket */
2897                 inp->sctp_flags = (SCTP_PCB_FLAGS_UDPTYPE |
2898                     SCTP_PCB_FLAGS_UNBOUND);
2899                 /* Be sure it is NON-BLOCKING IO for UDP */
2900                 /* SCTP_SET_SO_NBIO(so); */
2901         } else if (SCTP_SO_TYPE(so) == SOCK_STREAM) {
2902                 /* TCP style socket */
2903                 inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
2904                     SCTP_PCB_FLAGS_UNBOUND);
2905                 /* Be sure we have blocking IO by default */
2906                 SCTP_CLEAR_SO_NBIO(so);
2907 #if defined(__Panda__)
2908         } else if (SCTP_SO_TYPE(so) == SOCK_FASTSEQPACKET) {
2909                 inp->sctp_flags = (SCTP_PCB_FLAGS_UDPTYPE |
2910                     SCTP_PCB_FLAGS_UNBOUND);
2911                 sctp_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE);
2912         } else if (SCTP_SO_TYPE(so) == SOCK_FASTSTREAM) {
2913                 inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
2914                     SCTP_PCB_FLAGS_UNBOUND);
2915                 sctp_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE);
2916 #endif
2917         } else {
2918                 /*
2919                  * unsupported socket type (RAW, etc)- in case we missed it
2920                  * in protosw
2921                  */
2922                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EOPNOTSUPP);
2923                 so->so_pcb = NULL;
2924 #if defined(__FreeBSD__)
2925                 crfree(inp->ip_inp.inp.inp_cred);
2926 #endif
2927                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_ep), inp);
2928                 return (EOPNOTSUPP);
2929         }
2930         if (SCTP_BASE_SYSCTL(sctp_default_frag_interleave) == SCTP_FRAG_LEVEL_1) {
2931                 sctp_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE);
2932                 sctp_feature_off(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS);
2933         } else if (SCTP_BASE_SYSCTL(sctp_default_frag_interleave) == SCTP_FRAG_LEVEL_2) {
2934                 sctp_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE);
2935                 sctp_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS);
2936         } else if (SCTP_BASE_SYSCTL(sctp_default_frag_interleave) == SCTP_FRAG_LEVEL_0) {
2937                 sctp_feature_off(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE);
2938                 sctp_feature_off(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS);
2939         }
2940         inp->sctp_tcbhash = SCTP_HASH_INIT(SCTP_BASE_SYSCTL(sctp_pcbtblsize),
2941                                            &inp->sctp_hashmark);
2942         if (inp->sctp_tcbhash == NULL) {
2943                 SCTP_PRINTF("Out of SCTP-INPCB->hashinit - no resources\n");
2944                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOBUFS);
2945                 so->so_pcb = NULL;
2946 #if defined(__FreeBSD__)
2947                 crfree(inp->ip_inp.inp.inp_cred);
2948 #endif
2949                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_ep), inp);
2950                 return (ENOBUFS);
2951         }
2952 #ifdef SCTP_MVRF
2953         inp->vrf_size = SCTP_DEFAULT_VRF_SIZE;
2954         SCTP_MALLOC(inp->m_vrf_ids, uint32_t *,
2955                     (sizeof(uint32_t) * inp->vrf_size), SCTP_M_MVRF);
2956         if (inp->m_vrf_ids == NULL) {
2957                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOBUFS);
2958                 so->so_pcb = NULL;
2959                 SCTP_HASH_FREE(inp->sctp_tcbhash, inp->sctp_hashmark);
2960 #if defined(__FreeBSD__)
2961                 crfree(inp->ip_inp.inp.inp_cred);
2962 #endif
2963                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_ep), inp);
2964                 return (ENOBUFS);
2965         }
2966         inp->m_vrf_ids[0] = vrf_id;
2967         inp->num_vrfs = 1;
2968 #endif
2969         inp->def_vrf_id = vrf_id;
2970
2971 #if defined(__APPLE__)
2972 #if defined(APPLE_LEOPARD) || defined(APPLE_SNOWLEOPARD)
2973         inp->ip_inp.inp.inpcb_mtx = lck_mtx_alloc_init(SCTP_BASE_INFO(sctbinfo).mtx_grp, SCTP_BASE_INFO(sctbinfo).mtx_attr);
2974         if (inp->ip_inp.inp.inpcb_mtx == NULL) {
2975                 SCTP_PRINTF("in_pcballoc: can't alloc mutex! so=%p\n", (void *)so);
2976 #ifdef SCTP_MVRF
2977                 SCTP_FREE(inp->m_vrf_ids, SCTP_M_MVRF);
2978 #endif
2979                 SCTP_HASH_FREE(inp->sctp_tcbhash, inp->sctp_hashmark);
2980                 so->so_pcb = NULL;
2981 #if defined(__FreeBSD__)
2982                 crfree(inp->ip_inp.inp.inp_cred);
2983 #endif
2984                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_ep), inp);
2985                 SCTP_UNLOCK_EXC(SCTP_BASE_INFO(sctbinfo).ipi_lock);
2986                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOMEM);
2987                 return (ENOMEM);
2988         }
2989 #elif defined(APPLE_LION) || defined(APPLE_MOUNTAINLION)
2990         lck_mtx_init(&inp->ip_inp.inp.inpcb_mtx, SCTP_BASE_INFO(sctbinfo).mtx_grp, SCTP_BASE_INFO(sctbinfo).mtx_attr);
2991 #else
2992         lck_mtx_init(&inp->ip_inp.inp.inpcb_mtx, SCTP_BASE_INFO(sctbinfo).ipi_lock_grp, SCTP_BASE_INFO(sctbinfo).ipi_lock_attr);
2993 #endif
2994 #endif
2995         SCTP_INP_INFO_WLOCK();
2996         SCTP_INP_LOCK_INIT(inp);
2997 #if defined(__FreeBSD__)
2998         INP_LOCK_INIT(&inp->ip_inp.inp, "inp", "sctpinp");
2999 #endif
3000         SCTP_INP_READ_INIT(inp);
3001         SCTP_ASOC_CREATE_LOCK_INIT(inp);
3002         /* lock the new ep */
3003         SCTP_INP_WLOCK(inp);
3004
3005         /* add it to the info area */
3006         LIST_INSERT_HEAD(&SCTP_BASE_INFO(listhead), inp, sctp_list);
3007 #if defined(__APPLE__)
3008         inp->ip_inp.inp.inp_pcbinfo = &SCTP_BASE_INFO(sctbinfo);
3009 #if defined(APPLE_LEOPARD) || defined(APPLE_SNOWLEOPARD) || defined(APPLE_LION) || defined(APPLE_MOUNTAINLION)
3010         LIST_INSERT_HEAD(SCTP_BASE_INFO(sctbinfo).listhead, &inp->ip_inp.inp, inp_list);
3011 #else
3012         LIST_INSERT_HEAD(SCTP_BASE_INFO(sctbinfo).ipi_listhead, &inp->ip_inp.inp, inp_list);
3013 #endif
3014 #endif
3015         SCTP_INP_INFO_WUNLOCK();
3016
3017         TAILQ_INIT(&inp->read_queue);
3018         LIST_INIT(&inp->sctp_addr_list);
3019
3020         LIST_INIT(&inp->sctp_asoc_list);
3021
3022 #ifdef SCTP_TRACK_FREED_ASOCS
3023         /* TEMP CODE */
3024         LIST_INIT(&inp->sctp_asoc_free_list);
3025 #endif
3026         /* Init the timer structure for signature change */
3027         SCTP_OS_TIMER_INIT(&inp->sctp_ep.signature_change.timer);
3028         inp->sctp_ep.signature_change.type = SCTP_TIMER_TYPE_NEWCOOKIE;
3029
3030         /* now init the actual endpoint default data */
3031         m = &inp->sctp_ep;
3032
3033         /* setup the base timeout information */
3034         m->sctp_timeoutticks[SCTP_TIMER_SEND] = SEC_TO_TICKS(SCTP_SEND_SEC);    /* needed ? */
3035         m->sctp_timeoutticks[SCTP_TIMER_INIT] = SEC_TO_TICKS(SCTP_INIT_SEC);    /* needed ? */
3036         m->sctp_timeoutticks[SCTP_TIMER_RECV] = MSEC_TO_TICKS(SCTP_BASE_SYSCTL(sctp_delayed_sack_time_default));
3037         m->sctp_timeoutticks[SCTP_TIMER_HEARTBEAT] = MSEC_TO_TICKS(SCTP_BASE_SYSCTL(sctp_heartbeat_interval_default));
3038         m->sctp_timeoutticks[SCTP_TIMER_PMTU] = SEC_TO_TICKS(SCTP_BASE_SYSCTL(sctp_pmtu_raise_time_default));
3039         m->sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] = SEC_TO_TICKS(SCTP_BASE_SYSCTL(sctp_shutdown_guard_time_default));
3040         m->sctp_timeoutticks[SCTP_TIMER_SIGNATURE] = SEC_TO_TICKS(SCTP_BASE_SYSCTL(sctp_secret_lifetime_default));
3041         /* all max/min max are in ms */
3042         m->sctp_maxrto = SCTP_BASE_SYSCTL(sctp_rto_max_default);
3043         m->sctp_minrto = SCTP_BASE_SYSCTL(sctp_rto_min_default);
3044         m->initial_rto = SCTP_BASE_SYSCTL(sctp_rto_initial_default);
3045         m->initial_init_rto_max = SCTP_BASE_SYSCTL(sctp_init_rto_max_default);
3046         m->sctp_sack_freq = SCTP_BASE_SYSCTL(sctp_sack_freq_default);
3047         m->max_init_times = SCTP_BASE_SYSCTL(sctp_init_rtx_max_default);
3048         m->max_send_times = SCTP_BASE_SYSCTL(sctp_assoc_rtx_max_default);
3049         m->def_net_failure = SCTP_BASE_SYSCTL(sctp_path_rtx_max_default);
3050         m->def_net_pf_threshold = SCTP_BASE_SYSCTL(sctp_path_pf_threshold);
3051         m->sctp_sws_sender = SCTP_SWS_SENDER_DEF;
3052         m->sctp_sws_receiver = SCTP_SWS_RECEIVER_DEF;
3053         m->max_burst = SCTP_BASE_SYSCTL(sctp_max_burst_default);
3054         m->fr_max_burst = SCTP_BASE_SYSCTL(sctp_fr_max_burst_default);
3055
3056         m->sctp_default_cc_module = SCTP_BASE_SYSCTL(sctp_default_cc_module);
3057         m->sctp_default_ss_module = SCTP_BASE_SYSCTL(sctp_default_ss_module);
3058         m->max_open_streams_intome = SCTP_BASE_SYSCTL(sctp_nr_incoming_streams_default);
3059         /* number of streams to pre-open on a association */
3060         m->pre_open_stream_count = SCTP_BASE_SYSCTL(sctp_nr_outgoing_streams_default);
3061
3062         /* Add adaptation cookie */
3063         m->adaptation_layer_indicator = 0;
3064         m->adaptation_layer_indicator_provided = 0;
3065
3066         /* seed random number generator */
3067         m->random_counter = 1;
3068         m->store_at = SCTP_SIGNATURE_SIZE;
3069         SCTP_READ_RANDOM(m->random_numbers, sizeof(m->random_numbers));
3070         sctp_fill_random_store(m);
3071
3072         /* Minimum cookie size */
3073         m->size_of_a_cookie = (sizeof(struct sctp_init_msg) * 2) +
3074             sizeof(struct sctp_state_cookie);
3075         m->size_of_a_cookie += SCTP_SIGNATURE_SIZE;
3076
3077         /* Setup the initial secret */
3078         (void)SCTP_GETTIME_TIMEVAL(&time);
3079         m->time_of_secret_change = time.tv_sec;
3080
3081         for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
3082                 m->secret_key[0][i] = sctp_select_initial_TSN(m);
3083         }
3084         sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL);
3085
3086         /* How long is a cookie good for ? */
3087         m->def_cookie_life = MSEC_TO_TICKS(SCTP_BASE_SYSCTL(sctp_valid_cookie_life_default));
3088         /*
3089          * Initialize authentication parameters
3090          */
3091         m->local_hmacs = sctp_default_supported_hmaclist();
3092         m->local_auth_chunks = sctp_alloc_chunklist();
3093         m->default_dscp = 0;
3094 #ifdef INET6
3095         m->default_flowlabel = 0;
3096 #endif
3097         m->port = 0; /* encapsulation disabled by default */
3098         sctp_auth_set_default_chunks(m->local_auth_chunks);
3099         LIST_INIT(&m->shared_keys);
3100         /* add default NULL key as key id 0 */
3101         null_key = sctp_alloc_sharedkey();
3102         sctp_insert_sharedkey(&m->shared_keys, null_key);
3103         SCTP_INP_WUNLOCK(inp);
3104 #ifdef SCTP_LOG_CLOSING
3105         sctp_log_closing(inp, NULL, 12);
3106 #endif
3107         return (error);
3108 }
3109
3110
3111 void
3112 sctp_move_pcb_and_assoc(struct sctp_inpcb *old_inp, struct sctp_inpcb *new_inp,
3113     struct sctp_tcb *stcb)
3114 {
3115         struct sctp_nets *net;
3116         uint16_t lport, rport;
3117         struct sctppcbhead *head;
3118         struct sctp_laddr *laddr, *oladdr;
3119
3120         atomic_add_int(&stcb->asoc.refcnt, 1);
3121         SCTP_TCB_UNLOCK(stcb);
3122         SCTP_INP_INFO_WLOCK();
3123         SCTP_INP_WLOCK(old_inp);
3124         SCTP_INP_WLOCK(new_inp);
3125         SCTP_TCB_LOCK(stcb);
3126         atomic_subtract_int(&stcb->asoc.refcnt, 1);
3127
3128         new_inp->sctp_ep.time_of_secret_change =
3129             old_inp->sctp_ep.time_of_secret_change;
3130         memcpy(new_inp->sctp_ep.secret_key, old_inp->sctp_ep.secret_key,
3131             sizeof(old_inp->sctp_ep.secret_key));
3132         new_inp->sctp_ep.current_secret_number =
3133             old_inp->sctp_ep.current_secret_number;
3134         new_inp->sctp_ep.last_secret_number =
3135             old_inp->sctp_ep.last_secret_number;
3136         new_inp->sctp_ep.size_of_a_cookie = old_inp->sctp_ep.size_of_a_cookie;
3137
3138         /* make it so new data pours into the new socket */
3139         stcb->sctp_socket = new_inp->sctp_socket;
3140         stcb->sctp_ep = new_inp;
3141
3142         /* Copy the port across */
3143         lport = new_inp->sctp_lport = old_inp->sctp_lport;
3144         rport = stcb->rport;
3145         /* Pull the tcb from the old association */
3146         LIST_REMOVE(stcb, sctp_tcbhash);
3147         LIST_REMOVE(stcb, sctp_tcblist);
3148         if (stcb->asoc.in_asocid_hash) {
3149                 LIST_REMOVE(stcb, sctp_tcbasocidhash);
3150         }
3151         /* Now insert the new_inp into the TCP connected hash */
3152         head = &SCTP_BASE_INFO(sctp_tcpephash)[SCTP_PCBHASH_ALLADDR((lport | rport), SCTP_BASE_INFO(hashtcpmark))];
3153
3154         LIST_INSERT_HEAD(head, new_inp, sctp_hash);
3155         /* Its safe to access */
3156         new_inp->sctp_flags &= ~SCTP_PCB_FLAGS_UNBOUND;
3157
3158         /* Now move the tcb into the endpoint list */
3159         LIST_INSERT_HEAD(&new_inp->sctp_asoc_list, stcb, sctp_tcblist);
3160         /*
3161          * Question, do we even need to worry about the ep-hash since we
3162          * only have one connection? Probably not :> so lets get rid of it
3163          * and not suck up any kernel memory in that.
3164          */
3165         if (stcb->asoc.in_asocid_hash) {
3166                 struct sctpasochead *lhd;
3167                 lhd = &new_inp->sctp_asocidhash[SCTP_PCBHASH_ASOC(stcb->asoc.assoc_id,
3168                         new_inp->hashasocidmark)];
3169                 LIST_INSERT_HEAD(lhd, stcb, sctp_tcbasocidhash);
3170         }
3171         /* Ok. Let's restart timer. */
3172         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
3173                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, new_inp,
3174                     stcb, net);
3175         }
3176
3177         SCTP_INP_INFO_WUNLOCK();
3178         if (new_inp->sctp_tcbhash != NULL) {
3179                 SCTP_HASH_FREE(new_inp->sctp_tcbhash, new_inp->sctp_hashmark);
3180                 new_inp->sctp_tcbhash = NULL;
3181         }
3182         if ((new_inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
3183                 /* Subset bound, so copy in the laddr list from the old_inp */
3184                 LIST_FOREACH(oladdr, &old_inp->sctp_addr_list, sctp_nxt_addr) {
3185                         laddr = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
3186                         if (laddr == NULL) {
3187                                 /*
3188                                  * Gak, what can we do? This assoc is really
3189                                  * HOSED. We probably should send an abort
3190                                  * here.
3191                                  */
3192                                 SCTPDBG(SCTP_DEBUG_PCB1, "Association hosed in TCP model, out of laddr memory\n");
3193                                 continue;
3194                         }
3195                         SCTP_INCR_LADDR_COUNT();
3196                         bzero(laddr, sizeof(*laddr));
3197                         (void)SCTP_GETTIME_TIMEVAL(&laddr->start_time);
3198                         laddr->ifa = oladdr->ifa;
3199                         atomic_add_int(&laddr->ifa->refcount, 1);
3200                         LIST_INSERT_HEAD(&new_inp->sctp_addr_list, laddr,
3201                             sctp_nxt_addr);
3202                         new_inp->laddr_count++;
3203                         if (oladdr == stcb->asoc.last_used_address) {
3204                                 stcb->asoc.last_used_address = laddr;
3205                         }
3206                 }
3207         }
3208         /* Now any running timers need to be adjusted
3209          * since we really don't care if they are running
3210          * or not just blast in the new_inp into all of
3211          * them.
3212          */
3213
3214         stcb->asoc.dack_timer.ep = (void *)new_inp;
3215         stcb->asoc.asconf_timer.ep = (void *)new_inp;
3216         stcb->asoc.strreset_timer.ep = (void *)new_inp;
3217         stcb->asoc.shut_guard_timer.ep = (void *)new_inp;
3218         stcb->asoc.autoclose_timer.ep = (void *)new_inp;
3219         stcb->asoc.delayed_event_timer.ep = (void *)new_inp;
3220         stcb->asoc.delete_prim_timer.ep = (void *)new_inp;
3221         /* now what about the nets? */
3222         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
3223                 net->pmtu_timer.ep = (void *)new_inp;
3224                 net->hb_timer.ep = (void *)new_inp;
3225                 net->rxt_timer.ep = (void *)new_inp;
3226         }
3227         SCTP_INP_WUNLOCK(new_inp);
3228         SCTP_INP_WUNLOCK(old_inp);
3229 }
3230
3231
3232 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__Userspace__))
3233 /*
3234  * Don't know why, but without this there is an unknown reference when
3235  * compiling NetBSD... hmm
3236  */
3237 extern void in6_sin6_2_sin(struct sockaddr_in *, struct sockaddr_in6 *sin6);
3238 #endif
3239
3240
3241 /* sctp_ifap is used to bypass normal local address validation checks */
3242 int
3243 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
3244 sctp_inpcb_bind(struct socket *so, struct sockaddr *addr,
3245                 struct sctp_ifa *sctp_ifap, struct thread *p)
3246 #elif defined(__Windows__)
3247 sctp_inpcb_bind(struct socket *so, struct sockaddr *addr,
3248                 struct sctp_ifa *sctp_ifap, PKTHREAD p)
3249 #else
3250 sctp_inpcb_bind(struct socket *so, struct sockaddr *addr,
3251                 struct sctp_ifa *sctp_ifap, struct proc *p)
3252 #endif
3253 {
3254         /* bind a ep to a socket address */
3255         struct sctppcbhead *head;
3256         struct sctp_inpcb *inp, *inp_tmp;
3257 #if defined(INET) || (defined(INET6) && defined(__APPLE__)) || defined(__FreeBSD__) || defined(__APPLE__)
3258         struct inpcb *ip_inp;
3259 #endif
3260         int port_reuse_active = 0;
3261         int bindall;
3262 #ifdef SCTP_MVRF
3263         int i;
3264 #endif
3265         uint16_t lport;
3266         int error;
3267         uint32_t vrf_id;
3268
3269         lport = 0;
3270         bindall = 1;
3271         inp = (struct sctp_inpcb *)so->so_pcb;
3272 #if defined(INET) || (defined(INET6) && defined(__APPLE__)) || defined(__FreeBSD__) || defined(__APPLE__)
3273         ip_inp = (struct inpcb *)so->so_pcb;
3274 #endif
3275 #ifdef SCTP_DEBUG
3276         if (addr) {
3277                 SCTPDBG(SCTP_DEBUG_PCB1, "Bind called port: %d\n",
3278                         ntohs(((struct sockaddr_in *)addr)->sin_port));
3279                 SCTPDBG(SCTP_DEBUG_PCB1, "Addr: ");
3280                 SCTPDBG_ADDR(SCTP_DEBUG_PCB1, addr);
3281         }
3282 #endif
3283         if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) == 0) {
3284                 /* already did a bind, subsequent binds NOT allowed ! */
3285                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
3286                 return (EINVAL);
3287         }
3288 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
3289 #ifdef INVARIANTS
3290         if (p == NULL)
3291                 panic("null proc/thread");
3292 #endif
3293 #endif
3294         if (addr != NULL) {
3295                 switch (addr->sa_family) {
3296 #ifdef INET
3297                 case AF_INET:
3298                 {
3299                         struct sockaddr_in *sin;
3300
3301                         /* IPV6_V6ONLY socket? */
3302                         if (SCTP_IPV6_V6ONLY(ip_inp)) {
3303                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
3304                                 return (EINVAL);
3305                         }
3306 #ifdef HAVE_SA_LEN
3307                         if (addr->sa_len != sizeof(*sin)) {
3308                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
3309                                 return (EINVAL);
3310                         }
3311 #endif
3312
3313                         sin = (struct sockaddr_in *)addr;
3314                         lport = sin->sin_port;
3315 #if defined(__FreeBSD__) && __FreeBSD_version >= 800000
3316                         /*
3317                          * For LOOPBACK the prison_local_ip4() call will transmute the ip address
3318                          * to the proper value.
3319                          */
3320                         if (p && (error = prison_local_ip4(p->td_ucred, &sin->sin_addr)) != 0) {
3321                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
3322                                 return (error);
3323                         }
3324 #endif
3325                         if (sin->sin_addr.s_addr != INADDR_ANY) {
3326                                 bindall = 0;
3327                         }
3328                         break;
3329                 }
3330 #endif
3331 #ifdef INET6
3332                 case AF_INET6:
3333                 {
3334                         /* Only for pure IPv6 Address. (No IPv4 Mapped!) */
3335                         struct sockaddr_in6 *sin6;
3336
3337                         sin6 = (struct sockaddr_in6 *)addr;
3338
3339 #ifdef HAVE_SA_LEN
3340                         if (addr->sa_len != sizeof(*sin6)) {
3341                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
3342                                 return (EINVAL);
3343                         }
3344 #endif
3345                         lport = sin6->sin6_port;
3346 #if defined(__FreeBSD__) && __FreeBSD_version >= 800000
3347                         /*
3348                          * For LOOPBACK the prison_local_ip6() call will transmute the ipv6 address
3349                          * to the proper value.
3350                          */
3351                         if (p && (error = prison_local_ip6(p->td_ucred, &sin6->sin6_addr,
3352                             (SCTP_IPV6_V6ONLY(inp) != 0))) != 0) {
3353                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
3354                                 return (error);
3355                         }
3356 #endif
3357                         if (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
3358                                 bindall = 0;
3359 #ifdef SCTP_EMBEDDED_V6_SCOPE
3360                                 /* KAME hack: embed scopeid */
3361 #if defined(SCTP_KAME)
3362                                 if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) {
3363                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
3364                                         return (EINVAL);
3365                                 }
3366 #elif defined(__APPLE__)
3367 #if defined(APPLE_LEOPARD) || defined(APPLE_SNOWLEOPARD)
3368                                 if (in6_embedscope(&sin6->sin6_addr, sin6, ip_inp, NULL) != 0) {
3369 #else
3370                                 if (in6_embedscope(&sin6->sin6_addr, sin6, ip_inp, NULL, NULL) != 0) {
3371 #endif
3372                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
3373                                         return (EINVAL);
3374                                 }
3375 #elif defined(__FreeBSD__)
3376                                 error = scope6_check_id(sin6, MODULE_GLOBAL(ip6_use_defzone));
3377                                 if (error != 0) {
3378                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
3379                                         return (error);
3380                                 }
3381 #else
3382                                 if (in6_embedscope(&sin6->sin6_addr, sin6) != 0) {
3383                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
3384                                         return (EINVAL);
3385                                 }
3386 #endif
3387 #endif /* SCTP_EMBEDDED_V6_SCOPE */
3388                         }
3389 #ifndef SCOPEDROUTING
3390                         /* this must be cleared for ifa_ifwithaddr() */
3391                         sin6->sin6_scope_id = 0;
3392 #endif /* SCOPEDROUTING */
3393                         break;
3394                 }
3395 #endif
3396 #if defined(__Userspace__)
3397                 case AF_CONN:
3398                 {
3399                         struct sockaddr_conn *sconn;
3400
3401 #ifdef HAVE_SA_LEN
3402                         if (addr->sa_len != sizeof(struct sockaddr_conn)) {
3403                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
3404                                 return (EINVAL);
3405                         }
3406 #endif
3407                         sconn = (struct sockaddr_conn *)addr;
3408                         lport = sconn->sconn_port;
3409                         if (sconn->sconn_addr != NULL) {
3410                                 bindall = 0;
3411                         }
3412                         break;
3413                 }
3414 #endif
3415                 default:
3416                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EAFNOSUPPORT);
3417                         return (EAFNOSUPPORT);
3418                 }
3419         }
3420         SCTP_INP_INFO_WLOCK();
3421         SCTP_INP_WLOCK(inp);
3422         /* Setup a vrf_id to be the default for the non-bind-all case. */
3423         vrf_id = inp->def_vrf_id;
3424
3425         /* increase our count due to the unlock we do */
3426         SCTP_INP_INCR_REF(inp);
3427         if (lport) {
3428                 /*
3429                  * Did the caller specify a port? if so we must see if an ep
3430                  * already has this one bound.
3431                  */
3432                 /* got to be root to get at low ports */
3433 #if !defined(__Windows__)
3434                 if (ntohs(lport) < IPPORT_RESERVED) {
3435                         if (p && (error =
3436 #ifdef __FreeBSD__
3437 #if __FreeBSD_version > 602000
3438                                   priv_check(p, PRIV_NETINET_RESERVEDPORT)
3439 #elif __FreeBSD_version >= 500000
3440                                   suser_cred(p->td_ucred, 0)
3441 #else
3442                                   suser(p)
3443 #endif
3444 #elif defined(__APPLE__)
3445                                   suser(p->p_ucred, &p->p_acflag)
3446 #elif defined(__Userspace__) /* must be true to use raw socket */
3447                                   1
3448 #else
3449                                   suser(p, 0)
3450 #endif
3451                                     )) {
3452                                 SCTP_INP_DECR_REF(inp);
3453                                 SCTP_INP_WUNLOCK(inp);
3454                                 SCTP_INP_INFO_WUNLOCK();
3455                                 return (error);
3456                         }
3457 #if defined(__Panda__)
3458                         if (!SCTP_IS_PRIVILEDGED(so)) {
3459                                 SCTP_INP_DECR_REF(inp);
3460                                 SCTP_INP_WUNLOCK(inp);
3461                                 SCTP_INP_INFO_WUNLOCK();
3462                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EACCES);
3463                                 return (EACCES);
3464                         }
3465 #endif
3466                 }
3467 #endif /* __Windows__ */
3468                 SCTP_INP_WUNLOCK(inp);
3469                 if (bindall) {
3470 #ifdef SCTP_MVRF
3471                         for (i = 0; i < inp->num_vrfs; i++) {
3472                                 vrf_id = inp->m_vrf_ids[i];
3473 #else
3474                                 vrf_id = inp->def_vrf_id;
3475 #endif
3476                                 inp_tmp = sctp_pcb_findep(addr, 0, 1, vrf_id);
3477                                 if (inp_tmp != NULL) {
3478                                         /*
3479                                          * lock guy returned and lower count
3480                                          * note that we are not bound so
3481                                          * inp_tmp should NEVER be inp. And
3482                                          * it is this inp (inp_tmp) that gets
3483                                          * the reference bump, so we must
3484                                          * lower it.
3485                                          */
3486                                         SCTP_INP_DECR_REF(inp_tmp);
3487                                         /* unlock info */
3488                                         if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_PORTREUSE)) &&
3489                                             (sctp_is_feature_on(inp_tmp, SCTP_PCB_FLAGS_PORTREUSE))) {
3490                                                 /* Ok, must be one-2-one and allowing port re-use */
3491                                                 port_reuse_active = 1;
3492                                                 goto continue_anyway;
3493                                         }
3494                                         SCTP_INP_DECR_REF(inp);
3495                                         SCTP_INP_INFO_WUNLOCK();
3496                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EADDRINUSE);
3497                                         return (EADDRINUSE);
3498                                 }
3499 #ifdef SCTP_MVRF
3500                         }
3501 #endif
3502                 } else {
3503                         inp_tmp = sctp_pcb_findep(addr, 0, 1, vrf_id);
3504                         if (inp_tmp != NULL) {
3505                                 /*
3506                                  * lock guy returned and lower count note
3507                                  * that we are not bound so inp_tmp should
3508                                  * NEVER be inp. And it is this inp (inp_tmp)
3509                                  * that gets the reference bump, so we must
3510                                  * lower it.
3511                                  */
3512                                 SCTP_INP_DECR_REF(inp_tmp);
3513                                 /* unlock info */
3514                                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_PORTREUSE)) &&
3515                                     (sctp_is_feature_on(inp_tmp, SCTP_PCB_FLAGS_PORTREUSE))) {
3516                                         /* Ok, must be one-2-one and allowing port re-use */
3517                                         port_reuse_active = 1;
3518                                         goto continue_anyway;
3519                                 }
3520                                 SCTP_INP_DECR_REF(inp);
3521                                 SCTP_INP_INFO_WUNLOCK();
3522                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EADDRINUSE);
3523                                 return (EADDRINUSE);
3524                         }
3525                 }
3526         continue_anyway:
3527                 SCTP_INP_WLOCK(inp);
3528                 if (bindall) {
3529                         /* verify that no lport is not used by a singleton */
3530                         if ((port_reuse_active == 0) &&
3531                             (inp_tmp = sctp_isport_inuse(inp, lport, vrf_id))) {
3532                                 /* Sorry someone already has this one bound */
3533                                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_PORTREUSE)) &&
3534                                     (sctp_is_feature_on(inp_tmp, SCTP_PCB_FLAGS_PORTREUSE))) {
3535                                         port_reuse_active = 1;
3536                                 } else {
3537                                         SCTP_INP_DECR_REF(inp);
3538                                         SCTP_INP_WUNLOCK(inp);
3539                                         SCTP_INP_INFO_WUNLOCK();
3540                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EADDRINUSE);
3541                                         return (EADDRINUSE);
3542                                 }
3543                         }
3544                 }
3545         } else {
3546                 uint16_t first, last, candidate;
3547                 uint16_t count;
3548                 int done;
3549
3550 #if defined(__Windows__)
3551                 first = 1;
3552                 last = 0xffff;
3553 #else
3554 #if defined(__Userspace__)
3555                 /* TODO ensure uid is 0, etc... */
3556 #elif defined(__FreeBSD__) || defined(__APPLE__)
3557                 if (ip_inp->inp_flags & INP_HIGHPORT) {
3558                         first = MODULE_GLOBAL(ipport_hifirstauto);
3559                         last = MODULE_GLOBAL(ipport_hilastauto);
3560                 } else if (ip_inp->inp_flags & INP_LOWPORT) {
3561                         if (p && (error =
3562 #ifdef __FreeBSD__
3563 #if __FreeBSD_version > 602000
3564                                   priv_check(p, PRIV_NETINET_RESERVEDPORT)
3565 #elif __FreeBSD_version >= 500000
3566                                   suser_cred(p->td_ucred, 0)
3567 #else
3568                                   suser(p)
3569 #endif
3570 #elif defined(__APPLE__)
3571                                   suser(p->p_ucred, &p->p_acflag)
3572 #else
3573                                   suser(p, 0)
3574 #endif
3575                                     )) {
3576                                 SCTP_INP_DECR_REF(inp);
3577                                 SCTP_INP_WUNLOCK(inp);
3578                                 SCTP_INP_INFO_WUNLOCK();
3579                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
3580                                 return (error);
3581                         }
3582                         first = MODULE_GLOBAL(ipport_lowfirstauto);
3583                         last = MODULE_GLOBAL(ipport_lowlastauto);
3584                 } else {
3585 #endif
3586                         first = MODULE_GLOBAL(ipport_firstauto);
3587                         last = MODULE_GLOBAL(ipport_lastauto);
3588 #if defined(__FreeBSD__) || defined(__APPLE__)
3589                 }
3590 #endif
3591 #endif /* __Windows__ */
3592                 if (first > last) {
3593                         uint16_t temp;
3594
3595                         temp = first;
3596                         first = last;
3597                         last = temp;
3598                 }
3599                 count = last - first + 1; /* number of candidates */
3600                 candidate = first + sctp_select_initial_TSN(&inp->sctp_ep) % (count);
3601
3602                 done = 0;
3603                 while (!done) {
3604 #ifdef SCTP_MVRF
3605                         for (i = 0; i < inp->num_vrfs; i++) {
3606                                 if (sctp_isport_inuse(inp, htons(candidate), inp->m_vrf_ids[i]) != NULL) {
3607                                         break;
3608                                 }
3609                         }
3610                         if (i == inp->num_vrfs) {
3611                                 done = 1;
3612                         }
3613 #else
3614                         if (sctp_isport_inuse(inp, htons(candidate), inp->def_vrf_id) == NULL) {
3615                                 done = 1;
3616                         }
3617 #endif
3618                         if (!done) {
3619                                 if (--count == 0) {
3620                                         SCTP_INP_DECR_REF(inp);
3621                                         SCTP_INP_WUNLOCK(inp);
3622                                         SCTP_INP_INFO_WUNLOCK();
3623                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EADDRINUSE);
3624                                         return (EADDRINUSE);
3625                                 }
3626                                 if (candidate == last)
3627                                         candidate = first;
3628                                 else
3629                                         candidate = candidate + 1;
3630                         }
3631                 }
3632                 lport = htons(candidate);
3633         }
3634         SCTP_INP_DECR_REF(inp);
3635         if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE |
3636                                SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
3637                 /*
3638                  * this really should not happen. The guy did a non-blocking
3639                  * bind and then did a close at the same time.
3640                  */
3641                 SCTP_INP_WUNLOCK(inp);
3642                 SCTP_INP_INFO_WUNLOCK();
3643                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
3644                 return (EINVAL);
3645         }
3646         /* ok we look clear to give out this port, so lets setup the binding */
3647         if (bindall) {
3648                 /* binding to all addresses, so just set in the proper flags */
3649                 inp->sctp_flags |= SCTP_PCB_FLAGS_BOUNDALL;
3650                 /* set the automatic addr changes from kernel flag */
3651                 if (SCTP_BASE_SYSCTL(sctp_auto_asconf) == 0) {
3652                         sctp_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF);
3653                         sctp_feature_off(inp, SCTP_PCB_FLAGS_AUTO_ASCONF);
3654                 } else {
3655                         sctp_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF);
3656                         sctp_feature_on(inp, SCTP_PCB_FLAGS_AUTO_ASCONF);
3657                 }
3658                 if (SCTP_BASE_SYSCTL(sctp_multiple_asconfs) == 0) {
3659                         sctp_feature_off(inp, SCTP_PCB_FLAGS_MULTIPLE_ASCONFS);
3660                 } else {
3661                         sctp_feature_on(inp, SCTP_PCB_FLAGS_MULTIPLE_ASCONFS);
3662                 }
3663                 /* set the automatic mobility_base from kernel
3664                    flag (by micchie)
3665                 */
3666                 if (SCTP_BASE_SYSCTL(sctp_mobility_base) == 0) {
3667                         sctp_mobility_feature_off(inp, SCTP_MOBILITY_BASE);
3668                         sctp_mobility_feature_off(inp, SCTP_MOBILITY_PRIM_DELETED);
3669                 } else {
3670                         sctp_mobility_feature_on(inp, SCTP_MOBILITY_BASE);
3671                         sctp_mobility_feature_off(inp, SCTP_MOBILITY_PRIM_DELETED);
3672                 }
3673                 /* set the automatic mobility_fasthandoff from kernel
3674                    flag (by micchie)
3675                 */
3676                 if (SCTP_BASE_SYSCTL(sctp_mobility_fasthandoff) == 0) {
3677                         sctp_mobility_feature_off(inp, SCTP_MOBILITY_FASTHANDOFF);
3678                         sctp_mobility_feature_off(inp, SCTP_MOBILITY_PRIM_DELETED);
3679                 } else {
3680                         sctp_mobility_feature_on(inp, SCTP_MOBILITY_FASTHANDOFF);
3681                         sctp_mobility_feature_off(inp, SCTP_MOBILITY_PRIM_DELETED);
3682                 }
3683         } else {
3684                 /*
3685                  * bind specific, make sure flags is off and add a new
3686                  * address structure to the sctp_addr_list inside the ep
3687                  * structure.
3688                  *
3689                  * We will need to allocate one and insert it at the head. The
3690                  * socketopt call can just insert new addresses in there as
3691                  * well. It will also have to do the embed scope kame hack
3692                  * too (before adding).
3693                  */
3694                 struct sctp_ifa *ifa;
3695                 struct sockaddr_storage store_sa;
3696
3697                 memset(&store_sa, 0, sizeof(store_sa));
3698                 switch (addr->sa_family) {
3699 #ifdef INET
3700                 case AF_INET:
3701                 {
3702                         struct sockaddr_in *sin;
3703
3704                         sin = (struct sockaddr_in *)&store_sa;
3705                         memcpy(sin, addr, sizeof(struct sockaddr_in));
3706                         sin->sin_port = 0;
3707                         break;
3708                 }
3709 #endif
3710 #ifdef INET6
3711                 case AF_INET6:
3712                 {
3713                         struct sockaddr_in6 *sin6;
3714
3715                         sin6 = (struct sockaddr_in6 *)&store_sa;
3716                         memcpy(sin6, addr, sizeof(struct sockaddr_in6));
3717                         sin6->sin6_port = 0;
3718                         break;
3719                 }
3720 #endif
3721 #if defined(__Userspace__)
3722                 case AF_CONN:
3723                 {
3724                         struct sockaddr_conn *sconn;
3725
3726                         sconn = (struct sockaddr_conn *)&store_sa;
3727                         memcpy(sconn, addr, sizeof(struct sockaddr_conn));
3728                         sconn->sconn_port = 0;
3729                         break;
3730                 }
3731 #endif
3732                 default:
3733                         break;
3734                 }
3735                 /*
3736                  * first find the interface with the bound address need to
3737                  * zero out the port to find the address! yuck! can't do
3738                  * this earlier since need port for sctp_pcb_findep()
3739                  */
3740                 if (sctp_ifap != NULL) {
3741                         ifa = sctp_ifap;
3742                 } else {
3743                         /* Note for BSD we hit here always other
3744                          * O/S's will pass things in via the
3745                          * sctp_ifap argument (Panda).
3746                          */
3747                         ifa = sctp_find_ifa_by_addr((struct sockaddr *)&store_sa,
3748                                                     vrf_id, SCTP_ADDR_NOT_LOCKED);
3749                 }
3750                 if (ifa == NULL) {
3751                         /* Can't find an interface with that address */
3752                         SCTP_INP_WUNLOCK(inp);
3753                         SCTP_INP_INFO_WUNLOCK();
3754                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EADDRNOTAVAIL);
3755                         return (EADDRNOTAVAIL);
3756                 }
3757 #ifdef INET6
3758                 if (addr->sa_family == AF_INET6) {
3759                         /* GAK, more FIXME IFA lock? */
3760                         if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
3761                                 /* Can't bind a non-existent addr. */
3762                                 SCTP_INP_WUNLOCK(inp);
3763                                 SCTP_INP_INFO_WUNLOCK();
3764                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
3765                                 return (EINVAL);
3766                         }
3767                 }
3768 #endif
3769                 /* we're not bound all */
3770                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_BOUNDALL;
3771                 /* allow bindx() to send ASCONF's for binding changes */
3772                 sctp_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF);
3773                 /* clear automatic addr changes from kernel flag */
3774                 sctp_feature_off(inp, SCTP_PCB_FLAGS_AUTO_ASCONF);
3775
3776                 /* add this address to the endpoint list */
3777                 error = sctp_insert_laddr(&inp->sctp_addr_list, ifa, 0);
3778                 if (error != 0) {
3779                         SCTP_INP_WUNLOCK(inp);
3780                         SCTP_INP_INFO_WUNLOCK();
3781                         return (error);
3782                 }
3783                 inp->laddr_count++;
3784         }
3785         /* find the bucket */
3786         if (port_reuse_active) {
3787                 /* Put it into tcp 1-2-1 hash */
3788                 head = &SCTP_BASE_INFO(sctp_tcpephash)[SCTP_PCBHASH_ALLADDR(lport, SCTP_BASE_INFO(hashtcpmark))];
3789                 inp->sctp_flags |= SCTP_PCB_FLAGS_IN_TCPPOOL;
3790         } else {
3791                 head = &SCTP_BASE_INFO(sctp_ephash)[SCTP_PCBHASH_ALLADDR(lport, SCTP_BASE_INFO(hashmark))];
3792         }
3793         /* put it in the bucket */
3794         LIST_INSERT_HEAD(head, inp, sctp_hash);
3795         SCTPDBG(SCTP_DEBUG_PCB1, "Main hash to bind at head:%p, bound port:%d - in tcp_pool=%d\n",
3796                 (void *)head, ntohs(lport), port_reuse_active);
3797         /* set in the port */
3798         inp->sctp_lport = lport;
3799
3800         /* turn off just the unbound flag */
3801         inp->sctp_flags &= ~SCTP_PCB_FLAGS_UNBOUND;
3802         SCTP_INP_WUNLOCK(inp);
3803         SCTP_INP_INFO_WUNLOCK();
3804         return (0);
3805 }
3806
3807
3808 static void
3809 sctp_iterator_inp_being_freed(struct sctp_inpcb *inp)
3810 {
3811         struct sctp_iterator *it, *nit;
3812
3813         /*
3814          * We enter with the only the ITERATOR_LOCK in place and a write
3815          * lock on the inp_info stuff.
3816          */
3817         it = sctp_it_ctl.cur_it;
3818 #if defined(__FreeBSD__) && __FreeBSD_version >= 801000
3819         if (it && (it->vn != curvnet)) {
3820                 /* Its not looking at our VNET */
3821                 return;
3822         }
3823 #endif
3824         if (it && (it->inp == inp)) {
3825                 /*
3826                  * This is tricky and we hold the iterator lock,
3827                  * but when it returns and gets the lock (when we
3828                  * release it) the iterator will try to operate on
3829                  * inp. We need to stop that from happening. But
3830                  * of course the iterator has a reference on the
3831                  * stcb and inp. We can mark it and it will stop.
3832                  *
3833                  * If its a single iterator situation, we
3834                  * set the end iterator flag. Otherwise
3835                  * we set the iterator to go to the next inp.
3836                  *
3837                  */
3838                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
3839                         sctp_it_ctl.iterator_flags |= SCTP_ITERATOR_STOP_CUR_IT;
3840                 } else {
3841                         sctp_it_ctl.iterator_flags |= SCTP_ITERATOR_STOP_CUR_INP;
3842                 }
3843         }
3844         /* Now go through and remove any single reference to
3845          * our inp that may be still pending on the list
3846          */
3847         SCTP_IPI_ITERATOR_WQ_LOCK();
3848         TAILQ_FOREACH_SAFE(it, &sctp_it_ctl.iteratorhead, sctp_nxt_itr, nit) {
3849 #if defined(__FreeBSD__) && __FreeBSD_version >= 801000
3850                 if (it->vn != curvnet) {
3851                         continue;
3852                 }
3853 #endif
3854                 if (it->inp == inp) {
3855                         /* This one points to me is it inp specific? */
3856                         if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
3857                                 /* Remove and free this one */
3858                                 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead,
3859                                     it, sctp_nxt_itr);
3860                                 if (it->function_atend != NULL) {
3861                                         (*it->function_atend) (it->pointer, it->val);
3862                                 }
3863                                 SCTP_FREE(it, SCTP_M_ITER);
3864                         } else {
3865                                 it->inp = LIST_NEXT(it->inp, sctp_list);
3866                                 if (it->inp) {
3867                                         SCTP_INP_INCR_REF(it->inp);
3868                                 }
3869                         }
3870                         /* When its put in the refcnt is incremented so decr it */
3871                         SCTP_INP_DECR_REF(inp);
3872                 }
3873         }
3874         SCTP_IPI_ITERATOR_WQ_UNLOCK();
3875 }
3876
3877 /* release sctp_inpcb unbind the port */
3878 void
3879 sctp_inpcb_free(struct sctp_inpcb *inp, int immediate, int from)
3880 {
3881         /*
3882          * Here we free a endpoint. We must find it (if it is in the Hash
3883          * table) and remove it from there. Then we must also find it in the
3884          * overall list and remove it from there. After all removals are
3885          * complete then any timer has to be stopped. Then start the actual
3886          * freeing. a) Any local lists. b) Any associations. c) The hash of
3887          * all associations. d) finally the ep itself.
3888          */
3889         struct sctp_tcb *asoc, *nasoc;
3890         struct sctp_laddr *laddr, *nladdr;
3891         struct inpcb *ip_pcb;
3892         struct socket *so;
3893         int being_refed = 0;
3894         struct sctp_queued_to_read *sq, *nsq;
3895 #if !defined(__Panda__) && !defined(__Userspace__)
3896 #if !defined(__FreeBSD__) || __FreeBSD_version < 500000
3897         sctp_rtentry_t *rt;
3898 #endif
3899 #endif
3900         int cnt;
3901         sctp_sharedkey_t *shared_key, *nshared_key;
3902
3903
3904 #if defined(__APPLE__)
3905         sctp_lock_assert(SCTP_INP_SO(inp));
3906 #endif
3907 #ifdef SCTP_LOG_CLOSING
3908         sctp_log_closing(inp, NULL, 0);
3909 #endif
3910         SCTP_ITERATOR_LOCK();
3911         /* mark any iterators on the list or being processed */
3912         sctp_iterator_inp_being_freed(inp);
3913         SCTP_ITERATOR_UNLOCK();
3914         so = inp->sctp_socket;
3915         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
3916                 /* been here before.. eeks.. get out of here */
3917                 SCTP_PRINTF("This conflict in free SHOULD not be happening! from %d, imm %d\n", from, immediate);
3918 #ifdef SCTP_LOG_CLOSING
3919                 sctp_log_closing(inp, NULL, 1);
3920 #endif
3921                 return;
3922         }
3923         SCTP_ASOC_CREATE_LOCK(inp);
3924         SCTP_INP_INFO_WLOCK();
3925
3926         SCTP_INP_WLOCK(inp);
3927         if (from == SCTP_CALLED_AFTER_CMPSET_OFCLOSE) {
3928                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_CLOSE_IP;
3929                 /* socket is gone, so no more wakeups allowed */
3930                 inp->sctp_flags |= SCTP_PCB_FLAGS_DONT_WAKE;
3931                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_WAKEINPUT;
3932                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_WAKEOUTPUT;
3933
3934         }
3935         /* First time through we have the socket lock, after that no more. */
3936         sctp_timer_stop(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL,
3937                         SCTP_FROM_SCTP_PCB+SCTP_LOC_1);
3938
3939         if (inp->control) {
3940                 sctp_m_freem(inp->control);
3941                 inp->control = NULL;
3942         }
3943         if (inp->pkt) {
3944                 sctp_m_freem(inp->pkt);
3945                 inp->pkt = NULL;
3946         }
3947         ip_pcb = &inp->ip_inp.inp;      /* we could just cast the main pointer
3948                                          * here but I will be nice :> (i.e.
3949                                          * ip_pcb = ep;) */
3950         if (immediate == SCTP_FREE_SHOULD_USE_GRACEFUL_CLOSE) {
3951                 int cnt_in_sd;
3952
3953                 cnt_in_sd = 0;
3954                 LIST_FOREACH_SAFE(asoc, &inp->sctp_asoc_list, sctp_tcblist, nasoc) {
3955                         SCTP_TCB_LOCK(asoc);
3956                         if (asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
3957                                 /* Skip guys being freed */
3958                                 cnt_in_sd++;
3959                                 if (asoc->asoc.state & SCTP_STATE_IN_ACCEPT_QUEUE) {
3960                                         /*
3961                                          * Special case - we did not start a kill
3962                                          * timer on the asoc due to it was not
3963                                          * closed. So go ahead and start it now.
3964                                          */
3965                                         asoc->asoc.state &= ~SCTP_STATE_IN_ACCEPT_QUEUE;
3966                                         sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, asoc, NULL);
3967                                 }
3968                                 SCTP_TCB_UNLOCK(asoc);
3969                                 continue;
3970                         }
3971                         if (((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_COOKIE_WAIT) ||
3972                             (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_COOKIE_ECHOED)) &&
3973                             (asoc->asoc.total_output_queue_size == 0)) {
3974                                 /* If we have data in queue, we don't want to just
3975                                  * free since the app may have done, send()/close
3976                                  * or connect/send/close. And it wants the data
3977                                  * to get across first.
3978                                  */
3979                                 /* Just abandon things in the front states */
3980                                 if (sctp_free_assoc(inp, asoc, SCTP_PCBFREE_NOFORCE,
3981                                                    SCTP_FROM_SCTP_PCB+SCTP_LOC_2) == 0) {
3982                                         cnt_in_sd++;
3983                                 }
3984                                 continue;
3985                         }
3986                         /* Disconnect the socket please */
3987                         asoc->sctp_socket = NULL;
3988                         asoc->asoc.state |= SCTP_STATE_CLOSED_SOCKET;
3989                         if ((asoc->asoc.size_on_reasm_queue > 0) ||
3990                             (asoc->asoc.control_pdapi) ||
3991                             (asoc->asoc.size_on_all_streams > 0) ||
3992                             (so && (so->so_rcv.sb_cc > 0))) {
3993                                 /* Left with Data unread */
3994                                 struct mbuf *op_err;
3995
3996                                 op_err = sctp_generate_cause(SCTP_CAUSE_USER_INITIATED_ABT, "");
3997                                 asoc->sctp_ep->last_abort_code = SCTP_FROM_SCTP_PCB+SCTP_LOC_3;
3998                                 sctp_send_abort_tcb(asoc, op_err, SCTP_SO_LOCKED);
3999                                 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4000                                 if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_OPEN) ||
4001                                     (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4002                                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4003                                 }
4004                                 if (sctp_free_assoc(inp, asoc,
4005                                                     SCTP_PCBFREE_NOFORCE, SCTP_FROM_SCTP_PCB+SCTP_LOC_4) == 0) {
4006                                         cnt_in_sd++;
4007                                 }
4008                                 continue;
4009                         } else if (TAILQ_EMPTY(&asoc->asoc.send_queue) &&
4010                                    TAILQ_EMPTY(&asoc->asoc.sent_queue) &&
4011                                    (asoc->asoc.stream_queue_cnt == 0)) {
4012                                 if (asoc->asoc.locked_on_sending) {
4013                                         goto abort_anyway;
4014                                 }
4015                                 if ((SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
4016                                     (SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
4017                                         struct sctp_nets *netp;
4018
4019                                         /*
4020                                          * there is nothing queued to send,
4021                                          * so I send shutdown
4022                                          */
4023                                         if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_OPEN) ||
4024                                             (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4025                                                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4026                                         }
4027                                         SCTP_SET_STATE(&asoc->asoc, SCTP_STATE_SHUTDOWN_SENT);
4028                                         SCTP_CLEAR_SUBSTATE(&asoc->asoc, SCTP_STATE_SHUTDOWN_PENDING);
4029                                         sctp_stop_timers_for_shutdown(asoc);
4030                                         if (asoc->asoc.alternate) {
4031                                                 netp = asoc->asoc.alternate;
4032                                         } else {
4033                                                 netp = asoc->asoc.primary_destination;
4034                                         }
4035                                         sctp_send_shutdown(asoc, netp);
4036                                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, asoc->sctp_ep, asoc,
4037                                             netp);
4038                                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, asoc->sctp_ep, asoc,
4039                                             asoc->asoc.primary_destination);
4040                                         sctp_chunk_output(inp, asoc, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_LOCKED);
4041                                 }
4042                         } else {
4043                                 /* mark into shutdown pending */
4044                                 struct sctp_stream_queue_pending *sp;
4045
4046                                 asoc->asoc.state |= SCTP_STATE_SHUTDOWN_PENDING;
4047                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, asoc->sctp_ep, asoc,
4048                                                  asoc->asoc.primary_destination);
4049                                 if (asoc->asoc.locked_on_sending) {
4050                                         sp = TAILQ_LAST(&((asoc->asoc.locked_on_sending)->outqueue),
4051                                                 sctp_streamhead);
4052                                         if (sp == NULL) {
4053                                                 SCTP_PRINTF("Error, sp is NULL, locked on sending is %p strm:%d\n",
4054                                                        (void *)asoc->asoc.locked_on_sending,
4055                                                        asoc->asoc.locked_on_sending->stream_no);
4056                                         } else {
4057                                                 if ((sp->length == 0) && (sp->msg_is_complete == 0))
4058                                                         asoc->asoc.state |= SCTP_STATE_PARTIAL_MSG_LEFT;
4059                                         }
4060                                 }
4061                                 if (TAILQ_EMPTY(&asoc->asoc.send_queue) &&
4062                                     TAILQ_EMPTY(&asoc->asoc.sent_queue) &&
4063                                     (asoc->asoc.state & SCTP_STATE_PARTIAL_MSG_LEFT)) {
4064                                         struct mbuf *op_err;
4065                                 abort_anyway:
4066                                         op_err = sctp_generate_cause(SCTP_CAUSE_USER_INITIATED_ABT, "");
4067                                         asoc->sctp_ep->last_abort_code = SCTP_FROM_SCTP_PCB+SCTP_LOC_5;
4068                                         sctp_send_abort_tcb(asoc, op_err, SCTP_SO_LOCKED);
4069                                         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4070                                         if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_OPEN) ||
4071                                             (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4072                                                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4073                                         }
4074                                         if (sctp_free_assoc(inp, asoc,
4075                                                             SCTP_PCBFREE_NOFORCE,
4076                                                             SCTP_FROM_SCTP_PCB+SCTP_LOC_6) == 0) {
4077                                                 cnt_in_sd++;
4078                                         }
4079                                         continue;
4080                                 } else {
4081                                         sctp_chunk_output(inp, asoc, SCTP_OUTPUT_FROM_CLOSING, SCTP_SO_LOCKED);
4082                                 }
4083                         }
4084                         cnt_in_sd++;
4085                         SCTP_TCB_UNLOCK(asoc);
4086                 }
4087                 /* now is there some left in our SHUTDOWN state? */
4088                 if (cnt_in_sd) {
4089 #ifdef SCTP_LOG_CLOSING
4090                         sctp_log_closing(inp, NULL, 2);
4091 #endif
4092                         inp->sctp_socket = NULL;
4093                         SCTP_INP_WUNLOCK(inp);
4094                         SCTP_ASOC_CREATE_UNLOCK(inp);
4095                         SCTP_INP_INFO_WUNLOCK();
4096                         return;
4097                 }
4098         }
4099         inp->sctp_socket = NULL;
4100         if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) !=
4101             SCTP_PCB_FLAGS_UNBOUND) {
4102                 /*
4103                  * ok, this guy has been bound. It's port is
4104                  * somewhere in the SCTP_BASE_INFO(hash table). Remove
4105                  * it!
4106                  */
4107                 LIST_REMOVE(inp, sctp_hash);
4108                 inp->sctp_flags |= SCTP_PCB_FLAGS_UNBOUND;
4109         }
4110
4111         /* If there is a timer running to kill us,
4112          * forget it, since it may have a contest
4113          * on the INP lock.. which would cause us
4114          * to die ...
4115          */
4116         cnt = 0;
4117         LIST_FOREACH_SAFE(asoc, &inp->sctp_asoc_list, sctp_tcblist, nasoc) {
4118                 SCTP_TCB_LOCK(asoc);
4119                 if (asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
4120                         if (asoc->asoc.state & SCTP_STATE_IN_ACCEPT_QUEUE) {
4121                                 asoc->asoc.state &= ~SCTP_STATE_IN_ACCEPT_QUEUE;
4122                                 sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, asoc, NULL);
4123                         }
4124                         cnt++;
4125                         SCTP_TCB_UNLOCK(asoc);
4126                         continue;
4127                 }
4128                 /* Free associations that are NOT killing us */
4129                 if ((SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_COOKIE_WAIT) &&
4130                     ((asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0)) {
4131                         struct mbuf *op_err;
4132
4133                         op_err = sctp_generate_cause(SCTP_CAUSE_USER_INITIATED_ABT, "");
4134                         asoc->sctp_ep->last_abort_code = SCTP_FROM_SCTP_PCB+SCTP_LOC_7;
4135                         sctp_send_abort_tcb(asoc, op_err, SCTP_SO_LOCKED);
4136                         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4137                 } else if (asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
4138                         cnt++;
4139                         SCTP_TCB_UNLOCK(asoc);
4140                         continue;
4141                 }
4142                 if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_OPEN) ||
4143                     (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4144                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4145                 }
4146                 if (sctp_free_assoc(inp, asoc, SCTP_PCBFREE_FORCE, SCTP_FROM_SCTP_PCB+SCTP_LOC_8) == 0) {
4147                         cnt++;
4148                 }
4149         }
4150         if (cnt) {
4151                 /* Ok we have someone out there that will kill us */
4152                 (void)SCTP_OS_TIMER_STOP(&inp->sctp_ep.signature_change.timer);
4153 #ifdef SCTP_LOG_CLOSING
4154                 sctp_log_closing(inp, NULL, 3);
4155 #endif
4156                 SCTP_INP_WUNLOCK(inp);
4157                 SCTP_ASOC_CREATE_UNLOCK(inp);
4158                 SCTP_INP_INFO_WUNLOCK();
4159                 return;
4160         }
4161         if (SCTP_INP_LOCK_CONTENDED(inp))
4162                 being_refed++;
4163         if (SCTP_INP_READ_CONTENDED(inp))
4164                 being_refed++;
4165         if (SCTP_ASOC_CREATE_LOCK_CONTENDED(inp))
4166                 being_refed++;
4167
4168         if ((inp->refcount) ||
4169             (being_refed) ||
4170             (inp->sctp_flags & SCTP_PCB_FLAGS_CLOSE_IP)) {
4171                 (void)SCTP_OS_TIMER_STOP(&inp->sctp_ep.signature_change.timer);
4172 #ifdef SCTP_LOG_CLOSING
4173                 sctp_log_closing(inp, NULL, 4);
4174 #endif
4175                 sctp_timer_start(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL);
4176                 SCTP_INP_WUNLOCK(inp);
4177                 SCTP_ASOC_CREATE_UNLOCK(inp);
4178                 SCTP_INP_INFO_WUNLOCK();
4179                 return;
4180         }
4181         inp->sctp_ep.signature_change.type = 0;
4182         inp->sctp_flags |= SCTP_PCB_FLAGS_SOCKET_ALLGONE;
4183         /* Remove it from the list .. last thing we need a
4184          * lock for.
4185          */
4186         LIST_REMOVE(inp, sctp_list);
4187         SCTP_INP_WUNLOCK(inp);
4188         SCTP_ASOC_CREATE_UNLOCK(inp);
4189         SCTP_INP_INFO_WUNLOCK();
4190         /* Now we release all locks. Since this INP
4191          * cannot be found anymore except possibly by the
4192          * kill timer that might be running. We call
4193          * the drain function here. It should hit the case
4194          * were it sees the ACTIVE flag cleared and exit
4195          * out freeing us to proceed and destroy everything.
4196          */
4197         if (from != SCTP_CALLED_FROM_INPKILL_TIMER) {
4198                 (void)SCTP_OS_TIMER_STOP_DRAIN(&inp->sctp_ep.signature_change.timer);
4199         } else {
4200                 /* Probably un-needed */
4201                 (void)SCTP_OS_TIMER_STOP(&inp->sctp_ep.signature_change.timer);
4202         }
4203
4204 #ifdef SCTP_LOG_CLOSING
4205         sctp_log_closing(inp, NULL, 5);
4206 #endif
4207
4208 #if !(defined(__Panda__) || defined(__Windows__) || defined(__Userspace__))
4209 #if !defined(__FreeBSD__) || __FreeBSD_version < 500000
4210         rt = ip_pcb->inp_route.ro_rt;
4211 #endif
4212 #endif
4213
4214 #if defined(__Panda__)
4215         if (inp->pak_to_read) {
4216                 (void)SCTP_OS_TIMER_STOP(&inp->sctp_ep.zero_copy_timer.timer);
4217                 SCTP_RELEASE_PKT(inp->pak_to_read);
4218                 inp->pak_to_read = NULL;
4219         }
4220         if (inp->pak_to_read_sendq) {
4221                 (void)SCTP_OS_TIMER_STOP(&inp->sctp_ep.zero_copy_sendq_timer.timer);
4222                 SCTP_RELEASE_PKT(inp->pak_to_read_sendq);
4223                 inp->pak_to_read_sendq = NULL;
4224         }
4225 #endif
4226         if ((inp->sctp_asocidhash) != NULL) {
4227                 SCTP_HASH_FREE(inp->sctp_asocidhash, inp->hashasocidmark);
4228                 inp->sctp_asocidhash = NULL;
4229         }
4230         /*sa_ignore FREED_MEMORY*/
4231         TAILQ_FOREACH_SAFE(sq, &inp->read_queue, next, nsq) {
4232                 /* Its only abandoned if it had data left */
4233                 if (sq->length)
4234                         SCTP_STAT_INCR(sctps_left_abandon);
4235
4236                 TAILQ_REMOVE(&inp->read_queue, sq, next);
4237                 sctp_free_remote_addr(sq->whoFrom);
4238                 if (so)
4239                         so->so_rcv.sb_cc -= sq->length;
4240                 if (sq->data) {
4241                         sctp_m_freem(sq->data);
4242                         sq->data = NULL;
4243                 }
4244                 /*
4245                  * no need to free the net count, since at this point all
4246                  * assoc's are gone.
4247                  */
4248                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_readq), sq);
4249                 SCTP_DECR_READQ_COUNT();
4250         }
4251         /* Now the sctp_pcb things */
4252         /*
4253          * free each asoc if it is not already closed/free. we can't use the
4254          * macro here since le_next will get freed as part of the
4255          * sctp_free_assoc() call.
4256          */
4257         if (so) {
4258 #ifdef IPSEC
4259                 ipsec_delete_pcbpolicy(ip_pcb);
4260 #endif                          /* IPSEC */
4261
4262                 /* Unlocks not needed since the socket is gone now */
4263         }
4264 #ifndef __Panda__
4265         if (ip_pcb->inp_options) {
4266                 (void)sctp_m_free(ip_pcb->inp_options);
4267                 ip_pcb->inp_options = 0;
4268         }
4269 #endif
4270
4271 #if !(defined(__Panda__) || defined(__Windows__) || defined(__Userspace__))
4272 #if !defined(__FreeBSD__) || __FreeBSD_version < 500000
4273         if (rt) {
4274                 RTFREE(rt);
4275                 ip_pcb->inp_route.ro_rt = 0;
4276         }
4277 #endif
4278 #if defined(__FreeBSD__) && __FreeBSD_version < 803000
4279 #ifdef INET
4280         if (ip_pcb->inp_moptions) {
4281                 inp_freemoptions(ip_pcb->inp_moptions);
4282                 ip_pcb->inp_moptions = 0;
4283         }
4284 #endif
4285 #endif
4286 #endif
4287
4288 #ifdef INET6
4289 #if !(defined(__Panda__) || defined(__Windows__) || defined(__Userspace__))
4290 #if defined(__FreeBSD__) || defined(__APPLE__)
4291         if (ip_pcb->inp_vflag & INP_IPV6) {
4292 #else
4293         if (inp->inp_vflag & INP_IPV6) {
4294 #endif
4295                 struct in6pcb *in6p;
4296
4297                 in6p = (struct in6pcb *)inp;
4298                 ip6_freepcbopts(in6p->in6p_outputopts);
4299         }
4300 #endif
4301 #endif                          /* INET6 */
4302 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__Windows__) || defined(__Userspace__))
4303         inp->inp_vflag = 0;
4304 #else
4305         ip_pcb->inp_vflag = 0;
4306 #endif
4307         /* free up authentication fields */
4308         if (inp->sctp_ep.local_auth_chunks != NULL)
4309                 sctp_free_chunklist(inp->sctp_ep.local_auth_chunks);
4310         if (inp->sctp_ep.local_hmacs != NULL)
4311                 sctp_free_hmaclist(inp->sctp_ep.local_hmacs);
4312
4313         LIST_FOREACH_SAFE(shared_key, &inp->sctp_ep.shared_keys, next, nshared_key) {
4314                 LIST_REMOVE(shared_key, next);
4315                 sctp_free_sharedkey(shared_key);
4316                 /*sa_ignore FREED_MEMORY*/
4317         }
4318
4319 #if defined(__APPLE__)
4320         inp->ip_inp.inp.inp_state = INPCB_STATE_DEAD;
4321         if (in_pcb_checkstate(&inp->ip_inp.inp, WNT_STOPUSING, 1) != WNT_STOPUSING) {
4322 #ifdef INVARIANTS
4323                 panic("sctp_inpcb_free inp = %p couldn't set to STOPUSING\n", (void *)inp);
4324 #else
4325                 SCTP_PRINTF("sctp_inpcb_free inp = %p couldn't set to STOPUSING\n", (void *)inp);
4326 #endif
4327         }
4328         inp->ip_inp.inp.inp_socket->so_flags |= SOF_PCBCLEARING;
4329 #endif
4330         /*
4331          * if we have an address list the following will free the list of
4332          * ifaddr's that are set into this ep. Again macro limitations here,
4333          * since the LIST_FOREACH could be a bad idea.
4334          */
4335         LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
4336                 sctp_remove_laddr(laddr);
4337         }
4338
4339 #ifdef SCTP_TRACK_FREED_ASOCS
4340         /* TEMP CODE */
4341         LIST_FOREACH_SAFE(asoc, &inp->sctp_asoc_free_list, sctp_tcblist, nasoc) {
4342                 LIST_REMOVE(asoc, sctp_tcblist);
4343                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asoc), asoc);
4344                 SCTP_DECR_ASOC_COUNT();
4345         }
4346         /* *** END TEMP CODE ****/
4347 #endif
4348 #ifdef SCTP_MVRF
4349         SCTP_FREE(inp->m_vrf_ids, SCTP_M_MVRF);
4350 #endif
4351         /* Now lets see about freeing the EP hash table. */
4352         if (inp->sctp_tcbhash != NULL) {
4353                 SCTP_HASH_FREE(inp->sctp_tcbhash, inp->sctp_hashmark);
4354                 inp->sctp_tcbhash = NULL;
4355         }
4356         /* Now we must put the ep memory back into the zone pool */
4357 #if defined(__FreeBSD__)
4358         crfree(inp->ip_inp.inp.inp_cred);
4359         INP_LOCK_DESTROY(&inp->ip_inp.inp);
4360 #endif
4361         SCTP_INP_LOCK_DESTROY(inp);
4362         SCTP_INP_READ_DESTROY(inp);
4363         SCTP_ASOC_CREATE_LOCK_DESTROY(inp);
4364 #if !defined(__APPLE__)
4365         SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_ep), inp);
4366         SCTP_DECR_EP_COUNT();
4367 #else
4368         /* For Tiger, we will do this later... */
4369 #endif
4370 }
4371
4372
4373 struct sctp_nets *
4374 sctp_findnet(struct sctp_tcb *stcb, struct sockaddr *addr)
4375 {
4376         struct sctp_nets *net;
4377         /* locate the address */
4378         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
4379                 if (sctp_cmpaddr(addr, (struct sockaddr *)&net->ro._l_addr))
4380                         return (net);
4381         }
4382         return (NULL);
4383 }
4384
4385
4386 int
4387 sctp_is_address_on_local_host(struct sockaddr *addr, uint32_t vrf_id)
4388 {
4389 #ifdef __Panda__
4390         return (0);
4391 #else
4392         struct sctp_ifa *sctp_ifa;
4393         sctp_ifa = sctp_find_ifa_by_addr(addr, vrf_id, SCTP_ADDR_NOT_LOCKED);
4394         if (sctp_ifa) {
4395                 return (1);
4396         } else {
4397                 return (0);
4398         }
4399 #endif
4400 }
4401
4402 /*
4403  * add's a remote endpoint address, done with the INIT/INIT-ACK as well as
4404  * when a ASCONF arrives that adds it. It will also initialize all the cwnd
4405  * stats of stuff.
4406  */
4407 int
4408 sctp_add_remote_addr(struct sctp_tcb *stcb, struct sockaddr *newaddr,
4409     struct sctp_nets **netp, int set_scope, int from)
4410 {
4411         /*
4412          * The following is redundant to the same lines in the
4413          * sctp_aloc_assoc() but is needed since others call the add
4414          * address function
4415          */
4416         struct sctp_nets *net, *netfirst;
4417         int addr_inscope;
4418
4419         SCTPDBG(SCTP_DEBUG_PCB1, "Adding an address (from:%d) to the peer: ",
4420                 from);
4421         SCTPDBG_ADDR(SCTP_DEBUG_PCB1, newaddr);
4422
4423         netfirst = sctp_findnet(stcb, newaddr);
4424         if (netfirst) {
4425                 /*
4426                  * Lie and return ok, we don't want to make the association
4427                  * go away for this behavior. It will happen in the TCP
4428                  * model in a connected socket. It does not reach the hash
4429                  * table until after the association is built so it can't be
4430                  * found. Mark as reachable, since the initial creation will
4431                  * have been cleared and the NOT_IN_ASSOC flag will have
4432                  * been added... and we don't want to end up removing it
4433                  * back out.
4434                  */
4435                 if (netfirst->dest_state & SCTP_ADDR_UNCONFIRMED) {
4436                         netfirst->dest_state = (SCTP_ADDR_REACHABLE |
4437                             SCTP_ADDR_UNCONFIRMED);
4438                 } else {
4439                         netfirst->dest_state = SCTP_ADDR_REACHABLE;
4440                 }
4441
4442                 return (0);
4443         }
4444         addr_inscope = 1;
4445         switch (newaddr->sa_family) {
4446 #ifdef INET
4447         case AF_INET:
4448         {
4449                 struct sockaddr_in *sin;
4450
4451                 sin = (struct sockaddr_in *)newaddr;
4452                 if (sin->sin_addr.s_addr == 0) {
4453                         /* Invalid address */
4454                         return (-1);
4455                 }
4456                 /* zero out the bzero area */
4457                 memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
4458
4459                 /* assure len is set */
4460 #ifdef HAVE_SIN_LEN
4461                 sin->sin_len = sizeof(struct sockaddr_in);
4462 #endif
4463                 if (set_scope) {
4464 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE
4465                         stcb->asoc.scope.ipv4_local_scope = 1;
4466 #else
4467                         if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
4468                                 stcb->asoc.scope.ipv4_local_scope = 1;
4469                         }
4470 #endif                          /* SCTP_DONT_DO_PRIVADDR_SCOPE */
4471                 } else {
4472                         /* Validate the address is in scope */
4473                         if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) &&
4474                             (stcb->asoc.scope.ipv4_local_scope == 0)) {
4475                                 addr_inscope = 0;
4476                         }
4477                 }
4478                 break;
4479         }
4480 #endif
4481 #ifdef INET6
4482         case AF_INET6:
4483         {
4484                 struct sockaddr_in6 *sin6;
4485
4486                 sin6 = (struct sockaddr_in6 *)newaddr;
4487                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
4488                         /* Invalid address */
4489                         return (-1);
4490                 }
4491                 /* assure len is set */
4492 #ifdef HAVE_SIN6_LEN
4493                 sin6->sin6_len = sizeof(struct sockaddr_in6);
4494 #endif
4495                 if (set_scope) {
4496                         if (sctp_is_address_on_local_host(newaddr, stcb->asoc.vrf_id)) {
4497                                 stcb->asoc.scope.loopback_scope = 1;
4498                                 stcb->asoc.scope.local_scope = 0;
4499                                 stcb->asoc.scope.ipv4_local_scope = 1;
4500                                 stcb->asoc.scope.site_scope = 1;
4501                         } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
4502                                 /*
4503                                  * If the new destination is a LINK_LOCAL we
4504                                  * must have common site scope. Don't set
4505                                  * the local scope since we may not share
4506                                  * all links, only loopback can do this.
4507                                  * Links on the local network would also be
4508                                  * on our private network for v4 too.
4509                                  */
4510                                 stcb->asoc.scope.ipv4_local_scope = 1;
4511                                 stcb->asoc.scope.site_scope = 1;
4512                         } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
4513                                 /*
4514                                  * If the new destination is SITE_LOCAL then
4515                                  * we must have site scope in common.
4516                                  */
4517                                 stcb->asoc.scope.site_scope = 1;
4518                         }
4519                 } else {
4520                         /* Validate the address is in scope */
4521                         if (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr) &&
4522                             (stcb->asoc.scope.loopback_scope == 0)) {
4523                                 addr_inscope = 0;
4524                         } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) &&
4525                             (stcb->asoc.scope.local_scope == 0)) {
4526                                 addr_inscope = 0;
4527                         } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr) &&
4528                             (stcb->asoc.scope.site_scope == 0)) {
4529                                 addr_inscope = 0;
4530                         }
4531                 }
4532                 break;
4533         }
4534 #endif
4535 #if defined(__Userspace__)
4536         case AF_CONN:
4537         {
4538                 struct sockaddr_conn *sconn;
4539
4540                 sconn = (struct sockaddr_conn *)newaddr;
4541                 if (sconn->sconn_addr == NULL) {
4542                         /* Invalid address */
4543                         return (-1);
4544                 }
4545 #ifdef HAVE_SCONN_LEN
4546                 sconn->sconn_len = sizeof(struct sockaddr_conn);
4547 #endif
4548                 break;
4549         }
4550 #endif
4551         default:
4552                 /* not supported family type */
4553                 return (-1);
4554         }
4555         net = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_net), struct sctp_nets);
4556         if (net == NULL) {
4557                 return (-1);
4558         }
4559         SCTP_INCR_RADDR_COUNT();
4560         bzero(net, sizeof(struct sctp_nets));
4561         (void)SCTP_GETTIME_TIMEVAL(&net->start_time);
4562 #ifdef HAVE_SA_LEN
4563         memcpy(&net->ro._l_addr, newaddr, newaddr->sa_len);
4564 #endif
4565         switch (newaddr->sa_family) {
4566 #ifdef INET
4567         case AF_INET:
4568 #ifndef HAVE_SA_LEN
4569                 memcpy(&net->ro._l_addr, newaddr, sizeof(struct sockaddr_in));
4570 #endif
4571                 ((struct sockaddr_in *)&net->ro._l_addr)->sin_port = stcb->rport;
4572                 break;
4573 #endif
4574 #ifdef INET6
4575         case AF_INET6:
4576 #ifndef HAVE_SA_LEN
4577                 memcpy(&net->ro._l_addr, newaddr, sizeof(struct sockaddr_in6));
4578 #endif
4579                 ((struct sockaddr_in6 *)&net->ro._l_addr)->sin6_port = stcb->rport;
4580                 break;
4581 #endif
4582 #if defined(__Userspace__)
4583         case AF_CONN:
4584 #ifndef HAVE_SA_LEN
4585                 memcpy(&net->ro._l_addr, newaddr, sizeof(struct sockaddr_conn));
4586 #endif
4587                 ((struct sockaddr_conn *)&net->ro._l_addr)->sconn_port = stcb->rport;
4588                 break;
4589 #endif
4590         default:
4591                 break;
4592         }
4593         net->addr_is_local = sctp_is_address_on_local_host(newaddr, stcb->asoc.vrf_id);
4594         if (net->addr_is_local && ((set_scope || (from == SCTP_ADDR_IS_CONFIRMED)))) {
4595                 stcb->asoc.scope.loopback_scope = 1;
4596                 stcb->asoc.scope.ipv4_local_scope = 1;
4597                 stcb->asoc.scope.local_scope = 0;
4598                 stcb->asoc.scope.site_scope = 1;
4599                 addr_inscope = 1;
4600         }
4601         net->failure_threshold = stcb->asoc.def_net_failure;
4602         net->pf_threshold = stcb->asoc.def_net_pf_threshold;
4603         if (addr_inscope == 0) {
4604                 net->dest_state = (SCTP_ADDR_REACHABLE |
4605                     SCTP_ADDR_OUT_OF_SCOPE);
4606         } else {
4607                 if (from == SCTP_ADDR_IS_CONFIRMED)
4608                         /* SCTP_ADDR_IS_CONFIRMED is passed by connect_x */
4609                         net->dest_state = SCTP_ADDR_REACHABLE;
4610                 else
4611                         net->dest_state = SCTP_ADDR_REACHABLE |
4612                             SCTP_ADDR_UNCONFIRMED;
4613         }
4614         /* We set this to 0, the timer code knows that
4615          * this means its an initial value
4616          */
4617         net->rto_needed = 1;
4618         net->RTO = 0;
4619         net->RTO_measured = 0;
4620         stcb->asoc.numnets++;
4621         net->ref_count = 1;
4622         net->cwr_window_tsn = net->last_cwr_tsn = stcb->asoc.sending_seq - 1;
4623         net->port = stcb->asoc.port;
4624         net->dscp = stcb->asoc.default_dscp;
4625 #ifdef INET6
4626         net->flowlabel = stcb->asoc.default_flowlabel;
4627 #endif
4628         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DONOT_HEARTBEAT)) {
4629                 net->dest_state |= SCTP_ADDR_NOHB;
4630         } else {
4631                 net->dest_state &= ~SCTP_ADDR_NOHB;
4632         }
4633         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DO_NOT_PMTUD)) {
4634                 net->dest_state |= SCTP_ADDR_NO_PMTUD;
4635         } else {
4636                 net->dest_state &= ~SCTP_ADDR_NO_PMTUD;
4637         }
4638         net->heart_beat_delay = stcb->asoc.heart_beat_delay;
4639         /* Init the timer structure */
4640         SCTP_OS_TIMER_INIT(&net->rxt_timer.timer);
4641         SCTP_OS_TIMER_INIT(&net->pmtu_timer.timer);
4642         SCTP_OS_TIMER_INIT(&net->hb_timer.timer);
4643
4644         /* Now generate a route for this guy */
4645 #ifdef INET6
4646 #ifdef SCTP_EMBEDDED_V6_SCOPE
4647         /* KAME hack: embed scopeid */
4648         if (newaddr->sa_family == AF_INET6) {
4649                 struct sockaddr_in6 *sin6;
4650
4651                 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
4652 #if defined(__APPLE__)
4653 #if defined(APPLE_LEOPARD) || defined(APPLE_SNOWLEOPARD)
4654                 (void)in6_embedscope(&sin6->sin6_addr, sin6, &stcb->sctp_ep->ip_inp.inp, NULL);
4655 #else
4656                 (void)in6_embedscope(&sin6->sin6_addr, sin6, &stcb->sctp_ep->ip_inp.inp, NULL, NULL);
4657 #endif
4658 #elif defined(SCTP_KAME)
4659                 (void)sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone));
4660 #else
4661                 (void)in6_embedscope(&sin6->sin6_addr, sin6);
4662 #endif
4663 #ifndef SCOPEDROUTING
4664                 sin6->sin6_scope_id = 0;
4665 #endif
4666         }
4667 #endif /* SCTP_EMBEDDED_V6_SCOPE */
4668 #endif
4669         SCTP_RTALLOC((sctp_route_t *)&net->ro, stcb->asoc.vrf_id);
4670
4671 #if !defined(__Userspace__)
4672         if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro)) {
4673                 /* Get source address */
4674                 net->ro._s_addr = sctp_source_address_selection(stcb->sctp_ep,
4675                                                                 stcb,
4676                                                                 (sctp_route_t *)&net->ro,
4677                                                                 net,
4678                                                                 0,
4679                                                                 stcb->asoc.vrf_id);
4680                 /* Now get the interface MTU */
4681                 if (net->ro._s_addr && net->ro._s_addr->ifn_p) {
4682                         net->mtu = SCTP_GATHER_MTU_FROM_INTFC(net->ro._s_addr->ifn_p);
4683                 }
4684                 if (net->mtu > 0) {
4685                         uint32_t rmtu;
4686
4687                         rmtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, net->ro.ro_rt);
4688                         if (rmtu == 0) {
4689                                 /* Start things off to match mtu of interface please. */
4690                                 SCTP_SET_MTU_OF_ROUTE(&net->ro._l_addr.sa,
4691                                                       net->ro.ro_rt, net->mtu);
4692                         } else {
4693                                 /* we take the route mtu over the interface, since
4694                                  * the route may be leading out the loopback, or
4695                                  * a different interface.
4696                                  */
4697                                 net->mtu = rmtu;
4698                         }
4699                 }
4700         }
4701 #endif
4702         if (net->mtu == 0) {
4703                 switch (newaddr->sa_family) {
4704 #ifdef INET
4705                 case AF_INET:
4706                         net->mtu = SCTP_DEFAULT_MTU;
4707                         break;
4708 #endif
4709 #ifdef INET6
4710                 case AF_INET6:
4711                         net->mtu = 1280;
4712                         break;
4713 #endif
4714 #if defined(__Userspace__)
4715                 case AF_CONN:
4716                         net->mtu = 1280;
4717                         break;
4718 #endif
4719                 default:
4720                         break;
4721                 }
4722         }
4723 #if defined INET || defined INET6
4724         if (net->port) {
4725                 net->mtu -= (uint32_t)sizeof(struct udphdr);
4726         }
4727 #endif
4728         if (from == SCTP_ALLOC_ASOC) {
4729                 stcb->asoc.smallest_mtu = net->mtu;
4730         }
4731         if (stcb->asoc.smallest_mtu > net->mtu) {
4732                 stcb->asoc.smallest_mtu = net->mtu;
4733         }
4734 #ifdef INET6
4735 #ifdef SCTP_EMBEDDED_V6_SCOPE
4736         if (newaddr->sa_family == AF_INET6) {
4737                 struct sockaddr_in6 *sin6;
4738
4739                 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
4740 #ifdef SCTP_KAME
4741                 (void)sa6_recoverscope(sin6);
4742 #else
4743                 (void)in6_recoverscope(sin6, &sin6->sin6_addr, NULL);
4744 #endif /* SCTP_KAME */
4745         }
4746 #endif /* SCTP_EMBEDDED_V6_SCOPE */
4747 #endif
4748
4749         /* JRS - Use the congestion control given in the CC module */
4750         if (stcb->asoc.cc_functions.sctp_set_initial_cc_param != NULL)
4751                 (*stcb->asoc.cc_functions.sctp_set_initial_cc_param)(stcb, net);
4752
4753         /*
4754          * CMT: CUC algo - set find_pseudo_cumack to TRUE (1) at beginning
4755          * of assoc (2005/06/27, iyengar@cis.udel.edu)
4756          */
4757         net->find_pseudo_cumack = 1;
4758         net->find_rtx_pseudo_cumack = 1;
4759         net->src_addr_selected = 0;
4760 #if defined(__FreeBSD__)
4761         /* Choose an initial flowid. */
4762         net->flowid = stcb->asoc.my_vtag ^
4763                       ntohs(stcb->rport) ^
4764                       ntohs(stcb->sctp_ep->sctp_lport);
4765 #ifdef INVARIANTS
4766         net->flowidset = 1;
4767 #endif
4768 #endif
4769         if (netp) {
4770                 *netp = net;
4771         }
4772         netfirst = TAILQ_FIRST(&stcb->asoc.nets);
4773         if (net->ro.ro_rt == NULL) {
4774                 /* Since we have no route put it at the back */
4775                 TAILQ_INSERT_TAIL(&stcb->asoc.nets, net, sctp_next);
4776         } else if (netfirst == NULL) {
4777                 /* We are the first one in the pool. */
4778                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
4779         } else if (netfirst->ro.ro_rt == NULL) {
4780                 /*
4781                  * First one has NO route. Place this one ahead of the first
4782                  * one.
4783                  */
4784                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
4785 #ifndef __Panda__
4786         } else if (net->ro.ro_rt->rt_ifp != netfirst->ro.ro_rt->rt_ifp) {
4787                 /*
4788                  * This one has a different interface than the one at the
4789                  * top of the list. Place it ahead.
4790                  */
4791                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
4792 #endif
4793         } else {
4794                 /*
4795                  * Ok we have the same interface as the first one. Move
4796                  * forward until we find either a) one with a NULL route...
4797                  * insert ahead of that b) one with a different ifp.. insert
4798                  * after that. c) end of the list.. insert at the tail.
4799                  */
4800                 struct sctp_nets *netlook;
4801
4802                 do {
4803                         netlook = TAILQ_NEXT(netfirst, sctp_next);
4804                         if (netlook == NULL) {
4805                                 /* End of the list */
4806                                 TAILQ_INSERT_TAIL(&stcb->asoc.nets, net, sctp_next);
4807                                 break;
4808                         } else if (netlook->ro.ro_rt == NULL) {
4809                                 /* next one has NO route */
4810                                 TAILQ_INSERT_BEFORE(netfirst, net, sctp_next);
4811                                 break;
4812                         }
4813 #ifndef __Panda__
4814                         else if (netlook->ro.ro_rt->rt_ifp != net->ro.ro_rt->rt_ifp)
4815 #else
4816                         else
4817 #endif
4818                         {
4819                                 TAILQ_INSERT_AFTER(&stcb->asoc.nets, netlook,
4820                                                    net, sctp_next);
4821                                 break;
4822                         }
4823 #ifndef __Panda__
4824                         /* Shift forward */
4825                         netfirst = netlook;
4826 #endif
4827                 } while (netlook != NULL);
4828         }
4829
4830         /* got to have a primary set */
4831         if (stcb->asoc.primary_destination == 0) {
4832                 stcb->asoc.primary_destination = net;
4833         } else if ((stcb->asoc.primary_destination->ro.ro_rt == NULL) &&
4834                     (net->ro.ro_rt) &&
4835             ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0)) {
4836                 /* No route to current primary adopt new primary */
4837                 stcb->asoc.primary_destination = net;
4838         }
4839         /* Validate primary is first */
4840         net = TAILQ_FIRST(&stcb->asoc.nets);
4841         if ((net != stcb->asoc.primary_destination) &&
4842             (stcb->asoc.primary_destination)) {
4843                 /* first one on the list is NOT the primary
4844                  * sctp_cmpaddr() is much more efficient if
4845                  * the primary is the first on the list, make it
4846                  * so.
4847                  */
4848                 TAILQ_REMOVE(&stcb->asoc.nets,
4849                              stcb->asoc.primary_destination, sctp_next);
4850                 TAILQ_INSERT_HEAD(&stcb->asoc.nets,
4851                                   stcb->asoc.primary_destination, sctp_next);
4852         }
4853         return (0);
4854 }
4855
4856
4857 static uint32_t
4858 sctp_aloc_a_assoc_id(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
4859 {
4860         uint32_t id;
4861         struct sctpasochead *head;
4862         struct sctp_tcb *lstcb;
4863
4864         SCTP_INP_WLOCK(inp);
4865  try_again:
4866         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
4867                 /* TSNH */
4868                 SCTP_INP_WUNLOCK(inp);
4869                 return (0);
4870         }
4871         /*
4872          * We don't allow assoc id to be one of SCTP_FUTURE_ASSOC,
4873          * SCTP_CURRENT_ASSOC and SCTP_ALL_ASSOC.
4874          */
4875         if (inp->sctp_associd_counter <= SCTP_ALL_ASSOC) {
4876                 inp->sctp_associd_counter = SCTP_ALL_ASSOC + 1;
4877         }
4878         id = inp->sctp_associd_counter;
4879         inp->sctp_associd_counter++;
4880         lstcb = sctp_findasoc_ep_asocid_locked(inp, (sctp_assoc_t)id, 0);
4881         if (lstcb) {
4882                 goto try_again;
4883         }
4884         head = &inp->sctp_asocidhash[SCTP_PCBHASH_ASOC(id, inp->hashasocidmark)];
4885         LIST_INSERT_HEAD(head, stcb, sctp_tcbasocidhash);
4886         stcb->asoc.in_asocid_hash = 1;
4887         SCTP_INP_WUNLOCK(inp);
4888         return id;
4889 }
4890
4891 /*
4892  * allocate an association and add it to the endpoint. The caller must be
4893  * careful to add all additional addresses once they are know right away or
4894  * else the assoc will be may experience a blackout scenario.
4895  */
4896 struct sctp_tcb *
4897 sctp_aloc_assoc(struct sctp_inpcb *inp, struct sockaddr *firstaddr,
4898                 int *error, uint32_t override_tag, uint32_t vrf_id,
4899 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
4900                 struct thread *p
4901 #elif defined(__Windows__)
4902                 PKTHREAD p
4903 #else
4904 #if defined(__Userspace__)
4905                 /*  __Userspace__ NULL proc is going to be passed here. See sctp_lower_sosend */
4906 #endif
4907                 struct proc *p
4908 #endif
4909 )
4910 {
4911         /* note the p argument is only valid in unbound sockets */
4912
4913         struct sctp_tcb *stcb;
4914         struct sctp_association *asoc;
4915         struct sctpasochead *head;
4916         uint16_t rport;
4917         int err;
4918
4919         /*
4920          * Assumption made here: Caller has done a
4921          * sctp_findassociation_ep_addr(ep, addr's); to make sure the
4922          * address does not exist already.
4923          */
4924         if (SCTP_BASE_INFO(ipi_count_asoc) >= SCTP_MAX_NUM_OF_ASOC) {
4925                 /* Hit max assoc, sorry no more */
4926                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOBUFS);
4927                 *error = ENOBUFS;
4928                 return (NULL);
4929         }
4930         if (firstaddr == NULL) {
4931                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
4932                 *error = EINVAL;
4933                 return (NULL);
4934         }
4935         SCTP_INP_RLOCK(inp);
4936         if ((inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) &&
4937             ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_PORTREUSE)) ||
4938              (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
4939                 /*
4940                  * If its in the TCP pool, its NOT allowed to create an
4941                  * association. The parent listener needs to call
4942                  * sctp_aloc_assoc.. or the one-2-many socket. If a peeled
4943                  * off, or connected one does this.. its an error.
4944                  */
4945                 SCTP_INP_RUNLOCK(inp);
4946                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
4947                 *error = EINVAL;
4948                 return (NULL);
4949         }
4950         if ((inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
4951             (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
4952                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) ||
4953                     (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED)) {
4954                         SCTP_INP_RUNLOCK(inp);
4955                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
4956                         *error = EINVAL;
4957                         return (NULL);
4958                 }
4959         }
4960         SCTPDBG(SCTP_DEBUG_PCB3, "Allocate an association for peer:");
4961 #ifdef SCTP_DEBUG
4962         if (firstaddr) {
4963                 SCTPDBG_ADDR(SCTP_DEBUG_PCB3, firstaddr);
4964                 switch (firstaddr->sa_family) {
4965 #ifdef INET
4966                 case AF_INET:
4967                         SCTPDBG(SCTP_DEBUG_PCB3, "Port:%d\n",
4968                                 ntohs(((struct sockaddr_in *)firstaddr)->sin_port));
4969                         break;
4970 #endif
4971 #ifdef INET6
4972                 case AF_INET6:
4973                         SCTPDBG(SCTP_DEBUG_PCB3, "Port:%d\n",
4974                                 ntohs(((struct sockaddr_in6 *)firstaddr)->sin6_port));
4975                         break;
4976 #endif
4977 #if defined(__Userspace__)
4978                 case AF_CONN:
4979                         SCTPDBG(SCTP_DEBUG_PCB3, "Port:%d\n",
4980                                 ntohs(((struct sockaddr_conn *)firstaddr)->sconn_port));
4981                         break;
4982 #endif
4983                 default:
4984                         break;
4985                 }
4986         } else {
4987                 SCTPDBG(SCTP_DEBUG_PCB3,"None\n");
4988         }
4989 #endif                          /* SCTP_DEBUG */
4990         switch (firstaddr->sa_family) {
4991 #ifdef INET
4992         case AF_INET:
4993         {
4994                 struct sockaddr_in *sin;
4995
4996                 sin = (struct sockaddr_in *)firstaddr;
4997                 if ((ntohs(sin->sin_port) == 0) ||
4998                     (sin->sin_addr.s_addr == INADDR_ANY) ||
4999                     (sin->sin_addr.s_addr == INADDR_BROADCAST) ||
5000                     IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
5001                         /* Invalid address */
5002                         SCTP_INP_RUNLOCK(inp);
5003                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
5004                         *error = EINVAL;
5005                         return (NULL);
5006                 }
5007                 rport = sin->sin_port;
5008                 break;
5009         }
5010 #endif
5011 #ifdef INET6
5012         case AF_INET6:
5013         {
5014                 struct sockaddr_in6 *sin6;
5015
5016                 sin6 = (struct sockaddr_in6 *)firstaddr;
5017                 if ((ntohs(sin6->sin6_port) == 0) ||
5018                     IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
5019                     IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
5020                         /* Invalid address */
5021                         SCTP_INP_RUNLOCK(inp);
5022                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
5023                         *error = EINVAL;
5024                         return (NULL);
5025                 }
5026                 rport = sin6->sin6_port;
5027                 break;
5028         }
5029 #endif
5030 #if defined(__Userspace__)
5031         case AF_CONN:
5032         {
5033                 struct sockaddr_conn *sconn;
5034
5035                 sconn = (struct sockaddr_conn *)firstaddr;
5036                 if ((ntohs(sconn->sconn_port) == 0) ||
5037                     (sconn->sconn_addr == NULL)) {
5038                         /* Invalid address */
5039                         SCTP_INP_RUNLOCK(inp);
5040                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
5041                         *error = EINVAL;
5042                         return (NULL);
5043                 }
5044                 rport = sconn->sconn_port;
5045                 break;
5046         }
5047 #endif
5048         default:
5049                 /* not supported family type */
5050                 SCTP_INP_RUNLOCK(inp);
5051                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
5052                 *error = EINVAL;
5053                 return (NULL);
5054         }
5055         SCTP_INP_RUNLOCK(inp);
5056         if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
5057                 /*
5058                  * If you have not performed a bind, then we need to do the
5059                  * ephemeral bind for you.
5060                  */
5061                 if ((err = sctp_inpcb_bind(inp->sctp_socket,
5062                     (struct sockaddr *)NULL,
5063                     (struct sctp_ifa *)NULL,
5064 #ifndef __Panda__
5065                                            p
5066 #else
5067                                            (struct proc *)NULL
5068 #endif
5069                     ))) {
5070                         /* bind error, probably perm */
5071                         *error = err;
5072                         return (NULL);
5073                 }
5074         }
5075         stcb = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asoc), struct sctp_tcb);
5076         if (stcb == NULL) {
5077                 /* out of memory? */
5078                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOMEM);
5079                 *error = ENOMEM;
5080                 return (NULL);
5081         }
5082         SCTP_INCR_ASOC_COUNT();
5083
5084         bzero(stcb, sizeof(*stcb));
5085         asoc = &stcb->asoc;
5086
5087         asoc->assoc_id = sctp_aloc_a_assoc_id(inp, stcb);
5088         SCTP_TCB_LOCK_INIT(stcb);
5089         SCTP_TCB_SEND_LOCK_INIT(stcb);
5090         stcb->rport = rport;
5091         /* setup back pointer's */
5092         stcb->sctp_ep = inp;
5093         stcb->sctp_socket = inp->sctp_socket;
5094         if ((err = sctp_init_asoc(inp, stcb, override_tag, vrf_id))) {
5095                 /* failed */
5096                 SCTP_TCB_LOCK_DESTROY(stcb);
5097                 SCTP_TCB_SEND_LOCK_DESTROY(stcb);
5098                 LIST_REMOVE(stcb, sctp_tcbasocidhash);
5099                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asoc), stcb);
5100                 SCTP_DECR_ASOC_COUNT();
5101                 *error = err;
5102                 return (NULL);
5103         }
5104         /* and the port */
5105         SCTP_INP_INFO_WLOCK();
5106         SCTP_INP_WLOCK(inp);
5107         if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE | SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5108                 /* inpcb freed while alloc going on */
5109                 SCTP_TCB_LOCK_DESTROY(stcb);
5110                 SCTP_TCB_SEND_LOCK_DESTROY(stcb);
5111                 LIST_REMOVE(stcb, sctp_tcbasocidhash);
5112                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asoc), stcb);
5113                 SCTP_INP_WUNLOCK(inp);
5114                 SCTP_INP_INFO_WUNLOCK();
5115                 SCTP_DECR_ASOC_COUNT();
5116                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
5117                 *error = EINVAL;
5118                 return (NULL);
5119         }
5120         SCTP_TCB_LOCK(stcb);
5121
5122         /* now that my_vtag is set, add it to the hash */
5123         head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
5124         /* put it in the bucket in the vtag hash of assoc's for the system */
5125         LIST_INSERT_HEAD(head, stcb, sctp_asocs);
5126         SCTP_INP_INFO_WUNLOCK();
5127
5128         if ((err = sctp_add_remote_addr(stcb, firstaddr, NULL, SCTP_DO_SETSCOPE, SCTP_ALLOC_ASOC))) {
5129                 /* failure.. memory error? */
5130                 if (asoc->strmout) {
5131                         SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
5132                         asoc->strmout = NULL;
5133                 }
5134                 if (asoc->mapping_array) {
5135                         SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
5136                         asoc->mapping_array = NULL;
5137                 }
5138                 if (asoc->nr_mapping_array) {
5139                         SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
5140                         asoc->nr_mapping_array = NULL;
5141                 }
5142                 SCTP_DECR_ASOC_COUNT();
5143                 SCTP_TCB_UNLOCK(stcb);
5144                 SCTP_TCB_LOCK_DESTROY(stcb);
5145                 SCTP_TCB_SEND_LOCK_DESTROY(stcb);
5146                 LIST_REMOVE(stcb, sctp_tcbasocidhash);
5147                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asoc), stcb);
5148                 SCTP_INP_WUNLOCK(inp);
5149                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOBUFS);
5150                 *error = ENOBUFS;
5151                 return (NULL);
5152         }
5153         /* Init all the timers */
5154         SCTP_OS_TIMER_INIT(&asoc->dack_timer.timer);
5155         SCTP_OS_TIMER_INIT(&asoc->strreset_timer.timer);
5156         SCTP_OS_TIMER_INIT(&asoc->asconf_timer.timer);
5157         SCTP_OS_TIMER_INIT(&asoc->shut_guard_timer.timer);
5158         SCTP_OS_TIMER_INIT(&asoc->autoclose_timer.timer);
5159         SCTP_OS_TIMER_INIT(&asoc->delayed_event_timer.timer);
5160         SCTP_OS_TIMER_INIT(&asoc->delete_prim_timer.timer);
5161
5162         LIST_INSERT_HEAD(&inp->sctp_asoc_list, stcb, sctp_tcblist);
5163         /* now file the port under the hash as well */
5164         if (inp->sctp_tcbhash != NULL) {
5165                 head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(stcb->rport,
5166                     inp->sctp_hashmark)];
5167                 LIST_INSERT_HEAD(head, stcb, sctp_tcbhash);
5168         }
5169         SCTP_INP_WUNLOCK(inp);
5170         SCTPDBG(SCTP_DEBUG_PCB1, "Association %p now allocated\n", (void *)stcb);
5171         return (stcb);
5172 }
5173
5174
5175 void
5176 sctp_remove_net(struct sctp_tcb *stcb, struct sctp_nets *net)
5177 {
5178         struct sctp_association *asoc;
5179
5180         asoc = &stcb->asoc;
5181         asoc->numnets--;
5182         TAILQ_REMOVE(&asoc->nets, net, sctp_next);
5183         if (net == asoc->primary_destination) {
5184                 /* Reset primary */
5185                 struct sctp_nets *lnet;
5186
5187                 lnet = TAILQ_FIRST(&asoc->nets);
5188                 /* Mobility adaptation
5189                    Ideally, if deleted destination is the primary, it becomes
5190                    a fast retransmission trigger by the subsequent SET PRIMARY.
5191                    (by micchie)
5192                  */
5193                 if (sctp_is_mobility_feature_on(stcb->sctp_ep,
5194                                                 SCTP_MOBILITY_BASE) ||
5195                     sctp_is_mobility_feature_on(stcb->sctp_ep,
5196                                                 SCTP_MOBILITY_FASTHANDOFF)) {
5197                         SCTPDBG(SCTP_DEBUG_ASCONF1, "remove_net: primary dst is deleting\n");
5198                         if (asoc->deleted_primary != NULL) {
5199                                 SCTPDBG(SCTP_DEBUG_ASCONF1, "remove_net: deleted primary may be already stored\n");
5200                                 goto out;
5201                         }
5202                         asoc->deleted_primary = net;
5203                         atomic_add_int(&net->ref_count, 1);
5204                         memset(&net->lastsa, 0, sizeof(net->lastsa));
5205                         memset(&net->lastsv, 0, sizeof(net->lastsv));
5206                         sctp_mobility_feature_on(stcb->sctp_ep,
5207                                                  SCTP_MOBILITY_PRIM_DELETED);
5208                         sctp_timer_start(SCTP_TIMER_TYPE_PRIM_DELETED,
5209                                          stcb->sctp_ep, stcb, NULL);
5210                 }
5211 out:
5212                 /* Try to find a confirmed primary */
5213                 asoc->primary_destination = sctp_find_alternate_net(stcb, lnet, 0);
5214         }
5215         if (net == asoc->last_data_chunk_from) {
5216                 /* Reset primary */
5217                 asoc->last_data_chunk_from = TAILQ_FIRST(&asoc->nets);
5218         }
5219         if (net == asoc->last_control_chunk_from) {
5220                 /* Clear net */
5221                 asoc->last_control_chunk_from = NULL;
5222         }
5223         if (net == stcb->asoc.alternate) {
5224                 sctp_free_remote_addr(stcb->asoc.alternate);
5225                 stcb->asoc.alternate = NULL;
5226         }
5227         sctp_free_remote_addr(net);
5228 }
5229
5230 /*
5231  * remove a remote endpoint address from an association, it will fail if the
5232  * address does not exist.
5233  */
5234 int
5235 sctp_del_remote_addr(struct sctp_tcb *stcb, struct sockaddr *remaddr)
5236 {
5237         /*
5238          * Here we need to remove a remote address. This is quite simple, we
5239          * first find it in the list of address for the association
5240          * (tasoc->asoc.nets) and then if it is there, we do a LIST_REMOVE
5241          * on that item. Note we do not allow it to be removed if there are
5242          * no other addresses.
5243          */
5244         struct sctp_association *asoc;
5245         struct sctp_nets *net, *nnet;
5246
5247         asoc = &stcb->asoc;
5248
5249         /* locate the address */
5250         TAILQ_FOREACH_SAFE(net, &asoc->nets, sctp_next, nnet) {
5251                 if (net->ro._l_addr.sa.sa_family != remaddr->sa_family) {
5252                         continue;
5253                 }
5254                 if (sctp_cmpaddr((struct sockaddr *)&net->ro._l_addr,
5255                     remaddr)) {
5256                         /* we found the guy */
5257                         if (asoc->numnets < 2) {
5258                                 /* Must have at LEAST two remote addresses */
5259                                 return (-1);
5260                         } else {
5261                                 sctp_remove_net(stcb, net);
5262                                 return (0);
5263                         }
5264                 }
5265         }
5266         /* not found. */
5267         return (-2);
5268 }
5269
5270 void
5271 sctp_delete_from_timewait(uint32_t tag, uint16_t lport, uint16_t rport)
5272 {
5273         struct sctpvtaghead *chain;
5274         struct sctp_tagblock *twait_block;
5275         int found = 0;
5276         int i;
5277
5278         chain = &SCTP_BASE_INFO(vtag_timewait)[(tag % SCTP_STACK_VTAG_HASH_SIZE)];
5279         LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) {
5280                 for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) {
5281                   if ((twait_block->vtag_block[i].v_tag == tag) &&
5282                       (twait_block->vtag_block[i].lport == lport) &&
5283                       (twait_block->vtag_block[i].rport == rport)) {
5284                                 twait_block->vtag_block[i].tv_sec_at_expire = 0;
5285                                 twait_block->vtag_block[i].v_tag = 0;
5286                                 twait_block->vtag_block[i].lport = 0;
5287                                 twait_block->vtag_block[i].rport = 0;
5288                                 found = 1;
5289                                 break;
5290                         }
5291                 }
5292                 if (found)
5293                         break;
5294         }
5295 }
5296
5297 int
5298 sctp_is_in_timewait(uint32_t tag, uint16_t lport, uint16_t rport)
5299 {
5300         struct sctpvtaghead *chain;
5301         struct sctp_tagblock *twait_block;
5302         int found = 0;
5303         int i;
5304
5305         SCTP_INP_INFO_WLOCK();
5306         chain = &SCTP_BASE_INFO(vtag_timewait)[(tag % SCTP_STACK_VTAG_HASH_SIZE)];
5307         LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) {
5308                 for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) {
5309                         if ((twait_block->vtag_block[i].v_tag == tag)  &&
5310                             (twait_block->vtag_block[i].lport == lport)  &&
5311                             (twait_block->vtag_block[i].rport == rport)) {
5312                                 found = 1;
5313                                 break;
5314                         }
5315                 }
5316                 if (found)
5317                         break;
5318         }
5319         SCTP_INP_INFO_WUNLOCK();
5320         return (found);
5321 }
5322
5323
5324 void
5325 sctp_add_vtag_to_timewait(uint32_t tag, uint32_t time, uint16_t lport, uint16_t rport)
5326 {
5327         struct sctpvtaghead *chain;
5328         struct sctp_tagblock *twait_block;
5329         struct timeval now;
5330         int set, i;
5331
5332         if (time == 0) {
5333                 /* Its disabled */
5334                 return;
5335         }
5336         (void)SCTP_GETTIME_TIMEVAL(&now);
5337         chain = &SCTP_BASE_INFO(vtag_timewait)[(tag % SCTP_STACK_VTAG_HASH_SIZE)];
5338         set = 0;
5339         LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) {
5340                 /* Block(s) present, lets find space, and expire on the fly */
5341                 for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) {
5342                         if ((twait_block->vtag_block[i].v_tag == 0) &&
5343                             !set) {
5344                                 twait_block->vtag_block[i].tv_sec_at_expire =
5345                                         now.tv_sec + time;
5346                                 twait_block->vtag_block[i].v_tag = tag;
5347                                 twait_block->vtag_block[i].lport = lport;
5348                                 twait_block->vtag_block[i].rport = rport;
5349                                 set = 1;
5350                         } else if ((twait_block->vtag_block[i].v_tag) &&
5351                                     ((long)twait_block->vtag_block[i].tv_sec_at_expire < now.tv_sec)) {
5352                                 /* Audit expires this guy */
5353                                 twait_block->vtag_block[i].tv_sec_at_expire = 0;
5354                                 twait_block->vtag_block[i].v_tag = 0;
5355                                 twait_block->vtag_block[i].lport = 0;
5356                                 twait_block->vtag_block[i].rport = 0;
5357                                 if (set == 0) {
5358                                         /* Reuse it for my new tag */
5359                                         twait_block->vtag_block[i].tv_sec_at_expire = now.tv_sec + time;
5360                                         twait_block->vtag_block[i].v_tag = tag;
5361                                         twait_block->vtag_block[i].lport = lport;
5362                                         twait_block->vtag_block[i].rport = rport;
5363                                         set = 1;
5364                                 }
5365                         }
5366                 }
5367                 if (set) {
5368                         /*
5369                          * We only do up to the block where we can
5370                          * place our tag for audits
5371                          */
5372                         break;
5373                 }
5374         }
5375         /* Need to add a new block to chain */
5376         if (!set) {
5377                 SCTP_MALLOC(twait_block, struct sctp_tagblock *,
5378                     sizeof(struct sctp_tagblock), SCTP_M_TIMW);
5379                 if (twait_block == NULL) {
5380 #ifdef INVARIANTS
5381                         panic("Can not alloc tagblock");
5382 #endif
5383                         return;
5384                 }
5385                 memset(twait_block, 0, sizeof(struct sctp_tagblock));
5386                 LIST_INSERT_HEAD(chain, twait_block, sctp_nxt_tagblock);
5387                 twait_block->vtag_block[0].tv_sec_at_expire = now.tv_sec + time;
5388                 twait_block->vtag_block[0].v_tag = tag;
5389                 twait_block->vtag_block[0].lport = lport;
5390                 twait_block->vtag_block[0].rport = rport;
5391         }
5392 }
5393
5394
5395 #ifdef __Panda__
5396 void panda_wakeup_socket(struct socket *so);
5397 #endif
5398
5399 /*-
5400  * Free the association after un-hashing the remote port. This
5401  * function ALWAYS returns holding NO LOCK on the stcb. It DOES
5402  * expect that the input to this function IS a locked TCB.
5403  * It will return 0, if it did NOT destroy the association (instead
5404  * it unlocks it. It will return NON-zero if it either destroyed the
5405  * association OR the association is already destroyed.
5406  */
5407 int
5408 sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfree, int from_location)
5409 {
5410         int i;
5411         struct sctp_association *asoc;
5412         struct sctp_nets *net, *nnet;
5413         struct sctp_laddr *laddr, *naddr;
5414         struct sctp_tmit_chunk *chk, *nchk;
5415         struct sctp_asconf_addr *aparam, *naparam;
5416         struct sctp_asconf_ack *aack, *naack;
5417         struct sctp_stream_reset_list *strrst, *nstrrst;
5418         struct sctp_queued_to_read *sq, *nsq;
5419         struct sctp_stream_queue_pending *sp, *nsp;
5420         sctp_sharedkey_t *shared_key, *nshared_key;
5421         struct socket *so;
5422
5423         /* first, lets purge the entry from the hash table. */
5424 #if defined(__APPLE__)
5425         sctp_lock_assert(SCTP_INP_SO(inp));
5426 #endif
5427
5428 #ifdef SCTP_LOG_CLOSING
5429         sctp_log_closing(inp, stcb, 6);
5430 #endif
5431         if (stcb->asoc.state == 0) {
5432 #ifdef SCTP_LOG_CLOSING
5433                 sctp_log_closing(inp, NULL, 7);
5434 #endif
5435                 /* there is no asoc, really TSNH :-0 */
5436                 return (1);
5437         }
5438         if (stcb->asoc.alternate) {
5439                 sctp_free_remote_addr(stcb->asoc.alternate);
5440                 stcb->asoc.alternate = NULL;
5441         }
5442 #if !defined(__APPLE__) /* TEMP: moved to below */
5443         /* TEMP CODE */
5444         if (stcb->freed_from_where == 0) {
5445                 /* Only record the first place free happened from */
5446                 stcb->freed_from_where = from_location;
5447         }
5448         /* TEMP CODE */
5449 #endif
5450
5451         asoc = &stcb->asoc;
5452         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
5453             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE))
5454                 /* nothing around */
5455                 so = NULL;
5456         else
5457                 so = inp->sctp_socket;
5458
5459         /*
5460          * We used timer based freeing if a reader or writer is in the way.
5461          * So we first check if we are actually being called from a timer,
5462          * if so we abort early if a reader or writer is still in the way.
5463          */
5464         if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) &&
5465             (from_inpcbfree == SCTP_NORMAL_PROC)) {
5466                 /*
5467                  * is it the timer driving us? if so are the reader/writers
5468                  * gone?
5469                  */
5470                 if (stcb->asoc.refcnt) {
5471                         /* nope, reader or writer in the way */
5472                         sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
5473                         /* no asoc destroyed */
5474                         SCTP_TCB_UNLOCK(stcb);
5475 #ifdef SCTP_LOG_CLOSING
5476                         sctp_log_closing(inp, stcb, 8);
5477 #endif
5478                         return (0);
5479                 }
5480         }
5481         /* now clean up any other timers */
5482         (void)SCTP_OS_TIMER_STOP(&asoc->dack_timer.timer);
5483         asoc->dack_timer.self = NULL;
5484         (void)SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
5485         /*-
5486          * For stream reset we don't blast this unless
5487          * it is a str-reset timer, it might be the
5488          * free-asoc timer which we DON'T want to
5489          * disturb.
5490          */
5491         if (asoc->strreset_timer.type == SCTP_TIMER_TYPE_STRRESET)
5492                 asoc->strreset_timer.self = NULL;
5493         (void)SCTP_OS_TIMER_STOP(&asoc->asconf_timer.timer);
5494         asoc->asconf_timer.self = NULL;
5495         (void)SCTP_OS_TIMER_STOP(&asoc->autoclose_timer.timer);
5496         asoc->autoclose_timer.self = NULL;
5497         (void)SCTP_OS_TIMER_STOP(&asoc->shut_guard_timer.timer);
5498         asoc->shut_guard_timer.self = NULL;
5499         (void)SCTP_OS_TIMER_STOP(&asoc->delayed_event_timer.timer);
5500         asoc->delayed_event_timer.self = NULL;
5501         /* Mobility adaptation */
5502         (void)SCTP_OS_TIMER_STOP(&asoc->delete_prim_timer.timer);
5503         asoc->delete_prim_timer.self = NULL;
5504         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5505                 (void)SCTP_OS_TIMER_STOP(&net->rxt_timer.timer);
5506                 net->rxt_timer.self = NULL;
5507                 (void)SCTP_OS_TIMER_STOP(&net->pmtu_timer.timer);
5508                 net->pmtu_timer.self = NULL;
5509                 (void)SCTP_OS_TIMER_STOP(&net->hb_timer.timer);
5510                 net->hb_timer.self = NULL;
5511         }
5512         /* Now the read queue needs to be cleaned up (only once) */
5513         if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0) {
5514                 stcb->asoc.state |= SCTP_STATE_ABOUT_TO_BE_FREED;
5515                 SCTP_INP_READ_LOCK(inp);
5516                 TAILQ_FOREACH(sq, &inp->read_queue, next) {
5517                         if (sq->stcb == stcb) {
5518                                 sq->do_not_ref_stcb = 1;
5519                                 sq->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
5520                                 /* If there is no end, there never
5521                                  * will be now.
5522                                  */
5523                                 if (sq->end_added == 0) {
5524                                         /* Held for PD-API clear that. */
5525                                         sq->pdapi_aborted = 1;
5526                                         sq->held_length = 0;
5527                                         if (sctp_stcb_is_feature_on(inp, stcb, SCTP_PCB_FLAGS_PDAPIEVNT) && (so != NULL)) {
5528                                                 /*
5529                                                  * Need to add a PD-API aborted indication.
5530                                                  * Setting the control_pdapi assures that it will
5531                                                  * be added right after this msg.
5532                                                  */
5533                                                 uint32_t strseq;
5534                                                 stcb->asoc.control_pdapi = sq;
5535                                                 strseq = (sq->sinfo_stream << 16) | sq->sinfo_ssn;
5536                                                 sctp_ulp_notify(SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION,
5537                                                                 stcb,
5538                                                                 SCTP_PARTIAL_DELIVERY_ABORTED,
5539                                                                 (void *)&strseq,
5540                                                                 SCTP_SO_LOCKED);
5541                                                 stcb->asoc.control_pdapi = NULL;
5542                                         }
5543                                 }
5544                                 /* Add an end to wake them */
5545                                 sq->end_added = 1;
5546                         }
5547                 }
5548                 SCTP_INP_READ_UNLOCK(inp);
5549                 if (stcb->block_entry) {
5550                         SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_PCB, ECONNRESET);
5551                         stcb->block_entry->error = ECONNRESET;
5552                         stcb->block_entry = NULL;
5553                 }
5554         }
5555         if ((stcb->asoc.refcnt) || (stcb->asoc.state & SCTP_STATE_IN_ACCEPT_QUEUE)) {
5556                 /* Someone holds a reference OR the socket is unaccepted yet.
5557                 */
5558                 if ((stcb->asoc.refcnt)  ||
5559                     (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
5560                     (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
5561                         stcb->asoc.state &= ~SCTP_STATE_IN_ACCEPT_QUEUE;
5562                         sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
5563                 }
5564                 SCTP_TCB_UNLOCK(stcb);
5565                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
5566                     (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE))
5567                         /* nothing around */
5568                         so = NULL;
5569                 if (so) {
5570                         /* Wake any reader/writers */
5571                         sctp_sorwakeup(inp, so);
5572                         sctp_sowwakeup(inp, so);
5573                 }
5574
5575 #ifdef SCTP_LOG_CLOSING
5576                 sctp_log_closing(inp, stcb, 9);
5577 #endif
5578                 /* no asoc destroyed */
5579                 return (0);
5580         }
5581 #ifdef SCTP_LOG_CLOSING
5582         sctp_log_closing(inp, stcb, 10);
5583 #endif
5584         /* When I reach here, no others want
5585          * to kill the assoc yet.. and I own
5586          * the lock. Now its possible an abort
5587          * comes in when I do the lock exchange
5588          * below to grab all the locks to do
5589          * the final take out. to prevent this
5590          * we increment the count, which will
5591          * start a timer and blow out above thus
5592          * assuring us that we hold exclusive
5593          * killing of the asoc. Note that
5594          * after getting back the TCB lock
5595          * we will go ahead and increment the
5596          * counter back up and stop any timer
5597          * a passing stranger may have started :-S
5598          */
5599         if (from_inpcbfree == SCTP_NORMAL_PROC) {
5600                 atomic_add_int(&stcb->asoc.refcnt, 1);
5601
5602                 SCTP_TCB_UNLOCK(stcb);
5603                 SCTP_INP_INFO_WLOCK();
5604                 SCTP_INP_WLOCK(inp);
5605                 SCTP_TCB_LOCK(stcb);
5606         }
5607         /* Double check the GONE flag */
5608         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
5609             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE))
5610                 /* nothing around */
5611                 so = NULL;
5612
5613         if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5614             (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
5615                 /*
5616                  * For TCP type we need special handling when we are
5617                  * connected. We also include the peel'ed off ones to.
5618                  */
5619                 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
5620                         inp->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED;
5621                         inp->sctp_flags |= SCTP_PCB_FLAGS_WAS_CONNECTED;
5622                         if (so) {
5623                                 SOCK_LOCK(so);
5624                                 if (so->so_rcv.sb_cc == 0) {
5625                                         so->so_state &= ~(SS_ISCONNECTING |
5626                                                           SS_ISDISCONNECTING |
5627                                                           SS_ISCONFIRMING |
5628                                                           SS_ISCONNECTED);
5629                                 }
5630 #if defined(__APPLE__)
5631                                 socantrcvmore(so);
5632 #else
5633                                 socantrcvmore_locked(so);
5634 #endif
5635                                 sctp_sowwakeup(inp, so);
5636                                 sctp_sorwakeup(inp, so);
5637                                 SCTP_SOWAKEUP(so);
5638                         }
5639                 }
5640         }
5641
5642         /* Make it invalid too, that way if its
5643          * about to run it will abort and return.
5644          */
5645         /* re-increment the lock */
5646         if (from_inpcbfree == SCTP_NORMAL_PROC) {
5647                 atomic_add_int(&stcb->asoc.refcnt, -1);
5648         }
5649         if (stcb->asoc.refcnt) {
5650                 stcb->asoc.state &= ~SCTP_STATE_IN_ACCEPT_QUEUE;
5651                 sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
5652                 if (from_inpcbfree == SCTP_NORMAL_PROC) {
5653                         SCTP_INP_INFO_WUNLOCK();
5654                         SCTP_INP_WUNLOCK(inp);
5655                 }
5656                 SCTP_TCB_UNLOCK(stcb);
5657                 return (0);
5658         }
5659         asoc->state = 0;
5660         if (inp->sctp_tcbhash) {
5661                 LIST_REMOVE(stcb, sctp_tcbhash);
5662         }
5663         if (stcb->asoc.in_asocid_hash) {
5664                 LIST_REMOVE(stcb, sctp_tcbasocidhash);
5665         }
5666         /* Now lets remove it from the list of ALL associations in the EP */
5667         LIST_REMOVE(stcb, sctp_tcblist);
5668         if (from_inpcbfree == SCTP_NORMAL_PROC) {
5669                 SCTP_INP_INCR_REF(inp);
5670                 SCTP_INP_WUNLOCK(inp);
5671         }
5672         /* pull from vtag hash */
5673         LIST_REMOVE(stcb, sctp_asocs);
5674         sctp_add_vtag_to_timewait(asoc->my_vtag, SCTP_BASE_SYSCTL(sctp_vtag_time_wait),
5675                                   inp->sctp_lport, stcb->rport);
5676
5677         /* Now restop the timers to be sure
5678          * this is paranoia at is finest!
5679          */
5680         (void)SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
5681         (void)SCTP_OS_TIMER_STOP(&asoc->dack_timer.timer);
5682         (void)SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
5683         (void)SCTP_OS_TIMER_STOP(&asoc->asconf_timer.timer);
5684         (void)SCTP_OS_TIMER_STOP(&asoc->shut_guard_timer.timer);
5685         (void)SCTP_OS_TIMER_STOP(&asoc->autoclose_timer.timer);
5686         (void)SCTP_OS_TIMER_STOP(&asoc->delayed_event_timer.timer);
5687         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
5688                 (void)SCTP_OS_TIMER_STOP(&net->rxt_timer.timer);
5689                 (void)SCTP_OS_TIMER_STOP(&net->pmtu_timer.timer);
5690                 (void)SCTP_OS_TIMER_STOP(&net->hb_timer.timer);
5691         }
5692
5693         asoc->strreset_timer.type = SCTP_TIMER_TYPE_NONE;
5694         /*
5695          * The chunk lists and such SHOULD be empty but we check them just
5696          * in case.
5697          */
5698         /* anything on the wheel needs to be removed */
5699         for (i = 0; i < asoc->streamoutcnt; i++) {
5700                 struct sctp_stream_out *outs;
5701
5702                 outs = &asoc->strmout[i];
5703                 /* now clean up any chunks here */
5704                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
5705                         TAILQ_REMOVE(&outs->outqueue, sp, next);
5706                         sctp_free_spbufspace(stcb, asoc, sp);
5707                         if (sp->data) {
5708                                 if (so) {
5709                                         /* Still an open socket - report */
5710                                         sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
5711                                                         0, (void *)sp, SCTP_SO_LOCKED);
5712                                 }
5713                                 if (sp->data) {
5714                                         sctp_m_freem(sp->data);
5715                                         sp->data = NULL;
5716                                         sp->tail_mbuf = NULL;
5717                                         sp->length = 0;
5718                                 }
5719                         }
5720                         if (sp->net) {
5721                                 sctp_free_remote_addr(sp->net);
5722                                 sp->net = NULL;
5723                         }
5724                         sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED);
5725                 }
5726         }
5727         /*sa_ignore FREED_MEMORY*/
5728         TAILQ_FOREACH_SAFE(strrst, &asoc->resetHead, next_resp, nstrrst) {
5729                 TAILQ_REMOVE(&asoc->resetHead, strrst, next_resp);
5730                 SCTP_FREE(strrst, SCTP_M_STRESET);
5731         }
5732         TAILQ_FOREACH_SAFE(sq, &asoc->pending_reply_queue, next, nsq) {
5733                 TAILQ_REMOVE(&asoc->pending_reply_queue, sq, next);
5734                 if (sq->data) {
5735                         sctp_m_freem(sq->data);
5736                         sq->data = NULL;
5737                 }
5738                 sctp_free_remote_addr(sq->whoFrom);
5739                 sq->whoFrom = NULL;
5740                 sq->stcb = NULL;
5741                 /* Free the ctl entry */
5742                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_readq), sq);
5743                 SCTP_DECR_READQ_COUNT();
5744                 /*sa_ignore FREED_MEMORY*/
5745         }
5746         TAILQ_FOREACH_SAFE(chk, &asoc->free_chunks, sctp_next, nchk) {
5747                 TAILQ_REMOVE(&asoc->free_chunks, chk, sctp_next);
5748                 if (chk->data) {
5749                         sctp_m_freem(chk->data);
5750                         chk->data = NULL;
5751                 }
5752                 if (chk->holds_key_ref)
5753                         sctp_auth_key_release(stcb, chk->auth_keyid, SCTP_SO_LOCKED);
5754                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_chunk), chk);
5755                 SCTP_DECR_CHK_COUNT();
5756                 atomic_subtract_int(&SCTP_BASE_INFO(ipi_free_chunks), 1);
5757                 asoc->free_chunk_cnt--;
5758                 /*sa_ignore FREED_MEMORY*/
5759         }
5760         /* pending send queue SHOULD be empty */
5761         TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
5762                 if (asoc->strmout[chk->rec.data.stream_number].chunks_on_queues > 0) {
5763                         asoc->strmout[chk->rec.data.stream_number].chunks_on_queues--;
5764 #ifdef INVARIANTS
5765                 } else {
5766                         panic("No chunks on the queues for sid %u.", chk->rec.data.stream_number);
5767 #endif
5768                 }
5769                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
5770                 if (chk->data) {
5771                         if (so) {
5772                                 /* Still a socket? */
5773                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
5774                                                 0, chk, SCTP_SO_LOCKED);
5775                         }
5776                         if (chk->data) {
5777                                 sctp_m_freem(chk->data);
5778                                 chk->data = NULL;
5779                         }
5780                 }
5781                 if (chk->holds_key_ref)
5782                         sctp_auth_key_release(stcb, chk->auth_keyid, SCTP_SO_LOCKED);
5783                 if (chk->whoTo) {
5784                         sctp_free_remote_addr(chk->whoTo);
5785                         chk->whoTo = NULL;
5786                 }
5787                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_chunk), chk);
5788                 SCTP_DECR_CHK_COUNT();
5789                 /*sa_ignore FREED_MEMORY*/
5790         }
5791         /* sent queue SHOULD be empty */
5792         TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) {
5793                 if (chk->sent != SCTP_DATAGRAM_NR_ACKED) {
5794                         if (asoc->strmout[chk->rec.data.stream_number].chunks_on_queues > 0) {
5795                                 asoc->strmout[chk->rec.data.stream_number].chunks_on_queues--;
5796 #ifdef INVARIANTS
5797                         } else {
5798                                 panic("No chunks on the queues for sid %u.", chk->rec.data.stream_number);
5799 #endif
5800                         }
5801                 }
5802                 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
5803                 if (chk->data) {
5804                         if (so) {
5805                                 /* Still a socket? */
5806                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb,
5807                                                 0, chk, SCTP_SO_LOCKED);
5808                         }
5809                         if (chk->data) {
5810                                 sctp_m_freem(chk->data);
5811                                 chk->data = NULL;
5812                         }
5813                 }
5814                 if (chk->holds_key_ref)
5815                         sctp_auth_key_release(stcb, chk->auth_keyid, SCTP_SO_LOCKED);
5816                 sctp_free_remote_addr(chk->whoTo);
5817                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_chunk), chk);
5818                 SCTP_DECR_CHK_COUNT();
5819                 /*sa_ignore FREED_MEMORY*/
5820         }
5821 #ifdef INVARIANTS
5822         for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
5823                 if (stcb->asoc.strmout[i].chunks_on_queues > 0) {
5824                         panic("%u chunks left for stream %u.", stcb->asoc.strmout[i].chunks_on_queues, i);
5825                 }
5826         }
5827 #endif
5828         /* control queue MAY not be empty */
5829         TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) {
5830                 TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
5831                 if (chk->data) {
5832                         sctp_m_freem(chk->data);
5833                         chk->data = NULL;
5834                 }
5835                 if (chk->holds_key_ref)
5836                         sctp_auth_key_release(stcb, chk->auth_keyid, SCTP_SO_LOCKED);
5837                 sctp_free_remote_addr(chk->whoTo);
5838                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_chunk), chk);
5839                 SCTP_DECR_CHK_COUNT();
5840                 /*sa_ignore FREED_MEMORY*/
5841         }
5842         /* ASCONF queue MAY not be empty */
5843         TAILQ_FOREACH_SAFE(chk, &asoc->asconf_send_queue, sctp_next, nchk) {
5844                 TAILQ_REMOVE(&asoc->asconf_send_queue, chk, sctp_next);
5845                 if (chk->data) {
5846                         sctp_m_freem(chk->data);
5847                         chk->data = NULL;
5848                 }
5849                 if (chk->holds_key_ref)
5850                         sctp_auth_key_release(stcb, chk->auth_keyid, SCTP_SO_LOCKED);
5851                 sctp_free_remote_addr(chk->whoTo);
5852                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_chunk), chk);
5853                 SCTP_DECR_CHK_COUNT();
5854                 /*sa_ignore FREED_MEMORY*/
5855         }
5856         TAILQ_FOREACH_SAFE(chk, &asoc->reasmqueue, sctp_next, nchk) {
5857                 TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
5858                 if (chk->data) {
5859                         sctp_m_freem(chk->data);
5860                         chk->data = NULL;
5861                 }
5862                 if (chk->holds_key_ref)
5863                         sctp_auth_key_release(stcb, chk->auth_keyid, SCTP_SO_LOCKED);
5864                 sctp_free_remote_addr(chk->whoTo);
5865                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_chunk), chk);
5866                 SCTP_DECR_CHK_COUNT();
5867                 /*sa_ignore FREED_MEMORY*/
5868         }
5869
5870         if (asoc->mapping_array) {
5871                 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
5872                 asoc->mapping_array = NULL;
5873         }
5874         if (asoc->nr_mapping_array) {
5875                 SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
5876                 asoc->nr_mapping_array = NULL;
5877         }
5878         /* the stream outs */
5879         if (asoc->strmout) {
5880                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
5881                 asoc->strmout = NULL;
5882         }
5883         asoc->strm_realoutsize = asoc->streamoutcnt = 0;
5884         if (asoc->strmin) {
5885                 struct sctp_queued_to_read *ctl, *nctl;
5886
5887                 for (i = 0; i < asoc->streamincnt; i++) {
5888                         TAILQ_FOREACH_SAFE(ctl, &asoc->strmin[i].inqueue, next, nctl) {
5889                                 TAILQ_REMOVE(&asoc->strmin[i].inqueue, ctl, next);
5890                                 sctp_free_remote_addr(ctl->whoFrom);
5891                                 if (ctl->data) {
5892                                         sctp_m_freem(ctl->data);
5893                                         ctl->data = NULL;
5894                                 }
5895                                 /*
5896                                  * We don't free the address here
5897                                  * since all the net's were freed
5898                                  * above.
5899                                  */
5900                                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_readq), ctl);
5901                                 SCTP_DECR_READQ_COUNT();
5902                         }
5903                 }
5904                 SCTP_FREE(asoc->strmin, SCTP_M_STRMI);
5905                 asoc->strmin = NULL;
5906         }
5907         asoc->streamincnt = 0;
5908         TAILQ_FOREACH_SAFE(net, &asoc->nets, sctp_next, nnet) {
5909 #ifdef INVARIANTS
5910                 if (SCTP_BASE_INFO(ipi_count_raddr) == 0) {
5911                         panic("no net's left alloc'ed, or list points to itself");
5912                 }
5913 #endif
5914                 TAILQ_REMOVE(&asoc->nets, net, sctp_next);
5915                 sctp_free_remote_addr(net);
5916         }
5917         LIST_FOREACH_SAFE(laddr, &asoc->sctp_restricted_addrs, sctp_nxt_addr, naddr) {
5918                 /*sa_ignore FREED_MEMORY*/
5919                 sctp_remove_laddr(laddr);
5920         }
5921
5922         /* pending asconf (address) parameters */
5923         TAILQ_FOREACH_SAFE(aparam, &asoc->asconf_queue, next, naparam) {
5924                 /*sa_ignore FREED_MEMORY*/
5925                 TAILQ_REMOVE(&asoc->asconf_queue, aparam, next);
5926                 SCTP_FREE(aparam,SCTP_M_ASC_ADDR);
5927         }
5928         TAILQ_FOREACH_SAFE(aack, &asoc->asconf_ack_sent, next, naack) {
5929                 /*sa_ignore FREED_MEMORY*/
5930                 TAILQ_REMOVE(&asoc->asconf_ack_sent, aack, next);
5931                 if (aack->data != NULL) {
5932                         sctp_m_freem(aack->data);
5933                 }
5934                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), aack);
5935         }
5936         /* clean up auth stuff */
5937         if (asoc->local_hmacs)
5938                 sctp_free_hmaclist(asoc->local_hmacs);
5939         if (asoc->peer_hmacs)
5940                 sctp_free_hmaclist(asoc->peer_hmacs);
5941
5942         if (asoc->local_auth_chunks)
5943                 sctp_free_chunklist(asoc->local_auth_chunks);
5944         if (asoc->peer_auth_chunks)
5945                 sctp_free_chunklist(asoc->peer_auth_chunks);
5946
5947         sctp_free_authinfo(&asoc->authinfo);
5948
5949         LIST_FOREACH_SAFE(shared_key, &asoc->shared_keys, next, nshared_key) {
5950                 LIST_REMOVE(shared_key, next);
5951                 sctp_free_sharedkey(shared_key);
5952                 /*sa_ignore FREED_MEMORY*/
5953         }
5954
5955         /* Insert new items here :> */
5956
5957         /* Get rid of LOCK */
5958         SCTP_TCB_UNLOCK(stcb);
5959         SCTP_TCB_LOCK_DESTROY(stcb);
5960         SCTP_TCB_SEND_LOCK_DESTROY(stcb);
5961         if (from_inpcbfree == SCTP_NORMAL_PROC) {
5962                 SCTP_INP_INFO_WUNLOCK();
5963                 SCTP_INP_RLOCK(inp);
5964         }
5965 #if defined(__APPLE__) /* TEMP CODE */
5966         stcb->freed_from_where = from_location;
5967 #endif
5968 #ifdef SCTP_TRACK_FREED_ASOCS
5969         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5970                 /* now clean up the tasoc itself */
5971                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asoc), stcb);
5972                 SCTP_DECR_ASOC_COUNT();
5973         } else {
5974                 LIST_INSERT_HEAD(&inp->sctp_asoc_free_list, stcb, sctp_tcblist);
5975         }
5976 #else
5977         SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asoc), stcb);
5978         SCTP_DECR_ASOC_COUNT();
5979 #endif
5980         if (from_inpcbfree == SCTP_NORMAL_PROC) {
5981                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5982                         /* If its NOT the inp_free calling us AND
5983                          * sctp_close as been called, we
5984                          * call back...
5985                          */
5986                         SCTP_INP_RUNLOCK(inp);
5987                         /* This will start the kill timer (if we are
5988                          * the last one) since we hold an increment yet. But
5989                          * this is the only safe way to do this
5990                          * since otherwise if the socket closes
5991                          * at the same time we are here we might
5992                          * collide in the cleanup.
5993                          */
5994                         sctp_inpcb_free(inp,
5995                                         SCTP_FREE_SHOULD_USE_GRACEFUL_CLOSE,
5996                                         SCTP_CALLED_DIRECTLY_NOCMPSET);
5997                         SCTP_INP_DECR_REF(inp);
5998                         goto out_of;
5999                 } else {
6000                         /* The socket is still open. */
6001                         SCTP_INP_DECR_REF(inp);
6002                 }
6003         }
6004         if (from_inpcbfree == SCTP_NORMAL_PROC) {
6005                 SCTP_INP_RUNLOCK(inp);
6006         }
6007  out_of:
6008         /* destroyed the asoc */
6009 #ifdef SCTP_LOG_CLOSING
6010         sctp_log_closing(inp, NULL, 11);
6011 #endif
6012         return (1);
6013 }
6014
6015
6016
6017 /*
6018  * determine if a destination is "reachable" based upon the addresses bound
6019  * to the current endpoint (e.g. only v4 or v6 currently bound)
6020  */
6021 /*
6022  * FIX: if we allow assoc-level bindx(), then this needs to be fixed to use
6023  * assoc level v4/v6 flags, as the assoc *may* not have the same address
6024  * types bound as its endpoint
6025  */
6026 int
6027 sctp_destination_is_reachable(struct sctp_tcb *stcb, struct sockaddr *destaddr)
6028 {
6029         struct sctp_inpcb *inp;
6030         int answer;
6031
6032         /*
6033          * No locks here, the TCB, in all cases is already locked and an
6034          * assoc is up. There is either a INP lock by the caller applied (in
6035          * asconf case when deleting an address) or NOT in the HB case,
6036          * however if HB then the INP increment is up and the INP will not
6037          * be removed (on top of the fact that we have a TCB lock). So we
6038          * only want to read the sctp_flags, which is either bound-all or
6039          * not.. no protection needed since once an assoc is up you can't be
6040          * changing your binding.
6041          */
6042         inp = stcb->sctp_ep;
6043         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6044                 /* if bound all, destination is not restricted */
6045                 /*
6046                  * RRS: Question during lock work: Is this correct? If you
6047                  * are bound-all you still might need to obey the V4--V6
6048                  * flags??? IMO this bound-all stuff needs to be removed!
6049                  */
6050                 return (1);
6051         }
6052         /* NOTE: all "scope" checks are done when local addresses are added */
6053         switch (destaddr->sa_family) {
6054 #ifdef INET6
6055         case AF_INET6:
6056 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__Windows__) || defined(__Userspace__))
6057                 answer = inp->inp_vflag & INP_IPV6;
6058 #else
6059                 answer = inp->ip_inp.inp.inp_vflag & INP_IPV6;
6060 #endif
6061                 break;
6062 #endif
6063 #ifdef INET
6064         case AF_INET:
6065 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__Windows__) || defined(__Userspace__))
6066                 answer = inp->inp_vflag & INP_IPV4;
6067 #else
6068                 answer = inp->ip_inp.inp.inp_vflag & INP_IPV4;
6069 #endif
6070                 break;
6071 #endif
6072 #if defined(__Userspace__)
6073         case AF_CONN:
6074                 answer = inp->ip_inp.inp.inp_vflag & INP_CONN;
6075                 break;
6076 #endif
6077         default:
6078                 /* invalid family, so it's unreachable */
6079                 answer = 0;
6080                 break;
6081         }
6082         return (answer);
6083 }
6084
6085 /*
6086  * update the inp_vflags on an endpoint
6087  */
6088 static void
6089 sctp_update_ep_vflag(struct sctp_inpcb *inp)
6090 {
6091         struct sctp_laddr *laddr;
6092
6093         /* first clear the flag */
6094 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__Windows__) || defined(__Userspace__))
6095         inp->inp_vflag = 0;
6096 #else
6097         inp->ip_inp.inp.inp_vflag = 0;
6098 #endif
6099         /* set the flag based on addresses on the ep list */
6100         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
6101                 if (laddr->ifa == NULL) {
6102                         SCTPDBG(SCTP_DEBUG_PCB1, "%s: NULL ifa\n",
6103                                 __FUNCTION__);
6104                         continue;
6105                 }
6106
6107                 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) {
6108                         continue;
6109                 }
6110                 switch (laddr->ifa->address.sa.sa_family) {
6111 #ifdef INET6
6112                 case AF_INET6:
6113 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__Windows__) || defined(__Userspace__))
6114                         inp->inp_vflag |= INP_IPV6;
6115 #else
6116                         inp->ip_inp.inp.inp_vflag |= INP_IPV6;
6117 #endif
6118                         break;
6119 #endif
6120 #ifdef INET
6121                 case AF_INET:
6122 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__Windows__) || defined(__Userspace__))
6123                         inp->inp_vflag |= INP_IPV4;
6124 #else
6125                         inp->ip_inp.inp.inp_vflag |= INP_IPV4;
6126 #endif
6127                         break;
6128 #endif
6129 #if defined(__Userspace__)
6130                 case AF_CONN:
6131                         inp->ip_inp.inp.inp_vflag |= INP_CONN;
6132                         break;
6133 #endif
6134                 default:
6135                         break;
6136                 }
6137         }
6138 }
6139
6140 /*
6141  * Add the address to the endpoint local address list There is nothing to be
6142  * done if we are bound to all addresses
6143  */
6144 void
6145 sctp_add_local_addr_ep(struct sctp_inpcb *inp, struct sctp_ifa *ifa, uint32_t action)
6146 {
6147         struct sctp_laddr *laddr;
6148         int fnd, error = 0;
6149
6150         fnd = 0;
6151
6152         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6153                 /* You are already bound to all. You have it already */
6154                 return;
6155         }
6156 #ifdef INET6
6157         if (ifa->address.sa.sa_family == AF_INET6) {
6158                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
6159                         /* Can't bind a non-useable addr. */
6160                         return;
6161                 }
6162         }
6163 #endif
6164         /* first, is it already present? */
6165         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
6166                 if (laddr->ifa == ifa) {
6167                         fnd = 1;
6168                         break;
6169                 }
6170         }
6171
6172         if (fnd == 0) {
6173                 /* Not in the ep list */
6174                 error = sctp_insert_laddr(&inp->sctp_addr_list, ifa, action);
6175                 if (error != 0)
6176                         return;
6177                 inp->laddr_count++;
6178                 /* update inp_vflag flags */
6179                 switch (ifa->address.sa.sa_family) {
6180 #ifdef INET6
6181                 case AF_INET6:
6182 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__Windows__) || defined(__Userspace__))
6183                         inp->inp_vflag |= INP_IPV6;
6184 #else
6185                         inp->ip_inp.inp.inp_vflag |= INP_IPV6;
6186 #endif
6187                         break;
6188 #endif
6189 #ifdef INET
6190                 case AF_INET:
6191 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__Windows__) || defined(__Userspace__))
6192                         inp->inp_vflag |= INP_IPV4;
6193 #else
6194                         inp->ip_inp.inp.inp_vflag |= INP_IPV4;
6195 #endif
6196                         break;
6197 #endif
6198 #if defined(__Userspace__)
6199                 case AF_CONN:
6200                         inp->ip_inp.inp.inp_vflag |= INP_CONN;
6201                         break;
6202 #endif
6203                 default:
6204                         break;
6205                 }
6206         }
6207         return;
6208 }
6209
6210
6211 /*
6212  * select a new (hopefully reachable) destination net (should only be used
6213  * when we deleted an ep addr that is the only usable source address to reach
6214  * the destination net)
6215  */
6216 static void
6217 sctp_select_primary_destination(struct sctp_tcb *stcb)
6218 {
6219         struct sctp_nets *net;
6220
6221         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
6222                 /* for now, we'll just pick the first reachable one we find */
6223                 if (net->dest_state & SCTP_ADDR_UNCONFIRMED)
6224                         continue;
6225                 if (sctp_destination_is_reachable(stcb,
6226                     (struct sockaddr *)&net->ro._l_addr)) {
6227                         /* found a reachable destination */
6228                         stcb->asoc.primary_destination = net;
6229                 }
6230         }
6231         /* I can't there from here! ...we're gonna die shortly... */
6232 }
6233
6234
6235 /*
6236  * Delete the address from the endpoint local address list There is nothing
6237  * to be done if we are bound to all addresses
6238  */
6239 void
6240 sctp_del_local_addr_ep(struct sctp_inpcb *inp, struct sctp_ifa *ifa)
6241 {
6242         struct sctp_laddr *laddr;
6243         int fnd;
6244
6245         fnd = 0;
6246         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6247                 /* You are already bound to all. You have it already */
6248                 return;
6249         }
6250         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
6251                 if (laddr->ifa == ifa) {
6252                         fnd = 1;
6253                         break;
6254                 }
6255         }
6256         if (fnd && (inp->laddr_count < 2)) {
6257                 /* can't delete unless there are at LEAST 2 addresses */
6258                 return;
6259         }
6260         if (fnd) {
6261                 /*
6262                  * clean up any use of this address go through our
6263                  * associations and clear any last_used_address that match
6264                  * this one for each assoc, see if a new primary_destination
6265                  * is needed
6266                  */
6267                 struct sctp_tcb *stcb;
6268
6269                 /* clean up "next_addr_touse" */
6270                 if (inp->next_addr_touse == laddr)
6271                         /* delete this address */
6272                         inp->next_addr_touse = NULL;
6273
6274                 /* clean up "last_used_address" */
6275                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
6276                         struct sctp_nets *net;
6277                         SCTP_TCB_LOCK(stcb);
6278                         if (stcb->asoc.last_used_address == laddr)
6279                                 /* delete this address */
6280                                 stcb->asoc.last_used_address = NULL;
6281                         /* Now spin through all the nets and purge any ref to laddr */
6282                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
6283                                 if (net->ro._s_addr &&
6284                                     (net->ro._s_addr->ifa == laddr->ifa)) {
6285                                         /* Yep, purge src address selected */
6286                                         sctp_rtentry_t *rt;
6287
6288                                         /* delete this address if cached */
6289                                         rt = net->ro.ro_rt;
6290                                         if (rt != NULL) {
6291                                                 RTFREE(rt);
6292                                                 net->ro.ro_rt = NULL;
6293                                         }
6294                                         sctp_free_ifa(net->ro._s_addr);
6295                                         net->ro._s_addr = NULL;
6296                                         net->src_addr_selected = 0;
6297                                 }
6298                         }
6299                         SCTP_TCB_UNLOCK(stcb);
6300                 }               /* for each tcb */
6301                 /* remove it from the ep list */
6302                 sctp_remove_laddr(laddr);
6303                 inp->laddr_count--;
6304                 /* update inp_vflag flags */
6305                 sctp_update_ep_vflag(inp);
6306         }
6307         return;
6308 }
6309
6310 /*
6311  * Add the address to the TCB local address restricted list.
6312  * This is a "pending" address list (eg. addresses waiting for an
6313  * ASCONF-ACK response) and cannot be used as a valid source address.
6314  */
6315 void
6316 sctp_add_local_addr_restricted(struct sctp_tcb *stcb, struct sctp_ifa *ifa)
6317 {
6318         struct sctp_laddr *laddr;
6319         struct sctpladdr *list;
6320
6321         /*
6322          * Assumes TCB is locked.. and possibly the INP. May need to
6323          * confirm/fix that if we need it and is not the case.
6324          */
6325         list = &stcb->asoc.sctp_restricted_addrs;
6326
6327 #ifdef INET6
6328         if (ifa->address.sa.sa_family == AF_INET6) {
6329                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
6330                         /* Can't bind a non-existent addr. */
6331                         return;
6332                 }
6333         }
6334 #endif
6335         /* does the address already exist? */
6336         LIST_FOREACH(laddr, list, sctp_nxt_addr) {
6337                 if (laddr->ifa == ifa) {
6338                         return;
6339                 }
6340         }
6341
6342         /* add to the list */
6343         (void)sctp_insert_laddr(list, ifa, 0);
6344         return;
6345 }
6346
6347 /*
6348  * insert an laddr entry with the given ifa for the desired list
6349  */
6350 int
6351 sctp_insert_laddr(struct sctpladdr *list, struct sctp_ifa *ifa, uint32_t act)
6352 {
6353         struct sctp_laddr *laddr;
6354
6355         laddr = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
6356         if (laddr == NULL) {
6357                 /* out of memory? */
6358                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
6359                 return (EINVAL);
6360         }
6361         SCTP_INCR_LADDR_COUNT();
6362         bzero(laddr, sizeof(*laddr));
6363         (void)SCTP_GETTIME_TIMEVAL(&laddr->start_time);
6364         laddr->ifa = ifa;
6365         laddr->action = act;
6366         atomic_add_int(&ifa->refcount, 1);
6367         /* insert it */
6368         LIST_INSERT_HEAD(list, laddr, sctp_nxt_addr);
6369
6370         return (0);
6371 }
6372
6373 /*
6374  * Remove an laddr entry from the local address list (on an assoc)
6375  */
6376 void
6377 sctp_remove_laddr(struct sctp_laddr *laddr)
6378 {
6379
6380         /* remove from the list */
6381         LIST_REMOVE(laddr, sctp_nxt_addr);
6382         sctp_free_ifa(laddr->ifa);
6383         SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), laddr);
6384         SCTP_DECR_LADDR_COUNT();
6385 }
6386
6387 /*
6388  * Remove a local address from the TCB local address restricted list
6389  */
6390 void
6391 sctp_del_local_addr_restricted(struct sctp_tcb *stcb, struct sctp_ifa *ifa)
6392 {
6393         struct sctp_inpcb *inp;
6394         struct sctp_laddr *laddr;
6395
6396         /*
6397          * This is called by asconf work. It is assumed that a) The TCB is
6398          * locked and b) The INP is locked. This is true in as much as I can
6399          * trace through the entry asconf code where I did these locks.
6400          * Again, the ASCONF code is a bit different in that it does lock
6401          * the INP during its work often times. This must be since we don't
6402          * want other proc's looking up things while what they are looking
6403          * up is changing :-D
6404          */
6405
6406         inp = stcb->sctp_ep;
6407         /* if subset bound and don't allow ASCONF's, can't delete last */
6408         if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) &&
6409             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
6410                 if (stcb->sctp_ep->laddr_count < 2) {
6411                         /* can't delete last address */
6412                         return;
6413                 }
6414         }
6415         LIST_FOREACH(laddr, &stcb->asoc.sctp_restricted_addrs, sctp_nxt_addr) {
6416                 /* remove the address if it exists */
6417                 if (laddr->ifa == NULL)
6418                         continue;
6419                 if (laddr->ifa == ifa) {
6420                         sctp_remove_laddr(laddr);
6421                         return;
6422                 }
6423         }
6424
6425         /* address not found! */
6426         return;
6427 }
6428
6429 #if defined(__FreeBSD__)
6430 /*
6431  * Temporarily remove for __APPLE__ until we use the Tiger equivalents
6432  */
6433 /* sysctl */
6434 static int sctp_max_number_of_assoc = SCTP_MAX_NUM_OF_ASOC;
6435 static int sctp_scale_up_for_address = SCTP_SCALE_FOR_ADDR;
6436 #endif                          /* FreeBSD || APPLE */
6437
6438
6439
6440 #if defined(__FreeBSD__) && defined(SCTP_MCORE_INPUT) && defined(SMP)
6441 struct sctp_mcore_ctrl *sctp_mcore_workers = NULL;
6442 int *sctp_cpuarry = NULL;
6443 void
6444 sctp_queue_to_mcore(struct mbuf *m, int off, int cpu_to_use)
6445 {
6446         /* Queue a packet to a processor for the specified core */
6447         struct sctp_mcore_queue *qent;
6448         struct sctp_mcore_ctrl *wkq;
6449         int need_wake = 0;
6450         if (sctp_mcore_workers == NULL) {
6451                 /* Something went way bad during setup */
6452                 sctp_input_with_port(m, off, 0);
6453                 return;
6454         }
6455         SCTP_MALLOC(qent, struct sctp_mcore_queue *,
6456                     (sizeof(struct sctp_mcore_queue)),
6457                     SCTP_M_MCORE);
6458         if (qent == NULL) {
6459                 /* This is trouble  */
6460                 sctp_input_with_port(m, off, 0);
6461                 return;
6462         }
6463 #if defined(__FreeBSD__) && __FreeBSD_version >= 801000
6464         qent->vn = curvnet;
6465 #endif
6466         qent->m = m;
6467         qent->off = off;
6468         qent->v6 = 0;
6469         wkq = &sctp_mcore_workers[cpu_to_use];
6470         SCTP_MCORE_QLOCK(wkq);
6471
6472         TAILQ_INSERT_TAIL(&wkq->que, qent, next);
6473         if (wkq->running == 0) {
6474                 need_wake = 1;
6475         }
6476         SCTP_MCORE_QUNLOCK(wkq);
6477         if (need_wake) {
6478                 wakeup(&wkq->running);
6479         }
6480 }
6481
6482 static void
6483 sctp_mcore_thread(void *arg)
6484 {
6485
6486         struct sctp_mcore_ctrl *wkq;
6487         struct sctp_mcore_queue *qent;
6488
6489         wkq = (struct sctp_mcore_ctrl *)arg;
6490         struct mbuf *m;
6491         int off, v6;
6492
6493         /* Wait for first tickle */
6494         SCTP_MCORE_LOCK(wkq);
6495         wkq->running = 0;
6496         msleep(&wkq->running,
6497                &wkq->core_mtx,
6498                0, "wait for pkt", 0);
6499         SCTP_MCORE_UNLOCK(wkq);
6500
6501         /* Bind to our cpu */
6502         thread_lock(curthread);
6503         sched_bind(curthread, wkq->cpuid);
6504         thread_unlock(curthread);
6505
6506         /* Now lets start working */
6507         SCTP_MCORE_LOCK(wkq);
6508         /* Now grab lock and go */
6509         for (;;) {
6510                 SCTP_MCORE_QLOCK(wkq);
6511         skip_sleep:
6512                 wkq->running = 1;
6513                 qent = TAILQ_FIRST(&wkq->que);
6514                 if (qent) {
6515                         TAILQ_REMOVE(&wkq->que, qent, next);
6516                         SCTP_MCORE_QUNLOCK(wkq);
6517 #if defined(__FreeBSD__) && __FreeBSD_version >= 801000
6518                         CURVNET_SET(qent->vn);
6519 #endif
6520                         m = qent->m;
6521                         off = qent->off;
6522                         v6 = qent->v6;
6523                         SCTP_FREE(qent, SCTP_M_MCORE);
6524                         if (v6 == 0) {
6525                                 sctp_input_with_port(m, off, 0);
6526                         } else {
6527                                 SCTP_PRINTF("V6 not yet supported\n");
6528                                 sctp_m_freem(m);
6529                         }
6530 #if defined(__FreeBSD__) && __FreeBSD_version >= 801000
6531                         CURVNET_RESTORE();
6532 #endif
6533                         SCTP_MCORE_QLOCK(wkq);
6534                 }
6535                 wkq->running = 0;
6536                 if (!TAILQ_EMPTY(&wkq->que)) {
6537                         goto skip_sleep;
6538                 }
6539                 SCTP_MCORE_QUNLOCK(wkq);
6540                 msleep(&wkq->running,
6541                        &wkq->core_mtx,
6542                        0, "wait for pkt", 0);
6543         }
6544 }
6545
6546 static void
6547 sctp_startup_mcore_threads(void)
6548 {
6549         int i, cpu;
6550
6551         if (mp_ncpus == 1)
6552                 return;
6553
6554         if (sctp_mcore_workers != NULL) {
6555                 /* Already been here in some previous
6556                  * vnet?
6557                  */
6558                 return;
6559         }
6560         SCTP_MALLOC(sctp_mcore_workers, struct sctp_mcore_ctrl *,
6561                     ((mp_maxid+1) * sizeof(struct sctp_mcore_ctrl)),
6562                     SCTP_M_MCORE);
6563         if (sctp_mcore_workers == NULL) {
6564                 /* TSNH I hope */
6565                 return;
6566         }
6567         memset(sctp_mcore_workers, 0 , ((mp_maxid+1) *
6568                                         sizeof(struct sctp_mcore_ctrl)));
6569         /* Init the structures */
6570         for (i = 0; i<=mp_maxid; i++) {
6571                 TAILQ_INIT(&sctp_mcore_workers[i].que);
6572                 SCTP_MCORE_LOCK_INIT(&sctp_mcore_workers[i]);
6573                 SCTP_MCORE_QLOCK_INIT(&sctp_mcore_workers[i]);
6574                 sctp_mcore_workers[i].cpuid = i;
6575         }
6576         if (sctp_cpuarry == NULL) {
6577                 SCTP_MALLOC(sctp_cpuarry, int *,
6578                             (mp_ncpus * sizeof(int)),
6579                             SCTP_M_MCORE);
6580                 i = 0;
6581                 CPU_FOREACH(cpu) {
6582                         sctp_cpuarry[i] = cpu;
6583                         i++;
6584                 }
6585         }
6586
6587         /* Now start them all */
6588         CPU_FOREACH(cpu) {
6589 #if __FreeBSD_version <= 701000
6590                 (void)kthread_create(sctp_mcore_thread,
6591                                      (void *)&sctp_mcore_workers[cpu],
6592                                      &sctp_mcore_workers[cpu].thread_proc,
6593                                      RFPROC,
6594                                      SCTP_KTHREAD_PAGES,
6595                                      SCTP_MCORE_NAME);
6596
6597 #else
6598                 (void)kproc_create(sctp_mcore_thread,
6599                                    (void *)&sctp_mcore_workers[cpu],
6600                                    &sctp_mcore_workers[cpu].thread_proc,
6601                                    RFPROC,
6602                                    SCTP_KTHREAD_PAGES,
6603                                    SCTP_MCORE_NAME);
6604 #endif
6605
6606         }
6607 }
6608 #endif
6609 #if defined(__FreeBSD__) && __FreeBSD_cc_version >= 1200000
6610 static struct mbuf *
6611 sctp_netisr_hdlr(struct mbuf *m, uintptr_t source)
6612 {
6613         struct ip *ip;
6614         struct sctphdr *sh;
6615         int offset;
6616         uint32_t flowid, tag;
6617
6618         /*
6619          * No flow id built by lower layers fix it so we
6620          * create one.
6621          */
6622         ip = mtod(m, struct ip *);
6623         offset = (ip->ip_hl << 2) + sizeof(struct sctphdr);
6624         if (SCTP_BUF_LEN(m) < offset) {
6625                 if ((m = m_pullup(m, offset)) == NULL) {
6626                         SCTP_STAT_INCR(sctps_hdrops);
6627                         return (NULL);
6628                 }
6629                 ip = mtod(m, struct ip *);
6630         }
6631         sh = (struct sctphdr *)((caddr_t)ip + (ip->ip_hl << 2));
6632         tag = htonl(sh->v_tag);
6633         flowid = tag ^ ntohs(sh->dest_port) ^ ntohs(sh->src_port);
6634         m->m_pkthdr.flowid = flowid;
6635         m->m_flags |= M_FLOWID;
6636         return (m);
6637 }
6638 #endif
6639
6640 void
6641 sctp_pcb_init()
6642 {
6643         /*
6644          * SCTP initialization for the PCB structures should be called by
6645          * the sctp_init() funciton.
6646          */
6647         int i;
6648         struct timeval tv;
6649
6650         if (SCTP_BASE_VAR(sctp_pcb_initialized) != 0) {
6651                 /* error I was called twice */
6652                 return;
6653         }
6654         SCTP_BASE_VAR(sctp_pcb_initialized) = 1;
6655
6656 #if defined(SCTP_LOCAL_TRACE_BUF)
6657 #if defined(__Windows__)
6658         if (SCTP_BASE_SYSCTL(sctp_log) != NULL) {
6659                 bzero(SCTP_BASE_SYSCTL(sctp_log), sizeof(struct sctp_log));
6660         }
6661 #else
6662         bzero(&SCTP_BASE_SYSCTL(sctp_log), sizeof(struct sctp_log));
6663 #endif
6664 #endif
6665 #if defined(__FreeBSD__) && defined(SMP) && defined(SCTP_USE_PERCPU_STAT)
6666         SCTP_MALLOC(SCTP_BASE_STATS, struct sctpstat *,
6667                     ((mp_maxid+1) * sizeof(struct sctpstat)),
6668                     SCTP_M_MCORE);
6669 #endif
6670         (void)SCTP_GETTIME_TIMEVAL(&tv);
6671 #if defined(__FreeBSD__) && defined(SMP) && defined(SCTP_USE_PERCPU_STAT)
6672         bzero(SCTP_BASE_STATS, (sizeof(struct sctpstat) * (mp_maxid+1)));
6673         SCTP_BASE_STATS[PCPU_GET(cpuid)].sctps_discontinuitytime.tv_sec = (uint32_t)tv.tv_sec;
6674         SCTP_BASE_STATS[PCPU_GET(cpuid)].sctps_discontinuitytime.tv_usec = (uint32_t)tv.tv_usec;
6675 #else
6676         bzero(&SCTP_BASE_STATS, sizeof(struct sctpstat));
6677         SCTP_BASE_STAT(sctps_discontinuitytime).tv_sec = (uint32_t)tv.tv_sec;
6678         SCTP_BASE_STAT(sctps_discontinuitytime).tv_usec = (uint32_t)tv.tv_usec;
6679 #endif
6680         /* init the empty list of (All) Endpoints */
6681         LIST_INIT(&SCTP_BASE_INFO(listhead));
6682 #if defined(__APPLE__)
6683         LIST_INIT(&SCTP_BASE_INFO(inplisthead));
6684 #if defined(APPLE_LEOPARD) || defined(APPLE_SNOWLEOPARD) || defined(APPLE_LION) || defined(APPLE_MOUNTAINLION)
6685         SCTP_BASE_INFO(sctbinfo).listhead = &SCTP_BASE_INFO(inplisthead);
6686         SCTP_BASE_INFO(sctbinfo).mtx_grp_attr = lck_grp_attr_alloc_init();
6687         lck_grp_attr_setdefault(SCTP_BASE_INFO(sctbinfo).mtx_grp_attr);
6688         SCTP_BASE_INFO(sctbinfo).mtx_grp = lck_grp_alloc_init("sctppcb", SCTP_BASE_INFO(sctbinfo).mtx_grp_attr);
6689         SCTP_BASE_INFO(sctbinfo).mtx_attr = lck_attr_alloc_init();
6690         lck_attr_setdefault(SCTP_BASE_INFO(sctbinfo).mtx_attr);
6691 #else
6692         SCTP_BASE_INFO(sctbinfo).ipi_listhead = &SCTP_BASE_INFO(inplisthead);
6693         SCTP_BASE_INFO(sctbinfo).ipi_lock_grp_attr = lck_grp_attr_alloc_init();
6694         lck_grp_attr_setdefault(SCTP_BASE_INFO(sctbinfo).ipi_lock_grp_attr);
6695         SCTP_BASE_INFO(sctbinfo).ipi_lock_grp = lck_grp_alloc_init("sctppcb", SCTP_BASE_INFO(sctbinfo).ipi_lock_grp_attr);
6696         SCTP_BASE_INFO(sctbinfo).ipi_lock_attr = lck_attr_alloc_init();
6697         lck_attr_setdefault(SCTP_BASE_INFO(sctbinfo).ipi_lock_attr);
6698 #endif
6699 #if !defined(APPLE_LEOPARD) && !defined(APPLE_SNOWLEOPARD) && !defined(APPLE_LION) && !defined(APPLE_MOUNTAINLION)
6700         SCTP_BASE_INFO(sctbinfo).ipi_gc = sctp_gc;
6701         in_pcbinfo_attach(&SCTP_BASE_INFO(sctbinfo));
6702 #endif
6703 #endif
6704
6705
6706         /* init the hash table of endpoints */
6707 #if defined(__FreeBSD__)
6708 #if defined(__FreeBSD_cc_version) && __FreeBSD_cc_version >= 440000
6709         TUNABLE_INT_FETCH("net.inet.sctp.tcbhashsize", &SCTP_BASE_SYSCTL(sctp_hashtblsize));
6710         TUNABLE_INT_FETCH("net.inet.sctp.pcbhashsize", &SCTP_BASE_SYSCTL(sctp_pcbtblsize));
6711         TUNABLE_INT_FETCH("net.inet.sctp.chunkscale", &SCTP_BASE_SYSCTL(sctp_chunkscale));
6712 #else
6713         TUNABLE_INT_FETCH("net.inet.sctp.tcbhashsize", SCTP_TCBHASHSIZE,
6714                           SCTP_BASE_SYSCTL(sctp_hashtblsize));
6715         TUNABLE_INT_FETCH("net.inet.sctp.pcbhashsize", SCTP_PCBHASHSIZE,
6716                           SCTP_BASE_SYSCTL(sctp_pcbtblsize));
6717         TUNABLE_INT_FETCH("net.inet.sctp.chunkscale", SCTP_CHUNKQUEUE_SCALE,
6718                           SCTP_BASE_SYSCTL(sctp_chunkscale));
6719 #endif
6720 #endif
6721         SCTP_BASE_INFO(sctp_asochash) = SCTP_HASH_INIT((SCTP_BASE_SYSCTL(sctp_hashtblsize) * 31),
6722                                                        &SCTP_BASE_INFO(hashasocmark));
6723         SCTP_BASE_INFO(sctp_ephash) = SCTP_HASH_INIT(SCTP_BASE_SYSCTL(sctp_hashtblsize),
6724                                                      &SCTP_BASE_INFO(hashmark));
6725         SCTP_BASE_INFO(sctp_tcpephash) = SCTP_HASH_INIT(SCTP_BASE_SYSCTL(sctp_hashtblsize),
6726                                                         &SCTP_BASE_INFO(hashtcpmark));
6727         SCTP_BASE_INFO(hashtblsize) = SCTP_BASE_SYSCTL(sctp_hashtblsize);
6728
6729
6730         SCTP_BASE_INFO(sctp_vrfhash) = SCTP_HASH_INIT(SCTP_SIZE_OF_VRF_HASH,
6731                                                       &SCTP_BASE_INFO(hashvrfmark));
6732
6733         SCTP_BASE_INFO(vrf_ifn_hash) = SCTP_HASH_INIT(SCTP_VRF_IFN_HASH_SIZE,
6734                                                       &SCTP_BASE_INFO(vrf_ifn_hashmark));
6735         /* init the zones */
6736         /*
6737          * FIX ME: Should check for NULL returns, but if it does fail we are
6738          * doomed to panic anyways... add later maybe.
6739          */
6740         SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_ep), "sctp_ep",
6741                        sizeof(struct sctp_inpcb), maxsockets);
6742
6743         SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_asoc), "sctp_asoc",
6744                        sizeof(struct sctp_tcb), sctp_max_number_of_assoc);
6745
6746         SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_laddr), "sctp_laddr",
6747                        sizeof(struct sctp_laddr),
6748                        (sctp_max_number_of_assoc * sctp_scale_up_for_address));
6749
6750         SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_net), "sctp_raddr",
6751                        sizeof(struct sctp_nets),
6752                        (sctp_max_number_of_assoc * sctp_scale_up_for_address));
6753
6754         SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_chunk), "sctp_chunk",
6755                        sizeof(struct sctp_tmit_chunk),
6756                        (sctp_max_number_of_assoc * SCTP_BASE_SYSCTL(sctp_chunkscale)));
6757
6758         SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_readq), "sctp_readq",
6759                        sizeof(struct sctp_queued_to_read),
6760                        (sctp_max_number_of_assoc * SCTP_BASE_SYSCTL(sctp_chunkscale)));
6761
6762         SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_strmoq), "sctp_stream_msg_out",
6763                        sizeof(struct sctp_stream_queue_pending),
6764                        (sctp_max_number_of_assoc * SCTP_BASE_SYSCTL(sctp_chunkscale)));
6765
6766         SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_asconf), "sctp_asconf",
6767                        sizeof(struct sctp_asconf),
6768                        (sctp_max_number_of_assoc * SCTP_BASE_SYSCTL(sctp_chunkscale)));
6769
6770         SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_asconf_ack), "sctp_asconf_ack",
6771                        sizeof(struct sctp_asconf_ack),
6772                        (sctp_max_number_of_assoc * SCTP_BASE_SYSCTL(sctp_chunkscale)));
6773
6774
6775         /* Master Lock INIT for info structure */
6776         SCTP_INP_INFO_LOCK_INIT();
6777         SCTP_STATLOG_INIT_LOCK();
6778
6779         SCTP_IPI_COUNT_INIT();
6780         SCTP_IPI_ADDR_INIT();
6781 #ifdef SCTP_PACKET_LOGGING
6782         SCTP_IP_PKTLOG_INIT();
6783 #endif
6784         LIST_INIT(&SCTP_BASE_INFO(addr_wq));
6785
6786         SCTP_WQ_ADDR_INIT();
6787         /* not sure if we need all the counts */
6788         SCTP_BASE_INFO(ipi_count_ep) = 0;
6789         /* assoc/tcb zone info */
6790         SCTP_BASE_INFO(ipi_count_asoc) = 0;
6791         /* local addrlist zone info */
6792         SCTP_BASE_INFO(ipi_count_laddr) = 0;
6793         /* remote addrlist zone info */
6794         SCTP_BASE_INFO(ipi_count_raddr) = 0;
6795         /* chunk info */
6796         SCTP_BASE_INFO(ipi_count_chunk) = 0;
6797
6798         /* socket queue zone info */
6799         SCTP_BASE_INFO(ipi_count_readq) = 0;
6800
6801         /* stream out queue cont */
6802         SCTP_BASE_INFO(ipi_count_strmoq) = 0;
6803
6804         SCTP_BASE_INFO(ipi_free_strmoq) = 0;
6805         SCTP_BASE_INFO(ipi_free_chunks) = 0;
6806
6807         SCTP_OS_TIMER_INIT(&SCTP_BASE_INFO(addr_wq_timer.timer));
6808
6809         /* Init the TIMEWAIT list */
6810         for (i = 0; i < SCTP_STACK_VTAG_HASH_SIZE; i++) {
6811                 LIST_INIT(&SCTP_BASE_INFO(vtag_timewait)[i]);
6812         }
6813 #if defined(SCTP_PROCESS_LEVEL_LOCKS)
6814 #if defined(__Userspace_os_Windows)
6815         InitializeConditionVariable(&sctp_it_ctl.iterator_wakeup);
6816 #else
6817         (void)pthread_cond_init(&sctp_it_ctl.iterator_wakeup, NULL);
6818 #endif
6819 #endif
6820         sctp_startup_iterator();
6821
6822 #if defined(__FreeBSD__) && defined(SCTP_MCORE_INPUT) && defined(SMP)
6823         sctp_startup_mcore_threads();
6824 #endif
6825
6826 #ifndef __Panda__
6827         /*
6828          * INIT the default VRF which for BSD is the only one, other O/S's
6829          * may have more. But initially they must start with one and then
6830          * add the VRF's as addresses are added.
6831          */
6832         sctp_init_vrf_list(SCTP_DEFAULT_VRF);
6833 #endif
6834 #if defined(__FreeBSD__) && __FreeBSD_cc_version >= 1200000
6835         if (ip_register_flow_handler(sctp_netisr_hdlr, IPPROTO_SCTP)) {
6836                 SCTP_PRINTF("***SCTP- Error can't register netisr handler***\n");
6837         }
6838 #endif
6839 #if defined(_SCTP_NEEDS_CALLOUT_) || defined(_USER_SCTP_NEEDS_CALLOUT_)
6840         /* allocate the lock for the callout/timer queue */
6841         SCTP_TIMERQ_LOCK_INIT();
6842         TAILQ_INIT(&SCTP_BASE_INFO(callqueue));
6843 #endif
6844 #if defined(__Userspace__)
6845         mbuf_init(NULL);
6846         atomic_init();
6847 #if defined(INET) || defined(INET6)
6848         recv_thread_init();
6849 #endif
6850 #endif
6851 }
6852
6853 /*
6854  * Assumes that the SCTP_BASE_INFO() lock is NOT held.
6855  */
6856 void
6857 sctp_pcb_finish(void)
6858 {
6859         struct sctp_vrflist *vrf_bucket;
6860         struct sctp_vrf *vrf, *nvrf;
6861         struct sctp_ifn *ifn, *nifn;
6862         struct sctp_ifa *ifa, *nifa;
6863         struct sctpvtaghead *chain;
6864         struct sctp_tagblock *twait_block, *prev_twait_block;
6865         struct sctp_laddr *wi, *nwi;
6866         int i;
6867         struct sctp_iterator *it, *nit;
6868
6869 #if !defined(__FreeBSD__)
6870         /* Notify the iterator to exit. */
6871         SCTP_IPI_ITERATOR_WQ_LOCK();
6872         sctp_it_ctl.iterator_flags |= SCTP_ITERATOR_MUST_EXIT;
6873         sctp_wakeup_iterator();
6874         SCTP_IPI_ITERATOR_WQ_UNLOCK();
6875 #endif
6876 #if defined(__APPLE__)
6877 #if !defined(APPLE_LEOPARD) && !defined(APPLE_SNOWLEOPARD) && !defined(APPLE_LION) && !defined(APPLE_MOUNTAINLION)
6878         in_pcbinfo_detach(&SCTP_BASE_INFO(sctbinfo));
6879 #endif
6880         SCTP_IPI_ITERATOR_WQ_LOCK();
6881         do {
6882                 msleep(&sctp_it_ctl.iterator_flags,
6883                        sctp_it_ctl.ipi_iterator_wq_mtx,
6884                        0, "waiting_for_work", 0);
6885         } while ((sctp_it_ctl.iterator_flags & SCTP_ITERATOR_EXITED) == 0);
6886         thread_deallocate(sctp_it_ctl.thread_proc);
6887         SCTP_IPI_ITERATOR_WQ_UNLOCK();
6888 #endif
6889 #if defined(__Windows__)
6890         if (sctp_it_ctl.iterator_thread_obj != NULL) {
6891                 NTSTATUS status = STATUS_SUCCESS;
6892
6893                 KeSetEvent(&sctp_it_ctl.iterator_wakeup[1], IO_NO_INCREMENT, FALSE);
6894                 status = KeWaitForSingleObject(sctp_it_ctl.iterator_thread_obj,
6895                                                Executive,
6896                                                KernelMode,
6897                                                FALSE,
6898                                                NULL);
6899                 ObDereferenceObject(sctp_it_ctl.iterator_thread_obj);
6900         }
6901 #endif
6902 #if defined(__Userspace__)
6903         if (sctp_it_ctl.thread_proc) {
6904 #if defined(__Userspace_os_Windows)
6905                 WaitForSingleObject(sctp_it_ctl.thread_proc, INFINITE);
6906                 CloseHandle(sctp_it_ctl.thread_proc);
6907                 sctp_it_ctl.thread_proc = NULL;
6908 #else
6909                 pthread_join(sctp_it_ctl.thread_proc, NULL);
6910                 sctp_it_ctl.thread_proc = 0;
6911 #endif
6912         }
6913 #endif
6914 #if defined(SCTP_PROCESS_LEVEL_LOCKS)
6915 #if defined(__Userspace_os_Windows)
6916         DeleteConditionVariable(&sctp_it_ctl.iterator_wakeup);
6917 #else
6918         pthread_cond_destroy(&sctp_it_ctl.iterator_wakeup);
6919 #endif
6920 #endif
6921         /* In FreeBSD the iterator thread never exits
6922          * but we do clean up.
6923          * The only way FreeBSD reaches here is if we have VRF's
6924          * but we still add the ifdef to make it compile on old versions.
6925          */
6926         SCTP_IPI_ITERATOR_WQ_LOCK();
6927         TAILQ_FOREACH_SAFE(it, &sctp_it_ctl.iteratorhead, sctp_nxt_itr, nit) {
6928 #if defined(__FreeBSD__) && __FreeBSD_version >= 801000
6929                 if (it->vn != curvnet) {
6930                         continue;
6931                 }
6932 #endif
6933                 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
6934                 if (it->function_atend != NULL) {
6935                         (*it->function_atend) (it->pointer, it->val);
6936                 }
6937                 SCTP_FREE(it,SCTP_M_ITER);
6938         }
6939         SCTP_IPI_ITERATOR_WQ_UNLOCK();
6940 #if defined(__FreeBSD__) && __FreeBSD_version >= 801000
6941         SCTP_ITERATOR_LOCK();
6942         if ((sctp_it_ctl.cur_it) &&
6943             (sctp_it_ctl.cur_it->vn == curvnet)) {
6944                 sctp_it_ctl.iterator_flags |= SCTP_ITERATOR_STOP_CUR_IT;
6945         }
6946         SCTP_ITERATOR_UNLOCK();
6947 #endif
6948 #if !defined(__FreeBSD__)
6949         SCTP_IPI_ITERATOR_WQ_DESTROY();
6950         SCTP_ITERATOR_LOCK_DESTROY();
6951 #endif
6952         SCTP_OS_TIMER_STOP(&SCTP_BASE_INFO(addr_wq_timer.timer));
6953         SCTP_WQ_ADDR_LOCK();
6954         LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) {
6955                 LIST_REMOVE(wi, sctp_nxt_addr);
6956                 SCTP_DECR_LADDR_COUNT();
6957                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), wi);
6958         }
6959         SCTP_WQ_ADDR_UNLOCK();
6960
6961         /*
6962          * free the vrf/ifn/ifa lists and hashes (be sure address monitor
6963          * is destroyed first).
6964          */
6965         vrf_bucket = &SCTP_BASE_INFO(sctp_vrfhash)[(SCTP_DEFAULT_VRFID & SCTP_BASE_INFO(hashvrfmark))];
6966         LIST_FOREACH_SAFE(vrf, vrf_bucket, next_vrf, nvrf) {
6967                 LIST_FOREACH_SAFE(ifn, &vrf->ifnlist, next_ifn, nifn) {
6968                         LIST_FOREACH_SAFE(ifa, &ifn->ifalist, next_ifa, nifa) {
6969                                 /* free the ifa */
6970                                 LIST_REMOVE(ifa, next_bucket);
6971                                 LIST_REMOVE(ifa, next_ifa);
6972                                 SCTP_FREE(ifa, SCTP_M_IFA);
6973                         }
6974                         /* free the ifn */
6975                         LIST_REMOVE(ifn, next_bucket);
6976                         LIST_REMOVE(ifn, next_ifn);
6977                         SCTP_FREE(ifn, SCTP_M_IFN);
6978                 }
6979                 SCTP_HASH_FREE(vrf->vrf_addr_hash, vrf->vrf_addr_hashmark);
6980                 /* free the vrf */
6981                 LIST_REMOVE(vrf, next_vrf);
6982                 SCTP_FREE(vrf, SCTP_M_VRF);
6983         }
6984         /* free the vrf hashes */
6985         SCTP_HASH_FREE(SCTP_BASE_INFO(sctp_vrfhash), SCTP_BASE_INFO(hashvrfmark));
6986         SCTP_HASH_FREE(SCTP_BASE_INFO(vrf_ifn_hash), SCTP_BASE_INFO(vrf_ifn_hashmark));
6987 #if defined(__Userspace__) && !defined(__Userspace_os_Windows)
6988         /* free memory allocated by getifaddrs call */
6989 #if defined(INET) || defined(INET6)
6990         freeifaddrs(g_interfaces);
6991 #endif
6992 #endif
6993
6994         /* free the TIMEWAIT list elements malloc'd in the function
6995          * sctp_add_vtag_to_timewait()...
6996          */
6997         for (i = 0; i < SCTP_STACK_VTAG_HASH_SIZE; i++) {
6998                 chain = &SCTP_BASE_INFO(vtag_timewait)[i];
6999                 if (!LIST_EMPTY(chain)) {
7000                         prev_twait_block = NULL;
7001                         LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) {
7002                                 if (prev_twait_block) {
7003                                         SCTP_FREE(prev_twait_block, SCTP_M_TIMW);
7004                                 }
7005                                 prev_twait_block = twait_block;
7006                         }
7007                         SCTP_FREE(prev_twait_block, SCTP_M_TIMW);
7008                 }
7009         }
7010
7011         /* free the locks and mutexes */
7012 #if defined(__APPLE__)
7013         SCTP_TIMERQ_LOCK_DESTROY();
7014 #endif
7015 #ifdef SCTP_PACKET_LOGGING
7016         SCTP_IP_PKTLOG_DESTROY();
7017 #endif
7018         SCTP_IPI_ADDR_DESTROY();
7019 #if defined(__APPLE__)
7020         SCTP_IPI_COUNT_DESTROY();
7021 #endif
7022         SCTP_STATLOG_DESTROY();
7023         SCTP_INP_INFO_LOCK_DESTROY();
7024
7025         SCTP_WQ_ADDR_DESTROY();
7026
7027 #if defined(__APPLE__)
7028 #if defined(APPLE_LEOPARD) || defined(APPLE_SNOWLEOPARD) || defined(APPLE_LION) || defined(APPLE_MOUNTAINLION)
7029         lck_grp_attr_free(SCTP_BASE_INFO(sctbinfo).mtx_grp_attr);
7030         lck_grp_free(SCTP_BASE_INFO(sctbinfo).mtx_grp);
7031         lck_attr_free(SCTP_BASE_INFO(sctbinfo).mtx_attr);
7032 #else
7033         lck_grp_attr_free(SCTP_BASE_INFO(sctbinfo).ipi_lock_grp_attr);
7034         lck_grp_free(SCTP_BASE_INFO(sctbinfo).ipi_lock_grp);
7035         lck_attr_free(SCTP_BASE_INFO(sctbinfo).ipi_lock_attr);
7036 #endif
7037 #endif
7038 #if defined(__Userspace__)
7039         SCTP_TIMERQ_LOCK_DESTROY();
7040         SCTP_ZONE_DESTROY(zone_mbuf);
7041         SCTP_ZONE_DESTROY(zone_clust);
7042         SCTP_ZONE_DESTROY(zone_ext_refcnt);
7043 #endif
7044 #if defined(__Windows__) || defined(__FreeBSD__) || defined(__Userspace__)
7045         SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_ep));
7046         SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_asoc));
7047         SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_laddr));
7048         SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_net));
7049         SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_chunk));
7050         SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_readq));
7051         SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_strmoq));
7052         SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_asconf));
7053         SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_asconf_ack));
7054 #endif
7055         /* Get rid of other stuff to */
7056         if (SCTP_BASE_INFO(sctp_asochash) != NULL)
7057                 SCTP_HASH_FREE(SCTP_BASE_INFO(sctp_asochash), SCTP_BASE_INFO(hashasocmark));
7058         if (SCTP_BASE_INFO(sctp_ephash) != NULL)
7059                 SCTP_HASH_FREE(SCTP_BASE_INFO(sctp_ephash), SCTP_BASE_INFO(hashmark));
7060         if (SCTP_BASE_INFO(sctp_tcpephash) != NULL)
7061                 SCTP_HASH_FREE(SCTP_BASE_INFO(sctp_tcpephash), SCTP_BASE_INFO(hashtcpmark));
7062 #if defined(__FreeBSD__) && defined(SMP) && defined(SCTP_USE_PERCPU_STAT)
7063         SCTP_FREE(SCTP_BASE_STATS, SCTP_M_MCORE);
7064 #endif
7065 }
7066
7067
7068 int
7069 sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m,
7070                               int offset, int limit,
7071                               struct sockaddr *src, struct sockaddr *dst,
7072                               struct sockaddr *altsa)
7073 {
7074         /*
7075          * grub through the INIT pulling addresses and loading them to the
7076          * nets structure in the asoc. The from address in the mbuf should
7077          * also be loaded (if it is not already). This routine can be called
7078          * with either INIT or INIT-ACK's as long as the m points to the IP
7079          * packet and the offset points to the beginning of the parameters.
7080          */
7081         struct sctp_inpcb *inp;
7082         struct sctp_nets *net, *nnet, *net_tmp;
7083         struct sctp_paramhdr *phdr, parm_buf;
7084         struct sctp_tcb *stcb_tmp;
7085         uint16_t ptype, plen;
7086         struct sockaddr *sa;
7087         uint8_t random_store[SCTP_PARAM_BUFFER_SIZE];
7088         struct sctp_auth_random *p_random = NULL;
7089         uint16_t random_len = 0;
7090         uint8_t hmacs_store[SCTP_PARAM_BUFFER_SIZE];
7091         struct sctp_auth_hmac_algo *hmacs = NULL;
7092         uint16_t hmacs_len = 0;
7093         uint8_t saw_asconf = 0;
7094         uint8_t saw_asconf_ack = 0;
7095         uint8_t chunks_store[SCTP_PARAM_BUFFER_SIZE];
7096         struct sctp_auth_chunk_list *chunks = NULL;
7097         uint16_t num_chunks = 0;
7098         sctp_key_t *new_key;
7099         uint32_t keylen;
7100         int got_random = 0, got_hmacs = 0, got_chklist = 0;
7101         uint8_t ecn_allowed;
7102 #ifdef INET
7103         struct sockaddr_in sin;
7104 #endif
7105 #ifdef INET6
7106         struct sockaddr_in6 sin6;
7107 #endif
7108
7109         /* First get the destination address setup too. */
7110 #ifdef INET
7111         memset(&sin, 0, sizeof(sin));
7112         sin.sin_family = AF_INET;
7113 #ifdef HAVE_SIN_LEN
7114         sin.sin_len = sizeof(sin);
7115 #endif
7116         sin.sin_port = stcb->rport;
7117 #endif
7118 #ifdef INET6
7119         memset(&sin6, 0, sizeof(sin6));
7120         sin6.sin6_family = AF_INET6;
7121 #ifdef HAVE_SIN6_LEN
7122         sin6.sin6_len = sizeof(struct sockaddr_in6);
7123 #endif
7124         sin6.sin6_port = stcb->rport;
7125 #endif
7126         if (altsa) {
7127                 sa = altsa;
7128         } else {
7129                 sa = src;
7130         }
7131         /* Turn off ECN until we get through all params */
7132         ecn_allowed = 0;
7133         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
7134                 /* mark all addresses that we have currently on the list */
7135                 net->dest_state |= SCTP_ADDR_NOT_IN_ASSOC;
7136         }
7137         /* does the source address already exist? if so skip it */
7138         inp = stcb->sctp_ep;
7139         atomic_add_int(&stcb->asoc.refcnt, 1);
7140         stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net_tmp, dst, stcb);
7141         atomic_add_int(&stcb->asoc.refcnt, -1);
7142
7143         if ((stcb_tmp == NULL && inp == stcb->sctp_ep) || inp == NULL) {
7144                 /* we must add the source address */
7145                 /* no scope set here since we have a tcb already. */
7146                 switch (sa->sa_family) {
7147 #ifdef INET
7148                 case AF_INET:
7149                         if (stcb->asoc.scope.ipv4_addr_legal) {
7150                                 if (sctp_add_remote_addr(stcb, sa, NULL, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_2)) {
7151                                         return (-1);
7152                                 }
7153                         }
7154                         break;
7155 #endif
7156 #ifdef INET6
7157                 case AF_INET6:
7158                         if (stcb->asoc.scope.ipv6_addr_legal) {
7159                                 if (sctp_add_remote_addr(stcb, sa, NULL, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_3)) {
7160                                         return (-2);
7161                                 }
7162                         }
7163                         break;
7164 #endif
7165 #if defined(__Userspace__)
7166                 case AF_CONN:
7167                         if (stcb->asoc.scope.conn_addr_legal) {
7168                                 if (sctp_add_remote_addr(stcb, sa, NULL, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_3)) {
7169                                         return (-2);
7170                                 }
7171                         }
7172                         break;
7173 #endif
7174                 default:
7175                         break;
7176                 }
7177         } else {
7178                 if (net_tmp != NULL && stcb_tmp == stcb) {
7179                         net_tmp->dest_state &= ~SCTP_ADDR_NOT_IN_ASSOC;
7180                 } else if (stcb_tmp != stcb) {
7181                         /* It belongs to another association? */
7182                         if (stcb_tmp)
7183                                 SCTP_TCB_UNLOCK(stcb_tmp);
7184                         return (-3);
7185                 }
7186         }
7187         if (stcb->asoc.state == 0) {
7188                 /* the assoc was freed? */
7189                 return (-4);
7190         }
7191         /*
7192          * peer must explicitly turn this on. This may have been initialized
7193          * to be "on" in order to allow local addr changes while INIT's are
7194          * in flight.
7195          */
7196         stcb->asoc.peer_supports_asconf = 0;
7197         /* now we must go through each of the params. */
7198         phdr = sctp_get_next_param(m, offset, &parm_buf, sizeof(parm_buf));
7199         while (phdr) {
7200                 ptype = ntohs(phdr->param_type);
7201                 plen = ntohs(phdr->param_length);
7202                 /*
7203                  * SCTP_PRINTF("ptype => %0x, plen => %d\n", (uint32_t)ptype,
7204                  * (int)plen);
7205                  */
7206                 if (offset + plen > limit) {
7207                         break;
7208                 }
7209                 if (plen == 0) {
7210                         break;
7211                 }
7212 #ifdef INET
7213                 if (ptype == SCTP_IPV4_ADDRESS) {
7214                         if (stcb->asoc.scope.ipv4_addr_legal) {
7215                                 struct sctp_ipv4addr_param *p4, p4_buf;
7216
7217                                 /* ok get the v4 address and check/add */
7218                                 phdr = sctp_get_next_param(m, offset,
7219                                                            (struct sctp_paramhdr *)&p4_buf,
7220                                                            sizeof(p4_buf));
7221                                 if (plen != sizeof(struct sctp_ipv4addr_param) ||
7222                                     phdr == NULL) {
7223                                         return (-5);
7224                                 }
7225                                 p4 = (struct sctp_ipv4addr_param *)phdr;
7226                                 sin.sin_addr.s_addr = p4->addr;
7227                                 if (IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) {
7228                                         /* Skip multi-cast addresses */
7229                                         goto next_param;
7230                                 }
7231                                 if ((sin.sin_addr.s_addr == INADDR_BROADCAST) ||
7232                                     (sin.sin_addr.s_addr == INADDR_ANY)) {
7233                                         goto next_param;
7234                                 }
7235                                 sa = (struct sockaddr *)&sin;
7236                                 inp = stcb->sctp_ep;
7237                                 atomic_add_int(&stcb->asoc.refcnt, 1);
7238                                 stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net,
7239                                                                         dst, stcb);
7240                                 atomic_add_int(&stcb->asoc.refcnt, -1);
7241
7242                                 if ((stcb_tmp == NULL && inp == stcb->sctp_ep) ||
7243                                     inp == NULL) {
7244                                         /* we must add the source address */
7245                                         /*
7246                                          * no scope set since we have a tcb
7247                                          * already
7248                                          */
7249
7250                                         /*
7251                                          * we must validate the state again
7252                                          * here
7253                                          */
7254                                 add_it_now:
7255                                         if (stcb->asoc.state == 0) {
7256                                                 /* the assoc was freed? */
7257                                                 return (-7);
7258                                         }
7259                                         if (sctp_add_remote_addr(stcb, sa, NULL, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_4)) {
7260                                                 return (-8);
7261                                         }
7262                                 } else if (stcb_tmp == stcb) {
7263                                         if (stcb->asoc.state == 0) {
7264                                                 /* the assoc was freed? */
7265                                                 return (-10);
7266                                         }
7267                                         if (net != NULL) {
7268                                                 /* clear flag */
7269                                                 net->dest_state &=
7270                                                         ~SCTP_ADDR_NOT_IN_ASSOC;
7271                                         }
7272                                 } else {
7273                                         /*
7274                                          * strange, address is in another
7275                                          * assoc? straighten out locks.
7276                                          */
7277                                         if (stcb_tmp) {
7278                                                 if (SCTP_GET_STATE(&stcb_tmp->asoc) & SCTP_STATE_COOKIE_WAIT) {
7279                                                         /* in setup state we abort this guy */
7280                                                         sctp_abort_an_association(stcb_tmp->sctp_ep,
7281                                                                                   stcb_tmp, NULL, SCTP_SO_NOT_LOCKED);
7282                                                         goto add_it_now;
7283                                                 }
7284                                                 SCTP_TCB_UNLOCK(stcb_tmp);
7285                                         }
7286
7287                                         if (stcb->asoc.state == 0) {
7288                                                 /* the assoc was freed? */
7289                                                 return (-12);
7290                                         }
7291                                         return (-13);
7292                                 }
7293                         }
7294                 } else
7295 #endif
7296 #ifdef INET6
7297                 if (ptype == SCTP_IPV6_ADDRESS) {
7298                         if (stcb->asoc.scope.ipv6_addr_legal) {
7299                                 /* ok get the v6 address and check/add */
7300                                 struct sctp_ipv6addr_param *p6, p6_buf;
7301
7302                                 phdr = sctp_get_next_param(m, offset,
7303                                                            (struct sctp_paramhdr *)&p6_buf,
7304                                                            sizeof(p6_buf));
7305                                 if (plen != sizeof(struct sctp_ipv6addr_param) ||
7306                                     phdr == NULL) {
7307                                         return (-14);
7308                                 }
7309                                 p6 = (struct sctp_ipv6addr_param *)phdr;
7310                                 memcpy((caddr_t)&sin6.sin6_addr, p6->addr,
7311                                        sizeof(p6->addr));
7312                                 if (IN6_IS_ADDR_MULTICAST(&sin6.sin6_addr)) {
7313                                         /* Skip multi-cast addresses */
7314                                         goto next_param;
7315                                 }
7316                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6.sin6_addr)) {
7317                                         /* Link local make no sense without scope */
7318                                         goto next_param;
7319                                 }
7320                                 sa = (struct sockaddr *)&sin6;
7321                                 inp = stcb->sctp_ep;
7322                                 atomic_add_int(&stcb->asoc.refcnt, 1);
7323                                 stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net,
7324                                                                         dst, stcb);
7325                                 atomic_add_int(&stcb->asoc.refcnt, -1);
7326                                 if (stcb_tmp == NULL &&
7327                                     (inp == stcb->sctp_ep || inp == NULL)) {
7328                                         /*
7329                                          * we must validate the state again
7330                                          * here
7331                                          */
7332                                 add_it_now6:
7333                                         if (stcb->asoc.state == 0) {
7334                                                 /* the assoc was freed? */
7335                                                 return (-16);
7336                                         }
7337                                         /*
7338                                          * we must add the address, no scope
7339                                          * set
7340                                          */
7341                                         if (sctp_add_remote_addr(stcb, sa, NULL, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_5)) {
7342                                                 return (-17);
7343                                         }
7344                                 } else if (stcb_tmp == stcb) {
7345                                         /*
7346                                          * we must validate the state again
7347                                          * here
7348                                          */
7349                                         if (stcb->asoc.state == 0) {
7350                                                 /* the assoc was freed? */
7351                                                 return (-19);
7352                                         }
7353                                         if (net != NULL) {
7354                                                 /* clear flag */
7355                                                 net->dest_state &=
7356                                                         ~SCTP_ADDR_NOT_IN_ASSOC;
7357                                         }
7358                                 } else {
7359                                         /*
7360                                          * strange, address is in another
7361                                          * assoc? straighten out locks.
7362                                          */
7363                                         if (stcb_tmp)
7364                                                 if (SCTP_GET_STATE(&stcb_tmp->asoc) & SCTP_STATE_COOKIE_WAIT) {
7365                                                         /* in setup state we abort this guy */
7366                                                         sctp_abort_an_association(stcb_tmp->sctp_ep,
7367                                                                                   stcb_tmp, NULL, SCTP_SO_NOT_LOCKED);
7368                                                         goto add_it_now6;
7369                                                 }
7370                                         SCTP_TCB_UNLOCK(stcb_tmp);
7371
7372                                         if (stcb->asoc.state == 0) {
7373                                                 /* the assoc was freed? */
7374                                                 return (-21);
7375                                         }
7376                                         return (-22);
7377                                 }
7378                         }
7379                 } else
7380 #endif
7381                 if (ptype == SCTP_ECN_CAPABLE) {
7382                         ecn_allowed = 1;
7383                 } else if (ptype == SCTP_ULP_ADAPTATION) {
7384                         if (stcb->asoc.state != SCTP_STATE_OPEN) {
7385                                 struct sctp_adaptation_layer_indication ai, *aip;
7386
7387                                 phdr = sctp_get_next_param(m, offset,
7388                                                            (struct sctp_paramhdr *)&ai, sizeof(ai));
7389                                 aip = (struct sctp_adaptation_layer_indication *)phdr;
7390                                 if (aip) {
7391                                         stcb->asoc.peers_adaptation = ntohl(aip->indication);
7392                                         stcb->asoc.adaptation_needed = 1;
7393                                 }
7394                         }
7395                 } else if (ptype == SCTP_SET_PRIM_ADDR) {
7396                         struct sctp_asconf_addr_param lstore, *fee;
7397                         int lptype;
7398                         struct sockaddr *lsa = NULL;
7399 #ifdef INET
7400                         struct sctp_asconf_addrv4_param *fii;
7401 #endif
7402
7403                         stcb->asoc.peer_supports_asconf = 1;
7404                         if (plen > sizeof(lstore)) {
7405                                 return (-23);
7406                         }
7407                         phdr = sctp_get_next_param(m, offset,
7408                                                    (struct sctp_paramhdr *)&lstore,
7409                                                    min(plen,sizeof(lstore)));
7410                         if (phdr == NULL) {
7411                                 return (-24);
7412                         }
7413                         fee = (struct sctp_asconf_addr_param *)phdr;
7414                         lptype = ntohs(fee->addrp.ph.param_type);
7415                         switch (lptype) {
7416 #ifdef INET
7417                         case SCTP_IPV4_ADDRESS:
7418                                 if (plen !=
7419                                     sizeof(struct sctp_asconf_addrv4_param)) {
7420                                         SCTP_PRINTF("Sizeof setprim in init/init ack not %d but %d - ignored\n",
7421                                                     (int)sizeof(struct sctp_asconf_addrv4_param),
7422                                                     plen);
7423                                 } else {
7424                                         fii = (struct sctp_asconf_addrv4_param *)fee;
7425                                         sin.sin_addr.s_addr = fii->addrp.addr;
7426                                         lsa = (struct sockaddr *)&sin;
7427                                 }
7428                                 break;
7429 #endif
7430 #ifdef INET6
7431                         case SCTP_IPV6_ADDRESS:
7432                                 if (plen !=
7433                                     sizeof(struct sctp_asconf_addr_param)) {
7434                                         SCTP_PRINTF("Sizeof setprim (v6) in init/init ack not %d but %d - ignored\n",
7435                                                     (int)sizeof(struct sctp_asconf_addr_param),
7436                                                     plen);
7437                                 } else {
7438                                         memcpy(sin6.sin6_addr.s6_addr,
7439                                                fee->addrp.addr,
7440                                                sizeof(fee->addrp.addr));
7441                                         lsa = (struct sockaddr *)&sin6;
7442                                 }
7443                                 break;
7444 #endif
7445                         default:
7446                                 break;
7447                         }
7448                         if (lsa) {
7449                                 (void)sctp_set_primary_addr(stcb, sa, NULL);
7450                         }
7451                 } else if (ptype == SCTP_HAS_NAT_SUPPORT) {
7452                         stcb->asoc.peer_supports_nat = 1;
7453                 } else if (ptype == SCTP_PRSCTP_SUPPORTED) {
7454                         /* Peer supports pr-sctp */
7455                         stcb->asoc.peer_supports_prsctp = 1;
7456                 } else if (ptype == SCTP_SUPPORTED_CHUNK_EXT) {
7457                         /* A supported extension chunk */
7458                         struct sctp_supported_chunk_types_param *pr_supported;
7459                         uint8_t local_store[SCTP_PARAM_BUFFER_SIZE];
7460                         int num_ent, i;
7461
7462                         phdr = sctp_get_next_param(m, offset,
7463                                                    (struct sctp_paramhdr *)&local_store, min(sizeof(local_store),plen));
7464                         if (phdr == NULL) {
7465                                 return (-25);
7466                         }
7467                         stcb->asoc.peer_supports_asconf = 0;
7468                         stcb->asoc.peer_supports_prsctp = 0;
7469                         stcb->asoc.peer_supports_pktdrop = 0;
7470                         stcb->asoc.peer_supports_strreset = 0;
7471                         stcb->asoc.peer_supports_nr_sack = 0;
7472                         stcb->asoc.peer_supports_auth = 0;
7473                         pr_supported = (struct sctp_supported_chunk_types_param *)phdr;
7474                         num_ent = plen - sizeof(struct sctp_paramhdr);
7475                         for (i = 0; i < num_ent; i++) {
7476                                 switch (pr_supported->chunk_types[i]) {
7477                                 case SCTP_ASCONF:
7478                                 case SCTP_ASCONF_ACK:
7479                                         stcb->asoc.peer_supports_asconf = 1;
7480                                         break;
7481                                 case SCTP_FORWARD_CUM_TSN:
7482                                         stcb->asoc.peer_supports_prsctp = 1;
7483                                         break;
7484                                 case SCTP_PACKET_DROPPED:
7485                                         stcb->asoc.peer_supports_pktdrop = 1;
7486                                         break;
7487                                 case SCTP_NR_SELECTIVE_ACK:
7488                                         stcb->asoc.peer_supports_nr_sack = 1;
7489                                         break;
7490                                 case SCTP_STREAM_RESET:
7491                                         stcb->asoc.peer_supports_strreset = 1;
7492                                         break;
7493                                 case SCTP_AUTHENTICATION:
7494                                         stcb->asoc.peer_supports_auth = 1;
7495                                         break;
7496                                 default:
7497                                         /* one I have not learned yet */
7498                                         break;
7499
7500                                 }
7501                         }
7502                 } else if (ptype == SCTP_RANDOM) {
7503                         if (plen > sizeof(random_store))
7504                                 break;
7505                         if (got_random) {
7506                                 /* already processed a RANDOM */
7507                                 goto next_param;
7508                         }
7509                         phdr = sctp_get_next_param(m, offset,
7510                                                    (struct sctp_paramhdr *)random_store,
7511                                                    min(sizeof(random_store),plen));
7512                         if (phdr == NULL)
7513                                 return (-26);
7514                         p_random = (struct sctp_auth_random *)phdr;
7515                         random_len = plen - sizeof(*p_random);
7516                         /* enforce the random length */
7517                         if (random_len != SCTP_AUTH_RANDOM_SIZE_REQUIRED) {
7518                                 SCTPDBG(SCTP_DEBUG_AUTH1, "SCTP: invalid RANDOM len\n");
7519                                 return (-27);
7520                         }
7521                         got_random = 1;
7522                 } else if (ptype == SCTP_HMAC_LIST) {
7523                         int num_hmacs;
7524                         int i;
7525
7526                         if (plen > sizeof(hmacs_store))
7527                                 break;
7528                         if (got_hmacs) {
7529                                 /* already processed a HMAC list */
7530                                 goto next_param;
7531                         }
7532                         phdr = sctp_get_next_param(m, offset,
7533                                                    (struct sctp_paramhdr *)hmacs_store,
7534                                                    min(plen,sizeof(hmacs_store)));
7535                         if (phdr == NULL)
7536                                 return (-28);
7537                         hmacs = (struct sctp_auth_hmac_algo *)phdr;
7538                         hmacs_len = plen - sizeof(*hmacs);
7539                         num_hmacs = hmacs_len / sizeof(hmacs->hmac_ids[0]);
7540                         /* validate the hmac list */
7541                         if (sctp_verify_hmac_param(hmacs, num_hmacs)) {
7542                                 return (-29);
7543                         }
7544                         if (stcb->asoc.peer_hmacs != NULL)
7545                                 sctp_free_hmaclist(stcb->asoc.peer_hmacs);
7546                         stcb->asoc.peer_hmacs = sctp_alloc_hmaclist(num_hmacs);
7547                         if (stcb->asoc.peer_hmacs != NULL) {
7548                                 for (i = 0; i < num_hmacs; i++) {
7549                                         (void)sctp_auth_add_hmacid(stcb->asoc.peer_hmacs,
7550                                                                    ntohs(hmacs->hmac_ids[i]));
7551                                 }
7552                         }
7553                         got_hmacs = 1;
7554                 } else if (ptype == SCTP_CHUNK_LIST) {
7555                         int i;
7556
7557                         if (plen > sizeof(chunks_store))
7558                                 break;
7559                         if (got_chklist) {
7560                                 /* already processed a Chunks list */
7561                                 goto next_param;
7562                         }
7563                         phdr = sctp_get_next_param(m, offset,
7564                                                    (struct sctp_paramhdr *)chunks_store,
7565                                                    min(plen,sizeof(chunks_store)));
7566                         if (phdr == NULL)
7567                                 return (-30);
7568                         chunks = (struct sctp_auth_chunk_list *)phdr;
7569                         num_chunks = plen - sizeof(*chunks);
7570                         if (stcb->asoc.peer_auth_chunks != NULL)
7571                                 sctp_clear_chunklist(stcb->asoc.peer_auth_chunks);
7572                         else
7573                                 stcb->asoc.peer_auth_chunks = sctp_alloc_chunklist();
7574                         for (i = 0; i < num_chunks; i++) {
7575                                 (void)sctp_auth_add_chunk(chunks->chunk_types[i],
7576                                                           stcb->asoc.peer_auth_chunks);
7577                                 /* record asconf/asconf-ack if listed */
7578                                 if (chunks->chunk_types[i] == SCTP_ASCONF)
7579                                         saw_asconf = 1;
7580                                 if (chunks->chunk_types[i] == SCTP_ASCONF_ACK)
7581                                         saw_asconf_ack = 1;
7582
7583                         }
7584                         got_chklist = 1;
7585                 } else if ((ptype == SCTP_HEARTBEAT_INFO) ||
7586                            (ptype == SCTP_STATE_COOKIE) ||
7587                            (ptype == SCTP_UNRECOG_PARAM) ||
7588                            (ptype == SCTP_COOKIE_PRESERVE) ||
7589                            (ptype == SCTP_SUPPORTED_ADDRTYPE) ||
7590                            (ptype == SCTP_ADD_IP_ADDRESS) ||
7591                            (ptype == SCTP_DEL_IP_ADDRESS) ||
7592                            (ptype == SCTP_ERROR_CAUSE_IND) ||
7593                            (ptype == SCTP_SUCCESS_REPORT)) {
7594                         /* don't care */ ;
7595                 } else {
7596                         if ((ptype & 0x8000) == 0x0000) {
7597                                 /*
7598                                  * must stop processing the rest of the
7599                                  * param's. Any report bits were handled
7600                                  * with the call to
7601                                  * sctp_arethere_unrecognized_parameters()
7602                                  * when the INIT or INIT-ACK was first seen.
7603                                  */
7604                                 break;
7605                         }
7606                 }
7607
7608         next_param:
7609                 offset += SCTP_SIZE32(plen);
7610                 if (offset >= limit) {
7611                         break;
7612                 }
7613                 phdr = sctp_get_next_param(m, offset, &parm_buf,
7614                                            sizeof(parm_buf));
7615         }
7616         /* Now check to see if we need to purge any addresses */
7617         TAILQ_FOREACH_SAFE(net, &stcb->asoc.nets, sctp_next, nnet) {
7618                 if ((net->dest_state & SCTP_ADDR_NOT_IN_ASSOC) ==
7619                     SCTP_ADDR_NOT_IN_ASSOC) {
7620                         /* This address has been removed from the asoc */
7621                         /* remove and free it */
7622                         stcb->asoc.numnets--;
7623                         TAILQ_REMOVE(&stcb->asoc.nets, net, sctp_next);
7624                         sctp_free_remote_addr(net);
7625                         if (net == stcb->asoc.primary_destination) {
7626                                 stcb->asoc.primary_destination = NULL;
7627                                 sctp_select_primary_destination(stcb);
7628                         }
7629                 }
7630         }
7631         if (ecn_allowed == 0) {
7632                 stcb->asoc.ecn_allowed = 0;
7633         }
7634         /* validate authentication required parameters */
7635         if (got_random && got_hmacs) {
7636                 stcb->asoc.peer_supports_auth = 1;
7637         } else {
7638                 stcb->asoc.peer_supports_auth = 0;
7639         }
7640         if (!stcb->asoc.peer_supports_auth && got_chklist) {
7641                 /* peer does not support auth but sent a chunks list? */
7642                 return (-31);
7643         }
7644         if (!SCTP_BASE_SYSCTL(sctp_asconf_auth_nochk) && stcb->asoc.peer_supports_asconf &&
7645             !stcb->asoc.peer_supports_auth) {
7646                 /* peer supports asconf but not auth? */
7647                 return (-32);
7648         } else if ((stcb->asoc.peer_supports_asconf) && (stcb->asoc.peer_supports_auth) &&
7649                    ((saw_asconf == 0) || (saw_asconf_ack == 0))) {
7650                 return (-33);
7651         }
7652         /* concatenate the full random key */
7653         keylen = sizeof(*p_random) + random_len + sizeof(*hmacs) + hmacs_len;
7654         if (chunks != NULL) {
7655                 keylen += sizeof(*chunks) + num_chunks;
7656         }
7657         new_key = sctp_alloc_key(keylen);
7658         if (new_key != NULL) {
7659                 /* copy in the RANDOM */
7660                 if (p_random != NULL) {
7661                         keylen = sizeof(*p_random) + random_len;
7662                         bcopy(p_random, new_key->key, keylen);
7663                 }
7664                 /* append in the AUTH chunks */
7665                 if (chunks != NULL) {
7666                         bcopy(chunks, new_key->key + keylen,
7667                               sizeof(*chunks) + num_chunks);
7668                         keylen += sizeof(*chunks) + num_chunks;
7669                 }
7670                 /* append in the HMACs */
7671                 if (hmacs != NULL) {
7672                         bcopy(hmacs, new_key->key + keylen,
7673                               sizeof(*hmacs) + hmacs_len);
7674                 }
7675         } else {
7676                 /* failed to get memory for the key */
7677                 return (-34);
7678         }
7679         if (stcb->asoc.authinfo.peer_random != NULL)
7680                 sctp_free_key(stcb->asoc.authinfo.peer_random);
7681         stcb->asoc.authinfo.peer_random = new_key;
7682         sctp_clear_cachedkeys(stcb, stcb->asoc.authinfo.assoc_keyid);
7683         sctp_clear_cachedkeys(stcb, stcb->asoc.authinfo.recv_keyid);
7684
7685         return (0);
7686 }
7687
7688 int
7689 sctp_set_primary_addr(struct sctp_tcb *stcb, struct sockaddr *sa,
7690                       struct sctp_nets *net)
7691 {
7692         /* make sure the requested primary address exists in the assoc */
7693         if (net == NULL && sa)
7694                 net = sctp_findnet(stcb, sa);
7695
7696         if (net == NULL) {
7697                 /* didn't find the requested primary address! */
7698                 return (-1);
7699         } else {
7700                 /* set the primary address */
7701                 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {
7702                         /* Must be confirmed, so queue to set */
7703                         net->dest_state |= SCTP_ADDR_REQ_PRIMARY;
7704                         return (0);
7705                 }
7706                 stcb->asoc.primary_destination = net;
7707                 if (!(net->dest_state & SCTP_ADDR_PF) && (stcb->asoc.alternate)) {
7708                         sctp_free_remote_addr(stcb->asoc.alternate);
7709                         stcb->asoc.alternate = NULL;
7710                 }
7711                 net = TAILQ_FIRST(&stcb->asoc.nets);
7712                 if (net != stcb->asoc.primary_destination) {
7713                         /* first one on the list is NOT the primary
7714                          * sctp_cmpaddr() is much more efficient if
7715                          * the primary is the first on the list, make it
7716                          * so.
7717                          */
7718                         TAILQ_REMOVE(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next);
7719                         TAILQ_INSERT_HEAD(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next);
7720                 }
7721                 return (0);
7722         }
7723 }
7724
7725 int
7726 sctp_is_vtag_good(uint32_t tag, uint16_t lport, uint16_t rport, struct timeval *now)
7727 {
7728         /*
7729          * This function serves two purposes. It will see if a TAG can be
7730          * re-used and return 1 for yes it is ok and 0 for don't use that
7731          * tag. A secondary function it will do is purge out old tags that
7732          * can be removed.
7733          */
7734         struct sctpvtaghead *chain;
7735         struct sctp_tagblock *twait_block;
7736         struct sctpasochead *head;
7737         struct sctp_tcb *stcb;
7738         int i;
7739
7740         SCTP_INP_INFO_RLOCK();
7741         head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(tag,
7742                                                                 SCTP_BASE_INFO(hashasocmark))];
7743         if (head == NULL) {
7744                 /* invalid vtag */
7745                 goto skip_vtag_check;
7746         }
7747         LIST_FOREACH(stcb, head, sctp_asocs) {
7748                 /* We choose not to lock anything here. TCB's can't be
7749                  * removed since we have the read lock, so they can't
7750                  * be freed on us, same thing for the INP. I may
7751                  * be wrong with this assumption, but we will go
7752                  * with it for now :-)
7753                  */
7754                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
7755                         continue;
7756                 }
7757                 if (stcb->asoc.my_vtag == tag) {
7758                         /* candidate */
7759                         if (stcb->rport != rport) {
7760                                 continue;
7761                         }
7762                         if (stcb->sctp_ep->sctp_lport != lport) {
7763                                 continue;
7764                         }
7765                         /* Its a used tag set */
7766                         SCTP_INP_INFO_RUNLOCK();
7767                         return (0);
7768                 }
7769         }
7770 skip_vtag_check:
7771
7772         chain = &SCTP_BASE_INFO(vtag_timewait)[(tag % SCTP_STACK_VTAG_HASH_SIZE)];
7773         /* Now what about timed wait ? */
7774         LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) {
7775                 /*
7776                  * Block(s) are present, lets see if we have this tag in the
7777                  * list
7778                  */
7779                 for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) {
7780                         if (twait_block->vtag_block[i].v_tag == 0) {
7781                                 /* not used */
7782                                 continue;
7783                         } else if ((long)twait_block->vtag_block[i].tv_sec_at_expire  <
7784                                    now->tv_sec) {
7785                                 /* Audit expires this guy */
7786                                 twait_block->vtag_block[i].tv_sec_at_expire = 0;
7787                                 twait_block->vtag_block[i].v_tag = 0;
7788                                 twait_block->vtag_block[i].lport = 0;
7789                                 twait_block->vtag_block[i].rport = 0;
7790                         } else if ((twait_block->vtag_block[i].v_tag == tag) &&
7791                                    (twait_block->vtag_block[i].lport == lport) &&
7792                                    (twait_block->vtag_block[i].rport == rport)) {
7793                                 /* Bad tag, sorry :< */
7794                                 SCTP_INP_INFO_RUNLOCK();
7795                                 return (0);
7796                         }
7797                 }
7798         }
7799         SCTP_INP_INFO_RUNLOCK();
7800         return (1);
7801 }
7802
7803 static void
7804 sctp_drain_mbufs(struct sctp_tcb *stcb)
7805 {
7806         /*
7807          * We must hunt this association for MBUF's past the cumack (i.e.
7808          * out of order data that we can renege on).
7809          */
7810         struct sctp_association *asoc;
7811         struct sctp_tmit_chunk *chk, *nchk;
7812         uint32_t cumulative_tsn_p1;
7813         struct sctp_queued_to_read *ctl, *nctl;
7814         int cnt, strmat;
7815         uint32_t gap, i;
7816         int fnd = 0;
7817
7818         /* We look for anything larger than the cum-ack + 1 */
7819
7820         asoc = &stcb->asoc;
7821         if (asoc->cumulative_tsn == asoc->highest_tsn_inside_map) {
7822                 /* none we can reneg on. */
7823                 return;
7824         }
7825         SCTP_STAT_INCR(sctps_protocol_drains_done);
7826         cumulative_tsn_p1 = asoc->cumulative_tsn + 1;
7827         cnt = 0;
7828         /* First look in the re-assembly queue */
7829         TAILQ_FOREACH_SAFE(chk, &asoc->reasmqueue, sctp_next, nchk) {
7830                 if (SCTP_TSN_GT(chk->rec.data.TSN_seq, cumulative_tsn_p1)) {
7831                         /* Yep it is above cum-ack */
7832                         cnt++;
7833                         SCTP_CALC_TSN_TO_GAP(gap, chk->rec.data.TSN_seq, asoc->mapping_array_base_tsn);
7834                         asoc->size_on_reasm_queue = sctp_sbspace_sub(asoc->size_on_reasm_queue, chk->send_size);
7835                         sctp_ucount_decr(asoc->cnt_on_reasm_queue);
7836                         SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap);
7837                         TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
7838                         if (chk->data) {
7839                                 sctp_m_freem(chk->data);
7840                                 chk->data = NULL;
7841                         }
7842                         sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
7843                 }
7844         }
7845         /* Ok that was fun, now we will drain all the inbound streams? */
7846         for (strmat = 0; strmat < asoc->streamincnt; strmat++) {
7847                 TAILQ_FOREACH_SAFE(ctl, &asoc->strmin[strmat].inqueue, next, nctl) {
7848                         if (SCTP_TSN_GT(ctl->sinfo_tsn, cumulative_tsn_p1)) {
7849                                 /* Yep it is above cum-ack */
7850                                 cnt++;
7851                                 SCTP_CALC_TSN_TO_GAP(gap, ctl->sinfo_tsn, asoc->mapping_array_base_tsn);
7852                                 asoc->size_on_all_streams = sctp_sbspace_sub(asoc->size_on_all_streams, ctl->length);
7853                                 sctp_ucount_decr(asoc->cnt_on_all_streams);
7854                                 SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap);
7855                                 TAILQ_REMOVE(&asoc->strmin[strmat].inqueue, ctl, next);
7856                                 if (ctl->data) {
7857                                         sctp_m_freem(ctl->data);
7858                                         ctl->data = NULL;
7859                                 }
7860                                 sctp_free_remote_addr(ctl->whoFrom);
7861                                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_readq), ctl);
7862                                 SCTP_DECR_READQ_COUNT();
7863                         }
7864                 }
7865         }
7866         if (cnt) {
7867                 /* We must back down to see what the new highest is */
7868                 for (i = asoc->highest_tsn_inside_map; SCTP_TSN_GE(i, asoc->mapping_array_base_tsn); i--) {
7869                         SCTP_CALC_TSN_TO_GAP(gap, i, asoc->mapping_array_base_tsn);
7870                         if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap)) {
7871                                 asoc->highest_tsn_inside_map = i;
7872                                 fnd = 1;
7873                                 break;
7874                         }
7875                 }
7876                 if (!fnd) {
7877                         asoc->highest_tsn_inside_map = asoc->mapping_array_base_tsn - 1;
7878                 }
7879
7880                 /*
7881                  * Question, should we go through the delivery queue? The only
7882                  * reason things are on here is the app not reading OR a p-d-api up.
7883                  * An attacker COULD send enough in to initiate the PD-API and then
7884                  * send a bunch of stuff to other streams... these would wind up on
7885                  * the delivery queue.. and then we would not get to them. But in
7886                  * order to do this I then have to back-track and un-deliver
7887                  * sequence numbers in streams.. el-yucko. I think for now we will
7888                  * NOT look at the delivery queue and leave it to be something to
7889                  * consider later. An alternative would be to abort the P-D-API with
7890                  * a notification and then deliver the data.... Or another method
7891                  * might be to keep track of how many times the situation occurs and
7892                  * if we see a possible attack underway just abort the association.
7893                  */
7894 #ifdef SCTP_DEBUG
7895                 SCTPDBG(SCTP_DEBUG_PCB1, "Freed %d chunks from reneg harvest\n", cnt);
7896 #endif
7897                 /*
7898                  * Now do we need to find a new
7899                  * asoc->highest_tsn_inside_map?
7900                  */
7901                 asoc->last_revoke_count = cnt;
7902                 (void)SCTP_OS_TIMER_STOP(&stcb->asoc.dack_timer.timer);
7903                 /*sa_ignore NO_NULL_CHK*/
7904                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
7905                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_DRAIN, SCTP_SO_NOT_LOCKED);
7906         }
7907         /*
7908          * Another issue, in un-setting the TSN's in the mapping array we
7909          * DID NOT adjust the highest_tsn marker.  This will cause one of two
7910          * things to occur. It may cause us to do extra work in checking for
7911          * our mapping array movement. More importantly it may cause us to
7912          * SACK every datagram. This may not be a bad thing though since we
7913          * will recover once we get our cum-ack above and all this stuff we
7914          * dumped recovered.
7915          */
7916 }
7917
7918 void
7919 sctp_drain()
7920 {
7921         /*
7922          * We must walk the PCB lists for ALL associations here. The system
7923          * is LOW on MBUF's and needs help. This is where reneging will
7924          * occur. We really hope this does NOT happen!
7925          */
7926 #if defined(__FreeBSD__) && __FreeBSD_version >= 801000
7927         VNET_ITERATOR_DECL(vnet_iter);
7928 #else
7929         struct sctp_inpcb *inp;
7930         struct sctp_tcb *stcb;
7931
7932         SCTP_STAT_INCR(sctps_protocol_drain_calls);
7933         if (SCTP_BASE_SYSCTL(sctp_do_drain) == 0) {
7934                 return;
7935         }
7936 #endif
7937 #if defined(__FreeBSD__) && __FreeBSD_version >= 801000
7938         VNET_LIST_RLOCK_NOSLEEP();
7939         VNET_FOREACH(vnet_iter) {
7940                 CURVNET_SET(vnet_iter);
7941                 struct sctp_inpcb *inp;
7942                 struct sctp_tcb *stcb;
7943 #endif
7944
7945 #if defined(__FreeBSD__) && __FreeBSD_version >= 801000
7946                 SCTP_STAT_INCR(sctps_protocol_drain_calls);
7947                 if (SCTP_BASE_SYSCTL(sctp_do_drain) == 0) {
7948 #ifdef VIMAGE
7949                         continue;
7950 #else
7951                         return;
7952 #endif
7953                 }
7954 #endif
7955                 SCTP_INP_INFO_RLOCK();
7956                 LIST_FOREACH(inp, &SCTP_BASE_INFO(listhead), sctp_list) {
7957                         /* For each endpoint */
7958                         SCTP_INP_RLOCK(inp);
7959                         LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
7960                                 /* For each association */
7961                                 SCTP_TCB_LOCK(stcb);
7962                                 sctp_drain_mbufs(stcb);
7963                                 SCTP_TCB_UNLOCK(stcb);
7964                         }
7965                         SCTP_INP_RUNLOCK(inp);
7966                 }
7967                 SCTP_INP_INFO_RUNLOCK();
7968 #if defined(__FreeBSD__) && __FreeBSD_version >= 801000
7969                 CURVNET_RESTORE();
7970         }
7971         VNET_LIST_RUNLOCK_NOSLEEP();
7972 #endif
7973 }
7974
7975 /*
7976  * start a new iterator
7977  * iterates through all endpoints and associations based on the pcb_state
7978  * flags and asoc_state.  "af" (mandatory) is executed for all matching
7979  * assocs and "ef" (optional) is executed when the iterator completes.
7980  * "inpf" (optional) is executed for each new endpoint as it is being
7981  * iterated through. inpe (optional) is called when the inp completes
7982  * its way through all the stcbs.
7983  */
7984 int
7985 sctp_initiate_iterator(inp_func inpf,
7986                        asoc_func af,
7987                        inp_func inpe,
7988                        uint32_t pcb_state,
7989                        uint32_t pcb_features,
7990                        uint32_t asoc_state,
7991                        void *argp,
7992                        uint32_t argi,
7993                        end_func ef,
7994                        struct sctp_inpcb *s_inp,
7995                        uint8_t chunk_output_off)
7996 {
7997         struct sctp_iterator *it = NULL;
7998
7999         if (af == NULL) {
8000                 return (-1);
8001         }
8002         SCTP_MALLOC(it, struct sctp_iterator *, sizeof(struct sctp_iterator),
8003                     SCTP_M_ITER);
8004         if (it == NULL) {
8005                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOMEM);
8006                 return (ENOMEM);
8007         }
8008         memset(it, 0, sizeof(*it));
8009         it->function_assoc = af;
8010         it->function_inp = inpf;
8011         if (inpf)
8012                 it->done_current_ep = 0;
8013         else
8014                 it->done_current_ep = 1;
8015         it->function_atend = ef;
8016         it->pointer = argp;
8017         it->val = argi;
8018         it->pcb_flags = pcb_state;
8019         it->pcb_features = pcb_features;
8020         it->asoc_state = asoc_state;
8021         it->function_inp_end = inpe;
8022         it->no_chunk_output = chunk_output_off;
8023 #if defined(__FreeBSD__) && __FreeBSD_version >= 801000
8024         it->vn = curvnet;
8025 #endif
8026         if (s_inp) {
8027                 /* Assume lock is held here */
8028                 it->inp = s_inp;
8029                 SCTP_INP_INCR_REF(it->inp);
8030                 it->iterator_flags = SCTP_ITERATOR_DO_SINGLE_INP;
8031         } else {
8032                 SCTP_INP_INFO_RLOCK();
8033                 it->inp = LIST_FIRST(&SCTP_BASE_INFO(listhead));
8034                 if (it->inp) {
8035                         SCTP_INP_INCR_REF(it->inp);
8036                 }
8037                 SCTP_INP_INFO_RUNLOCK();
8038                 it->iterator_flags = SCTP_ITERATOR_DO_ALL_INP;
8039
8040         }
8041         SCTP_IPI_ITERATOR_WQ_LOCK();
8042
8043         TAILQ_INSERT_TAIL(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
8044         if (sctp_it_ctl.iterator_running == 0) {
8045                 sctp_wakeup_iterator();
8046         }
8047         SCTP_IPI_ITERATOR_WQ_UNLOCK();
8048         /* sa_ignore MEMLEAK {memory is put on the tailq for the iterator} */
8049         return (0);
8050 }