sys/netinet/sctp_pcb.c

   1 /*-
   2  * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions are met:
   6  *
   7  * a) Redistributions of source code must retain the above copyright notice,
   8  *   this list of conditions and the following disclaimer.
   9  *
  10  * b) Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in
  12  *   the documentation and/or other materials provided with the distribution.
  13  *
  14  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  15  *    contributors may be used to endorse or promote products derived
  16  *    from this software without specific prior written permission.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  20  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  22  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  28  * THE POSSIBILITY OF SUCH DAMAGE.
  29  */
  30
  31 /* $KAME: sctp_pcb.c,v 1.38 2005/03/06 16:04:18 itojun Exp $     */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35 #include "opt_ipsec.h"
  36 #include "opt_compat.h"
  37 #include "opt_inet6.h"
  38 #include "opt_inet.h"
  39 #include "opt_sctp.h"
  40
  41 #include <sys/param.h>
  42 #include <sys/systm.h>
  43 #include <sys/malloc.h>
  44 #include <sys/mbuf.h>
  45 #include <sys/domain.h>
  46 #include <sys/protosw.h>
  47 #include <sys/socket.h>
  48 #include <sys/socketvar.h>
  49 #include <sys/priv.h>
  50 #include <sys/proc.h>
  51 #include <sys/kernel.h>
  52 #include <sys/sysctl.h>
  53
  54 #include <sys/limits.h>
  55 #include <machine/cpu.h>
  56
  57 #include <net/if.h>
  58 #include <net/if_types.h>
  59 #include <net/route.h>
  60 #include <netinet/in.h>
  61 #include <netinet/in_systm.h>
  62 #include <netinet/ip.h>
  63 #include <netinet/in_pcb.h>
  64 #include <netinet/in_var.h>
  65 #include <netinet/ip_var.h>
  66
  67 #ifdef INET6
  68 #include <netinet/ip6.h>
  69 #include <netinet6/ip6_var.h>
  70 #include <netinet6/scope6_var.h>
  71 #include <netinet6/in6_pcb.h>
  72 #endif                          /* INET6 */
  73
  74 #ifdef IPSEC
  75 #include <netinet6/ipsec.h>
  76 #include <netkey/key.h>
  77 #endif                          /* IPSEC */
  78
  79 #include <netinet/sctp_os.h>
  80 #include <netinet/sctp_var.h>
  81 #include <netinet/sctp_pcb.h>
  82 #include <netinet/sctputil.h>
  83 #include <netinet/sctp.h>
  84 #include <netinet/sctp_header.h>
  85 #include <netinet/sctp_asconf.h>
  86 #include <netinet/sctp_output.h>
  87 #include <netinet/sctp_timer.h>
  88
  89
  90 #ifdef SCTP_DEBUG
  91 uint32_t sctp_debug_on = 0;
  92
  93 #endif                          /* SCTP_DEBUG */
  94
  95
  96 extern int sctp_pcbtblsize;
  97 extern int sctp_hashtblsize;
  98 extern int sctp_chunkscale;
  99
 100 struct sctp_epinfo sctppcbinfo;
 101
 102 /* FIX: we don't handle multiple link local scopes */
 103 /* "scopeless" replacement IN6_ARE_ADDR_EQUAL */
 104 int
 105 SCTP6_ARE_ADDR_EQUAL(struct in6_addr *a, struct in6_addr *b)
 106 {
 107         struct in6_addr tmp_a, tmp_b;
 108
 109         /* use a copy of a and b */
 110         tmp_a = *a;
 111         tmp_b = *b;
 112         in6_clearscope(&tmp_a);
 113         in6_clearscope(&tmp_b);
 114         return (IN6_ARE_ADDR_EQUAL(&tmp_a, &tmp_b));
 115 }
 116
 117
 118 void
 119 sctp_fill_pcbinfo(struct sctp_pcbinfo *spcb)
 120 {
 121         /*
 122          * We really don't need to lock this, but I will just because it
 123          * does not hurt.
 124          */
 125         SCTP_INP_INFO_RLOCK();
 126         spcb->ep_count = sctppcbinfo.ipi_count_ep;
 127         spcb->asoc_count = sctppcbinfo.ipi_count_asoc;
 128         spcb->laddr_count = sctppcbinfo.ipi_count_laddr;
 129         spcb->raddr_count = sctppcbinfo.ipi_count_raddr;
 130         spcb->chk_count = sctppcbinfo.ipi_count_chunk;
 131         spcb->readq_count = sctppcbinfo.ipi_count_readq;
 132         spcb->stream_oque = sctppcbinfo.ipi_count_strmoq;
 133         spcb->free_chunks = sctppcbinfo.ipi_free_chunks;
 134
 135         SCTP_INP_INFO_RUNLOCK();
 136 }
 137
 138
 139 /*
 140  * Notes on locks for FreeBSD 5 and up. All association lookups that have a
 141  * definte ep, the INP structure is assumed to be locked for reading. If we
 142  * need to go find the INP (ususally when a **inp is passed) then we must
 143  * lock the INFO structure first and if needed lock the INP too. Note that if
 144  * we lock it we must
 145  *
 146  */
 147
 148
 149 /*
 150  * Given a endpoint, look and find in its association list any association
 151  * with the "to" address given. This can be a "from" address, too, for
 152  * inbound packets. For outbound packets it is a true "to" address.
 153  */
 154
 155 static struct sctp_tcb *
 156 sctp_tcb_special_locate(struct sctp_inpcb **inp_p, struct sockaddr *from,
 157     struct sockaddr *to, struct sctp_nets **netp)
 158 {
 159         /**** ASSUMSES THE CALLER holds the INP_INFO_RLOCK */
 160
 161         /*
 162          * Note for this module care must be taken when observing what to is
 163          * for. In most of the rest of the code the TO field represents my
 164          * peer and the FROM field represents my address. For this module it
 165          * is reversed of that.
 166          */
 167         /*
 168          * If we support the TCP model, then we must now dig through to see
 169          * if we can find our endpoint in the list of tcp ep's.
 170          */
 171         uint16_t lport, rport;
 172         struct sctppcbhead *ephead;
 173         struct sctp_inpcb *inp;
 174         struct sctp_laddr *laddr;
 175         struct sctp_tcb *stcb;
 176         struct sctp_nets *net;
 177
 178         if ((to == NULL) || (from == NULL)) {
 179                 return (NULL);
 180         }
 181         if (to->sa_family == AF_INET && from->sa_family == AF_INET) {
 182                 lport = ((struct sockaddr_in *)to)->sin_port;
 183                 rport = ((struct sockaddr_in *)from)->sin_port;
 184         } else if (to->sa_family == AF_INET6 && from->sa_family == AF_INET6) {
 185                 lport = ((struct sockaddr_in6 *)to)->sin6_port;
 186                 rport = ((struct sockaddr_in6 *)from)->sin6_port;
 187         } else {
 188                 return NULL;
 189         }
 190         ephead = &sctppcbinfo.sctp_tcpephash[SCTP_PCBHASH_ALLADDR(
 191             (lport + rport), sctppcbinfo.hashtcpmark)];
 192         /*
 193          * Ok now for each of the guys in this bucket we must look and see:
 194          * - Does the remote port match. - Does there single association's
 195          * addresses match this address (to). If so we update p_ep to point
 196          * to this ep and return the tcb from it.
 197          */
 198         LIST_FOREACH(inp, ephead, sctp_hash) {
 199                 if (lport != inp->sctp_lport) {
 200                         continue;
 201                 }
 202                 SCTP_INP_RLOCK(inp);
 203                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
 204                         SCTP_INP_RUNLOCK(inp);
 205                         continue;
 206                 }
 207                 /* check to see if the ep has one of the addresses */
 208                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
 209                         /* We are NOT bound all, so look further */
 210                         int match = 0;
 211
 212                         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
 213
 214                                 if (laddr->ifa == NULL) {
 215 #ifdef SCTP_DEBUG
 216                                         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 217                                                 printf("An ounce of prevention is worth a pound of cure\n");
 218                                         }
 219 #endif
 220                                         continue;
 221                                 }
 222                                 if (laddr->ifa->ifa_addr == NULL) {
 223 #ifdef SCTP_DEBUG
 224                                         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 225                                                 printf("ifa with a NULL address\n");
 226                                         }
 227 #endif
 228                                         continue;
 229                                 }
 230                                 if (laddr->ifa->ifa_addr->sa_family ==
 231                                     to->sa_family) {
 232                                         /* see if it matches */
 233                                         struct sockaddr_in *intf_addr, *sin;
 234
 235                                         intf_addr = (struct sockaddr_in *)
 236                                             laddr->ifa->ifa_addr;
 237                                         sin = (struct sockaddr_in *)to;
 238                                         if (from->sa_family == AF_INET) {
 239                                                 if (sin->sin_addr.s_addr ==
 240                                                     intf_addr->sin_addr.s_addr) {
 241                                                         match = 1;
 242                                                         break;
 243                                                 }
 244                                         } else {
 245                                                 struct sockaddr_in6 *intf_addr6;
 246                                                 struct sockaddr_in6 *sin6;
 247
 248                                                 sin6 = (struct sockaddr_in6 *)
 249                                                     to;
 250                                                 intf_addr6 = (struct sockaddr_in6 *)
 251                                                     laddr->ifa->ifa_addr;
 252
 253                                                 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
 254                                                     &intf_addr6->sin6_addr)) {
 255                                                         match = 1;
 256                                                         break;
 257                                                 }
 258                                         }
 259                                 }
 260                         }
 261                         if (match == 0) {
 262                                 /* This endpoint does not have this address */
 263                                 SCTP_INP_RUNLOCK(inp);
 264                                 continue;
 265                         }
 266                 }
 267                 /*
 268                  * Ok if we hit here the ep has the address, does it hold
 269                  * the tcb?
 270                  */
 271
 272                 stcb = LIST_FIRST(&inp->sctp_asoc_list);
 273                 if (stcb == NULL) {
 274                         SCTP_INP_RUNLOCK(inp);
 275                         continue;
 276                 }
 277                 SCTP_TCB_LOCK(stcb);
 278                 if (stcb->rport != rport) {
 279                         /* remote port does not match. */
 280                         SCTP_TCB_UNLOCK(stcb);
 281                         SCTP_INP_RUNLOCK(inp);
 282                         continue;
 283                 }
 284                 /* Does this TCB have a matching address? */
 285                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 286
 287                         if (net->ro._l_addr.sa.sa_family != from->sa_family) {
 288                                 /* not the same family, can't be a match */
 289                                 continue;
 290                         }
 291                         if (from->sa_family == AF_INET) {
 292                                 struct sockaddr_in *sin, *rsin;
 293
 294                                 sin = (struct sockaddr_in *)&net->ro._l_addr;
 295                                 rsin = (struct sockaddr_in *)from;
 296                                 if (sin->sin_addr.s_addr ==
 297                                     rsin->sin_addr.s_addr) {
 298                                         /* found it */
 299                                         if (netp != NULL) {
 300                                                 *netp = net;
 301                                         }
 302                                         /* Update the endpoint pointer */
 303                                         *inp_p = inp;
 304                                         SCTP_INP_RUNLOCK(inp);
 305                                         return (stcb);
 306                                 }
 307                         } else {
 308                                 struct sockaddr_in6 *sin6, *rsin6;
 309
 310                                 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
 311                                 rsin6 = (struct sockaddr_in6 *)from;
 312                                 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
 313                                     &rsin6->sin6_addr)) {
 314                                         /* found it */
 315                                         if (netp != NULL) {
 316                                                 *netp = net;
 317                                         }
 318                                         /* Update the endpoint pointer */
 319                                         *inp_p = inp;
 320                                         SCTP_INP_RUNLOCK(inp);
 321                                         return (stcb);
 322                                 }
 323                         }
 324                 }
 325                 SCTP_TCB_UNLOCK(stcb);
 326                 SCTP_INP_RUNLOCK(inp);
 327         }
 328         return (NULL);
 329 }
 330
 331 /*
 332  * rules for use
 333  *
 334  * 1) If I return a NULL you must decrement any INP ref cnt. 2) If I find an
 335  * stcb, both will be locked (locked_tcb and stcb) but decrement will be done
 336  * (if locked == NULL). 3) Decrement happens on return ONLY if locked ==
 337  * NULL.
 338  */
 339
 340 struct sctp_tcb *
 341 sctp_findassociation_ep_addr(struct sctp_inpcb **inp_p, struct sockaddr *remote,
 342     struct sctp_nets **netp, struct sockaddr *local, struct sctp_tcb *locked_tcb)
 343 {
 344         struct sctpasochead *head;
 345         struct sctp_inpcb *inp;
 346         struct sctp_tcb *stcb;
 347         struct sctp_nets *net;
 348         uint16_t rport;
 349
 350         inp = *inp_p;
 351         if (remote->sa_family == AF_INET) {
 352                 rport = (((struct sockaddr_in *)remote)->sin_port);
 353         } else if (remote->sa_family == AF_INET6) {
 354                 rport = (((struct sockaddr_in6 *)remote)->sin6_port);
 355         } else {
 356                 return (NULL);
 357         }
 358         if (locked_tcb) {
 359                 /*
 360                  * UN-lock so we can do proper locking here this occurs when
 361                  * called from load_addresses_from_init.
 362                  */
 363                 SCTP_TCB_UNLOCK(locked_tcb);
 364         }
 365         SCTP_INP_INFO_RLOCK();
 366         if (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
 367                 /*
 368                  * Now either this guy is our listener or it's the
 369                  * connector. If it is the one that issued the connect, then
 370                  * it's only chance is to be the first TCB in the list. If
 371                  * it is the acceptor, then do the special_lookup to hash
 372                  * and find the real inp.
 373                  */
 374                 if ((inp->sctp_socket) && (inp->sctp_socket->so_qlimit)) {
 375                         /* to is peer addr, from is my addr */
 376                         stcb = sctp_tcb_special_locate(inp_p, remote, local,
 377                             netp);
 378                         if ((stcb != NULL) && (locked_tcb == NULL)) {
 379                                 /* we have a locked tcb, lower refcount */
 380                                 SCTP_INP_WLOCK(inp);
 381                                 SCTP_INP_DECR_REF(inp);
 382                                 SCTP_INP_WUNLOCK(inp);
 383                         }
 384                         if ((locked_tcb != NULL) && (locked_tcb != stcb)) {
 385                                 SCTP_INP_RLOCK(locked_tcb->sctp_ep);
 386                                 SCTP_TCB_LOCK(locked_tcb);
 387                                 SCTP_INP_RUNLOCK(locked_tcb->sctp_ep);
 388                         }
 389                         SCTP_INP_INFO_RUNLOCK();
 390                         return (stcb);
 391                 } else {
 392                         SCTP_INP_WLOCK(inp);
 393                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
 394                                 goto null_return;
 395                         }
 396                         stcb = LIST_FIRST(&inp->sctp_asoc_list);
 397                         if (stcb == NULL) {
 398                                 goto null_return;
 399                         }
 400                         SCTP_TCB_LOCK(stcb);
 401                         if (stcb->rport != rport) {
 402                                 /* remote port does not match. */
 403                                 SCTP_TCB_UNLOCK(stcb);
 404                                 goto null_return;
 405                         }
 406                         /* now look at the list of remote addresses */
 407                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 408 #ifdef INVARIANTS
 409                                 if (net == (TAILQ_NEXT(net, sctp_next))) {
 410                                         panic("Corrupt net list");
 411                                 }
 412 #endif
 413                                 if (net->ro._l_addr.sa.sa_family !=
 414                                     remote->sa_family) {
 415                                         /* not the same family */
 416                                         continue;
 417                                 }
 418                                 if (remote->sa_family == AF_INET) {
 419                                         struct sockaddr_in *sin, *rsin;
 420
 421                                         sin = (struct sockaddr_in *)
 422                                             &net->ro._l_addr;
 423                                         rsin = (struct sockaddr_in *)remote;
 424                                         if (sin->sin_addr.s_addr ==
 425                                             rsin->sin_addr.s_addr) {
 426                                                 /* found it */
 427                                                 if (netp != NULL) {
 428                                                         *netp = net;
 429                                                 }
 430                                                 if (locked_tcb == NULL) {
 431                                                         SCTP_INP_DECR_REF(inp);
 432                                                 } else if (locked_tcb != stcb) {
 433                                                         SCTP_TCB_LOCK(locked_tcb);
 434                                                 }
 435                                                 SCTP_INP_WUNLOCK(inp);
 436                                                 SCTP_INP_INFO_RUNLOCK();
 437                                                 return (stcb);
 438                                         }
 439                                 } else if (remote->sa_family == AF_INET6) {
 440                                         struct sockaddr_in6 *sin6, *rsin6;
 441
 442                                         sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
 443                                         rsin6 = (struct sockaddr_in6 *)remote;
 444                                         if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
 445                                             &rsin6->sin6_addr)) {
 446                                                 /* found it */
 447                                                 if (netp != NULL) {
 448                                                         *netp = net;
 449                                                 }
 450                                                 if (locked_tcb == NULL) {
 451                                                         SCTP_INP_DECR_REF(inp);
 452                                                 } else if (locked_tcb != stcb) {
 453                                                         SCTP_TCB_LOCK(locked_tcb);
 454                                                 }
 455                                                 SCTP_INP_WUNLOCK(inp);
 456                                                 SCTP_INP_INFO_RUNLOCK();
 457                                                 return (stcb);
 458                                         }
 459                                 }
 460                         }
 461                         SCTP_TCB_UNLOCK(stcb);
 462                 }
 463         } else {
 464                 SCTP_INP_WLOCK(inp);
 465                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
 466                         goto null_return;
 467                 }
 468                 head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(rport,
 469                     inp->sctp_hashmark)];
 470                 if (head == NULL) {
 471                         goto null_return;
 472                 }
 473                 LIST_FOREACH(stcb, head, sctp_tcbhash) {
 474                         if (stcb->rport != rport) {
 475                                 /* remote port does not match */
 476                                 continue;
 477                         }
 478                         /* now look at the list of remote addresses */
 479                         SCTP_TCB_LOCK(stcb);
 480                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 481 #ifdef INVARIANTS
 482                                 if (net == (TAILQ_NEXT(net, sctp_next))) {
 483                                         panic("Corrupt net list");
 484                                 }
 485 #endif
 486                                 if (net->ro._l_addr.sa.sa_family !=
 487                                     remote->sa_family) {
 488                                         /* not the same family */
 489                                         continue;
 490                                 }
 491                                 if (remote->sa_family == AF_INET) {
 492                                         struct sockaddr_in *sin, *rsin;
 493
 494                                         sin = (struct sockaddr_in *)
 495                                             &net->ro._l_addr;
 496                                         rsin = (struct sockaddr_in *)remote;
 497                                         if (sin->sin_addr.s_addr ==
 498                                             rsin->sin_addr.s_addr) {
 499                                                 /* found it */
 500                                                 if (netp != NULL) {
 501                                                         *netp = net;
 502                                                 }
 503                                                 if (locked_tcb == NULL) {
 504                                                         SCTP_INP_DECR_REF(inp);
 505                                                 } else if (locked_tcb != stcb) {
 506                                                         SCTP_TCB_LOCK(locked_tcb);
 507                                                 }
 508                                                 SCTP_INP_WUNLOCK(inp);
 509                                                 SCTP_INP_INFO_RUNLOCK();
 510                                                 return (stcb);
 511                                         }
 512                                 } else if (remote->sa_family == AF_INET6) {
 513                                         struct sockaddr_in6 *sin6, *rsin6;
 514
 515                                         sin6 = (struct sockaddr_in6 *)
 516                                             &net->ro._l_addr;
 517                                         rsin6 = (struct sockaddr_in6 *)remote;
 518                                         if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
 519                                             &rsin6->sin6_addr)) {
 520                                                 /* found it */
 521                                                 if (netp != NULL) {
 522                                                         *netp = net;
 523                                                 }
 524                                                 if (locked_tcb == NULL) {
 525                                                         SCTP_INP_DECR_REF(inp);
 526                                                 } else if (locked_tcb != stcb) {
 527                                                         SCTP_TCB_LOCK(locked_tcb);
 528                                                 }
 529                                                 SCTP_INP_WUNLOCK(inp);
 530                                                 SCTP_INP_INFO_RUNLOCK();
 531                                                 return (stcb);
 532                                         }
 533                                 }
 534                         }
 535                         SCTP_TCB_UNLOCK(stcb);
 536                 }
 537         }
 538 null_return:
 539         /* clean up for returning null */
 540         if (locked_tcb) {
 541                 SCTP_TCB_LOCK(locked_tcb);
 542         }
 543         SCTP_INP_WUNLOCK(inp);
 544         SCTP_INP_INFO_RUNLOCK();
 545         /* not found */
 546         return (NULL);
 547 }
 548
 549 /*
 550  * Find an association for a specific endpoint using the association id given
 551  * out in the COMM_UP notification
 552  */
 553
 554 struct sctp_tcb *
 555 sctp_findassociation_ep_asocid(struct sctp_inpcb *inp, sctp_assoc_t asoc_id, int want_lock)
 556 {
 557         /*
 558          * Use my the assoc_id to find a endpoint
 559          */
 560         struct sctpasochead *head;
 561         struct sctp_tcb *stcb;
 562         uint32_t id;
 563
 564         if (asoc_id == 0 || inp == NULL) {
 565                 return (NULL);
 566         }
 567         SCTP_INP_INFO_RLOCK();
 568         id = (uint32_t) asoc_id;
 569         head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(id,
 570             sctppcbinfo.hashasocmark)];
 571         if (head == NULL) {
 572                 /* invalid id TSNH */
 573                 SCTP_INP_INFO_RUNLOCK();
 574                 return (NULL);
 575         }
 576         LIST_FOREACH(stcb, head, sctp_asocs) {
 577                 SCTP_INP_RLOCK(stcb->sctp_ep);
 578                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
 579                         SCTP_INP_RUNLOCK(stcb->sctp_ep);
 580                         SCTP_INP_INFO_RUNLOCK();
 581                         return (NULL);
 582                 }
 583                 if (stcb->asoc.assoc_id == id) {
 584                         /* candidate */
 585                         if (inp != stcb->sctp_ep) {
 586                                 /*
 587                                  * some other guy has the same id active (id
 588                                  * collision ??).
 589                                  */
 590                                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
 591                                 continue;
 592                         }
 593                         if (want_lock) {
 594                                 SCTP_TCB_LOCK(stcb);
 595                         }
 596                         SCTP_INP_RUNLOCK(stcb->sctp_ep);
 597                         SCTP_INP_INFO_RUNLOCK();
 598                         return (stcb);
 599                 }
 600                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
 601         }
 602         /* Ok if we missed here, lets try the restart hash */
 603         head = &sctppcbinfo.sctp_restarthash[SCTP_PCBHASH_ASOC(id, sctppcbinfo.hashrestartmark)];
 604         if (head == NULL) {
 605                 /* invalid id TSNH */
 606                 SCTP_INP_INFO_RUNLOCK();
 607                 return (NULL);
 608         }
 609         LIST_FOREACH(stcb, head, sctp_tcbrestarhash) {
 610                 SCTP_INP_RLOCK(stcb->sctp_ep);
 611                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
 612                         SCTP_INP_RUNLOCK(stcb->sctp_ep);
 613                         SCTP_INP_INFO_RUNLOCK();
 614                         return (NULL);
 615                 }
 616                 SCTP_TCB_LOCK(stcb);
 617                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
 618                 if (stcb->asoc.assoc_id == id) {
 619                         /* candidate */
 620                         if (inp != stcb->sctp_ep) {
 621                                 /*
 622                                  * some other guy has the same id active (id
 623                                  * collision ??).
 624                                  */
 625                                 SCTP_TCB_UNLOCK(stcb);
 626                                 continue;
 627                         }
 628                         SCTP_INP_INFO_RUNLOCK();
 629                         return (stcb);
 630                 }
 631                 SCTP_TCB_UNLOCK(stcb);
 632         }
 633         SCTP_INP_INFO_RUNLOCK();
 634         return (NULL);
 635 }
 636
 637
 638 static struct sctp_inpcb *
 639 sctp_endpoint_probe(struct sockaddr *nam, struct sctppcbhead *head,
 640     uint16_t lport)
 641 {
 642         struct sctp_inpcb *inp;
 643         struct sockaddr_in *sin;
 644         struct sockaddr_in6 *sin6;
 645         struct sctp_laddr *laddr;
 646
 647         /*
 648          * Endpoing probe expects that the INP_INFO is locked.
 649          */
 650         if (nam->sa_family == AF_INET) {
 651                 sin = (struct sockaddr_in *)nam;
 652                 sin6 = NULL;
 653         } else if (nam->sa_family == AF_INET6) {
 654                 sin6 = (struct sockaddr_in6 *)nam;
 655                 sin = NULL;
 656         } else {
 657                 /* unsupported family */
 658                 return (NULL);
 659         }
 660         if (head == NULL)
 661                 return (NULL);
 662         LIST_FOREACH(inp, head, sctp_hash) {
 663                 SCTP_INP_RLOCK(inp);
 664                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
 665                         SCTP_INP_RUNLOCK(inp);
 666                         continue;
 667                 }
 668                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) &&
 669                     (inp->sctp_lport == lport)) {
 670                         /* got it */
 671                         if ((nam->sa_family == AF_INET) &&
 672                             (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
 673                             SCTP_IPV6_V6ONLY(inp)) {
 674                                 /* IPv4 on a IPv6 socket with ONLY IPv6 set */
 675                                 SCTP_INP_RUNLOCK(inp);
 676                                 continue;
 677                         }
 678                         /* A V6 address and the endpoint is NOT bound V6 */
 679                         if (nam->sa_family == AF_INET6 &&
 680                             (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
 681                                 SCTP_INP_RUNLOCK(inp);
 682                                 continue;
 683                         }
 684                         SCTP_INP_RUNLOCK(inp);
 685                         return (inp);
 686                 }
 687                 SCTP_INP_RUNLOCK(inp);
 688         }
 689
 690         if ((nam->sa_family == AF_INET) &&
 691             (sin->sin_addr.s_addr == INADDR_ANY)) {
 692                 /* Can't hunt for one that has no address specified */
 693                 return (NULL);
 694         } else if ((nam->sa_family == AF_INET6) &&
 695             (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))) {
 696                 /* Can't hunt for one that has no address specified */
 697                 return (NULL);
 698         }
 699         /*
 700          * ok, not bound to all so see if we can find a EP bound to this
 701          * address.
 702          */
 703         LIST_FOREACH(inp, head, sctp_hash) {
 704                 SCTP_INP_RLOCK(inp);
 705                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
 706                         SCTP_INP_RUNLOCK(inp);
 707                         continue;
 708                 }
 709                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)) {
 710                         SCTP_INP_RUNLOCK(inp);
 711                         continue;
 712                 }
 713                 /*
 714                  * Ok this could be a likely candidate, look at all of its
 715                  * addresses
 716                  */
 717                 if (inp->sctp_lport != lport) {
 718                         SCTP_INP_RUNLOCK(inp);
 719                         continue;
 720                 }
 721                 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
 722                         if (laddr->ifa == NULL) {
 723 #ifdef SCTP_DEBUG
 724                                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 725                                         printf("An ounce of prevention is worth a pound of cure\n");
 726                                 }
 727 #endif
 728                                 continue;
 729                         }
 730 #ifdef SCTP_DEBUG
 731                         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 732                                 printf("Ok laddr->ifa:%p is possible, ",
 733                                     laddr->ifa);
 734                         }
 735 #endif
 736                         if (laddr->ifa->ifa_addr == NULL) {
 737 #ifdef SCTP_DEBUG
 738                                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
 739                                         printf("Huh IFA as an ifa_addr=NULL, ");
 740                                 }
 741 #endif
 742                                 continue;
 743                         }
 744                         if (laddr->ifa->ifa_addr->sa_family == nam->sa_family) {
 745                                 /* possible, see if it matches */
 746                                 struct sockaddr_in *intf_addr;
 747
 748                                 intf_addr = (struct sockaddr_in *)
 749                                     laddr->ifa->ifa_addr;
 750                                 if (nam->sa_family == AF_INET) {
 751                                         if (sin->sin_addr.s_addr ==
 752                                             intf_addr->sin_addr.s_addr) {
 753                                                 SCTP_INP_RUNLOCK(inp);
 754                                                 return (inp);
 755                                         }
 756                                 } else if (nam->sa_family == AF_INET6) {
 757                                         struct sockaddr_in6 *intf_addr6;
 758
 759                                         intf_addr6 = (struct sockaddr_in6 *)
 760                                             laddr->ifa->ifa_addr;
 761                                         if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
 762                                             &intf_addr6->sin6_addr)) {
 763                                                 SCTP_INP_RUNLOCK(inp);
 764                                                 return (inp);
 765                                         }
 766                                 }
 767                         }
 768                 }
 769                 SCTP_INP_RUNLOCK(inp);
 770         }
 771         return (NULL);
 772 }
 773
 774
 775 struct sctp_inpcb *
 776 sctp_pcb_findep(struct sockaddr *nam, int find_tcp_pool, int have_lock)
 777 {
 778         /*
 779          * First we check the hash table to see if someone has this port
 780          * bound with just the port.
 781          */
 782         struct sctp_inpcb *inp;
 783         struct sctppcbhead *head;
 784         struct sockaddr_in *sin;
 785         struct sockaddr_in6 *sin6;
 786         int lport;
 787
 788         if (nam->sa_family == AF_INET) {
 789                 sin = (struct sockaddr_in *)nam;
 790                 lport = ((struct sockaddr_in *)nam)->sin_port;
 791         } else if (nam->sa_family == AF_INET6) {
 792                 sin6 = (struct sockaddr_in6 *)nam;
 793                 lport = ((struct sockaddr_in6 *)nam)->sin6_port;
 794         } else {
 795                 /* unsupported family */
 796                 return (NULL);
 797         }
 798         /*
 799          * I could cheat here and just cast to one of the types but we will
 800          * do it right. It also provides the check against an Unsupported
 801          * type too.
 802          */
 803         /* Find the head of the ALLADDR chain */
 804         if (have_lock == 0) {
 805                 SCTP_INP_INFO_RLOCK();
 806
 807         }
 808         head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport,
 809             sctppcbinfo.hashmark)];
 810         inp = sctp_endpoint_probe(nam, head, lport);
 811
 812         /*
 813          * If the TCP model exists it could be that the main listening
 814          * endpoint is gone but there exists a connected socket for this guy
 815          * yet. If so we can return the first one that we find. This may NOT
 816          * be the correct one but the sctp_findassociation_ep_addr has
 817          * further code to look at all TCP models.
 818          */
 819         if (inp == NULL && find_tcp_pool) {
 820                 unsigned int i;
 821
 822                 for (i = 0; i < sctppcbinfo.hashtblsize; i++) {
 823                         /*
 824                          * This is real gross, but we do NOT have a remote
 825                          * port at this point depending on who is calling.
 826                          * We must therefore look for ANY one that matches
 827                          * our local port :/
 828                          */
 829                         head = &sctppcbinfo.sctp_tcpephash[i];
 830                         if (LIST_FIRST(head)) {
 831                                 inp = sctp_endpoint_probe(nam, head, lport);
 832                                 if (inp) {
 833                                         /* Found one */
 834                                         break;
 835                                 }
 836                         }
 837                 }
 838         }
 839         if (inp) {
 840                 SCTP_INP_INCR_REF(inp);
 841         }
 842         if (have_lock == 0) {
 843                 SCTP_INP_INFO_RUNLOCK();
 844         }
 845         return (inp);
 846 }
 847
 848 /*
 849  * Find an association for an endpoint with the pointer to whom you want to
 850  * send to and the endpoint pointer. The address can be IPv4 or IPv6. We may
 851  * need to change the *to to some other struct like a mbuf...
 852  */
 853 struct sctp_tcb *
 854 sctp_findassociation_addr_sa(struct sockaddr *to, struct sockaddr *from,
 855     struct sctp_inpcb **inp_p, struct sctp_nets **netp, int find_tcp_pool)
 856 {
 857         struct sctp_inpcb *inp;
 858         struct sctp_tcb *retval;
 859
 860         SCTP_INP_INFO_RLOCK();
 861         if (find_tcp_pool) {
 862                 if (inp_p != NULL) {
 863                         retval = sctp_tcb_special_locate(inp_p, from, to, netp);
 864                 } else {
 865                         retval = sctp_tcb_special_locate(&inp, from, to, netp);
 866                 }
 867                 if (retval != NULL) {
 868                         SCTP_INP_INFO_RUNLOCK();
 869                         return (retval);
 870                 }
 871         }
 872         inp = sctp_pcb_findep(to, 0, 1);
 873         if (inp_p != NULL) {
 874                 *inp_p = inp;
 875         }
 876         SCTP_INP_INFO_RUNLOCK();
 877
 878         if (inp == NULL) {
 879                 return (NULL);
 880         }
 881         /*
 882          * ok, we have an endpoint, now lets find the assoc for it (if any)
 883          * we now place the source address or from in the to of the find
 884          * endpoint call. Since in reality this chain is used from the
 885          * inbound packet side.
 886          */
 887         if (inp_p != NULL) {
 888                 retval = sctp_findassociation_ep_addr(inp_p, from, netp, to, NULL);
 889         } else {
 890                 retval = sctp_findassociation_ep_addr(&inp, from, netp, to, NULL);
 891         }
 892         return retval;
 893 }
 894
 895
 896 /*
 897  * This routine will grub through the mbuf that is a INIT or INIT-ACK and
 898  * find all addresses that the sender has specified in any address list. Each
 899  * address will be used to lookup the TCB and see if one exits.
 900  */
 901 static struct sctp_tcb *
 902 sctp_findassociation_special_addr(struct mbuf *m, int iphlen, int offset,
 903     struct sctphdr *sh, struct sctp_inpcb **inp_p, struct sctp_nets **netp,
 904     struct sockaddr *dest)
 905 {
 906         struct sockaddr_in sin4;
 907         struct sockaddr_in6 sin6;
 908         struct sctp_paramhdr *phdr, parm_buf;
 909         struct sctp_tcb *retval;
 910         uint32_t ptype, plen;
 911
 912         memset(&sin4, 0, sizeof(sin4));
 913         memset(&sin6, 0, sizeof(sin6));
 914         sin4.sin_len = sizeof(sin4);
 915         sin4.sin_family = AF_INET;
 916         sin4.sin_port = sh->src_port;
 917         sin6.sin6_len = sizeof(sin6);
 918         sin6.sin6_family = AF_INET6;
 919         sin6.sin6_port = sh->src_port;
 920
 921         retval = NULL;
 922         offset += sizeof(struct sctp_init_chunk);
 923
 924         phdr = sctp_get_next_param(m, offset, &parm_buf, sizeof(parm_buf));
 925         while (phdr != NULL) {
 926                 /* now we must see if we want the parameter */
 927                 ptype = ntohs(phdr->param_type);
 928                 plen = ntohs(phdr->param_length);
 929                 if (plen == 0) {
 930                         break;
 931                 }
 932                 if (ptype == SCTP_IPV4_ADDRESS &&
 933                     plen == sizeof(struct sctp_ipv4addr_param)) {
 934                         /* Get the rest of the address */
 935                         struct sctp_ipv4addr_param ip4_parm, *p4;
 936
 937                         phdr = sctp_get_next_param(m, offset,
 938                             (struct sctp_paramhdr *)&ip4_parm, plen);
 939                         if (phdr == NULL) {
 940                                 return (NULL);
 941                         }
 942                         p4 = (struct sctp_ipv4addr_param *)phdr;
 943                         memcpy(&sin4.sin_addr, &p4->addr, sizeof(p4->addr));
 944                         /* look it up */
 945                         retval = sctp_findassociation_ep_addr(inp_p,
 946                             (struct sockaddr *)&sin4, netp, dest, NULL);
 947                         if (retval != NULL) {
 948                                 return (retval);
 949                         }
 950                 } else if (ptype == SCTP_IPV6_ADDRESS &&
 951                     plen == sizeof(struct sctp_ipv6addr_param)) {
 952                         /* Get the rest of the address */
 953                         struct sctp_ipv6addr_param ip6_parm, *p6;
 954
 955                         phdr = sctp_get_next_param(m, offset,
 956                             (struct sctp_paramhdr *)&ip6_parm, plen);
 957                         if (phdr == NULL) {
 958                                 return (NULL);
 959                         }
 960                         p6 = (struct sctp_ipv6addr_param *)phdr;
 961                         memcpy(&sin6.sin6_addr, &p6->addr, sizeof(p6->addr));
 962                         /* look it up */
 963                         retval = sctp_findassociation_ep_addr(inp_p,
 964                             (struct sockaddr *)&sin6, netp, dest, NULL);
 965                         if (retval != NULL) {
 966                                 return (retval);
 967                         }
 968                 }
 969                 offset += SCTP_SIZE32(plen);
 970                 phdr = sctp_get_next_param(m, offset, &parm_buf,
 971                     sizeof(parm_buf));
 972         }
 973         return (NULL);
 974 }
 975
 976
 977 static struct sctp_tcb *
 978 sctp_findassoc_by_vtag(struct sockaddr *from, uint32_t vtag,
 979     struct sctp_inpcb **inp_p, struct sctp_nets **netp, uint16_t rport,
 980     uint16_t lport, int skip_src_check)
 981 {
 982         /*
 983          * Use my vtag to hash. If we find it we then verify the source addr
 984          * is in the assoc. If all goes well we save a bit on rec of a
 985          * packet.
 986          */
 987         struct sctpasochead *head;
 988         struct sctp_nets *net;
 989         struct sctp_tcb *stcb;
 990
 991         *netp = NULL;
 992         *inp_p = NULL;
 993         SCTP_INP_INFO_RLOCK();
 994         head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(vtag,
 995             sctppcbinfo.hashasocmark)];
 996         if (head == NULL) {
 997                 /* invalid vtag */
 998                 SCTP_INP_INFO_RUNLOCK();
 999                 return (NULL);
1000         }
1001         LIST_FOREACH(stcb, head, sctp_asocs) {
1002                 SCTP_INP_RLOCK(stcb->sctp_ep);
1003                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1004                         SCTP_INP_RUNLOCK(stcb->sctp_ep);
1005                         SCTP_INP_INFO_RUNLOCK();
1006                         return (NULL);
1007                 }
1008                 SCTP_TCB_LOCK(stcb);
1009                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
1010                 if (stcb->asoc.my_vtag == vtag) {
1011                         /* candidate */
1012                         if (stcb->rport != rport) {
1013                                 /*
1014                                  * we could remove this if vtags are unique
1015                                  * across the system.
1016                                  */
1017                                 SCTP_TCB_UNLOCK(stcb);
1018                                 continue;
1019                         }
1020                         if (stcb->sctp_ep->sctp_lport != lport) {
1021                                 /*
1022                                  * we could remove this if vtags are unique
1023                                  * across the system.
1024                                  */
1025                                 SCTP_TCB_UNLOCK(stcb);
1026                                 continue;
1027                         }
1028                         if (skip_src_check) {
1029                                 *netp = NULL;   /* unknown */
1030                                 *inp_p = stcb->sctp_ep;
1031                                 SCTP_INP_INFO_RUNLOCK();
1032                                 return (stcb);
1033                         }
1034                         net = sctp_findnet(stcb, from);
1035                         if (net) {
1036                                 /* yep its him. */
1037                                 *netp = net;
1038                                 SCTP_STAT_INCR(sctps_vtagexpress);
1039                                 *inp_p = stcb->sctp_ep;
1040                                 SCTP_INP_INFO_RUNLOCK();
1041                                 return (stcb);
1042                         } else {
1043                                 /*
1044                                  * not him, this should only happen in rare
1045                                  * cases so I peg it.
1046                                  */
1047                                 SCTP_STAT_INCR(sctps_vtagbogus);
1048                         }
1049                 }
1050                 SCTP_TCB_UNLOCK(stcb);
1051         }
1052         SCTP_INP_INFO_RUNLOCK();
1053         return (NULL);
1054 }
1055
1056 /*
1057  * Find an association with the pointer to the inbound IP packet. This can be
1058  * a IPv4 or IPv6 packet.
1059  */
1060 struct sctp_tcb *
1061 sctp_findassociation_addr(struct mbuf *m, int iphlen, int offset,
1062     struct sctphdr *sh, struct sctp_chunkhdr *ch,
1063     struct sctp_inpcb **inp_p, struct sctp_nets **netp)
1064 {
1065         int find_tcp_pool;
1066         struct ip *iph;
1067         struct sctp_tcb *retval;
1068         struct sockaddr_storage to_store, from_store;
1069         struct sockaddr *to = (struct sockaddr *)&to_store;
1070         struct sockaddr *from = (struct sockaddr *)&from_store;
1071         struct sctp_inpcb *inp;
1072
1073
1074         iph = mtod(m, struct ip *);
1075         if (iph->ip_v == IPVERSION) {
1076                 /* its IPv4 */
1077                 struct sockaddr_in *from4;
1078
1079                 from4 = (struct sockaddr_in *)&from_store;
1080                 bzero(from4, sizeof(*from4));
1081                 from4->sin_family = AF_INET;
1082                 from4->sin_len = sizeof(struct sockaddr_in);
1083                 from4->sin_addr.s_addr = iph->ip_src.s_addr;
1084                 from4->sin_port = sh->src_port;
1085         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
1086                 /* its IPv6 */
1087                 struct ip6_hdr *ip6;
1088                 struct sockaddr_in6 *from6;
1089
1090                 ip6 = mtod(m, struct ip6_hdr *);
1091                 from6 = (struct sockaddr_in6 *)&from_store;
1092                 bzero(from6, sizeof(*from6));
1093                 from6->sin6_family = AF_INET6;
1094                 from6->sin6_len = sizeof(struct sockaddr_in6);
1095                 from6->sin6_addr = ip6->ip6_src;
1096                 from6->sin6_port = sh->src_port;
1097                 /* Get the scopes in properly to the sin6 addr's */
1098                 /* we probably don't need these operations */
1099                 (void)sa6_recoverscope(from6);
1100                 sa6_embedscope(from6, ip6_use_defzone);
1101         } else {
1102                 /* Currently not supported. */
1103                 return (NULL);
1104         }
1105         if (sh->v_tag) {
1106                 /* we only go down this path if vtag is non-zero */
1107                 retval = sctp_findassoc_by_vtag(from, ntohl(sh->v_tag),
1108                     inp_p, netp, sh->src_port, sh->dest_port, 0);
1109                 if (retval) {
1110                         return (retval);
1111                 }
1112         }
1113         if (iph->ip_v == IPVERSION) {
1114                 /* its IPv4 */
1115                 struct sockaddr_in *to4;
1116
1117                 to4 = (struct sockaddr_in *)&to_store;
1118                 bzero(to4, sizeof(*to4));
1119                 to4->sin_family = AF_INET;
1120                 to4->sin_len = sizeof(struct sockaddr_in);
1121                 to4->sin_addr.s_addr = iph->ip_dst.s_addr;
1122                 to4->sin_port = sh->dest_port;
1123         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
1124                 /* its IPv6 */
1125                 struct ip6_hdr *ip6;
1126                 struct sockaddr_in6 *to6;
1127
1128                 ip6 = mtod(m, struct ip6_hdr *);
1129                 to6 = (struct sockaddr_in6 *)&to_store;
1130                 bzero(to6, sizeof(*to6));
1131                 to6->sin6_family = AF_INET6;
1132                 to6->sin6_len = sizeof(struct sockaddr_in6);
1133                 to6->sin6_addr = ip6->ip6_dst;
1134                 to6->sin6_port = sh->dest_port;
1135                 /* Get the scopes in properly to the sin6 addr's */
1136                 /* we probably don't need these operations */
1137                 (void)sa6_recoverscope(to6);
1138                 sa6_embedscope(to6, ip6_use_defzone);
1139         }
1140         find_tcp_pool = 0;
1141         /*
1142          * FIX FIX?, I think we only need to look in the TCP pool if its an
1143          * INIT or COOKIE-ECHO, We really don't need to find it that way if
1144          * its a INIT-ACK or COOKIE_ACK since these in bot one-2-one and
1145          * one-2-N would be in the main pool anyway.
1146          */
1147         if ((ch->chunk_type != SCTP_INITIATION) &&
1148             (ch->chunk_type != SCTP_INITIATION_ACK) &&
1149             (ch->chunk_type != SCTP_COOKIE_ACK) &&
1150             (ch->chunk_type != SCTP_COOKIE_ECHO)) {
1151                 /* Other chunk types go to the tcp pool. */
1152                 find_tcp_pool = 1;
1153         }
1154         if (inp_p) {
1155                 retval = sctp_findassociation_addr_sa(to, from, inp_p, netp,
1156                     find_tcp_pool);
1157                 inp = *inp_p;
1158         } else {
1159                 retval = sctp_findassociation_addr_sa(to, from, &inp, netp,
1160                     find_tcp_pool);
1161         }
1162 #ifdef SCTP_DEBUG
1163         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
1164                 printf("retval:%p inp:%p\n", retval, inp);
1165         }
1166 #endif
1167         if (retval == NULL && inp) {
1168                 /* Found a EP but not this address */
1169                 if ((ch->chunk_type == SCTP_INITIATION) ||
1170                     (ch->chunk_type == SCTP_INITIATION_ACK)) {
1171                         /*
1172                          * special hook, we do NOT return linp or an
1173                          * association that is linked to an existing
1174                          * association that is under the TCP pool (i.e. no
1175                          * listener exists). The endpoint finding routine
1176                          * will always find a listner before examining the
1177                          * TCP pool.
1178                          */
1179                         if (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) {
1180                                 if (inp_p) {
1181                                         *inp_p = NULL;
1182                                 }
1183                                 return (NULL);
1184                         }
1185                         retval = sctp_findassociation_special_addr(m, iphlen,
1186                             offset, sh, &inp, netp, to);
1187                         if (inp_p != NULL) {
1188                                 *inp_p = inp;
1189                         }
1190                 }
1191         }
1192 #ifdef SCTP_DEBUG
1193         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
1194                 printf("retval is %p\n", retval);
1195         }
1196 #endif
1197         return (retval);
1198 }
1199
1200 /*
1201  * lookup an association by an ASCONF lookup address.
1202  * if the lookup address is 0.0.0.0 or ::0, use the vtag to do the lookup
1203  */
1204 struct sctp_tcb *
1205 sctp_findassociation_ep_asconf(struct mbuf *m, int iphlen, int offset,
1206     struct sctphdr *sh, struct sctp_inpcb **inp_p, struct sctp_nets **netp)
1207 {
1208         struct sctp_tcb *stcb;
1209         struct sockaddr_in *sin;
1210         struct sockaddr_in6 *sin6;
1211         struct sockaddr_storage local_store, remote_store;
1212         struct ip *iph;
1213         struct sctp_paramhdr parm_buf, *phdr;
1214         int ptype;
1215         int zero_address = 0;
1216
1217
1218         memset(&local_store, 0, sizeof(local_store));
1219         memset(&remote_store, 0, sizeof(remote_store));
1220
1221         /* First get the destination address setup too. */
1222         iph = mtod(m, struct ip *);
1223         if (iph->ip_v == IPVERSION) {
1224                 /* its IPv4 */
1225                 sin = (struct sockaddr_in *)&local_store;
1226                 sin->sin_family = AF_INET;
1227                 sin->sin_len = sizeof(*sin);
1228                 sin->sin_port = sh->dest_port;
1229                 sin->sin_addr.s_addr = iph->ip_dst.s_addr;
1230         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
1231                 /* its IPv6 */
1232                 struct ip6_hdr *ip6;
1233
1234                 ip6 = mtod(m, struct ip6_hdr *);
1235                 sin6 = (struct sockaddr_in6 *)&local_store;
1236                 sin6->sin6_family = AF_INET6;
1237                 sin6->sin6_len = sizeof(*sin6);
1238                 sin6->sin6_port = sh->dest_port;
1239                 sin6->sin6_addr = ip6->ip6_dst;
1240         } else {
1241                 return NULL;
1242         }
1243
1244         phdr = sctp_get_next_param(m, offset + sizeof(struct sctp_asconf_chunk),
1245             &parm_buf, sizeof(struct sctp_paramhdr));
1246         if (phdr == NULL) {
1247 #ifdef SCTP_DEBUG
1248                 if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
1249                         printf("findassociation_ep_asconf: failed to get asconf lookup addr\n");
1250                 }
1251 #endif                          /* SCTP_DEBUG */
1252                 return NULL;
1253         }
1254         ptype = (int)((uint32_t) ntohs(phdr->param_type));
1255         /* get the correlation address */
1256         if (ptype == SCTP_IPV6_ADDRESS) {
1257                 /* ipv6 address param */
1258                 struct sctp_ipv6addr_param *p6, p6_buf;
1259
1260                 if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv6addr_param)) {
1261                         return NULL;
1262                 }
1263                 p6 = (struct sctp_ipv6addr_param *)sctp_get_next_param(m,
1264                     offset + sizeof(struct sctp_asconf_chunk),
1265                     &p6_buf.ph, sizeof(*p6));
1266                 if (p6 == NULL) {
1267 #ifdef SCTP_DEBUG
1268                         if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
1269                                 printf("findassociation_ep_asconf: failed to get asconf v6 lookup addr\n");
1270                         }
1271 #endif                          /* SCTP_DEBUG */
1272                         return (NULL);
1273                 }
1274                 sin6 = (struct sockaddr_in6 *)&remote_store;
1275                 sin6->sin6_family = AF_INET6;
1276                 sin6->sin6_len = sizeof(*sin6);
1277                 sin6->sin6_port = sh->src_port;
1278                 memcpy(&sin6->sin6_addr, &p6->addr, sizeof(struct in6_addr));
1279                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
1280                         zero_address = 1;
1281         } else if (ptype == SCTP_IPV4_ADDRESS) {
1282                 /* ipv4 address param */
1283                 struct sctp_ipv4addr_param *p4, p4_buf;
1284
1285                 if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv4addr_param)) {
1286                         return NULL;
1287                 }
1288                 p4 = (struct sctp_ipv4addr_param *)sctp_get_next_param(m,
1289                     offset + sizeof(struct sctp_asconf_chunk),
1290                     &p4_buf.ph, sizeof(*p4));
1291                 if (p4 == NULL) {
1292 #ifdef SCTP_DEBUG
1293                         if (sctp_debug_on & SCTP_DEBUG_INPUT3) {
1294                                 printf("findassociation_ep_asconf: failed to get asconf v4 lookup addr\n");
1295                         }
1296 #endif                          /* SCTP_DEBUG */
1297                         return (NULL);
1298                 }
1299                 sin = (struct sockaddr_in *)&remote_store;
1300                 sin->sin_family = AF_INET;
1301                 sin->sin_len = sizeof(*sin);
1302                 sin->sin_port = sh->src_port;
1303                 memcpy(&sin->sin_addr, &p4->addr, sizeof(struct in_addr));
1304                 if (sin->sin_addr.s_addr == INADDR_ANY)
1305                         zero_address = 1;
1306         } else {
1307                 /* invalid address param type */
1308                 return NULL;
1309         }
1310
1311         if (zero_address) {
1312                 stcb = sctp_findassoc_by_vtag(NULL, ntohl(sh->v_tag), inp_p,
1313                     netp, sh->src_port, sh->dest_port, 1);
1314                 /*
1315                  * printf("findassociation_ep_asconf: zero lookup address
1316                  * finds stcb 0x%x\n", (uint32_t)stcb);
1317                  */
1318         } else {
1319                 stcb = sctp_findassociation_ep_addr(inp_p,
1320                     (struct sockaddr *)&remote_store, netp,
1321                     (struct sockaddr *)&local_store, NULL);
1322         }
1323         return (stcb);
1324 }
1325
1326
1327 extern int sctp_max_burst_default;
1328
1329 extern unsigned int sctp_delayed_sack_time_default;
1330 extern unsigned int sctp_heartbeat_interval_default;
1331 extern unsigned int sctp_pmtu_raise_time_default;
1332 extern unsigned int sctp_shutdown_guard_time_default;
1333 extern unsigned int sctp_secret_lifetime_default;
1334
1335 extern unsigned int sctp_rto_max_default;
1336 extern unsigned int sctp_rto_min_default;
1337 extern unsigned int sctp_rto_initial_default;
1338 extern unsigned int sctp_init_rto_max_default;
1339 extern unsigned int sctp_valid_cookie_life_default;
1340 extern unsigned int sctp_init_rtx_max_default;
1341 extern unsigned int sctp_assoc_rtx_max_default;
1342 extern unsigned int sctp_path_rtx_max_default;
1343 extern unsigned int sctp_nr_outgoing_streams_default;
1344
1345 /*
1346  * allocate a sctp_inpcb and setup a temporary binding to a port/all
1347  * addresses. This way if we don't get a bind we by default pick a ephemeral
1348  * port with all addresses bound.
1349  */
1350 int
1351 sctp_inpcb_alloc(struct socket *so)
1352 {
1353         /*
1354          * we get called when a new endpoint starts up. We need to allocate
1355          * the sctp_inpcb structure from the zone and init it. Mark it as
1356          * unbound and find a port that we can use as an ephemeral with
1357          * INADDR_ANY. If the user binds later no problem we can then add in
1358          * the specific addresses. And setup the default parameters for the
1359          * EP.
1360          */
1361         int i, error;
1362         struct sctp_inpcb *inp;
1363
1364         struct sctp_pcb *m;
1365         struct timeval time;
1366         sctp_sharedkey_t *null_key;
1367
1368         error = 0;
1369
1370         SCTP_INP_INFO_WLOCK();
1371         inp = (struct sctp_inpcb *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_ep);
1372         if (inp == NULL) {
1373                 printf("Out of SCTP-INPCB structures - no resources\n");
1374                 SCTP_INP_INFO_WUNLOCK();
1375                 return (ENOBUFS);
1376         }
1377         /* zap it */
1378         bzero(inp, sizeof(*inp));
1379
1380         /* bump generations */
1381         /* setup socket pointers */
1382         inp->sctp_socket = so;
1383         inp->ip_inp.inp.inp_socket = so;
1384
1385         inp->partial_delivery_point = so->so_rcv.sb_hiwat >> SCTP_PARTIAL_DELIVERY_SHIFT;
1386         inp->sctp_frag_point = SCTP_DEFAULT_MAXSEGMENT;
1387
1388 #ifdef IPSEC
1389         {
1390                 struct inpcbpolicy *pcb_sp = NULL;
1391
1392                 error = ipsec_init_pcbpolicy(so, &pcb_sp);
1393                 /* Arrange to share the policy */
1394                 inp->ip_inp.inp.inp_sp = pcb_sp;
1395                 ((struct in6pcb *)(&inp->ip_inp.inp))->in6p_sp = pcb_sp;
1396         }
1397         if (error != 0) {
1398                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp);
1399                 SCTP_INP_INFO_WUNLOCK();
1400                 return error;
1401         }
1402 #endif                          /* IPSEC */
1403         SCTP_INCR_EP_COUNT();
1404         inp->ip_inp.inp.inp_ip_ttl = ip_defttl;
1405         SCTP_INP_INFO_WUNLOCK();
1406
1407         so->so_pcb = (caddr_t)inp;
1408
1409         if ((so->so_type == SOCK_DGRAM) ||
1410             (so->so_type == SOCK_SEQPACKET)) {
1411                 /* UDP style socket */
1412                 inp->sctp_flags = (SCTP_PCB_FLAGS_UDPTYPE |
1413                     SCTP_PCB_FLAGS_UNBOUND);
1414                 sctp_feature_on(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT);
1415                 /* Be sure it is NON-BLOCKING IO for UDP */
1416                 /* so->so_state |= SS_NBIO; */
1417         } else if (so->so_type == SOCK_STREAM) {
1418                 /* TCP style socket */
1419                 inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
1420                     SCTP_PCB_FLAGS_UNBOUND);
1421                 sctp_feature_on(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT);
1422                 /* Be sure we have blocking IO by default */
1423                 so->so_state &= ~SS_NBIO;
1424         } else {
1425                 /*
1426                  * unsupported socket type (RAW, etc)- in case we missed it
1427                  * in protosw
1428                  */
1429                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp);
1430                 return (EOPNOTSUPP);
1431         }
1432         inp->sctp_tcbhash = SCTP_HASH_INIT(sctp_pcbtblsize,
1433             &inp->sctp_hashmark);
1434         if (inp->sctp_tcbhash == NULL) {
1435                 printf("Out of SCTP-INPCB->hashinit - no resources\n");
1436                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp);
1437                 return (ENOBUFS);
1438         }
1439         SCTP_INP_INFO_WLOCK();
1440         SCTP_INP_LOCK_INIT(inp);
1441         SCTP_INP_READ_INIT(inp);
1442         SCTP_ASOC_CREATE_LOCK_INIT(inp);
1443         /* lock the new ep */
1444         SCTP_INP_WLOCK(inp);
1445
1446         /* add it to the info area */
1447         LIST_INSERT_HEAD(&sctppcbinfo.listhead, inp, sctp_list);
1448         SCTP_INP_INFO_WUNLOCK();
1449
1450         TAILQ_INIT(&inp->read_queue);
1451         LIST_INIT(&inp->sctp_addr_list);
1452         LIST_INIT(&inp->sctp_asoc_list);
1453
1454 #ifdef SCTP_TRACK_FREED_ASOCS
1455         /* TEMP CODE */
1456         LIST_INIT(&inp->sctp_asoc_free_list);
1457 #endif
1458         /* Init the timer structure for signature change */
1459         SCTP_OS_TIMER_INIT(&inp->sctp_ep.signature_change.timer);
1460         inp->sctp_ep.signature_change.type = SCTP_TIMER_TYPE_NEWCOOKIE;
1461
1462         /* now init the actual endpoint default data */
1463         m = &inp->sctp_ep;
1464
1465         /* setup the base timeout information */
1466         m->sctp_timeoutticks[SCTP_TIMER_SEND] = SEC_TO_TICKS(SCTP_SEND_SEC);    /* needed ? */
1467         m->sctp_timeoutticks[SCTP_TIMER_INIT] = SEC_TO_TICKS(SCTP_INIT_SEC);    /* needed ? */
1468         m->sctp_timeoutticks[SCTP_TIMER_RECV] = MSEC_TO_TICKS(sctp_delayed_sack_time_default);
1469         m->sctp_timeoutticks[SCTP_TIMER_HEARTBEAT] = MSEC_TO_TICKS(sctp_heartbeat_interval_default);
1470         m->sctp_timeoutticks[SCTP_TIMER_PMTU] = SEC_TO_TICKS(sctp_pmtu_raise_time_default);
1471         m->sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] = SEC_TO_TICKS(sctp_shutdown_guard_time_default);
1472         m->sctp_timeoutticks[SCTP_TIMER_SIGNATURE] = SEC_TO_TICKS(sctp_secret_lifetime_default);
1473         /* all max/min max are in ms */
1474         m->sctp_maxrto = sctp_rto_max_default;
1475         m->sctp_minrto = sctp_rto_min_default;
1476         m->initial_rto = sctp_rto_initial_default;
1477         m->initial_init_rto_max = sctp_init_rto_max_default;
1478
1479         m->max_open_streams_intome = MAX_SCTP_STREAMS;
1480
1481         m->max_init_times = sctp_init_rtx_max_default;
1482         m->max_send_times = sctp_assoc_rtx_max_default;
1483         m->def_net_failure = sctp_path_rtx_max_default;
1484         m->sctp_sws_sender = SCTP_SWS_SENDER_DEF;
1485         m->sctp_sws_receiver = SCTP_SWS_RECEIVER_DEF;
1486         m->max_burst = sctp_max_burst_default;
1487         /* number of streams to pre-open on a association */
1488         m->pre_open_stream_count = sctp_nr_outgoing_streams_default;
1489
1490         /* Add adaptation cookie */
1491         m->adaptation_layer_indicator = 0x504C5253;
1492
1493         /* seed random number generator */
1494         m->random_counter = 1;
1495         m->store_at = SCTP_SIGNATURE_SIZE;
1496         SCTP_READ_RANDOM(m->random_numbers, sizeof(m->random_numbers));
1497         sctp_fill_random_store(m);
1498
1499         /* Minimum cookie size */
1500         m->size_of_a_cookie = (sizeof(struct sctp_init_msg) * 2) +
1501             sizeof(struct sctp_state_cookie);
1502         m->size_of_a_cookie += SCTP_SIGNATURE_SIZE;
1503
1504         /* Setup the initial secret */
1505         SCTP_GETTIME_TIMEVAL(&time);
1506         m->time_of_secret_change = time.tv_sec;
1507
1508         for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1509                 m->secret_key[0][i] = sctp_select_initial_TSN(m);
1510         }
1511         sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL);
1512
1513         /* How long is a cookie good for ? */
1514         m->def_cookie_life = sctp_valid_cookie_life_default;
1515
1516         /*
1517          * Initialize authentication parameters
1518          */
1519         m->local_hmacs = sctp_default_supported_hmaclist();
1520         m->local_auth_chunks = sctp_alloc_chunklist();
1521         sctp_auth_set_default_chunks(m->local_auth_chunks);
1522         LIST_INIT(&m->shared_keys);
1523         /* add default NULL key as key id 0 */
1524         null_key = sctp_alloc_sharedkey();
1525         sctp_insert_sharedkey(&m->shared_keys, null_key);
1526         SCTP_INP_WUNLOCK(inp);
1527 #ifdef SCTP_LOG_CLOSING
1528         sctp_log_closing(inp, NULL, 12);
1529 #endif
1530         return (error);
1531 }
1532
1533
1534 void
1535 sctp_move_pcb_and_assoc(struct sctp_inpcb *old_inp, struct sctp_inpcb *new_inp,
1536     struct sctp_tcb *stcb)
1537 {
1538         struct sctp_nets *net;
1539         uint16_t lport, rport;
1540         struct sctppcbhead *head;
1541         struct sctp_laddr *laddr, *oladdr;
1542
1543         SCTP_TCB_UNLOCK(stcb);
1544         SCTP_INP_INFO_WLOCK();
1545         SCTP_INP_WLOCK(old_inp);
1546         SCTP_INP_WLOCK(new_inp);
1547         SCTP_TCB_LOCK(stcb);
1548
1549         new_inp->sctp_ep.time_of_secret_change =
1550             old_inp->sctp_ep.time_of_secret_change;
1551         memcpy(new_inp->sctp_ep.secret_key, old_inp->sctp_ep.secret_key,
1552             sizeof(old_inp->sctp_ep.secret_key));
1553         new_inp->sctp_ep.current_secret_number =
1554             old_inp->sctp_ep.current_secret_number;
1555         new_inp->sctp_ep.last_secret_number =
1556             old_inp->sctp_ep.last_secret_number;
1557         new_inp->sctp_ep.size_of_a_cookie = old_inp->sctp_ep.size_of_a_cookie;
1558
1559         /* make it so new data pours into the new socket */
1560         stcb->sctp_socket = new_inp->sctp_socket;
1561         stcb->sctp_ep = new_inp;
1562
1563         /* Copy the port across */
1564         lport = new_inp->sctp_lport = old_inp->sctp_lport;
1565         rport = stcb->rport;
1566         /* Pull the tcb from the old association */
1567         LIST_REMOVE(stcb, sctp_tcbhash);
1568         LIST_REMOVE(stcb, sctp_tcblist);
1569
1570         /* Now insert the new_inp into the TCP connected hash */
1571         head = &sctppcbinfo.sctp_tcpephash[SCTP_PCBHASH_ALLADDR((lport + rport),
1572             sctppcbinfo.hashtcpmark)];
1573
1574         LIST_INSERT_HEAD(head, new_inp, sctp_hash);
1575
1576         /* Now move the tcb into the endpoint list */
1577         LIST_INSERT_HEAD(&new_inp->sctp_asoc_list, stcb, sctp_tcblist);
1578         /*
1579          * Question, do we even need to worry about the ep-hash since we
1580          * only have one connection? Probably not :> so lets get rid of it
1581          * and not suck up any kernel memory in that.
1582          */
1583
1584         /* Ok. Let's restart timer. */
1585         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1586                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, new_inp,
1587                     stcb, net);
1588         }
1589
1590         SCTP_INP_INFO_WUNLOCK();
1591         if (new_inp->sctp_tcbhash != NULL) {
1592                 SCTP_HASH_FREE(new_inp->sctp_tcbhash, new_inp->sctp_hashmark);
1593                 new_inp->sctp_tcbhash = NULL;
1594         }
1595         if ((new_inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
1596                 /* Subset bound, so copy in the laddr list from the old_inp */
1597                 LIST_FOREACH(oladdr, &old_inp->sctp_addr_list, sctp_nxt_addr) {
1598                         laddr = (struct sctp_laddr *)SCTP_ZONE_GET(
1599                             sctppcbinfo.ipi_zone_laddr);
1600                         if (laddr == NULL) {
1601                                 /*
1602                                  * Gak, what can we do? This assoc is really
1603                                  * HOSED. We probably should send an abort
1604                                  * here.
1605                                  */
1606 #ifdef SCTP_DEBUG
1607                                 if (sctp_debug_on & SCTP_DEBUG_PCB1) {
1608                                         printf("Association hosed in TCP model, out of laddr memory\n");
1609                                 }
1610 #endif                          /* SCTP_DEBUG */
1611                                 continue;
1612                         }
1613                         SCTP_INCR_LADDR_COUNT();
1614                         bzero(laddr, sizeof(*laddr));
1615                         laddr->ifa = oladdr->ifa;
1616                         LIST_INSERT_HEAD(&new_inp->sctp_addr_list, laddr,
1617                             sctp_nxt_addr);
1618                         new_inp->laddr_count++;
1619                 }
1620         }
1621         /*
1622          * Now any running timers need to be adjusted since we really don't
1623          * care if they are running or not just blast in the new_inp into
1624          * all of them.
1625          */
1626
1627         stcb->asoc.hb_timer.ep = (void *)new_inp;
1628         stcb->asoc.dack_timer.ep = (void *)new_inp;
1629         stcb->asoc.asconf_timer.ep = (void *)new_inp;
1630         stcb->asoc.strreset_timer.ep = (void *)new_inp;
1631         stcb->asoc.shut_guard_timer.ep = (void *)new_inp;
1632         stcb->asoc.autoclose_timer.ep = (void *)new_inp;
1633         stcb->asoc.delayed_event_timer.ep = (void *)new_inp;
1634         /* now what about the nets? */
1635         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1636                 net->pmtu_timer.ep = (void *)new_inp;
1637                 net->rxt_timer.ep = (void *)new_inp;
1638                 net->fr_timer.ep = (void *)new_inp;
1639         }
1640         SCTP_INP_WUNLOCK(new_inp);
1641         SCTP_INP_WUNLOCK(old_inp);
1642 }
1643
1644 static int
1645 sctp_isport_inuse(struct sctp_inpcb *inp, uint16_t lport)
1646 {
1647         struct sctppcbhead *head;
1648         struct sctp_inpcb *t_inp;
1649
1650         head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport,
1651             sctppcbinfo.hashmark)];
1652
1653         LIST_FOREACH(t_inp, head, sctp_hash) {
1654                 if (t_inp->sctp_lport != lport) {
1655                         continue;
1656                 }
1657                 /* This one is in use. */
1658                 /* check the v6/v4 binding issue */
1659                 if ((t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1660                     SCTP_IPV6_V6ONLY(t_inp)) {
1661                         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1662                                 /* collision in V6 space */
1663                                 return (1);
1664                         } else {
1665                                 /* inp is BOUND_V4 no conflict */
1666                                 continue;
1667                         }
1668                 } else if (t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1669                         /* t_inp is bound v4 and v6, conflict always */
1670                         return (1);
1671                 } else {
1672                         /* t_inp is bound only V4 */
1673                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1674                             SCTP_IPV6_V6ONLY(t_inp)) {
1675                                 /* no conflict */
1676                                 continue;
1677                         }
1678                         /* else fall through to conflict */
1679                 }
1680                 return (1);
1681         }
1682         return (0);
1683 }
1684
1685
1686
1687 int
1688 sctp_inpcb_bind(struct socket *so, struct sockaddr *addr, struct thread *p)
1689 {
1690         /* bind a ep to a socket address */
1691         struct sctppcbhead *head;
1692         struct sctp_inpcb *inp, *inp_tmp;
1693         struct inpcb *ip_inp;
1694         int bindall;
1695         uint16_t lport;
1696         int error;
1697
1698         lport = 0;
1699         error = 0;
1700         bindall = 1;
1701         inp = (struct sctp_inpcb *)so->so_pcb;
1702         ip_inp = (struct inpcb *)so->so_pcb;
1703 #ifdef SCTP_DEBUG
1704         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
1705                 if (addr) {
1706                         printf("Bind called port:%d\n",
1707                             ntohs(((struct sockaddr_in *)addr)->sin_port));
1708                         printf("Addr :");
1709                         sctp_print_address(addr);
1710                 }
1711         }
1712 #endif                          /* SCTP_DEBUG */
1713         if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) == 0) {
1714                 /* already did a bind, subsequent binds NOT allowed ! */
1715                 return (EINVAL);
1716         }
1717         if (addr != NULL) {
1718                 if (addr->sa_family == AF_INET) {
1719                         struct sockaddr_in *sin;
1720
1721                         /* IPV6_V6ONLY socket? */
1722                         if (SCTP_IPV6_V6ONLY(ip_inp)) {
1723                                 return (EINVAL);
1724                         }
1725                         if (addr->sa_len != sizeof(*sin))
1726                                 return (EINVAL);
1727
1728                         sin = (struct sockaddr_in *)addr;
1729                         lport = sin->sin_port;
1730
1731                         if (sin->sin_addr.s_addr != INADDR_ANY) {
1732                                 bindall = 0;
1733                         }
1734                 } else if (addr->sa_family == AF_INET6) {
1735                         /* Only for pure IPv6 Address. (No IPv4 Mapped!) */
1736                         struct sockaddr_in6 *sin6;
1737
1738                         sin6 = (struct sockaddr_in6 *)addr;
1739
1740                         if (addr->sa_len != sizeof(*sin6))
1741                                 return (EINVAL);
1742
1743                         lport = sin6->sin6_port;
1744                         if (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1745                                 bindall = 0;
1746                                 /* KAME hack: embed scopeid */
1747                                 if (sa6_embedscope(sin6, ip6_use_defzone) != 0)
1748                                         return (EINVAL);
1749                         }
1750                         /* this must be cleared for ifa_ifwithaddr() */
1751                         sin6->sin6_scope_id = 0;
1752                 } else {
1753                         return (EAFNOSUPPORT);
1754                 }
1755         }
1756         SCTP_INP_INFO_WLOCK();
1757         SCTP_INP_WLOCK(inp);
1758         /* increase our count due to the unlock we do */
1759         SCTP_INP_INCR_REF(inp);
1760         if (lport) {
1761                 /*
1762                  * Did the caller specify a port? if so we must see if a ep
1763                  * already has this one bound.
1764                  */
1765                 /* got to be root to get at low ports */
1766                 if (ntohs(lport) < IPPORT_RESERVED) {
1767                         if (p && (error =
1768                             priv_check(p,
1769                             PRIV_NETINET_RESERVEDPORT)
1770                             )) {
1771                                 SCTP_INP_DECR_REF(inp);
1772                                 SCTP_INP_WUNLOCK(inp);
1773                                 SCTP_INP_INFO_WUNLOCK();
1774                                 return (error);
1775                         }
1776                 }
1777                 if (p == NULL) {
1778                         SCTP_INP_DECR_REF(inp);
1779                         SCTP_INP_WUNLOCK(inp);
1780                         SCTP_INP_INFO_WUNLOCK();
1781                         return (error);
1782                 }
1783                 SCTP_INP_WUNLOCK(inp);
1784                 inp_tmp = sctp_pcb_findep(addr, 0, 1);
1785                 if (inp_tmp != NULL) {
1786                         /*
1787                          * lock guy returned and lower count note that we
1788                          * are not bound so inp_tmp should NEVER be inp. And
1789                          * it is this inp (inp_tmp) that gets the reference
1790                          * bump, so we must lower it.
1791                          */
1792                         SCTP_INP_DECR_REF(inp_tmp);
1793                         SCTP_INP_DECR_REF(inp);
1794                         /* unlock info */
1795                         SCTP_INP_INFO_WUNLOCK();
1796                         return (EADDRNOTAVAIL);
1797                 }
1798                 SCTP_INP_WLOCK(inp);
1799                 if (bindall) {
1800                         /* verify that no lport is not used by a singleton */
1801                         if (sctp_isport_inuse(inp, lport)) {
1802                                 /* Sorry someone already has this one bound */
1803                                 SCTP_INP_DECR_REF(inp);
1804                                 SCTP_INP_WUNLOCK(inp);
1805                                 SCTP_INP_INFO_WUNLOCK();
1806                                 return (EADDRNOTAVAIL);
1807                         }
1808                 }
1809         } else {
1810                 /*
1811                  * get any port but lets make sure no one has any address
1812                  * with this port bound
1813                  */
1814
1815                 /*
1816                  * setup the inp to the top (I could use the union but this
1817                  * is just as easy
1818                  */
1819                 uint32_t port_guess;
1820                 uint16_t port_attempt;
1821                 int not_done = 1;
1822
1823                 while (not_done) {
1824                         port_guess = sctp_select_initial_TSN(&inp->sctp_ep);
1825                         port_attempt = (port_guess & 0x0000ffff);
1826                         if (port_attempt == 0) {
1827                                 goto next_half;
1828                         }
1829                         if (port_attempt < IPPORT_RESERVED) {
1830                                 port_attempt += IPPORT_RESERVED;
1831                         }
1832                         if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) {
1833                                 /* got a port we can use */
1834                                 not_done = 0;
1835                                 continue;
1836                         }
1837                         /* try upper half */
1838         next_half:
1839                         port_attempt = ((port_guess >> 16) & 0x0000ffff);
1840                         if (port_attempt == 0) {
1841                                 goto last_try;
1842                         }
1843                         if (port_attempt < IPPORT_RESERVED) {
1844                                 port_attempt += IPPORT_RESERVED;
1845                         }
1846                         if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) {
1847                                 /* got a port we can use */
1848                                 not_done = 0;
1849                                 continue;
1850                         }
1851                         /* try two half's added together */
1852         last_try:
1853                         port_attempt = (((port_guess >> 16) & 0x0000ffff) +
1854                             (port_guess & 0x0000ffff));
1855                         if (port_attempt == 0) {
1856                                 /* get a new random number */
1857                                 continue;
1858                         }
1859                         if (port_attempt < IPPORT_RESERVED) {
1860                                 port_attempt += IPPORT_RESERVED;
1861                         }
1862                         if (sctp_isport_inuse(inp, htons(port_attempt)) == 0) {
1863                                 /* got a port we can use */
1864                                 not_done = 0;
1865                                 continue;
1866                         }
1867                 }
1868                 /* we don't get out of the loop until we have a port */
1869                 lport = htons(port_attempt);
1870         }
1871         SCTP_INP_DECR_REF(inp);
1872         if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE |
1873             SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
1874                 /*
1875                  * this really should not happen. The guy did a non-blocking
1876                  * bind and then did a close at the same time.
1877                  */
1878                 SCTP_INP_WUNLOCK(inp);
1879                 SCTP_INP_INFO_WUNLOCK();
1880                 return (EINVAL);
1881         }
1882         /* ok we look clear to give out this port, so lets setup the binding */
1883         if (bindall) {
1884                 /* binding to all addresses, so just set in the proper flags */
1885                 inp->sctp_flags |= SCTP_PCB_FLAGS_BOUNDALL;
1886                 sctp_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF);
1887                 /* set the automatic addr changes from kernel flag */
1888                 if (sctp_auto_asconf == 0) {
1889                         sctp_feature_off(inp, SCTP_PCB_FLAGS_AUTO_ASCONF);
1890                 } else {
1891                         sctp_feature_on(inp, SCTP_PCB_FLAGS_AUTO_ASCONF);
1892                 }
1893         } else {
1894                 /*
1895                  * bind specific, make sure flags is off and add a new
1896                  * address structure to the sctp_addr_list inside the ep
1897                  * structure.
1898                  *
1899                  * We will need to allocate one and insert it at the head. The
1900                  * socketopt call can just insert new addresses in there as
1901                  * well. It will also have to do the embed scope kame hack
1902                  * too (before adding).
1903                  */
1904                 struct ifaddr *ifa;
1905                 struct sockaddr_storage store_sa;
1906
1907                 memset(&store_sa, 0, sizeof(store_sa));
1908                 if (addr->sa_family == AF_INET) {
1909                         struct sockaddr_in *sin;
1910
1911                         sin = (struct sockaddr_in *)&store_sa;
1912                         memcpy(sin, addr, sizeof(struct sockaddr_in));
1913                         sin->sin_port = 0;
1914                 } else if (addr->sa_family == AF_INET6) {
1915                         struct sockaddr_in6 *sin6;
1916
1917                         sin6 = (struct sockaddr_in6 *)&store_sa;
1918                         memcpy(sin6, addr, sizeof(struct sockaddr_in6));
1919                         sin6->sin6_port = 0;
1920                 }
1921                 /*
1922                  * first find the interface with the bound address need to
1923                  * zero out the port to find the address! yuck! can't do
1924                  * this earlier since need port for sctp_pcb_findep()
1925                  */
1926                 ifa = sctp_find_ifa_by_addr((struct sockaddr *)&store_sa);
1927                 if (ifa == NULL) {
1928                         /* Can't find an interface with that address */
1929                         SCTP_INP_WUNLOCK(inp);
1930                         SCTP_INP_INFO_WUNLOCK();
1931                         return (EADDRNOTAVAIL);
1932                 }
1933                 if (addr->sa_family == AF_INET6) {
1934                         struct in6_ifaddr *ifa6;
1935
1936                         ifa6 = (struct in6_ifaddr *)ifa;
1937                         /*
1938                          * allow binding of deprecated addresses as per RFC
1939                          * 2462 and ipng discussion
1940                          */
1941                         if (ifa6->ia6_flags & (IN6_IFF_DETACHED |
1942                             IN6_IFF_ANYCAST |
1943                             IN6_IFF_NOTREADY)) {
1944                                 /* Can't bind a non-existent addr. */
1945                                 SCTP_INP_WUNLOCK(inp);
1946                                 SCTP_INP_INFO_WUNLOCK();
1947                                 return (EINVAL);
1948                         }
1949                 }
1950                 /* we're not bound all */
1951                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_BOUNDALL;
1952                 /* set the automatic addr changes from kernel flag */
1953                 if (sctp_auto_asconf == 0) {
1954                         sctp_feature_off(inp, SCTP_PCB_FLAGS_AUTO_ASCONF);
1955                 } else {
1956                         sctp_feature_on(inp, SCTP_PCB_FLAGS_AUTO_ASCONF);
1957                 }
1958                 /* allow bindx() to send ASCONF's for binding changes */
1959                 sctp_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF);
1960                 /* add this address to the endpoint list */
1961                 error = sctp_insert_laddr(&inp->sctp_addr_list, ifa);
1962                 if (error != 0) {
1963                         SCTP_INP_WUNLOCK(inp);
1964                         SCTP_INP_INFO_WUNLOCK();
1965                         return (error);
1966                 }
1967                 inp->laddr_count++;
1968         }
1969         /* find the bucket */
1970         head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport,
1971             sctppcbinfo.hashmark)];
1972         /* put it in the bucket */
1973         LIST_INSERT_HEAD(head, inp, sctp_hash);
1974 #ifdef SCTP_DEBUG
1975         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
1976                 printf("Main hash to bind at head:%p, bound port:%d\n", head, ntohs(lport));
1977         }
1978 #endif
1979         /* set in the port */
1980         inp->sctp_lport = lport;
1981
1982         /* turn off just the unbound flag */
1983         inp->sctp_flags &= ~SCTP_PCB_FLAGS_UNBOUND;
1984         SCTP_INP_WUNLOCK(inp);
1985         SCTP_INP_INFO_WUNLOCK();
1986         return (0);
1987 }
1988
1989
1990 static void
1991 sctp_iterator_inp_being_freed(struct sctp_inpcb *inp, struct sctp_inpcb *inp_next)
1992 {
1993         struct sctp_iterator *it;
1994
1995         /*
1996          * We enter with the only the ITERATOR_LOCK in place and a write
1997          * lock on the inp_info stuff.
1998          */
1999
2000         /*
2001          * Go through all iterators, we must do this since it is possible
2002          * that some iterator does NOT have the lock, but is waiting for it.
2003          * And the one that had the lock has either moved in the last
2004          * iteration or we just cleared it above. We need to find all of
2005          * those guys. The list of iterators should never be very big
2006          * though.
2007          */
2008         LIST_FOREACH(it, &sctppcbinfo.iteratorhead, sctp_nxt_itr) {
2009                 if (it == inp->inp_starting_point_for_iterator)
2010                         /* skip this guy, he's special */
2011                         continue;
2012                 if (it->inp == inp) {
2013                         /*
2014                          * This is tricky and we DON'T lock the iterator.
2015                          * Reason is he's running but waiting for me since
2016                          * inp->inp_starting_point_for_iterator has the lock
2017                          * on me (the guy above we skipped). This tells us
2018                          * its is not running but waiting for
2019                          * inp->inp_starting_point_for_iterator to be
2020                          * released by the guy that does have our INP in a
2021                          * lock.
2022                          */
2023                         if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
2024                                 it->inp = NULL;
2025                                 it->stcb = NULL;
2026                         } else {
2027                                 /* set him up to do the next guy not me */
2028                                 it->inp = inp_next;
2029                                 it->stcb = NULL;
2030                         }
2031                 }
2032         }
2033         it = inp->inp_starting_point_for_iterator;
2034         if (it) {
2035                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
2036                         it->inp = NULL;
2037                 } else {
2038                         it->inp = inp_next;
2039                 }
2040                 it->stcb = NULL;
2041         }
2042 }
2043
2044 /* release sctp_inpcb unbind the port */
2045 void
2046 sctp_inpcb_free(struct sctp_inpcb *inp, int immediate, int from)
2047 {
2048         /*
2049          * Here we free a endpoint. We must find it (if it is in the Hash
2050          * table) and remove it from there. Then we must also find it in the
2051          * overall list and remove it from there. After all removals are
2052          * complete then any timer has to be stopped. Then start the actual
2053          * freeing. a) Any local lists. b) Any associations. c) The hash of
2054          * all associations. d) finally the ep itself.
2055          */
2056         struct sctp_pcb *m;
2057         struct sctp_inpcb *inp_save;
2058         struct sctp_tcb *asoc, *nasoc;
2059         struct sctp_laddr *laddr, *nladdr;
2060         struct inpcb *ip_pcb;
2061         struct socket *so;
2062
2063         struct sctp_queued_to_read *sq;
2064
2065         int s, cnt;
2066         sctp_sharedkey_t *shared_key;
2067
2068         s = splnet();
2069
2070 #ifdef SCTP_LOG_CLOSING
2071         sctp_log_closing(inp, NULL, 0);
2072 #endif
2073
2074         SCTP_ITERATOR_LOCK();
2075         so = inp->sctp_socket;
2076         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
2077                 /* been here before.. eeks.. get out of here */
2078                 splx(s);
2079                 printf("This conflict in free SHOULD not be happening!\n");
2080                 SCTP_ITERATOR_UNLOCK();
2081 #ifdef SCTP_LOG_CLOSING
2082                 sctp_log_closing(inp, NULL, 1);
2083 #endif
2084                 return;
2085         }
2086         SCTP_ASOC_CREATE_LOCK(inp);
2087         SCTP_INP_INFO_WLOCK();
2088
2089         SCTP_INP_WLOCK(inp);
2090         /*
2091          * First time through we have the socket lock, after that no more.
2092          */
2093         if (from == 1) {
2094                 /*
2095                  * Once we are in we can remove the flag from = 1 is only
2096                  * passed from the actual closing routines that are called
2097                  * via the sockets layer.
2098                  */
2099                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_CLOSE_IP;
2100         }
2101         sctp_timer_stop(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL,
2102             SCTP_FROM_SCTP_PCB + SCTP_LOC_1);
2103
2104         if (inp->control) {
2105                 sctp_m_freem(inp->control);
2106                 inp->control = NULL;
2107         }
2108         if (inp->pkt) {
2109                 sctp_m_freem(inp->pkt);
2110                 inp->pkt = NULL;
2111         }
2112         m = &inp->sctp_ep;
2113         ip_pcb = &inp->ip_inp.inp;      /* we could just cast the main pointer
2114                                          * here but I will be nice :> (i.e.
2115                                          * ip_pcb = ep;) */
2116         if (immediate == 0) {
2117                 int cnt_in_sd;
2118
2119                 cnt_in_sd = 0;
2120                 for ((asoc = LIST_FIRST(&inp->sctp_asoc_list)); asoc != NULL;
2121                     asoc = nasoc) {
2122                         nasoc = LIST_NEXT(asoc, sctp_tcblist);
2123                         if (asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
2124                                 /* Skip guys being freed */
2125                                 asoc->sctp_socket = NULL;
2126                                 cnt_in_sd++;
2127                                 continue;
2128                         }
2129                         if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_COOKIE_WAIT) ||
2130                             (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_COOKIE_ECHOED)) {
2131                                 /* Just abandon things in the front states */
2132                                 if (asoc->asoc.total_output_queue_size == 0) {
2133                                         sctp_free_assoc(inp, asoc, SCTP_PCBFREE_NOFORCE, SCTP_FROM_SCTP_PCB + SCTP_LOC_2);
2134                                         continue;
2135                                 }
2136                         }
2137                         SCTP_TCB_LOCK(asoc);
2138                         /* Disconnect the socket please */
2139                         asoc->sctp_socket = NULL;
2140                         asoc->asoc.state |= SCTP_STATE_CLOSED_SOCKET;
2141                         if ((asoc->asoc.size_on_reasm_queue > 0) ||
2142                             (asoc->asoc.control_pdapi) ||
2143                             (asoc->asoc.size_on_all_streams > 0) ||
2144                             (so && (so->so_rcv.sb_cc > 0))
2145                             ) {
2146                                 /* Left with Data unread */
2147                                 struct mbuf *op_err;
2148
2149                                 op_err = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)),
2150                                     0, M_DONTWAIT, 1, MT_DATA);
2151                                 if (op_err) {
2152                                         /* Fill in the user initiated abort */
2153                                         struct sctp_paramhdr *ph;
2154                                         uint32_t *ippp;
2155
2156                                         SCTP_BUF_LEN(op_err) =
2157                                             sizeof(struct sctp_paramhdr) + sizeof(uint32_t);
2158                                         ph = mtod(op_err,
2159                                             struct sctp_paramhdr *);
2160                                         ph->param_type = htons(
2161                                             SCTP_CAUSE_USER_INITIATED_ABT);
2162                                         ph->param_length = htons(SCTP_BUF_LEN(op_err));
2163                                         ippp = (uint32_t *) (ph + 1);
2164                                         *ippp = htonl(SCTP_FROM_SCTP_PCB + SCTP_LOC_3);
2165                                 }
2166                                 asoc->sctp_ep->last_abort_code = SCTP_FROM_SCTP_PCB + SCTP_LOC_3;
2167                                 sctp_send_abort_tcb(asoc, op_err);
2168                                 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
2169                                 if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_OPEN) ||
2170                                     (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2171                                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
2172                                 }
2173                                 sctp_free_assoc(inp, asoc, SCTP_PCBFREE_NOFORCE, SCTP_FROM_SCTP_PCB + SCTP_LOC_4);
2174                                 continue;
2175                         } else if (TAILQ_EMPTY(&asoc->asoc.send_queue) &&
2176                                     TAILQ_EMPTY(&asoc->asoc.sent_queue) &&
2177                                     (asoc->asoc.stream_queue_cnt == 0)
2178                             ) {
2179                                 if (asoc->asoc.locked_on_sending) {
2180                                         goto abort_anyway;
2181                                 }
2182                                 if ((SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
2183                                     (SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
2184                                         /*
2185                                          * there is nothing queued to send,
2186                                          * so I send shutdown
2187                                          */
2188                                         sctp_send_shutdown(asoc, asoc->asoc.primary_destination);
2189                                         asoc->asoc.state = SCTP_STATE_SHUTDOWN_SENT;
2190                                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
2191                                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, asoc->sctp_ep, asoc,
2192                                             asoc->asoc.primary_destination);
2193                                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, asoc->sctp_ep, asoc,
2194                                             asoc->asoc.primary_destination);
2195                                         sctp_chunk_output(inp, asoc, SCTP_OUTPUT_FROM_SHUT_TMR);
2196                                 }
2197                         } else {
2198                                 /* mark into shutdown pending */
2199                                 struct sctp_stream_queue_pending *sp;
2200
2201                                 asoc->asoc.state |= SCTP_STATE_SHUTDOWN_PENDING;
2202                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, asoc->sctp_ep, asoc,
2203                                     asoc->asoc.primary_destination);
2204                                 if (asoc->asoc.locked_on_sending) {
2205                                         sp = TAILQ_LAST(&((asoc->asoc.locked_on_sending)->outqueue),
2206                                             sctp_streamhead);
2207                                         if (sp == NULL) {
2208                                                 printf("Error, sp is NULL, locked on sending is %p strm:%d\n",
2209                                                     asoc->asoc.locked_on_sending,
2210                                                     asoc->asoc.locked_on_sending->stream_no);
2211                                         } else {
2212                                                 if ((sp->length == 0) && (sp->msg_is_complete == 0))
2213                                                         asoc->asoc.state |= SCTP_STATE_PARTIAL_MSG_LEFT;
2214                                         }
2215                                 }
2216                                 if (TAILQ_EMPTY(&asoc->asoc.send_queue) &&
2217                                     TAILQ_EMPTY(&asoc->asoc.sent_queue) &&
2218                                     (asoc->asoc.state & SCTP_STATE_PARTIAL_MSG_LEFT)) {
2219                                         struct mbuf *op_err;
2220
2221                         abort_anyway:
2222                                         op_err = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)),
2223                                             0, M_DONTWAIT, 1, MT_DATA);
2224                                         if (op_err) {
2225                                                 /*
2226                                                  * Fill in the user
2227                                                  * initiated abort
2228                                                  */
2229                                                 struct sctp_paramhdr *ph;
2230                                                 uint32_t *ippp;
2231
2232                                                 SCTP_BUF_LEN(op_err) =
2233                                                     (sizeof(struct sctp_paramhdr) +
2234                                                     sizeof(uint32_t));
2235                                                 ph = mtod(op_err,
2236                                                     struct sctp_paramhdr *);
2237                                                 ph->param_type = htons(
2238                                                     SCTP_CAUSE_USER_INITIATED_ABT);
2239                                                 ph->param_length = htons(SCTP_BUF_LEN(op_err));
2240                                                 ippp = (uint32_t *) (ph + 1);
2241                                                 *ippp = htonl(SCTP_FROM_SCTP_PCB + SCTP_LOC_5);
2242                                         }
2243                                         asoc->sctp_ep->last_abort_code = SCTP_FROM_SCTP_PCB + SCTP_LOC_5;
2244                                         sctp_send_abort_tcb(asoc, op_err);
2245                                         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
2246                                         if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_OPEN) ||
2247                                             (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2248                                                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
2249                                         }
2250                                         sctp_free_assoc(inp, asoc, SCTP_PCBFREE_NOFORCE, SCTP_FROM_SCTP_PCB + SCTP_LOC_6);
2251                                         continue;
2252                                 }
2253                         }
2254                         cnt_in_sd++;
2255                         SCTP_TCB_UNLOCK(asoc);
2256                 }
2257                 /* now is there some left in our SHUTDOWN state? */
2258                 if (cnt_in_sd) {
2259                         splx(s);
2260
2261                         SCTP_INP_WUNLOCK(inp);
2262                         SCTP_ASOC_CREATE_UNLOCK(inp);
2263                         SCTP_INP_INFO_WUNLOCK();
2264                         SCTP_ITERATOR_UNLOCK();
2265 #ifdef SCTP_LOG_CLOSING
2266                         sctp_log_closing(inp, NULL, 2);
2267 #endif
2268                         return;
2269                 }
2270         }
2271         inp->sctp_socket = NULL;
2272         if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) !=
2273             SCTP_PCB_FLAGS_UNBOUND) {
2274                 /*
2275                  * ok, this guy has been bound. It's port is somewhere in
2276                  * the sctppcbinfo hash table. Remove it!
2277                  */
2278                 LIST_REMOVE(inp, sctp_hash);
2279                 inp->sctp_flags |= SCTP_PCB_FLAGS_UNBOUND;
2280         }
2281         /*
2282          * If there is a timer running to kill us, forget it, since it may
2283          * have a contest on the INP lock.. which would cause us to die ...
2284          */
2285         cnt = 0;
2286         for ((asoc = LIST_FIRST(&inp->sctp_asoc_list)); asoc != NULL;
2287             asoc = nasoc) {
2288                 nasoc = LIST_NEXT(asoc, sctp_tcblist);
2289                 if (asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
2290                         cnt++;
2291                         continue;
2292                 }
2293                 /* Free associations that are NOT killing us */
2294                 SCTP_TCB_LOCK(asoc);
2295                 if ((SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_COOKIE_WAIT) &&
2296                     ((asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0)) {
2297                         struct mbuf *op_err;
2298                         uint32_t *ippp;
2299
2300                         op_err = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)),
2301                             0, M_DONTWAIT, 1, MT_DATA);
2302                         if (op_err) {
2303                                 /* Fill in the user initiated abort */
2304                                 struct sctp_paramhdr *ph;
2305
2306                                 SCTP_BUF_LEN(op_err) = (sizeof(struct sctp_paramhdr) +
2307                                     sizeof(uint32_t));
2308                                 ph = mtod(op_err, struct sctp_paramhdr *);
2309                                 ph->param_type = htons(
2310                                     SCTP_CAUSE_USER_INITIATED_ABT);
2311                                 ph->param_length = htons(SCTP_BUF_LEN(op_err));
2312                                 ippp = (uint32_t *) (ph + 1);
2313                                 *ippp = htonl(SCTP_FROM_SCTP_PCB + SCTP_LOC_7);
2314
2315                         }
2316                         asoc->sctp_ep->last_abort_code = SCTP_FROM_SCTP_PCB + SCTP_LOC_7;
2317                         sctp_send_abort_tcb(asoc, op_err);
2318                         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
2319                 } else if (asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
2320                         cnt++;
2321                         SCTP_TCB_UNLOCK(asoc);
2322                         continue;
2323                 }
2324                 if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_OPEN) ||
2325                     (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2326                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
2327                 }
2328                 sctp_free_assoc(inp, asoc, SCTP_PCBFREE_FORCE, SCTP_FROM_SCTP_PCB + SCTP_LOC_8);
2329         }
2330         if (cnt) {
2331                 /* Ok we have someone out there that will kill us */
2332                 SCTP_OS_TIMER_STOP(&inp->sctp_ep.signature_change.timer);
2333                 SCTP_INP_WUNLOCK(inp);
2334                 SCTP_ASOC_CREATE_UNLOCK(inp);
2335                 SCTP_INP_INFO_WUNLOCK();
2336                 SCTP_ITERATOR_UNLOCK();
2337 #ifdef SCTP_LOG_CLOSING
2338                 sctp_log_closing(inp, NULL, 3);
2339 #endif
2340                 return;
2341         }
2342         if ((inp->refcount) || (inp->sctp_flags & SCTP_PCB_FLAGS_CLOSE_IP)) {
2343                 SCTP_OS_TIMER_STOP(&inp->sctp_ep.signature_change.timer);
2344                 sctp_timer_start(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL);
2345                 SCTP_INP_WUNLOCK(inp);
2346                 SCTP_ASOC_CREATE_UNLOCK(inp);
2347                 SCTP_INP_INFO_WUNLOCK();
2348                 SCTP_ITERATOR_UNLOCK();
2349 #ifdef SCTP_LOG_CLOSING
2350                 sctp_log_closing(inp, NULL, 4);
2351 #endif
2352                 return;
2353         }
2354         SCTP_OS_TIMER_STOP(&inp->sctp_ep.signature_change.timer);
2355         inp->sctp_ep.signature_change.type = 0;
2356         inp->sctp_flags |= SCTP_PCB_FLAGS_SOCKET_ALLGONE;
2357
2358 #ifdef SCTP_LOG_CLOSING
2359         sctp_log_closing(inp, NULL, 5);
2360 #endif
2361
2362         SCTP_OS_TIMER_STOP(&inp->sctp_ep.signature_change.timer);
2363         inp->sctp_ep.signature_change.type = SCTP_TIMER_TYPE_NONE;
2364         /* Clear the read queue */
2365         while ((sq = TAILQ_FIRST(&inp->read_queue)) != NULL) {
2366                 TAILQ_REMOVE(&inp->read_queue, sq, next);
2367                 sctp_free_remote_addr(sq->whoFrom);
2368                 if (so)
2369                         so->so_rcv.sb_cc -= sq->length;
2370                 if (sq->data) {
2371                         sctp_m_freem(sq->data);
2372                         sq->data = NULL;
2373                 }
2374                 /*
2375                  * no need to free the net count, since at this point all
2376                  * assoc's are gone.
2377                  */
2378                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_readq, sq);
2379                 SCTP_DECR_READQ_COUNT();
2380         }
2381         /* Now the sctp_pcb things */
2382         /*
2383          * free each asoc if it is not already closed/free. we can't use the
2384          * macro here since le_next will get freed as part of the
2385          * sctp_free_assoc() call.
2386          */
2387         cnt = 0;
2388         if (so) {
2389 #ifdef IPSEC
2390                 ipsec4_delete_pcbpolicy(ip_pcb);
2391 #endif                          /* IPSEC */
2392
2393                 /* Unlocks not needed since the socket is gone now */
2394         }
2395         if (ip_pcb->inp_options) {
2396                 (void)sctp_m_free(ip_pcb->inp_options);
2397                 ip_pcb->inp_options = 0;
2398         }
2399         if (ip_pcb->inp_moptions) {
2400                 ip_freemoptions(ip_pcb->inp_moptions);
2401                 ip_pcb->inp_moptions = 0;
2402         }
2403 #ifdef INET6
2404         if (ip_pcb->inp_vflag & INP_IPV6) {
2405                 struct in6pcb *in6p;
2406
2407                 in6p = (struct in6pcb *)inp;
2408                 ip6_freepcbopts(in6p->in6p_outputopts);
2409         }
2410 #endif                          /* INET6 */
2411         ip_pcb->inp_vflag = 0;
2412         /* free up authentication fields */
2413         if (inp->sctp_ep.local_auth_chunks != NULL)
2414                 sctp_free_chunklist(inp->sctp_ep.local_auth_chunks);
2415         if (inp->sctp_ep.local_hmacs != NULL)
2416                 sctp_free_hmaclist(inp->sctp_ep.local_hmacs);
2417
2418         shared_key = LIST_FIRST(&inp->sctp_ep.shared_keys);
2419         while (shared_key) {
2420                 LIST_REMOVE(shared_key, next);
2421                 sctp_free_sharedkey(shared_key);
2422                 shared_key = LIST_FIRST(&inp->sctp_ep.shared_keys);
2423         }
2424
2425         inp_save = LIST_NEXT(inp, sctp_list);
2426         LIST_REMOVE(inp, sctp_list);
2427
2428         /* fix any iterators only after out of the list */
2429         sctp_iterator_inp_being_freed(inp, inp_save);
2430         /*
2431          * if we have an address list the following will free the list of
2432          * ifaddr's that are set into this ep. Again macro limitations here,
2433          * since the LIST_FOREACH could be a bad idea.
2434          */
2435         for ((laddr = LIST_FIRST(&inp->sctp_addr_list)); laddr != NULL;
2436             laddr = nladdr) {
2437                 nladdr = LIST_NEXT(laddr, sctp_nxt_addr);
2438                 LIST_REMOVE(laddr, sctp_nxt_addr);
2439                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr);
2440                 SCTP_DECR_LADDR_COUNT();
2441         }
2442
2443 #ifdef SCTP_TRACK_FREED_ASOCS
2444         /* TEMP CODE */
2445         for ((asoc = LIST_FIRST(&inp->sctp_asoc_free_list)); asoc != NULL;
2446             asoc = nasoc) {
2447                 nasoc = LIST_NEXT(asoc, sctp_tcblist);
2448                 LIST_REMOVE(asoc, sctp_tcblist);
2449                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, asoc);
2450                 SCTP_DECR_ASOC_COUNT();
2451         }
2452         /* *** END TEMP CODE *** */
2453 #endif
2454         /* Now lets see about freeing the EP hash table. */
2455         if (inp->sctp_tcbhash != NULL) {
2456                 SCTP_HASH_FREE(inp->sctp_tcbhash, inp->sctp_hashmark);
2457                 inp->sctp_tcbhash = NULL;
2458         }
2459         /* Now we must put the ep memory back into the zone pool */
2460         SCTP_INP_LOCK_DESTROY(inp);
2461         SCTP_INP_READ_DESTROY(inp);
2462         SCTP_ASOC_CREATE_LOCK_DESTROY(inp);
2463         SCTP_INP_INFO_WUNLOCK();
2464
2465         SCTP_ITERATOR_UNLOCK();
2466
2467         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp);
2468         SCTP_DECR_EP_COUNT();
2469
2470         splx(s);
2471 }
2472
2473
2474 struct sctp_nets *
2475 sctp_findnet(struct sctp_tcb *stcb, struct sockaddr *addr)
2476 {
2477         struct sctp_nets *net;
2478
2479         /* locate the address */
2480         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2481                 if (sctp_cmpaddr(addr, (struct sockaddr *)&net->ro._l_addr))
2482                         return (net);
2483         }
2484         return (NULL);
2485 }
2486
2487
2488 /*
2489  * add's a remote endpoint address, done with the INIT/INIT-ACK as well as
2490  * when a ASCONF arrives that adds it. It will also initialize all the cwnd
2491  * stats of stuff.
2492  */
2493 int
2494 sctp_is_address_on_local_host(struct sockaddr *addr)
2495 {
2496         struct ifnet *ifn;
2497         struct ifaddr *ifa;
2498
2499         TAILQ_FOREACH(ifn, &ifnet, if_list) {
2500                 TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
2501                         if (addr->sa_family == ifa->ifa_addr->sa_family) {
2502                                 /* same family */
2503                                 if (addr->sa_family == AF_INET) {
2504                                         struct sockaddr_in *sin, *sin_c;
2505
2506                                         sin = (struct sockaddr_in *)addr;
2507                                         sin_c = (struct sockaddr_in *)
2508                                             ifa->ifa_addr;
2509                                         if (sin->sin_addr.s_addr ==
2510                                             sin_c->sin_addr.s_addr) {
2511                                                 /*
2512                                                  * we are on the same
2513                                                  * machine
2514                                                  */
2515                                                 return (1);
2516                                         }
2517                                 } else if (addr->sa_family == AF_INET6) {
2518                                         struct sockaddr_in6 *sin6, *sin_c6;
2519
2520                                         sin6 = (struct sockaddr_in6 *)addr;
2521                                         sin_c6 = (struct sockaddr_in6 *)
2522                                             ifa->ifa_addr;
2523                                         if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
2524                                             &sin_c6->sin6_addr)) {
2525                                                 /*
2526                                                  * we are on the same
2527                                                  * machine
2528                                                  */
2529                                                 return (1);
2530                                         }
2531                                 }
2532                         }
2533                 }
2534         }
2535         return (0);
2536 }
2537
2538 int
2539 sctp_add_remote_addr(struct sctp_tcb *stcb, struct sockaddr *newaddr,
2540     int set_scope, int from)
2541 {
2542         /*
2543          * The following is redundant to the same lines in the
2544          * sctp_aloc_assoc() but is needed since other's call the add
2545          * address function
2546          */
2547         struct sctp_nets *net, *netfirst;
2548         int addr_inscope;
2549
2550 #ifdef SCTP_DEBUG
2551         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
2552                 printf("Adding an address (from:%d) to the peer: ", from);
2553                 sctp_print_address(newaddr);
2554         }
2555 #endif
2556
2557         netfirst = sctp_findnet(stcb, newaddr);
2558         if (netfirst) {
2559                 /*
2560                  * Lie and return ok, we don't want to make the association
2561                  * go away for this behavior. It will happen in the TCP
2562                  * model in a connected socket. It does not reach the hash
2563                  * table until after the association is built so it can't be
2564                  * found. Mark as reachable, since the initial creation will
2565                  * have been cleared and the NOT_IN_ASSOC flag will have
2566                  * been added... and we don't want to end up removing it
2567                  * back out.
2568                  */
2569                 if (netfirst->dest_state & SCTP_ADDR_UNCONFIRMED) {
2570                         netfirst->dest_state = (SCTP_ADDR_REACHABLE |
2571                             SCTP_ADDR_UNCONFIRMED);
2572                 } else {
2573                         netfirst->dest_state = SCTP_ADDR_REACHABLE;
2574                 }
2575
2576                 return (0);
2577         }
2578         addr_inscope = 1;
2579         if (newaddr->sa_family == AF_INET) {
2580                 struct sockaddr_in *sin;
2581
2582                 sin = (struct sockaddr_in *)newaddr;
2583                 if (sin->sin_addr.s_addr == 0) {
2584                         /* Invalid address */
2585                         return (-1);
2586                 }
2587                 /* zero out the bzero area */
2588                 memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
2589
2590                 /* assure len is set */
2591                 sin->sin_len = sizeof(struct sockaddr_in);
2592                 if (set_scope) {
2593 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE
2594                         stcb->ipv4_local_scope = 1;
2595 #else
2596                         if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2597                                 stcb->asoc.ipv4_local_scope = 1;
2598                         }
2599 #endif                          /* SCTP_DONT_DO_PRIVADDR_SCOPE */
2600
2601                         if (sctp_is_address_on_local_host(newaddr)) {
2602                                 stcb->asoc.loopback_scope = 1;
2603                                 stcb->asoc.ipv4_local_scope = 1;
2604                                 stcb->asoc.local_scope = 1;
2605                                 stcb->asoc.site_scope = 1;
2606                         }
2607                 } else {
2608                         if (from == SCTP_ADDR_IS_CONFIRMED) {
2609                                 /* From connectx */
2610                                 if (sctp_is_address_on_local_host(newaddr)) {
2611                                         stcb->asoc.loopback_scope = 1;
2612                                         stcb->asoc.ipv4_local_scope = 1;
2613                                         stcb->asoc.local_scope = 1;
2614                                         stcb->asoc.site_scope = 1;
2615                                 }
2616                         }
2617                         /* Validate the address is in scope */
2618                         if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) &&
2619                             (stcb->asoc.ipv4_local_scope == 0)) {
2620                                 addr_inscope = 0;
2621                         }
2622                 }
2623         } else if (newaddr->sa_family == AF_INET6) {
2624                 struct sockaddr_in6 *sin6;
2625
2626                 sin6 = (struct sockaddr_in6 *)newaddr;
2627                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2628                         /* Invalid address */
2629                         return (-1);
2630                 }
2631                 /* assure len is set */
2632                 sin6->sin6_len = sizeof(struct sockaddr_in6);
2633                 if (set_scope) {
2634                         if (sctp_is_address_on_local_host(newaddr)) {
2635                                 stcb->asoc.loopback_scope = 1;
2636                                 stcb->asoc.local_scope = 1;
2637                                 stcb->asoc.ipv4_local_scope = 1;
2638                                 stcb->asoc.site_scope = 1;
2639                         } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2640                                 /*
2641                                  * If the new destination is a LINK_LOCAL we
2642                                  * must have common site scope. Don't set
2643                                  * the local scope since we may not share
2644                                  * all links, only loopback can do this.
2645                                  * Links on the local network would also be
2646                                  * on our private network for v4 too.
2647                                  */
2648                                 stcb->asoc.ipv4_local_scope = 1;
2649                                 stcb->asoc.site_scope = 1;
2650                         } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
2651                                 /*
2652                                  * If the new destination is SITE_LOCAL then
2653                                  * we must have site scope in common.
2654                                  */
2655                                 stcb->asoc.site_scope = 1;
2656                         }
2657                 } else {
2658                         if (from == SCTP_ADDR_IS_CONFIRMED) {
2659                                 /* From connectx so we check for localhost. */
2660                                 if (sctp_is_address_on_local_host(newaddr)) {
2661                                         stcb->asoc.loopback_scope = 1;
2662                                         stcb->asoc.ipv4_local_scope = 1;
2663                                         stcb->asoc.local_scope = 1;
2664                                         stcb->asoc.site_scope = 1;
2665                                 }
2666                         }
2667                         /* Validate the address is in scope */
2668                         if (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr) &&
2669                             (stcb->asoc.loopback_scope == 0)) {
2670                                 addr_inscope = 0;
2671                         } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) &&
2672                             (stcb->asoc.local_scope == 0)) {
2673                                 addr_inscope = 0;
2674                         } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr) &&
2675                             (stcb->asoc.site_scope == 0)) {
2676                                 addr_inscope = 0;
2677                         }
2678                 }
2679         } else {
2680                 /* not supported family type */
2681                 return (-1);
2682         }
2683         net = (struct sctp_nets *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_net);
2684         if (net == NULL) {
2685                 return (-1);
2686         }
2687         SCTP_INCR_RADDR_COUNT();
2688         bzero(net, sizeof(*net));
2689         memcpy(&net->ro._l_addr, newaddr, newaddr->sa_len);
2690         if (newaddr->sa_family == AF_INET) {
2691                 ((struct sockaddr_in *)&net->ro._l_addr)->sin_port = stcb->rport;
2692         } else if (newaddr->sa_family == AF_INET6) {
2693                 ((struct sockaddr_in6 *)&net->ro._l_addr)->sin6_port = stcb->rport;
2694         }
2695         net->addr_is_local = sctp_is_address_on_local_host(newaddr);
2696         net->failure_threshold = stcb->asoc.def_net_failure;
2697         if (addr_inscope == 0) {
2698                 net->dest_state = (SCTP_ADDR_REACHABLE |
2699                     SCTP_ADDR_OUT_OF_SCOPE);
2700         } else {
2701                 if (from == SCTP_ADDR_IS_CONFIRMED)
2702                         /* SCTP_ADDR_IS_CONFIRMED is passed by connect_x */
2703                         net->dest_state = SCTP_ADDR_REACHABLE;
2704                 else
2705                         net->dest_state = SCTP_ADDR_REACHABLE |
2706                             SCTP_ADDR_UNCONFIRMED;
2707         }
2708         net->RTO = stcb->asoc.initial_rto;
2709         stcb->asoc.numnets++;
2710         *(&net->ref_count) = 1;
2711         net->tos_flowlabel = 0;
2712 #ifdef AF_INET
2713         if (newaddr->sa_family == AF_INET)
2714                 net->tos_flowlabel = stcb->asoc.default_tos;
2715 #endif
2716 #ifdef AF_INET6
2717         if (newaddr->sa_family == AF_INET6)
2718                 net->tos_flowlabel = stcb->asoc.default_flowlabel;
2719 #endif
2720         /* Init the timer structure */
2721         SCTP_OS_TIMER_INIT(&net->rxt_timer.timer);
2722         SCTP_OS_TIMER_INIT(&net->fr_timer.timer);
2723         SCTP_OS_TIMER_INIT(&net->pmtu_timer.timer);
2724
2725         /* Now generate a route for this guy */
2726         /* KAME hack: embed scopeid */
2727         if (newaddr->sa_family == AF_INET6) {
2728                 struct sockaddr_in6 *sin6;
2729
2730                 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
2731                 (void)sa6_embedscope(sin6, ip6_use_defzone);
2732                 sin6->sin6_scope_id = 0;
2733         }
2734         rtalloc_ign((struct route *)&net->ro, 0UL);
2735         if (newaddr->sa_family == AF_INET6) {
2736                 struct sockaddr_in6 *sin6;
2737
2738                 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
2739                 (void)sa6_recoverscope(sin6);
2740         }
2741         if ((net->ro.ro_rt) &&
2742             (net->ro.ro_rt->rt_ifp)) {
2743                 net->mtu = net->ro.ro_rt->rt_ifp->if_mtu;
2744                 if (from == SCTP_ALLOC_ASOC) {
2745                         stcb->asoc.smallest_mtu = net->mtu;
2746                 }
2747                 /* start things off to match mtu of interface please. */
2748                 net->ro.ro_rt->rt_rmx.rmx_mtu = net->ro.ro_rt->rt_ifp->if_mtu;
2749         } else {
2750                 net->mtu = stcb->asoc.smallest_mtu;
2751         }
2752
2753         if (stcb->asoc.smallest_mtu > net->mtu) {
2754                 stcb->asoc.smallest_mtu = net->mtu;
2755         }
2756         /*
2757          * We take the max of the burst limit times a MTU or the
2758          * INITIAL_CWND. We then limit this to 4 MTU's of sending.
2759          */
2760         net->cwnd = min((net->mtu * 4), max((2 * net->mtu), SCTP_INITIAL_CWND));
2761
2762         /* we always get at LEAST 2 MTU's */
2763         if (net->cwnd < (2 * net->mtu)) {
2764                 net->cwnd = 2 * net->mtu;
2765         }
2766         net->ssthresh = stcb->asoc.peers_rwnd;
2767
2768 #if defined(SCTP_CWND_MONITOR) || defined(SCTP_CWND_LOGGING)
2769         sctp_log_cwnd(stcb, net, 0, SCTP_CWND_INITIALIZATION);
2770 #endif
2771
2772         /*
2773          * CMT: CUC algo - set find_pseudo_cumack to TRUE (1) at beginning
2774          * of assoc (2005/06/27, iyengar@cis.udel.edu)
2775          */
2776         net->find_pseudo_cumack = 1;
2777         net->find_rtx_pseudo_cumack = 1;
2778         net->src_addr_selected = 0;
2779         netfirst = TAILQ_FIRST(&stcb->asoc.nets);
2780         if (net->ro.ro_rt == NULL) {
2781                 /* Since we have no route put it at the back */
2782                 TAILQ_INSERT_TAIL(&stcb->asoc.nets, net, sctp_next);
2783         } else if (netfirst == NULL) {
2784                 /* We are the first one in the pool. */
2785                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
2786         } else if (netfirst->ro.ro_rt == NULL) {
2787                 /*
2788                  * First one has NO route. Place this one ahead of the first
2789                  * one.
2790                  */
2791                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
2792         } else if (net->ro.ro_rt->rt_ifp != netfirst->ro.ro_rt->rt_ifp) {
2793                 /*
2794                  * This one has a different interface than the one at the
2795                  * top of the list. Place it ahead.
2796                  */
2797                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
2798         } else {
2799                 /*
2800                  * Ok we have the same interface as the first one. Move
2801                  * forward until we find either a) one with a NULL route...
2802                  * insert ahead of that b) one with a different ifp.. insert
2803                  * after that. c) end of the list.. insert at the tail.
2804                  */
2805                 struct sctp_nets *netlook;
2806
2807                 do {
2808                         netlook = TAILQ_NEXT(netfirst, sctp_next);
2809                         if (netlook == NULL) {
2810                                 /* End of the list */
2811                                 TAILQ_INSERT_TAIL(&stcb->asoc.nets, net,
2812                                     sctp_next);
2813                                 break;
2814                         } else if (netlook->ro.ro_rt == NULL) {
2815                                 /* next one has NO route */
2816                                 TAILQ_INSERT_BEFORE(netfirst, net, sctp_next);
2817                                 break;
2818                         } else if (netlook->ro.ro_rt->rt_ifp !=
2819                             net->ro.ro_rt->rt_ifp) {
2820                                 TAILQ_INSERT_AFTER(&stcb->asoc.nets, netlook,
2821                                     net, sctp_next);
2822                                 break;
2823                         }
2824                         /* Shift forward */
2825                         netfirst = netlook;
2826                 } while (netlook != NULL);
2827         }
2828
2829         /* got to have a primary set */
2830         if (stcb->asoc.primary_destination == 0) {
2831                 stcb->asoc.primary_destination = net;
2832         } else if ((stcb->asoc.primary_destination->ro.ro_rt == NULL) &&
2833                     (net->ro.ro_rt) &&
2834             ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0)) {
2835                 /* No route to current primary adopt new primary */
2836                 stcb->asoc.primary_destination = net;
2837         }
2838         sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb,
2839             net);
2840         /* Validate primary is first */
2841         net = TAILQ_FIRST(&stcb->asoc.nets);
2842         if ((net != stcb->asoc.primary_destination) &&
2843             (stcb->asoc.primary_destination)) {
2844                 /*
2845                  * first one on the list is NOT the primary sctp_cmpaddr()
2846                  * is much more efficent if the primary is the first on the
2847                  * list, make it so.
2848                  */
2849                 TAILQ_REMOVE(&stcb->asoc.nets,
2850                     stcb->asoc.primary_destination, sctp_next);
2851                 TAILQ_INSERT_HEAD(&stcb->asoc.nets,
2852                     stcb->asoc.primary_destination, sctp_next);
2853         }
2854         return (0);
2855 }
2856
2857
2858 /*
2859  * allocate an association and add it to the endpoint. The caller must be
2860  * careful to add all additional addresses once they are know right away or
2861  * else the assoc will be may experience a blackout scenario.
2862  */
2863 struct sctp_tcb *
2864 sctp_aloc_assoc(struct sctp_inpcb *inp, struct sockaddr *firstaddr,
2865     int for_a_init, int *error, uint32_t override_tag)
2866 {
2867         struct sctp_tcb *stcb;
2868         struct sctp_association *asoc;
2869         struct sctpasochead *head;
2870         uint16_t rport;
2871         int err;
2872
2873         /*
2874          * Assumption made here: Caller has done a
2875          * sctp_findassociation_ep_addr(ep, addr's); to make sure the
2876          * address does not exist already.
2877          */
2878         if (sctppcbinfo.ipi_count_asoc >= SCTP_MAX_NUM_OF_ASOC) {
2879                 /* Hit max assoc, sorry no more */
2880                 *error = ENOBUFS;
2881                 return (NULL);
2882         }
2883         SCTP_INP_RLOCK(inp);
2884         if (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) {
2885                 /*
2886                  * If its in the TCP pool, its NOT allowed to create an
2887                  * association. The parent listener needs to call
2888                  * sctp_aloc_assoc.. or the one-2-many socket. If a peeled
2889                  * off, or connected one does this.. its an error.
2890                  */
2891                 SCTP_INP_RUNLOCK(inp);
2892                 *error = EINVAL;
2893                 return (NULL);
2894         }
2895 #ifdef SCTP_DEBUG
2896         if (sctp_debug_on & SCTP_DEBUG_PCB3) {
2897                 printf("Allocate an association for peer:");
2898                 if (firstaddr)
2899                         sctp_print_address(firstaddr);
2900                 else
2901                         printf("None\n");
2902                 printf("Port:%d\n",
2903                     ntohs(((struct sockaddr_in *)firstaddr)->sin_port));
2904         }
2905 #endif                          /* SCTP_DEBUG */
2906         if (firstaddr->sa_family == AF_INET) {
2907                 struct sockaddr_in *sin;
2908
2909                 sin = (struct sockaddr_in *)firstaddr;
2910                 if ((sin->sin_port == 0) || (sin->sin_addr.s_addr == 0)) {
2911                         /* Invalid address */
2912                         SCTP_INP_RUNLOCK(inp);
2913                         *error = EINVAL;
2914                         return (NULL);
2915                 }
2916                 rport = sin->sin_port;
2917         } else if (firstaddr->sa_family == AF_INET6) {
2918                 struct sockaddr_in6 *sin6;
2919
2920                 sin6 = (struct sockaddr_in6 *)firstaddr;
2921                 if ((sin6->sin6_port == 0) ||
2922                     (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))) {
2923                         /* Invalid address */
2924                         SCTP_INP_RUNLOCK(inp);
2925                         *error = EINVAL;
2926                         return (NULL);
2927                 }
2928                 rport = sin6->sin6_port;
2929         } else {
2930                 /* not supported family type */
2931                 SCTP_INP_RUNLOCK(inp);
2932                 *error = EINVAL;
2933                 return (NULL);
2934         }
2935         SCTP_INP_RUNLOCK(inp);
2936         if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
2937                 /*
2938                  * If you have not performed a bind, then we need to do the
2939                  * ephemerial bind for you.
2940                  */
2941                 if ((err = sctp_inpcb_bind(inp->sctp_socket,
2942                     (struct sockaddr *)NULL,
2943                     (struct thread *)NULL
2944                     ))) {
2945                         /* bind error, probably perm */
2946                         *error = err;
2947                         return (NULL);
2948                 }
2949         }
2950         stcb = (struct sctp_tcb *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_asoc);
2951         if (stcb == NULL) {
2952                 /* out of memory? */
2953                 *error = ENOMEM;
2954                 return (NULL);
2955         }
2956         SCTP_INCR_ASOC_COUNT();
2957
2958         bzero(stcb, sizeof(*stcb));
2959         asoc = &stcb->asoc;
2960         SCTP_TCB_LOCK_INIT(stcb);
2961         SCTP_TCB_SEND_LOCK_INIT(stcb);
2962         /* setup back pointer's */
2963         stcb->sctp_ep = inp;
2964         stcb->sctp_socket = inp->sctp_socket;
2965         if ((err = sctp_init_asoc(inp, asoc, for_a_init, override_tag))) {
2966                 /* failed */
2967                 SCTP_TCB_LOCK_DESTROY(stcb);
2968                 SCTP_TCB_SEND_LOCK_DESTROY(stcb);
2969                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb);
2970                 SCTP_DECR_ASOC_COUNT();
2971                 *error = err;
2972                 return (NULL);
2973         }
2974         /* and the port */
2975         stcb->rport = rport;
2976         SCTP_INP_INFO_WLOCK();
2977         SCTP_INP_WLOCK(inp);
2978         if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE | SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
2979                 /* inpcb freed while alloc going on */
2980                 SCTP_TCB_LOCK_DESTROY(stcb);
2981                 SCTP_TCB_SEND_LOCK_DESTROY(stcb);
2982                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb);
2983                 SCTP_INP_WUNLOCK(inp);
2984                 SCTP_INP_INFO_WUNLOCK();
2985                 SCTP_DECR_ASOC_COUNT();
2986                 *error = EINVAL;
2987                 return (NULL);
2988         }
2989         SCTP_TCB_LOCK(stcb);
2990
2991         /* now that my_vtag is set, add it to the hash */
2992         head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag,
2993             sctppcbinfo.hashasocmark)];
2994         /* put it in the bucket in the vtag hash of assoc's for the system */
2995         LIST_INSERT_HEAD(head, stcb, sctp_asocs);
2996         SCTP_INP_INFO_WUNLOCK();
2997
2998         if ((err = sctp_add_remote_addr(stcb, firstaddr, SCTP_DO_SETSCOPE, SCTP_ALLOC_ASOC))) {
2999                 /* failure.. memory error? */
3000                 if (asoc->strmout)
3001                         SCTP_FREE(asoc->strmout);
3002                 if (asoc->mapping_array)
3003                         SCTP_FREE(asoc->mapping_array);
3004
3005                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb);
3006                 SCTP_DECR_ASOC_COUNT();
3007                 SCTP_TCB_LOCK_DESTROY(stcb);
3008                 SCTP_TCB_SEND_LOCK_DESTROY(stcb);
3009                 *error = ENOBUFS;
3010                 return (NULL);
3011         }
3012         /* Init all the timers */
3013         SCTP_OS_TIMER_INIT(&asoc->hb_timer.timer);
3014         SCTP_OS_TIMER_INIT(&asoc->dack_timer.timer);
3015         SCTP_OS_TIMER_INIT(&asoc->strreset_timer.timer);
3016         SCTP_OS_TIMER_INIT(&asoc->asconf_timer.timer);
3017         SCTP_OS_TIMER_INIT(&asoc->shut_guard_timer.timer);
3018         SCTP_OS_TIMER_INIT(&asoc->autoclose_timer.timer);
3019         SCTP_OS_TIMER_INIT(&asoc->delayed_event_timer.timer);
3020
3021         LIST_INSERT_HEAD(&inp->sctp_asoc_list, stcb, sctp_tcblist);
3022         /* now file the port under the hash as well */
3023         if (inp->sctp_tcbhash != NULL) {
3024                 head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(stcb->rport,
3025                     inp->sctp_hashmark)];
3026                 LIST_INSERT_HEAD(head, stcb, sctp_tcbhash);
3027         }
3028         SCTP_INP_WUNLOCK(inp);
3029 #ifdef SCTP_DEBUG
3030         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
3031                 printf("Association %p now allocated\n", stcb);
3032         }
3033 #endif
3034         return (stcb);
3035 }
3036
3037
3038 void
3039 sctp_remove_net(struct sctp_tcb *stcb, struct sctp_nets *net)
3040 {
3041         struct sctp_association *asoc;
3042
3043         asoc = &stcb->asoc;
3044         asoc->numnets--;
3045         TAILQ_REMOVE(&asoc->nets, net, sctp_next);
3046         sctp_free_remote_addr(net);
3047         if (net == asoc->primary_destination) {
3048                 /* Reset primary */
3049                 struct sctp_nets *lnet;
3050
3051                 lnet = TAILQ_FIRST(&asoc->nets);
3052                 /* Try to find a confirmed primary */
3053                 asoc->primary_destination = sctp_find_alternate_net(stcb, lnet,
3054                     0);
3055         }
3056         if (net == asoc->last_data_chunk_from) {
3057                 /* Reset primary */
3058                 asoc->last_data_chunk_from = TAILQ_FIRST(&asoc->nets);
3059         }
3060         if (net == asoc->last_control_chunk_from) {
3061                 /* Clear net */
3062                 asoc->last_control_chunk_from = NULL;
3063         }
3064 /*      if (net == asoc->asconf_last_sent_to) {*/
3065         /* Reset primary */
3066 /*              asoc->asconf_last_sent_to = TAILQ_FIRST(&asoc->nets);*/
3067 /*      }*/
3068 }
3069
3070 /*
3071  * remove a remote endpoint address from an association, it will fail if the
3072  * address does not exist.
3073  */
3074 int
3075 sctp_del_remote_addr(struct sctp_tcb *stcb, struct sockaddr *remaddr)
3076 {
3077         /*
3078          * Here we need to remove a remote address. This is quite simple, we
3079          * first find it in the list of address for the association
3080          * (tasoc->asoc.nets) and then if it is there, we do a LIST_REMOVE
3081          * on that item. Note we do not allow it to be removed if there are
3082          * no other addresses.
3083          */
3084         struct sctp_association *asoc;
3085         struct sctp_nets *net, *net_tmp;
3086
3087         asoc = &stcb->asoc;
3088
3089         /* locate the address */
3090         for (net = TAILQ_FIRST(&asoc->nets); net != NULL; net = net_tmp) {
3091                 net_tmp = TAILQ_NEXT(net, sctp_next);
3092                 if (net->ro._l_addr.sa.sa_family != remaddr->sa_family) {
3093                         continue;
3094                 }
3095                 if (sctp_cmpaddr((struct sockaddr *)&net->ro._l_addr,
3096                     remaddr)) {
3097                         /* we found the guy */
3098                         if (asoc->numnets < 2) {
3099                                 /* Must have at LEAST two remote addresses */
3100                                 return (-1);
3101                         } else {
3102                                 sctp_remove_net(stcb, net);
3103                                 return (0);
3104                         }
3105                 }
3106         }
3107         /* not found. */
3108         return (-2);
3109 }
3110
3111
3112 void
3113 sctp_add_vtag_to_timewait(struct sctp_inpcb *inp, uint32_t tag, uint32_t time)
3114 {
3115         struct sctpvtaghead *chain;
3116         struct sctp_tagblock *twait_block;
3117         struct timeval now;
3118         int set, i;
3119
3120         SCTP_GETTIME_TIMEVAL(&now);
3121         chain = &sctppcbinfo.vtag_timewait[(tag % SCTP_STACK_VTAG_HASH_SIZE)];
3122         set = 0;
3123         if (!LIST_EMPTY(chain)) {
3124                 /* Block(s) present, lets find space, and expire on the fly */
3125                 LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) {
3126                         for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) {
3127                                 if ((twait_block->vtag_block[i].v_tag == 0) &&
3128                                     !set) {
3129                                         twait_block->vtag_block[i].tv_sec_at_expire =
3130                                             now.tv_sec + time;
3131                                         twait_block->vtag_block[i].v_tag = tag;
3132                                         set = 1;
3133                                 } else if ((twait_block->vtag_block[i].v_tag) &&
3134                                             ((long)twait_block->vtag_block[i].tv_sec_at_expire >
3135                                     now.tv_sec)) {
3136                                         /* Audit expires this guy */
3137                                         twait_block->vtag_block[i].tv_sec_at_expire = 0;
3138                                         twait_block->vtag_block[i].v_tag = 0;
3139                                         if (set == 0) {
3140                                                 /* Reuse it for my new tag */
3141                                                 twait_block->vtag_block[0].tv_sec_at_expire = now.tv_sec + SCTP_TIME_WAIT;
3142                                                 twait_block->vtag_block[0].v_tag = tag;
3143                                                 set = 1;
3144                                         }
3145                                 }
3146                         }
3147                         if (set) {
3148                                 /*
3149                                  * We only do up to the block where we can
3150                                  * place our tag for audits
3151                                  */
3152                                 break;
3153                         }
3154                 }
3155         }
3156         /* Need to add a new block to chain */
3157         if (!set) {
3158                 SCTP_MALLOC(twait_block, struct sctp_tagblock *,
3159                     sizeof(struct sctp_tagblock), "TimeWait");
3160                 if (twait_block == NULL) {
3161                         return;
3162                 }
3163                 memset(twait_block, 0, sizeof(struct sctp_tagblock));
3164                 LIST_INSERT_HEAD(chain, twait_block, sctp_nxt_tagblock);
3165                 twait_block->vtag_block[0].tv_sec_at_expire = now.tv_sec +
3166                     SCTP_TIME_WAIT;
3167                 twait_block->vtag_block[0].v_tag = tag;
3168         }
3169 }
3170
3171
3172 static void
3173 sctp_iterator_asoc_being_freed(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
3174 {
3175         struct sctp_iterator *it;
3176
3177         /*
3178          * Unlock the tcb lock we do this so we avoid a dead lock scenario
3179          * where the iterator is waiting on the TCB lock and the TCB lock is
3180          * waiting on the iterator lock.
3181          */
3182         it = stcb->asoc.stcb_starting_point_for_iterator;
3183         if (it == NULL) {
3184                 return;
3185         }
3186         if (it->inp != stcb->sctp_ep) {
3187                 /* hmm, focused on the wrong one? */
3188                 return;
3189         }
3190         if (it->stcb != stcb) {
3191                 return;
3192         }
3193         it->stcb = LIST_NEXT(stcb, sctp_tcblist);
3194         if (it->stcb == NULL) {
3195                 /* done with all asoc's in this assoc */
3196                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
3197                         it->inp = NULL;
3198                 } else {
3199                         it->inp = LIST_NEXT(inp, sctp_list);
3200                 }
3201         }
3202 }
3203
3204 /*
3205  * Free the association after un-hashing the remote port.
3206  */
3207 int
3208 sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfree, int from_location)
3209 {
3210         int i;
3211         struct sctp_association *asoc;
3212         struct sctp_nets *net, *prev;
3213         struct sctp_laddr *laddr;
3214         struct sctp_tmit_chunk *chk;
3215         struct sctp_asconf_addr *aparam;
3216         struct sctp_stream_reset_list *liste;
3217         struct sctp_queued_to_read *sq;
3218         struct sctp_stream_queue_pending *sp;
3219         sctp_sharedkey_t *shared_key;
3220         struct socket *so;
3221         int ccnt = 0;
3222         int s, cnt = 0;
3223
3224         /* first, lets purge the entry from the hash table. */
3225         s = splnet();
3226
3227 #ifdef SCTP_LOG_CLOSING
3228         sctp_log_closing(inp, stcb, 6);
3229 #endif
3230         if (stcb->asoc.state == 0) {
3231 #ifdef SCTP_LOG_CLOSING
3232                 sctp_log_closing(inp, NULL, 7);
3233 #endif
3234                 splx(s);
3235                 /* there is no asoc, really TSNH :-0 */
3236                 return (1);
3237         }
3238         /* TEMP CODE */
3239         if (stcb->freed_from_where == 0) {
3240                 /* Only record the first place free happened from */
3241                 stcb->freed_from_where = from_location;
3242         }
3243         /* TEMP CODE */
3244
3245         asoc = &stcb->asoc;
3246         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3247             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE))
3248                 /* nothing around */
3249                 so = NULL;
3250         else
3251                 so = inp->sctp_socket;
3252
3253         /*
3254          * We used timer based freeing if a reader or writer is in the way.
3255          * So we first check if we are actually being called from a timer,
3256          * if so we abort early if a reader or writer is still in the way.
3257          */
3258         if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) &&
3259             (from_inpcbfree == SCTP_NORMAL_PROC)) {
3260                 /*
3261                  * is it the timer driving us? if so are the reader/writers
3262                  * gone?
3263                  */
3264                 if (stcb->asoc.refcnt) {
3265                         /* nope, reader or writer in the way */
3266                         sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
3267                         /* no asoc destroyed */
3268                         SCTP_TCB_UNLOCK(stcb);
3269                         splx(s);
3270 #ifdef SCTP_LOG_CLOSING
3271                         sctp_log_closing(inp, stcb, 8);
3272 #endif
3273                         return (0);
3274                 }
3275         }
3276         /* now clean up any other timers */
3277         SCTP_OS_TIMER_STOP(&asoc->hb_timer.timer);
3278         SCTP_OS_TIMER_STOP(&asoc->dack_timer.timer);
3279         SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
3280         SCTP_OS_TIMER_STOP(&asoc->asconf_timer.timer);
3281         SCTP_OS_TIMER_STOP(&asoc->autoclose_timer.timer);
3282         SCTP_OS_TIMER_STOP(&asoc->shut_guard_timer.timer);
3283         SCTP_OS_TIMER_STOP(&asoc->delayed_event_timer.timer);
3284
3285         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3286                 SCTP_OS_TIMER_STOP(&net->fr_timer.timer);
3287                 SCTP_OS_TIMER_STOP(&net->rxt_timer.timer);
3288                 SCTP_OS_TIMER_STOP(&net->pmtu_timer.timer);
3289         }
3290         /* Now the read queue needs to be cleaned up (only once) */
3291         cnt = 0;
3292         if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0) {
3293                 SCTP_INP_READ_LOCK(inp);
3294                 TAILQ_FOREACH(sq, &inp->read_queue, next) {
3295                         if (sq->stcb == stcb) {
3296                                 sq->do_not_ref_stcb = 1;
3297                                 sq->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
3298                                 /*
3299                                  * If there is no end, there never will be
3300                                  * now.
3301                                  */
3302                                 if (sq->end_added == 0) {
3303                                         /* Held for PD-API clear that. */
3304                                         sq->pdapi_aborted = 1;
3305                                         sq->held_length = 0;
3306                                         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_PDAPIEVNT)) {
3307                                                 /*
3308                                                  * Need to add a PD-API
3309                                                  * aborted indication.
3310                                                  * Setting the control_pdapi
3311                                                  * assures that it will be
3312                                                  * added right after this
3313                                                  * msg.
3314                                                  */
3315                                                 stcb->asoc.control_pdapi = sq;
3316                                                 sctp_notify_partial_delivery_indication(stcb,
3317                                                     SCTP_PARTIAL_DELIVERY_ABORTED, 1);
3318                                                 stcb->asoc.control_pdapi = NULL;
3319                                         }
3320                                 }
3321                                 /* Add an end to wake them */
3322                                 sq->end_added = 1;
3323                                 cnt++;
3324                         }
3325                 }
3326                 SCTP_INP_READ_UNLOCK(inp);
3327                 if (stcb->block_entry) {
3328                         cnt++;
3329                         stcb->block_entry->error = ECONNRESET;
3330                         stcb->block_entry = NULL;
3331                 }
3332         }
3333         stcb->asoc.state |= SCTP_STATE_ABOUT_TO_BE_FREED;
3334         if ((from_inpcbfree != SCTP_PCBFREE_FORCE) && (stcb->asoc.refcnt)) {
3335                 /*
3336                  * reader or writer in the way, we have hopefully given him
3337                  * something to chew on above.
3338                  */
3339                 sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
3340                 SCTP_TCB_UNLOCK(stcb);
3341                 if (so) {
3342                         SCTP_INP_RLOCK(inp);
3343                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3344                             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE))
3345                                 /* nothing around */
3346                                 so = NULL;
3347                         if (so) {
3348                                 /* Wake any reader/writers */
3349                                 sctp_sorwakeup(inp, so);
3350                                 sctp_sowwakeup(inp, so);
3351                         }
3352                         SCTP_INP_RUNLOCK(inp);
3353
3354                 }
3355                 splx(s);
3356 #ifdef SCTP_LOG_CLOSING
3357                 sctp_log_closing(inp, stcb, 9);
3358 #endif
3359                 /* no asoc destroyed */
3360                 return (0);
3361         }
3362 #ifdef SCTP_LOG_CLOSING
3363         sctp_log_closing(inp, stcb, 10);
3364 #endif
3365         /*
3366          * When I reach here, no others want to kill the assoc yet.. and I
3367          * own the lock. Now its possible an abort comes in when I do the
3368          * lock exchange below to grab all the locks to do the final take
3369          * out. to prevent this we increment the count, which will start a
3370          * timer and blow out above thus assuring us that we hold exclusive
3371          * killing of the asoc. Note that after getting back the TCB lock we
3372          * will go ahead and increment the counter back up and stop any
3373          * timer a passing stranger may have started :-S
3374          */
3375         if (from_inpcbfree == SCTP_NORMAL_PROC) {
3376                 atomic_add_int(&stcb->asoc.refcnt, 1);
3377
3378                 SCTP_TCB_UNLOCK(stcb);
3379
3380                 SCTP_ITERATOR_LOCK();
3381                 SCTP_INP_INFO_WLOCK();
3382                 SCTP_INP_WLOCK(inp);
3383                 SCTP_TCB_LOCK(stcb);
3384         }
3385         /* Double check the GONE flag */
3386         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3387             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE))
3388                 /* nothing around */
3389                 so = NULL;
3390
3391         if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3392             (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
3393                 /*
3394                  * For TCP type we need special handling when we are
3395                  * connected. We also include the peel'ed off ones to.
3396                  */
3397                 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
3398                         inp->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED;
3399                         inp->sctp_flags |= SCTP_PCB_FLAGS_WAS_CONNECTED;
3400                         if (so) {
3401                                 SOCK_LOCK(so);
3402                                 if (so->so_rcv.sb_cc == 0) {
3403                                         so->so_state &= ~(SS_ISCONNECTING |
3404                                             SS_ISDISCONNECTING |
3405                                             SS_ISCONFIRMING |
3406                                             SS_ISCONNECTED);
3407                                 }
3408                                 SOCK_UNLOCK(so);
3409                                 sctp_sowwakeup(inp, so);
3410                                 sctp_sorwakeup(inp, so);
3411                                 wakeup(&so->so_timeo);
3412                         }
3413                 }
3414         }
3415         /*
3416          * Make it invalid too, that way if its about to run it will abort
3417          * and return.
3418          */
3419         sctp_iterator_asoc_being_freed(inp, stcb);
3420         /* re-increment the lock */
3421         if (from_inpcbfree == SCTP_NORMAL_PROC) {
3422                 atomic_add_int(&stcb->asoc.refcnt, -1);
3423         }
3424         asoc->state = 0;
3425         if (inp->sctp_tcbhash) {
3426                 LIST_REMOVE(stcb, sctp_tcbhash);
3427         }
3428         if (stcb->asoc.in_restart_hash) {
3429                 LIST_REMOVE(stcb, sctp_tcbrestarhash);
3430         }
3431         /* Now lets remove it from the list of ALL associations in the EP */
3432         LIST_REMOVE(stcb, sctp_tcblist);
3433         if (from_inpcbfree == SCTP_NORMAL_PROC) {
3434                 SCTP_INP_INCR_REF(inp);
3435                 SCTP_INP_WUNLOCK(inp);
3436                 SCTP_ITERATOR_UNLOCK();
3437         }
3438         /* pull from vtag hash */
3439         LIST_REMOVE(stcb, sctp_asocs);
3440         sctp_add_vtag_to_timewait(inp, asoc->my_vtag, SCTP_TIME_WAIT);
3441
3442
3443         /*
3444          * Now restop the timers to be sure - this is paranoia at is finest!
3445          */
3446         SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
3447         SCTP_OS_TIMER_STOP(&asoc->hb_timer.timer);
3448         SCTP_OS_TIMER_STOP(&asoc->dack_timer.timer);
3449         SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
3450         SCTP_OS_TIMER_STOP(&asoc->asconf_timer.timer);
3451         SCTP_OS_TIMER_STOP(&asoc->shut_guard_timer.timer);
3452         SCTP_OS_TIMER_STOP(&asoc->autoclose_timer.timer);
3453         SCTP_OS_TIMER_STOP(&asoc->delayed_event_timer.timer);
3454
3455         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3456                 SCTP_OS_TIMER_STOP(&net->fr_timer.timer);
3457                 SCTP_OS_TIMER_STOP(&net->rxt_timer.timer);
3458                 SCTP_OS_TIMER_STOP(&net->pmtu_timer.timer);
3459         }
3460
3461         asoc->strreset_timer.type = SCTP_TIMER_TYPE_NONE;
3462         prev = NULL;
3463         /*
3464          * The chunk lists and such SHOULD be empty but we check them just
3465          * in case.
3466          */
3467         /* anything on the wheel needs to be removed */
3468         for (i = 0; i < asoc->streamoutcnt; i++) {
3469                 struct sctp_stream_out *outs;
3470
3471                 outs = &asoc->strmout[i];
3472                 /* now clean up any chunks here */
3473                 sp = TAILQ_FIRST(&outs->outqueue);
3474                 while (sp) {
3475                         TAILQ_REMOVE(&outs->outqueue, sp, next);
3476                         if (sp->data) {
3477                                 sctp_m_freem(sp->data);
3478                                 sp->data = NULL;
3479                                 sp->tail_mbuf = NULL;
3480                         }
3481                         sctp_free_remote_addr(sp->net);
3482                         sctp_free_spbufspace(stcb, asoc, sp);
3483                         /* Free the zone stuff  */
3484                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_strmoq, sp);
3485                         SCTP_DECR_STRMOQ_COUNT();
3486                         sp = TAILQ_FIRST(&outs->outqueue);
3487                 }
3488         }
3489
3490         while ((sp = TAILQ_FIRST(&asoc->free_strmoq)) != NULL) {
3491                 TAILQ_REMOVE(&asoc->free_strmoq, sp, next);
3492                 if (sp->data) {
3493                         sctp_m_freem(sp->data);
3494                         sp->data = NULL;
3495                         sp->tail_mbuf = NULL;
3496                 }
3497                 /* Free the zone stuff  */
3498                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_strmoq, sp);
3499                 SCTP_DECR_STRMOQ_COUNT();
3500                 atomic_add_int(&sctppcbinfo.ipi_free_strmoq, -1);
3501         }
3502
3503         while ((liste = TAILQ_FIRST(&asoc->resetHead)) != NULL) {
3504                 TAILQ_REMOVE(&asoc->resetHead, liste, next_resp);
3505                 SCTP_FREE(liste);
3506         }
3507
3508         sq = TAILQ_FIRST(&asoc->pending_reply_queue);
3509         while (sq) {
3510                 TAILQ_REMOVE(&asoc->pending_reply_queue, sq, next);
3511                 if (sq->data) {
3512                         sctp_m_freem(sq->data);
3513                         sq->data = NULL;
3514                 }
3515                 sctp_free_remote_addr(sq->whoFrom);
3516                 sq->whoFrom = NULL;
3517                 sq->stcb = NULL;
3518                 /* Free the ctl entry */
3519                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_readq, sq);
3520                 SCTP_DECR_READQ_COUNT();
3521                 sq = TAILQ_FIRST(&asoc->pending_reply_queue);
3522         }
3523
3524         chk = TAILQ_FIRST(&asoc->free_chunks);
3525         while (chk) {
3526                 TAILQ_REMOVE(&asoc->free_chunks, chk, sctp_next);
3527                 if (chk->data) {
3528                         sctp_m_freem(chk->data);
3529                         chk->data = NULL;
3530                 }
3531                 ccnt++;
3532                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
3533                 SCTP_DECR_CHK_COUNT();
3534                 atomic_subtract_int(&sctppcbinfo.ipi_free_chunks, 1);
3535                 asoc->free_chunk_cnt--;
3536                 chk = TAILQ_FIRST(&asoc->free_chunks);
3537         }
3538         /* pending send queue SHOULD be empty */
3539         if (!TAILQ_EMPTY(&asoc->send_queue)) {
3540                 chk = TAILQ_FIRST(&asoc->send_queue);
3541                 while (chk) {
3542                         TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
3543                         if (chk->data) {
3544                                 sctp_m_freem(chk->data);
3545                                 chk->data = NULL;
3546                         }
3547                         ccnt++;
3548                         sctp_free_remote_addr(chk->whoTo);
3549                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
3550                         SCTP_DECR_CHK_COUNT();
3551                         chk = TAILQ_FIRST(&asoc->send_queue);
3552                 }
3553         }
3554 /*
3555   if(ccnt) {
3556   printf("Freed %d from send_queue\n", ccnt);
3557   ccnt = 0;
3558   }
3559 */
3560         /* sent queue SHOULD be empty */
3561         if (!TAILQ_EMPTY(&asoc->sent_queue)) {
3562                 chk = TAILQ_FIRST(&asoc->sent_queue);
3563                 while (chk) {
3564                         TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
3565                         if (chk->data) {
3566                                 sctp_m_freem(chk->data);
3567                                 chk->data = NULL;
3568                         }
3569                         ccnt++;
3570                         sctp_free_remote_addr(chk->whoTo);
3571                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
3572                         SCTP_DECR_CHK_COUNT();
3573                         chk = TAILQ_FIRST(&asoc->sent_queue);
3574                 }
3575         }
3576 /*
3577   if(ccnt) {
3578   printf("Freed %d from sent_queue\n", ccnt);
3579   ccnt = 0;
3580   }
3581 */
3582         /* control queue MAY not be empty */
3583         if (!TAILQ_EMPTY(&asoc->control_send_queue)) {
3584                 chk = TAILQ_FIRST(&asoc->control_send_queue);
3585                 while (chk) {
3586                         TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
3587                         if (chk->data) {
3588                                 sctp_m_freem(chk->data);
3589                                 chk->data = NULL;
3590                         }
3591                         ccnt++;
3592                         sctp_free_remote_addr(chk->whoTo);
3593                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
3594                         SCTP_DECR_CHK_COUNT();
3595                         chk = TAILQ_FIRST(&asoc->control_send_queue);
3596                 }
3597         }
3598 /*
3599   if(ccnt) {
3600   printf("Freed %d from ctrl_queue\n", ccnt);
3601   ccnt = 0;
3602   }
3603 */
3604         if (!TAILQ_EMPTY(&asoc->reasmqueue)) {
3605                 chk = TAILQ_FIRST(&asoc->reasmqueue);
3606                 while (chk) {
3607                         TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
3608                         if (chk->data) {
3609                                 sctp_m_freem(chk->data);
3610                                 chk->data = NULL;
3611                         }
3612                         sctp_free_remote_addr(chk->whoTo);
3613                         ccnt++;
3614                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
3615                         SCTP_DECR_CHK_COUNT();
3616                         chk = TAILQ_FIRST(&asoc->reasmqueue);
3617                 }
3618         }
3619 /*
3620   if(ccnt) {
3621   printf("Freed %d from reasm_queue\n", ccnt);
3622   ccnt = 0;
3623   }
3624 */
3625         if (asoc->mapping_array) {
3626                 SCTP_FREE(asoc->mapping_array);
3627                 asoc->mapping_array = NULL;
3628         }
3629         /* the stream outs */
3630         if (asoc->strmout) {
3631                 SCTP_FREE(asoc->strmout);
3632                 asoc->strmout = NULL;
3633         }
3634         asoc->streamoutcnt = 0;
3635         if (asoc->strmin) {
3636                 struct sctp_queued_to_read *ctl;
3637                 int i;
3638
3639                 for (i = 0; i < asoc->streamincnt; i++) {
3640                         if (!TAILQ_EMPTY(&asoc->strmin[i].inqueue)) {
3641                                 /* We have somethings on the streamin queue */
3642                                 ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue);
3643                                 while (ctl) {
3644                                         TAILQ_REMOVE(&asoc->strmin[i].inqueue,
3645                                             ctl, next);
3646                                         sctp_free_remote_addr(ctl->whoFrom);
3647                                         if (ctl->data) {
3648                                                 sctp_m_freem(ctl->data);
3649                                                 ctl->data = NULL;
3650                                         }
3651                                         /*
3652                                          * We don't free the address here
3653                                          * since all the net's were freed
3654                                          * above.
3655                                          */
3656                                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_readq, ctl);
3657                                         SCTP_DECR_READQ_COUNT();
3658                                         ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue);
3659                                 }
3660                         }
3661                 }
3662                 SCTP_FREE(asoc->strmin);
3663                 asoc->strmin = NULL;
3664         }
3665         asoc->streamincnt = 0;
3666         while (!TAILQ_EMPTY(&asoc->nets)) {
3667                 net = TAILQ_FIRST(&asoc->nets);
3668                 /* pull from list */
3669                 if ((sctppcbinfo.ipi_count_raddr == 0) || (prev == net)) {
3670 #ifdef INVARIANTS
3671                         panic("no net's left alloc'ed, or list points to itself");
3672 #endif
3673                         break;
3674                 }
3675                 prev = net;
3676                 TAILQ_REMOVE(&asoc->nets, net, sctp_next);
3677                 sctp_free_remote_addr(net);
3678         }
3679
3680         /* local addresses, if any */
3681         while (!LIST_EMPTY(&asoc->sctp_local_addr_list)) {
3682                 laddr = LIST_FIRST(&asoc->sctp_local_addr_list);
3683                 LIST_REMOVE(laddr, sctp_nxt_addr);
3684                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr);
3685                 SCTP_DECR_LADDR_COUNT();
3686         }
3687         /* pending asconf (address) parameters */
3688         while (!TAILQ_EMPTY(&asoc->asconf_queue)) {
3689                 aparam = TAILQ_FIRST(&asoc->asconf_queue);
3690                 TAILQ_REMOVE(&asoc->asconf_queue, aparam, next);
3691                 SCTP_FREE(aparam);
3692         }
3693         if (asoc->last_asconf_ack_sent != NULL) {
3694                 sctp_m_freem(asoc->last_asconf_ack_sent);
3695                 asoc->last_asconf_ack_sent = NULL;
3696         }
3697         /* clean up auth stuff */
3698         if (asoc->local_hmacs)
3699                 sctp_free_hmaclist(asoc->local_hmacs);
3700         if (asoc->peer_hmacs)
3701                 sctp_free_hmaclist(asoc->peer_hmacs);
3702
3703         if (asoc->local_auth_chunks)
3704                 sctp_free_chunklist(asoc->local_auth_chunks);
3705         if (asoc->peer_auth_chunks)
3706                 sctp_free_chunklist(asoc->peer_auth_chunks);
3707
3708         sctp_free_authinfo(&asoc->authinfo);
3709
3710         shared_key = LIST_FIRST(&asoc->shared_keys);
3711         while (shared_key) {
3712                 LIST_REMOVE(shared_key, next);
3713                 sctp_free_sharedkey(shared_key);
3714                 shared_key = LIST_FIRST(&asoc->shared_keys);
3715         }
3716
3717         /* Insert new items here :> */
3718
3719         /* Get rid of LOCK */
3720         SCTP_TCB_LOCK_DESTROY(stcb);
3721         SCTP_TCB_SEND_LOCK_DESTROY(stcb);
3722         if (from_inpcbfree == SCTP_NORMAL_PROC) {
3723                 SCTP_INP_INFO_WUNLOCK();
3724                 SCTP_INP_RLOCK(inp);
3725         }
3726 #ifdef SCTP_TRACK_FREED_ASOCS
3727         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3728                 /* now clean up the tasoc itself */
3729                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb);
3730                 SCTP_DECR_ASOC_COUNT();
3731         } else {
3732                 LIST_INSERT_HEAD(&inp->sctp_asoc_free_list, stcb, sctp_tcblist);
3733         }
3734 #else
3735         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb);
3736         SCTP_DECR_ASOC_COUNT();
3737 #endif
3738         if (from_inpcbfree == SCTP_NORMAL_PROC) {
3739                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3740                         /*
3741                          * If its NOT the inp_free calling us AND sctp_close
3742                          * as been called, we call back...
3743                          */
3744                         SCTP_INP_RUNLOCK(inp);
3745                         /*
3746                          * This will start the kill timer (if we are the
3747                          * lastone) since we hold an increment yet. But this
3748                          * is the only safe way to do this since otherwise
3749                          * if the socket closes at the same time we are here
3750                          * we might collide in the cleanup.
3751                          */
3752                         sctp_inpcb_free(inp, 0, 0);
3753                         SCTP_INP_DECR_REF(inp);
3754                         goto out_of;
3755                 } else {
3756                         /* The socket is still open. */
3757                         SCTP_INP_DECR_REF(inp);
3758                 }
3759         }
3760         if (from_inpcbfree == SCTP_NORMAL_PROC) {
3761                 SCTP_INP_RUNLOCK(inp);
3762         }
3763 out_of:
3764         splx(s);
3765         /* destroyed the asoc */
3766 #ifdef SCTP_LOG_CLOSING
3767         sctp_log_closing(inp, NULL, 11);
3768 #endif
3769         return (1);
3770 }
3771
3772
3773
3774 /*
3775  * determine if a destination is "reachable" based upon the addresses bound
3776  * to the current endpoint (e.g. only v4 or v6 currently bound)
3777  */
3778 /*
3779  * FIX: if we allow assoc-level bindx(), then this needs to be fixed to use
3780  * assoc level v4/v6 flags, as the assoc *may* not have the same address
3781  * types bound as its endpoint
3782  */
3783 int
3784 sctp_destination_is_reachable(struct sctp_tcb *stcb, struct sockaddr *destaddr)
3785 {
3786         struct sctp_inpcb *inp;
3787         int answer;
3788
3789         /*
3790          * No locks here, the TCB, in all cases is already locked and an
3791          * assoc is up. There is either a INP lock by the caller applied (in
3792          * asconf case when deleting an address) or NOT in the HB case,
3793          * however if HB then the INP increment is up and the INP will not
3794          * be removed (on top of the fact that we have a TCB lock). So we
3795          * only want to read the sctp_flags, which is either bound-all or
3796          * not.. no protection needed since once an assoc is up you can't be
3797          * changing your binding.
3798          */
3799         inp = stcb->sctp_ep;
3800         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3801                 /* if bound all, destination is not restricted */
3802                 /*
3803                  * RRS: Question during lock work: Is this correct? If you
3804                  * are bound-all you still might need to obey the V4--V6
3805                  * flags??? IMO this bound-all stuff needs to be removed!
3806                  */
3807                 return (1);
3808         }
3809         /* NOTE: all "scope" checks are done when local addresses are added */
3810         if (destaddr->sa_family == AF_INET6) {
3811                 answer = inp->ip_inp.inp.inp_vflag & INP_IPV6;
3812         } else if (destaddr->sa_family == AF_INET) {
3813                 answer = inp->ip_inp.inp.inp_vflag & INP_IPV4;
3814         } else {
3815                 /* invalid family, so it's unreachable */
3816                 answer = 0;
3817         }
3818         return (answer);
3819 }
3820
3821 /*
3822  * update the inp_vflags on an endpoint
3823  */
3824 static void
3825 sctp_update_ep_vflag(struct sctp_inpcb *inp)
3826 {
3827         struct sctp_laddr *laddr;
3828
3829         /* first clear the flag */
3830         inp->ip_inp.inp.inp_vflag = 0;
3831         /* set the flag based on addresses on the ep list */
3832         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3833                 if (laddr->ifa == NULL) {
3834 #ifdef SCTP_DEBUG
3835                         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
3836                                 printf("An ounce of prevention is worth a pound of cure\n");
3837                         }
3838 #endif                          /* SCTP_DEBUG */
3839                         continue;
3840                 }
3841                 if (laddr->ifa->ifa_addr) {
3842                         continue;
3843                 }
3844                 if (laddr->ifa->ifa_addr->sa_family == AF_INET6) {
3845                         inp->ip_inp.inp.inp_vflag |= INP_IPV6;
3846                 } else if (laddr->ifa->ifa_addr->sa_family == AF_INET) {
3847                         inp->ip_inp.inp.inp_vflag |= INP_IPV4;
3848                 }
3849         }
3850 }
3851
3852 /*
3853  * Add the address to the endpoint local address list There is nothing to be
3854  * done if we are bound to all addresses
3855  */
3856 int
3857 sctp_add_local_addr_ep(struct sctp_inpcb *inp, struct ifaddr *ifa)
3858 {
3859         struct sctp_laddr *laddr;
3860         int fnd, error;
3861
3862         fnd = 0;
3863
3864         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3865                 /* You are already bound to all. You have it already */
3866                 return (0);
3867         }
3868         if (ifa->ifa_addr->sa_family == AF_INET6) {
3869                 struct in6_ifaddr *ifa6;
3870
3871                 ifa6 = (struct in6_ifaddr *)ifa;
3872                 if (ifa6->ia6_flags & (IN6_IFF_DETACHED |
3873                     IN6_IFF_DEPRECATED | IN6_IFF_ANYCAST | IN6_IFF_NOTREADY))
3874                         /* Can't bind a non-existent addr. */
3875                         return (-1);
3876         }
3877         /* first, is it already present? */
3878         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3879                 if (laddr->ifa == ifa) {
3880                         fnd = 1;
3881                         break;
3882                 }
3883         }
3884
3885         if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && (fnd == 0)) {
3886                 /* Not bound to all */
3887                 error = sctp_insert_laddr(&inp->sctp_addr_list, ifa);
3888                 if (error != 0)
3889                         return (error);
3890                 inp->laddr_count++;
3891                 /* update inp_vflag flags */
3892                 if (ifa->ifa_addr->sa_family == AF_INET6) {
3893                         inp->ip_inp.inp.inp_vflag |= INP_IPV6;
3894                 } else if (ifa->ifa_addr->sa_family == AF_INET) {
3895                         inp->ip_inp.inp.inp_vflag |= INP_IPV4;
3896                 }
3897         }
3898         return (0);
3899 }
3900
3901
3902 /*
3903  * select a new (hopefully reachable) destination net (should only be used
3904  * when we deleted an ep addr that is the only usable source address to reach
3905  * the destination net)
3906  */
3907 static void
3908 sctp_select_primary_destination(struct sctp_tcb *stcb)
3909 {
3910         struct sctp_nets *net;
3911
3912         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
3913                 /* for now, we'll just pick the first reachable one we find */
3914                 if (net->dest_state & SCTP_ADDR_UNCONFIRMED)
3915                         continue;
3916                 if (sctp_destination_is_reachable(stcb,
3917                     (struct sockaddr *)&net->ro._l_addr)) {
3918                         /* found a reachable destination */
3919                         stcb->asoc.primary_destination = net;
3920                 }
3921         }
3922         /* I can't there from here! ...we're gonna die shortly... */
3923 }
3924
3925
3926 /*
3927  * Delete the address from the endpoint local address list There is nothing
3928  * to be done if we are bound to all addresses
3929  */
3930 int
3931 sctp_del_local_addr_ep(struct sctp_inpcb *inp, struct ifaddr *ifa)
3932 {
3933         struct sctp_laddr *laddr;
3934         int fnd;
3935
3936         fnd = 0;
3937         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
3938                 /* You are already bound to all. You have it already */
3939                 return (EINVAL);
3940         }
3941         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
3942                 if (laddr->ifa == ifa) {
3943                         fnd = 1;
3944                         break;
3945                 }
3946         }
3947         if (fnd && (inp->laddr_count < 2)) {
3948                 /* can't delete unless there are at LEAST 2 addresses */
3949                 return (-1);
3950         }
3951         if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) && (fnd)) {
3952                 /*
3953                  * clean up any use of this address go through our
3954                  * associations and clear any last_used_address that match
3955                  * this one for each assoc, see if a new primary_destination
3956                  * is needed
3957                  */
3958                 struct sctp_tcb *stcb;
3959
3960                 /* clean up "next_addr_touse" */
3961                 if (inp->next_addr_touse == laddr)
3962                         /* delete this address */
3963                         inp->next_addr_touse = NULL;
3964
3965                 /* clean up "last_used_address" */
3966                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
3967                         if (stcb->asoc.last_used_address == laddr)
3968                                 /* delete this address */
3969                                 stcb->asoc.last_used_address = NULL;
3970                 }               /* for each tcb */
3971
3972                 /* remove it from the ep list */
3973                 sctp_remove_laddr(laddr);
3974                 inp->laddr_count--;
3975                 /* update inp_vflag flags */
3976                 sctp_update_ep_vflag(inp);
3977                 /* select a new primary destination if needed */
3978                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
3979                         /*
3980                          * presume caller (sctp_asconf.c) already owns INP
3981                          * lock
3982                          */
3983                         SCTP_TCB_LOCK(stcb);
3984                         if (sctp_destination_is_reachable(stcb,
3985                             (struct sockaddr *)&stcb->asoc.primary_destination->ro._l_addr) == 0) {
3986                                 sctp_select_primary_destination(stcb);
3987                         }
3988                         SCTP_TCB_UNLOCK(stcb);
3989                 }               /* for each tcb */
3990         }
3991         return (0);
3992 }
3993
3994 /*
3995  * Add the addr to the TCB local address list For the BOUNDALL or dynamic
3996  * case, this is a "pending" address list (eg. addresses waiting for an
3997  * ASCONF-ACK response) For the subset binding, static case, this is a
3998  * "valid" address list
3999  */
4000 int
4001 sctp_add_local_addr_assoc(struct sctp_tcb *stcb, struct ifaddr *ifa)
4002 {
4003         struct sctp_inpcb *inp;
4004         struct sctp_laddr *laddr;
4005         int error;
4006
4007         /*
4008          * Assumes TCP is locked.. and possiblye the INP. May need to
4009          * confirm/fix that if we need it and is not the case.
4010          */
4011         inp = stcb->sctp_ep;
4012         if (ifa->ifa_addr->sa_family == AF_INET6) {
4013                 struct in6_ifaddr *ifa6;
4014
4015                 ifa6 = (struct in6_ifaddr *)ifa;
4016                 if (ifa6->ia6_flags & (IN6_IFF_DETACHED |
4017                 /* IN6_IFF_DEPRECATED | */
4018                     IN6_IFF_ANYCAST |
4019                     IN6_IFF_NOTREADY))
4020                         /* Can't bind a non-existent addr. */
4021                         return (-1);
4022         }
4023         /* does the address already exist? */
4024         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
4025                 if (laddr->ifa == ifa) {
4026                         return (-1);
4027                 }
4028         }
4029
4030         /* add to the list */
4031         error = sctp_insert_laddr(&stcb->asoc.sctp_local_addr_list, ifa);
4032         if (error != 0)
4033                 return (error);
4034         return (0);
4035 }
4036
4037 /*
4038  * insert an laddr entry with the given ifa for the desired list
4039  */
4040 int
4041 sctp_insert_laddr(struct sctpladdr *list, struct ifaddr *ifa)
4042 {
4043         struct sctp_laddr *laddr;
4044         int s;
4045
4046         s = splnet();
4047
4048         laddr = (struct sctp_laddr *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_laddr);
4049         if (laddr == NULL) {
4050                 /* out of memory? */
4051                 splx(s);
4052                 return (EINVAL);
4053         }
4054         SCTP_INCR_LADDR_COUNT();
4055         bzero(laddr, sizeof(*laddr));
4056         laddr->ifa = ifa;
4057         /* insert it */
4058         LIST_INSERT_HEAD(list, laddr, sctp_nxt_addr);
4059
4060         splx(s);
4061         return (0);
4062 }
4063
4064 /*
4065  * Remove an laddr entry from the local address list (on an assoc)
4066  */
4067 void
4068 sctp_remove_laddr(struct sctp_laddr *laddr)
4069 {
4070         int s;
4071
4072         s = splnet();
4073         /* remove from the list */
4074         LIST_REMOVE(laddr, sctp_nxt_addr);
4075         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr);
4076         SCTP_DECR_LADDR_COUNT();
4077         splx(s);
4078 }
4079
4080 /*
4081  * Remove an address from the TCB local address list
4082  */
4083 int
4084 sctp_del_local_addr_assoc(struct sctp_tcb *stcb, struct ifaddr *ifa)
4085 {
4086         struct sctp_inpcb *inp;
4087         struct sctp_laddr *laddr;
4088
4089         /*
4090          * This is called by asconf work. It is assumed that a) The TCB is
4091          * locked and b) The INP is locked. This is true in as much as I can
4092          * trace through the entry asconf code where I did these locks.
4093          * Again, the ASCONF code is a bit different in that it does lock
4094          * the INP during its work often times. This must be since we don't
4095          * want other proc's looking up things while what they are looking
4096          * up is changing :-D
4097          */
4098
4099         inp = stcb->sctp_ep;
4100         /* if subset bound and don't allow ASCONF's, can't delete last */
4101         if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) &&
4102             (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF) == 0)) {
4103                 if (stcb->asoc.numnets < 2) {
4104                         /* can't delete last address */
4105                         return (-1);
4106                 }
4107         }
4108         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
4109                 /* remove the address if it exists */
4110                 if (laddr->ifa == NULL)
4111                         continue;
4112                 if (laddr->ifa == ifa) {
4113                         sctp_remove_laddr(laddr);
4114                         return (0);
4115                 }
4116         }
4117
4118         /* address not found! */
4119         return (-1);
4120 }
4121
4122 /*
4123  * Remove an address from the TCB local address list lookup using a sockaddr
4124  * addr
4125  */
4126 int
4127 sctp_del_local_addr_assoc_sa(struct sctp_tcb *stcb, struct sockaddr *sa)
4128 {
4129         struct sctp_inpcb *inp;
4130         struct sctp_laddr *laddr;
4131         struct sockaddr *l_sa;
4132
4133         /*
4134          * This function I find does not seem to have a caller. As such we
4135          * NEED TO DELETE this code. If we do find a caller, the caller MUST
4136          * have locked the TCB at the least and probably the INP as well.
4137          */
4138         inp = stcb->sctp_ep;
4139         /* if subset bound and don't allow ASCONF's, can't delete last */
4140         if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) &&
4141             (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF) == 0)) {
4142                 if (stcb->asoc.numnets < 2) {
4143                         /* can't delete last address */
4144                         return (-1);
4145                 }
4146         }
4147         LIST_FOREACH(laddr, &stcb->asoc.sctp_local_addr_list, sctp_nxt_addr) {
4148                 /* make sure the address exists */
4149                 if (laddr->ifa == NULL)
4150                         continue;
4151                 if (laddr->ifa->ifa_addr == NULL)
4152                         continue;
4153
4154                 l_sa = laddr->ifa->ifa_addr;
4155                 if (l_sa->sa_family == AF_INET6) {
4156                         /* IPv6 address */
4157                         struct sockaddr_in6 *sin1, *sin2;
4158
4159                         sin1 = (struct sockaddr_in6 *)l_sa;
4160                         sin2 = (struct sockaddr_in6 *)sa;
4161                         if (memcmp(&sin1->sin6_addr, &sin2->sin6_addr,
4162                             sizeof(struct in6_addr)) == 0) {
4163                                 /* matched */
4164                                 sctp_remove_laddr(laddr);
4165                                 return (0);
4166                         }
4167                 } else if (l_sa->sa_family == AF_INET) {
4168                         /* IPv4 address */
4169                         struct sockaddr_in *sin1, *sin2;
4170
4171                         sin1 = (struct sockaddr_in *)l_sa;
4172                         sin2 = (struct sockaddr_in *)sa;
4173                         if (sin1->sin_addr.s_addr == sin2->sin_addr.s_addr) {
4174                                 /* matched */
4175                                 sctp_remove_laddr(laddr);
4176                                 return (0);
4177                         }
4178                 } else {
4179                         /* invalid family */
4180                         return (-1);
4181                 }
4182         }                       /* end foreach */
4183         /* address not found! */
4184         return (-1);
4185 }
4186
4187 static char sctp_pcb_initialized = 0;
4188
4189 /*
4190  * Temporarily remove for __APPLE__ until we use the Tiger equivalents
4191  */
4192 /* sysctl */
4193 static int sctp_max_number_of_assoc = SCTP_MAX_NUM_OF_ASOC;
4194 static int sctp_scale_up_for_address = SCTP_SCALE_FOR_ADDR;
4195
4196 void
4197 sctp_pcb_init()
4198 {
4199         /*
4200          * SCTP initialization for the PCB structures should be called by
4201          * the sctp_init() funciton.
4202          */
4203         int i;
4204
4205         if (sctp_pcb_initialized != 0) {
4206                 /* error I was called twice */
4207                 return;
4208         }
4209         sctp_pcb_initialized = 1;
4210
4211         bzero(&sctpstat, sizeof(struct sctpstat));
4212
4213         /* init the empty list of (All) Endpoints */
4214         LIST_INIT(&sctppcbinfo.listhead);
4215
4216         /* init the iterator head */
4217         LIST_INIT(&sctppcbinfo.iteratorhead);
4218
4219         /* init the hash table of endpoints */
4220         TUNABLE_INT_FETCH("net.inet.sctp.tcbhashsize", &sctp_hashtblsize);
4221         TUNABLE_INT_FETCH("net.inet.sctp.pcbhashsize", &sctp_pcbtblsize);
4222         TUNABLE_INT_FETCH("net.inet.sctp.chunkscale", &sctp_chunkscale);
4223         sctppcbinfo.sctp_asochash = SCTP_HASH_INIT((sctp_hashtblsize * 31),
4224             &sctppcbinfo.hashasocmark);
4225         sctppcbinfo.sctp_ephash = SCTP_HASH_INIT(sctp_hashtblsize,
4226             &sctppcbinfo.hashmark);
4227         sctppcbinfo.sctp_tcpephash = SCTP_HASH_INIT(sctp_hashtblsize,
4228             &sctppcbinfo.hashtcpmark);
4229         sctppcbinfo.hashtblsize = sctp_hashtblsize;
4230
4231         /* init the small hash table we use to track restarted asoc's */
4232         sctppcbinfo.sctp_restarthash = SCTP_HASH_INIT(SCTP_STACK_VTAG_HASH_SIZE,
4233             &sctppcbinfo.hashrestartmark);
4234
4235         /* init the zones */
4236         /*
4237          * FIX ME: Should check for NULL returns, but if it does fail we are
4238          * doomed to panic anyways... add later maybe.
4239          */
4240         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_ep, "sctp_ep",
4241             sizeof(struct sctp_inpcb), maxsockets);
4242
4243         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_asoc, "sctp_asoc",
4244             sizeof(struct sctp_tcb), sctp_max_number_of_assoc);
4245
4246         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_laddr, "sctp_laddr",
4247             sizeof(struct sctp_laddr),
4248             (sctp_max_number_of_assoc * sctp_scale_up_for_address));
4249
4250         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_net, "sctp_raddr",
4251             sizeof(struct sctp_nets),
4252             (sctp_max_number_of_assoc * sctp_scale_up_for_address));
4253
4254         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_chunk, "sctp_chunk",
4255             sizeof(struct sctp_tmit_chunk),
4256             (sctp_max_number_of_assoc * sctp_chunkscale));
4257
4258         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_readq, "sctp_readq",
4259             sizeof(struct sctp_queued_to_read),
4260             (sctp_max_number_of_assoc * sctp_chunkscale));
4261
4262         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_strmoq, "sctp_stream_msg_out",
4263             sizeof(struct sctp_stream_queue_pending),
4264             (sctp_max_number_of_assoc * sctp_chunkscale));
4265
4266         /* Master Lock INIT for info structure */
4267         SCTP_INP_INFO_LOCK_INIT();
4268         SCTP_STATLOG_INIT_LOCK();
4269         SCTP_ITERATOR_LOCK_INIT();
4270
4271         SCTP_IPI_COUNT_INIT();
4272         SCTP_IPI_ADDR_INIT();
4273         LIST_INIT(&sctppcbinfo.addr_wq);
4274
4275         /* not sure if we need all the counts */
4276         sctppcbinfo.ipi_count_ep = 0;
4277         /* assoc/tcb zone info */
4278         sctppcbinfo.ipi_count_asoc = 0;
4279         /* local addrlist zone info */
4280         sctppcbinfo.ipi_count_laddr = 0;
4281         /* remote addrlist zone info */
4282         sctppcbinfo.ipi_count_raddr = 0;
4283         /* chunk info */
4284         sctppcbinfo.ipi_count_chunk = 0;
4285
4286         /* socket queue zone info */
4287         sctppcbinfo.ipi_count_readq = 0;
4288
4289         /* stream out queue cont */
4290         sctppcbinfo.ipi_count_strmoq = 0;
4291
4292         sctppcbinfo.ipi_free_strmoq = 0;
4293         sctppcbinfo.ipi_free_chunks = 0;
4294
4295         SCTP_OS_TIMER_INIT(&sctppcbinfo.addr_wq_timer.timer);
4296
4297         /* Init the TIMEWAIT list */
4298         for (i = 0; i < SCTP_STACK_VTAG_HASH_SIZE; i++) {
4299                 LIST_INIT(&sctppcbinfo.vtag_timewait[i]);
4300         }
4301
4302 }
4303
4304
4305 int
4306 sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m,
4307     int iphlen, int offset, int limit, struct sctphdr *sh,
4308     struct sockaddr *altsa)
4309 {
4310         /*
4311          * grub through the INIT pulling addresses and loading them to the
4312          * nets structure in the asoc. The from address in the mbuf should
4313          * also be loaded (if it is not already). This routine can be called
4314          * with either INIT or INIT-ACK's as long as the m points to the IP
4315          * packet and the offset points to the beginning of the parameters.
4316          */
4317         struct sctp_inpcb *inp, *l_inp;
4318         struct sctp_nets *net, *net_tmp;
4319         struct ip *iph;
4320         struct sctp_paramhdr *phdr, parm_buf;
4321         struct sctp_tcb *stcb_tmp;
4322         uint16_t ptype, plen;
4323         struct sockaddr *sa;
4324         struct sockaddr_storage dest_store;
4325         struct sockaddr *local_sa = (struct sockaddr *)&dest_store;
4326         struct sockaddr_in sin;
4327         struct sockaddr_in6 sin6;
4328         uint8_t store[384];
4329         struct sctp_auth_random *random = NULL;
4330         uint16_t random_len = 0;
4331         struct sctp_auth_hmac_algo *hmacs = NULL;
4332         uint16_t hmacs_len = 0;
4333         struct sctp_auth_chunk_list *chunks = NULL;
4334         uint16_t num_chunks = 0;
4335         sctp_key_t *new_key;
4336         uint32_t keylen;
4337         int got_random = 0, got_hmacs = 0, got_chklist = 0;
4338
4339         /* First get the destination address setup too. */
4340         memset(&sin, 0, sizeof(sin));
4341         memset(&sin6, 0, sizeof(sin6));
4342
4343         sin.sin_family = AF_INET;
4344         sin.sin_len = sizeof(sin);
4345         sin.sin_port = stcb->rport;
4346
4347         sin6.sin6_family = AF_INET6;
4348         sin6.sin6_len = sizeof(struct sockaddr_in6);
4349         sin6.sin6_port = stcb->rport;
4350         if (altsa == NULL) {
4351                 iph = mtod(m, struct ip *);
4352                 if (iph->ip_v == IPVERSION) {
4353                         /* its IPv4 */
4354                         struct sockaddr_in *sin_2;
4355
4356                         sin_2 = (struct sockaddr_in *)(local_sa);
4357                         memset(sin_2, 0, sizeof(sin));
4358                         sin_2->sin_family = AF_INET;
4359                         sin_2->sin_len = sizeof(sin);
4360                         sin_2->sin_port = sh->dest_port;
4361                         sin_2->sin_addr.s_addr = iph->ip_dst.s_addr;
4362                         sin.sin_addr = iph->ip_src;
4363                         sa = (struct sockaddr *)&sin;
4364                 } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
4365                         /* its IPv6 */
4366                         struct ip6_hdr *ip6;
4367                         struct sockaddr_in6 *sin6_2;
4368
4369                         ip6 = mtod(m, struct ip6_hdr *);
4370                         sin6_2 = (struct sockaddr_in6 *)(local_sa);
4371                         memset(sin6_2, 0, sizeof(sin6));
4372                         sin6_2->sin6_family = AF_INET6;
4373                         sin6_2->sin6_len = sizeof(struct sockaddr_in6);
4374                         sin6_2->sin6_port = sh->dest_port;
4375                         sin6.sin6_addr = ip6->ip6_src;
4376                         sa = (struct sockaddr *)&sin6;
4377                 } else {
4378                         sa = NULL;
4379                 }
4380         } else {
4381                 /*
4382                  * For cookies we use the src address NOT from the packet
4383                  * but from the original INIT
4384                  */
4385                 sa = altsa;
4386         }
4387         /* Turn off ECN until we get through all params */
4388         stcb->asoc.ecn_allowed = 0;
4389         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
4390                 /* mark all addresses that we have currently on the list */
4391                 net->dest_state |= SCTP_ADDR_NOT_IN_ASSOC;
4392         }
4393         /* does the source address already exist? if so skip it */
4394         l_inp = inp = stcb->sctp_ep;
4395
4396         atomic_add_int(&stcb->asoc.refcnt, 1);
4397         stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net_tmp, local_sa, stcb);
4398         atomic_add_int(&stcb->asoc.refcnt, -1);
4399
4400         if ((stcb_tmp == NULL && inp == stcb->sctp_ep) || inp == NULL) {
4401                 /* we must add the source address */
4402                 /* no scope set here since we have a tcb already. */
4403                 if ((sa->sa_family == AF_INET) &&
4404                     (stcb->asoc.ipv4_addr_legal)) {
4405                         if (sctp_add_remote_addr(stcb, sa, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_2)) {
4406                                 return (-1);
4407                         }
4408                 } else if ((sa->sa_family == AF_INET6) &&
4409                     (stcb->asoc.ipv6_addr_legal)) {
4410                         if (sctp_add_remote_addr(stcb, sa, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_3)) {
4411                                 return (-2);
4412                         }
4413                 }
4414         } else {
4415                 if (net_tmp != NULL && stcb_tmp == stcb) {
4416                         net_tmp->dest_state &= ~SCTP_ADDR_NOT_IN_ASSOC;
4417                 } else if (stcb_tmp != stcb) {
4418                         /* It belongs to another association? */
4419                         SCTP_TCB_UNLOCK(stcb_tmp);
4420                         return (-3);
4421                 }
4422         }
4423         if (stcb->asoc.state == 0) {
4424                 /* the assoc was freed? */
4425                 return (-4);
4426         }
4427         /* now we must go through each of the params. */
4428         phdr = sctp_get_next_param(m, offset, &parm_buf, sizeof(parm_buf));
4429         while (phdr) {
4430                 ptype = ntohs(phdr->param_type);
4431                 plen = ntohs(phdr->param_length);
4432                 /*
4433                  * printf("ptype => %0x, plen => %d\n", (uint32_t)ptype,
4434                  * (int)plen);
4435                  */
4436                 if (offset + plen > limit) {
4437                         break;
4438                 }
4439                 if (plen == 0) {
4440                         break;
4441                 }
4442                 if (ptype == SCTP_IPV4_ADDRESS) {
4443                         if (stcb->asoc.ipv4_addr_legal) {
4444                                 struct sctp_ipv4addr_param *p4, p4_buf;
4445
4446                                 /* ok get the v4 address and check/add */
4447                                 phdr = sctp_get_next_param(m, offset,
4448                                     (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf));
4449                                 if (plen != sizeof(struct sctp_ipv4addr_param) ||
4450                                     phdr == NULL) {
4451                                         return (-5);
4452                                 }
4453                                 p4 = (struct sctp_ipv4addr_param *)phdr;
4454                                 sin.sin_addr.s_addr = p4->addr;
4455                                 sa = (struct sockaddr *)&sin;
4456                                 inp = stcb->sctp_ep;
4457                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4458                                 stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net,
4459                                     local_sa, stcb);
4460                                 atomic_add_int(&stcb->asoc.refcnt, -1);
4461
4462                                 if ((stcb_tmp == NULL && inp == stcb->sctp_ep) ||
4463                                     inp == NULL) {
4464                                         /* we must add the source address */
4465                                         /*
4466                                          * no scope set since we have a tcb
4467                                          * already
4468                                          */
4469
4470                                         /*
4471                                          * we must validate the state again
4472                                          * here
4473                                          */
4474                                         if (stcb->asoc.state == 0) {
4475                                                 /* the assoc was freed? */
4476                                                 return (-7);
4477                                         }
4478                                         if (sctp_add_remote_addr(stcb, sa, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_4)) {
4479                                                 return (-8);
4480                                         }
4481                                 } else if (stcb_tmp == stcb) {
4482                                         if (stcb->asoc.state == 0) {
4483                                                 /* the assoc was freed? */
4484                                                 return (-10);
4485                                         }
4486                                         if (net != NULL) {
4487                                                 /* clear flag */
4488                                                 net->dest_state &=
4489                                                     ~SCTP_ADDR_NOT_IN_ASSOC;
4490                                         }
4491                                 } else {
4492                                         /*
4493                                          * strange, address is in another
4494                                          * assoc? straighten out locks.
4495                                          */
4496                                         if (stcb->asoc.state == 0) {
4497                                                 /* the assoc was freed? */
4498                                                 return (-12);
4499                                         }
4500                                         return (-13);
4501                                 }
4502                         }
4503                 } else if (ptype == SCTP_IPV6_ADDRESS) {
4504                         if (stcb->asoc.ipv6_addr_legal) {
4505                                 /* ok get the v6 address and check/add */
4506                                 struct sctp_ipv6addr_param *p6, p6_buf;
4507
4508                                 phdr = sctp_get_next_param(m, offset,
4509                                     (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf));
4510                                 if (plen != sizeof(struct sctp_ipv6addr_param) ||
4511                                     phdr == NULL) {
4512                                         return (-14);
4513                                 }
4514                                 p6 = (struct sctp_ipv6addr_param *)phdr;
4515                                 memcpy((caddr_t)&sin6.sin6_addr, p6->addr,
4516                                     sizeof(p6->addr));
4517                                 sa = (struct sockaddr *)&sin6;
4518                                 inp = stcb->sctp_ep;
4519                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4520                                 stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net,
4521                                     local_sa, stcb);
4522                                 atomic_add_int(&stcb->asoc.refcnt, -1);
4523                                 if (stcb_tmp == NULL && (inp == stcb->sctp_ep ||
4524                                     inp == NULL)) {
4525                                         /*
4526                                          * we must validate the state again
4527                                          * here
4528                                          */
4529                                         if (stcb->asoc.state == 0) {
4530                                                 /* the assoc was freed? */
4531                                                 return (-16);
4532                                         }
4533                                         /*
4534                                          * we must add the address, no scope
4535                                          * set
4536                                          */
4537                                         if (sctp_add_remote_addr(stcb, sa, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_5)) {
4538                                                 return (-17);
4539                                         }
4540                                 } else if (stcb_tmp == stcb) {
4541                                         /*
4542                                          * we must validate the state again
4543                                          * here
4544                                          */
4545                                         if (stcb->asoc.state == 0) {
4546                                                 /* the assoc was freed? */
4547                                                 return (-19);
4548                                         }
4549                                         if (net != NULL) {
4550                                                 /* clear flag */
4551                                                 net->dest_state &=
4552                                                     ~SCTP_ADDR_NOT_IN_ASSOC;
4553                                         }
4554                                 } else {
4555                                         /*
4556                                          * strange, address is in another
4557                                          * assoc? straighten out locks.
4558                                          */
4559                                         if (stcb->asoc.state == 0) {
4560                                                 /* the assoc was freed? */
4561                                                 return (-21);
4562                                         }
4563                                         return (-22);
4564                                 }
4565                         }
4566                 } else if (ptype == SCTP_ECN_CAPABLE) {
4567                         stcb->asoc.ecn_allowed = 1;
4568                 } else if (ptype == SCTP_ULP_ADAPTATION) {
4569                         if (stcb->asoc.state != SCTP_STATE_OPEN) {
4570                                 struct sctp_adaptation_layer_indication ai,
4571                                                                 *aip;
4572
4573                                 phdr = sctp_get_next_param(m, offset,
4574                                     (struct sctp_paramhdr *)&ai, sizeof(ai));
4575                                 aip = (struct sctp_adaptation_layer_indication *)phdr;
4576                                 sctp_ulp_notify(SCTP_NOTIFY_ADAPTATION_INDICATION,
4577                                     stcb, ntohl(aip->indication), NULL);
4578                         }
4579                 } else if (ptype == SCTP_SET_PRIM_ADDR) {
4580                         struct sctp_asconf_addr_param lstore, *fee;
4581                         struct sctp_asconf_addrv4_param *fii;
4582                         int lptype;
4583                         struct sockaddr *lsa = NULL;
4584
4585                         stcb->asoc.peer_supports_asconf = 1;
4586                         if (plen > sizeof(lstore)) {
4587                                 return (-23);
4588                         }
4589                         phdr = sctp_get_next_param(m, offset,
4590                             (struct sctp_paramhdr *)&lstore, plen);
4591                         if (phdr == NULL) {
4592                                 return (-24);
4593                         }
4594                         fee = (struct sctp_asconf_addr_param *)phdr;
4595                         lptype = ntohs(fee->addrp.ph.param_type);
4596                         if (lptype == SCTP_IPV4_ADDRESS) {
4597                                 if (plen !=
4598                                     sizeof(struct sctp_asconf_addrv4_param)) {
4599                                         printf("Sizeof setprim in init/init ack not %d but %d - ignored\n",
4600                                             (int)sizeof(struct sctp_asconf_addrv4_param),
4601                                             plen);
4602                                 } else {
4603                                         fii = (struct sctp_asconf_addrv4_param *)fee;
4604                                         sin.sin_addr.s_addr = fii->addrp.addr;
4605                                         lsa = (struct sockaddr *)&sin;
4606                                 }
4607                         } else if (lptype == SCTP_IPV6_ADDRESS) {
4608                                 if (plen !=
4609                                     sizeof(struct sctp_asconf_addr_param)) {
4610                                         printf("Sizeof setprim (v6) in init/init ack not %d but %d - ignored\n",
4611                                             (int)sizeof(struct sctp_asconf_addr_param),
4612                                             plen);
4613                                 } else {
4614                                         memcpy(sin6.sin6_addr.s6_addr,
4615                                             fee->addrp.addr,
4616                                             sizeof(fee->addrp.addr));
4617                                         lsa = (struct sockaddr *)&sin6;
4618                                 }
4619                         }
4620                         if (lsa) {
4621                                 sctp_set_primary_addr(stcb, sa, NULL);
4622                         }
4623                 } else if (ptype == SCTP_PRSCTP_SUPPORTED) {
4624                         /* Peer supports pr-sctp */
4625                         stcb->asoc.peer_supports_prsctp = 1;
4626                 } else if (ptype == SCTP_SUPPORTED_CHUNK_EXT) {
4627                         /* A supported extension chunk */
4628                         struct sctp_supported_chunk_types_param *pr_supported;
4629                         uint8_t local_store[128];
4630                         int num_ent, i;
4631
4632                         phdr = sctp_get_next_param(m, offset,
4633                             (struct sctp_paramhdr *)&local_store, plen);
4634                         if (phdr == NULL) {
4635                                 return (-25);
4636                         }
4637                         stcb->asoc.peer_supports_asconf = 0;
4638                         stcb->asoc.peer_supports_prsctp = 0;
4639                         stcb->asoc.peer_supports_pktdrop = 0;
4640                         stcb->asoc.peer_supports_strreset = 0;
4641                         stcb->asoc.peer_supports_auth = 0;
4642                         pr_supported = (struct sctp_supported_chunk_types_param *)phdr;
4643                         num_ent = plen - sizeof(struct sctp_paramhdr);
4644                         for (i = 0; i < num_ent; i++) {
4645                                 switch (pr_supported->chunk_types[i]) {
4646                                 case SCTP_ASCONF:
4647                                 case SCTP_ASCONF_ACK:
4648                                         stcb->asoc.peer_supports_asconf = 1;
4649                                         break;
4650                                 case SCTP_FORWARD_CUM_TSN:
4651                                         stcb->asoc.peer_supports_prsctp = 1;
4652                                         break;
4653                                 case SCTP_PACKET_DROPPED:
4654                                         stcb->asoc.peer_supports_pktdrop = 1;
4655                                         break;
4656                                 case SCTP_STREAM_RESET:
4657                                         stcb->asoc.peer_supports_strreset = 1;
4658                                         break;
4659                                 case SCTP_AUTHENTICATION:
4660                                         stcb->asoc.peer_supports_auth = 1;
4661                                         break;
4662                                 default:
4663                                         /* one I have not learned yet */
4664                                         break;
4665
4666                                 }
4667                         }
4668                 } else if (ptype == SCTP_ECN_NONCE_SUPPORTED) {
4669                         /* Peer supports ECN-nonce */
4670                         stcb->asoc.peer_supports_ecn_nonce = 1;
4671                         stcb->asoc.ecn_nonce_allowed = 1;
4672                 } else if (ptype == SCTP_RANDOM) {
4673                         if (plen > sizeof(store))
4674                                 break;
4675                         if (got_random) {
4676                                 /* already processed a RANDOM */
4677                                 goto next_param;
4678                         }
4679                         phdr = sctp_get_next_param(m, offset,
4680                             (struct sctp_paramhdr *)store,
4681                             plen);
4682                         if (phdr == NULL)
4683                                 return (-26);
4684                         random = (struct sctp_auth_random *)phdr;
4685                         random_len = plen - sizeof(*random);
4686                         /* enforce the random length */
4687                         if (random_len != SCTP_AUTH_RANDOM_SIZE_REQUIRED) {
4688 #ifdef SCTP_DEBUG
4689                                 if (sctp_debug_on & SCTP_DEBUG_AUTH1)
4690                                         printf("SCTP: invalid RANDOM len\n");
4691 #endif
4692                                 return (-27);
4693                         }
4694                         got_random = 1;
4695                 } else if (ptype == SCTP_HMAC_LIST) {
4696                         int num_hmacs;
4697                         int i;
4698
4699                         if (plen > sizeof(store))
4700                                 break;
4701                         if (got_hmacs) {
4702                                 /* already processed a HMAC list */
4703                                 goto next_param;
4704                         }
4705                         phdr = sctp_get_next_param(m, offset,
4706                             (struct sctp_paramhdr *)store,
4707                             plen);
4708                         if (phdr == NULL)
4709                                 return (-28);
4710                         hmacs = (struct sctp_auth_hmac_algo *)phdr;
4711                         hmacs_len = plen - sizeof(*hmacs);
4712                         num_hmacs = hmacs_len / sizeof(hmacs->hmac_ids[0]);
4713                         /* validate the hmac list */
4714                         if (sctp_verify_hmac_param(hmacs, num_hmacs)) {
4715                                 return (-29);
4716                         }
4717                         if (stcb->asoc.peer_hmacs != NULL)
4718                                 sctp_free_hmaclist(stcb->asoc.peer_hmacs);
4719                         stcb->asoc.peer_hmacs = sctp_alloc_hmaclist(num_hmacs);
4720                         if (stcb->asoc.peer_hmacs != NULL) {
4721                                 for (i = 0; i < num_hmacs; i++) {
4722                                         sctp_auth_add_hmacid(stcb->asoc.peer_hmacs,
4723                                             ntohs(hmacs->hmac_ids[i]));
4724                                 }
4725                         }
4726                         got_hmacs = 1;
4727                 } else if (ptype == SCTP_CHUNK_LIST) {
4728                         int i;
4729
4730                         if (plen > sizeof(store))
4731                                 break;
4732                         if (got_chklist) {
4733                                 /* already processed a Chunks list */
4734                                 goto next_param;
4735                         }
4736                         phdr = sctp_get_next_param(m, offset,
4737                             (struct sctp_paramhdr *)store,
4738                             plen);
4739                         if (phdr == NULL)
4740                                 return (-30);
4741                         chunks = (struct sctp_auth_chunk_list *)phdr;
4742                         num_chunks = plen - sizeof(*chunks);
4743                         if (stcb->asoc.peer_auth_chunks != NULL)
4744                                 sctp_clear_chunklist(stcb->asoc.peer_auth_chunks);
4745                         else
4746                                 stcb->asoc.peer_auth_chunks = sctp_alloc_chunklist();
4747                         for (i = 0; i < num_chunks; i++) {
4748                                 sctp_auth_add_chunk(chunks->chunk_types[i],
4749                                     stcb->asoc.peer_auth_chunks);
4750                         }
4751                         got_chklist = 1;
4752                 } else if ((ptype == SCTP_HEARTBEAT_INFO) ||
4753                             (ptype == SCTP_STATE_COOKIE) ||
4754                             (ptype == SCTP_UNRECOG_PARAM) ||
4755                             (ptype == SCTP_COOKIE_PRESERVE) ||
4756                             (ptype == SCTP_SUPPORTED_ADDRTYPE) ||
4757                             (ptype == SCTP_ADD_IP_ADDRESS) ||
4758                             (ptype == SCTP_DEL_IP_ADDRESS) ||
4759                             (ptype == SCTP_ERROR_CAUSE_IND) ||
4760                     (ptype == SCTP_SUCCESS_REPORT)) {
4761                          /* don't care */ ;
4762                 } else {
4763                         if ((ptype & 0x8000) == 0x0000) {
4764                                 /*
4765                                  * must stop processing the rest of the
4766                                  * param's. Any report bits were handled
4767                                  * with the call to
4768                                  * sctp_arethere_unrecognized_parameters()
4769                                  * when the INIT or INIT-ACK was first seen.
4770                                  */
4771                                 break;
4772                         }
4773                 }
4774 next_param:
4775                 offset += SCTP_SIZE32(plen);
4776                 if (offset >= limit) {
4777                         break;
4778                 }
4779                 phdr = sctp_get_next_param(m, offset, &parm_buf,
4780                     sizeof(parm_buf));
4781         }
4782         /* Now check to see if we need to purge any addresses */
4783         for (net = TAILQ_FIRST(&stcb->asoc.nets); net != NULL; net = net_tmp) {
4784                 net_tmp = TAILQ_NEXT(net, sctp_next);
4785                 if ((net->dest_state & SCTP_ADDR_NOT_IN_ASSOC) ==
4786                     SCTP_ADDR_NOT_IN_ASSOC) {
4787                         /* This address has been removed from the asoc */
4788                         /* remove and free it */
4789                         stcb->asoc.numnets--;
4790                         TAILQ_REMOVE(&stcb->asoc.nets, net, sctp_next);
4791                         sctp_free_remote_addr(net);
4792                         if (net == stcb->asoc.primary_destination) {
4793                                 stcb->asoc.primary_destination = NULL;
4794                                 sctp_select_primary_destination(stcb);
4795                         }
4796                 }
4797         }
4798         /* validate authentication required parameters */
4799         if (got_random && got_hmacs) {
4800                 stcb->asoc.peer_supports_auth = 1;
4801         } else {
4802                 stcb->asoc.peer_supports_auth = 0;
4803         }
4804         if (!sctp_asconf_auth_nochk && stcb->asoc.peer_supports_asconf &&
4805             !stcb->asoc.peer_supports_auth) {
4806                 return (-31);
4807         }
4808         /* concatenate the full random key */
4809         keylen = random_len + num_chunks + hmacs_len;
4810         new_key = sctp_alloc_key(keylen);
4811         if (new_key != NULL) {
4812                 /* copy in the RANDOM */
4813                 if (random != NULL)
4814                         bcopy(random->random_data, new_key->key, random_len);
4815                 /* append in the AUTH chunks */
4816                 if (chunks != NULL)
4817                         bcopy(chunks->chunk_types, new_key->key + random_len,
4818                             num_chunks);
4819                 /* append in the HMACs */
4820                 if (hmacs != NULL)
4821                         bcopy(hmacs->hmac_ids, new_key->key + random_len + num_chunks,
4822                             hmacs_len);
4823         } else {
4824                 return (-32);
4825         }
4826         if (stcb->asoc.authinfo.peer_random != NULL)
4827                 sctp_free_key(stcb->asoc.authinfo.peer_random);
4828         stcb->asoc.authinfo.peer_random = new_key;
4829 #ifdef SCTP_AUTH_DRAFT_04
4830         /* don't include the chunks and hmacs for draft -04 */
4831         stcb->asoc.authinfo.peer_random->keylen = random_len;
4832 #endif
4833         sctp_clear_cachedkeys(stcb, stcb->asoc.authinfo.assoc_keyid);
4834         sctp_clear_cachedkeys(stcb, stcb->asoc.authinfo.recv_keyid);
4835
4836         return (0);
4837 }
4838
4839 int
4840 sctp_set_primary_addr(struct sctp_tcb *stcb, struct sockaddr *sa,
4841     struct sctp_nets *net)
4842 {
4843         /* make sure the requested primary address exists in the assoc */
4844         if (net == NULL && sa)
4845                 net = sctp_findnet(stcb, sa);
4846
4847         if (net == NULL) {
4848                 /* didn't find the requested primary address! */
4849                 return (-1);
4850         } else {
4851                 /* set the primary address */
4852                 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {
4853                         /* Must be confirmed */
4854                         return (-1);
4855                 }
4856                 stcb->asoc.primary_destination = net;
4857                 net->dest_state &= ~SCTP_ADDR_WAS_PRIMARY;
4858                 net = TAILQ_FIRST(&stcb->asoc.nets);
4859                 if (net != stcb->asoc.primary_destination) {
4860                         /*
4861                          * first one on the list is NOT the primary
4862                          * sctp_cmpaddr() is much more efficent if the
4863                          * primary is the first on the list, make it so.
4864                          */
4865                         TAILQ_REMOVE(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next);
4866                         TAILQ_INSERT_HEAD(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next);
4867                 }
4868                 return (0);
4869         }
4870 }
4871
4872
4873 int
4874 sctp_is_vtag_good(struct sctp_inpcb *inp, uint32_t tag, struct timeval *now)
4875 {
4876         /*
4877          * This function serves two purposes. It will see if a TAG can be
4878          * re-used and return 1 for yes it is ok and 0 for don't use that
4879          * tag. A secondary function it will do is purge out old tags that
4880          * can be removed.
4881          */
4882         struct sctpasochead *head;
4883         struct sctpvtaghead *chain;
4884         struct sctp_tagblock *twait_block;
4885         struct sctp_tcb *stcb;
4886         int i;
4887
4888         SCTP_INP_INFO_WLOCK();
4889         chain = &sctppcbinfo.vtag_timewait[(tag % SCTP_STACK_VTAG_HASH_SIZE)];
4890         /* First is the vtag in use ? */
4891
4892         head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(tag,
4893             sctppcbinfo.hashasocmark)];
4894         if (head == NULL) {
4895                 goto check_restart;
4896         }
4897         LIST_FOREACH(stcb, head, sctp_asocs) {
4898
4899                 if (stcb->asoc.my_vtag == tag) {
4900                         /*
4901                          * We should remove this if and return 0 always if
4902                          * we want vtags unique across all endpoints. For
4903                          * now within a endpoint is ok.
4904                          */
4905                         if (inp == stcb->sctp_ep) {
4906                                 /* bad tag, in use */
4907                                 SCTP_INP_INFO_WUNLOCK();
4908                                 return (0);
4909                         }
4910                 }
4911         }
4912 check_restart:
4913         /* Now lets check the restart hash */
4914         head = &sctppcbinfo.sctp_restarthash[SCTP_PCBHASH_ASOC(tag,
4915             sctppcbinfo.hashrestartmark)];
4916         if (head == NULL) {
4917                 goto check_time_wait;
4918         }
4919         LIST_FOREACH(stcb, head, sctp_tcbrestarhash) {
4920                 if (stcb->asoc.assoc_id == tag) {
4921                         /* candidate */
4922                         if (inp == stcb->sctp_ep) {
4923                                 /* bad tag, in use */
4924                                 SCTP_INP_INFO_WUNLOCK();
4925                                 return (0);
4926                         }
4927                 }
4928         }
4929 check_time_wait:
4930         /* Now what about timed wait ? */
4931         if (!LIST_EMPTY(chain)) {
4932                 /*
4933                  * Block(s) are present, lets see if we have this tag in the
4934                  * list
4935                  */
4936                 LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) {
4937                         for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) {
4938                                 if (twait_block->vtag_block[i].v_tag == 0) {
4939                                         /* not used */
4940                                         continue;
4941                                 } else if ((long)twait_block->vtag_block[i].tv_sec_at_expire >
4942                                     now->tv_sec) {
4943                                         /* Audit expires this guy */
4944                                         twait_block->vtag_block[i].tv_sec_at_expire = 0;
4945                                         twait_block->vtag_block[i].v_tag = 0;
4946                                 } else if (twait_block->vtag_block[i].v_tag ==
4947                                     tag) {
4948                                         /* Bad tag, sorry :< */
4949                                         SCTP_INP_INFO_WUNLOCK();
4950                                         return (0);
4951                                 }
4952                         }
4953                 }
4954         }
4955         /* Not found, ok to use the tag */
4956         SCTP_INP_INFO_WUNLOCK();
4957         return (1);
4958 }
4959
4960
4961 /*
4962  * Delete the address from the endpoint local address list Lookup using a
4963  * sockaddr address (ie. not an ifaddr)
4964  */
4965 int
4966 sctp_del_local_addr_ep_sa(struct sctp_inpcb *inp, struct sockaddr *sa)
4967 {
4968         struct sctp_laddr *laddr;
4969         struct sockaddr *l_sa;
4970         int found = 0;
4971
4972         /*
4973          * Here is another function I cannot find a caller for. As such we
4974          * SHOULD delete it if we have no users. If we find a user that user
4975          * MUST have the INP locked.
4976          *
4977          */
4978
4979         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
4980                 /* You are already bound to all. You have it already */
4981                 return (EINVAL);
4982         }
4983         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
4984                 /* make sure the address exists */
4985                 if (laddr->ifa == NULL)
4986                         continue;
4987                 if (laddr->ifa->ifa_addr == NULL)
4988                         continue;
4989
4990                 l_sa = laddr->ifa->ifa_addr;
4991                 if (l_sa->sa_family == AF_INET6) {
4992                         /* IPv6 address */
4993                         struct sockaddr_in6 *sin1, *sin2;
4994
4995                         sin1 = (struct sockaddr_in6 *)l_sa;
4996                         sin2 = (struct sockaddr_in6 *)sa;
4997                         if (memcmp(&sin1->sin6_addr, &sin2->sin6_addr,
4998                             sizeof(struct in6_addr)) == 0) {
4999                                 /* matched */
5000                                 found = 1;
5001                                 break;
5002                         }
5003                 } else if (l_sa->sa_family == AF_INET) {
5004                         /* IPv4 address */
5005                         struct sockaddr_in *sin1, *sin2;
5006
5007                         sin1 = (struct sockaddr_in *)l_sa;
5008                         sin2 = (struct sockaddr_in *)sa;
5009                         if (sin1->sin_addr.s_addr == sin2->sin_addr.s_addr) {
5010                                 /* matched */
5011                                 found = 1;
5012                                 break;
5013                         }
5014                 } else {
5015                         /* invalid family */
5016                         return (-1);
5017                 }
5018         }
5019
5020         if (found && inp->laddr_count < 2) {
5021                 /* can't delete unless there are at LEAST 2 addresses */
5022                 return (-1);
5023         }
5024         if (found && (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
5025                 /*
5026                  * remove it from the ep list, this should NOT be done until
5027                  * its really gone from the interface list and we won't be
5028                  * receiving more of these. Probably right away. If we do
5029                  * allow a removal of an address from an association
5030                  * (sub-set bind) than this should NOT be called until the
5031                  * all ASCONF come back from this association.
5032                  */
5033                 sctp_remove_laddr(laddr);
5034                 return (0);
5035         } else {
5036                 return (-1);
5037         }
5038 }
5039
5040 static sctp_assoc_t reneged_asoc_ids[256];
5041 static uint8_t reneged_at = 0;
5042
5043 extern int sctp_do_drain;
5044
5045 static void
5046 sctp_drain_mbufs(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
5047 {
5048         /*
5049          * We must hunt this association for MBUF's past the cumack (i.e.
5050          * out of order data that we can renege on).
5051          */
5052         struct sctp_association *asoc;
5053         struct sctp_tmit_chunk *chk, *nchk;
5054         uint32_t cumulative_tsn_p1, tsn;
5055         struct sctp_queued_to_read *ctl, *nctl;
5056         int cnt, strmat, gap;
5057
5058         /* We look for anything larger than the cum-ack + 1 */
5059
5060         SCTP_STAT_INCR(sctps_protocol_drain_calls);
5061         if (sctp_do_drain == 0) {
5062                 return;
5063         }
5064         asoc = &stcb->asoc;
5065         if (asoc->cumulative_tsn == asoc->highest_tsn_inside_map) {
5066                 /* none we can reneg on. */
5067                 return;
5068         }
5069         SCTP_STAT_INCR(sctps_protocol_drains_done);
5070         cumulative_tsn_p1 = asoc->cumulative_tsn + 1;
5071         cnt = 0;
5072         /* First look in the re-assembly queue */
5073         chk = TAILQ_FIRST(&asoc->reasmqueue);
5074         while (chk) {
5075                 /* Get the next one */
5076                 nchk = TAILQ_NEXT(chk, sctp_next);
5077                 if (compare_with_wrap(chk->rec.data.TSN_seq,
5078                     cumulative_tsn_p1, MAX_TSN)) {
5079                         /* Yep it is above cum-ack */
5080                         cnt++;
5081                         tsn = chk->rec.data.TSN_seq;
5082                         if (tsn >= asoc->mapping_array_base_tsn) {
5083                                 gap = tsn - asoc->mapping_array_base_tsn;
5084                         } else {
5085                                 gap = (MAX_TSN - asoc->mapping_array_base_tsn) +
5086                                     tsn + 1;
5087                         }
5088                         asoc->size_on_reasm_queue = sctp_sbspace_sub(asoc->size_on_reasm_queue, chk->send_size);
5089                         sctp_ucount_decr(asoc->cnt_on_reasm_queue);
5090                         SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap);
5091                         TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
5092                         if (chk->data) {
5093                                 sctp_m_freem(chk->data);
5094                                 chk->data = NULL;
5095                         }
5096                         sctp_free_remote_addr(chk->whoTo);
5097                         sctp_free_a_chunk(stcb, chk);
5098                 }
5099                 chk = nchk;
5100         }
5101         /* Ok that was fun, now we will drain all the inbound streams? */
5102         for (strmat = 0; strmat < asoc->streamincnt; strmat++) {
5103                 ctl = TAILQ_FIRST(&asoc->strmin[strmat].inqueue);
5104                 while (ctl) {
5105                         nctl = TAILQ_NEXT(ctl, next);
5106                         if (compare_with_wrap(ctl->sinfo_tsn,
5107                             cumulative_tsn_p1, MAX_TSN)) {
5108                                 /* Yep it is above cum-ack */
5109                                 cnt++;
5110                                 tsn = ctl->sinfo_tsn;
5111                                 if (tsn >= asoc->mapping_array_base_tsn) {
5112                                         gap = tsn -
5113                                             asoc->mapping_array_base_tsn;
5114                                 } else {
5115                                         gap = (MAX_TSN -
5116                                             asoc->mapping_array_base_tsn) +
5117                                             tsn + 1;
5118                                 }
5119                                 asoc->size_on_all_streams = sctp_sbspace_sub(asoc->size_on_all_streams, ctl->length);
5120                                 sctp_ucount_decr(asoc->cnt_on_all_streams);
5121
5122                                 SCTP_UNSET_TSN_PRESENT(asoc->mapping_array,
5123                                     gap);
5124                                 TAILQ_REMOVE(&asoc->strmin[strmat].inqueue,
5125                                     ctl, next);
5126                                 if (ctl->data) {
5127                                         sctp_m_freem(ctl->data);
5128                                         ctl->data = NULL;
5129                                 }
5130                                 sctp_free_remote_addr(ctl->whoFrom);
5131                                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_readq, ctl);
5132                                 SCTP_DECR_READQ_COUNT();
5133                         }
5134                         ctl = nctl;
5135                 }
5136         }
5137         /*
5138          * Question, should we go through the delivery queue? The only
5139          * reason things are on here is the app not reading OR a p-d-api up.
5140          * An attacker COULD send enough in to initiate the PD-API and then
5141          * send a bunch of stuff to other streams... these would wind up on
5142          * the delivery queue.. and then we would not get to them. But in
5143          * order to do this I then have to back-track and un-deliver
5144          * sequence numbers in streams.. el-yucko. I think for now we will
5145          * NOT look at the delivery queue and leave it to be something to
5146          * consider later. An alternative would be to abort the P-D-API with
5147          * a notification and then deliver the data.... Or another method
5148          * might be to keep track of how many times the situation occurs and
5149          * if we see a possible attack underway just abort the association.
5150          */
5151 #ifdef SCTP_DEBUG
5152         if (sctp_debug_on & SCTP_DEBUG_PCB1) {
5153                 if (cnt) {
5154                         printf("Freed %d chunks from reneg harvest\n", cnt);
5155                 }
5156         }
5157 #endif                          /* SCTP_DEBUG */
5158         if (cnt) {
5159                 /*
5160                  * Now do we need to find a new
5161                  * asoc->highest_tsn_inside_map?
5162                  */
5163                 if (asoc->highest_tsn_inside_map >= asoc->mapping_array_base_tsn) {
5164                         gap = asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn;
5165                 } else {
5166                         gap = (MAX_TSN - asoc->mapping_array_base_tsn) +
5167                             asoc->highest_tsn_inside_map + 1;
5168                 }
5169                 if (gap >= (asoc->mapping_array_size << 3)) {
5170                         /*
5171                          * Something bad happened or cum-ack and high were
5172                          * behind the base, but if so earlier checks should
5173                          * have found NO data... wierd... we will start at
5174                          * end of mapping array.
5175                          */
5176                         printf("Gap was larger than array?? %d set to max:%d maparraymax:%x\n",
5177                             (int)gap,
5178                             (int)(asoc->mapping_array_size << 3),
5179                             (int)asoc->highest_tsn_inside_map);
5180                         gap = asoc->mapping_array_size << 3;
5181                 }
5182                 while (gap > 0) {
5183                         if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap)) {
5184                                 /* found the new highest */
5185                                 asoc->highest_tsn_inside_map = asoc->mapping_array_base_tsn + gap;
5186                                 break;
5187                         }
5188                         gap--;
5189                 }
5190                 if (gap == 0) {
5191                         /* Nothing left in map */
5192                         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
5193                         asoc->mapping_array_base_tsn = asoc->cumulative_tsn + 1;
5194                         asoc->highest_tsn_inside_map = asoc->cumulative_tsn;
5195                 }
5196                 asoc->last_revoke_count = cnt;
5197                 SCTP_OS_TIMER_STOP(&stcb->asoc.dack_timer.timer);
5198                 sctp_send_sack(stcb);
5199                 reneged_asoc_ids[reneged_at] = sctp_get_associd(stcb);
5200                 reneged_at++;
5201         }
5202         /*
5203          * Another issue, in un-setting the TSN's in the mapping array we
5204          * DID NOT adjust the higest_tsn marker.  This will cause one of two
5205          * things to occur. It may cause us to do extra work in checking for
5206          * our mapping array movement. More importantly it may cause us to
5207          * SACK every datagram. This may not be a bad thing though since we
5208          * will recover once we get our cum-ack above and all this stuff we
5209          * dumped recovered.
5210          */
5211 }
5212
5213 void
5214 sctp_drain()
5215 {
5216         /*
5217          * We must walk the PCB lists for ALL associations here. The system
5218          * is LOW on MBUF's and needs help. This is where reneging will
5219          * occur. We really hope this does NOT happen!
5220          */
5221         struct sctp_inpcb *inp;
5222         struct sctp_tcb *stcb;
5223
5224         SCTP_INP_INFO_RLOCK();
5225         LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) {
5226                 /* For each endpoint */
5227                 SCTP_INP_RLOCK(inp);
5228                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
5229                         /* For each association */
5230                         SCTP_TCB_LOCK(stcb);
5231                         sctp_drain_mbufs(inp, stcb);
5232                         SCTP_TCB_UNLOCK(stcb);
5233                 }
5234                 SCTP_INP_RUNLOCK(inp);
5235         }
5236         SCTP_INP_INFO_RUNLOCK();
5237 }
5238
5239 /*
5240  * start a new iterator
5241  * iterates through all endpoints and associations based on the pcb_state
5242  * flags and asoc_state.  "af" (mandatory) is executed for all matching
5243  * assocs and "ef" (optional) is executed when the iterator completes.
5244  * "inpf" (optional) is executed for each new endpoint as it is being
5245  * iterated through.
5246  */
5247 int
5248 sctp_initiate_iterator(inp_func inpf, asoc_func af, uint32_t pcb_state,
5249     uint32_t pcb_features, uint32_t asoc_state, void *argp, uint32_t argi,
5250     end_func ef, struct sctp_inpcb *s_inp, uint8_t chunk_output_off)
5251 {
5252         struct sctp_iterator *it = NULL;
5253         int s;
5254
5255         if (af == NULL) {
5256                 return (-1);
5257         }
5258         SCTP_MALLOC(it, struct sctp_iterator *, sizeof(struct sctp_iterator),
5259             "Iterator");
5260         if (it == NULL) {
5261                 return (ENOMEM);
5262         }
5263         memset(it, 0, sizeof(*it));
5264         it->function_assoc = af;
5265         it->function_inp = inpf;
5266         it->function_atend = ef;
5267         it->pointer = argp;
5268         it->val = argi;
5269         it->pcb_flags = pcb_state;
5270         it->pcb_features = pcb_features;
5271         it->asoc_state = asoc_state;
5272         it->no_chunk_output = chunk_output_off;
5273         if (s_inp) {
5274                 it->inp = s_inp;
5275                 it->iterator_flags = SCTP_ITERATOR_DO_SINGLE_INP;
5276         } else {
5277                 SCTP_INP_INFO_RLOCK();
5278                 it->inp = LIST_FIRST(&sctppcbinfo.listhead);
5279                 SCTP_INP_INFO_RUNLOCK();
5280                 it->iterator_flags = SCTP_ITERATOR_DO_ALL_INP;
5281
5282         }
5283         /* Init the timer */
5284         SCTP_OS_TIMER_INIT(&it->tmr.timer);
5285         /* add to the list of all iterators */
5286         SCTP_INP_INFO_WLOCK();
5287         LIST_INSERT_HEAD(&sctppcbinfo.iteratorhead, it, sctp_nxt_itr);
5288         SCTP_INP_INFO_WUNLOCK();
5289         s = splnet();
5290         sctp_timer_start(SCTP_TIMER_TYPE_ITERATOR, (struct sctp_inpcb *)it,
5291             NULL, NULL);
5292         splx(s);
5293         return (0);
5294 }