sctp_pcb.c

Version: - FREEBSD - FREEBSD-13-STABLE - FREEBSD-13-0 - FREEBSD-12-STABLE - FREEBSD-12-0 - FREEBSD-11-STABLE - FREEBSD-11-0 - FREEBSD-10-STABLE - FREEBSD-10-0 - FREEBSD-9-STABLE - FREEBSD-9-0 - FREEBSD-8-STABLE - FREEBSD-8-0 - FREEBSD-7-STABLE - FREEBSD-7-0 - FREEBSD-6-STABLE - FREEBSD-6-0 - FREEBSD-5-STABLE - FREEBSD-5-0 - FREEBSD-4-STABLE - FREEBSD-3-STABLE - FREEBSD22 - l41 - OPENBSD - linux-2.6 - MK84 - PLAN9 - xnu-8792
SearchContext: - none - 3 - 10
    1 /*      $KAME: sctp_pcb.c,v 1.37 2004/08/17 06:28:02 t-momose Exp $     */
    2 
    3 /*
    4  * Copyright (c) 2001, 2002, 2003, 2004 Cisco Systems, Inc.
    5  * All rights reserved.
    6  *
    7  * Redistribution and use in source and binary forms, with or without
    8  * modification, are permitted provided that the following conditions
    9  * are met:
   10  * 1. Redistributions of source code must retain the above copyright
   11  *    notice, this list of conditions and the following disclaimer.
   12  * 2. Redistributions in binary form must reproduce the above copyright
   13  *    notice, this list of conditions and the following disclaimer in the
   14  *    documentation and/or other materials provided with the distribution.
   15  * 3. All advertising materials mentioning features or use of this software
   16  *    must display the following acknowledgement:
   17  *      This product includes software developed by Cisco Systems, Inc.
   18  * 4. Neither the name of the project nor the names of its contributors
   19  *    may be used to endorse or promote products derived from this software
   20  *    without specific prior written permission.
   21  *
   22  * THIS SOFTWARE IS PROVIDED BY CISCO SYSTEMS AND CONTRIBUTORS ``AS IS'' AND
   23  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   24  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   25  * ARE DISCLAIMED.  IN NO EVENT SHALL CISCO SYSTEMS OR CONTRIBUTORS BE LIABLE
   26  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   27  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   28  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   29  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   30  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   31  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   32  * SUCH DAMAGE.
   33  */
   34 #if !(defined(__OpenBSD__) || defined(__APPLE__))
   35 #include "opt_ipsec.h"
   36 #endif
   37 #if defined(__FreeBSD__) || defined(__DragonFly__)
   38 #include "opt_compat.h"
   39 #include "opt_inet6.h"
   40 #include "opt_inet.h"
   41 #endif
   42 #if defined(__NetBSD__)
   43 #include "opt_inet.h"
   44 #endif
   45 #ifdef __APPLE__
   46 #include <sctp.h>
   47 #elif !defined(__OpenBSD__)
   48 #include "opt_sctp.h"
   49 #endif
   50 
   51 #include <sys/param.h>
   52 #include <sys/systm.h>
   53 #include <sys/malloc.h>
   54 #include <sys/mbuf.h>
   55 #include <sys/domain.h>
   56 #include <sys/protosw.h>
   57 #include <sys/socket.h>
   58 #include <sys/socketvar.h>
   59 #include <sys/proc.h>
   60 #include <sys/priv.h>
   61 #include <sys/kernel.h>
   62 #include <sys/sysctl.h>
   63 #include <sys/thread2.h>
   64 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
   65 #include <sys/random.h>
   66 #endif
   67 #if defined(__NetBSD__)
   68 #include <sys/rnd.h>
   69 #endif
   70 #if defined(__OpenBSD__)
   71 #include <dev/rndvar.h>
   72 #endif
   73 
   74 #if defined(__APPLE__)
   75 #include <netinet/sctp_callout.h>
   76 #elif defined(__OpenBSD__)
   77 #include <sys/timeout.h>
   78 #else
   79 #include <sys/callout.h>
   80 #endif
   81 
   82 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000)
   83 #include <sys/limits.h>
   84 #else
   85 #include <machine/limits.h>
   86 #endif
   87 #include <machine/cpu.h>
   88 
   89 #include <net/if.h>
   90 #include <net/if_types.h>
   91 #include <net/route.h>
   92 #include <netinet/in.h>
   93 #include <netinet/in_systm.h>
   94 #include <netinet/ip.h>
   95 #include <netinet/in_pcb.h>
   96 #include <netinet/in_var.h>
   97 #include <netinet/ip_var.h>
   98 
   99 #ifdef INET6
  100 #include <netinet/ip6.h>
  101 #include <netinet6/ip6_var.h>
  102 #include <netinet6/scope6_var.h>
  103 #if defined(__FreeBSD__) || defined(__NetBSD__) || defined(__DragonFly__)
  104 #include <netinet6/in6_pcb.h>
  105 #elif defined(__OpenBSD__)
  106 #include <netinet/in_pcb.h>
  107 #endif
  108 #endif /* INET6 */
  109 
  110 #ifdef IPSEC
  111 #ifndef __OpenBSD__
  112 #include <netinet6/ipsec.h>
  113 #include <netproto/key/key.h>
  114 #else
  115 #undef IPSEC
  116 #endif
  117 #endif /* IPSEC */
  118 
  119 #include <netinet/sctp_var.h>
  120 #include <netinet/sctp_pcb.h>
  121 #include <netinet/sctputil.h>
  122 #include <netinet/sctp.h>
  123 #include <netinet/sctp_header.h>
  124 #include <netinet/sctp_asconf.h>
  125 #include <netinet/sctp_output.h>
  126 #include <netinet/sctp_timer.h>
  127 
  128 #ifndef SCTP_PCBHASHSIZE
  129 /* default number of association hash buckets in each endpoint */
  130 #define SCTP_PCBHASHSIZE 256
  131 #endif
  132 
  133 #ifdef SCTP_DEBUG
  134 u_int32_t sctp_debug_on = 0;
  135 #endif /* SCTP_DEBUG */
  136 
  137 u_int32_t sctp_pegs[SCTP_NUMBER_OF_PEGS];
  138 
  139 int sctp_pcbtblsize = SCTP_PCBHASHSIZE;
  140 
  141 struct sctp_epinfo sctppcbinfo;
  142 
  143 /* FIX: we don't handle multiple link local scopes */
  144 /* "scopeless" replacement IN6_ARE_ADDR_EQUAL */
  145 int
  146 SCTP6_ARE_ADDR_EQUAL(struct in6_addr *a, struct in6_addr *b)
  147 {
  148         struct in6_addr tmp_a, tmp_b;
  149         /* use a copy of a and b */
  150         tmp_a = *a;
  151         tmp_b = *b;
  152         in6_clearscope(&tmp_a);
  153         in6_clearscope(&tmp_b);
  154         return (IN6_ARE_ADDR_EQUAL(&tmp_a, &tmp_b));
  155 }
  156 
  157 #ifdef __OpenBSD__
  158 extern int ipport_firstauto;
  159 extern int ipport_lastauto;
  160 extern int ipport_hifirstauto;
  161 extern int ipport_hilastauto;
  162 #endif
  163 
  164 #if defined(__FreeBSD__) && __FreeBSD_version > 500000
  165 
  166 #ifndef xyzzy
  167 void sctp_validate_no_locks(void);
  168 
  169 void
  170 SCTP_INP_RLOCK(struct sctp_inpcb *inp)
  171 {
  172         struct sctp_tcb *stcb;
  173         LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
  174                 if (mtx_owned(&(stcb)->tcb_mtx))
  175                         panic("I own TCB lock?");
  176         }
  177         if (mtx_owned(&(inp)->inp_mtx))
  178                 panic("INP Recursive Lock-R");
  179         mtx_lock(&(inp)->inp_mtx);
  180 }
  181 
  182 void
  183 SCTP_INP_WLOCK(struct sctp_inpcb *inp)
  184 {
  185         SCTP_INP_RLOCK(inp);
  186 }
  187 
  188 void
  189 SCTP_INP_INFO_RLOCK(void)
  190 {
  191         struct sctp_inpcb *inp;
  192         struct sctp_tcb *stcb;
  193         LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) {
  194                 if (mtx_owned(&(inp)->inp_mtx))
  195                         panic("info-lock and own inp lock?");
  196                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
  197                         if (mtx_owned(&(stcb)->tcb_mtx))
  198                                 panic("Info lock and own a tcb lock?");
  199                 }
  200         }
  201         if (mtx_owned(&sctppcbinfo.ipi_ep_mtx))
  202                 panic("INP INFO Recursive Lock-R");
  203         mtx_lock(&sctppcbinfo.ipi_ep_mtx);
  204 }
  205 
  206 void
  207 SCTP_INP_INFO_WLOCK(void)
  208 {
  209         SCTP_INP_INFO_RLOCK();
  210 }
  211 
  212 
  213 void sctp_validate_no_locks(void)
  214 {
  215         struct sctp_inpcb *inp;
  216         struct sctp_tcb *stcb;
  217 
  218         if (mtx_owned(&sctppcbinfo.ipi_ep_mtx))
  219                 panic("INP INFO lock is owned?");
  220 
  221         LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) {
  222                 if (mtx_owned(&(inp)->inp_mtx))
  223                         panic("You own an INP lock?");
  224                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
  225                         if (mtx_owned(&(stcb)->tcb_mtx))
  226                                 panic("You own a TCB lock?");
  227                 }
  228         }
  229 }
  230 
  231 #endif
  232 #endif
  233 
  234 void
  235 sctp_fill_pcbinfo(struct sctp_pcbinfo *spcb)
  236 {
  237         /* We really don't need
  238          * to lock this, but I will
  239          * just because it does not hurt.
  240          */
  241         SCTP_INP_INFO_RLOCK();
  242         spcb->ep_count = sctppcbinfo.ipi_count_ep;
  243         spcb->asoc_count = sctppcbinfo.ipi_count_asoc;
  244         spcb->laddr_count = sctppcbinfo.ipi_count_laddr;
  245         spcb->raddr_count = sctppcbinfo.ipi_count_raddr;
  246         spcb->chk_count = sctppcbinfo.ipi_count_chunk;
  247         spcb->sockq_count = sctppcbinfo.ipi_count_sockq;
  248         spcb->mbuf_track = sctppcbinfo.mbuf_track;
  249         SCTP_INP_INFO_RUNLOCK();
  250 }
  251 
  252 
  253 /*
  254  * Notes on locks for FreeBSD 5 and up. All association
  255  * lookups that have a definte ep, the INP structure is
  256  * assumed to be locked for reading. If we need to go
  257  * find the INP (ususally when a **inp is passed) then
  258  * we must lock the INFO structure first and if needed
  259  * lock the INP too. Note that if we lock it we must
  260  *
  261  */
  262 
  263 
  264 /*
  265  * Given a endpoint, look and find in its association list any association
  266  * with the "to" address given. This can be a "from" address, too, for
  267  * inbound packets. For outbound packets it is a true "to" address.
  268  */
  269 static struct sctp_tcb *
  270 sctp_tcb_special_locate(struct sctp_inpcb **inp_p, struct sockaddr *from,
  271                         struct sockaddr *to, struct sctp_nets **netp)
  272 {
  273         /**** ASSUMSES THE CALLER holds the INP_INFO_RLOCK */
  274 
  275         /*
  276          * Note for this module care must be taken when observing what to is
  277          * for. In most of the rest of the code the TO field represents my
  278          * peer and the FROM field represents my address. For this module it
  279          * is reversed of that.
  280          */
  281         /*
  282          * If we support the TCP model, then we must now dig through to
  283          * see if we can find our endpoint in the list of tcp ep's.
  284          */
  285         uint16_t lport, rport;
  286         struct sctppcbhead *ephead;
  287         struct sctp_inpcb *inp;
  288         struct sctp_laddr *laddr;
  289         struct sctp_tcb *stcb;
  290         struct sctp_nets *net;
  291 
  292         if ((to == NULL) || (from == NULL)) {
  293                 return (NULL);
  294         }
  295 
  296         if (to->sa_family == AF_INET && from->sa_family == AF_INET) {
  297                 lport = ((struct sockaddr_in *)to)->sin_port;
  298                 rport = ((struct sockaddr_in *)from)->sin_port;
  299         } else if (to->sa_family == AF_INET6 && from->sa_family == AF_INET6) {
  300                 lport = ((struct sockaddr_in6 *)to)->sin6_port;
  301                 rport = ((struct sockaddr_in6 *)from)->sin6_port;
  302         } else {
  303                 return NULL;
  304         }
  305         ephead = &sctppcbinfo.sctp_tcpephash[SCTP_PCBHASH_ALLADDR(
  306                                                      (lport + rport), sctppcbinfo.hashtcpmark)];
  307         /*
  308          * Ok now for each of the guys in this bucket we must look
  309          * and see:
  310          *  - Does the remote port match.
  311          *  - Does there single association's addresses match this
  312          *    address (to).
  313          * If so we update p_ep to point to this ep and return the
  314          * tcb from it.
  315          */
  316         LIST_FOREACH(inp, ephead, sctp_hash) {
  317                 if (lport != inp->sctp_lport) {
  318                         continue;
  319                 }
  320                 SCTP_INP_RLOCK(inp);
  321                 /* check to see if the ep has one of the addresses */
  322                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
  323                         /* We are NOT bound all, so look further */
  324                         int match = 0;
  325 
  326                         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
  327                                 if (laddr->ifa == NULL) {
  328 #ifdef SCTP_DEBUG
  329                                         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
  330                                                 kprintf("An ounce of prevention is worth a pound of cure\n");
  331                                         }
  332 #endif
  333                                         continue;
  334                                 }
  335                                 if (laddr->ifa->ifa_addr == NULL) {
  336 #ifdef SCTP_DEBUG
  337                                         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
  338                                                 kprintf("ifa with a NULL address\n");
  339                                         }
  340 #endif
  341                                         continue;
  342                                 }
  343                                 if (laddr->ifa->ifa_addr->sa_family ==
  344                                     to->sa_family) {
  345                                         /* see if it matches */
  346                                         struct sockaddr_in *intf_addr, *sin;
  347                                         intf_addr = (struct sockaddr_in *)
  348                                                 laddr->ifa->ifa_addr;
  349                                         sin = (struct sockaddr_in *)to;
  350                                         if (from->sa_family == AF_INET) {
  351                                                 if (sin->sin_addr.s_addr ==
  352                                                     intf_addr->sin_addr.s_addr) {
  353                                                         match = 1;
  354                                                         SCTP_INP_RUNLOCK(inp);
  355                                                         break;
  356                                                 }
  357                                         } else {
  358                                                 struct sockaddr_in6 *intf_addr6;
  359                                                 struct sockaddr_in6 *sin6;
  360                                                 sin6 = (struct sockaddr_in6 *)
  361                                                         to;
  362                                                 intf_addr6 = (struct sockaddr_in6 *)
  363                                                         laddr->ifa->ifa_addr;
  364 
  365                                                 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
  366                                                                          &intf_addr6->sin6_addr)) {
  367                                                         match = 1;
  368                                                         SCTP_INP_RUNLOCK(inp);
  369                                                         break;
  370                                                 }
  371                                         }
  372                                 }
  373                         }
  374                         if (match == 0) {
  375                                 /* This endpoint does not have this address */
  376                                 SCTP_INP_RUNLOCK(inp);
  377                                 continue;
  378                         }
  379                 }
  380                 /*
  381                  * Ok if we hit here the ep has the address, does it hold the
  382                  * tcb?
  383                  */
  384 
  385                 stcb = LIST_FIRST(&inp->sctp_asoc_list);
  386                 if (stcb == NULL) {
  387                         SCTP_INP_RUNLOCK(inp);
  388                         continue;
  389                 }
  390                 SCTP_TCB_LOCK(stcb);
  391                 if (stcb->rport != rport) {
  392                         /* remote port does not match. */
  393                         SCTP_TCB_UNLOCK(stcb);
  394                         SCTP_INP_RUNLOCK(inp);
  395                         continue;
  396                 }
  397                 /* Does this TCB have a matching address? */
  398                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
  399                         if (net->ro._l_addr.sa.sa_family != from->sa_family) {
  400                                 /* not the same family, can't be a match */
  401                                 continue;
  402                         }
  403                         if (from->sa_family == AF_INET) {
  404                                 struct sockaddr_in *sin, *rsin;
  405                                 sin = (struct sockaddr_in *)&net->ro._l_addr;
  406                                 rsin = (struct sockaddr_in *)from;
  407                                 if (sin->sin_addr.s_addr ==
  408                                     rsin->sin_addr.s_addr) {
  409                                         /* found it */
  410                                         if (netp != NULL) {
  411                                                 *netp = net;
  412                                         }
  413                                         /* Update the endpoint pointer */
  414                                         *inp_p = inp;
  415                                         SCTP_INP_RUNLOCK(inp);
  416                                         return (stcb);
  417                                 }
  418                         } else {
  419                                 struct sockaddr_in6 *sin6, *rsin6;
  420                                 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
  421                                 rsin6 = (struct sockaddr_in6 *)from;
  422                                 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
  423                                                          &rsin6->sin6_addr)) {
  424                                         /* found it */
  425                                         if (netp != NULL) {
  426                                                 *netp = net;
  427                                         }
  428                                         /* Update the endpoint pointer */
  429                                         *inp_p = inp;
  430                                         SCTP_INP_RUNLOCK(inp);
  431                                         return (stcb);
  432                                 }
  433                         }
  434                 }
  435                 SCTP_TCB_UNLOCK(stcb);
  436 
  437                 SCTP_INP_RUNLOCK(inp);
  438         }
  439         return (NULL);
  440 }
  441 
  442 struct sctp_tcb *
  443 sctp_findassociation_ep_asconf(struct mbuf *m, int iphlen, int offset,
  444     struct sctphdr *sh, struct sctp_inpcb **inp_p, struct sctp_nets **netp)
  445 {
  446         struct sctp_tcb *stcb;
  447         struct sockaddr_in *sin;
  448         struct sockaddr_in6 *sin6;
  449         struct sockaddr_storage local_store, remote_store;
  450         struct ip *iph;
  451         struct sctp_paramhdr parm_buf, *phdr;
  452         int ptype;
  453 
  454         memset(&local_store, 0, sizeof(local_store));
  455         memset(&remote_store, 0, sizeof(remote_store));
  456 
  457         /* First get the destination address setup too. */
  458         iph = mtod(m, struct ip *);
  459         if (iph->ip_v == IPVERSION) {
  460                 /* its IPv4 */
  461                 sin = (struct sockaddr_in *)&local_store;
  462                 sin->sin_family = AF_INET;
  463                 sin->sin_len = sizeof(*sin);
  464                 sin->sin_port = sh->dest_port;
  465                 sin->sin_addr.s_addr = iph->ip_dst.s_addr ;
  466         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
  467                 /* its IPv6 */
  468                 struct ip6_hdr *ip6;
  469                 ip6 = mtod(m, struct ip6_hdr *);
  470                 sin6 = (struct sockaddr_in6 *)&local_store;
  471                 sin6->sin6_family = AF_INET6;
  472                 sin6->sin6_len = sizeof(*sin6);
  473                 sin6->sin6_port = sh->dest_port;
  474                 sin6->sin6_addr = ip6->ip6_dst;
  475         } else {
  476                 return NULL;
  477         }
  478 
  479         phdr = sctp_get_next_param(m, offset + sizeof(struct sctp_asconf_chunk),
  480             &parm_buf, sizeof(struct sctp_paramhdr));
  481         if (phdr == NULL) {
  482 #ifdef SCTP_DEBUG
  483                 if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
  484                         kprintf("sctp_process_control: failed to get asconf lookup addr\n");
  485                 }
  486 #endif /* SCTP_DEBUG */
  487                 return NULL;
  488         }
  489         ptype = (int)((u_int)ntohs(phdr->param_type));
  490         /* get the correlation address */
  491         if (ptype == SCTP_IPV6_ADDRESS) {
  492                 /* ipv6 address param */
  493                 struct sctp_ipv6addr_param *p6, p6_buf;
  494                 if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv6addr_param)) {
  495                         return NULL;
  496                 }
  497 
  498                 p6 = (struct sctp_ipv6addr_param *)sctp_get_next_param(m,
  499                     offset + sizeof(struct sctp_asconf_chunk),
  500                     &p6_buf.ph, sizeof(*p6));
  501                 if (p6 == NULL) {
  502 #ifdef SCTP_DEBUG
  503                         if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
  504                                 kprintf("sctp_process_control: failed to get asconf v6 lookup addr\n");
  505                         }
  506 #endif /* SCTP_DEBUG */
  507                         return (NULL);
  508                 }
  509                 sin6 = (struct sockaddr_in6 *)&remote_store;
  510                 sin6->sin6_family = AF_INET6;
  511                 sin6->sin6_len = sizeof(*sin6);
  512                 sin6->sin6_port = sh->src_port;
  513                 memcpy(&sin6->sin6_addr, &p6->addr, sizeof(struct in6_addr));
  514         } else if (ptype == SCTP_IPV4_ADDRESS) {
  515                 /* ipv4 address param */
  516                 struct sctp_ipv4addr_param *p4, p4_buf;
  517                 if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv4addr_param)) {
  518                         return NULL;
  519                 }
  520 
  521                 p4 = (struct sctp_ipv4addr_param *)sctp_get_next_param(m,
  522                     offset + sizeof(struct sctp_asconf_chunk),
  523                     &p4_buf.ph, sizeof(*p4));
  524                 if (p4 == NULL) {
  525 #ifdef SCTP_DEBUG
  526                         if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
  527                                 kprintf("sctp_process_control: failed to get asconf v4 lookup addr\n");
  528                         }
  529 #endif /* SCTP_DEBUG */
  530                         return (NULL);
  531                 }
  532                 sin = (struct sockaddr_in *)&remote_store;
  533                 sin->sin_family = AF_INET;
  534                 sin->sin_len = sizeof(*sin);
  535                 sin->sin_port = sh->src_port;
  536                 memcpy(&sin->sin_addr, &p4->addr, sizeof(struct in_addr));
  537         } else {
  538                 /* invalid address param type */
  539                 return NULL;
  540         }
  541 
  542         stcb = sctp_findassociation_ep_addr(inp_p,
  543             (struct sockaddr *)&remote_store, netp,
  544             (struct sockaddr *)&local_store, NULL);
  545         return (stcb);
  546 }
  547 
  548 struct sctp_tcb *
  549 sctp_findassociation_ep_addr(struct sctp_inpcb **inp_p, struct sockaddr *remote,
  550     struct sctp_nets **netp, struct sockaddr *local, struct sctp_tcb *locked_tcb)
  551 {
  552         struct sctpasochead *head;
  553         struct sctp_inpcb *inp;
  554         struct sctp_tcb *stcb;
  555         struct sctp_nets *net;
  556         uint16_t rport;
  557 
  558         inp = *inp_p;
  559         if (remote->sa_family == AF_INET) {
  560                 rport = (((struct sockaddr_in *)remote)->sin_port);
  561         } else if (remote->sa_family == AF_INET6) {
  562                 rport = (((struct sockaddr_in6 *)remote)->sin6_port);
  563         } else {
  564                 return (NULL);
  565         }
  566         if (locked_tcb) {
  567                 /* UN-lock so we can do proper locking here
  568                  * this occurs when called from load_addresses_from_init.
  569                  */
  570                 SCTP_TCB_UNLOCK(locked_tcb);
  571         }
  572         SCTP_INP_INFO_RLOCK();
  573         if (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
  574                 /*
  575                  * Now either this guy is our listner or it's the connector.
  576                  * If it is the one that issued the connect, then it's only
  577                  * chance is to be the first TCB in the list. If it is the
  578                  * acceptor, then do the special_lookup to hash and find the
  579                  * real inp.
  580                  */
  581                 if (inp->sctp_flags & SCTP_PCB_FLAGS_ACCEPTING) {
  582                         /* to is peer addr, from is my addr */
  583                         stcb = sctp_tcb_special_locate(inp_p, remote, local,
  584                                                        netp);
  585                         if ((stcb != NULL) && (locked_tcb == NULL)){
  586                                 /* we have a locked tcb, lower refcount */
  587                                 SCTP_INP_WLOCK(inp);
  588                                 SCTP_INP_DECR_REF(inp);
  589                                 SCTP_INP_WUNLOCK(inp);
  590                         }
  591                         if (locked_tcb != NULL) {
  592                                 SCTP_INP_RLOCK(locked_tcb->sctp_ep);
  593                                 SCTP_TCB_LOCK(locked_tcb);
  594                                 SCTP_INP_RUNLOCK(locked_tcb->sctp_ep);
  595                                 if (stcb != NULL)
  596                                         SCTP_TCB_UNLOCK(stcb);
  597                         }
  598                         SCTP_INP_INFO_RUNLOCK();
  599                         return (stcb);
  600                 } else {
  601                         SCTP_INP_WLOCK(inp);
  602                         stcb = LIST_FIRST(&inp->sctp_asoc_list);
  603                         if (stcb == NULL) {
  604                                 goto null_return;
  605                         }
  606                         SCTP_TCB_LOCK(stcb);
  607                         if (stcb->rport != rport) {
  608                                 /* remote port does not match. */
  609                                 SCTP_TCB_UNLOCK(stcb);
  610                                 goto null_return;
  611                         }
  612                         /* now look at the list of remote addresses */
  613                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
  614                                 if (net->ro._l_addr.sa.sa_family !=
  615                                     remote->sa_family) {
  616                                         /* not the same family */
  617                                         continue;
  618                                 }
  619                                 if (remote->sa_family == AF_INET) {
  620                                         struct sockaddr_in *sin, *rsin;
  621                                         sin = (struct sockaddr_in *)
  622                                                 &net->ro._l_addr;
  623                                         rsin = (struct sockaddr_in *)remote;
  624                                         if (sin->sin_addr.s_addr ==
  625                                             rsin->sin_addr.s_addr) {
  626                                                 /* found it */
  627                                                 if (netp != NULL) {
  628                                                         *netp = net;
  629                                                 }
  630                                                 if (locked_tcb == NULL) {
  631                                                         SCTP_INP_DECR_REF(inp);
  632                                                 }
  633                                                 SCTP_INP_WUNLOCK(inp);
  634                                                 SCTP_INP_INFO_RUNLOCK();
  635                                                 return (stcb);
  636                                         }
  637                                 } else if (remote->sa_family == AF_INET6) {
  638                                         struct sockaddr_in6 *sin6, *rsin6;
  639                                         sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
  640                                         rsin6 = (struct sockaddr_in6 *)remote;
  641                                         if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
  642                                                                  &rsin6->sin6_addr)) {
  643                                                 /* found it */
  644                                                 if (netp != NULL) {
  645                                                         *netp = net;
  646                                                 }
  647                                                 if (locked_tcb == NULL) {
  648                                                         SCTP_INP_DECR_REF(inp);
  649                                                 }
  650                                                 SCTP_INP_WUNLOCK(inp);
  651                                                 SCTP_INP_INFO_RUNLOCK();
  652                                                 return (stcb);
  653                                         }
  654                                 }
  655                         }
  656                         SCTP_TCB_UNLOCK(stcb);
  657                 }
  658         } else {
  659                 SCTP_INP_WLOCK(inp);
  660                 head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(rport,
  661                                                                inp->sctp_hashmark)];
  662                 if (head == NULL) {
  663                         goto null_return;
  664                 }
  665                 LIST_FOREACH(stcb, head, sctp_tcbhash) {
  666                         if (stcb->rport != rport) {
  667                                 /* remote port does not match */
  668                                 continue;
  669                         }
  670                         /* now look at the list of remote addresses */
  671                         SCTP_TCB_LOCK(stcb);
  672                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
  673                                 if (net->ro._l_addr.sa.sa_family !=
  674                                     remote->sa_family) {
  675                                         /* not the same family */
  676                                         continue;
  677                                 }
  678                                 if (remote->sa_family == AF_INET) {
  679                                         struct sockaddr_in *sin, *rsin;
  680                                         sin = (struct sockaddr_in *)
  681                                                 &net->ro._l_addr;
  682                                         rsin = (struct sockaddr_in *)remote;
  683                                         if (sin->sin_addr.s_addr ==
  684                                             rsin->sin_addr.s_addr) {
  685                                                 /* found it */
  686                                                 if (netp != NULL) {
  687                                                         *netp = net;
  688                                                 }
  689                                                 if (locked_tcb == NULL) {
  690                                                         SCTP_INP_DECR_REF(inp);
  691                                                 }
  692                                                 SCTP_INP_WUNLOCK(inp);
  693                                                 SCTP_INP_INFO_RUNLOCK();
  694                                                 return (stcb);
  695                                         }
  696                                 } else if (remote->sa_family == AF_INET6) {
  697                                         struct sockaddr_in6 *sin6, *rsin6;
  698                                         sin6 = (struct sockaddr_in6 *)
  699                                                 &net->ro._l_addr;
  700                                         rsin6 = (struct sockaddr_in6 *)remote;
  701                                         if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
  702                                                                  &rsin6->sin6_addr)) {
  703                                                 /* found it */
  704                                                 if (netp != NULL) {
  705                                                         *netp = net;
  706                                                 }
  707                                                 if (locked_tcb == NULL) {
  708                                                         SCTP_INP_DECR_REF(inp);
  709                                                 }
  710                                                 SCTP_INP_WUNLOCK(inp);
  711                                                 SCTP_INP_INFO_RUNLOCK();
  712                                                 return (stcb);
  713                                         }
  714                                 }
  715                         }
  716                         SCTP_TCB_UNLOCK(stcb);
  717                 }
  718         }
  719  null_return:
  720         /* clean up for returning null */
  721         if (locked_tcb){
  722                 if (locked_tcb->sctp_ep != inp) {
  723                         SCTP_INP_RLOCK(locked_tcb->sctp_ep);
  724                         SCTP_TCB_LOCK(locked_tcb);
  725                         SCTP_INP_RUNLOCK(locked_tcb->sctp_ep);
  726                 } else
  727                         SCTP_TCB_LOCK(locked_tcb);
  728         }
  729         SCTP_INP_WUNLOCK(inp);
  730         SCTP_INP_INFO_RUNLOCK();
  731         /* not found */
  732         return (NULL);
  733 }
  734 
  735 /*
  736  * Find an association for a specific endpoint using the association id
  737  * given out in the COMM_UP notification
  738  */
  739 struct sctp_tcb *
  740 sctp_findassociation_ep_asocid(struct sctp_inpcb *inp, caddr_t asoc_id)
  741 {
  742         /*
  743          * Use my the assoc_id to find a endpoint
  744          */
  745         struct sctpasochead *head;
  746         struct sctp_tcb *stcb;
  747         u_int32_t vtag;
  748 
  749         if (asoc_id == 0 || inp == NULL) {
  750                 return (NULL);
  751         }
  752         SCTP_INP_INFO_RLOCK();
  753         vtag = (u_int32_t)(uintptr_t)asoc_id;
  754         head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(vtag,
  755             sctppcbinfo.hashasocmark)];
  756         if (head == NULL) {
  757                 /* invalid vtag */
  758                 SCTP_INP_INFO_RUNLOCK();
  759                 return (NULL);
  760         }
  761         LIST_FOREACH(stcb, head, sctp_asocs) {
  762                 SCTP_INP_RLOCK(stcb->sctp_ep);
  763                 SCTP_TCB_LOCK(stcb);
  764                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
  765                 if (stcb->asoc.my_vtag == vtag) {
  766                         /* candidate */
  767                         if (inp != stcb->sctp_ep) {
  768                                 /* some other guy has the
  769                                  * same vtag active (vtag collision).
  770                                  */
  771                                 sctp_pegs[SCTP_VTAG_BOGUS]++;
  772                                 SCTP_TCB_UNLOCK(stcb);
  773                                 continue;
  774                         }
  775                         sctp_pegs[SCTP_VTAG_EXPR]++;
  776                         SCTP_INP_INFO_RUNLOCK();
  777                         return (stcb);
  778                 }
  779                 SCTP_TCB_UNLOCK(stcb);
  780         }
  781         SCTP_INP_INFO_RUNLOCK();
  782         return (NULL);
  783 }
  784 
  785 static struct sctp_inpcb *
  786 sctp_endpoint_probe(struct sockaddr *nam, struct sctppcbhead *head,
  787                     uint16_t lport)
  788 {
  789         struct sctp_inpcb *inp;
  790         struct sockaddr_in *sin;
  791         struct sockaddr_in6 *sin6;
  792         struct sctp_laddr *laddr;
  793 
  794         /* Endpoing probe expects
  795          * that the INP_INFO is locked.
  796          */
  797         if (nam->sa_family == AF_INET) {
  798                 sin = (struct sockaddr_in *)nam;
  799                 sin6 = NULL;
  800         } else if (nam->sa_family == AF_INET6) {
  801                 sin6 = (struct sockaddr_in6 *)nam;
  802                 sin = NULL;
  803         } else {
  804                 /* unsupported family */
  805                 return (NULL);
  806         }
  807         if (head == NULL)
  808                 return (NULL);
  809 
  810         LIST_FOREACH(inp, head, sctp_hash) {
  811                 SCTP_INP_RLOCK(inp);
  812 
  813                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) &&
  814                     (inp->sctp_lport == lport)) {
  815                         /* got it */
  816                         if ((nam->sa_family == AF_INET) &&
  817                             (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
  818 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
  819                             (((struct inpcb *)inp)->inp_flags & IN6P_IPV6_V6ONLY)
  820 #else
  821 #if defined(__OpenBSD__)
  822                             (0) /* For open bsd we do dual bind only */
  823 #else
  824                             (((struct in6pcb *)inp)->in6p_flags & IN6P_IPV6_V6ONLY)
  825 #endif
  826 #endif
  827                                 ) {
  828                                 /* IPv4 on a IPv6 socket with ONLY IPv6 set */
  829                                 SCTP_INP_RUNLOCK(inp);
  830                                 continue;
  831                         }
  832                         /* A V6 address and the endpoint is NOT bound V6 */
  833                         if (nam->sa_family == AF_INET6 &&
  834                            (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
  835                                 SCTP_INP_RUNLOCK(inp);
  836                                 continue;
  837                         }
  838                         SCTP_INP_RUNLOCK(inp);
  839                         return (inp);
  840                 }
  841                 SCTP_INP_RUNLOCK(inp);
  842         }
  843 
  844         if ((nam->sa_family == AF_INET) &&
  845             (sin->sin_addr.s_addr == INADDR_ANY)) {
  846                 /* Can't hunt for one that has no address specified */
  847                 return (NULL);
  848         } else if ((nam->sa_family == AF_INET6) &&
  849                    (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))) {
  850                 /* Can't hunt for one that has no address specified */
  851                 return (NULL);
  852         }
  853         /*
  854          * ok, not bound to all so see if we can find a EP bound to this
  855          * address.
  856          */
  857 #ifdef SCTP_DEBUG
  858         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
  859                 kprintf("Ok, there is NO bound-all available for port:%x\n", ntohs(lport));
  860         }
  861 #endif
  862         LIST_FOREACH(inp, head, sctp_hash) {
  863                 SCTP_INP_RLOCK(inp);
  864                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)) {
  865                         SCTP_INP_RUNLOCK(inp);
  866                         continue;
  867                 }
  868                 /*
  869                  * Ok this could be a likely candidate, look at all of
  870                  * its addresses
  871                  */
  872                 if (inp->sctp_lport != lport) {
  873                         SCTP_INP_RUNLOCK(inp);
  874                         continue;
  875                 }
  876 #ifdef SCTP_DEBUG
  877                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
  878                         kprintf("Ok, found matching local port\n");
  879                 }
  880 #endif
  881                 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
  882                         if (laddr->ifa == NULL) {
  883 #ifdef SCTP_DEBUG
  884                                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
  885                                         kprintf("An ounce of prevention is worth a pound of cure\n");
  886                                 }
  887 #endif
  888                                 continue;
  889                         }
  890 #ifdef SCTP_DEBUG
  891                         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
  892                                 kprintf("Ok laddr->ifa:%p is possible, ",
  893                                     laddr->ifa);
  894                         }
  895 #endif
  896                         if (laddr->ifa->ifa_addr == NULL) {
  897 #ifdef SCTP_DEBUG
  898                                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
  899                                         kprintf("Huh IFA as an ifa_addr=NULL, ");
  900                                 }
  901 #endif
  902                                 continue;
  903                         }
  904 #ifdef SCTP_DEBUG
  905                         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
  906                                 kprintf("Ok laddr->ifa:%p is possible, ",
  907                                     laddr->ifa->ifa_addr);
  908                                 sctp_print_address(laddr->ifa->ifa_addr);
  909                                 kprintf("looking for ");
  910                                 sctp_print_address(nam);
  911                         }
  912 #endif
  913                         if (laddr->ifa->ifa_addr->sa_family == nam->sa_family) {
  914                                 /* possible, see if it matches */
  915                                 struct sockaddr_in *intf_addr;
  916                                 intf_addr = (struct sockaddr_in *)
  917                                     laddr->ifa->ifa_addr;
  918                                 if (nam->sa_family == AF_INET) {
  919                                         if (sin->sin_addr.s_addr ==
  920                                             intf_addr->sin_addr.s_addr) {
  921 #ifdef SCTP_DEBUG
  922                                                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
  923                                                         kprintf("YES, return ep:%p\n", inp);
  924                                                 }
  925 #endif
  926                                                 SCTP_INP_RUNLOCK(inp);
  927                                                 return (inp);
  928                                         }
  929                                 } else if (nam->sa_family == AF_INET6) {
  930                                         struct sockaddr_in6 *intf_addr6;
  931                                         intf_addr6 = (struct sockaddr_in6 *)
  932                                             laddr->ifa->ifa_addr;
  933                                         if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
  934                                             &intf_addr6->sin6_addr)) {
  935 #ifdef SCTP_DEBUG
  936                                                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
  937                                                         kprintf("YES, return ep:%p\n", inp);
  938                                                 }
  939 #endif
  940                                                 SCTP_INP_RUNLOCK(inp);
  941                                                 return (inp);
  942                                         }
  943                                 }
  944                         }
  945                         SCTP_INP_RUNLOCK(inp);
  946                 }
  947         }
  948 #ifdef SCTP_DEBUG
  949         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
  950                 kprintf("NO, Falls out to NULL\n");
  951         }
  952 #endif
  953         return (NULL);
  954 }
  955 
  956 
  957 struct sctp_inpcb *
  958 sctp_pcb_findep(struct sockaddr *nam, int find_tcp_pool, int have_lock)
  959 {
  960         /*
  961          * First we check the hash table to see if someone has this port
  962          * bound with just the port.
  963          */
  964         struct sctp_inpcb *inp;
  965         struct sctppcbhead *head;
  966         int lport;
  967 #ifdef SCTP_DEBUG
  968         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
  969                 kprintf("Looking for endpoint %d :",
  970                        ntohs(((struct sockaddr_in *)nam)->sin_port));
  971                 sctp_print_address(nam);
  972         }
  973 #endif
  974         if (nam->sa_family == AF_INET) {
  975                 lport = ((struct sockaddr_in *)nam)->sin_port;
  976         } else if (nam->sa_family == AF_INET6) {
  977                 lport = ((struct sockaddr_in6 *)nam)->sin6_port;
  978         } else {
  979                 /* unsupported family */
  980                 return (NULL);
  981         }
  982         /*
  983          * I could cheat here and just cast to one of the types but we will
  984          * do it right. It also provides the check against an Unsupported
  985          * type too.
  986          */
  987         /* Find the head of the ALLADDR chain */
  988         if (have_lock == 0)
  989                 SCTP_INP_INFO_RLOCK();
  990         head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport,
  991                                                              sctppcbinfo.hashmark)];
  992 #ifdef SCTP_DEBUG
  993         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
  994                 kprintf("Main hash to lookup at head:%p\n", head);
  995         }
  996 #endif
  997         inp = sctp_endpoint_probe(nam, head, lport);
  998 
  999         /*
 1000          * If the TCP model exists it could be that the main listening
 1001          * endpoint is gone but there exists a connected socket for this
 1002          * guy yet. If so we can return the first one that we find. This
 1003          * may NOT be the correct one but the sctp_findassociation_ep_addr
 1004          * has further code to look at all TCP models.
 1005          */
 1006         if (inp == NULL && find_tcp_pool) {
 1007                 unsigned int i;
 1008 #ifdef SCTP_DEBUG
 1009                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 1010                         kprintf("EP was NULL and TCP model is supported\n");
 1011                 }
 1012 #endif
 1013                 for (i = 0; i < sctppcbinfo.hashtblsize; i++) {
 1014                         /*
 1015                          * This is real gross, but we do NOT have a remote
 1016                          * port at this point depending on who is calling. We
 1017                          * must therefore look for ANY one that matches our
 1018                          * local port :/
 1019                          */
 1020                         head = &sctppcbinfo.sctp_tcpephash[i];
 1021                         if (LIST_FIRST(head)) {
 1022                                 inp = sctp_endpoint_probe(nam, head, lport);
 1023                                 if (inp) {
 1024                                         /* Found one */
 1025                                         break;
 1026                                 }
 1027                         }
 1028                 }
 1029         }
 1030 #ifdef SCTP_DEBUG
 1031         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 1032                 kprintf("EP to return is %p\n", inp);
 1033         }
 1034 #endif
 1035         if (have_lock == 0) {
 1036                 if (inp) {
 1037                         SCTP_INP_WLOCK(inp);
 1038                         SCTP_INP_INCR_REF(inp);
 1039                         SCTP_INP_WUNLOCK(inp);
 1040                 }
 1041                 SCTP_INP_INFO_RUNLOCK();
 1042         } else {
 1043                 if (inp) {
 1044                         SCTP_INP_WLOCK(inp);
 1045                         SCTP_INP_INCR_REF(inp);
 1046                         SCTP_INP_WUNLOCK(inp);
 1047                 }
 1048         }
 1049         return (inp);
 1050 }
 1051 
 1052 /*
 1053  * Find an association for an endpoint with the pointer to whom you want
 1054  * to send to and the endpoint pointer. The address can be IPv4 or IPv6.
 1055  * We may need to change the *to to some other struct like a mbuf...
 1056  */
 1057 struct sctp_tcb *
 1058 sctp_findassociation_addr_sa(struct sockaddr *to, struct sockaddr *from,
 1059     struct sctp_inpcb **inp_p, struct sctp_nets **netp, int find_tcp_pool)
 1060 {
 1061         struct sctp_inpcb *inp;
 1062         struct sctp_tcb *retval;
 1063 
 1064         SCTP_INP_INFO_RLOCK();
 1065         if (find_tcp_pool) {
 1066                 if (inp_p != NULL) {
 1067                         retval = sctp_tcb_special_locate(inp_p, from, to, netp);
 1068                 } else {
 1069                         retval = sctp_tcb_special_locate(&inp, from, to, netp);
 1070                 }
 1071                 if (retval != NULL) {
 1072                         SCTP_INP_INFO_RUNLOCK();
 1073                         return (retval);
 1074                 }
 1075         }
 1076         inp = sctp_pcb_findep(to, 0, 1);
 1077         if (inp_p != NULL) {
 1078                 *inp_p = inp;
 1079         }
 1080         SCTP_INP_INFO_RUNLOCK();
 1081 
 1082         if (inp == NULL) {
 1083                 return (NULL);
 1084         }
 1085 
 1086         /*
 1087          * ok, we have an endpoint, now lets find the assoc for it (if any)
 1088          * we now place the source address or from in the to of the find
 1089          * endpoint call. Since in reality this chain is used from the
 1090          * inbound packet side.
 1091          */
 1092         if (inp_p != NULL) {
 1093                 return (sctp_findassociation_ep_addr(inp_p, from, netp, to, NULL));
 1094         } else {
 1095                 return (sctp_findassociation_ep_addr(&inp, from, netp, to, NULL));
 1096         }
 1097 }
 1098 
 1099 
 1100 /*
 1101  * This routine will grub through the mbuf that is a INIT or INIT-ACK and
 1102  * find all addresses that the sender has specified in any address list.
 1103  * Each address will be used to lookup the TCB and see if one exits.
 1104  */
 1105 static struct sctp_tcb *
 1106 sctp_findassociation_special_addr(struct mbuf *m, int iphlen, int offset,
 1107     struct sctphdr *sh, struct sctp_inpcb **inp_p, struct sctp_nets **netp,
 1108     struct sockaddr *dest)
 1109 {
 1110         struct sockaddr_in sin4;
 1111         struct sockaddr_in6 sin6;
 1112         struct sctp_paramhdr *phdr, parm_buf;
 1113         struct sctp_tcb *retval;
 1114         u_int32_t ptype, plen;
 1115 
 1116         memset(&sin4, 0, sizeof(sin4));
 1117         memset(&sin6, 0, sizeof(sin6));
 1118         sin4.sin_len = sizeof(sin4);
 1119         sin4.sin_family = AF_INET;
 1120         sin4.sin_port = sh->src_port;
 1121         sin6.sin6_len = sizeof(sin6);
 1122         sin6.sin6_family = AF_INET6;
 1123         sin6.sin6_port = sh->src_port;
 1124 
 1125         retval = NULL;
 1126         offset += sizeof(struct sctp_init_chunk);
 1127 
 1128         phdr = sctp_get_next_param(m, offset, &parm_buf, sizeof(parm_buf));
 1129         while (phdr != NULL) {
 1130                 /* now we must see if we want the parameter */
 1131                 ptype = ntohs(phdr->param_type);
 1132                 plen = ntohs(phdr->param_length);
 1133                 if (plen == 0) {
 1134 #ifdef SCTP_DEBUG
 1135                         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 1136                                 kprintf("sctp_findassociation_special_addr: Impossible length in parameter\n");
 1137                         }
 1138 #endif /* SCTP_DEBUG */
 1139                         break;
 1140                 }
 1141                 if (ptype == SCTP_IPV4_ADDRESS &&
 1142                     plen == sizeof(struct sctp_ipv4addr_param)) {
 1143                         /* Get the rest of the address */
 1144                         struct sctp_ipv4addr_param ip4_parm, *p4;
 1145 
 1146                         phdr = sctp_get_next_param(m, offset,
 1147                             (struct sctp_paramhdr *)&ip4_parm, plen);
 1148                         if (phdr == NULL) {
 1149                                 return (NULL);
 1150                         }
 1151                         p4 = (struct sctp_ipv4addr_param *)phdr;
 1152                         memcpy(&sin4.sin_addr, &p4->addr, sizeof(p4->addr));
 1153                         /* look it up */
 1154                         retval = sctp_findassociation_ep_addr(inp_p,
 1155                             (struct sockaddr *)&sin4, netp, dest, NULL);
 1156                         if (retval != NULL) {
 1157                                 return (retval);
 1158                         }
 1159                 } else if (ptype == SCTP_IPV6_ADDRESS &&
 1160                     plen == sizeof(struct sctp_ipv6addr_param)) {
 1161                         /* Get the rest of the address */
 1162                         struct sctp_ipv6addr_param ip6_parm, *p6;
 1163 
 1164                         phdr = sctp_get_next_param(m, offset,
 1165                             (struct sctp_paramhdr *)&ip6_parm, plen);
 1166                         if (phdr == NULL) {
 1167                                 return (NULL);
 1168                         }
 1169                         p6 = (struct sctp_ipv6addr_param *)phdr;
 1170                         memcpy(&sin6.sin6_addr, &p6->addr, sizeof(p6->addr));
 1171                         /* look it up */
 1172                         retval = sctp_findassociation_ep_addr(inp_p,
 1173                             (struct sockaddr *)&sin6, netp, dest, NULL);
 1174                         if (retval != NULL) {
 1175                                 return (retval);
 1176                         }
 1177                 }
 1178                 offset += SCTP_SIZE32(plen);
 1179                 phdr = sctp_get_next_param(m, offset, &parm_buf,
 1180                     sizeof(parm_buf));
 1181         }
 1182         return (NULL);
 1183 }
 1184 
 1185 static struct sctp_tcb *
 1186 sctp_findassoc_by_vtag(struct sockaddr *from, uint32_t vtag,
 1187     struct sctp_inpcb **inp_p, struct sctp_nets **netp, uint16_t rport,
 1188     uint16_t lport)
 1189 {
 1190         /*
 1191          * Use my vtag to hash. If we find it we then verify the source addr
 1192          * is in the assoc. If all goes well we save a bit on rec of a packet.
 1193          */
 1194         struct sctpasochead *head;
 1195         struct sctp_nets *net;
 1196         struct sctp_tcb *stcb;
 1197 
 1198         SCTP_INP_INFO_RLOCK();
 1199         head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(vtag,
 1200             sctppcbinfo.hashasocmark)];
 1201         if (head == NULL) {
 1202                 /* invalid vtag */
 1203                 SCTP_INP_INFO_RUNLOCK();
 1204                 return (NULL);
 1205         }
 1206         LIST_FOREACH(stcb, head, sctp_asocs) {
 1207                 SCTP_INP_RLOCK(stcb->sctp_ep);
 1208                 SCTP_TCB_LOCK(stcb);
 1209                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
 1210                 if (stcb->asoc.my_vtag == vtag) {
 1211                         /* candidate */
 1212                         if (stcb->rport != rport) {
 1213                                 /*
 1214                                  * we could remove this if vtags are unique
 1215                                  * across the system.
 1216                                  */
 1217                                 SCTP_TCB_UNLOCK(stcb);
 1218                                 continue;
 1219                         }
 1220                         if (stcb->sctp_ep->sctp_lport != lport) {
 1221                                 /*
 1222                                  * we could remove this if vtags are unique
 1223                                  * across the system.
 1224                                  */
 1225                                 SCTP_TCB_UNLOCK(stcb);
 1226                                 continue;
 1227                         }
 1228                         net = sctp_findnet(stcb, from);
 1229                         if (net) {
 1230                                 /* yep its him. */
 1231                                 *netp = net;
 1232                                 sctp_pegs[SCTP_VTAG_EXPR]++;
 1233                                 *inp_p = stcb->sctp_ep;
 1234                                 SCTP_INP_INFO_RUNLOCK();
 1235                                 return (stcb);
 1236                         } else {
 1237                                 /* not him, this should only
 1238                                  * happen in rare cases so
 1239                                  * I peg it.
 1240                                  */
 1241                                 sctp_pegs[SCTP_VTAG_BOGUS]++;
 1242                         }
 1243                 }
 1244                 SCTP_TCB_UNLOCK(stcb);
 1245         }
 1246         SCTP_INP_INFO_RUNLOCK();
 1247         return (NULL);
 1248 }
 1249 
 1250 /*
 1251  * Find an association with the pointer to the inbound IP packet. This
 1252  * can be a IPv4 or IPv6 packet.
 1253  */
 1254 struct sctp_tcb *
 1255 sctp_findassociation_addr(struct mbuf *m, int iphlen, int offset,
 1256     struct sctphdr *sh, struct sctp_chunkhdr *ch,
 1257     struct sctp_inpcb **inp_p, struct sctp_nets **netp)
 1258 {
 1259         int find_tcp_pool;
 1260         struct ip *iph;
 1261         struct sctp_tcb *retval;
 1262         struct sockaddr_storage to_store, from_store;
 1263         struct sockaddr *to = (struct sockaddr *)&to_store;
 1264         struct sockaddr *from = (struct sockaddr *)&from_store;
 1265         struct sctp_inpcb *inp;
 1266 
 1267 
 1268         iph = mtod(m, struct ip *);
 1269         if (iph->ip_v == IPVERSION) {
 1270                 /* its IPv4 */
 1271                 struct sockaddr_in *to4, *from4;
 1272 
 1273                 to4 = (struct sockaddr_in *)&to_store;
 1274                 from4 = (struct sockaddr_in *)&from_store;
 1275                 bzero(to4, sizeof(*to4));
 1276                 bzero(from4, sizeof(*from4));
 1277                 from4->sin_family = to4->sin_family = AF_INET;
 1278                 from4->sin_len = to4->sin_len = sizeof(struct sockaddr_in);
 1279                 from4->sin_addr.s_addr  = iph->ip_src.s_addr;
 1280                 to4->sin_addr.s_addr = iph->ip_dst.s_addr ;
 1281                 from4->sin_port = sh->src_port;
 1282                 to4->sin_port = sh->dest_port;
 1283         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
 1284                 /* its IPv6 */
 1285                 struct ip6_hdr *ip6;
 1286                 struct sockaddr_in6 *to6, *from6;
 1287 
 1288                 ip6 = mtod(m, struct ip6_hdr *);
 1289                 to6 = (struct sockaddr_in6 *)&to_store;
 1290                 from6 = (struct sockaddr_in6 *)&from_store;
 1291                 bzero(to6, sizeof(*to6));
 1292                 bzero(from6, sizeof(*from6));
 1293                 from6->sin6_family = to6->sin6_family = AF_INET6;
 1294                 from6->sin6_len = to6->sin6_len = sizeof(struct sockaddr_in6);
 1295                 to6->sin6_addr = ip6->ip6_dst;
 1296                 from6->sin6_addr = ip6->ip6_src;
 1297                 from6->sin6_port = sh->src_port;
 1298                 to6->sin6_port = sh->dest_port;
 1299                 /* Get the scopes in properly to the sin6 addr's */
 1300                 in6_recoverscope(to6, &to6->sin6_addr, NULL);
 1301 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) || defined(__DragonFly__)
 1302                 in6_embedscope(&to6->sin6_addr, to6, NULL, NULL);
 1303 #else
 1304                 in6_embedscope(&to6->sin6_addr, to6);
 1305 #endif
 1306 
 1307                 in6_recoverscope(from6, &from6->sin6_addr, NULL);
 1308 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) || defined(__DragonFly__)
 1309                 in6_embedscope(&from6->sin6_addr, from6, NULL, NULL);
 1310 #else
 1311                 in6_embedscope(&from6->sin6_addr, from6);
 1312 #endif
 1313         } else {
 1314                 /* Currently not supported. */
 1315                 return (NULL);
 1316         }
 1317 #ifdef SCTP_DEBUG
 1318         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 1319                 kprintf("Looking for port %d address :",
 1320                        ntohs(((struct sockaddr_in *)to)->sin_port));
 1321                 sctp_print_address(to);
 1322                 kprintf("From for port %d address :",
 1323                        ntohs(((struct sockaddr_in *)from)->sin_port));
 1324                 sctp_print_address(from);
 1325         }
 1326 #endif
 1327 
 1328         if (sh->v_tag) {
 1329                 /* we only go down this path if vtag is non-zero */
 1330                 retval = sctp_findassoc_by_vtag(from, ntohl(sh->v_tag),
 1331                     inp_p, netp, sh->src_port, sh->dest_port);
 1332                 if (retval) {
 1333                         return (retval);
 1334                 }
 1335         }
 1336         find_tcp_pool = 0;
 1337         if ((ch->chunk_type != SCTP_INITIATION) &&
 1338             (ch->chunk_type != SCTP_INITIATION_ACK) &&
 1339             (ch->chunk_type != SCTP_COOKIE_ACK) &&
 1340             (ch->chunk_type != SCTP_COOKIE_ECHO)) {
 1341                 /* Other chunk types go to the tcp pool. */
 1342                 find_tcp_pool = 1;
 1343         }
 1344         if (inp_p) {
 1345                 retval = sctp_findassociation_addr_sa(to, from, inp_p, netp,
 1346                     find_tcp_pool);
 1347                 inp = *inp_p;
 1348         } else {
 1349                 retval = sctp_findassociation_addr_sa(to, from, &inp, netp,
 1350                     find_tcp_pool);
 1351         }
 1352 #ifdef SCTP_DEBUG
 1353         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 1354                 kprintf("retval:%p inp:%p\n", retval, inp);
 1355         }
 1356 #endif
 1357         if (retval == NULL && inp) {
 1358                 /* Found a EP but not this address */
 1359 #ifdef SCTP_DEBUG
 1360                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 1361                         kprintf("Found endpoint %p but no asoc - ep state:%x\n",
 1362                             inp, inp->sctp_flags);
 1363                 }
 1364 #endif
 1365                 if ((ch->chunk_type == SCTP_INITIATION) ||
 1366                     (ch->chunk_type == SCTP_INITIATION_ACK)) {
 1367                         /*
 1368                          * special hook, we do NOT return linp or an
 1369                          * association that is linked to an existing
 1370                          * association that is under the TCP pool (i.e. no
 1371                          * listener exists). The endpoint finding routine
 1372                          * will always find a listner before examining the
 1373                          * TCP pool.
 1374                          */
 1375                         if (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) {
 1376 #ifdef SCTP_DEBUG
 1377                                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 1378                                         kprintf("Gak, its in the TCP pool... return NULL");
 1379                                 }
 1380 #endif
 1381                                 if (inp_p) {
 1382                                         *inp_p = NULL;
 1383                                 }
 1384                                 return (NULL);
 1385                         }
 1386 #ifdef SCTP_DEBUG
 1387                         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 1388                                 kprintf("Now doing SPECIAL find\n");
 1389                         }
 1390 #endif
 1391                         retval = sctp_findassociation_special_addr(m, iphlen,
 1392                             offset, sh, inp_p, netp, to);
 1393                 }
 1394         }
 1395 #ifdef SCTP_DEBUG
 1396         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 1397             kprintf("retval is %p\n", retval);
 1398         }
 1399 #endif
 1400         return (retval);
 1401 }
 1402 
 1403 extern int sctp_max_burst_default;
 1404 
 1405 extern unsigned int sctp_delayed_sack_time_default;
 1406 extern unsigned int sctp_heartbeat_interval_default;
 1407 extern unsigned int sctp_pmtu_raise_time_default;
 1408 extern unsigned int sctp_shutdown_guard_time_default;
 1409 extern unsigned int sctp_secret_lifetime_default;
 1410 
 1411 extern unsigned int sctp_rto_max_default;
 1412 extern unsigned int sctp_rto_min_default;
 1413 extern unsigned int sctp_rto_initial_default;
 1414 extern unsigned int sctp_init_rto_max_default;
 1415 extern unsigned int sctp_valid_cookie_life_default;
 1416 extern unsigned int sctp_init_rtx_max_default;
 1417 extern unsigned int sctp_assoc_rtx_max_default;
 1418 extern unsigned int sctp_path_rtx_max_default;
 1419 extern unsigned int sctp_nr_outgoing_streams_default;
 1420 
 1421 /*
 1422  * allocate a sctp_inpcb and setup a temporary binding to a port/all
 1423  * addresses. This way if we don't get a bind we by default pick a ephemeral
 1424  * port with all addresses bound.
 1425  */
 1426 int
 1427 sctp_inpcb_alloc(struct socket *so)
 1428 {
 1429         /*
 1430          * we get called when a new endpoint starts up. We need to allocate
 1431          * the sctp_inpcb structure from the zone and init it. Mark it as
 1432          * unbound and find a port that we can use as an ephemeral with
 1433          * INADDR_ANY. If the user binds later no problem we can then add
 1434          * in the specific addresses. And setup the default parameters for
 1435          * the EP.
 1436          */
 1437         int i, error;
 1438         struct sctp_inpcb *inp, *n_inp;
 1439         struct sctp_pcb *m;
 1440         struct timeval time;
 1441 
 1442         error = 0;
 1443 
 1444         /* Hack alert:
 1445          *
 1446          * This code audits the entire INP list to see if
 1447          * any ep's that are in the GONE state are now
 1448          * all free. This should not happen really since when
 1449          * the last association if freed we should end up deleting
 1450          * the inpcb. This code including the locks should
 1451          * be taken out ... since the last set of fixes I
 1452          * have not seen the "Found a GONE on list" has not
 1453          * came out. But i am paranoid and we will leave this
 1454          * in at the cost of efficency on allocation of PCB's.
 1455          * Probably we should move this to the invariant
 1456          * compile options
 1457          */
 1458 /* #ifdef INVARIANTS*/
 1459         SCTP_INP_INFO_RLOCK();
 1460         inp = LIST_FIRST(&sctppcbinfo.listhead);
 1461         while (inp) {
 1462                 n_inp = LIST_NEXT(inp, sctp_list);
 1463                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
 1464                         if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
 1465                                 /* finish the job now */
 1466                                 kprintf("Found a GONE on list\n");
 1467                                 SCTP_INP_INFO_RUNLOCK();
 1468                                 sctp_inpcb_free(inp, 1);
 1469                                 SCTP_INP_INFO_RLOCK();
 1470                         }
 1471                 }
 1472                 inp = n_inp;
 1473         }
 1474         SCTP_INP_INFO_RUNLOCK();
 1475 /* #endif INVARIANTS*/
 1476 
 1477         SCTP_INP_INFO_WLOCK();
 1478         inp = (struct sctp_inpcb *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_ep);
 1479         if (inp == NULL) {
 1480                 kprintf("Out of SCTP-INPCB structures - no resources\n");
 1481                 SCTP_INP_INFO_WUNLOCK();
 1482                 return (ENOBUFS);
 1483         }
 1484 
 1485         /* zap it */
 1486         bzero(inp, sizeof(*inp));
 1487 
 1488         /* bump generations */
 1489         inp->ip_inp.inp.inp_socket = so;
 1490 
 1491         /* setup socket pointers */
 1492         inp->sctp_socket = so;
 1493 
 1494         /* setup inpcb socket too */
 1495         inp->ip_inp.inp.inp_socket = so;
 1496         inp->sctp_frag_point = SCTP_DEFAULT_MAXSEGMENT;
 1497 #ifdef IPSEC
 1498 #if !(defined(__OpenBSD__) || defined(__APPLE__))
 1499         {
 1500                 struct inpcbpolicy *pcb_sp = NULL;
 1501                 error = ipsec_init_policy(so, &pcb_sp);
 1502                 /* Arrange to share the policy */
 1503                 inp->ip_inp.inp.inp_sp = pcb_sp;
 1504                 ((struct in6pcb *)(&inp->ip_inp.inp))->in6p_sp = pcb_sp;
 1505         }
 1506 #else
 1507         /* not sure what to do for openbsd here */
 1508         error = 0;
 1509 #endif
 1510         if (error != 0) {
 1511                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp);
 1512                 SCTP_INP_INFO_WUNLOCK();
 1513                 return error;
 1514         }
 1515 #endif /* IPSEC */
 1516         sctppcbinfo.ipi_count_ep++;
 1517 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
 1518         inp->ip_inp.inp.inp_gencnt = ++sctppcbinfo.ipi_gencnt_ep;
 1519         inp->ip_inp.inp.inp_ip_ttl = ip_defttl;
 1520 #else
 1521         inp->inp_ip_ttl = ip_defttl;
 1522         inp->inp_ip_tos = 0;
 1523 #endif
 1524 
 1525         so->so_pcb = (caddr_t)inp;
 1526 
 1527         if ((so->so_type == SOCK_DGRAM) ||
 1528             (so->so_type == SOCK_SEQPACKET)) {
 1529                 /* UDP style socket */
 1530                 inp->sctp_flags = (SCTP_PCB_FLAGS_UDPTYPE |
 1531                     SCTP_PCB_FLAGS_UNBOUND);
 1532                 inp->sctp_flags |= (SCTP_PCB_FLAGS_RECVDATAIOEVNT);
 1533         } else if (so->so_type == SOCK_STREAM) {
 1534                 /* TCP style socket */
 1535                 inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
 1536                     SCTP_PCB_FLAGS_UNBOUND);
 1537                 inp->sctp_flags |= (SCTP_PCB_FLAGS_RECVDATAIOEVNT);
 1538         } else {
 1539                 /*
 1540                  * unsupported socket type (RAW, etc)- in case we missed
 1541                  * it in protosw
 1542                  */
 1543                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp);
 1544                 SCTP_INP_INFO_WUNLOCK();
 1545                 return (EOPNOTSUPP);
 1546         }
 1547         inp->sctp_tcbhash = hashinit(sctp_pcbtblsize,
 1548 #ifdef __NetBSD__
 1549             HASH_LIST,
 1550 #endif
 1551             M_PCB,
 1552 #if defined(__NetBSD__) || defined(__OpenBSD__)
 1553             M_WAITOK,
 1554 #endif
 1555             &inp->sctp_hashmark);
 1556         if (inp->sctp_tcbhash == NULL) {
 1557                 kprintf("Out of SCTP-INPCB->hashinit - no resources\n");
 1558                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp);
 1559                 SCTP_INP_INFO_WUNLOCK();
 1560                 return (ENOBUFS);
 1561         }
 1562         /* LOCK init's */
 1563         SCTP_INP_LOCK_INIT(inp);
 1564         SCTP_ASOC_CREATE_LOCK_INIT(inp);
 1565         /* lock the new ep */
 1566         SCTP_INP_WLOCK(inp);
 1567 
 1568         /* add it to the info area */
 1569         LIST_INSERT_HEAD(&sctppcbinfo.listhead, inp, sctp_list);
 1570         SCTP_INP_INFO_WUNLOCK();
 1571 
 1572         LIST_INIT(&inp->sctp_addr_list);
 1573         LIST_INIT(&inp->sctp_asoc_list);
 1574         TAILQ_INIT(&inp->sctp_queue_list);
 1575         /* Init the timer structure for signature change */
 1576 #if defined (__FreeBSD__) && __FreeBSD_version >= 500000
 1577         callout_init(&inp->sctp_ep.signature_change.timer, 0);
 1578 #else
 1579         callout_init(&inp->sctp_ep.signature_change.timer);
 1580 #endif
 1581         inp->sctp_ep.signature_change.type = SCTP_TIMER_TYPE_NEWCOOKIE;
 1582 
 1583         /* now init the actual endpoint default data */
 1584         m = &inp->sctp_ep;
 1585 
 1586         /* setup the base timeout information */
 1587         m->sctp_timeoutticks[SCTP_TIMER_SEND] = SEC_TO_TICKS(SCTP_SEND_SEC); /* needed ? */
 1588         m->sctp_timeoutticks[SCTP_TIMER_INIT] = SEC_TO_TICKS(SCTP_INIT_SEC); /* needed ? */
 1589         m->sctp_timeoutticks[SCTP_TIMER_RECV] = MSEC_TO_TICKS(sctp_delayed_sack_time_default);
 1590         m->sctp_timeoutticks[SCTP_TIMER_HEARTBEAT] = sctp_heartbeat_interval_default; /* this is in MSEC */
 1591         m->sctp_timeoutticks[SCTP_TIMER_PMTU] = SEC_TO_TICKS(sctp_pmtu_raise_time_default);
 1592         m->sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] = SEC_TO_TICKS(sctp_shutdown_guard_time_default);
 1593         m->sctp_timeoutticks[SCTP_TIMER_SIGNATURE] = SEC_TO_TICKS(sctp_secret_lifetime_default);
 1594         /* all max/min max are in ms */
 1595         m->sctp_maxrto = sctp_rto_max_default;
 1596         m->sctp_minrto = sctp_rto_min_default;
 1597         m->initial_rto = sctp_rto_initial_default;
 1598         m->initial_init_rto_max = sctp_init_rto_max_default;
 1599 
 1600         m->max_open_streams_intome = MAX_SCTP_STREAMS;
 1601 
 1602         m->max_init_times = sctp_init_rtx_max_default;
 1603         m->max_send_times = sctp_assoc_rtx_max_default;
 1604         m->def_net_failure = sctp_path_rtx_max_default;
 1605         m->sctp_sws_sender = SCTP_SWS_SENDER_DEF;
 1606         m->sctp_sws_receiver = SCTP_SWS_RECEIVER_DEF;
 1607         m->max_burst = sctp_max_burst_default;
 1608         /* number of streams to pre-open on a association */
 1609         m->pre_open_stream_count = sctp_nr_outgoing_streams_default;
 1610 
 1611         /* Add adaption cookie */
 1612         m->adaption_layer_indicator = 0x504C5253;
 1613 
 1614         /* seed random number generator */
 1615         m->random_counter = 1;
 1616         m->store_at = SCTP_SIGNATURE_SIZE;
 1617 #if (defined(__FreeBSD__) && (__FreeBSD_version < 500000)) || defined(__DragonFly__)
 1618         read_random_unlimited(m->random_numbers, sizeof(m->random_numbers));
 1619 #elif defined(__APPLE__) || (defined(__FreeBSD__) && (__FreeBSD_version > 500000))
 1620         read_random(m->random_numbers, sizeof(m->random_numbers));
 1621 #elif defined(__OpenBSD__)
 1622         get_random_bytes(m->random_numbers, sizeof(m->random_numbers));
 1623 #elif defined(__NetBSD__) && NRND > 0
 1624         rnd_extract_data(m->random_numbers, sizeof(m->random_numbers),
 1625                          RND_EXTRACT_ANY);
 1626 #else
 1627         {
 1628                 u_int32_t *ranm, *ranp;
 1629                 ranp = (u_int32_t *)&m->random_numbers;
 1630                 ranm = ranp + (SCTP_SIGNATURE_ALOC_SIZE/sizeof(u_int32_t));
 1631                 if ((u_long)ranp % 4) {
 1632                         /* not a even boundary? */
 1633                         ranp = (u_int32_t *)SCTP_SIZE32((u_long)ranp);
 1634                 }
 1635                 while (ranp < ranm) {
 1636                         *ranp = random();
 1637                         ranp++;
 1638                 }
 1639         }
 1640 #endif
 1641         sctp_fill_random_store(m);
 1642 
 1643         /* Minimum cookie size */
 1644         m->size_of_a_cookie = (sizeof(struct sctp_init_msg) * 2) +
 1645                 sizeof(struct sctp_state_cookie);
 1646         m->size_of_a_cookie += SCTP_SIGNATURE_SIZE;
 1647 
 1648         /* Setup the initial secret */
 1649         SCTP_GETTIME_TIMEVAL(&time);
 1650         m->time_of_secret_change = time.tv_sec;
 1651 
 1652         for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
 1653                 m->secret_key[0][i] = sctp_select_initial_TSN(m);
 1654         }
 1655         sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL);
 1656 
 1657         /* How long is a cookie good for ? */
 1658         m->def_cookie_life = sctp_valid_cookie_life_default;
 1659         SCTP_INP_WUNLOCK(inp);
 1660         return (error);
 1661 }
 1662 
 1663 
 1664 void
 1665 sctp_move_pcb_and_assoc(struct sctp_inpcb *old_inp, struct sctp_inpcb *new_inp,
 1666     struct sctp_tcb *stcb)
 1667 {
 1668         uint16_t lport, rport;
 1669         struct sctppcbhead *head;
 1670         struct sctp_laddr *laddr, *oladdr;
 1671 
 1672         SCTP_TCB_UNLOCK(stcb);
 1673         SCTP_INP_INFO_WLOCK();
 1674         SCTP_INP_WLOCK(old_inp);
 1675         SCTP_INP_WLOCK(new_inp);
 1676         SCTP_TCB_LOCK(stcb);
 1677 
 1678         new_inp->sctp_ep.time_of_secret_change =
 1679             old_inp->sctp_ep.time_of_secret_change;
 1680         memcpy(new_inp->sctp_ep.secret_key, old_inp->sctp_ep.secret_key,
 1681             sizeof(old_inp->sctp_ep.secret_key));
 1682         new_inp->sctp_ep.current_secret_number =
 1683             old_inp->sctp_ep.current_secret_number;
 1684         new_inp->sctp_ep.last_secret_number =
 1685             old_inp->sctp_ep.last_secret_number;
 1686         new_inp->sctp_ep.size_of_a_cookie = old_inp->sctp_ep.size_of_a_cookie;
 1687 
 1688         /* Copy the port across */
 1689         lport = new_inp->sctp_lport = old_inp->sctp_lport;
 1690         rport = stcb->rport;
 1691         /* Pull the tcb from the old association */
 1692         LIST_REMOVE(stcb, sctp_tcbhash);
 1693         LIST_REMOVE(stcb, sctp_tcblist);
 1694 
 1695         /* Now insert the new_inp into the TCP connected hash */
 1696         head = &sctppcbinfo.sctp_tcpephash[SCTP_PCBHASH_ALLADDR((lport + rport),
 1697             sctppcbinfo.hashtcpmark)];
 1698 
 1699         LIST_INSERT_HEAD(head, new_inp, sctp_hash);
 1700 
 1701         /* Now move the tcb into the endpoint list */
 1702         LIST_INSERT_HEAD(&new_inp->sctp_asoc_list, stcb, sctp_tcblist);
 1703         /*
 1704          * Question, do we even need to worry about the ep-hash since
 1705          * we only have one connection? Probably not :> so lets
 1706          * get rid of it and not suck up any kernel memory in that.
 1707          */
 1708         SCTP_INP_INFO_WUNLOCK();
 1709         stcb->sctp_socket = new_inp->sctp_socket;
 1710         stcb->sctp_ep = new_inp;
 1711         if (new_inp->sctp_tcbhash != NULL) {
 1712                 hashdestroy(new_inp->sctp_tcbhash, M_PCB,
 1713                     new_inp->sctp_hashmark);
 1714                 new_inp->sctp_tcbhash = NULL;
 1715         }
 1716         if ((new_inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
 1717                 /* Subset bound, so copy in the laddr list from the old_inp */
 1718                 LIST_FOREACH(oladdr, &old_inp->sctp_addr_list, sctp_nxt_addr) {
 1719                         laddr = (struct sctp_laddr *)SCTP_ZONE_GET(
 1720                             sctppcbinfo.ipi_zone_laddr);
 1721                         if (laddr == NULL) {
 1722                                 /*
 1723                                  * Gak, what can we do? This assoc is really
 1724                                  * HOSED. We probably should send an abort
 1725                                  * here.
 1726                                  */
 1727 #ifdef SCTP_DEBUG
 1728                                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 1729                                         kprintf("Association hosed in TCP model, out of laddr memory\n");
 1730                                 }
 1731 #endif /* SCTP_DEBUG */
 1732                                 continue;
 1733                         }
 1734                         sctppcbinfo.ipi_count_laddr++;
 1735                         sctppcbinfo.ipi_gencnt_laddr++;
 1736                         bzero(laddr, sizeof(*laddr));
 1737                         laddr->ifa = oladdr->ifa;
 1738                         LIST_INSERT_HEAD(&new_inp->sctp_addr_list, laddr,
 1739                             sctp_nxt_addr);
 1740                         new_inp->laddr_count++;
 1741                 }
 1742         }
 1743         SCTP_INP_WUNLOCK(new_inp);
 1744         SCTP_INP_WUNLOCK(old_inp);
 1745 }
 1746 
 1747 static int
 1748 sctp_isport_inuse(struct sctp_inpcb *inp, uint16_t lport)
 1749 {
 1750         struct sctppcbhead *head;
 1751         struct sctp_inpcb *t_inp;
 1752 
 1753         head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport,
 1754             sctppcbinfo.hashmark)];
 1755         LIST_FOREACH(t_inp, head, sctp_hash) {
 1756                 if (t_inp->sctp_lport != lport) {
 1757                         continue;
 1758                 }
 1759                 /* This one is in use. */
 1760                 /* check the v6/v4 binding issue */
 1761                 if ((t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
 1762 #if defined(__FreeBSD__)
 1763                     (((struct inpcb *)t_inp)->inp_flags & IN6P_IPV6_V6ONLY)
 1764 #else
 1765 #if defined(__OpenBSD__)
 1766                     (0) /* For open bsd we do dual bind only */
 1767 #else
 1768                     (((struct in6pcb *)t_inp)->in6p_flags & IN6P_IPV6_V6ONLY)
 1769 #endif
 1770 #endif
 1771                         ) {
 1772                         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
 1773                                 /* collision in V6 space */
 1774                                 return (1);
 1775                         } else {
 1776                                 /* inp is BOUND_V4 no conflict */
 1777                                 continue;
 1778                         }
 1779                 } else if (t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
 1780                         /* t_inp is bound v4 and v6, conflict always */
 1781                         return (1);
 1782                 } else {
 1783                         /* t_inp is bound only V4 */
 1784                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
 1785 #if defined(__FreeBSD__)
 1786                             (((struct inpcb *)inp)->inp_flags & IN6P_IPV6_V6ONLY)
 1787 #else
 1788 #if defined(__OpenBSD__)
 1789                             (0) /* For open bsd we do dual bind only */
 1790 #else
 1791                             (((struct in6pcb *)inp)->in6p_flags & IN6P_IPV6_V6ONLY)
 1792 #endif
 1793 #endif
 1794                                 ) {
 1795                                 /* no conflict */
 1796                                 continue;
 1797                         }
 1798                         /* else fall through to conflict */
 1799                 }
 1800                 return (1);
 1801         }
 1802         return (0);
 1803 }
 1804 
 1805 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__))
 1806 /*
 1807  * Don't know why, but without this there is an unknown reference when
 1808  * compiling NetBSD... hmm
 1809  */
 1810 extern void in6_sin6_2_sin (struct sockaddr_in *, struct sockaddr_in6 *sin6);
 1811 #endif
 1812 
 1813 
 1814 int
 1815 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000) || defined(__DragonFly__)
 1816 sctp_inpcb_bind(struct socket *so, struct sockaddr *addr, struct thread *p)
 1817 #else
 1818 sctp_inpcb_bind(struct socket *so, struct sockaddr *addr, struct proc *p)
 1819 #endif
 1820 {
 1821         /* bind a ep to a socket address */
 1822         struct sctppcbhead *head;
 1823         struct sctp_inpcb *inp, *inp_tmp;
 1824         struct inpcb *ip_inp;
 1825         int bindall;
 1826         uint16_t lport;
 1827         int error;
 1828 
 1829         lport = 0;
 1830         error = 0;
 1831         bindall = 1;
 1832         inp = (struct sctp_inpcb *)so->so_pcb;
 1833         ip_inp = (struct inpcb *)so->so_pcb;
 1834 #ifdef SCTP_DEBUG
 1835         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 1836                 if (addr) {
 1837                         kprintf("Bind called port:%d\n",
 1838                                ntohs(((struct sockaddr_in *)addr)->sin_port));
 1839                         kprintf("Addr :");
 1840                         sctp_print_address(addr);
 1841                 }
 1842         }
 1843 #endif /* SCTP_DEBUG */
 1844         if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) == 0) {
 1845                 /* already did a bind, subsequent binds NOT allowed ! */
 1846                 return (EINVAL);
 1847         }
 1848 
 1849         if (addr != NULL) {
 1850                 if (addr->sa_family == AF_INET) {
 1851                         struct sockaddr_in *sin;
 1852 
 1853                         /* IPV6_V6ONLY socket? */
 1854                         if (
 1855 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
 1856                                 (ip_inp->inp_flags & IN6P_IPV6_V6ONLY)
 1857 #else
 1858 #if defined(__OpenBSD__)
 1859                                 (0)     /* For openbsd we do dual bind only */
 1860 #else
 1861                                 (((struct in6pcb *)inp)->in6p_flags & IN6P_IPV6_V6ONLY)
 1862 #endif
 1863 #endif
 1864                                 ) {
 1865                                 return (EINVAL);
 1866                         }
 1867 
 1868                         if (addr->sa_len != sizeof(*sin))
 1869                                 return (EINVAL);
 1870 
 1871                         sin = (struct sockaddr_in *)addr;
 1872                         lport = sin->sin_port;
 1873 
 1874                         if (sin->sin_addr.s_addr != INADDR_ANY) {
 1875                                 bindall = 0;
 1876                         }
 1877                 } else if (addr->sa_family == AF_INET6) {
 1878                         /* Only for pure IPv6 Address. (No IPv4 Mapped!) */
 1879                         struct sockaddr_in6 *sin6;
 1880 
 1881                         sin6 = (struct sockaddr_in6 *)addr;
 1882 
 1883                         if (addr->sa_len != sizeof(*sin6))
 1884                                 return (EINVAL);
 1885 
 1886                         lport = sin6->sin6_port;
 1887                         if (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
 1888                                 bindall = 0;
 1889                                 /* KAME hack: embed scopeid */
 1890 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) || defined(__DragonFly__)
 1891                                 if (in6_embedscope(&sin6->sin6_addr, sin6,
 1892                                     ip_inp, NULL) != 0)
 1893                                         return (EINVAL);
 1894 #elif defined(__FreeBSD__)
 1895                                 error = scope6_check_id(sin6, ip6_use_defzone);
 1896                                 if (error != 0)
 1897                                         return (error);
 1898 #else
 1899                                 if (in6_embedscope(&sin6->sin6_addr, sin6) != 0) {
 1900                                         return (EINVAL);
 1901                                 }
 1902 #endif
 1903                         }
 1904 #ifndef SCOPEDROUTING
 1905                         /* this must be cleared for ifa_ifwithaddr() */
 1906                         sin6->sin6_scope_id = 0;
 1907 #endif /* SCOPEDROUTING */
 1908                 } else {
 1909                         return (EAFNOSUPPORT);
 1910                 }
 1911         }
 1912         SCTP_INP_INFO_WLOCK();
 1913         SCTP_INP_WLOCK(inp);
 1914         /* increase our count due to the unlock we do */
 1915         SCTP_INP_INCR_REF(inp);
 1916         if (lport) {
 1917                 /*
 1918                  * Did the caller specify a port? if so we must see if a
 1919                  * ep already has this one bound.
 1920                  */
 1921                 /* got to be root to get at low ports */
 1922                 if (ntohs(lport) < IPPORT_RESERVED) {
 1923                         if (p && (error =
 1924 #ifdef __FreeBSD__
 1925 #if __FreeBSD_version >= 500000
 1926                             suser_cred(p->td_ucred, 0)
 1927 #else
 1928                             suser(p)
 1929 #endif
 1930 #elif defined(__NetBSD__) || defined(__APPLE__)
 1931                             suser(p->p_ucred, &p->p_acflag)
 1932 #elif defined(__DragonFly__)
 1933                             priv_check(p, PRIV_ROOT)
 1934 #else
 1935                             suser(p, 0)
 1936 #endif
 1937                             )) {
 1938                                 SCTP_INP_DECR_REF(inp);
 1939                                 SCTP_INP_WUNLOCK(inp);
 1940                                 SCTP_INP_INFO_WUNLOCK();
 1941                                 return (error);
 1942                         }
 1943                 }
 1944                 if (p == NULL) {
 1945                         SCTP_INP_DECR_REF(inp);
 1946                         SCTP_INP_WUNLOCK(inp);
 1947                         SCTP_INP_INFO_WUNLOCK();
 1948                         return (error);
 1949                 }
 1950                 SCTP_INP_WUNLOCK(inp);
 1951                 inp_tmp = sctp_pcb_findep(addr, 0, 1);
 1952                 if (inp_tmp != NULL) {
 1953                         /* lock guy returned and lower count
 1954                          * note that we are not bound so inp_tmp
 1955                          * should NEVER be inp. And it is this
 1956                          * inp (inp_tmp) that gets the reference
 1957                          * bump, so we must lower it.
 1958                          */
 1959                         SCTP_INP_WLOCK(inp_tmp);
 1960                         SCTP_INP_DECR_REF(inp_tmp);
 1961                         SCTP_INP_WUNLOCK(inp_tmp);
 1962 
 1963                         /* unlock info */
 1964                         SCTP_INP_INFO_WUNLOCK();
 1965                         return (EADDRNOTAVAIL);
 1966                 }
 1967                 SCTP_INP_WLOCK(inp);
 1968                 if (bindall) {
 1969                         /* verify that no lport is not used by a singleton */
 1970                         if (sctp_isport_inuse(inp, lport)) {
 1971                                 /* Sorry someone already has this one bound */
 1972                                 SCTP_INP_DECR_REF(inp);
 1973                                 SCTP_INP_WUNLOCK(inp);
 1974                                 SCTP_INP_INFO_WUNLOCK();
 1975                                 return (EADDRNOTAVAIL);
 1976                         }
 1977                 }
 1978         } else {
 1979                 /*
 1980                  * get any port but lets make sure no one has any address
 1981                  * with this port bound
 1982                  */
 1983 
 1984                 /*
 1985                  * setup the inp to the top (I could use the union but this
 1986                  * is just as easy
 1987                  */
 1988                 uint32_t port_guess;
 1989                 uint16_t port_attempt;
 1990                 int not_done=1;
 1991 
 1992                 while (not_done) {
 1993                         port_guess = sctp_select_initial_TSN(&inp->sctp_ep);
 1994                         port_attempt = (port_guess &  0x0000ffff);
 1995                         if (port_attempt == 0) {
 1996                                 goto next_half;
 1997                         }
 1998                         if (port_attempt < IPPORT_RESERVED) {
 1999                                 port_attempt += IPPORT_RESERVED;
 2000                         }
 2001 
 2002                         if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) {
 2003                                 /* got a port we can use */
 2004                                 not_done = 0;
 2005                                 continue;
 2006                         }
 2007                         /* try upper half */
 2008                 next_half:
 2009                         port_attempt = ((port_guess >> 16) &  0x0000ffff);
 2010                         if (port_attempt == 0) {
 2011                                 goto last_try;
 2012                         }
 2013                         if (port_attempt < IPPORT_RESERVED) {
 2014                                 port_attempt += IPPORT_RESERVED;
 2015                         }
 2016                         if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) {
 2017                                 /* got a port we can use */
 2018                                 not_done = 0;
 2019                                 continue;
 2020                         }
 2021                         /* try two half's added together */
 2022                 last_try:
 2023                         port_attempt = (((port_guess >> 16) &  0x0000ffff) + (port_guess & 0x0000ffff));
 2024                         if (port_attempt == 0) {
 2025                                 /* get a new random number */
 2026                                 continue;
 2027                         }
 2028                         if (port_attempt < IPPORT_RESERVED) {
 2029                                 port_attempt += IPPORT_RESERVED;
 2030                         }
 2031                         if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) {
 2032                                 /* got a port we can use */
 2033                                 not_done = 0;
 2034                                 continue;
 2035                         }
 2036                 }
 2037                 /* we don't get out of the loop until we have a port */
 2038                 lport = htons(port_attempt);
 2039         }
 2040         SCTP_INP_DECR_REF(inp);
 2041         if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
 2042                 /* this really should not happen. The guy
 2043                  * did a non-blocking bind and then did a close
 2044                  * at the same time.
 2045                  */
 2046                 SCTP_INP_WUNLOCK(inp);
 2047                 SCTP_INP_INFO_WUNLOCK();
 2048                 return (EINVAL);
 2049         }
 2050         /* ok we look clear to give out this port, so lets setup the binding */
 2051         if (bindall) {
 2052                 /* binding to all addresses, so just set in the proper flags */
 2053                 inp->sctp_flags |= (SCTP_PCB_FLAGS_BOUNDALL |
 2054                     SCTP_PCB_FLAGS_DO_ASCONF);
 2055                 /* set the automatic addr changes from kernel flag */
 2056                 if (sctp_auto_asconf == 0) {
 2057                         inp->sctp_flags &= ~SCTP_PCB_FLAGS_AUTO_ASCONF;
 2058                 } else {
 2059                         inp->sctp_flags |= SCTP_PCB_FLAGS_AUTO_ASCONF;
 2060                 }
 2061         } else {
 2062                 /*
 2063                  * bind specific, make sure flags is off and add a new address
 2064                  * structure to the sctp_addr_list inside the ep structure.
 2065                  *
 2066                  * We will need to allocate one and insert it at the head.
 2067                  * The socketopt call can just insert new addresses in there
 2068                  * as well. It will also have to do the embed scope kame hack
 2069                  * too (before adding).
 2070                  */
 2071                 struct ifaddr *ifa;
 2072                 struct sockaddr_storage store_sa;
 2073 
 2074                 memset(&store_sa, 0, sizeof(store_sa));
 2075                 if (addr->sa_family == AF_INET) {
 2076                         struct sockaddr_in *sin;
 2077 
 2078                         sin = (struct sockaddr_in *)&store_sa;
 2079                         memcpy(sin, addr, sizeof(struct sockaddr_in));
 2080                         sin->sin_port = 0;
 2081                 } else if (addr->sa_family == AF_INET6) {
 2082                         struct sockaddr_in6 *sin6;
 2083 
 2084                         sin6 = (struct sockaddr_in6 *)&store_sa;
 2085                         memcpy(sin6, addr, sizeof(struct sockaddr_in6));
 2086                         sin6->sin6_port = 0;
 2087                 }
 2088                 /*
 2089                  * first find the interface with the bound address
 2090                  * need to zero out the port to find the address! yuck!
 2091                  * can't do this earlier since need port for sctp_pcb_findep()
 2092                  */
 2093                 ifa = sctp_find_ifa_by_addr((struct sockaddr *)&store_sa);
 2094                 if (ifa == NULL) {
 2095                         /* Can't find an interface with that address */
 2096                         SCTP_INP_WUNLOCK(inp);
 2097                         SCTP_INP_INFO_WUNLOCK();
 2098                         return (EADDRNOTAVAIL);
 2099                 }
 2100                 if (addr->sa_family == AF_INET6) {
 2101                         struct in6_ifaddr *ifa6;
 2102                         ifa6 = (struct in6_ifaddr *)ifa;
 2103                         /*
 2104                          * allow binding of deprecated addresses as per
 2105                          * RFC 2462 and ipng discussion
 2106                          */
 2107                         if (ifa6->ia6_flags & (IN6_IFF_DETACHED |
 2108                             IN6_IFF_ANYCAST |
 2109                             IN6_IFF_NOTREADY)) {
 2110                                 /* Can't bind a non-existent addr. */
 2111                                 SCTP_INP_WUNLOCK(inp);
 2112                                 SCTP_INP_INFO_WUNLOCK();
 2113                                 return (EINVAL);
 2114                         }
 2115                 }
 2116                 /* we're not bound all */
 2117                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_BOUNDALL;
 2118 #if 0 /* use sysctl now */
 2119                 /* don't allow automatic addr changes from kernel */
 2120                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_AUTO_ASCONF;
 2121 #endif
 2122                 /* set the automatic addr changes from kernel flag */
 2123                 if (sctp_auto_asconf == 0) {
 2124                         inp->sctp_flags &= ~SCTP_PCB_FLAGS_AUTO_ASCONF;
 2125                 } else {
 2126                         inp->sctp_flags |= SCTP_PCB_FLAGS_AUTO_ASCONF;
 2127                 }
 2128                 /* allow bindx() to send ASCONF's for binding changes */
 2129                 inp->sctp_flags |= SCTP_PCB_FLAGS_DO_ASCONF;
 2130                 /* add this address to the endpoint list */
 2131                 error = sctp_insert_laddr(&inp->sctp_addr_list, ifa);
 2132                 if (error != 0) {
 2133                         SCTP_INP_WUNLOCK(inp);
 2134                         SCTP_INP_INFO_WUNLOCK();
 2135                         return (error);
 2136                 }
 2137                 inp->laddr_count++;
 2138         }
 2139         /* find the bucket */
 2140         head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport,
 2141             sctppcbinfo.hashmark)];
 2142         /* put it in the bucket */
 2143         LIST_INSERT_HEAD(head, inp, sctp_hash);
 2144 #ifdef SCTP_DEBUG
 2145         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 2146                 kprintf("Main hash to bind at head:%p, bound port:%d\n", head, ntohs(lport));
 2147         }
 2148 #endif
 2149         /* set in the port */
 2150         inp->sctp_lport = lport;
 2151 
 2152         /* turn off just the unbound flag */
 2153         inp->sctp_flags &= ~SCTP_PCB_FLAGS_UNBOUND;
 2154         SCTP_INP_WUNLOCK(inp);
 2155         SCTP_INP_INFO_WUNLOCK();
 2156         return (0);
 2157 }
 2158 
 2159 
 2160 static void
 2161 sctp_iterator_inp_being_freed(struct sctp_inpcb *inp, struct sctp_inpcb *inp_next)
 2162 {
 2163         struct sctp_iterator *it;
 2164         /* We enter with the only the ITERATOR_LOCK in place and
 2165          * A write lock on the inp_info stuff.
 2166          */
 2167 
 2168         /* Go through all iterators, we must do this since
 2169          * it is possible that some iterator does NOT have
 2170          * the lock, but is waiting for it. And the one that
 2171          * had the lock has either moved in the last iteration
 2172          * or we just cleared it above. We need to find all
 2173          * of those guys. The list of iterators should never
 2174          * be very big though.
 2175          */
 2176         LIST_FOREACH(it, &sctppcbinfo.iteratorhead, sctp_nxt_itr) {
 2177                 if (it == inp->inp_starting_point_for_iterator)
 2178                         /* skip this guy, he's special */
 2179                         continue;
 2180                 if (it->inp == inp) {
 2181                         /* This is tricky and we DON'T lock the iterator.
 2182                          * Reason is he's running but waiting for me since
 2183                          * inp->inp_starting_point_for_iterator has the lock
 2184                          * on me (the guy above we skipped). This tells us
 2185                          * its is not running but waiting for inp->inp_starting_point_for_iterator
 2186                          * to be released by the guy that does have our INP in a lock.
 2187                          */
 2188                         if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
 2189                                 it->inp = NULL;
 2190                                 it->stcb = NULL;
 2191                         } else {
 2192                                 /* set him up to do the next guy not me */
 2193                                 it->inp = inp_next;
 2194                                 it->stcb = NULL;
 2195                         }
 2196                 }
 2197         }
 2198         it = inp->inp_starting_point_for_iterator;
 2199         if (it) {
 2200                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
 2201                         it->inp = NULL;
 2202                 } else {
 2203                         it->inp = inp_next;
 2204                 }
 2205                 it->stcb = NULL;
 2206         }
 2207 }
 2208 
 2209 /* release sctp_inpcb unbind the port */
 2210 void
 2211 sctp_inpcb_free(struct sctp_inpcb *inp, int immediate)
 2212 {
 2213         /*
 2214          * Here we free a endpoint. We must find it (if it is in the Hash
 2215          * table) and remove it from there. Then we must also find it in
 2216          * the overall list and remove it from there. After all removals are
 2217          * complete then any timer has to be stopped. Then start the actual
 2218          * freeing.
 2219          * a) Any local lists.
 2220          * b) Any associations.
 2221          * c) The hash of all associations.
 2222          * d) finally the ep itself.
 2223          */
 2224         struct sctp_inpcb *inp_save;
 2225         struct sctp_tcb *asoc, *nasoc;
 2226         struct sctp_laddr *laddr, *nladdr;
 2227         struct inpcb *ip_pcb;
 2228         struct socket *so;
 2229         struct sctp_socket_q_list *sq;
 2230 #if !defined(__FreeBSD__) || __FreeBSD_version < 500000
 2231         struct rtentry *rt;
 2232 #endif
 2233         int cnt;
 2234 
 2235         SCTP_ASOC_CREATE_LOCK(inp);
 2236         SCTP_INP_WLOCK(inp);
 2237 
 2238         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
 2239                 /* been here before */
 2240                 kprintf("Endpoint was all gone (dup free)?\n");
 2241                 SCTP_INP_WUNLOCK(inp);
 2242                 SCTP_ASOC_CREATE_UNLOCK(inp);
 2243                 return;
 2244         }
 2245         sctp_timer_stop(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL);
 2246 
 2247         if (inp->control) {
 2248                 sctp_m_freem(inp->control);
 2249                 inp->control = NULL;
 2250         }
 2251         if (inp->pkt) {
 2252                 sctp_m_freem(inp->pkt);
 2253                 inp->pkt = NULL;
 2254         }
 2255         so  = inp->sctp_socket;
 2256         ip_pcb = &inp->ip_inp.inp; /* we could just cast the main
 2257                                    * pointer here but I will
 2258                                    * be nice :> (i.e. ip_pcb = ep;)
 2259                                    */
 2260 
 2261         if (immediate == 0) {
 2262                 int cnt_in_sd;
 2263                 cnt_in_sd = 0;
 2264                 for ((asoc = LIST_FIRST(&inp->sctp_asoc_list)); asoc != NULL;
 2265                      asoc = nasoc) {
 2266                         nasoc = LIST_NEXT(asoc, sctp_tcblist);
 2267                         if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_COOKIE_WAIT) ||
 2268                             (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_COOKIE_ECHOED)) {
 2269                                 /* Just abandon things in the front states */
 2270                                 SCTP_TCB_LOCK(asoc);
 2271                                 SCTP_INP_WUNLOCK(inp);
 2272                                 sctp_free_assoc(inp, asoc);
 2273                                 SCTP_INP_WLOCK(inp);
 2274                                 continue;
 2275                         } else {
 2276                                 asoc->asoc.state |= SCTP_STATE_CLOSED_SOCKET;
 2277                         }
 2278                         if ((asoc->asoc.size_on_delivery_queue  > 0) ||
 2279                             (asoc->asoc.size_on_reasm_queue > 0) ||
 2280                             (asoc->asoc.size_on_all_streams > 0) ||
 2281                             (so && (so->so_rcv.ssb_cc > 0))
 2282                                 ) {
 2283                                 /* Left with Data unread */
 2284                                 struct mbuf *op_err;
 2285                                 MGET(op_err, MB_DONTWAIT, MT_DATA);
 2286                                 if (op_err) {
 2287                                         /* Fill in the user initiated abort */
 2288                                         struct sctp_paramhdr *ph;
 2289                                         op_err->m_len =
 2290                                             sizeof(struct sctp_paramhdr);
 2291                                         ph = mtod(op_err,
 2292                                             struct sctp_paramhdr *);
 2293                                         ph->param_type = htons(
 2294                                             SCTP_CAUSE_USER_INITIATED_ABT);
 2295                                         ph->param_length = htons(op_err->m_len);
 2296                                 }
 2297                                 SCTP_TCB_LOCK(asoc);
 2298                                 sctp_send_abort_tcb(asoc, op_err);
 2299 
 2300                                 SCTP_INP_WUNLOCK(inp);
 2301                                 sctp_free_assoc(inp, asoc);
 2302                                 SCTP_INP_WLOCK(inp);
 2303                                 continue;
 2304                         } else if (TAILQ_EMPTY(&asoc->asoc.send_queue) &&
 2305                             TAILQ_EMPTY(&asoc->asoc.sent_queue)) {
 2306                                 if ((SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
 2307                                     (SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
 2308                                         /* there is nothing queued to send, so I send shutdown */
 2309                                         SCTP_TCB_LOCK(asoc);
 2310                                         sctp_send_shutdown(asoc, asoc->asoc.primary_destination);
 2311                                         asoc->asoc.state = SCTP_STATE_SHUTDOWN_SENT;
 2312                                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, asoc->sctp_ep, asoc,
 2313                                                          asoc->asoc.primary_destination);
 2314                                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, asoc->sctp_ep, asoc,
 2315                                                          asoc->asoc.primary_destination);
 2316                                         sctp_chunk_output(inp, asoc, 1);
 2317                                         SCTP_TCB_UNLOCK(asoc);
 2318                                 }
 2319                         } else {
 2320                                 /* mark into shutdown pending */
 2321                                 asoc->asoc.state |= SCTP_STATE_SHUTDOWN_PENDING;
 2322                         }
 2323                         cnt_in_sd++;
 2324                 }
 2325                 /* now is there some left in our SHUTDOWN state? */
 2326                 if (cnt_in_sd) {
 2327                         inp->sctp_flags |= SCTP_PCB_FLAGS_SOCKET_GONE;
 2328                         SCTP_INP_WUNLOCK(inp);
 2329                         SCTP_ASOC_CREATE_UNLOCK(inp);
 2330                         return;
 2331                 }
 2332         }
 2333 #if defined(__FreeBSD__) && __FreeBSD_version >= 503000
 2334         if (inp->refcount) {
 2335                 sctp_timer_start(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL);
 2336                 SCTP_INP_WUNLOCK(inp);
 2337                 SCTP_ASOC_CREATE_UNLOCK(inp);
 2338                 return;
 2339         }
 2340 #endif
 2341         inp->sctp_flags |= SCTP_PCB_FLAGS_SOCKET_ALLGONE;
 2342 #if !defined(__FreeBSD__) || __FreeBSD_version < 500000
 2343         rt = ip_pcb->inp_route.ro_rt;
 2344 #endif
 2345 
 2346         callout_stop(&inp->sctp_ep.signature_change.timer);
 2347 
 2348         if (so) {
 2349         /* First take care of socket level things */
 2350 #ifdef IPSEC
 2351 #ifdef __OpenBSD__
 2352         /* XXX IPsec cleanup here */
 2353                 if (ip_pcb->inp_tdb_in)
 2354                     TAILQ_REMOVE(&ip_pcb->inp_tdb_in->tdb_inp_in,
 2355                                  ip_pcb, inp_tdb_in_next);
 2356                 if (ip_pcb->inp_tdb_out)
 2357                     TAILQ_REMOVE(&ip_pcb->inp_tdb_out->tdb_inp_out, ip_pcb,
 2358                                  inp_tdb_out_next);
 2359                 if (ip_pcb->inp_ipsec_localid)
 2360                     ipsp_reffree(ip_pcb->inp_ipsec_localid);
 2361                 if (ip_pcb->inp_ipsec_remoteid)
 2362                     ipsp_reffree(ip_pcb->inp_ipsec_remoteid);
 2363                 if (ip_pcb->inp_ipsec_localcred)
 2364                     ipsp_reffree(ip_pcb->inp_ipsec_localcred);
 2365                 if (ip_pcb->inp_ipsec_remotecred)
 2366                     ipsp_reffree(ip_pcb->inp_ipsec_remotecred);
 2367                 if (ip_pcb->inp_ipsec_localauth)
 2368                     ipsp_reffree(ip_pcb->inp_ipsec_localauth);
 2369                 if (ip_pcb->inp_ipsec_remoteauth)
 2370                     ipsp_reffree(ip_pcb->inp_ipsec_remoteauth);
 2371 #else
 2372                 ipsec4_delete_pcbpolicy(ip_pcb);
 2373 #endif
 2374 #endif /*IPSEC*/
 2375 #if defined(__FreeBSD__) && __FreeBSD_version > 500000
 2376                 ACCEPT_LOCK();
 2377                 SOCK_LOCK(so);
 2378 #endif
 2379                 so->so_pcb = NULL;
 2380                 sofree(so);
 2381         }
 2382 
 2383         if (ip_pcb->inp_options) {
 2384                 m_free(ip_pcb->inp_options);
 2385                 ip_pcb->inp_options = 0;
 2386         }
 2387 #if !defined(__FreeBSD__) || __FreeBSD_version < 500000
 2388         if (rt) {
 2389                 RTFREE(rt);
 2390                 ip_pcb->inp_route.ro_rt = 0;
 2391         }
 2392 #endif
 2393         if (ip_pcb->inp_moptions) {
 2394                 ip_freemoptions(ip_pcb->inp_moptions);
 2395                 ip_pcb->inp_moptions = 0;
 2396         }
 2397 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__))
 2398         inp->inp_vflag = 0;
 2399 #else
 2400         ip_pcb->inp_vflag = 0;
 2401 #endif
 2402 
 2403         /* Now the sctp_pcb things */
 2404 
 2405         /*
 2406          * free each asoc if it is not already closed/free. we can't use
 2407          * the macro here since le_next will get freed as part of the
 2408          * sctp_free_assoc() call.
 2409          */
 2410         cnt = 0;
 2411         for ((asoc = LIST_FIRST(&inp->sctp_asoc_list)); asoc != NULL;
 2412              asoc = nasoc) {
 2413                 nasoc = LIST_NEXT(asoc, sctp_tcblist);
 2414                 SCTP_TCB_LOCK(asoc);
 2415                 if (SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_COOKIE_WAIT) {
 2416                         struct mbuf *op_err;
 2417                         MGET(op_err, MB_DONTWAIT, MT_DATA);
 2418                         if (op_err) {
 2419                                 /* Fill in the user initiated abort */
 2420                                 struct sctp_paramhdr *ph;
 2421                                 op_err->m_len = sizeof(struct sctp_paramhdr);
 2422                                 ph = mtod(op_err, struct sctp_paramhdr *);
 2423                                 ph->param_type = htons(
 2424                                     SCTP_CAUSE_USER_INITIATED_ABT);
 2425                                 ph->param_length = htons(op_err->m_len);
 2426                         }
 2427                         sctp_send_abort_tcb(asoc, op_err);
 2428                 }
 2429                 cnt++;
 2430                 /*
 2431                  * sctp_free_assoc() will call sctp_inpcb_free(),
 2432                  * if SCTP_PCB_FLAGS_SOCKET_GONE set.
 2433                  * So, we clear it before sctp_free_assoc() making sure
 2434                  * no double sctp_inpcb_free().
 2435                  */
 2436                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_SOCKET_GONE;
 2437                 SCTP_INP_WUNLOCK(inp);
 2438                 sctp_free_assoc(inp, asoc);
 2439                 SCTP_INP_WLOCK(inp);
 2440         }
 2441         while ((sq = TAILQ_FIRST(&inp->sctp_queue_list)) != NULL) {
 2442                 TAILQ_REMOVE(&inp->sctp_queue_list, sq, next_sq);
 2443                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_sockq, sq);
 2444                 sctppcbinfo.ipi_count_sockq--;
 2445                 sctppcbinfo.ipi_gencnt_sockq++;
 2446         }
 2447         inp->sctp_socket = 0;
 2448         /* Now first we remove ourselves from the overall list of all EP's */
 2449 
 2450         /* Unlock inp first, need correct order */
 2451         SCTP_INP_WUNLOCK(inp);
 2452         /* now iterator lock */
 2453         SCTP_ITERATOR_LOCK();
 2454         /* now info lock */
 2455         SCTP_INP_INFO_WLOCK();
 2456         /* now reget the inp lock */
 2457         SCTP_INP_WLOCK(inp);
 2458 
 2459         inp_save = LIST_NEXT(inp, sctp_list);
 2460         LIST_REMOVE(inp, sctp_list);
 2461         /*
 2462          * Now the question comes as to if this EP was ever bound at all.
 2463          * If it was, then we must pull it out of the EP hash list.
 2464          */
 2465         if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) !=
 2466             SCTP_PCB_FLAGS_UNBOUND) {
 2467                 /*
 2468                  * ok, this guy has been bound. It's port is somewhere
 2469                  * in the sctppcbinfo hash table. Remove it!
 2470                  */
 2471                 LIST_REMOVE(inp, sctp_hash);
 2472         }
 2473         /* fix any iterators only after out of the list */
 2474         sctp_iterator_inp_being_freed(inp, inp_save);
 2475         SCTP_ITERATOR_UNLOCK();
 2476         /*
 2477          * if we have an address list the following will free the list of
 2478          * ifaddr's that are set into this ep. Again macro limitations here,
 2479          * since the LIST_FOREACH could be a bad idea.
 2480          */
 2481         for ((laddr = LIST_FIRST(&inp->sctp_addr_list)); laddr != NULL;
 2482              laddr = nladdr) {
 2483                 nladdr = LIST_NEXT(laddr, sctp_nxt_addr);
 2484                 LIST_REMOVE(laddr, sctp_nxt_addr);
 2485                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr);
 2486                 sctppcbinfo.ipi_gencnt_laddr++;
 2487                 sctppcbinfo.ipi_count_laddr--;
 2488         }
 2489         /* Now lets see about freeing the EP hash table. */
 2490         if (inp->sctp_tcbhash != NULL) {
 2491                 hashdestroy(inp->sctp_tcbhash, M_PCB, inp->sctp_hashmark);
 2492                 inp->sctp_tcbhash = 0;
 2493         }
 2494         SCTP_INP_WUNLOCK(inp);
 2495         SCTP_ASOC_CREATE_UNLOCK(inp);
 2496         SCTP_INP_LOCK_DESTROY(inp);
 2497         SCTP_ASOC_CREATE_LOCK_DESTROY(inp);
 2498 
 2499         /* Now we must put the ep memory back into the zone pool */
 2500         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp);
 2501         sctppcbinfo.ipi_count_ep--;
 2502 
 2503         SCTP_INP_INFO_WUNLOCK();
 2504 }
 2505 
 2506 
 2507 struct sctp_nets *
 2508 sctp_findnet(struct sctp_tcb *stcb, struct sockaddr *addr)
 2509 {
 2510         struct sctp_nets *net;
 2511 #if 0
 2512         struct sockaddr_in *sin;
 2513 
 2514         /* why do we need to check the port for a nets list on an assoc? */
 2515         /* use the peer's/remote port for lookup if unspecified */
 2516         sin = (struct sockaddr_in *)addr;
 2517         if (stcb->rport != sin->sin_port) {
 2518                 /* we cheat and just a sin for this test */
 2519                 return (NULL);
 2520         }
 2521 #endif
 2522         /* locate the address */
 2523         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 2524                 if (sctp_cmpaddr(addr, (struct sockaddr *)&net->ro._l_addr))
 2525                         return (net);
 2526         }
 2527         return (NULL);
 2528 }
 2529 
 2530 
 2531 /*
 2532  * add's a remote endpoint address, done with the INIT/INIT-ACK
 2533  * as well as when a ASCONF arrives that adds it. It will also
 2534  * initialize all the cwnd stats of stuff.
 2535  */
 2536 int
 2537 sctp_is_address_on_local_host(struct sockaddr *addr)
 2538 {
 2539         struct ifnet *ifn;
 2540 
 2541         TAILQ_FOREACH(ifn, &ifnet, if_list) {
 2542                 struct ifaddr_container *ifac;
 2543 
 2544                 TAILQ_FOREACH(ifac, &ifn->if_addrheads[mycpuid], ifa_link) {
 2545                         struct ifaddr *ifa = ifac->ifa;
 2546 
 2547                         if (addr->sa_family == ifa->ifa_addr->sa_family) {
 2548                                 /* same family */
 2549                                 if (addr->sa_family == AF_INET) {
 2550                                         struct sockaddr_in *sin, *sin_c;
 2551                                         sin = (struct sockaddr_in *)addr;
 2552                                         sin_c = (struct sockaddr_in *)
 2553                                             ifa->ifa_addr;
 2554                                         if (sin->sin_addr.s_addr ==
 2555                                             sin_c->sin_addr.s_addr) {
 2556                                                 /* we are on the same machine */
 2557                                                 return (1);
 2558                                         }
 2559                                 } else if (addr->sa_family == AF_INET6) {
 2560                                         struct sockaddr_in6 *sin6, *sin_c6;
 2561                                         sin6 = (struct sockaddr_in6 *)addr;
 2562                                         sin_c6 = (struct sockaddr_in6 *)
 2563                                             ifa->ifa_addr;
 2564                                         if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
 2565                                             &sin_c6->sin6_addr)) {
 2566                                                 /* we are on the same machine */
 2567                                                 return (1);
 2568                                         }
 2569                                 }
 2570                         }
 2571                 }
 2572         }
 2573         return (0);
 2574 }
 2575 
 2576 int
 2577 sctp_add_remote_addr(struct sctp_tcb *stcb, struct sockaddr *newaddr,
 2578     int set_scope, int from)
 2579 {
 2580         /*
 2581          * The following is redundant to the same lines in the
 2582          * sctp_aloc_assoc() but is needed since other's call the add
 2583          * address function
 2584          */
 2585         struct sctp_nets *net, *netfirst;
 2586         int addr_inscope;
 2587 
 2588 #ifdef SCTP_DEBUG
 2589         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 2590                 kprintf("Adding an address (from:%d) to the peer: ", from);
 2591                 sctp_print_address(newaddr);
 2592         }
 2593 #endif
 2594         netfirst = sctp_findnet(stcb, newaddr);
 2595         if (netfirst) {
 2596                 /*
 2597                  * Lie and return ok, we don't want to make the association
 2598                  * go away for this behavior. It will happen in the TCP model
 2599                  * in a connected socket. It does not reach the hash table
 2600                  * until after the association is built so it can't be found.
 2601                  * Mark as reachable, since the initial creation will have
 2602                  * been cleared and the NOT_IN_ASSOC flag will have been
 2603                  * added... and we don't want to end up removing it back out.
 2604                  */
 2605                 if (netfirst->dest_state & SCTP_ADDR_UNCONFIRMED) {
 2606                         netfirst->dest_state = (SCTP_ADDR_REACHABLE|
 2607                             SCTP_ADDR_UNCONFIRMED);
 2608                 } else {
 2609                         netfirst->dest_state = SCTP_ADDR_REACHABLE;
 2610                 }
 2611 
 2612                 return (0);
 2613         }
 2614         addr_inscope = 1;
 2615         if (newaddr->sa_family == AF_INET) {
 2616                 struct sockaddr_in *sin;
 2617                 sin = (struct sockaddr_in *)newaddr;
 2618                 if (sin->sin_addr.s_addr == 0) {
 2619                         /* Invalid address */
 2620                         return (-1);
 2621                 }
 2622                 /* zero out the bzero area */
 2623                 memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
 2624 
 2625                 /* assure len is set */
 2626                 sin->sin_len = sizeof(struct sockaddr_in);
 2627                 if (set_scope) {
 2628 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE
 2629                         stcb->ipv4_local_scope = 1;
 2630 #else
 2631                         if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
 2632                                 stcb->asoc.ipv4_local_scope = 1;
 2633                         }
 2634 #endif /* SCTP_DONT_DO_PRIVADDR_SCOPE */
 2635 
 2636                         if (sctp_is_address_on_local_host(newaddr)) {
 2637                                 stcb->asoc.loopback_scope = 1;
 2638                                 stcb->asoc.ipv4_local_scope = 1;
 2639                                 stcb->asoc.local_scope = 1;
 2640                                 stcb->asoc.site_scope = 1;
 2641                         }
 2642                 } else {
 2643                         if (from == 8) {
 2644                                 /* From connectx */
 2645                                 if (sctp_is_address_on_local_host(newaddr)) {
 2646                                         stcb->asoc.loopback_scope = 1;
 2647                                         stcb->asoc.ipv4_local_scope = 1;
 2648                                         stcb->asoc.local_scope = 1;
 2649                                         stcb->asoc.site_scope = 1;
 2650                                 }
 2651                         }
 2652                         /* Validate the address is in scope */
 2653                         if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) &&
 2654                             (stcb->asoc.ipv4_local_scope == 0)) {
 2655                                 addr_inscope = 0;
 2656                         }
 2657                 }
 2658         } else if (newaddr->sa_family == AF_INET6) {
 2659                 struct sockaddr_in6 *sin6;
 2660                 sin6 = (struct sockaddr_in6 *)newaddr;
 2661                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
 2662                         /* Invalid address */
 2663                         return (-1);
 2664                 }
 2665                 /* assure len is set */
 2666                 sin6->sin6_len = sizeof(struct sockaddr_in6);
 2667                 if (set_scope) {
 2668                         if (sctp_is_address_on_local_host(newaddr)) {
 2669                                 stcb->asoc.loopback_scope = 1;
 2670                                 stcb->asoc.local_scope = 1;
 2671                                 stcb->asoc.ipv4_local_scope = 1;
 2672                                 stcb->asoc.site_scope = 1;
 2673                         } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
 2674                                 /*
 2675                                  * If the new destination is a LINK_LOCAL
 2676                                  * we must have common site scope. Don't set
 2677                                  * the local scope since we may not share all
 2678                                  * links, only loopback can do this.
 2679                                  * Links on the local network would also
 2680                                  * be on our private network for v4 too.
 2681                                  */
 2682                                 stcb->asoc.ipv4_local_scope = 1;
 2683                                 stcb->asoc.site_scope = 1;
 2684                         } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
 2685                                 /*
 2686                                  * If the new destination is SITE_LOCAL
 2687                                  * then we must have site scope in common.
 2688                                  */
 2689                                 stcb->asoc.site_scope = 1;
 2690                         }
 2691                 } else {
 2692                         if (from == 8) {
 2693                                 /* From connectx */
 2694                                 if (sctp_is_address_on_local_host(newaddr)) {
 2695                                         stcb->asoc.loopback_scope = 1;
 2696                                         stcb->asoc.ipv4_local_scope = 1;
 2697                                         stcb->asoc.local_scope = 1;
 2698                                         stcb->asoc.site_scope = 1;
 2699                                 }
 2700                         }
 2701                         /* Validate the address is in scope */
 2702                         if (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr) &&
 2703                             (stcb->asoc.loopback_scope == 0)) {
 2704                                 addr_inscope = 0;
 2705                         } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) &&
 2706                                    (stcb->asoc.local_scope == 0)) {
 2707                                 addr_inscope = 0;
 2708                         } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr) &&
 2709                                    (stcb->asoc.site_scope == 0)) {
 2710                                 addr_inscope = 0;
 2711                         }
 2712                 }
 2713         } else {
 2714                 /* not supported family type */
 2715                 return (-1);
 2716         }
 2717         net = (struct sctp_nets *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_net);
 2718         if (net == NULL) {
 2719                 return (-1);
 2720         }
 2721         sctppcbinfo.ipi_count_raddr++;
 2722         sctppcbinfo.ipi_gencnt_raddr++;
 2723         bzero(net, sizeof(*net));
 2724         memcpy(&net->ro._l_addr, newaddr, newaddr->sa_len);
 2725         if (newaddr->sa_family == AF_INET) {
 2726                 ((struct sockaddr_in *)&net->ro._l_addr)->sin_port = stcb->rport;
 2727         } else if (newaddr->sa_family == AF_INET6) {
 2728                 ((struct sockaddr_in6 *)&net->ro._l_addr)->sin6_port = stcb->rport;
 2729         }
 2730         net->addr_is_local = sctp_is_address_on_local_host(newaddr);
 2731         net->failure_threshold = stcb->asoc.def_net_failure;
 2732         if (addr_inscope == 0) {
 2733 #ifdef SCTP_DEBUG
 2734                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 2735                         kprintf("Adding an address which is OUT OF SCOPE\n");
 2736                 }
 2737 #endif /* SCTP_DEBUG */
 2738                 net->dest_state = (SCTP_ADDR_REACHABLE |
 2739                     SCTP_ADDR_OUT_OF_SCOPE);
 2740         } else {
 2741                 if (from == 8)
 2742                         /* 8 is passed by connect_x */
 2743                         net->dest_state = SCTP_ADDR_REACHABLE;
 2744                 else
 2745                         net->dest_state = SCTP_ADDR_REACHABLE |
 2746                             SCTP_ADDR_UNCONFIRMED;
 2747         }
 2748         net->RTO = stcb->asoc.initial_rto;
 2749         stcb->asoc.numnets++;
 2750         net->ref_count = 1;
 2751 
 2752         /* Init the timer structure */
 2753 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
 2754         callout_init(&net->rxt_timer.timer, 0);
 2755         callout_init(&net->pmtu_timer.timer, 0);
 2756 #else
 2757         callout_init(&net->rxt_timer.timer);
 2758         callout_init(&net->pmtu_timer.timer);
 2759 #endif
 2760 
 2761         /* Now generate a route for this guy */
 2762         /* KAME hack: embed scopeid */
 2763         if (newaddr->sa_family == AF_INET6) {
 2764                 struct sockaddr_in6 *sin6;
 2765                 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
 2766 #if defined(SCTP_BASE_FREEBSD) || defined(__APPLE__) || defined(__DragonFly__)
 2767                 in6_embedscope(&sin6->sin6_addr, sin6,
 2768                     &stcb->sctp_ep->ip_inp.inp, NULL);
 2769 #else
 2770                 in6_embedscope(&sin6->sin6_addr, sin6);
 2771 #endif
 2772 #ifndef SCOPEDROUTING
 2773                 sin6->sin6_scope_id = 0;
 2774 #endif
 2775         }
 2776 #if defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__)
 2777         rtalloc_ign((struct route *)&net->ro, 0UL);
 2778 #else
 2779         rtalloc((struct route *)&net->ro);
 2780 #endif
 2781         if (newaddr->sa_family == AF_INET6) {
 2782                 struct sockaddr_in6 *sin6;
 2783                 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
 2784                 in6_recoverscope(sin6, &sin6->sin6_addr, NULL);
 2785         }
 2786         if ((net->ro.ro_rt) &&
 2787             (net->ro.ro_rt->rt_ifp)) {
 2788                 net->mtu = net->ro.ro_rt->rt_ifp->if_mtu;
 2789                 if (from == 1) {
 2790                         stcb->asoc.smallest_mtu = net->mtu;
 2791                 }
 2792                 /* start things off to match mtu of interface please. */
 2793                 net->ro.ro_rt->rt_rmx.rmx_mtu = net->ro.ro_rt->rt_ifp->if_mtu;
 2794         } else {
 2795                 net->mtu = stcb->asoc.smallest_mtu;
 2796         }
 2797         if (stcb->asoc.smallest_mtu > net->mtu) {
 2798                 stcb->asoc.smallest_mtu = net->mtu;
 2799         }
 2800         /* We take the max of the burst limit times a MTU or the INITIAL_CWND.
 2801          * We then limit this to 4 MTU's of sending.
 2802          */
 2803         net->cwnd = min((net->mtu * 4), max((stcb->asoc.max_burst * net->mtu), SCTP_INITIAL_CWND));
 2804 
 2805         /* we always get at LEAST 2 MTU's */
 2806         if (net->cwnd < (2 * net->mtu)) {
 2807                 net->cwnd = 2 * net->mtu;
 2808         }
 2809 
 2810         net->ssthresh = stcb->asoc.peers_rwnd;
 2811 
 2812         net->src_addr_selected = 0;
 2813         netfirst = TAILQ_FIRST(&stcb->asoc.nets);
 2814         if (net->ro.ro_rt == NULL) {
 2815                 /* Since we have no route put it at the back */
 2816                 TAILQ_INSERT_TAIL(&stcb->asoc.nets, net, sctp_next);
 2817         } else if (netfirst == NULL) {
 2818                 /* We are the first one in the pool. */
 2819                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
 2820         } else if (netfirst->ro.ro_rt == NULL) {
 2821                 /*
 2822                  * First one has NO route. Place this one ahead of the
 2823                  * first one.
 2824                  */
 2825                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
 2826         } else if (net->ro.ro_rt->rt_ifp != netfirst->ro.ro_rt->rt_ifp) {
 2827                 /*
 2828                  * This one has a different interface than the one at the
 2829                  * top of the list. Place it ahead.
 2830                  */
 2831                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
 2832         } else {
 2833                 /*
 2834                  * Ok we have the same interface as the first one. Move
 2835                  * forward until we find either
 2836                  *   a) one with a NULL route... insert ahead of that
 2837                  *   b) one with a different ifp.. insert after that.
 2838                  *   c) end of the list.. insert at the tail.
 2839                  */
 2840                 struct sctp_nets *netlook;
 2841                 do {
 2842                         netlook = TAILQ_NEXT(netfirst, sctp_next);
 2843                         if (netlook == NULL) {
 2844                                 /* End of the list */
 2845                                 TAILQ_INSERT_TAIL(&stcb->asoc.nets, net,
 2846                                     sctp_next);
 2847                                 break;
 2848                         } else if (netlook->ro.ro_rt == NULL) {
 2849                                 /* next one has NO route */
 2850                                 TAILQ_INSERT_BEFORE(netfirst, net, sctp_next);
 2851                                 break;
 2852                         } else if (netlook->ro.ro_rt->rt_ifp !=
 2853                                    net->ro.ro_rt->rt_ifp) {
 2854                                 TAILQ_INSERT_AFTER(&stcb->asoc.nets, netlook,
 2855                                     net, sctp_next);
 2856                                 break;
 2857                         }
 2858                         /* Shift forward */
 2859                         netfirst = netlook;
 2860                 } while (netlook != NULL);
 2861         }
 2862         /* got to have a primary set */
 2863         if (stcb->asoc.primary_destination == 0) {
 2864                 stcb->asoc.primary_destination = net;
 2865         } else if ((stcb->asoc.primary_destination->ro.ro_rt == NULL) &&
 2866                    (net->ro.ro_rt)) {
 2867                 /* No route to current primary adopt new primary */
 2868                 stcb->asoc.primary_destination = net;
 2869         }
 2870         sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb,
 2871             net);
 2872 
 2873         return (0);
 2874 }
 2875 
 2876 
 2877 /*
 2878  * allocate an association and add it to the endpoint. The caller must
 2879  * be careful to add all additional addresses once they are know right
 2880  * away or else the assoc will be may experience a blackout scenario.
 2881  */
 2882 struct sctp_tcb *
 2883 sctp_aloc_assoc(struct sctp_inpcb *inp, struct sockaddr *firstaddr,
 2884     int for_a_init, int *error,  uint32_t override_tag)
 2885 {
 2886         struct sctp_tcb *stcb;
 2887         struct sctp_association *asoc;
 2888         struct sctpasochead *head;
 2889         uint16_t rport;
 2890         int err;
 2891 
 2892         /*
 2893          * Assumption made here:
 2894          *  Caller has done a sctp_findassociation_ep_addr(ep, addr's);
 2895          *  to make sure the address does not exist already.
 2896          */
 2897         if (sctppcbinfo.ipi_count_asoc >= SCTP_MAX_NUM_OF_ASOC) {
 2898                 /* Hit max assoc, sorry no more */
 2899                 *error = ENOBUFS;
 2900                 return (NULL);
 2901         }
 2902         SCTP_INP_RLOCK(inp);
 2903         if (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) {
 2904                 /*
 2905                  * If its in the TCP pool, its NOT allowed to create an
 2906                  * association. The parent listener needs to call
 2907                  * sctp_aloc_assoc.. or the one-2-many socket. If a
 2908                  * peeled off, or connected one does this.. its an error.
 2909                  */
 2910                 SCTP_INP_RUNLOCK(inp);
 2911                 *error = EINVAL;
 2912                 return (NULL);
 2913         }
 2914 
 2915 #ifdef SCTP_DEBUG
 2916         if (sctp_debug_on & SCTP_DEBUG_PCB3) {
 2917                 kprintf("Allocate an association for peer:");
 2918                 if (firstaddr)
 2919                         sctp_print_address(firstaddr);
 2920                 else
 2921                         kprintf("None\n");
 2922                 kprintf("Port:%d\n",
 2923                        ntohs(((struct sockaddr_in *)firstaddr)->sin_port));
 2924         }
 2925 #endif /* SCTP_DEBUG */
 2926         if (firstaddr->sa_family == AF_INET) {
 2927                 struct sockaddr_in *sin;
 2928                 sin = (struct sockaddr_in *)firstaddr;
 2929                 if ((sin->sin_port == 0) || (sin->sin_addr.s_addr == 0)) {
 2930                         /* Invalid address */
 2931 #ifdef SCTP_DEBUG
 2932                         if (sctp_debug_on & SCTP_DEBUG_PCB3) {
 2933                                 kprintf("peer address invalid\n");
 2934                         }
 2935 #endif
 2936                         SCTP_INP_RUNLOCK(inp);
 2937                         *error = EINVAL;
 2938                         return (NULL);
 2939                 }
 2940                 rport = sin->sin_port;
 2941         } else if (firstaddr->sa_family == AF_INET6) {
 2942                 struct sockaddr_in6 *sin6;
 2943                 sin6 = (struct sockaddr_in6 *)firstaddr;
 2944                 if ((sin6->sin6_port == 0) ||
 2945                     (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))) {
 2946                         /* Invalid address */
 2947 #ifdef SCTP_DEBUG
 2948                         if (sctp_debug_on & SCTP_DEBUG_PCB3) {
 2949                                 kprintf("peer address invalid\n");
 2950                         }
 2951 #endif
 2952                         SCTP_INP_RUNLOCK(inp);
 2953                         *error = EINVAL;
 2954                         return (NULL);
 2955                 }
 2956                 rport = sin6->sin6_port;
 2957         } else {
 2958                 /* not supported family type */
 2959 #ifdef SCTP_DEBUG
 2960                 if (sctp_debug_on & SCTP_DEBUG_PCB3) {
 2961                         kprintf("BAD family %d\n", firstaddr->sa_family);
 2962                 }
 2963 #endif
 2964                 SCTP_INP_RUNLOCK(inp);
 2965                 *error = EINVAL;
 2966                 return (NULL);
 2967         }
 2968         SCTP_INP_RUNLOCK(inp);
 2969         if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
 2970                 /*
 2971                  * If you have not performed a bind, then we need to do
 2972                  * the ephemerial bind for you.
 2973                  */
 2974 #ifdef SCTP_DEBUG
 2975                 if (sctp_debug_on & SCTP_DEBUG_PCB3) {
 2976                         kprintf("Doing implicit BIND\n");
 2977                 }
 2978 #endif
 2979 
 2980                 if ((err = sctp_inpcb_bind(inp->sctp_socket,
 2981                     NULL,
 2982 #if (defined(__FreeBSD__) && __FreeBSD_version >= 500000) || defined(__DragonFly__)
 2983                                            NULL
 2984 #else
 2985                                            NULL
 2986 #endif
 2987                              ))){
 2988                         /* bind error, probably perm */
 2989 #ifdef SCTP_DEBUG
 2990                         if (sctp_debug_on & SCTP_DEBUG_PCB3) {
 2991                                 kprintf("BIND FAILS ret:%d\n", err);
 2992                         }
 2993 #endif
 2994 
 2995                         *error = err;
 2996                         return (NULL);
 2997                 }
 2998         }
 2999         stcb = (struct sctp_tcb *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_asoc);
 3000         if (stcb == NULL) {
 3001                 /* out of memory? */
 3002 #ifdef SCTP_DEBUG
 3003                 if (sctp_debug_on & SCTP_DEBUG_PCB3) {
 3004                         kprintf("aloc_assoc: no assoc mem left, stcb=NULL\n");
 3005                 }
 3006 #endif
 3007                 *error = ENOMEM;
 3008                 return (NULL);
 3009         }
 3010         sctppcbinfo.ipi_count_asoc++;
 3011         sctppcbinfo.ipi_gencnt_asoc++;
 3012 
 3013         bzero(stcb, sizeof(*stcb));
 3014         asoc = &stcb->asoc;
 3015         SCTP_TCB_LOCK_INIT(stcb);
 3016         /* setup back pointer's */
 3017         stcb->sctp_ep = inp;
 3018         stcb->sctp_socket = inp->sctp_socket;
 3019         if ((err = sctp_init_asoc(inp, asoc, for_a_init, override_tag))) {
 3020                 /* failed */
 3021                 SCTP_TCB_LOCK_DESTROY (stcb);
 3022                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb);
 3023                 sctppcbinfo.ipi_count_asoc--;
 3024 #ifdef SCTP_DEBUG
 3025                 if (sctp_debug_on & SCTP_DEBUG_PCB3) {
 3026                         kprintf("aloc_assoc: couldn't init asoc, out of mem?!\n");
 3027                 }
 3028 #endif
 3029                 *error = err;
 3030                 return (NULL);
 3031         }
 3032         /* and the port */
 3033         stcb->rport = rport;
 3034         SCTP_INP_INFO_WLOCK();
 3035         SCTP_INP_WLOCK(inp);
 3036         if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
 3037                 /* inpcb freed while alloc going on */
 3038                 SCTP_TCB_LOCK_DESTROY (stcb);
 3039                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb);
 3040                 SCTP_INP_WUNLOCK(inp);
 3041                 SCTP_INP_INFO_WUNLOCK();
 3042                 sctppcbinfo.ipi_count_asoc--;
 3043 #ifdef SCTP_DEBUG
 3044                 if (sctp_debug_on & SCTP_DEBUG_PCB3) {
 3045                         kprintf("aloc_assoc: couldn't init asoc, out of mem?!\n");
 3046                 }
 3047 #endif
 3048                 *error = EINVAL;
 3049                 return (NULL);
 3050         }
 3051         SCTP_TCB_LOCK(stcb);
 3052 
 3053         /* now that my_vtag is set, add it to the  hash */
 3054         head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag,
 3055              sctppcbinfo.hashasocmark)];
 3056         /* put it in the bucket in the vtag hash of assoc's for the system */
 3057         LIST_INSERT_HEAD(head, stcb, sctp_asocs);
 3058         SCTP_INP_INFO_WUNLOCK();
 3059 
 3060 
 3061         if ((err = sctp_add_remote_addr(stcb, firstaddr, 1, 1))) {
 3062                 /* failure.. memory error? */
 3063                 if (asoc->strmout)
 3064                         kfree(asoc->strmout, M_PCB);
 3065                 if (asoc->mapping_array)
 3066                         kfree(asoc->mapping_array, M_PCB);
 3067 
 3068                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb);
 3069                 sctppcbinfo.ipi_count_asoc--;
 3070 #ifdef SCTP_DEBUG
 3071                 if (sctp_debug_on & SCTP_DEBUG_PCB3) {
 3072                         kprintf("aloc_assoc: couldn't add remote addr!\n");
 3073                 }
 3074 #endif
 3075                 SCTP_TCB_LOCK_DESTROY (stcb);
 3076                 *error = ENOBUFS;
 3077                 return (NULL);
 3078         }
 3079         /* Init all the timers */
 3080 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
 3081         callout_init(&asoc->hb_timer.timer, 0);
 3082         callout_init(&asoc->dack_timer.timer, 0);
 3083         callout_init(&asoc->asconf_timer.timer, 0);
 3084         callout_init(&asoc->shut_guard_timer.timer, 0);
 3085         callout_init(&asoc->autoclose_timer.timer, 0);
 3086         callout_init(&asoc->delayed_event_timer.timer, 0);
 3087 #else
 3088         callout_init(&asoc->hb_timer.timer);
 3089         callout_init(&asoc->dack_timer.timer);
 3090         callout_init(&asoc->asconf_timer.timer);
 3091         callout_init(&asoc->shut_guard_timer.timer);
 3092         callout_init(&asoc->autoclose_timer.timer);
 3093         callout_init(&asoc->delayed_event_timer.timer);
 3094 #endif
 3095         LIST_INSERT_HEAD(&inp->sctp_asoc_list, stcb, sctp_tcblist);
 3096         /* now file the port under the hash as well */
 3097         if (inp->sctp_tcbhash != NULL) {
 3098                 head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(stcb->rport,
 3099                    inp->sctp_hashmark)];
 3100                 LIST_INSERT_HEAD(head, stcb, sctp_tcbhash);
 3101         }
 3102         SCTP_INP_WUNLOCK(inp);
 3103 #ifdef SCTP_DEBUG
 3104         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 3105                 kprintf("Association %p now allocated\n", stcb);
 3106         }
 3107 #endif
 3108         return (stcb);
 3109 }
 3110 
 3111 void
 3112 sctp_free_remote_addr(struct sctp_nets *net)
 3113 {
 3114         if (net == NULL)
 3115                 return;
 3116         net->ref_count--;
 3117         if (net->ref_count <= 0) {
 3118                 /* stop timer if running */
 3119                 callout_stop(&net->rxt_timer.timer);
 3120                 callout_stop(&net->pmtu_timer.timer);
 3121                 net->dest_state = SCTP_ADDR_NOT_REACHABLE;
 3122                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_net, net);
 3123                 sctppcbinfo.ipi_count_raddr--;
 3124         }
 3125 }
 3126 
 3127 /*
 3128  * remove a remote endpoint address from an association, it
 3129  * will fail if the address does not exist.
 3130  */
 3131 int
 3132 sctp_del_remote_addr(struct sctp_tcb *stcb, struct sockaddr *remaddr)
 3133 {
 3134         /*
 3135          * Here we need to remove a remote address. This is quite simple, we
 3136          * first find it in the list of address for the association
 3137          * (tasoc->asoc.nets) and then if it is there, we do a LIST_REMOVE on
 3138          * that item.
 3139          * Note we do not allow it to be removed if there are no other
 3140          * addresses.
 3141          */
 3142         struct sctp_association *asoc;
 3143         struct sctp_nets *net, *net_tmp;
 3144         asoc = &stcb->asoc;
 3145         if (asoc->numnets < 2) {
 3146                 /* Must have at LEAST two remote addresses */
 3147                 return (-1);
 3148         }
 3149         /* locate the address */
 3150         for (net = TAILQ_FIRST(&asoc->nets); net != NULL; net = net_tmp) {
 3151                 net_tmp = TAILQ_NEXT(net, sctp_next);
 3152                 if (net->ro._l_addr.sa.sa_family != remaddr->sa_family) {
 3153                         continue;
 3154                 }
 3155                 if (sctp_cmpaddr((struct sockaddr *)&net->ro._l_addr,
 3156                     remaddr)) {
 3157                         /* we found the guy */
 3158                         asoc->numnets--;
 3159                         TAILQ_REMOVE(&asoc->nets, net, sctp_next);
 3160                         sctp_free_remote_addr(net);
 3161                         if (net == asoc->primary_destination) {
 3162                                 /* Reset primary */
 3163                                 struct sctp_nets *lnet;
 3164                                 lnet = TAILQ_FIRST(&asoc->nets);
 3165                                 /* Try to find a confirmed primary */
 3166                                 asoc->primary_destination =
 3167                                     sctp_find_alternate_net(stcb, lnet);
 3168                         }
 3169                         if (net == asoc->last_data_chunk_from) {
 3170                                 /* Reset primary */
 3171                                 asoc->last_data_chunk_from =
 3172                                     TAILQ_FIRST(&asoc->nets);
 3173                         }
 3174                         if (net == asoc->last_control_chunk_from) {
 3175                                 /* Reset primary */
 3176                                 asoc->last_control_chunk_from =
 3177                                     TAILQ_FIRST(&asoc->nets);
 3178                         }
 3179                         if (net == asoc->asconf_last_sent_to) {
 3180                                 /* Reset primary */
 3181                                 asoc->asconf_last_sent_to =
 3182                                     TAILQ_FIRST(&asoc->nets);
 3183                         }
 3184                         return (0);
 3185                 }
 3186         }
 3187         /* not found. */
 3188         return (-2);
 3189 }
 3190 
 3191 
 3192 static void
 3193 sctp_add_vtag_to_timewait(struct sctp_inpcb *inp, u_int32_t tag)
 3194 {
 3195         struct sctpvtaghead *chain;
 3196         struct sctp_tagblock *twait_block;
 3197         struct timeval now;
 3198         int set, i;
 3199         SCTP_GETTIME_TIMEVAL(&now);
 3200         chain = &sctppcbinfo.vtag_timewait[(tag % SCTP_STACK_VTAG_HASH_SIZE)];
 3201         set = 0;
 3202         if (!LIST_EMPTY(chain)) {
 3203                 /* Block(s) present, lets find space, and expire on the fly */
 3204                 LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) {
 3205                         for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) {
 3206                                 if ((twait_block->vtag_block[i].v_tag == 0) &&
 3207                                     !set) {
 3208                                         twait_block->vtag_block[0].tv_sec_at_expire =
 3209                                             now.tv_sec + SCTP_TIME_WAIT;
 3210                                         twait_block->vtag_block[0].v_tag = tag;
 3211                                         set = 1;
 3212                                 } else if ((twait_block->vtag_block[i].v_tag) &&
 3213                                     ((long)twait_block->vtag_block[i].tv_sec_at_expire >
 3214                                     now.tv_sec)) {
 3215                                         /* Audit expires this guy */
 3216                                         twait_block->vtag_block[i].tv_sec_at_expire = 0;
 3217                                         twait_block->vtag_block[i].v_tag = 0;
 3218                                         if (set == 0) {
 3219                                                 /* Reuse it for my new tag */
 3220                                                 twait_block->vtag_block[0].tv_sec_at_expire = now.tv_sec + SCTP_TIME_WAIT;
 3221                                                 twait_block->vtag_block[0].v_tag = tag;
 3222                                                 set = 1;
 3223                                         }
 3224                                 }
 3225                         }
 3226                         if (set) {
 3227                                 /*
 3228                                  * We only do up to the block where we can
 3229                                  * place our tag for audits
 3230                                  */
 3231                                 break;
 3232                         }
 3233                 }
 3234         }
 3235         /* Need to add a new block to chain */
 3236         if (!set) {
 3237                 twait_block = kmalloc(sizeof(struct sctp_tagblock), M_PCB,
 3238                                       M_NOWAIT);
 3239                 if (twait_block == NULL) {
 3240                         return;
 3241                 }
 3242                 memset(twait_block, 0, sizeof(struct sctp_timewait));
 3243                 LIST_INSERT_HEAD(chain, twait_block, sctp_nxt_tagblock);
 3244                 twait_block->vtag_block[0].tv_sec_at_expire = now.tv_sec +
 3245                     SCTP_TIME_WAIT;
 3246                 twait_block->vtag_block[0].v_tag = tag;
 3247         }
 3248 }
 3249 
 3250 
 3251 static void
 3252 sctp_iterator_asoc_being_freed(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
 3253 {
 3254         struct sctp_iterator *it;
 3255 
 3256 
 3257 
 3258         /* Unlock the tcb lock we do this so
 3259          * we avoid a dead lock scenario where
 3260          * the iterator is waiting on the TCB lock
 3261          * and the TCB lock is waiting on the iterator
 3262          * lock.
 3263          */
 3264         SCTP_ITERATOR_LOCK();
 3265         SCTP_INP_INFO_WLOCK();
 3266         SCTP_INP_WLOCK(inp);
 3267         SCTP_TCB_LOCK(stcb);
 3268 
 3269         it = stcb->asoc.stcb_starting_point_for_iterator;
 3270         if (it == NULL) {
 3271                 return;
 3272         }
 3273         if (it->inp != stcb->sctp_ep) {
 3274                 /* hm, focused on the wrong one? */
 3275                 return;
 3276         }
 3277         if (it->stcb != stcb) {
 3278                 return;
 3279         }
 3280         it->stcb = LIST_NEXT(stcb, sctp_tcblist);
 3281         if (it->stcb == NULL) {
 3282                 /* done with all asoc's in this assoc */
 3283                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
 3284                         it->inp = NULL;
 3285                 } else {
 3286 
 3287                         it->inp = LIST_NEXT(inp, sctp_list);
 3288                 }
 3289         }
 3290 }
 3291 
 3292 /*
 3293  * Free the association after un-hashing the remote port.
 3294  */
 3295 void
 3296 sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
 3297 {
 3298         struct sctp_association *asoc;
 3299         struct sctp_nets *net, *prev;
 3300         struct sctp_laddr *laddr;
 3301         struct sctp_tmit_chunk *chk;
 3302         struct sctp_asconf_addr *aparam;
 3303         struct sctp_socket_q_list *sq;
 3304 
 3305         /* first, lets purge the entry from the hash table. */
 3306         if (stcb->asoc.state == 0) {
 3307                 kprintf("Freeing already free association:%p - huh??\n",
 3308                     stcb);
 3309                 return;
 3310         }
 3311         asoc = &stcb->asoc;
 3312         asoc->state = 0;
 3313         /* now clean up any other timers */
 3314         callout_stop(&asoc->hb_timer.timer);
 3315         callout_stop(&asoc->dack_timer.timer);
 3316         callout_stop(&asoc->asconf_timer.timer);
 3317         callout_stop(&asoc->shut_guard_timer.timer);
 3318         callout_stop(&asoc->autoclose_timer.timer);
 3319         callout_stop(&asoc->delayed_event_timer.timer);
 3320         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
 3321                 callout_stop(&net->rxt_timer.timer);
 3322                 callout_stop(&net->pmtu_timer.timer);
 3323         }
 3324 
 3325         /* Iterator asoc being freed we send an
 3326          * unlocked TCB. It returns with INP_INFO
 3327          * and INP write locked and the TCB locked
 3328          * too and of course the iterator lock
 3329          * in place as well..
 3330          */
 3331         SCTP_TCB_UNLOCK(stcb);
 3332         sctp_iterator_asoc_being_freed(inp, stcb);
 3333 
 3334         /* Null all of my entry's on the socket q */
 3335         TAILQ_FOREACH(sq, &inp->sctp_queue_list, next_sq) {
 3336                 if (sq->tcb == stcb) {
 3337                         sq->tcb = NULL;
 3338                 }
 3339         }
 3340 
 3341         if (inp->sctp_tcb_at_block == (void *)stcb) {
 3342                 inp->error_on_block = ECONNRESET;
 3343         }
 3344 
 3345         if (inp->sctp_tcbhash) {
 3346                 LIST_REMOVE(stcb, sctp_tcbhash);
 3347         }
 3348         /* Now lets remove it from the list of ALL associations in the EP */
 3349         LIST_REMOVE(stcb, sctp_tcblist);
 3350         SCTP_INP_WUNLOCK(inp);
 3351         SCTP_ITERATOR_UNLOCK();
 3352 
 3353 
 3354         /* pull from vtag hash */
 3355         LIST_REMOVE(stcb, sctp_asocs);
 3356 
 3357         /*
 3358          * Now before we can free the assoc, we must  remove all of the
 3359          * networks and any other allocated space.. i.e. add removes here
 3360          * before the SCTP_ZONE_FREE() of the tasoc entry.
 3361          */
 3362 
 3363         sctp_add_vtag_to_timewait(inp, asoc->my_vtag);
 3364         SCTP_INP_INFO_WUNLOCK();
 3365         prev = NULL;
 3366         while (!TAILQ_EMPTY(&asoc->nets)) {
 3367                 net = TAILQ_FIRST(&asoc->nets);
 3368                 /* pull from list */
 3369                 if ((sctppcbinfo.ipi_count_raddr == 0) || (prev == net)) {
 3370                         break;
 3371                 }
 3372                 prev = net;
 3373                 TAILQ_REMOVE(&asoc->nets, net, sctp_next);
 3374                 /* free it */
 3375                 net->ref_count = 0;
 3376                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_net, net);
 3377                 sctppcbinfo.ipi_count_raddr--;
 3378         }
 3379         /*
 3380          * The chunk lists and such SHOULD be empty but we check them
 3381          * just in case.
 3382          */
 3383         /* anything on the wheel needs to be removed */
 3384         while (!TAILQ_EMPTY(&asoc->out_wheel)) {
 3385                 struct sctp_stream_out *outs;
 3386                 outs = TAILQ_FIRST(&asoc->out_wheel);
 3387                 TAILQ_REMOVE(&asoc->out_wheel, outs, next_spoke);
 3388                 /* now clean up any chunks here */
 3389                 chk = TAILQ_FIRST(&outs->outqueue);
 3390                 while (chk) {
 3391                         TAILQ_REMOVE(&outs->outqueue, chk, sctp_next);
 3392                         if (chk->data) {
 3393                                 sctp_m_freem(chk->data);
 3394                                 chk->data = NULL;
 3395                         }
 3396                         chk->whoTo = NULL;
 3397                         chk->asoc = NULL;
 3398                         /* Free the chunk */
 3399                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
 3400                         sctppcbinfo.ipi_count_chunk--;
 3401                         sctppcbinfo.ipi_gencnt_chunk++;
 3402                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
 3403                                 panic("Chunk count is negative");
 3404                         }
 3405                         chk = TAILQ_FIRST(&outs->outqueue);
 3406                 }
 3407                 outs = TAILQ_FIRST(&asoc->out_wheel);
 3408         }
 3409 
 3410         if (asoc->pending_reply) {
 3411                 kfree(asoc->pending_reply, M_PCB);
 3412                 asoc->pending_reply = NULL;
 3413         }
 3414         chk = TAILQ_FIRST(&asoc->pending_reply_queue);
 3415         while (chk) {
 3416                 TAILQ_REMOVE(&asoc->pending_reply_queue, chk, sctp_next);
 3417                 if (chk->data) {
 3418                         sctp_m_freem(chk->data);
 3419                         chk->data = NULL;
 3420                 }
 3421                 chk->whoTo = NULL;
 3422                 chk->asoc = NULL;
 3423                 /* Free the chunk */
 3424                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
 3425                 sctppcbinfo.ipi_count_chunk--;
 3426                 sctppcbinfo.ipi_gencnt_chunk++;
 3427                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
 3428                         panic("Chunk count is negative");
 3429                 }
 3430                 chk = TAILQ_FIRST(&asoc->pending_reply_queue);
 3431         }
 3432         /* pending send queue SHOULD be empty */
 3433         if (!TAILQ_EMPTY(&asoc->send_queue)) {
 3434                 chk = TAILQ_FIRST(&asoc->send_queue);
 3435                 while (chk) {
 3436                         TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
 3437                         if (chk->data) {
 3438                                 sctp_m_freem(chk->data);
 3439                                 chk->data = NULL;
 3440                         }
 3441                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
 3442                         sctppcbinfo.ipi_count_chunk--;
 3443                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
 3444                                 panic("Chunk count is negative");
 3445                         }
 3446                         sctppcbinfo.ipi_gencnt_chunk++;
 3447                         chk = TAILQ_FIRST(&asoc->send_queue);
 3448                 }
 3449         }
 3450         /* sent queue SHOULD be empty */
 3451         if (!TAILQ_EMPTY(&asoc->sent_queue)) {
 3452                 chk = TAILQ_FIRST(&asoc->sent_queue);
 3453                 while (chk) {
 3454                         TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
 3455                         if (chk->data) {
 3456                                 sctp_m_freem(chk->data);
 3457                                 chk->data = NULL;
 3458                         }
 3459                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
 3460                         sctppcbinfo.ipi_count_chunk--;
 3461                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
 3462                                 panic("Chunk count is negative");
 3463                         }
 3464                         sctppcbinfo.ipi_gencnt_chunk++;
 3465                         chk = TAILQ_FIRST(&asoc->sent_queue);
 3466                 }
 3467         }
 3468         /* control queue MAY not be empty */
 3469         if (!TAILQ_EMPTY(&asoc->control_send_queue)) {
 3470                 chk = TAILQ_FIRST(&asoc->control_send_queue);
 3471                 while (chk) {
 3472                         TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
 3473                         if (chk->data) {
 3474                                 sctp_m_freem(chk->data);
 3475                                 chk->data = NULL;
 3476                         }
 3477                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
 3478                         sctppcbinfo.ipi_count_chunk--;
 3479                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
 3480                                 panic("Chunk count is negative");
 3481                         }
 3482                         sctppcbinfo.ipi_gencnt_chunk++;
 3483                         chk = TAILQ_FIRST(&asoc->control_send_queue);
 3484                 }
 3485         }
 3486         if (!TAILQ_EMPTY(&asoc->reasmqueue)) {
 3487                 chk = TAILQ_FIRST(&asoc->reasmqueue);
 3488                 while (chk) {
 3489                         TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
 3490                         if (chk->data) {
 3491                                 sctp_m_freem(chk->data);
 3492                                 chk->data = NULL;
 3493                         }
 3494                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
 3495                         sctppcbinfo.ipi_count_chunk--;
 3496                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
 3497                                 panic("Chunk count is negative");
 3498                         }
 3499                         sctppcbinfo.ipi_gencnt_chunk++;
 3500                         chk = TAILQ_FIRST(&asoc->reasmqueue);
 3501                 }
 3502         }
 3503         if (!TAILQ_EMPTY(&asoc->delivery_queue)) {
 3504                 chk = TAILQ_FIRST(&asoc->delivery_queue);
 3505                 while (chk) {
 3506                         TAILQ_REMOVE(&asoc->delivery_queue, chk, sctp_next);
 3507                         if (chk->data) {
 3508                                 sctp_m_freem(chk->data);
 3509                                 chk->data = NULL;
 3510                         }
 3511                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
 3512                         sctppcbinfo.ipi_count_chunk--;
 3513                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
 3514                                 panic("Chunk count is negative");
 3515                         }
 3516                         sctppcbinfo.ipi_gencnt_chunk++;
 3517                         chk = TAILQ_FIRST(&asoc->delivery_queue);
 3518                 }
 3519         }
 3520         if (asoc->mapping_array) {
 3521                 kfree(asoc->mapping_array, M_PCB);
 3522                 asoc->mapping_array = NULL;
 3523         }
 3524 
 3525         /* the stream outs */
 3526         if (asoc->strmout) {
 3527                 kfree(asoc->strmout, M_PCB);
 3528                 asoc->strmout = NULL;
 3529         }
 3530         asoc->streamoutcnt = 0;
 3531         if (asoc->strmin) {
 3532                 int i;
 3533                 for (i = 0; i < asoc->streamincnt; i++) {
 3534                         if (!TAILQ_EMPTY(&asoc->strmin[i].inqueue)) {
 3535                                 /* We have somethings on the streamin queue */
 3536                                 chk = TAILQ_FIRST(&asoc->strmin[i].inqueue);
 3537                                 while (chk) {
 3538                                         TAILQ_REMOVE(&asoc->strmin[i].inqueue,
 3539                                             chk, sctp_next);
 3540                                         if (chk->data) {
 3541                                                 sctp_m_freem(chk->data);
 3542                                                 chk->data = NULL;
 3543                                         }
 3544                                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk,
 3545                                             chk);
 3546                                         sctppcbinfo.ipi_count_chunk--;
 3547                                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
 3548                                                 panic("Chunk count is negative");
 3549                                         }
 3550                                         sctppcbinfo.ipi_gencnt_chunk++;
 3551                                         chk = TAILQ_FIRST(&asoc->strmin[i].inqueue);
 3552                                 }
 3553                         }
 3554                 }
 3555                 kfree(asoc->strmin, M_PCB);
 3556                 asoc->strmin = NULL;
 3557         }
 3558         asoc->streamincnt = 0;
 3559         /* local addresses, if any */
 3560         while (!LIST_EMPTY(&asoc->sctp_local_addr_list)) {
 3561                 laddr = LIST_FIRST(&asoc->sctp_local_addr_list);
 3562                 LIST_REMOVE(laddr, sctp_nxt_addr);
 3563                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr);
 3564                 sctppcbinfo.ipi_count_laddr--;
 3565         }
 3566         /* pending asconf (address) parameters */
 3567         while (!TAILQ_EMPTY(&asoc->asconf_queue)) {
 3568                 aparam = TAILQ_FIRST(&asoc->asconf_queue);
 3569                 TAILQ_REMOVE(&asoc->asconf_queue, aparam, next);
 3570                 kfree(aparam, M_PCB);
 3571         }
 3572         if (asoc->last_asconf_ack_sent != NULL) {
 3573                 sctp_m_freem(asoc->last_asconf_ack_sent);
 3574                 asoc->last_asconf_ack_sent = NULL;
 3575         }
 3576         /* Insert new items here :> */
 3577 
 3578         /* Get rid of LOCK */
 3579         SCTP_TCB_LOCK_DESTROY(stcb);
 3580 
 3581         /* now clean up the tasoc itself */
 3582         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb);
 3583         sctppcbinfo.ipi_count_asoc--;
 3584         if ((inp->sctp_socket->so_snd.ssb_cc) ||
 3585             (inp->sctp_socket->so_snd.ssb_mbcnt)) {
 3586                 /* This will happen when a abort is done */
 3587                 inp->sctp_socket->so_snd.ssb_cc = 0;
 3588                 inp->sctp_socket->so_snd.ssb_mbcnt = 0;
 3589         }
 3590         if (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
 3591                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) {
 3592                         if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
 3593                                 /*
 3594                                  * For the base fd, that is NOT in TCP pool we
 3595                                  * turn off the connected flag. This allows
 3596                                  * non-listening endpoints to connect/shutdown/
 3597                                  * connect.
 3598                                  */
 3599                                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED;
 3600                                 soisdisconnected(inp->sctp_socket);
 3601                         }
 3602                         /*
 3603                          * For those that are in the TCP pool we just leave
 3604                          * so it cannot be used. When they close the fd we
 3605                          * will free it all.
 3606                          */
 3607                 }
 3608         }
 3609         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
 3610                 sctp_inpcb_free(inp, 0);
 3611         }
 3612 }
 3613 
 3614 
 3615 /*
 3616  * determine if a destination is "reachable" based upon the addresses
 3617  * bound to the current endpoint (e.g. only v4 or v6 currently bound)
 3618  */
 3619 /*
 3620  * FIX: if we allow assoc-level bindx(), then this needs to be fixed
 3621  * to use assoc level v4/v6 flags, as the assoc *may* not have the
 3622  * same address types bound as its endpoint
 3623  */
 3624 int
 3625 sctp_destination_is_reachable(struct sctp_tcb *stcb, struct sockaddr *destaddr)
 3626 {
 3627         struct sctp_inpcb *inp;
 3628         int answer;
 3629 
 3630         /* No locks here, the TCB, in all cases is already
 3631          * locked and an assoc is up. There is either a
 3632          * INP lock by the caller applied (in asconf case when
 3633          * deleting an address) or NOT in the HB case, however
 3634          * if HB then the INP increment is up and the INP
 3635          * will not be removed (on top of the fact that
 3636          * we have a TCB lock). So we only want to
 3637          * read the sctp_flags, which is either bound-all
 3638          * or not.. no protection needed since once an
 3639          * assoc is up you can't be changing your binding.
 3640          */
 3641         inp = stcb->sctp_ep;
 3642         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
 3643                 /* if bound all, destination is not restricted */
 3644                 /* RRS: Question during lock work: Is this
 3645                  * correct? If you are bound-all you still
 3646                  * might need to obey the V4--V6 flags???
 3647                  * IMO this bound-all stuff needs to be removed!
 3648                  */
 3649                 return (1);
 3650         }
 3651         /* NOTE: all "scope" checks are done when local addresses are added */
 3652         if (destaddr->sa_family == AF_INET6) {
 3653 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__))
 3654                 answer = inp->inp_vflag & INP_IPV6;
 3655 #else
 3656                 answer = inp->ip_inp.inp.inp_vflag & INP_IPV6;
 3657 #endif
 3658         } else if (destaddr->sa_family == AF_INET) {
 3659 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__))
 3660                 answer = inp->inp_vflag & INP_IPV4;
 3661 #else
 3662                 answer = inp->ip_inp.inp.inp_vflag & INP_IPV4;
 3663 #endif
 3664         } else {
 3665                 /* invalid family, so it's unreachable */
 3666                 answer = 0;
 3667         }
 3668         return (answer);
 3669 }
 3670 
 3671 /*
 3672  * update the inp_vflags on an endpoint
 3673  */
 3674 static void
 3675 sctp_update_ep_vflag(struct sctp_inpcb *inp) {
 3676         struct sctp_laddr *laddr;
 3677 
 3678         /* first clear the flag */
 3679 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__))
 3680         inp->inp_vflag = 0;
 3681 #else
 3682         inp->ip_inp.inp.inp_vflag = 0;
 3683 #endif
 3684         /* set the flag based on addresses on the ep list */
 3685         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
 3686                 if (laddr->ifa == NULL) {
 3687 #ifdef SCTP_DEBUG
 3688                         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 3689                                 kprintf("An ounce of prevention is worth a pound of cure\n");
 3690                         }
 3691 #endif /* SCTP_DEBUG */
 3692                         continue;
 3693                 }
 3694                 if (laddr->ifa->ifa_addr) {
 3695                         continue;
 3696                 }
 3697                 if (laddr->ifa->ifa_addr->sa_family == AF_INET6) {
 3698 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__))
 3699                         inp->inp_vflag |= INP_IPV6;
 3700 #else
 3701                         inp->ip_inp.inp.inp_vflag |= INP_IPV6;
 3702 #endif
 3703                 } else if (laddr->ifa->ifa_addr->sa_family == AF_INET) {
 3704 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__))
 3705                         inp->inp_vflag |= INP_IPV4;
 3706 #else
 3707                         inp->ip_inp.inp.inp_vflag |= INP_IPV4;
 3708 #endif
 3709                 }
 3710         }
 3711 }
 3712 
 3713 /*
 3714  * Add the address to the endpoint local address list
 3715  * There is nothing to be done if we are bound to all addresses
 3716  */
 3717 int
 3718 sctp_add_local_addr_ep(struct sctp_inpcb *inp, struct ifaddr *ifa)
 3719 {
 3720         struct sctp_laddr *laddr;
 3721         int fnd, error;
 3722         fnd = 0;
 3723 
 3724         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
 3725                 /* You are already bound to all. You have it already */
 3726                 return (0);
 3727         }
 3728         if (ifa->ifa_addr->sa_family == AF_INET6) {
 3729                 struct in6_ifaddr *ifa6;
 3730                 ifa6 = (struct in6_ifaddr *)ifa;
 3731                 if (ifa6->ia6_flags & (IN6_IFF_DETACHED |
 3732                     IN6_IFF_DEPRECATED | IN6_IFF_ANYCAST | IN6_IFF_NOTREADY))
 3733                         /* Can't bind a non-existent addr. */
 3734                         return (-1);
 3735         }
 3736         /* first, is it already present? */
 3737         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
 3738                 if (laddr->ifa == ifa) {
 3739                         fnd = 1;
 3740                         break;
 3741                 }
 3742         }
 3743 
 3744         if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && (fnd == 0)) {
 3745                 /* Not bound to all */
 3746                 error = sctp_insert_laddr(&inp->sctp_addr_list, ifa);
 3747                 if (error != 0)
 3748                         return (error);
 3749                 inp->laddr_count++;
 3750                 /* update inp_vflag flags */
 3751                 if (ifa->ifa_addr->sa_family == AF_INET6) {
 3752 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__))
 3753                         inp->inp_vflag |= INP_IPV6;
 3754 #else
 3755                         inp->ip_inp.inp.inp_vflag |= INP_IPV6;
 3756 #endif
 3757                 } else if (ifa->ifa_addr->sa_family == AF_INET) {
 3758 #if !(defined(__FreeBSD__) || defined(__APPLE__) || defined(__DragonFly__))
 3759                         inp->inp_vflag |= INP_IPV4;
 3760 #else
 3761                         inp->ip_inp.inp.inp_vflag |= INP_IPV4;
 3762 #endif
 3763                 }
 3764         }
 3765         return (0);
 3766 }
 3767 
 3768 
 3769 /*
 3770  * select a new (hopefully reachable) destination net
 3771  * (should only be used when we deleted an ep addr that is the
 3772  * only usable source address to reach the destination net)
 3773  */
 3774 static void
 3775 sctp_select_primary_destination(struct sctp_tcb *stcb)
 3776 {
 3777         struct sctp_nets *net;
 3778 
 3779         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 3780                 /* for now, we'll just pick the first reachable one we find */
 3781                 if (net->dest_state & SCTP_ADDR_UNCONFIRMED)
 3782                         continue;
 3783                 if (sctp_destination_is_reachable(stcb,
 3784                     (struct sockaddr *)&net->ro._l_addr)) {
 3785                         /* found a reachable destination */
 3786                         stcb->asoc.primary_destination = net;
 3787                 }
 3788         }
 3789         /* I can't there from here! ...we're gonna die shortly... */
 3790 }
 3791 
 3792 
 3793 /*
 3794  * Delete the address from the endpoint local address list
 3795  * There is nothing to be done if we are bound to all addresses
 3796  */
 3797 int
 3798 sctp_del_local_addr_ep(struct sctp_inpcb *inp, struct ifaddr *ifa)
 3799 {
 3800         struct sctp_laddr *laddr;
 3801         int fnd;
 3802         fnd = 0;
 3803         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
 3804                 /* You are already bound to all. You have it already */
 3805                 return (EINVAL);
 3806         }
 3807 
 3808         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
 3809                 if (laddr->ifa == ifa) {
 3810                         fnd = 1;
 3811                         break;
 3812                 }
 3813         }
 3814         if (fnd && (inp->laddr_count < 2)) {
 3815                 /* can't delete unless there are at LEAST 2 addresses */
 3816                 return (-1);
 3817         }
 3818         if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && (fnd)) {
 3819                 /*
 3820                  * clean up any use of this address
 3821                  * go through our associations and clear any
 3822                  *  last_used_address that match this one
 3823                  * for each assoc, see if a new primary_destination is needed
 3824                  */
 3825                 struct sctp_tcb *stcb;
 3826 
 3827                 /* clean up "next_addr_touse" */
 3828                 if (inp->next_addr_touse == laddr)
 3829                         /* delete this address */
 3830                         inp->next_addr_touse = NULL;
 3831 
 3832                 /* clean up "last_used_address" */
 3833                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
 3834                         if (stcb->asoc.last_used_address == laddr)
 3835                                 /* delete this address */
 3836                                 stcb->asoc.last_used_address = NULL;
 3837                 } /* for each tcb */
 3838 
 3839                 /* remove it from the ep list */
 3840                 sctp_remove_laddr(laddr);
 3841                 inp->laddr_count--;
 3842                 /* update inp_vflag flags */
 3843                 sctp_update_ep_vflag(inp);
 3844                 /* select a new primary destination if needed */
 3845                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
 3846                         /* presume caller (sctp_asconf.c) already owns INP lock */
 3847                         SCTP_TCB_LOCK(stcb);
 3848                         if (sctp_destination_is_reachable(stcb,
 3849                             (struct sockaddr *)&stcb->asoc.primary_destination->ro._l_addr) == 0) {
 3850                                 sctp_select_primary_destination(stcb);
 3851                         }
 3852                         SCTP_TCB_UNLOCK(stcb);
 3853                 } /* for each tcb */
 3854         }
 3855         return (0);
 3856 }
 3857 
 3858 /*
 3859  * Add the addr to the TCB local address list
 3860  * For the BOUNDALL or dynamic case, this is a "pending" address list
 3861  * (eg. addresses waiting for an ASCONF-ACK response)
 3862  * For the subset binding, static case, this is a "valid" address list
 3863  */
 3864 int
 3865 sctp_add_local_addr_assoc(struct sctp_tcb *stcb, struct ifaddr *ifa)
 3866 {
 3867         struct sctp_laddr *laddr;
 3868         int error;
 3869 
 3870         /* Assumes TCP is locked.. and possiblye
 3871          * the INP. May need to confirm/fix that if
 3872          * we need it and is not the case.
 3873          */
 3874         if (ifa->ifa_addr->sa_family == AF_INET6) {
 3875                 struct in6_ifaddr *ifa6;
 3876                 ifa6 = (struct in6_ifaddr *)ifa;
 3877                 if (ifa6->ia6_flags & (IN6_IFF_DETACHED |
 3878                     /* IN6_IFF_DEPRECATED | */
 3879                     IN6_IFF_ANYCAST |
 3880                     IN6_IFF_NOTREADY))
 3881                         /* Can't bind a non-existent addr. */
 3882                         return (-1);
 3883         }
 3884         /* does the address already exist? */
 3885         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
 3886                 if (laddr->ifa == ifa) {
 3887                         return (-1);
 3888                 }
 3889         }
 3890 
 3891         /* add to the list */
 3892         error = sctp_insert_laddr(&stcb->asoc.sctp_local_addr_list, ifa);
 3893         if (error != 0)
 3894                 return (error);
 3895         return (0);
 3896 }
 3897 
 3898 /*
 3899  * insert an laddr entry with the given ifa for the desired list
 3900  */
 3901 int
 3902 sctp_insert_laddr(struct sctpladdr *list, struct ifaddr *ifa) {
 3903         struct sctp_laddr *laddr;
 3904 
 3905         laddr = (struct sctp_laddr *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_laddr);
 3906         if (laddr == NULL) {
 3907                 /* out of memory? */
 3908                 return (EINVAL);
 3909         }
 3910         sctppcbinfo.ipi_count_laddr++;
 3911         sctppcbinfo.ipi_gencnt_laddr++;
 3912         bzero(laddr, sizeof(*laddr));
 3913         laddr->ifa = ifa;
 3914         /* insert it */
 3915         LIST_INSERT_HEAD(list, laddr, sctp_nxt_addr);
 3916 
 3917         return (0);
 3918 }
 3919 
 3920 /*
 3921  * Remove an laddr entry from the local address list (on an assoc)
 3922  */
 3923 void
 3924 sctp_remove_laddr(struct sctp_laddr *laddr)
 3925 {
 3926         /* remove from the list */
 3927         LIST_REMOVE(laddr, sctp_nxt_addr);
 3928         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr);
 3929         sctppcbinfo.ipi_count_laddr--;
 3930         sctppcbinfo.ipi_gencnt_laddr++;
 3931 }
 3932 
 3933 /*
 3934  * Remove an address from the TCB local address list
 3935  */
 3936 int
 3937 sctp_del_local_addr_assoc(struct sctp_tcb *stcb, struct ifaddr *ifa)
 3938 {
 3939         struct sctp_inpcb *inp;
 3940         struct sctp_laddr *laddr;
 3941 
 3942         /* This is called by asconf work. It is assumed that
 3943          * a) The TCB is locked
 3944          * and
 3945          * b) The INP is locked.
 3946          * This is true in as much as I can trace through
 3947          * the entry asconf code where I did these locks.
 3948          * Again, the ASCONF code is a bit different in
 3949          * that it does lock the INP during its work often
 3950          * times. This must be since we don't want other
 3951          * proc's looking up things while what they are
 3952          * looking up is changing :-D
 3953          */
 3954 
 3955         inp = stcb->sctp_ep;
 3956         /* if subset bound and don't allow ASCONF's, can't delete last */
 3957         if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) &&
 3958             ((inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) == 0)) {
 3959                 if (stcb->asoc.numnets < 2) {
 3960                         /* can't delete last address */
 3961                         return (-1);
 3962                 }
 3963         }
 3964 
 3965         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
 3966                 /* remove the address if it exists */
 3967                 if (laddr->ifa == NULL)
 3968                         continue;
 3969                 if (laddr->ifa == ifa) {
 3970                         sctp_remove_laddr(laddr);
 3971                         return (0);
 3972                 }
 3973         }
 3974 
 3975         /* address not found! */
 3976         return (-1);
 3977 }
 3978 
 3979 /*
 3980  * Remove an address from the TCB local address list
 3981  * lookup using a sockaddr addr
 3982  */
 3983 int
 3984 sctp_del_local_addr_assoc_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
 3985 {
 3986         struct sctp_inpcb *inp;
 3987         struct sctp_laddr *laddr;
 3988         struct sockaddr *l_sa;
 3989 
 3990         /*
 3991          * This function I find does not seem to have a caller.
 3992          * As such we NEED TO DELETE this code. If we do
 3993          * find a caller, the caller MUST have locked the TCB
 3994          * at the least and probably the INP as well.
 3995          */
 3996         inp = stcb->sctp_ep;
 3997         /* if subset bound and don't allow ASCONF's, can't delete last */
 3998         if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) &&
 3999             ((inp->sctp_flags & SCTP_PCB_FLAGS_DO_ASCONF) == 0)) {
 4000                 if (stcb->asoc.numnets < 2) {
 4001                         /* can't delete last address */
 4002                         return (-1);
 4003                 }
 4004         }
 4005 
 4006         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
 4007                 /* make sure the address exists */
 4008                 if (laddr->ifa == NULL)
 4009                         continue;
 4010                 if (laddr->ifa->ifa_addr == NULL)
 4011                         continue;
 4012 
 4013                 l_sa = laddr->ifa->ifa_addr;
 4014                 if (l_sa->sa_family == AF_INET6) {
 4015                         /* IPv6 address */
 4016                         struct sockaddr_in6 *sin1, *sin2;
 4017                         sin1 = (struct sockaddr_in6 *)l_sa;
 4018                         sin2 = (struct sockaddr_in6 *)sa;
 4019                         if (memcmp(&sin1->sin6_addr, &sin2->sin6_addr,
 4020                             sizeof(struct in6_addr)) == 0) {
 4021                                 /* matched */
 4022                                 sctp_remove_laddr(laddr);
 4023                                 return (0);
 4024                         }
 4025                 } else if (l_sa->sa_family == AF_INET) {
 4026                         /* IPv4 address */
 4027                         struct sockaddr_in *sin1, *sin2;
 4028                         sin1 = (struct sockaddr_in *)l_sa;
 4029                         sin2 = (struct sockaddr_in *)sa;
 4030                         if (sin1->sin_addr.s_addr == sin2->sin_addr.s_addr) {
 4031                                 /* matched */
 4032                                 sctp_remove_laddr(laddr);
 4033                                 return (0);
 4034                         }
 4035                 } else {
 4036                         /* invalid family */
 4037                         return (-1);
 4038                 }
 4039         } /* end foreach */
 4040         /* address not found! */
 4041         return (-1);
 4042 }
 4043 
 4044 static char sctp_pcb_initialized = 0;
 4045 
 4046 #if defined(__FreeBSD__) || defined(__APPLE__)
 4047 /* sysctl */
 4048 /* not used by DragonFly SCTP_ZONE_INIT macro */
 4049 static int sctp_max_number_of_assoc = SCTP_MAX_NUM_OF_ASOC;
 4050 static int sctp_scale_up_for_address = SCTP_SCALE_FOR_ADDR;
 4051 
 4052 #endif /* FreeBSD || APPLE || DragonFly */
 4053 
 4054 #ifndef SCTP_TCBHASHSIZE
 4055 #define SCTP_TCBHASHSIZE 1024
 4056 #endif
 4057 
 4058 #ifndef SCTP_CHUNKQUEUE_SCALE
 4059 #define SCTP_CHUNKQUEUE_SCALE 10
 4060 #endif
 4061 
 4062 void
 4063 sctp_pcb_init(void)
 4064 {
 4065         /*
 4066          * SCTP initialization for the PCB structures
 4067          * should be called by the sctp_init() funciton.
 4068          */
 4069         int i;
 4070         int hashtblsize = SCTP_TCBHASHSIZE;
 4071 
 4072 #if defined(__FreeBSD__) || defined(__APPLE__)
 4073         /* not used by DragonFly SCTP_ZONE_INIT macro */
 4074         int sctp_chunkscale = SCTP_CHUNKQUEUE_SCALE;
 4075 #endif
 4076 
 4077         if (sctp_pcb_initialized != 0) {
 4078                 /* error I was called twice */
 4079                 return;
 4080         }
 4081         sctp_pcb_initialized = 1;
 4082 
 4083         /* Init all peg counts */
 4084         for (i = 0; i < SCTP_NUMBER_OF_PEGS; i++) {
 4085                 sctp_pegs[i] = 0;
 4086         }
 4087 
 4088         /* init the empty list of (All) Endpoints */
 4089         LIST_INIT(&sctppcbinfo.listhead);
 4090 
 4091         /* init the iterator head */
 4092         LIST_INIT(&sctppcbinfo.iteratorhead);
 4093 
 4094         /* init the hash table of endpoints */
 4095 #if defined(__FreeBSD__)
 4096 #if defined(__FreeBSD_cc_version) && __FreeBSD_cc_version >= 440000
 4097         TUNABLE_INT_FETCH("net.inet.sctp.tcbhashsize", &hashtblsize);
 4098         TUNABLE_INT_FETCH("net.inet.sctp.pcbhashsize", &sctp_pcbtblsize);
 4099         TUNABLE_INT_FETCH("net.inet.sctp.chunkscale", &sctp_chunkscale);
 4100 #else
 4101         TUNABLE_INT_FETCH("net.inet.sctp.tcbhashsize", SCTP_TCBHASHSIZE,
 4102             hashtblsize);
 4103         TUNABLE_INT_FETCH("net.inet.sctp.pcbhashsize", SCTP_PCBHASHSIZE,
 4104             sctp_pcbtblsize);
 4105         TUNABLE_INT_FETCH("net.inet.sctp.chunkscale", SCTP_CHUNKQUEUE_SCALE,
 4106             sctp_chunkscale);
 4107 #endif
 4108 #endif
 4109 
 4110         sctppcbinfo.sctp_asochash = hashinit((hashtblsize * 31),
 4111 #ifdef __NetBSD__
 4112             HASH_LIST,
 4113 #endif
 4114             M_PCB,
 4115 #if defined(__NetBSD__) || defined(__OpenBSD__)
 4116             M_WAITOK,
 4117 #endif
 4118             &sctppcbinfo.hashasocmark);
 4119 
 4120         sctppcbinfo.sctp_ephash = hashinit(hashtblsize,
 4121 #ifdef __NetBSD__
 4122             HASH_LIST,
 4123 #endif
 4124             M_PCB,
 4125 #if defined(__NetBSD__) || defined(__OpenBSD__)
 4126             M_WAITOK,
 4127 #endif
 4128             &sctppcbinfo.hashmark);
 4129 
 4130         sctppcbinfo.sctp_tcpephash = hashinit(hashtblsize,
 4131 #ifdef __NetBSD__
 4132             HASH_LIST,
 4133 #endif
 4134             M_PCB,
 4135 #if defined(__NetBSD__) || defined(__OpenBSD__)
 4136             M_WAITOK,
 4137 #endif
 4138             &sctppcbinfo.hashtcpmark);
 4139 
 4140         sctppcbinfo.hashtblsize = hashtblsize;
 4141 
 4142         /* init the zones */
 4143         /*
 4144          * FIX ME: Should check for NULL returns, but if it does fail we
 4145          * are doomed to panic anyways... add later maybe.
 4146          */
 4147         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_ep, "sctp_ep",
 4148             sizeof(struct sctp_inpcb), maxsockets);
 4149 
 4150         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_asoc, "sctp_asoc",
 4151             sizeof(struct sctp_tcb), sctp_max_number_of_assoc);
 4152 
 4153         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_laddr, "sctp_laddr",
 4154             sizeof(struct sctp_laddr),
 4155             (sctp_max_number_of_assoc * sctp_scale_up_for_address));
 4156 
 4157         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_net, "sctp_raddr",
 4158             sizeof(struct sctp_nets),
 4159             (sctp_max_number_of_assoc * sctp_scale_up_for_address));
 4160 
 4161         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_chunk, "sctp_chunk",
 4162             sizeof(struct sctp_tmit_chunk),
 4163             (sctp_max_number_of_assoc * sctp_scale_up_for_address *
 4164             sctp_chunkscale));
 4165 
 4166         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_sockq, "sctp_sockq",
 4167             sizeof(struct sctp_socket_q_list),
 4168             (sctp_max_number_of_assoc * sctp_scale_up_for_address *
 4169             sctp_chunkscale));
 4170 
 4171         /* Master Lock INIT for info structure */
 4172         SCTP_INP_INFO_LOCK_INIT();
 4173         SCTP_ITERATOR_LOCK_INIT();
 4174         /* not sure if we need all the counts */
 4175         sctppcbinfo.ipi_count_ep = 0;
 4176         sctppcbinfo.ipi_gencnt_ep = 0;
 4177         /* assoc/tcb zone info */
 4178         sctppcbinfo.ipi_count_asoc = 0;
 4179         sctppcbinfo.ipi_gencnt_asoc = 0;
 4180         /* local addrlist zone info */
 4181         sctppcbinfo.ipi_count_laddr = 0;
 4182         sctppcbinfo.ipi_gencnt_laddr = 0;
 4183         /* remote addrlist zone info */
 4184         sctppcbinfo.ipi_count_raddr = 0;
 4185         sctppcbinfo.ipi_gencnt_raddr = 0;
 4186         /* chunk info */
 4187         sctppcbinfo.ipi_count_chunk = 0;
 4188         sctppcbinfo.ipi_gencnt_chunk = 0;
 4189 
 4190         /* socket queue zone info */
 4191         sctppcbinfo.ipi_count_sockq = 0;
 4192         sctppcbinfo.ipi_gencnt_sockq = 0;
 4193 
 4194         /* mbuf tracker */
 4195         sctppcbinfo.mbuf_track = 0;
 4196         /* port stuff */
 4197 #if defined(__FreeBSD__) || defined(__OpenBSD__) || defined(__APPLE__) \
 4198     || defined(__DragonFly__)
 4199         sctppcbinfo.lastlow = ipport_firstauto;
 4200 #else
 4201         sctppcbinfo.lastlow = anonportmin;
 4202 #endif
 4203         /* Init the TIMEWAIT list */
 4204         for (i = 0; i < SCTP_STACK_VTAG_HASH_SIZE; i++) {
 4205                 LIST_INIT(&sctppcbinfo.vtag_timewait[i]);
 4206         }
 4207 
 4208 #if defined(_SCTP_NEEDS_CALLOUT_) && !defined(__APPLE__)
 4209         TAILQ_INIT(&sctppcbinfo.callqueue);
 4210 #endif
 4211 
 4212 }
 4213 
 4214 int
 4215 sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m,
 4216     int iphlen, int offset, int limit, struct sctphdr *sh,
 4217     struct sockaddr *altsa)
 4218 {
 4219         /*
 4220          * grub through the INIT pulling addresses and
 4221          * loading them to the nets structure in the asoc.
 4222          * The from address in the mbuf should also be loaded
 4223          * (if it is not already). This routine can be called
 4224          * with either INIT or INIT-ACK's as long as the
 4225          * m points to the IP packet and the offset points
 4226          * to the beginning of the parameters.
 4227          */
 4228         struct sctp_inpcb *inp, *l_inp;
 4229         struct sctp_nets *net, *net_tmp;
 4230         struct ip *iph;
 4231         struct sctp_paramhdr *phdr, parm_buf;
 4232         struct sctp_tcb *stcb_tmp;
 4233         u_int16_t ptype, plen;
 4234         struct sockaddr *sa;
 4235         struct sockaddr_storage dest_store;
 4236         struct sockaddr *local_sa = (struct sockaddr *)&dest_store;
 4237         struct sockaddr_in sin;
 4238         struct sockaddr_in6 sin6;
 4239 
 4240         /* First get the destination address setup too. */
 4241         memset(&sin, 0, sizeof(sin));
 4242         memset(&sin6, 0, sizeof(sin6));
 4243 
 4244         sin.sin_family = AF_INET;
 4245         sin.sin_len = sizeof(sin);
 4246         sin.sin_port = stcb->rport;
 4247 
 4248         sin6.sin6_family = AF_INET6;
 4249         sin6.sin6_len = sizeof(struct sockaddr_in6);
 4250         sin6.sin6_port = stcb->rport;
 4251         if (altsa == NULL) {
 4252                 iph = mtod(m, struct ip *);
 4253                 if (iph->ip_v == IPVERSION) {
 4254                         /* its IPv4 */
 4255                         struct sockaddr_in *sin_2;
 4256                         sin_2 = (struct sockaddr_in *)(local_sa);
 4257                         memset(sin_2, 0, sizeof(sin));
 4258                         sin_2->sin_family = AF_INET;
 4259                         sin_2->sin_len = sizeof(sin);
 4260                         sin_2->sin_port = sh->dest_port;
 4261                         sin_2->sin_addr.s_addr = iph->ip_dst.s_addr ;
 4262                         sin.sin_addr = iph->ip_src;
 4263                         sa = (struct sockaddr *)&sin;
 4264                 } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
 4265                         /* its IPv6 */
 4266                         struct ip6_hdr *ip6;
 4267                         struct sockaddr_in6 *sin6_2;
 4268 
 4269                         ip6 = mtod(m, struct ip6_hdr *);
 4270                         sin6_2 = (struct sockaddr_in6 *)(local_sa);
 4271                         memset(sin6_2, 0, sizeof(sin6));
 4272                         sin6_2->sin6_family = AF_INET6;
 4273                         sin6_2->sin6_len = sizeof(struct sockaddr_in6);
 4274                         sin6_2->sin6_port = sh->dest_port;
 4275                         sin6.sin6_addr = ip6->ip6_src;
 4276                         sa = (struct sockaddr *)&sin6;
 4277                 } else {
 4278                         sa = NULL;
 4279                 }
 4280         } else {
 4281                 /*
 4282                  * For cookies we use the src address NOT from the packet
 4283                  * but from the original INIT
 4284                  */
 4285                 sa = altsa;
 4286         }
 4287         /* Turn off ECN until we get through all params */
 4288         stcb->asoc.ecn_allowed = 0;
 4289 
 4290         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 4291                 /* mark all addresses that we have currently on the list */
 4292                 net->dest_state |= SCTP_ADDR_NOT_IN_ASSOC;
 4293         }
 4294         /* does the source address already exist? if so skip it */
 4295         l_inp = inp = stcb->sctp_ep;
 4296         stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net_tmp, local_sa, stcb);
 4297         if ((stcb_tmp == NULL && inp == stcb->sctp_ep) || inp == NULL) {
 4298                 /* we must add the source address */
 4299                 /* no scope set here since we have a tcb already. */
 4300                 if ((sa->sa_family == AF_INET) &&
 4301                     (stcb->asoc.ipv4_addr_legal)) {
 4302                         if (sctp_add_remote_addr(stcb, sa, 0, 2)) {
 4303                                 return (-1);
 4304                         }
 4305                 } else if ((sa->sa_family == AF_INET6) &&
 4306                     (stcb->asoc.ipv6_addr_legal)) {
 4307                         if (sctp_add_remote_addr(stcb, sa, 0, 3)) {
 4308                                 return (-1);
 4309                         }
 4310                 }
 4311         } else {
 4312                 if (net_tmp != NULL && stcb_tmp == stcb) {
 4313                         net_tmp->dest_state &= ~SCTP_ADDR_NOT_IN_ASSOC;
 4314                 } else if (stcb_tmp != stcb) {
 4315                         /* It belongs to another association? */
 4316                         return (-1);
 4317                 }
 4318         }
 4319         /* since a unlock occured we must check the
 4320          * TCB's state and the pcb's gone flags.
 4321          */
 4322         if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
 4323                 /* the user freed the ep */
 4324                 return (-1);
 4325         }
 4326         if (stcb->asoc.state == 0) {
 4327                 /* the assoc was freed? */
 4328                 return (-1);
 4329         }
 4330 
 4331         /* now we must go through each of the params. */
 4332         phdr = sctp_get_next_param(m, offset, &parm_buf, sizeof(parm_buf));
 4333         while (phdr) {
 4334                 ptype = ntohs(phdr->param_type);
 4335                 plen = ntohs(phdr->param_length);
 4336                 /*kprintf("ptype => %d, plen => %d\n", ptype, plen);*/
 4337                 if (offset + plen > limit) {
 4338                         break;
 4339                 }
 4340                 if (plen == 0) {
 4341                         break;
 4342                 }
 4343                 if ((ptype == SCTP_IPV4_ADDRESS) &&
 4344                     (stcb->asoc.ipv4_addr_legal)) {
 4345                         struct sctp_ipv4addr_param *p4, p4_buf;
 4346                         /* ok get the v4 address and check/add */
 4347                         phdr = sctp_get_next_param(m, offset,
 4348                             (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf));
 4349                         if (plen != sizeof(struct sctp_ipv4addr_param) ||
 4350                             phdr == NULL) {
 4351                                 return (-1);
 4352                         }
 4353                         p4 = (struct sctp_ipv4addr_param *)phdr;
 4354                         sin.sin_addr.s_addr = p4->addr;
 4355                         sa = (struct sockaddr *)&sin;
 4356                         inp = stcb->sctp_ep;
 4357                         stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net,
 4358                             local_sa, stcb);
 4359 
 4360                         if ((stcb_tmp== NULL && inp == stcb->sctp_ep) ||
 4361                             inp == NULL) {
 4362                                 /* we must add the source address */
 4363                                 /* no scope set since we have a tcb already */
 4364 
 4365                                 /* we must validate the state again here */
 4366                                 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
 4367                                         /* the user freed the ep */
 4368                                         return (-1);
 4369                                 }
 4370                                 if (stcb->asoc.state == 0) {
 4371                                         /* the assoc was freed? */
 4372                                         return (-1);
 4373                                 }
 4374                                 if (sctp_add_remote_addr(stcb, sa, 0, 4)) {
 4375                                         return (-1);
 4376                                 }
 4377                         } else if (stcb_tmp == stcb) {
 4378                                 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
 4379                                         /* the user freed the ep */
 4380                                         return (-1);
 4381                                 }
 4382                                 if (stcb->asoc.state == 0) {
 4383                                         /* the assoc was freed? */
 4384                                         return (-1);
 4385                                 }
 4386                                 if (net != NULL) {
 4387                                         /* clear flag */
 4388                                         net->dest_state &=
 4389                                             ~SCTP_ADDR_NOT_IN_ASSOC;
 4390                                 }
 4391                         } else {
 4392                                 /* strange, address is in another assoc?
 4393                                  * straighten out locks.
 4394                                  */
 4395                                 SCTP_TCB_UNLOCK(stcb_tmp);
 4396                                 SCTP_INP_RLOCK(inp);
 4397                                 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
 4398                                         /* the user freed the ep */
 4399                                         SCTP_INP_RUNLOCK(l_inp);
 4400                                         return (-1);
 4401                                 }
 4402                                 if (stcb->asoc.state == 0) {
 4403                                         /* the assoc was freed? */
 4404                                         SCTP_INP_RUNLOCK(l_inp);
 4405                                         return (-1);
 4406                                 }
 4407                                 SCTP_TCB_LOCK(stcb);
 4408                                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
 4409                                 return (-1);
 4410                         }
 4411                 } else if ((ptype == SCTP_IPV6_ADDRESS) &&
 4412                     (stcb->asoc.ipv6_addr_legal)) {
 4413                         /* ok get the v6 address and check/add */
 4414                         struct sctp_ipv6addr_param *p6, p6_buf;
 4415                         phdr = sctp_get_next_param(m, offset,
 4416                             (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf));
 4417                         if (plen != sizeof(struct sctp_ipv6addr_param) ||
 4418                             phdr == NULL) {
 4419                                 return (-1);
 4420                         }
 4421                         p6 = (struct sctp_ipv6addr_param *)phdr;
 4422                         memcpy((caddr_t)&sin6.sin6_addr, p6->addr,
 4423                             sizeof(p6->addr));
 4424                         sa = (struct sockaddr *)&sin6;
 4425                         inp = stcb->sctp_ep;
 4426                         stcb_tmp= sctp_findassociation_ep_addr(&inp, sa, &net,
 4427                             local_sa, stcb);
 4428                         if (stcb_tmp == NULL && (inp == stcb->sctp_ep ||
 4429                             inp == NULL)) {
 4430                                 /* we must validate the state again here */
 4431                                 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
 4432                                         /* the user freed the ep */
 4433                                         return (-1);
 4434                                 }
 4435                                 if (stcb->asoc.state == 0) {
 4436                                         /* the assoc was freed? */
 4437                                         return (-1);
 4438                                 }
 4439                                 /* we must add the address, no scope set */
 4440                                 if (sctp_add_remote_addr(stcb, sa, 0, 5)) {
 4441                                         return (-1);
 4442                                 }
 4443                         } else if (stcb_tmp == stcb) {
 4444                                 /* we must validate the state again here */
 4445                                 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
 4446                                         /* the user freed the ep */
 4447                                         return (-1);
 4448                                 }
 4449                                 if (stcb->asoc.state == 0) {
 4450                                         /* the assoc was freed? */
 4451                                         return (-1);
 4452                                 }
 4453                                 if (net != NULL) {
 4454                                         /* clear flag */
 4455                                         net->dest_state &=
 4456                                             ~SCTP_ADDR_NOT_IN_ASSOC;
 4457                                 }
 4458                         } else {
 4459                                 /* strange, address is in another assoc?
 4460                                  * straighten out locks.
 4461                                  */
 4462                                 SCTP_TCB_UNLOCK(stcb_tmp);
 4463                                 SCTP_INP_RLOCK(l_inp);
 4464                                 /* we must validate the state again here */
 4465                                 if (l_inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE|SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
 4466                                         /* the user freed the ep */
 4467                                         SCTP_INP_RUNLOCK(l_inp);
 4468                                         return (-1);
 4469                                 }
 4470                                 if (stcb->asoc.state == 0) {
 4471                                         /* the assoc was freed? */
 4472                                         SCTP_INP_RUNLOCK(l_inp);
 4473                                         return (-1);
 4474                                 }
 4475                                 SCTP_TCB_LOCK(stcb);
 4476                                 SCTP_INP_RUNLOCK(l_inp);
 4477                                 return (-1);
 4478                         }
 4479                 } else if (ptype == SCTP_ECN_CAPABLE) {
 4480                         stcb->asoc.ecn_allowed = 1;
 4481                 } else if (ptype == SCTP_ULP_ADAPTION) {
 4482                         if (stcb->asoc.state != SCTP_STATE_OPEN) {
 4483                                 struct sctp_adaption_layer_indication ai, *aip;
 4484 
 4485                                 phdr = sctp_get_next_param(m, offset,
 4486                                                            (struct sctp_paramhdr *)&ai, sizeof(ai));
 4487                                 aip = (struct sctp_adaption_layer_indication *)phdr;
 4488                                 sctp_ulp_notify(SCTP_NOTIFY_ADAPTION_INDICATION,
 4489                                                 stcb, ntohl(aip->indication), NULL);
 4490                         }
 4491                 } else if (ptype == SCTP_SET_PRIM_ADDR) {
 4492                         struct sctp_asconf_addr_param lstore, *fee;
 4493                         struct sctp_asconf_addrv4_param *fii;
 4494                         int lptype;
 4495                         struct sockaddr *lsa = NULL;
 4496 
 4497                         stcb->asoc.peer_supports_asconf = 1;
 4498                         stcb->asoc.peer_supports_asconf_setprim = 1;
 4499                         if (plen > sizeof(lstore)) {
 4500                                 return (-1);
 4501                         }
 4502                         phdr = sctp_get_next_param(m, offset,
 4503                             (struct sctp_paramhdr *)&lstore, plen);
 4504                         if (phdr == NULL) {
 4505                                 return (-1);
 4506                         }
 4507 
 4508                         fee  = (struct sctp_asconf_addr_param *)phdr;
 4509                         lptype = ntohs(fee->addrp.ph.param_type);
 4510                         if (lptype == SCTP_IPV4_ADDRESS) {
 4511                                 if (plen !=
 4512                                     sizeof(struct sctp_asconf_addrv4_param)) {
 4513                                         kprintf("Sizeof setprim in init/init ack not %d but %d - ignored\n",
 4514                                            (int)sizeof(struct sctp_asconf_addrv4_param),
 4515                                            plen);
 4516                                 } else {
 4517                                         fii = (struct sctp_asconf_addrv4_param *)fee;
 4518                                         sin.sin_addr.s_addr = fii->addrp.addr;
 4519                                         lsa = (struct sockaddr *)&sin;
 4520                                 }
 4521                         } else if (lptype == SCTP_IPV6_ADDRESS) {
 4522                                 if (plen !=
 4523                                     sizeof(struct sctp_asconf_addr_param)) {
 4524                                         kprintf("Sizeof setprim (v6) in init/init ack not %d but %d - ignored\n",
 4525                                            (int)sizeof(struct sctp_asconf_addr_param),
 4526                                            plen);
 4527                                 } else {
 4528                                         memcpy(sin6.sin6_addr.s6_addr,
 4529                                             fee->addrp.addr,
 4530                                             sizeof(fee->addrp.addr));
 4531                                         lsa = (struct sockaddr *)&sin6;
 4532                                 }
 4533                         }
 4534                         if (lsa) {
 4535                                 sctp_set_primary_addr(stcb, sa, NULL);
 4536                         }
 4537 
 4538                 } else if (ptype == SCTP_PRSCTP_SUPPORTED) {
 4539                         /* Peer supports pr-sctp */
 4540                         stcb->asoc.peer_supports_prsctp = 1;
 4541                 } else if (ptype == SCTP_SUPPORTED_CHUNK_EXT) {
 4542                         /* A supported extension chunk */
 4543                         struct sctp_supported_chunk_types_param *pr_supported;
 4544                         uint8_t local_store[128];
 4545                         int num_ent, i;
 4546 
 4547                         phdr = sctp_get_next_param(m, offset,
 4548                             (struct sctp_paramhdr *)&local_store, plen);
 4549                         if (phdr == NULL) {
 4550                                 return (-1);
 4551                         }
 4552                         stcb->asoc.peer_supports_asconf = 0;
 4553                         stcb->asoc.peer_supports_asconf_setprim = 0;
 4554                         stcb->asoc.peer_supports_prsctp = 0;
 4555                         stcb->asoc.peer_supports_pktdrop = 0;
 4556                         stcb->asoc.peer_supports_strreset = 0;
 4557                         pr_supported = (struct sctp_supported_chunk_types_param *)phdr;
 4558                         num_ent = plen - sizeof(struct sctp_paramhdr);
 4559                         for (i=0; i<num_ent; i++) {
 4560                                 switch (pr_supported->chunk_types[i]) {
 4561                                 case SCTP_ASCONF:
 4562                                         stcb->asoc.peer_supports_asconf = 1;
 4563                                         stcb->asoc.peer_supports_asconf_setprim = 1;
 4564                                         break;
 4565                                 case SCTP_ASCONF_ACK:
 4566                                         stcb->asoc.peer_supports_asconf = 1;
 4567                                         stcb->asoc.peer_supports_asconf_setprim = 1;
 4568                                         break;
 4569                                 case SCTP_FORWARD_CUM_TSN:
 4570                                         stcb->asoc.peer_supports_prsctp = 1;
 4571                                         break;
 4572                                 case SCTP_PACKET_DROPPED:
 4573                                         stcb->asoc.peer_supports_pktdrop = 1;
 4574                                         break;
 4575                                 case SCTP_STREAM_RESET:
 4576                                         stcb->asoc.peer_supports_strreset = 1;
 4577                                         break;
 4578                                 default:
 4579                                         /* one I have not learned yet */
 4580                                         break;
 4581 
 4582                                 }
 4583                         }
 4584                 } else if (ptype == SCTP_ECN_NONCE_SUPPORTED) {
 4585                         /* Peer supports ECN-nonce */
 4586                         stcb->asoc.peer_supports_ecn_nonce = 1;
 4587                         stcb->asoc.ecn_nonce_allowed = 1;
 4588                 } else if ((ptype == SCTP_HEARTBEAT_INFO) ||
 4589                            (ptype == SCTP_STATE_COOKIE) ||
 4590                            (ptype == SCTP_UNRECOG_PARAM) ||
 4591                            (ptype == SCTP_COOKIE_PRESERVE) ||
 4592                            (ptype == SCTP_SUPPORTED_ADDRTYPE) ||
 4593                            (ptype == SCTP_ADD_IP_ADDRESS) ||
 4594                            (ptype == SCTP_DEL_IP_ADDRESS) ||
 4595                            (ptype == SCTP_ERROR_CAUSE_IND) ||
 4596                            (ptype == SCTP_SUCCESS_REPORT)) {
 4597                         /* don't care */;
 4598                 } else {
 4599                         if ((ptype & 0x8000) == 0x0000) {
 4600                                 /* must stop processing the rest of
 4601                                  * the param's. Any report bits were
 4602                                  * handled with the call to sctp_arethere_unrecognized_parameters()
 4603                                  * when the INIT or INIT-ACK was first seen.
 4604                                  */
 4605                                 break;
 4606                         }
 4607                 }
 4608                 offset += SCTP_SIZE32(plen);
 4609                 if (offset >= limit) {
 4610                         break;
 4611                 }
 4612                 phdr = sctp_get_next_param(m, offset, &parm_buf,
 4613                     sizeof(parm_buf));
 4614         }
 4615         /* Now check to see if we need to purge any addresses */
 4616         for (net = TAILQ_FIRST(&stcb->asoc.nets); net != NULL; net = net_tmp) {
 4617                 net_tmp = TAILQ_NEXT(net, sctp_next);
 4618                 if ((net->dest_state & SCTP_ADDR_NOT_IN_ASSOC) ==
 4619                     SCTP_ADDR_NOT_IN_ASSOC) {
 4620                         /* This address has been removed from the asoc */
 4621                         /* remove and free it */
 4622                         stcb->asoc.numnets--;
 4623                         TAILQ_REMOVE(&stcb->asoc.nets, net, sctp_next);
 4624                         sctp_free_remote_addr(net);
 4625                         if (net == stcb->asoc.primary_destination) {
 4626                                 stcb->asoc.primary_destination = NULL;
 4627                                 sctp_select_primary_destination(stcb);
 4628                         }
 4629                 }
 4630         }
 4631         return (0);
 4632 }
 4633 
 4634 int
 4635 sctp_set_primary_addr(struct sctp_tcb *stcb, struct sockaddr *sa,
 4636     struct sctp_nets *net)
 4637 {
 4638         /* make sure the requested primary address exists in the assoc */
 4639         if (net == NULL && sa)
 4640                 net = sctp_findnet(stcb, sa);
 4641 
 4642         if (net == NULL) {
 4643                 /* didn't find the requested primary address! */
 4644                 return (-1);
 4645         } else {
 4646                 /* set the primary address */
 4647                 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {
 4648                         /* Must be confirmed */
 4649                         return (-1);
 4650                 }
 4651                 stcb->asoc.primary_destination = net;
 4652                 net->dest_state &= ~SCTP_ADDR_WAS_PRIMARY;
 4653                 return (0);
 4654         }
 4655 }
 4656 
 4657 
 4658 int
 4659 sctp_is_vtag_good(struct sctp_inpcb *inp, u_int32_t tag, struct timeval *now)
 4660 {
 4661         /*
 4662          * This function serves two purposes. It will see if a TAG can be
 4663          * re-used and return 1 for yes it is ok and 0 for don't use that
 4664          * tag.
 4665          * A secondary function it will do is purge out old tags that can
 4666          * be removed.
 4667          */
 4668         struct sctpasochead *head;
 4669         struct sctpvtaghead *chain;
 4670         struct sctp_tagblock *twait_block;
 4671         struct sctp_tcb *stcb;
 4672 
 4673         int i;
 4674         SCTP_INP_INFO_WLOCK();
 4675         chain = &sctppcbinfo.vtag_timewait[(tag % SCTP_STACK_VTAG_HASH_SIZE)];
 4676         /* First is the vtag in use ? */
 4677 
 4678         head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(tag,
 4679             sctppcbinfo.hashasocmark)];
 4680         if (head == NULL) {
 4681                 SCTP_INP_INFO_WUNLOCK();
 4682                 return (0);
 4683         }
 4684         LIST_FOREACH(stcb, head, sctp_asocs) {
 4685                 if (stcb->asoc.my_vtag == tag) {
 4686                         /* We should remove this if and
 4687                          * return 0 always if we want vtags
 4688                          * unique across all endpoints. For
 4689                          * now within a endpoint is ok.
 4690                          */
 4691                         if (inp == stcb->sctp_ep) {
 4692                                 /* bad tag, in use */
 4693                                 SCTP_INP_INFO_WUNLOCK();
 4694                                 return (0);
 4695                         }
 4696                 }
 4697         }
 4698         if (!LIST_EMPTY(chain)) {
 4699                 /*
 4700                  * Block(s) are present, lets see if we have this tag in
 4701                  * the list
 4702                  */
 4703                 LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) {
 4704                         for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) {
 4705                                 if (twait_block->vtag_block[i].v_tag == 0) {
 4706                                         /* not used */
 4707                                         continue;
 4708                                 } else if ((long)twait_block->vtag_block[i].tv_sec_at_expire >
 4709                                     now->tv_sec) {
 4710                                         /* Audit expires this guy */
 4711                                         twait_block->vtag_block[i].tv_sec_at_expire = 0;
 4712                                         twait_block->vtag_block[i].v_tag = 0;
 4713                                 } else if (twait_block->vtag_block[i].v_tag ==
 4714                                     tag) {
 4715                                         /* Bad tag, sorry :< */
 4716                                         SCTP_INP_INFO_WUNLOCK();
 4717                                         return (0);
 4718                                 }
 4719                         }
 4720                 }
 4721         }
 4722         /* Not found, ok to use the tag */
 4723         SCTP_INP_INFO_WUNLOCK();
 4724         return (1);
 4725 }
 4726 
 4727 
 4728 /*
 4729  * Delete the address from the endpoint local address list
 4730  * Lookup using a sockaddr address (ie. not an ifaddr)
 4731  */
 4732 int
 4733 sctp_del_local_addr_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa)
 4734 {
 4735         struct sctp_laddr *laddr;
 4736         struct sockaddr *l_sa;
 4737         int found = 0;
 4738         /* Here is another function I cannot find a
 4739          * caller for. As such we SHOULD delete it
 4740          * if we have no users. If we find a user that
 4741          * user MUST have the INP locked.
 4742          *
 4743          */
 4744 
 4745         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
 4746                 /* You are already bound to all. You have it already */
 4747                 return (EINVAL);
 4748         }
 4749 
 4750         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
 4751                 /* make sure the address exists */
 4752                 if (laddr->ifa == NULL)
 4753                         continue;
 4754                 if (laddr->ifa->ifa_addr == NULL)
 4755                         continue;
 4756 
 4757                 l_sa = laddr->ifa->ifa_addr;
 4758                 if (l_sa->sa_family == AF_INET6) {
 4759                         /* IPv6 address */
 4760                         struct sockaddr_in6 *sin1, *sin2;
 4761                         sin1 = (struct sockaddr_in6 *)l_sa;
 4762                         sin2 = (struct sockaddr_in6 *)sa;
 4763                         if (memcmp(&sin1->sin6_addr, &sin2->sin6_addr,
 4764                             sizeof(struct in6_addr)) == 0) {
 4765                                 /* matched */
 4766                                 found = 1;
 4767                                 break;
 4768                         }
 4769                 } else if (l_sa->sa_family == AF_INET) {
 4770                         /* IPv4 address */
 4771                         struct sockaddr_in *sin1, *sin2;
 4772                         sin1 = (struct sockaddr_in *)l_sa;
 4773                         sin2 = (struct sockaddr_in *)sa;
 4774                         if (sin1->sin_addr.s_addr == sin2->sin_addr.s_addr) {
 4775                                 /* matched */
 4776                                 found = 1;
 4777                                 break;
 4778                         }
 4779                 } else {
 4780                         /* invalid family */
 4781                         return (-1);
 4782                 }
 4783         }
 4784 
 4785         if (found && inp->laddr_count < 2) {
 4786                 /* can't delete unless there are at LEAST 2 addresses */
 4787                 return (-1);
 4788         }
 4789 
 4790         if (found && (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
 4791                 /*
 4792                  * remove it from the ep list, this should NOT be
 4793                  * done until its really gone from the interface list and
 4794                  * we won't be receiving more of these. Probably right
 4795                  * away. If we do allow a removal of an address from
 4796                  * an association (sub-set bind) than this should NOT
 4797                  * be called until the all ASCONF come back from this
 4798                  * association.
 4799                  */
 4800                 sctp_remove_laddr(laddr);
 4801                 return (0);
 4802         } else {
 4803                 return (-1);
 4804         }
 4805 }
 4806 
 4807 static void
 4808 sctp_drain_mbufs(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
 4809 {
 4810         /*
 4811          * We must hunt this association for MBUF's past the cumack
 4812          * (i.e. out of order data that we can renege on).
 4813          */
 4814         struct sctp_association *asoc;
 4815         struct sctp_tmit_chunk *chk, *nchk;
 4816         u_int32_t cumulative_tsn_p1, tsn;
 4817         int cnt, strmat, gap;
 4818         /* We look for anything larger than the cum-ack + 1 */
 4819 
 4820         asoc = &stcb->asoc;
 4821         cumulative_tsn_p1 = asoc->cumulative_tsn + 1;
 4822         cnt = 0;
 4823         /* First look in the re-assembly queue */
 4824         chk = TAILQ_FIRST(&asoc->reasmqueue);
 4825         while (chk) {
 4826                 /* Get the next one */
 4827                 nchk = TAILQ_NEXT(chk, sctp_next);
 4828                 if (compare_with_wrap(chk->rec.data.TSN_seq,
 4829                     cumulative_tsn_p1, MAX_TSN)) {
 4830                         /* Yep it is above cum-ack */
 4831                         cnt++;
 4832                         tsn = chk->rec.data.TSN_seq;
 4833                         if (tsn >= asoc->mapping_array_base_tsn) {
 4834                                 gap  = tsn - asoc->mapping_array_base_tsn;
 4835                         } else {
 4836                                 gap = (MAX_TSN - asoc->mapping_array_base_tsn) +
 4837                                     tsn + 1;
 4838                         }
 4839                         asoc->size_on_reasm_queue -= chk->send_size;
 4840                         asoc->cnt_on_reasm_queue--;
 4841                         SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap);
 4842                         TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
 4843                         if (chk->data) {
 4844                                 sctp_m_freem(chk->data);
 4845                                 chk->data = NULL;
 4846                         }
 4847                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
 4848                         sctppcbinfo.ipi_count_chunk--;
 4849                         if ((int)sctppcbinfo.ipi_count_chunk < 0) {
 4850                                 panic("Chunk count is negative");
 4851                         }
 4852                         sctppcbinfo.ipi_gencnt_chunk++;
 4853                 }
 4854                 chk = nchk;
 4855         }
 4856         /* Ok that was fun, now we will drain all the inbound streams? */
 4857         for (strmat = 0; strmat < asoc->streamincnt; strmat++) {
 4858                 chk = TAILQ_FIRST(&asoc->strmin[strmat].inqueue);
 4859                 while (chk) {
 4860                         nchk = TAILQ_NEXT(chk, sctp_next);
 4861                         if (compare_with_wrap(chk->rec.data.TSN_seq,
 4862                             cumulative_tsn_p1, MAX_TSN)) {
 4863                                 /* Yep it is above cum-ack */
 4864                                 cnt++;
 4865                                 tsn = chk->rec.data.TSN_seq;
 4866                                 if (tsn >= asoc->mapping_array_base_tsn) {
 4867                                         gap = tsn -
 4868                                             asoc->mapping_array_base_tsn;
 4869                                 } else {
 4870                                         gap = (MAX_TSN -
 4871                                             asoc->mapping_array_base_tsn) +
 4872                                             tsn + 1;
 4873                                 }
 4874                                 asoc->size_on_all_streams -= chk->send_size;
 4875                                 asoc->cnt_on_all_streams--;
 4876 
 4877                                 SCTP_UNSET_TSN_PRESENT(asoc->mapping_array,
 4878                                     gap);
 4879                                 TAILQ_REMOVE(&asoc->strmin[strmat].inqueue,
 4880                                     chk, sctp_next);
 4881                                 if (chk->data) {
 4882                                         sctp_m_freem(chk->data);
 4883                                         chk->data = NULL;
 4884                                 }
 4885                                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
 4886                                 sctppcbinfo.ipi_count_chunk--;
 4887                                 if ((int)sctppcbinfo.ipi_count_chunk < 0) {
 4888                                         panic("Chunk count is negative");
 4889                                 }
 4890                                 sctppcbinfo.ipi_gencnt_chunk++;
 4891                         }
 4892                         chk = nchk;
 4893                 }
 4894         }
 4895         /*
 4896          * Question, should we go through the delivery queue?
 4897          * The only reason things are on here is the app not reading OR a
 4898          * p-d-api up. An attacker COULD send enough in to initiate the
 4899          * PD-API and then send a bunch of stuff to other streams... these
 4900          * would wind up on the delivery queue.. and then we would not get
 4901          * to them. But in order to do this I then have to back-track and
 4902          * un-deliver sequence numbers in streams.. el-yucko. I think for
 4903          * now we will NOT look at the delivery queue and leave it to be
 4904          * something to consider later. An alternative would be to abort
 4905          * the P-D-API with a notification and then deliver the data....
 4906          * Or another method might be to keep track of how many times the
 4907          * situation occurs and if we see a possible attack underway just
 4908          * abort the association.
 4909          */
 4910 #ifdef SCTP_DEBUG
 4911         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 4912                 if (cnt) {
 4913                         kprintf("Freed %d chunks from reneg harvest\n", cnt);
 4914                 }
 4915         }
 4916 #endif /* SCTP_DEBUG */
 4917 
 4918         /*
 4919          * Another issue, in un-setting the TSN's in the mapping array we
 4920          * DID NOT adjust the higest_tsn marker.  This will cause one of
 4921          * two things to occur. It may cause us to do extra work in checking
 4922          * for our mapping array movement. More importantly it may cause us
 4923          * to SACK every datagram. This may not be a bad thing though since
 4924          * we will recover once we get our cum-ack above and all this stuff
 4925          * we dumped recovered.
 4926          */
 4927 }
 4928 
 4929 void
 4930 sctp_drain(void)
 4931 {
 4932         /*
 4933          * We must walk the PCB lists for ALL associations here. The system
 4934          * is LOW on MBUF's and needs help. This is where reneging will
 4935          * occur. We really hope this does NOT happen!
 4936          */
 4937         struct sctp_inpcb *inp;
 4938         struct sctp_tcb *stcb;
 4939 
 4940         SCTP_INP_INFO_RLOCK();
 4941         LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) {
 4942                 /* For each endpoint */
 4943                 SCTP_INP_RLOCK(inp);
 4944                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
 4945                         /* For each association */
 4946                         SCTP_TCB_LOCK(stcb);
 4947                         sctp_drain_mbufs(inp, stcb);
 4948                         SCTP_TCB_UNLOCK(stcb);
 4949                 }
 4950                 SCTP_INP_RUNLOCK(inp);
 4951         }
 4952         SCTP_INP_INFO_RUNLOCK();
 4953 }
 4954 
 4955 int
 4956 sctp_add_to_socket_q(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
 4957 {
 4958         struct sctp_socket_q_list *sq;
 4959 
 4960         /* write lock on INP assumed */
 4961         if ((inp == NULL) || (stcb == NULL)) {
 4962                 /* I am paranoid */
 4963                 return (0);
 4964         }
 4965         sq = (struct sctp_socket_q_list *)SCTP_ZONE_GET(
 4966             sctppcbinfo.ipi_zone_sockq);
 4967         if (sq == NULL) {
 4968                 /* out of sq structs */
 4969                 return (0);
 4970         }
 4971         sctppcbinfo.ipi_count_sockq++;
 4972         sctppcbinfo.ipi_gencnt_sockq++;
 4973         if (stcb)
 4974                 stcb->asoc.cnt_msg_on_sb++;
 4975         sq->tcb = stcb;
 4976         TAILQ_INSERT_TAIL(&inp->sctp_queue_list, sq, next_sq);
 4977         return (1);
 4978 }
 4979 
 4980 
 4981 struct sctp_tcb *
 4982 sctp_remove_from_socket_q(struct sctp_inpcb *inp)
 4983 {
 4984         struct sctp_tcb *stcb = NULL;
 4985         struct sctp_socket_q_list *sq;
 4986 
 4987         /* W-Lock on INP assumed held */
 4988         sq = TAILQ_FIRST(&inp->sctp_queue_list);
 4989         if (sq == NULL)
 4990                 return (NULL);
 4991 
 4992         stcb = sq->tcb;
 4993         TAILQ_REMOVE(&inp->sctp_queue_list, sq, next_sq);
 4994         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_sockq, sq);
 4995         sctppcbinfo.ipi_count_sockq--;
 4996         sctppcbinfo.ipi_gencnt_sockq++;
 4997         if (stcb) {
 4998                 stcb->asoc.cnt_msg_on_sb--;
 4999         }
 5000         return (stcb);
 5001 }
 5002 
 5003 int
 5004 sctp_initiate_iterator(asoc_func af, uint32_t pcb_state, uint32_t asoc_state,
 5005                        void *argp, uint32_t argi, end_func ef,
 5006                        struct sctp_inpcb *s_inp)
 5007 {
 5008         struct sctp_iterator *it=NULL;
 5009 
 5010         if (af == NULL) {
 5011                 return (-1);
 5012         }
 5013         it = kmalloc(sizeof(struct sctp_iterator), M_PCB, M_WAITOK);
 5014         memset(it, 0, sizeof(*it));
 5015         it->function_toapply = af;
 5016         it->function_atend = ef;
 5017         it->pointer = argp;
 5018         it->val = argi;
 5019         it->pcb_flags = pcb_state;
 5020         it->asoc_state = asoc_state;
 5021         if (s_inp) {
 5022                 it->inp = s_inp;
 5023                 it->iterator_flags = SCTP_ITERATOR_DO_SINGLE_INP;
 5024         } else {
 5025                 SCTP_INP_INFO_RLOCK();
 5026                 it->inp = LIST_FIRST(&sctppcbinfo.listhead);
 5027                 SCTP_INP_INFO_RUNLOCK();
 5028                 it->iterator_flags = SCTP_ITERATOR_DO_ALL_INP;
 5029 
 5030         }
 5031         /* Init the timer */
 5032 #if defined(__FreeBSD__) && __FreeBSD_version >= 500000
 5033         callout_init(&it->tmr.timer, 0);
 5034 #else
 5035         callout_init(&it->tmr.timer);
 5036 #endif
 5037         /* add to the list of all iterators */
 5038         SCTP_INP_INFO_WLOCK();
 5039         LIST_INSERT_HEAD(&sctppcbinfo.iteratorhead, it, sctp_nxt_itr);
 5040         SCTP_INP_INFO_WUNLOCK();
 5041         sctp_iterator_timer(it);
 5042         return (0);
 5043 }
 5044 
 5045 
 5046 /*
 5047  * Callout/Timer routines for OS that doesn't have them
 5048  */
 5049 #ifdef _SCTP_NEEDS_CALLOUT_
 5050 #ifndef __APPLE__
 5051 extern int ticks;
 5052 #endif
 5053 
 5054 void
 5055 callout_init(struct callout *c)
 5056 {
 5057         bzero(c, sizeof(*c));
 5058 }
 5059 
 5060 void
 5061 callout_reset(struct callout *c, int to_ticks, void (*ftn)(void *), void *arg)
 5062 {
 5063         if (c->c_flags & CALLOUT_PENDING)
 5064                 callout_stop(c);
 5065 
 5066         /*
 5067          * We could spl down here and back up at the TAILQ_INSERT_TAIL,
 5068          * but there's no point since doing this setup doesn't take much
 5069          * time.
 5070          */
 5071         if (to_ticks <= 0)
 5072                 to_ticks = 1;
 5073 
 5074         c->c_arg = arg;
 5075         c->c_flags = (CALLOUT_ACTIVE | CALLOUT_PENDING);
 5076         c->c_func = ftn;
 5077 #ifdef __APPLE__
 5078         c->c_time = to_ticks;   /* just store the requested timeout */
 5079         timeout(ftn, arg, to_ticks);
 5080 #else
 5081         c->c_time = ticks + to_ticks;
 5082         TAILQ_INSERT_TAIL(&sctppcbinfo.callqueue, c, tqe);
 5083 #endif
 5084 }
 5085 
 5086 int
 5087 callout_stop(struct callout *c)
 5088 {
 5089         /*
 5090          * Don't attempt to delete a callout that's not on the queue.
 5091          */
 5092         if (!(c->c_flags & CALLOUT_PENDING)) {
 5093                 c->c_flags &= ~CALLOUT_ACTIVE;
 5094                 return (0);
 5095         }
 5096         c->c_flags &= ~(CALLOUT_ACTIVE | CALLOUT_PENDING| CALLOUT_FIRED);
 5097 #ifdef __APPLE__
 5098 /*      thread_call_cancel(c->c_call); */
 5099         untimeout(c->c_func, c->c_arg);
 5100 #else
 5101         TAILQ_REMOVE(&sctppcbinfo.callqueue, c, tqe);
 5102         c->c_func = NULL;
 5103 #endif
 5104         return (1);
 5105 }
 5106 
 5107 #if !defined(__APPLE__)
 5108 void
 5109 sctp_fasttim(void)
 5110 {
 5111         struct callout *c, *n;
 5112         struct calloutlist locallist;
 5113         int inited = 0;
 5114 
 5115         /* run through and subtract and mark all callouts */
 5116         c = TAILQ_FIRST(&sctppcbinfo.callqueue);
 5117         while (c) {
 5118                 n = TAILQ_NEXT(c, tqe);
 5119                 if (c->c_time <= ticks) {
 5120                         c->c_flags |= CALLOUT_FIRED;
 5121                         c->c_time = 0;
 5122                         TAILQ_REMOVE(&sctppcbinfo.callqueue, c, tqe);
 5123                         if (inited == 0) {
 5124                                 TAILQ_INIT(&locallist);
 5125                                 inited = 1;
 5126                         }
 5127                         /* move off of main list */
 5128                         TAILQ_INSERT_TAIL(&locallist, c, tqe);
 5129                 }
 5130                 c = n;
 5131         }
 5132         /* Now all the ones on the locallist must be called */
 5133         if (inited) {
 5134                 c = TAILQ_FIRST(&locallist);
 5135                 while (c) {
 5136                         /* remove it */
 5137                         TAILQ_REMOVE(&locallist, c, tqe);
 5138                         /* now validate that it did not get canceled */
 5139                         if (c->c_flags & CALLOUT_FIRED) {
 5140                                 c->c_flags &= ~CALLOUT_PENDING;
 5141                                 (*c->c_func)(c->c_arg);
 5142                         }
 5143                         c = TAILQ_FIRST(&locallist);
 5144                 }
 5145         }
 5146 }
 5147 #endif
 5148 #endif /* _SCTP_NEEDS_CALLOUT_ */
Cache object: af17701de848210146209ed13d888b69
[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]
This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.
FreeBSD/Linux Kernel Cross Reference sys/netinet/sctp_pcb.c

FreeBSD/Linux Kernel Cross Reference
sys/netinet/sctp_pcb.c
