sys/netinet/sctp_pcb.c

   1 /*-
   2  * Copyright (c) 2001-2007, by Cisco Systems, Inc. All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions are met:
   6  *
   7  * a) Redistributions of source code must retain the above copyright notice,
   8  *   this list of conditions and the following disclaimer.
   9  *
  10  * b) Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in
  12  *   the documentation and/or other materials provided with the distribution.
  13  *
  14  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  15  *    contributors may be used to endorse or promote products derived
  16  *    from this software without specific prior written permission.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  20  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  22  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  28  * THE POSSIBILITY OF SUCH DAMAGE.
  29  */
  30
  31 /* $KAME: sctp_pcb.c,v 1.38 2005/03/06 16:04:18 itojun Exp $     */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <sys/proc.h>
  38 #include <netinet/sctp_var.h>
  39 #include <netinet/sctp_sysctl.h>
  40 #include <netinet/sctp_pcb.h>
  41 #include <netinet/sctputil.h>
  42 #include <netinet/sctp.h>
  43 #include <netinet/sctp_header.h>
  44 #include <netinet/sctp_asconf.h>
  45 #include <netinet/sctp_output.h>
  46 #include <netinet/sctp_timer.h>
  47 #include <netinet/sctp_bsd_addr.h>
  48
  49
  50 struct sctp_epinfo sctppcbinfo;
  51
  52 /* FIX: we don't handle multiple link local scopes */
  53 /* "scopeless" replacement IN6_ARE_ADDR_EQUAL */
  54 int
  55 SCTP6_ARE_ADDR_EQUAL(struct in6_addr *a, struct in6_addr *b)
  56 {
  57         struct in6_addr tmp_a, tmp_b;
  58
  59         /* use a copy of a and b */
  60         tmp_a = *a;
  61         tmp_b = *b;
  62         in6_clearscope(&tmp_a);
  63         in6_clearscope(&tmp_b);
  64         return (IN6_ARE_ADDR_EQUAL(&tmp_a, &tmp_b));
  65 }
  66
  67 void
  68 sctp_fill_pcbinfo(struct sctp_pcbinfo *spcb)
  69 {
  70         /*
  71          * We really don't need to lock this, but I will just because it
  72          * does not hurt.
  73          */
  74         SCTP_INP_INFO_RLOCK();
  75         spcb->ep_count = sctppcbinfo.ipi_count_ep;
  76         spcb->asoc_count = sctppcbinfo.ipi_count_asoc;
  77         spcb->laddr_count = sctppcbinfo.ipi_count_laddr;
  78         spcb->raddr_count = sctppcbinfo.ipi_count_raddr;
  79         spcb->chk_count = sctppcbinfo.ipi_count_chunk;
  80         spcb->readq_count = sctppcbinfo.ipi_count_readq;
  81         spcb->stream_oque = sctppcbinfo.ipi_count_strmoq;
  82         spcb->free_chunks = sctppcbinfo.ipi_free_chunks;
  83
  84         SCTP_INP_INFO_RUNLOCK();
  85 }
  86
  87 /*
  88  * Addresses are added to VRF's (Virtual Router's). For BSD we
  89  * have only the default VRF 0. We maintain a hash list of
  90  * VRF's. Each VRF has its own list of sctp_ifn's. Each of
  91  * these has a list of addresses. When we add a new address
  92  * to a VRF we lookup the ifn/ifn_index, if the ifn does
  93  * not exist we create it and add it to the list of IFN's
  94  * within the VRF. Once we have the sctp_ifn, we add the
  95  * address to the list. So we look something like:
  96  *
  97  * hash-vrf-table
  98  *   vrf-> ifn-> ifn -> ifn
  99  *   vrf    |
 100  *    ...   +--ifa-> ifa -> ifa
 101  *   vrf
 102  *
 103  * We keep these seperate lists since the SCTP subsystem will
 104  * point to these from its source address selection nets structure.
 105  * When an address is deleted it does not happen right away on
 106  * the SCTP side, it gets scheduled. What we do when a
 107  * delete happens is immediately remove the address from
 108  * the master list and decrement the refcount. As our
 109  * addip iterator works through and frees the src address
 110  * selection pointing to the sctp_ifa, eventually the refcount
 111  * will reach 0 and we will delete it. Note that it is assumed
 112  * that any locking on system level ifn/ifa is done at the
 113  * caller of these functions and these routines will only
 114  * lock the SCTP structures as they add or delete things.
 115  *
 116  * Other notes on VRF concepts.
 117  *  - An endpoint can be in multiple VRF's
 118  *  - An association lives within a VRF and only one VRF.
 119  *  - Any incoming packet we can deduce the VRF for by
 120  *    looking at the mbuf/pak inbound (for BSD its VRF=0 :D)
 121  *  - Any downward send call or connect call must supply the
 122  *    VRF via ancillary data or via some sort of set default
 123  *    VRF socket option call (again for BSD no brainer since
 124  *    the VRF is always 0).
 125  *  - An endpoint may add multiple VRF's to it.
 126  *  - Listening sockets can accept associations in any
 127  *    of the VRF's they are in but the assoc will end up
 128  *    in only one VRF (gotten from the packet or connect/send).
 129  *
 130  */
 131
 132 struct sctp_vrf *
 133 sctp_allocate_vrf(int vrf_id)
 134 {
 135         struct sctp_vrf *vrf = NULL;
 136         struct sctp_vrflist *bucket;
 137
 138         /* First allocate the VRF structure */
 139         vrf = sctp_find_vrf(vrf_id);
 140         if (vrf) {
 141                 /* Already allocated */
 142                 return (vrf);
 143         }
 144         SCTP_MALLOC(vrf, struct sctp_vrf *, sizeof(struct sctp_vrf),
 145             "SCTP_VRF");
 146         if (vrf == NULL) {
 147                 /* No memory */
 148 #ifdef INVARIANTS
 149                 panic("No memory for VRF:%d", vrf_id);
 150 #endif
 151                 return (NULL);
 152         }
 153         /* setup the VRF */
 154         memset(vrf, 0, sizeof(struct sctp_vrf));
 155         vrf->vrf_id = vrf_id;
 156         LIST_INIT(&vrf->ifnlist);
 157         vrf->total_ifa_count = 0;
 158         /* Init the HASH of addresses */
 159         vrf->vrf_addr_hash = SCTP_HASH_INIT(SCTP_VRF_ADDR_HASH_SIZE,
 160             &vrf->vrf_addr_hashmark);
 161         if (vrf->vrf_addr_hash == NULL) {
 162                 /* No memory */
 163 #ifdef INVARIANTS
 164                 panic("No memory for VRF:%d", vrf_id);
 165 #endif
 166                 SCTP_FREE(vrf);
 167                 return (NULL);
 168         }
 169         vrf->vrf_ifn_hash = SCTP_HASH_INIT(SCTP_VRF_IFN_HASH_SIZE,
 170             &vrf->vrf_ifn_hashmark);
 171         if (vrf->vrf_ifn_hash == NULL) {
 172                 /* No memory */
 173 #ifdef INVARIANTS
 174                 panic("No memory for VRF:%d", vrf_id);
 175 #endif
 176                 SCTP_HASH_FREE(vrf->vrf_addr_hash, vrf->vrf_addr_hashmark);
 177                 SCTP_FREE(vrf);
 178                 return (NULL);
 179         }
 180         /* Add it to the hash table */
 181         bucket = &sctppcbinfo.sctp_vrfhash[(vrf_id & sctppcbinfo.hashvrfmark)];
 182         LIST_INSERT_HEAD(bucket, vrf, next_vrf);
 183         atomic_add_int(&sctppcbinfo.ipi_count_vrfs, 1);
 184         return (vrf);
 185 }
 186
 187
 188 struct sctp_ifn *
 189 sctp_find_ifn(struct sctp_vrf *vrf, void *ifn, uint32_t ifn_index)
 190 {
 191         struct sctp_ifn *sctp_ifnp;
 192         struct sctp_ifnlist *hash_ifn_head;
 193
 194         /*
 195          * We assume the lock is held for the addresses if thats wrong
 196          * problems could occur :-)
 197          */
 198         hash_ifn_head = &vrf->vrf_ifn_hash[(ifn_index & vrf->vrf_ifn_hashmark)];
 199         LIST_FOREACH(sctp_ifnp, hash_ifn_head, next_bucket) {
 200                 if (sctp_ifnp->ifn_index == ifn_index) {
 201                         return (sctp_ifnp);
 202                 }
 203                 if (sctp_ifnp->ifn_p && ifn && (sctp_ifnp->ifn_p == ifn)) {
 204                         return (sctp_ifnp);
 205                 }
 206         }
 207         return (NULL);
 208 }
 209
 210
 211
 212 struct sctp_vrf *
 213 sctp_find_vrf(uint32_t vrf_id)
 214 {
 215         struct sctp_vrflist *bucket;
 216         struct sctp_vrf *liste;
 217
 218         bucket = &sctppcbinfo.sctp_vrfhash[(vrf_id & sctppcbinfo.hashvrfmark)];
 219         LIST_FOREACH(liste, bucket, next_vrf) {
 220                 if (vrf_id == liste->vrf_id) {
 221                         return (liste);
 222                 }
 223         }
 224         return (NULL);
 225 }
 226
 227
 228 void
 229 sctp_free_ifn(struct sctp_ifn *sctp_ifnp)
 230 {
 231         int ret;
 232
 233         ret = atomic_fetchadd_int(&sctp_ifnp->refcount, -1);
 234         if (ret == 1) {
 235                 /* We zero'd the count */
 236                 SCTP_FREE(sctp_ifnp);
 237                 atomic_subtract_int(&sctppcbinfo.ipi_count_ifns, 1);
 238         }
 239 }
 240
 241 void
 242 sctp_update_ifn_mtu(uint32_t vrf_id, uint32_t ifn_index, uint32_t mtu)
 243 {
 244         struct sctp_ifn *sctp_ifnp;
 245         struct sctp_vrf *vrf;
 246
 247         vrf = sctp_find_vrf(vrf_id);
 248         if (vrf == NULL)
 249                 return;
 250         sctp_ifnp = sctp_find_ifn(vrf, (void *)NULL, ifn_index);
 251         if (sctp_ifnp != NULL) {
 252                 sctp_ifnp->ifn_mtu = mtu;
 253         }
 254 }
 255
 256
 257 void
 258 sctp_free_ifa(struct sctp_ifa *sctp_ifap)
 259 {
 260         int ret;
 261
 262         ret = atomic_fetchadd_int(&sctp_ifap->refcount, -1);
 263         if (ret == 1) {
 264                 /* We zero'd the count */
 265                 SCTP_FREE(sctp_ifap);
 266                 atomic_subtract_int(&sctppcbinfo.ipi_count_ifas, 1);
 267         }
 268 }
 269
 270 static void
 271 sctp_delete_ifn(struct sctp_ifn *sctp_ifnp, int hold_addr_lock)
 272 {
 273         struct sctp_ifn *found;
 274
 275         found = sctp_find_ifn(sctp_ifnp->vrf, sctp_ifnp->ifn_p, sctp_ifnp->ifn_index);
 276         if (found == NULL) {
 277                 /* Not in the list.. sorry */
 278                 return;
 279         }
 280         if (hold_addr_lock == 0)
 281                 SCTP_IPI_ADDR_LOCK();
 282         LIST_REMOVE(sctp_ifnp, next_bucket);
 283         LIST_REMOVE(sctp_ifnp, next_ifn);
 284         if (hold_addr_lock == 0)
 285                 SCTP_IPI_ADDR_UNLOCK();
 286         /* Take away the reference, and possibly free it */
 287         sctp_free_ifn(sctp_ifnp);
 288 }
 289
 290
 291 struct sctp_ifa *
 292 sctp_add_addr_to_vrf(uint32_t vrf_id, void *ifn, uint32_t ifn_index,
 293     uint32_t ifn_type, const char *if_name,
 294     void *ifa, struct sockaddr *addr, uint32_t ifa_flags,
 295     int dynamic_add)
 296 {
 297         struct sctp_vrf *vrf;
 298         struct sctp_ifn *sctp_ifnp = NULL;
 299         struct sctp_ifa *sctp_ifap = NULL;
 300         struct sctp_ifalist *hash_addr_head;
 301         struct sctp_ifnlist *hash_ifn_head;
 302         uint32_t hash_of_addr;
 303
 304         /* How granular do we need the locks to be here? */
 305         SCTP_IPI_ADDR_LOCK();
 306         vrf = sctp_find_vrf(vrf_id);
 307         if (vrf == NULL) {
 308                 vrf = sctp_allocate_vrf(vrf_id);
 309                 if (vrf == NULL) {
 310                         SCTP_IPI_ADDR_UNLOCK();
 311                         return (NULL);
 312                 }
 313         }
 314         sctp_ifnp = sctp_find_ifn(vrf, ifn, ifn_index);
 315         if (sctp_ifnp == NULL) {
 316                 /*
 317                  * build one and add it, can't hold lock until after malloc
 318                  * done though.
 319                  */
 320                 SCTP_IPI_ADDR_UNLOCK();
 321                 SCTP_MALLOC(sctp_ifnp, struct sctp_ifn *, sizeof(struct sctp_ifn), "SCTP_IFN");
 322                 if (sctp_ifnp == NULL) {
 323 #ifdef INVARIANTS
 324                         panic("No memory for IFN:%u", sctp_ifnp->ifn_index);
 325 #endif
 326                         return (NULL);
 327                 }
 328                 sctp_ifnp->ifn_index = ifn_index;
 329                 sctp_ifnp->ifn_p = ifn;
 330                 sctp_ifnp->ifn_type = ifn_type;
 331                 sctp_ifnp->ifa_count = 0;
 332                 sctp_ifnp->refcount = 1;
 333                 sctp_ifnp->vrf = vrf;
 334                 sctp_ifnp->ifn_mtu = SCTP_GATHER_MTU_FROM_IFN_INFO(ifn, ifn_index);
 335                 if (if_name != NULL) {
 336                         memcpy(sctp_ifnp->ifn_name, if_name, SCTP_IFNAMSIZ);
 337                 } else {
 338                         memcpy(sctp_ifnp->ifn_name, "unknown", min(7, SCTP_IFNAMSIZ));
 339                 }
 340                 hash_ifn_head = &vrf->vrf_ifn_hash[(ifn_index & vrf->vrf_ifn_hashmark)];
 341                 LIST_INIT(&sctp_ifnp->ifalist);
 342                 SCTP_IPI_ADDR_LOCK();
 343                 LIST_INSERT_HEAD(hash_ifn_head, sctp_ifnp, next_bucket);
 344                 LIST_INSERT_HEAD(&vrf->ifnlist, sctp_ifnp, next_ifn);
 345                 atomic_add_int(&sctppcbinfo.ipi_count_ifns, 1);
 346         }
 347         sctp_ifap = sctp_find_ifa_by_addr(addr, vrf->vrf_id, 1);
 348         if (sctp_ifap) {
 349                 /* Hmm, it already exists? */
 350                 if ((sctp_ifap->ifn_p) &&
 351                     (sctp_ifap->ifn_p->ifn_index == ifn_index)) {
 352                         if (sctp_ifap->localifa_flags & SCTP_BEING_DELETED) {
 353                                 /* easy to solve, just switch back to active */
 354                                 sctp_ifap->localifa_flags = SCTP_ADDR_VALID;
 355                                 sctp_ifap->ifn_p = sctp_ifnp;
 356                 exit_stage_left:
 357                                 SCTP_IPI_ADDR_UNLOCK();
 358                                 return (sctp_ifap);
 359                         } else {
 360                                 goto exit_stage_left;
 361                         }
 362                 } else {
 363                         if (sctp_ifap->ifn_p) {
 364                                 /*
 365                                  * The first IFN gets the address,
 366                                  * duplicates are ignored.
 367                                  */
 368                                 goto exit_stage_left;
 369                         } else {
 370                                 /* repair ifnp which was NULL ? */
 371                                 sctp_ifap->localifa_flags = SCTP_ADDR_VALID;
 372                                 sctp_ifap->ifn_p = sctp_ifnp;
 373                                 atomic_add_int(&sctp_ifap->ifn_p->refcount, 1);
 374                         }
 375                         goto exit_stage_left;
 376                 }
 377         }
 378         SCTP_IPI_ADDR_UNLOCK();
 379         SCTP_MALLOC(sctp_ifap, struct sctp_ifa *, sizeof(struct sctp_ifa), "SCTP_IFA");
 380         if (sctp_ifap == NULL) {
 381 #ifdef INVARIANTS
 382                 panic("No memory for IFA");
 383 #endif
 384                 return (NULL);
 385         }
 386         memset(sctp_ifap, 0, sizeof(struct sctp_ifa));
 387         sctp_ifap->ifn_p = sctp_ifnp;
 388         atomic_add_int(&sctp_ifnp->refcount, 1);
 389
 390         sctp_ifap->ifa = ifa;
 391         memcpy(&sctp_ifap->address, addr, addr->sa_len);
 392         sctp_ifap->localifa_flags = SCTP_ADDR_VALID | SCTP_ADDR_DEFER_USE;
 393         sctp_ifap->flags = ifa_flags;
 394         /* Set scope */
 395         if (sctp_ifap->address.sa.sa_family == AF_INET) {
 396                 struct sockaddr_in *sin;
 397
 398                 sin = (struct sockaddr_in *)&sctp_ifap->address.sin;
 399                 if (SCTP_IFN_IS_IFT_LOOP(sctp_ifap->ifn_p) ||
 400                     (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
 401                         sctp_ifap->src_is_loop = 1;
 402                 }
 403                 if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
 404                         sctp_ifap->src_is_priv = 1;
 405                 }
 406         } else if (sctp_ifap->address.sa.sa_family == AF_INET6) {
 407                 /* ok to use deprecated addresses? */
 408                 struct sockaddr_in6 *sin6;
 409
 410                 sin6 = (struct sockaddr_in6 *)&sctp_ifap->address.sin6;
 411                 if (SCTP_IFN_IS_IFT_LOOP(sctp_ifap->ifn_p) ||
 412                     (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr))) {
 413                         sctp_ifap->src_is_loop = 1;
 414                 }
 415                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
 416                         sctp_ifap->src_is_priv = 1;
 417                 }
 418         }
 419         hash_of_addr = sctp_get_ifa_hash_val(&sctp_ifap->address.sa);
 420
 421         if ((sctp_ifap->src_is_priv == 0) &&
 422             (sctp_ifap->src_is_loop == 0)) {
 423                 sctp_ifap->src_is_glob = 1;
 424         }
 425         SCTP_IPI_ADDR_LOCK();
 426         hash_addr_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)];
 427         LIST_INSERT_HEAD(hash_addr_head, sctp_ifap, next_bucket);
 428         sctp_ifap->refcount = 1;
 429         LIST_INSERT_HEAD(&sctp_ifnp->ifalist, sctp_ifap, next_ifa);
 430         sctp_ifnp->ifa_count++;
 431         vrf->total_ifa_count++;
 432         atomic_add_int(&sctppcbinfo.ipi_count_ifas, 1);
 433         SCTP_IPI_ADDR_UNLOCK();
 434         if (dynamic_add) {
 435                 /*
 436                  * Bump up the refcount so that when the timer completes it
 437                  * will drop back down.
 438                  */
 439                 struct sctp_laddr *wi;
 440
 441                 atomic_add_int(&sctp_ifap->refcount, 1);
 442                 wi = SCTP_ZONE_GET(sctppcbinfo.ipi_zone_laddr, struct sctp_laddr);
 443                 if (wi == NULL) {
 444                         /*
 445                          * Gak, what can we do? We have lost an address
 446                          * change can you say HOSED?
 447                          */
 448                         SCTPDBG(SCTP_DEBUG_PCB1, "Lost and address change ???\n");
 449                         /* Opps, must decrement the count */
 450                         sctp_del_addr_from_vrf(vrf_id, addr, ifn_index);
 451                         return (NULL);
 452                 }
 453                 SCTP_INCR_LADDR_COUNT();
 454                 bzero(wi, sizeof(*wi));
 455                 wi->ifa = sctp_ifap;
 456                 wi->action = SCTP_ADD_IP_ADDRESS;
 457                 SCTP_IPI_ITERATOR_WQ_LOCK();
 458                 /*
 459                  * Should this really be a tailq? As it is we will process
 460                  * the newest first :-0
 461                  */
 462                 LIST_INSERT_HEAD(&sctppcbinfo.addr_wq, wi, sctp_nxt_addr);
 463                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
 464                     (struct sctp_inpcb *)NULL,
 465                     (struct sctp_tcb *)NULL,
 466                     (struct sctp_nets *)NULL);
 467                 SCTP_IPI_ITERATOR_WQ_UNLOCK();
 468         } else {
 469                 /* it's ready for use */
 470                 sctp_ifap->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
 471         }
 472         return (sctp_ifap);
 473 }
 474
 475 void
 476 sctp_del_addr_from_vrf(uint32_t vrf_id, struct sockaddr *addr,
 477     uint32_t ifn_index)
 478 {
 479         struct sctp_vrf *vrf;
 480         struct sctp_ifa *sctp_ifap = NULL;
 481
 482         SCTP_IPI_ADDR_LOCK();
 483
 484         vrf = sctp_find_vrf(vrf_id);
 485         if (vrf == NULL) {
 486                 SCTP_PRINTF("Can't find vrf_id:%d\n", vrf_id);
 487                 goto out_now;
 488         }
 489         sctp_ifap = sctp_find_ifa_by_addr(addr, vrf->vrf_id, 1);
 490         if (sctp_ifap) {
 491                 sctp_ifap->localifa_flags &= SCTP_ADDR_VALID;
 492                 sctp_ifap->localifa_flags |= SCTP_BEING_DELETED;
 493                 vrf->total_ifa_count--;
 494                 LIST_REMOVE(sctp_ifap, next_bucket);
 495                 LIST_REMOVE(sctp_ifap, next_ifa);
 496                 if (sctp_ifap->ifn_p) {
 497                         sctp_ifap->ifn_p->ifa_count--;
 498                         if (SCTP_LIST_EMPTY(&sctp_ifap->ifn_p->ifalist)) {
 499                                 sctp_delete_ifn(sctp_ifap->ifn_p, 1);
 500                         }
 501                         sctp_free_ifn(sctp_ifap->ifn_p);
 502                         sctp_ifap->ifn_p = NULL;
 503                 }
 504         }
 505 #ifdef SCTP_DEBUG
 506         else {
 507                 SCTPDBG(SCTP_DEBUG_PCB1, "Del Addr-ifn:%d Could not find address:",
 508                     ifn_index);
 509                 SCTPDBG_ADDR(SCTP_DEBUG_PCB1, addr);
 510         }
 511 #endif
 512
 513 out_now:
 514         SCTP_IPI_ADDR_UNLOCK();
 515         if (sctp_ifap) {
 516                 struct sctp_laddr *wi;
 517
 518                 wi = SCTP_ZONE_GET(sctppcbinfo.ipi_zone_laddr, struct sctp_laddr);
 519                 if (wi == NULL) {
 520                         /*
 521                          * Gak, what can we do? We have lost an address
 522                          * change can you say HOSED?
 523                          */
 524                         SCTPDBG(SCTP_DEBUG_PCB1, "Lost and address change ???\n");
 525
 526                         /* Opps, must decrement the count */
 527                         sctp_free_ifa(sctp_ifap);
 528                         return;
 529                 }
 530                 SCTP_INCR_LADDR_COUNT();
 531                 bzero(wi, sizeof(*wi));
 532                 wi->ifa = sctp_ifap;
 533                 wi->action = SCTP_DEL_IP_ADDRESS;
 534                 SCTP_IPI_ITERATOR_WQ_LOCK();
 535                 /*
 536                  * Should this really be a tailq? As it is we will process
 537                  * the newest first :-0
 538                  */
 539                 LIST_INSERT_HEAD(&sctppcbinfo.addr_wq, wi, sctp_nxt_addr);
 540                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
 541                     (struct sctp_inpcb *)NULL,
 542                     (struct sctp_tcb *)NULL,
 543                     (struct sctp_nets *)NULL);
 544                 SCTP_IPI_ITERATOR_WQ_UNLOCK();
 545         }
 546         return;
 547 }
 548
 549
 550
 551 static struct sctp_tcb *
 552 sctp_tcb_special_locate(struct sctp_inpcb **inp_p, struct sockaddr *from,
 553     struct sockaddr *to, struct sctp_nets **netp, uint32_t vrf_id)
 554 {
 555         /**** ASSUMSES THE CALLER holds the INP_INFO_RLOCK */
 556         /*
 557          * If we support the TCP model, then we must now dig through to see
 558          * if we can find our endpoint in the list of tcp ep's.
 559          */
 560         uint16_t lport, rport;
 561         struct sctppcbhead *ephead;
 562         struct sctp_inpcb *inp;
 563         struct sctp_laddr *laddr;
 564         struct sctp_tcb *stcb;
 565         struct sctp_nets *net;
 566
 567         if ((to == NULL) || (from == NULL)) {
 568                 return (NULL);
 569         }
 570         if (to->sa_family == AF_INET && from->sa_family == AF_INET) {
 571                 lport = ((struct sockaddr_in *)to)->sin_port;
 572                 rport = ((struct sockaddr_in *)from)->sin_port;
 573         } else if (to->sa_family == AF_INET6 && from->sa_family == AF_INET6) {
 574                 lport = ((struct sockaddr_in6 *)to)->sin6_port;
 575                 rport = ((struct sockaddr_in6 *)from)->sin6_port;
 576         } else {
 577                 return NULL;
 578         }
 579         ephead = &sctppcbinfo.sctp_tcpephash[SCTP_PCBHASH_ALLADDR(
 580             (lport + rport), sctppcbinfo.hashtcpmark)];
 581         /*
 582          * Ok now for each of the guys in this bucket we must look and see:
 583          * - Does the remote port match. - Does there single association's
 584          * addresses match this address (to). If so we update p_ep to point
 585          * to this ep and return the tcb from it.
 586          */
 587         LIST_FOREACH(inp, ephead, sctp_hash) {
 588                 SCTP_INP_RLOCK(inp);
 589                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
 590                         SCTP_INP_RUNLOCK(inp);
 591                         continue;
 592                 }
 593                 if (lport != inp->sctp_lport) {
 594                         SCTP_INP_RUNLOCK(inp);
 595                         continue;
 596                 }
 597                 if (inp->def_vrf_id != vrf_id) {
 598                         SCTP_INP_RUNLOCK(inp);
 599                         continue;
 600                 }
 601                 /* check to see if the ep has one of the addresses */
 602                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
 603                         /* We are NOT bound all, so look further */
 604                         int match = 0;
 605
 606                         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
 607
 608                                 if (laddr->ifa == NULL) {
 609                                         SCTPDBG(SCTP_DEBUG_PCB1, "%s: NULL ifa\n", __FUNCTION__);
 610                                         continue;
 611                                 }
 612                                 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) {
 613                                         SCTPDBG(SCTP_DEBUG_PCB1, "ifa being deleted\n");
 614                                         continue;
 615                                 }
 616                                 if (laddr->ifa->address.sa.sa_family ==
 617                                     to->sa_family) {
 618                                         /* see if it matches */
 619                                         struct sockaddr_in *intf_addr, *sin;
 620
 621                                         intf_addr = &laddr->ifa->address.sin;
 622                                         sin = (struct sockaddr_in *)to;
 623                                         if (from->sa_family == AF_INET) {
 624                                                 if (sin->sin_addr.s_addr ==
 625                                                     intf_addr->sin_addr.s_addr) {
 626                                                         match = 1;
 627                                                         break;
 628                                                 }
 629                                         } else {
 630                                                 struct sockaddr_in6 *intf_addr6;
 631                                                 struct sockaddr_in6 *sin6;
 632
 633                                                 sin6 = (struct sockaddr_in6 *)
 634                                                     to;
 635                                                 intf_addr6 = &laddr->ifa->address.sin6;
 636
 637                                                 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
 638                                                     &intf_addr6->sin6_addr)) {
 639                                                         match = 1;
 640                                                         break;
 641                                                 }
 642                                         }
 643                                 }
 644                         }
 645                         if (match == 0) {
 646                                 /* This endpoint does not have this address */
 647                                 SCTP_INP_RUNLOCK(inp);
 648                                 continue;
 649                         }
 650                 }
 651                 /*
 652                  * Ok if we hit here the ep has the address, does it hold
 653                  * the tcb?
 654                  */
 655
 656                 stcb = LIST_FIRST(&inp->sctp_asoc_list);
 657                 if (stcb == NULL) {
 658                         SCTP_INP_RUNLOCK(inp);
 659                         continue;
 660                 }
 661                 SCTP_TCB_LOCK(stcb);
 662                 if (stcb->rport != rport) {
 663                         /* remote port does not match. */
 664                         SCTP_TCB_UNLOCK(stcb);
 665                         SCTP_INP_RUNLOCK(inp);
 666                         continue;
 667                 }
 668                 /* Does this TCB have a matching address? */
 669                 TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 670
 671                         if (net->ro._l_addr.sa.sa_family != from->sa_family) {
 672                                 /* not the same family, can't be a match */
 673                                 continue;
 674                         }
 675                         if (from->sa_family == AF_INET) {
 676                                 struct sockaddr_in *sin, *rsin;
 677
 678                                 sin = (struct sockaddr_in *)&net->ro._l_addr;
 679                                 rsin = (struct sockaddr_in *)from;
 680                                 if (sin->sin_addr.s_addr ==
 681                                     rsin->sin_addr.s_addr) {
 682                                         /* found it */
 683                                         if (netp != NULL) {
 684                                                 *netp = net;
 685                                         }
 686                                         /* Update the endpoint pointer */
 687                                         *inp_p = inp;
 688                                         SCTP_INP_RUNLOCK(inp);
 689                                         return (stcb);
 690                                 }
 691                         } else {
 692                                 struct sockaddr_in6 *sin6, *rsin6;
 693
 694                                 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
 695                                 rsin6 = (struct sockaddr_in6 *)from;
 696                                 if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
 697                                     &rsin6->sin6_addr)) {
 698                                         /* found it */
 699                                         if (netp != NULL) {
 700                                                 *netp = net;
 701                                         }
 702                                         /* Update the endpoint pointer */
 703                                         *inp_p = inp;
 704                                         SCTP_INP_RUNLOCK(inp);
 705                                         return (stcb);
 706                                 }
 707                         }
 708                 }
 709                 SCTP_TCB_UNLOCK(stcb);
 710                 SCTP_INP_RUNLOCK(inp);
 711         }
 712         return (NULL);
 713 }
 714
 715 /*
 716  * rules for use
 717  *
 718  * 1) If I return a NULL you must decrement any INP ref cnt. 2) If I find an
 719  * stcb, both will be locked (locked_tcb and stcb) but decrement will be done
 720  * (if locked == NULL). 3) Decrement happens on return ONLY if locked ==
 721  * NULL.
 722  */
 723
 724 struct sctp_tcb *
 725 sctp_findassociation_ep_addr(struct sctp_inpcb **inp_p, struct sockaddr *remote,
 726     struct sctp_nets **netp, struct sockaddr *local, struct sctp_tcb *locked_tcb)
 727 {
 728         struct sctpasochead *head;
 729         struct sctp_inpcb *inp;
 730         struct sctp_tcb *stcb = NULL;
 731         struct sctp_nets *net;
 732         uint16_t rport;
 733
 734         inp = *inp_p;
 735         if (remote->sa_family == AF_INET) {
 736                 rport = (((struct sockaddr_in *)remote)->sin_port);
 737         } else if (remote->sa_family == AF_INET6) {
 738                 rport = (((struct sockaddr_in6 *)remote)->sin6_port);
 739         } else {
 740                 return (NULL);
 741         }
 742         if (locked_tcb) {
 743                 /*
 744                  * UN-lock so we can do proper locking here this occurs when
 745                  * called from load_addresses_from_init.
 746                  */
 747                 SCTP_TCB_UNLOCK(locked_tcb);
 748         }
 749         SCTP_INP_INFO_RLOCK();
 750         if (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
 751                 /*-
 752                  * Now either this guy is our listener or it's the
 753                  * connector. If it is the one that issued the connect, then
 754                  * it's only chance is to be the first TCB in the list. If
 755                  * it is the acceptor, then do the special_lookup to hash
 756                  * and find the real inp.
 757                  */
 758                 if ((inp->sctp_socket) && (inp->sctp_socket->so_qlimit)) {
 759                         /* to is peer addr, from is my addr */
 760                         stcb = sctp_tcb_special_locate(inp_p, remote, local,
 761                             netp, inp->def_vrf_id);
 762                         if ((stcb != NULL) && (locked_tcb == NULL)) {
 763                                 /* we have a locked tcb, lower refcount */
 764                                 SCTP_INP_WLOCK(inp);
 765                                 SCTP_INP_DECR_REF(inp);
 766                                 SCTP_INP_WUNLOCK(inp);
 767                         }
 768                         if ((locked_tcb != NULL) && (locked_tcb != stcb)) {
 769                                 SCTP_INP_RLOCK(locked_tcb->sctp_ep);
 770                                 SCTP_TCB_LOCK(locked_tcb);
 771                                 SCTP_INP_RUNLOCK(locked_tcb->sctp_ep);
 772                         }
 773                         SCTP_INP_INFO_RUNLOCK();
 774                         return (stcb);
 775                 } else {
 776                         SCTP_INP_WLOCK(inp);
 777                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
 778                                 goto null_return;
 779                         }
 780                         stcb = LIST_FIRST(&inp->sctp_asoc_list);
 781                         if (stcb == NULL) {
 782                                 goto null_return;
 783                         }
 784                         SCTP_TCB_LOCK(stcb);
 785                         if (stcb->rport != rport) {
 786                                 /* remote port does not match. */
 787                                 SCTP_TCB_UNLOCK(stcb);
 788                                 goto null_return;
 789                         }
 790                         /* now look at the list of remote addresses */
 791                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 792 #ifdef INVARIANTS
 793                                 if (net == (TAILQ_NEXT(net, sctp_next))) {
 794                                         panic("Corrupt net list");
 795                                 }
 796 #endif
 797                                 if (net->ro._l_addr.sa.sa_family !=
 798                                     remote->sa_family) {
 799                                         /* not the same family */
 800                                         continue;
 801                                 }
 802                                 if (remote->sa_family == AF_INET) {
 803                                         struct sockaddr_in *sin, *rsin;
 804
 805                                         sin = (struct sockaddr_in *)
 806                                             &net->ro._l_addr;
 807                                         rsin = (struct sockaddr_in *)remote;
 808                                         if (sin->sin_addr.s_addr ==
 809                                             rsin->sin_addr.s_addr) {
 810                                                 /* found it */
 811                                                 if (netp != NULL) {
 812                                                         *netp = net;
 813                                                 }
 814                                                 if (locked_tcb == NULL) {
 815                                                         SCTP_INP_DECR_REF(inp);
 816                                                 } else if (locked_tcb != stcb) {
 817                                                         SCTP_TCB_LOCK(locked_tcb);
 818                                                 }
 819                                                 SCTP_INP_WUNLOCK(inp);
 820                                                 SCTP_INP_INFO_RUNLOCK();
 821                                                 return (stcb);
 822                                         }
 823                                 } else if (remote->sa_family == AF_INET6) {
 824                                         struct sockaddr_in6 *sin6, *rsin6;
 825
 826                                         sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
 827                                         rsin6 = (struct sockaddr_in6 *)remote;
 828                                         if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
 829                                             &rsin6->sin6_addr)) {
 830                                                 /* found it */
 831                                                 if (netp != NULL) {
 832                                                         *netp = net;
 833                                                 }
 834                                                 if (locked_tcb == NULL) {
 835                                                         SCTP_INP_DECR_REF(inp);
 836                                                 } else if (locked_tcb != stcb) {
 837                                                         SCTP_TCB_LOCK(locked_tcb);
 838                                                 }
 839                                                 SCTP_INP_WUNLOCK(inp);
 840                                                 SCTP_INP_INFO_RUNLOCK();
 841                                                 return (stcb);
 842                                         }
 843                                 }
 844                         }
 845                         SCTP_TCB_UNLOCK(stcb);
 846                 }
 847         } else {
 848                 SCTP_INP_WLOCK(inp);
 849                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
 850                         goto null_return;
 851                 }
 852                 head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(rport,
 853                     inp->sctp_hashmark)];
 854                 if (head == NULL) {
 855                         goto null_return;
 856                 }
 857                 LIST_FOREACH(stcb, head, sctp_tcbhash) {
 858                         if (stcb->rport != rport) {
 859                                 /* remote port does not match */
 860                                 continue;
 861                         }
 862                         /* now look at the list of remote addresses */
 863                         SCTP_TCB_LOCK(stcb);
 864                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 865 #ifdef INVARIANTS
 866                                 if (net == (TAILQ_NEXT(net, sctp_next))) {
 867                                         panic("Corrupt net list");
 868                                 }
 869 #endif
 870                                 if (net->ro._l_addr.sa.sa_family !=
 871                                     remote->sa_family) {
 872                                         /* not the same family */
 873                                         continue;
 874                                 }
 875                                 if (remote->sa_family == AF_INET) {
 876                                         struct sockaddr_in *sin, *rsin;
 877
 878                                         sin = (struct sockaddr_in *)
 879                                             &net->ro._l_addr;
 880                                         rsin = (struct sockaddr_in *)remote;
 881                                         if (sin->sin_addr.s_addr ==
 882                                             rsin->sin_addr.s_addr) {
 883                                                 /* found it */
 884                                                 if (netp != NULL) {
 885                                                         *netp = net;
 886                                                 }
 887                                                 if (locked_tcb == NULL) {
 888                                                         SCTP_INP_DECR_REF(inp);
 889                                                 } else if (locked_tcb != stcb) {
 890                                                         SCTP_TCB_LOCK(locked_tcb);
 891                                                 }
 892                                                 SCTP_INP_WUNLOCK(inp);
 893                                                 SCTP_INP_INFO_RUNLOCK();
 894                                                 return (stcb);
 895                                         }
 896                                 } else if (remote->sa_family == AF_INET6) {
 897                                         struct sockaddr_in6 *sin6, *rsin6;
 898
 899                                         sin6 = (struct sockaddr_in6 *)
 900                                             &net->ro._l_addr;
 901                                         rsin6 = (struct sockaddr_in6 *)remote;
 902                                         if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
 903                                             &rsin6->sin6_addr)) {
 904                                                 /* found it */
 905                                                 if (netp != NULL) {
 906                                                         *netp = net;
 907                                                 }
 908                                                 if (locked_tcb == NULL) {
 909                                                         SCTP_INP_DECR_REF(inp);
 910                                                 } else if (locked_tcb != stcb) {
 911                                                         SCTP_TCB_LOCK(locked_tcb);
 912                                                 }
 913                                                 SCTP_INP_WUNLOCK(inp);
 914                                                 SCTP_INP_INFO_RUNLOCK();
 915                                                 return (stcb);
 916                                         }
 917                                 }
 918                         }
 919                         SCTP_TCB_UNLOCK(stcb);
 920                 }
 921         }
 922 null_return:
 923         /* clean up for returning null */
 924         if (locked_tcb) {
 925                 SCTP_TCB_LOCK(locked_tcb);
 926         }
 927         SCTP_INP_WUNLOCK(inp);
 928         SCTP_INP_INFO_RUNLOCK();
 929         /* not found */
 930         return (NULL);
 931 }
 932
 933 /*
 934  * Find an association for a specific endpoint using the association id given
 935  * out in the COMM_UP notification
 936  */
 937
 938 struct sctp_tcb *
 939 sctp_findassociation_ep_asocid(struct sctp_inpcb *inp, sctp_assoc_t asoc_id, int want_lock)
 940 {
 941         /*
 942          * Use my the assoc_id to find a endpoint
 943          */
 944         struct sctpasochead *head;
 945         struct sctp_tcb *stcb;
 946         uint32_t id;
 947
 948         if (asoc_id == 0 || inp == NULL) {
 949                 return (NULL);
 950         }
 951         SCTP_INP_INFO_RLOCK();
 952         id = (uint32_t) asoc_id;
 953         head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(id,
 954             sctppcbinfo.hashasocmark)];
 955         if (head == NULL) {
 956                 /* invalid id TSNH */
 957                 SCTP_INP_INFO_RUNLOCK();
 958                 return (NULL);
 959         }
 960         LIST_FOREACH(stcb, head, sctp_asocs) {
 961                 SCTP_INP_RLOCK(stcb->sctp_ep);
 962                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
 963                         SCTP_INP_RUNLOCK(stcb->sctp_ep);
 964                         SCTP_INP_INFO_RUNLOCK();
 965                         return (NULL);
 966                 }
 967                 if (stcb->asoc.assoc_id == id) {
 968                         /* candidate */
 969                         if (inp != stcb->sctp_ep) {
 970                                 /*
 971                                  * some other guy has the same id active (id
 972                                  * collision ??).
 973                                  */
 974                                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
 975                                 continue;
 976                         }
 977                         if (want_lock) {
 978                                 SCTP_TCB_LOCK(stcb);
 979                         }
 980                         SCTP_INP_RUNLOCK(stcb->sctp_ep);
 981                         SCTP_INP_INFO_RUNLOCK();
 982                         return (stcb);
 983                 }
 984                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
 985         }
 986         /* Ok if we missed here, lets try the restart hash */
 987         head = &sctppcbinfo.sctp_restarthash[SCTP_PCBHASH_ASOC(id, sctppcbinfo.hashrestartmark)];
 988         if (head == NULL) {
 989                 /* invalid id TSNH */
 990                 SCTP_INP_INFO_RUNLOCK();
 991                 return (NULL);
 992         }
 993         LIST_FOREACH(stcb, head, sctp_tcbrestarhash) {
 994                 SCTP_INP_RLOCK(stcb->sctp_ep);
 995                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
 996                         SCTP_INP_RUNLOCK(stcb->sctp_ep);
 997                         SCTP_INP_INFO_RUNLOCK();
 998                         return (NULL);
 999                 }
1000                 SCTP_TCB_LOCK(stcb);
1001                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
1002                 if (stcb->asoc.assoc_id == id) {
1003                         /* candidate */
1004                         if (inp != stcb->sctp_ep) {
1005                                 /*
1006                                  * some other guy has the same id active (id
1007                                  * collision ??).
1008                                  */
1009                                 SCTP_TCB_UNLOCK(stcb);
1010                                 continue;
1011                         }
1012                         SCTP_INP_INFO_RUNLOCK();
1013                         return (stcb);
1014                 }
1015                 SCTP_TCB_UNLOCK(stcb);
1016         }
1017         SCTP_INP_INFO_RUNLOCK();
1018         return (NULL);
1019 }
1020
1021
1022 static struct sctp_inpcb *
1023 sctp_endpoint_probe(struct sockaddr *nam, struct sctppcbhead *head,
1024     uint16_t lport, uint32_t vrf_id)
1025 {
1026         struct sctp_inpcb *inp;
1027         struct sockaddr_in *sin;
1028         struct sockaddr_in6 *sin6;
1029         struct sctp_laddr *laddr;
1030         int fnd;
1031
1032         /*
1033          * Endpoing probe expects that the INP_INFO is locked.
1034          */
1035         if (nam->sa_family == AF_INET) {
1036                 sin = (struct sockaddr_in *)nam;
1037                 sin6 = NULL;
1038         } else if (nam->sa_family == AF_INET6) {
1039                 sin6 = (struct sockaddr_in6 *)nam;
1040                 sin = NULL;
1041         } else {
1042                 /* unsupported family */
1043                 return (NULL);
1044         }
1045         if (head == NULL)
1046                 return (NULL);
1047         LIST_FOREACH(inp, head, sctp_hash) {
1048                 SCTP_INP_RLOCK(inp);
1049                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1050                         SCTP_INP_RUNLOCK(inp);
1051                         continue;
1052                 }
1053                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) &&
1054                     (inp->sctp_lport == lport)) {
1055                         /* got it */
1056                         if ((nam->sa_family == AF_INET) &&
1057                             (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1058                             SCTP_IPV6_V6ONLY(inp)) {
1059                                 /* IPv4 on a IPv6 socket with ONLY IPv6 set */
1060                                 SCTP_INP_RUNLOCK(inp);
1061                                 continue;
1062                         }
1063                         /* A V6 address and the endpoint is NOT bound V6 */
1064                         if (nam->sa_family == AF_INET6 &&
1065                             (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
1066                                 SCTP_INP_RUNLOCK(inp);
1067                                 continue;
1068                         }
1069                         /* does a VRF id match? */
1070                         fnd = 0;
1071                         if (inp->def_vrf_id == vrf_id)
1072                                 fnd = 1;
1073
1074                         SCTP_INP_RUNLOCK(inp);
1075                         if (!fnd)
1076                                 continue;
1077                         return (inp);
1078                 }
1079                 SCTP_INP_RUNLOCK(inp);
1080         }
1081
1082         if ((nam->sa_family == AF_INET) &&
1083             (sin->sin_addr.s_addr == INADDR_ANY)) {
1084                 /* Can't hunt for one that has no address specified */
1085                 return (NULL);
1086         } else if ((nam->sa_family == AF_INET6) &&
1087             (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))) {
1088                 /* Can't hunt for one that has no address specified */
1089                 return (NULL);
1090         }
1091         /*
1092          * ok, not bound to all so see if we can find a EP bound to this
1093          * address.
1094          */
1095         LIST_FOREACH(inp, head, sctp_hash) {
1096                 SCTP_INP_RLOCK(inp);
1097                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1098                         SCTP_INP_RUNLOCK(inp);
1099                         continue;
1100                 }
1101                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)) {
1102                         SCTP_INP_RUNLOCK(inp);
1103                         continue;
1104                 }
1105                 /*
1106                  * Ok this could be a likely candidate, look at all of its
1107                  * addresses
1108                  */
1109                 if (inp->sctp_lport != lport) {
1110                         SCTP_INP_RUNLOCK(inp);
1111                         continue;
1112                 }
1113                 /* does a VRF id match? */
1114                 fnd = 0;
1115                 if (inp->def_vrf_id == vrf_id)
1116                         fnd = 1;
1117
1118                 if (!fnd) {
1119                         SCTP_INP_RUNLOCK(inp);
1120                         continue;
1121                 }
1122                 LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
1123                         if (laddr->ifa == NULL) {
1124                                 SCTPDBG(SCTP_DEBUG_PCB1, "%s: NULL ifa\n",
1125                                     __FUNCTION__);
1126                                 continue;
1127                         }
1128                         SCTPDBG(SCTP_DEBUG_PCB1, "Ok laddr->ifa:%p is possible, ",
1129                             laddr->ifa);
1130                         if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) {
1131                                 SCTPDBG(SCTP_DEBUG_PCB1, "Huh IFA being deleted\n");
1132                                 continue;
1133                         }
1134                         if (laddr->ifa->address.sa.sa_family == nam->sa_family) {
1135                                 /* possible, see if it matches */
1136                                 struct sockaddr_in *intf_addr;
1137
1138                                 intf_addr = &laddr->ifa->address.sin;
1139                                 if (nam->sa_family == AF_INET) {
1140                                         if (sin->sin_addr.s_addr ==
1141                                             intf_addr->sin_addr.s_addr) {
1142                                                 SCTP_INP_RUNLOCK(inp);
1143                                                 return (inp);
1144                                         }
1145                                 } else if (nam->sa_family == AF_INET6) {
1146                                         struct sockaddr_in6 *intf_addr6;
1147
1148                                         intf_addr6 = &laddr->ifa->address.sin6;
1149                                         if (SCTP6_ARE_ADDR_EQUAL(&sin6->sin6_addr,
1150                                             &intf_addr6->sin6_addr)) {
1151                                                 SCTP_INP_RUNLOCK(inp);
1152                                                 return (inp);
1153                                         }
1154                                 }
1155                         }
1156                 }
1157                 SCTP_INP_RUNLOCK(inp);
1158         }
1159         return (NULL);
1160 }
1161
1162
1163 struct sctp_inpcb *
1164 sctp_pcb_findep(struct sockaddr *nam, int find_tcp_pool, int have_lock,
1165     uint32_t vrf_id)
1166 {
1167         /*
1168          * First we check the hash table to see if someone has this port
1169          * bound with just the port.
1170          */
1171         struct sctp_inpcb *inp;
1172         struct sctppcbhead *head;
1173         struct sockaddr_in *sin;
1174         struct sockaddr_in6 *sin6;
1175         int lport;
1176
1177         if (nam->sa_family == AF_INET) {
1178                 sin = (struct sockaddr_in *)nam;
1179                 lport = ((struct sockaddr_in *)nam)->sin_port;
1180         } else if (nam->sa_family == AF_INET6) {
1181                 sin6 = (struct sockaddr_in6 *)nam;
1182                 lport = ((struct sockaddr_in6 *)nam)->sin6_port;
1183         } else {
1184                 /* unsupported family */
1185                 return (NULL);
1186         }
1187         /*
1188          * I could cheat here and just cast to one of the types but we will
1189          * do it right. It also provides the check against an Unsupported
1190          * type too.
1191          */
1192         /* Find the head of the ALLADDR chain */
1193         if (have_lock == 0) {
1194                 SCTP_INP_INFO_RLOCK();
1195
1196         }
1197         head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport,
1198             sctppcbinfo.hashmark)];
1199         inp = sctp_endpoint_probe(nam, head, lport, vrf_id);
1200
1201         /*
1202          * If the TCP model exists it could be that the main listening
1203          * endpoint is gone but there exists a connected socket for this guy
1204          * yet. If so we can return the first one that we find. This may NOT
1205          * be the correct one but the sctp_findassociation_ep_addr has
1206          * further code to look at all TCP models.
1207          */
1208         if (inp == NULL && find_tcp_pool) {
1209                 unsigned int i;
1210
1211                 for (i = 0; i < sctppcbinfo.hashtblsize; i++) {
1212                         /*
1213                          * This is real gross, but we do NOT have a remote
1214                          * port at this point depending on who is calling.
1215                          * We must therefore look for ANY one that matches
1216                          * our local port :/
1217                          */
1218                         head = &sctppcbinfo.sctp_tcpephash[i];
1219                         if (LIST_FIRST(head)) {
1220                                 inp = sctp_endpoint_probe(nam, head, lport, vrf_id);
1221                                 if (inp) {
1222                                         /* Found one */
1223                                         break;
1224                                 }
1225                         }
1226                 }
1227         }
1228         if (inp) {
1229                 SCTP_INP_INCR_REF(inp);
1230         }
1231         if (have_lock == 0) {
1232                 SCTP_INP_INFO_RUNLOCK();
1233         }
1234         return (inp);
1235 }
1236
1237 /*
1238  * Find an association for an endpoint with the pointer to whom you want to
1239  * send to and the endpoint pointer. The address can be IPv4 or IPv6. We may
1240  * need to change the *to to some other struct like a mbuf...
1241  */
1242 struct sctp_tcb *
1243 sctp_findassociation_addr_sa(struct sockaddr *to, struct sockaddr *from,
1244     struct sctp_inpcb **inp_p, struct sctp_nets **netp, int find_tcp_pool, uint32_t vrf_id)
1245 {
1246         struct sctp_inpcb *inp = NULL;
1247         struct sctp_tcb *retval;
1248
1249         SCTP_INP_INFO_RLOCK();
1250         if (find_tcp_pool) {
1251                 if (inp_p != NULL) {
1252                         retval = sctp_tcb_special_locate(inp_p, from, to, netp, vrf_id);
1253                 } else {
1254                         retval = sctp_tcb_special_locate(&inp, from, to, netp, vrf_id);
1255                 }
1256                 if (retval != NULL) {
1257                         SCTP_INP_INFO_RUNLOCK();
1258                         return (retval);
1259                 }
1260         }
1261         inp = sctp_pcb_findep(to, 0, 1, vrf_id);
1262         if (inp_p != NULL) {
1263                 *inp_p = inp;
1264         }
1265         SCTP_INP_INFO_RUNLOCK();
1266
1267         if (inp == NULL) {
1268                 return (NULL);
1269         }
1270         /*
1271          * ok, we have an endpoint, now lets find the assoc for it (if any)
1272          * we now place the source address or from in the to of the find
1273          * endpoint call. Since in reality this chain is used from the
1274          * inbound packet side.
1275          */
1276         if (inp_p != NULL) {
1277                 retval = sctp_findassociation_ep_addr(inp_p, from, netp, to, NULL);
1278         } else {
1279                 retval = sctp_findassociation_ep_addr(&inp, from, netp, to, NULL);
1280         }
1281         return retval;
1282 }
1283
1284
1285 /*
1286  * This routine will grub through the mbuf that is a INIT or INIT-ACK and
1287  * find all addresses that the sender has specified in any address list. Each
1288  * address will be used to lookup the TCB and see if one exits.
1289  */
1290 static struct sctp_tcb *
1291 sctp_findassociation_special_addr(struct mbuf *m, int iphlen, int offset,
1292     struct sctphdr *sh, struct sctp_inpcb **inp_p, struct sctp_nets **netp,
1293     struct sockaddr *dest)
1294 {
1295         struct sockaddr_in sin4;
1296         struct sockaddr_in6 sin6;
1297         struct sctp_paramhdr *phdr, parm_buf;
1298         struct sctp_tcb *retval;
1299         uint32_t ptype, plen;
1300
1301         memset(&sin4, 0, sizeof(sin4));
1302         memset(&sin6, 0, sizeof(sin6));
1303         sin4.sin_len = sizeof(sin4);
1304         sin4.sin_family = AF_INET;
1305         sin4.sin_port = sh->src_port;
1306         sin6.sin6_len = sizeof(sin6);
1307         sin6.sin6_family = AF_INET6;
1308         sin6.sin6_port = sh->src_port;
1309
1310         retval = NULL;
1311         offset += sizeof(struct sctp_init_chunk);
1312
1313         phdr = sctp_get_next_param(m, offset, &parm_buf, sizeof(parm_buf));
1314         while (phdr != NULL) {
1315                 /* now we must see if we want the parameter */
1316                 ptype = ntohs(phdr->param_type);
1317                 plen = ntohs(phdr->param_length);
1318                 if (plen == 0) {
1319                         break;
1320                 }
1321                 if (ptype == SCTP_IPV4_ADDRESS &&
1322                     plen == sizeof(struct sctp_ipv4addr_param)) {
1323                         /* Get the rest of the address */
1324                         struct sctp_ipv4addr_param ip4_parm, *p4;
1325
1326                         phdr = sctp_get_next_param(m, offset,
1327                             (struct sctp_paramhdr *)&ip4_parm, min(plen, sizeof(ip4_parm)));
1328                         if (phdr == NULL) {
1329                                 return (NULL);
1330                         }
1331                         p4 = (struct sctp_ipv4addr_param *)phdr;
1332                         memcpy(&sin4.sin_addr, &p4->addr, sizeof(p4->addr));
1333                         /* look it up */
1334                         retval = sctp_findassociation_ep_addr(inp_p,
1335                             (struct sockaddr *)&sin4, netp, dest, NULL);
1336                         if (retval != NULL) {
1337                                 return (retval);
1338                         }
1339                 } else if (ptype == SCTP_IPV6_ADDRESS &&
1340                     plen == sizeof(struct sctp_ipv6addr_param)) {
1341                         /* Get the rest of the address */
1342                         struct sctp_ipv6addr_param ip6_parm, *p6;
1343
1344                         phdr = sctp_get_next_param(m, offset,
1345                             (struct sctp_paramhdr *)&ip6_parm, min(plen, sizeof(ip6_parm)));
1346                         if (phdr == NULL) {
1347                                 return (NULL);
1348                         }
1349                         p6 = (struct sctp_ipv6addr_param *)phdr;
1350                         memcpy(&sin6.sin6_addr, &p6->addr, sizeof(p6->addr));
1351                         /* look it up */
1352                         retval = sctp_findassociation_ep_addr(inp_p,
1353                             (struct sockaddr *)&sin6, netp, dest, NULL);
1354                         if (retval != NULL) {
1355                                 return (retval);
1356                         }
1357                 }
1358                 offset += SCTP_SIZE32(plen);
1359                 phdr = sctp_get_next_param(m, offset, &parm_buf,
1360                     sizeof(parm_buf));
1361         }
1362         return (NULL);
1363 }
1364
1365
1366 static struct sctp_tcb *
1367 sctp_findassoc_by_vtag(struct sockaddr *from, uint32_t vtag,
1368     struct sctp_inpcb **inp_p, struct sctp_nets **netp, uint16_t rport,
1369     uint16_t lport, int skip_src_check)
1370 {
1371         /*
1372          * Use my vtag to hash. If we find it we then verify the source addr
1373          * is in the assoc. If all goes well we save a bit on rec of a
1374          * packet.
1375          */
1376         struct sctpasochead *head;
1377         struct sctp_nets *net;
1378         struct sctp_tcb *stcb;
1379
1380         *netp = NULL;
1381         *inp_p = NULL;
1382         SCTP_INP_INFO_RLOCK();
1383         head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(vtag,
1384             sctppcbinfo.hashasocmark)];
1385         if (head == NULL) {
1386                 /* invalid vtag */
1387                 SCTP_INP_INFO_RUNLOCK();
1388                 return (NULL);
1389         }
1390         LIST_FOREACH(stcb, head, sctp_asocs) {
1391                 SCTP_INP_RLOCK(stcb->sctp_ep);
1392                 if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1393                         SCTP_INP_RUNLOCK(stcb->sctp_ep);
1394                         continue;
1395                 }
1396                 SCTP_TCB_LOCK(stcb);
1397                 SCTP_INP_RUNLOCK(stcb->sctp_ep);
1398                 if (stcb->asoc.my_vtag == vtag) {
1399                         /* candidate */
1400                         if (stcb->rport != rport) {
1401                                 /*
1402                                  * we could remove this if vtags are unique
1403                                  * across the system.
1404                                  */
1405                                 SCTP_TCB_UNLOCK(stcb);
1406                                 continue;
1407                         }
1408                         if (stcb->sctp_ep->sctp_lport != lport) {
1409                                 /*
1410                                  * we could remove this if vtags are unique
1411                                  * across the system.
1412                                  */
1413                                 SCTP_TCB_UNLOCK(stcb);
1414                                 continue;
1415                         }
1416                         if (skip_src_check) {
1417                                 *netp = NULL;   /* unknown */
1418                                 if (inp_p)
1419                                         *inp_p = stcb->sctp_ep;
1420                                 SCTP_INP_INFO_RUNLOCK();
1421                                 return (stcb);
1422                         }
1423                         net = sctp_findnet(stcb, from);
1424                         if (net) {
1425                                 /* yep its him. */
1426                                 *netp = net;
1427                                 SCTP_STAT_INCR(sctps_vtagexpress);
1428                                 *inp_p = stcb->sctp_ep;
1429                                 SCTP_INP_INFO_RUNLOCK();
1430                                 return (stcb);
1431                         } else {
1432                                 /*
1433                                  * not him, this should only happen in rare
1434                                  * cases so I peg it.
1435                                  */
1436                                 SCTP_STAT_INCR(sctps_vtagbogus);
1437                         }
1438                 }
1439                 SCTP_TCB_UNLOCK(stcb);
1440         }
1441         SCTP_INP_INFO_RUNLOCK();
1442         return (NULL);
1443 }
1444
1445 /*
1446  * Find an association with the pointer to the inbound IP packet. This can be
1447  * a IPv4 or IPv6 packet.
1448  */
1449 struct sctp_tcb *
1450 sctp_findassociation_addr(struct mbuf *m, int iphlen, int offset,
1451     struct sctphdr *sh, struct sctp_chunkhdr *ch,
1452     struct sctp_inpcb **inp_p, struct sctp_nets **netp, uint32_t vrf_id)
1453 {
1454         int find_tcp_pool;
1455         struct ip *iph;
1456         struct sctp_tcb *retval;
1457         struct sockaddr_storage to_store, from_store;
1458         struct sockaddr *to = (struct sockaddr *)&to_store;
1459         struct sockaddr *from = (struct sockaddr *)&from_store;
1460         struct sctp_inpcb *inp;
1461
1462         iph = mtod(m, struct ip *);
1463         if (iph->ip_v == IPVERSION) {
1464                 /* its IPv4 */
1465                 struct sockaddr_in *from4;
1466
1467                 from4 = (struct sockaddr_in *)&from_store;
1468                 bzero(from4, sizeof(*from4));
1469                 from4->sin_family = AF_INET;
1470                 from4->sin_len = sizeof(struct sockaddr_in);
1471                 from4->sin_addr.s_addr = iph->ip_src.s_addr;
1472                 from4->sin_port = sh->src_port;
1473         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
1474                 /* its IPv6 */
1475                 struct ip6_hdr *ip6;
1476                 struct sockaddr_in6 *from6;
1477
1478                 ip6 = mtod(m, struct ip6_hdr *);
1479                 from6 = (struct sockaddr_in6 *)&from_store;
1480                 bzero(from6, sizeof(*from6));
1481                 from6->sin6_family = AF_INET6;
1482                 from6->sin6_len = sizeof(struct sockaddr_in6);
1483                 from6->sin6_addr = ip6->ip6_src;
1484                 from6->sin6_port = sh->src_port;
1485                 /* Get the scopes in properly to the sin6 addr's */
1486                 /* we probably don't need these operations */
1487                 (void)sa6_recoverscope(from6);
1488                 sa6_embedscope(from6, ip6_use_defzone);
1489         } else {
1490                 /* Currently not supported. */
1491                 return (NULL);
1492         }
1493         if (sh->v_tag) {
1494                 /* we only go down this path if vtag is non-zero */
1495                 retval = sctp_findassoc_by_vtag(from, ntohl(sh->v_tag),
1496                     inp_p, netp, sh->src_port, sh->dest_port, 0);
1497                 if (retval) {
1498                         return (retval);
1499                 }
1500         }
1501         if (iph->ip_v == IPVERSION) {
1502                 /* its IPv4 */
1503                 struct sockaddr_in *to4;
1504
1505                 to4 = (struct sockaddr_in *)&to_store;
1506                 bzero(to4, sizeof(*to4));
1507                 to4->sin_family = AF_INET;
1508                 to4->sin_len = sizeof(struct sockaddr_in);
1509                 to4->sin_addr.s_addr = iph->ip_dst.s_addr;
1510                 to4->sin_port = sh->dest_port;
1511         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
1512                 /* its IPv6 */
1513                 struct ip6_hdr *ip6;
1514                 struct sockaddr_in6 *to6;
1515
1516                 ip6 = mtod(m, struct ip6_hdr *);
1517                 to6 = (struct sockaddr_in6 *)&to_store;
1518                 bzero(to6, sizeof(*to6));
1519                 to6->sin6_family = AF_INET6;
1520                 to6->sin6_len = sizeof(struct sockaddr_in6);
1521                 to6->sin6_addr = ip6->ip6_dst;
1522                 to6->sin6_port = sh->dest_port;
1523                 /* Get the scopes in properly to the sin6 addr's */
1524                 /* we probably don't need these operations */
1525                 (void)sa6_recoverscope(to6);
1526                 sa6_embedscope(to6, ip6_use_defzone);
1527         }
1528         find_tcp_pool = 0;
1529         if ((ch->chunk_type != SCTP_INITIATION) &&
1530             (ch->chunk_type != SCTP_INITIATION_ACK) &&
1531             (ch->chunk_type != SCTP_COOKIE_ACK) &&
1532             (ch->chunk_type != SCTP_COOKIE_ECHO)) {
1533                 /* Other chunk types go to the tcp pool. */
1534                 find_tcp_pool = 1;
1535         }
1536         if (inp_p) {
1537                 retval = sctp_findassociation_addr_sa(to, from, inp_p, netp,
1538                     find_tcp_pool, vrf_id);
1539                 inp = *inp_p;
1540         } else {
1541                 retval = sctp_findassociation_addr_sa(to, from, &inp, netp,
1542                     find_tcp_pool, vrf_id);
1543         }
1544         SCTPDBG(SCTP_DEBUG_PCB1, "retval:%p inp:%p\n", retval, inp);
1545         if (retval == NULL && inp) {
1546                 /* Found a EP but not this address */
1547                 if ((ch->chunk_type == SCTP_INITIATION) ||
1548                     (ch->chunk_type == SCTP_INITIATION_ACK)) {
1549                         /*-
1550                          * special hook, we do NOT return linp or an
1551                          * association that is linked to an existing
1552                          * association that is under the TCP pool (i.e. no
1553                          * listener exists). The endpoint finding routine
1554                          * will always find a listner before examining the
1555                          * TCP pool.
1556                          */
1557                         if (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) {
1558                                 if (inp_p) {
1559                                         *inp_p = NULL;
1560                                 }
1561                                 return (NULL);
1562                         }
1563                         retval = sctp_findassociation_special_addr(m, iphlen,
1564                             offset, sh, &inp, netp, to);
1565                         if (inp_p != NULL) {
1566                                 *inp_p = inp;
1567                         }
1568                 }
1569         }
1570         SCTPDBG(SCTP_DEBUG_PCB1, "retval is %p\n", retval);
1571         return (retval);
1572 }
1573
1574 /*
1575  * lookup an association by an ASCONF lookup address.
1576  * if the lookup address is 0.0.0.0 or ::0, use the vtag to do the lookup
1577  */
1578 struct sctp_tcb *
1579 sctp_findassociation_ep_asconf(struct mbuf *m, int iphlen, int offset,
1580     struct sctphdr *sh, struct sctp_inpcb **inp_p, struct sctp_nets **netp)
1581 {
1582         struct sctp_tcb *stcb;
1583         struct sockaddr_in *sin;
1584         struct sockaddr_in6 *sin6;
1585         struct sockaddr_storage local_store, remote_store;
1586         struct ip *iph;
1587         struct sctp_paramhdr parm_buf, *phdr;
1588         int ptype;
1589         int zero_address = 0;
1590
1591
1592         memset(&local_store, 0, sizeof(local_store));
1593         memset(&remote_store, 0, sizeof(remote_store));
1594
1595         /* First get the destination address setup too. */
1596         iph = mtod(m, struct ip *);
1597         if (iph->ip_v == IPVERSION) {
1598                 /* its IPv4 */
1599                 sin = (struct sockaddr_in *)&local_store;
1600                 sin->sin_family = AF_INET;
1601                 sin->sin_len = sizeof(*sin);
1602                 sin->sin_port = sh->dest_port;
1603                 sin->sin_addr.s_addr = iph->ip_dst.s_addr;
1604         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
1605                 /* its IPv6 */
1606                 struct ip6_hdr *ip6;
1607
1608                 ip6 = mtod(m, struct ip6_hdr *);
1609                 sin6 = (struct sockaddr_in6 *)&local_store;
1610                 sin6->sin6_family = AF_INET6;
1611                 sin6->sin6_len = sizeof(*sin6);
1612                 sin6->sin6_port = sh->dest_port;
1613                 sin6->sin6_addr = ip6->ip6_dst;
1614         } else {
1615                 return NULL;
1616         }
1617
1618         phdr = sctp_get_next_param(m, offset + sizeof(struct sctp_asconf_chunk),
1619             &parm_buf, sizeof(struct sctp_paramhdr));
1620         if (phdr == NULL) {
1621                 SCTPDBG(SCTP_DEBUG_INPUT3, "%s: failed to get asconf lookup addr\n",
1622                     __FUNCTION__);
1623                 return NULL;
1624         }
1625         ptype = (int)((uint32_t) ntohs(phdr->param_type));
1626         /* get the correlation address */
1627         if (ptype == SCTP_IPV6_ADDRESS) {
1628                 /* ipv6 address param */
1629                 struct sctp_ipv6addr_param *p6, p6_buf;
1630
1631                 if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv6addr_param)) {
1632                         return NULL;
1633                 }
1634                 p6 = (struct sctp_ipv6addr_param *)sctp_get_next_param(m,
1635                     offset + sizeof(struct sctp_asconf_chunk),
1636                     &p6_buf.ph, sizeof(*p6));
1637                 if (p6 == NULL) {
1638                         SCTPDBG(SCTP_DEBUG_INPUT3, "%s: failed to get asconf v6 lookup addr\n",
1639                             __FUNCTION__);
1640                         return (NULL);
1641                 }
1642                 sin6 = (struct sockaddr_in6 *)&remote_store;
1643                 sin6->sin6_family = AF_INET6;
1644                 sin6->sin6_len = sizeof(*sin6);
1645                 sin6->sin6_port = sh->src_port;
1646                 memcpy(&sin6->sin6_addr, &p6->addr, sizeof(struct in6_addr));
1647                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
1648                         zero_address = 1;
1649         } else if (ptype == SCTP_IPV4_ADDRESS) {
1650                 /* ipv4 address param */
1651                 struct sctp_ipv4addr_param *p4, p4_buf;
1652
1653                 if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv4addr_param)) {
1654                         return NULL;
1655                 }
1656                 p4 = (struct sctp_ipv4addr_param *)sctp_get_next_param(m,
1657                     offset + sizeof(struct sctp_asconf_chunk),
1658                     &p4_buf.ph, sizeof(*p4));
1659                 if (p4 == NULL) {
1660                         SCTPDBG(SCTP_DEBUG_INPUT3, "%s: failed to get asconf v4 lookup addr\n",
1661                             __FUNCTION__);
1662                         return (NULL);
1663                 }
1664                 sin = (struct sockaddr_in *)&remote_store;
1665                 sin->sin_family = AF_INET;
1666                 sin->sin_len = sizeof(*sin);
1667                 sin->sin_port = sh->src_port;
1668                 memcpy(&sin->sin_addr, &p4->addr, sizeof(struct in_addr));
1669                 if (sin->sin_addr.s_addr == INADDR_ANY)
1670                         zero_address = 1;
1671         } else {
1672                 /* invalid address param type */
1673                 return NULL;
1674         }
1675
1676         if (zero_address) {
1677                 stcb = sctp_findassoc_by_vtag(NULL, ntohl(sh->v_tag), inp_p,
1678                     netp, sh->src_port, sh->dest_port, 1);
1679                 /*
1680                  * printf("findassociation_ep_asconf: zero lookup address
1681                  * finds stcb 0x%x\n", (uint32_t)stcb);
1682                  */
1683         } else {
1684                 stcb = sctp_findassociation_ep_addr(inp_p,
1685                     (struct sockaddr *)&remote_store, netp,
1686                     (struct sockaddr *)&local_store, NULL);
1687         }
1688         return (stcb);
1689 }
1690
1691
1692 /*
1693  * allocate a sctp_inpcb and setup a temporary binding to a port/all
1694  * addresses. This way if we don't get a bind we by default pick a ephemeral
1695  * port with all addresses bound.
1696  */
1697 int
1698 sctp_inpcb_alloc(struct socket *so)
1699 {
1700         /*
1701          * we get called when a new endpoint starts up. We need to allocate
1702          * the sctp_inpcb structure from the zone and init it. Mark it as
1703          * unbound and find a port that we can use as an ephemeral with
1704          * INADDR_ANY. If the user binds later no problem we can then add in
1705          * the specific addresses. And setup the default parameters for the
1706          * EP.
1707          */
1708         int i, error;
1709         struct sctp_inpcb *inp;
1710         struct sctp_pcb *m;
1711         struct timeval time;
1712         sctp_sharedkey_t *null_key;
1713
1714         error = 0;
1715
1716         SCTP_INP_INFO_WLOCK();
1717         inp = SCTP_ZONE_GET(sctppcbinfo.ipi_zone_ep, struct sctp_inpcb);
1718         if (inp == NULL) {
1719                 SCTP_PRINTF("Out of SCTP-INPCB structures - no resources\n");
1720                 SCTP_INP_INFO_WUNLOCK();
1721                 return (ENOBUFS);
1722         }
1723         /* zap it */
1724         bzero(inp, sizeof(*inp));
1725
1726         /* bump generations */
1727         /* setup socket pointers */
1728         inp->sctp_socket = so;
1729         inp->ip_inp.inp.inp_socket = so;
1730
1731         inp->partial_delivery_point = SCTP_SB_LIMIT_RCV(so) >> SCTP_PARTIAL_DELIVERY_SHIFT;
1732         inp->sctp_frag_point = SCTP_DEFAULT_MAXSEGMENT;
1733
1734 #ifdef IPSEC
1735         {
1736                 struct inpcbpolicy *pcb_sp = NULL;
1737
1738                 error = ipsec_init_pcbpolicy(so, &pcb_sp);
1739                 /* Arrange to share the policy */
1740                 inp->ip_inp.inp.inp_sp = pcb_sp;
1741                 ((struct in6pcb *)(&inp->ip_inp.inp))->in6p_sp = pcb_sp;
1742         }
1743         if (error != 0) {
1744                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp);
1745                 SCTP_INP_INFO_WUNLOCK();
1746                 return error;
1747         }
1748 #endif                          /* IPSEC */
1749         SCTP_INCR_EP_COUNT();
1750         inp->ip_inp.inp.inp_ip_ttl = ip_defttl;
1751         SCTP_INP_INFO_WUNLOCK();
1752
1753         so->so_pcb = (caddr_t)inp;
1754
1755         if ((SCTP_SO_TYPE(so) == SOCK_DGRAM) ||
1756             (SCTP_SO_TYPE(so) == SOCK_SEQPACKET)) {
1757                 /* UDP style socket */
1758                 inp->sctp_flags = (SCTP_PCB_FLAGS_UDPTYPE |
1759                     SCTP_PCB_FLAGS_UNBOUND);
1760                 /* Be sure it is NON-BLOCKING IO for UDP */
1761                 /* SCTP_SET_SO_NBIO(so); */
1762         } else if (SCTP_SO_TYPE(so) == SOCK_STREAM) {
1763                 /* TCP style socket */
1764                 inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
1765                     SCTP_PCB_FLAGS_UNBOUND);
1766                 /* Be sure we have blocking IO by default */
1767                 SCTP_CLEAR_SO_NBIO(so);
1768         } else {
1769                 /*
1770                  * unsupported socket type (RAW, etc)- in case we missed it
1771                  * in protosw
1772                  */
1773                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp);
1774                 return (EOPNOTSUPP);
1775         }
1776         inp->sctp_tcbhash = SCTP_HASH_INIT(sctp_pcbtblsize,
1777             &inp->sctp_hashmark);
1778         if (inp->sctp_tcbhash == NULL) {
1779                 SCTP_PRINTF("Out of SCTP-INPCB->hashinit - no resources\n");
1780                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp);
1781                 return (ENOBUFS);
1782         }
1783         inp->def_vrf_id = SCTP_DEFAULT_VRFID;
1784         inp->def_table_id = SCTP_DEFAULT_TABLEID;
1785
1786         SCTP_INP_INFO_WLOCK();
1787         SCTP_INP_LOCK_INIT(inp);
1788         SCTP_INP_READ_INIT(inp);
1789         SCTP_ASOC_CREATE_LOCK_INIT(inp);
1790         /* lock the new ep */
1791         SCTP_INP_WLOCK(inp);
1792
1793         /* add it to the info area */
1794         LIST_INSERT_HEAD(&sctppcbinfo.listhead, inp, sctp_list);
1795         SCTP_INP_INFO_WUNLOCK();
1796
1797         TAILQ_INIT(&inp->read_queue);
1798         LIST_INIT(&inp->sctp_addr_list);
1799
1800         LIST_INIT(&inp->sctp_asoc_list);
1801
1802 #ifdef SCTP_TRACK_FREED_ASOCS
1803         /* TEMP CODE */
1804         LIST_INIT(&inp->sctp_asoc_free_list);
1805 #endif
1806         /* Init the timer structure for signature change */
1807         SCTP_OS_TIMER_INIT(&inp->sctp_ep.signature_change.timer);
1808         inp->sctp_ep.signature_change.type = SCTP_TIMER_TYPE_NEWCOOKIE;
1809
1810         /* now init the actual endpoint default data */
1811         m = &inp->sctp_ep;
1812
1813         /* setup the base timeout information */
1814         m->sctp_timeoutticks[SCTP_TIMER_SEND] = SEC_TO_TICKS(SCTP_SEND_SEC);    /* needed ? */
1815         m->sctp_timeoutticks[SCTP_TIMER_INIT] = SEC_TO_TICKS(SCTP_INIT_SEC);    /* needed ? */
1816         m->sctp_timeoutticks[SCTP_TIMER_RECV] = MSEC_TO_TICKS(sctp_delayed_sack_time_default);
1817         m->sctp_timeoutticks[SCTP_TIMER_HEARTBEAT] = MSEC_TO_TICKS(sctp_heartbeat_interval_default);
1818         m->sctp_timeoutticks[SCTP_TIMER_PMTU] = SEC_TO_TICKS(sctp_pmtu_raise_time_default);
1819         m->sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] = SEC_TO_TICKS(sctp_shutdown_guard_time_default);
1820         m->sctp_timeoutticks[SCTP_TIMER_SIGNATURE] = SEC_TO_TICKS(sctp_secret_lifetime_default);
1821         /* all max/min max are in ms */
1822         m->sctp_maxrto = sctp_rto_max_default;
1823         m->sctp_minrto = sctp_rto_min_default;
1824         m->initial_rto = sctp_rto_initial_default;
1825         m->initial_init_rto_max = sctp_init_rto_max_default;
1826         m->sctp_sack_freq = sctp_sack_freq_default;
1827
1828         m->max_open_streams_intome = MAX_SCTP_STREAMS;
1829
1830         m->max_init_times = sctp_init_rtx_max_default;
1831         m->max_send_times = sctp_assoc_rtx_max_default;
1832         m->def_net_failure = sctp_path_rtx_max_default;
1833         m->sctp_sws_sender = SCTP_SWS_SENDER_DEF;
1834         m->sctp_sws_receiver = SCTP_SWS_RECEIVER_DEF;
1835         m->max_burst = sctp_max_burst_default;
1836         /* number of streams to pre-open on a association */
1837         m->pre_open_stream_count = sctp_nr_outgoing_streams_default;
1838
1839         /* Add adaptation cookie */
1840         m->adaptation_layer_indicator = 0x504C5253;
1841
1842         /* seed random number generator */
1843         m->random_counter = 1;
1844         m->store_at = SCTP_SIGNATURE_SIZE;
1845         SCTP_READ_RANDOM(m->random_numbers, sizeof(m->random_numbers));
1846         sctp_fill_random_store(m);
1847
1848         /* Minimum cookie size */
1849         m->size_of_a_cookie = (sizeof(struct sctp_init_msg) * 2) +
1850             sizeof(struct sctp_state_cookie);
1851         m->size_of_a_cookie += SCTP_SIGNATURE_SIZE;
1852
1853         /* Setup the initial secret */
1854         (void)SCTP_GETTIME_TIMEVAL(&time);
1855         m->time_of_secret_change = time.tv_sec;
1856
1857         for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1858                 m->secret_key[0][i] = sctp_select_initial_TSN(m);
1859         }
1860         sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL);
1861
1862         /* How long is a cookie good for ? */
1863         m->def_cookie_life = MSEC_TO_TICKS(sctp_valid_cookie_life_default);
1864         /*
1865          * Initialize authentication parameters
1866          */
1867         m->local_hmacs = sctp_default_supported_hmaclist();
1868         m->local_auth_chunks = sctp_alloc_chunklist();
1869         sctp_auth_set_default_chunks(m->local_auth_chunks);
1870         LIST_INIT(&m->shared_keys);
1871         /* add default NULL key as key id 0 */
1872         null_key = sctp_alloc_sharedkey();
1873         sctp_insert_sharedkey(&m->shared_keys, null_key);
1874         SCTP_INP_WUNLOCK(inp);
1875 #ifdef SCTP_LOG_CLOSING
1876         sctp_log_closing(inp, NULL, 12);
1877 #endif
1878         return (error);
1879 }
1880
1881
1882 void
1883 sctp_move_pcb_and_assoc(struct sctp_inpcb *old_inp, struct sctp_inpcb *new_inp,
1884     struct sctp_tcb *stcb)
1885 {
1886         struct sctp_nets *net;
1887         uint16_t lport, rport;
1888         struct sctppcbhead *head;
1889         struct sctp_laddr *laddr, *oladdr;
1890
1891         SCTP_TCB_UNLOCK(stcb);
1892         SCTP_INP_INFO_WLOCK();
1893         SCTP_INP_WLOCK(old_inp);
1894         SCTP_INP_WLOCK(new_inp);
1895         SCTP_TCB_LOCK(stcb);
1896
1897         new_inp->sctp_ep.time_of_secret_change =
1898             old_inp->sctp_ep.time_of_secret_change;
1899         memcpy(new_inp->sctp_ep.secret_key, old_inp->sctp_ep.secret_key,
1900             sizeof(old_inp->sctp_ep.secret_key));
1901         new_inp->sctp_ep.current_secret_number =
1902             old_inp->sctp_ep.current_secret_number;
1903         new_inp->sctp_ep.last_secret_number =
1904             old_inp->sctp_ep.last_secret_number;
1905         new_inp->sctp_ep.size_of_a_cookie = old_inp->sctp_ep.size_of_a_cookie;
1906
1907         /* make it so new data pours into the new socket */
1908         stcb->sctp_socket = new_inp->sctp_socket;
1909         stcb->sctp_ep = new_inp;
1910
1911         /* Copy the port across */
1912         lport = new_inp->sctp_lport = old_inp->sctp_lport;
1913         rport = stcb->rport;
1914         /* Pull the tcb from the old association */
1915         LIST_REMOVE(stcb, sctp_tcbhash);
1916         LIST_REMOVE(stcb, sctp_tcblist);
1917
1918         /* Now insert the new_inp into the TCP connected hash */
1919         head = &sctppcbinfo.sctp_tcpephash[SCTP_PCBHASH_ALLADDR((lport + rport),
1920             sctppcbinfo.hashtcpmark)];
1921
1922         LIST_INSERT_HEAD(head, new_inp, sctp_hash);
1923         /* Its safe to access */
1924         new_inp->sctp_flags &= ~SCTP_PCB_FLAGS_UNBOUND;
1925
1926         /* Now move the tcb into the endpoint list */
1927         LIST_INSERT_HEAD(&new_inp->sctp_asoc_list, stcb, sctp_tcblist);
1928         /*
1929          * Question, do we even need to worry about the ep-hash since we
1930          * only have one connection? Probably not :> so lets get rid of it
1931          * and not suck up any kernel memory in that.
1932          */
1933
1934         /* Ok. Let's restart timer. */
1935         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1936                 sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, new_inp,
1937                     stcb, net);
1938         }
1939
1940         SCTP_INP_INFO_WUNLOCK();
1941         if (new_inp->sctp_tcbhash != NULL) {
1942                 SCTP_HASH_FREE(new_inp->sctp_tcbhash, new_inp->sctp_hashmark);
1943                 new_inp->sctp_tcbhash = NULL;
1944         }
1945         if ((new_inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
1946                 /* Subset bound, so copy in the laddr list from the old_inp */
1947                 LIST_FOREACH(oladdr, &old_inp->sctp_addr_list, sctp_nxt_addr) {
1948                         laddr = SCTP_ZONE_GET(sctppcbinfo.ipi_zone_laddr, struct sctp_laddr);
1949                         if (laddr == NULL) {
1950                                 /*
1951                                  * Gak, what can we do? This assoc is really
1952                                  * HOSED. We probably should send an abort
1953                                  * here.
1954                                  */
1955                                 SCTPDBG(SCTP_DEBUG_PCB1, "Association hosed in TCP model, out of laddr memory\n");
1956                                 continue;
1957                         }
1958                         SCTP_INCR_LADDR_COUNT();
1959                         bzero(laddr, sizeof(*laddr));
1960                         laddr->ifa = oladdr->ifa;
1961                         atomic_add_int(&laddr->ifa->refcount, 1);
1962                         LIST_INSERT_HEAD(&new_inp->sctp_addr_list, laddr,
1963                             sctp_nxt_addr);
1964                         new_inp->laddr_count++;
1965                 }
1966         }
1967         /*
1968          * Now any running timers need to be adjusted since we really don't
1969          * care if they are running or not just blast in the new_inp into
1970          * all of them.
1971          */
1972
1973         stcb->asoc.hb_timer.ep = (void *)new_inp;
1974         stcb->asoc.dack_timer.ep = (void *)new_inp;
1975         stcb->asoc.asconf_timer.ep = (void *)new_inp;
1976         stcb->asoc.strreset_timer.ep = (void *)new_inp;
1977         stcb->asoc.shut_guard_timer.ep = (void *)new_inp;
1978         stcb->asoc.autoclose_timer.ep = (void *)new_inp;
1979         stcb->asoc.delayed_event_timer.ep = (void *)new_inp;
1980         /* now what about the nets? */
1981         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1982                 net->pmtu_timer.ep = (void *)new_inp;
1983                 net->rxt_timer.ep = (void *)new_inp;
1984                 net->fr_timer.ep = (void *)new_inp;
1985         }
1986         SCTP_INP_WUNLOCK(new_inp);
1987         SCTP_INP_WUNLOCK(old_inp);
1988 }
1989
1990 static int
1991 sctp_isport_inuse(struct sctp_inpcb *inp, uint16_t lport, uint32_t vrf_id)
1992 {
1993         struct sctppcbhead *head;
1994         struct sctp_inpcb *t_inp;
1995         int fnd;
1996
1997         head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport,
1998             sctppcbinfo.hashmark)];
1999         LIST_FOREACH(t_inp, head, sctp_hash) {
2000                 if (t_inp->sctp_lport != lport) {
2001                         continue;
2002                 }
2003                 /* is it in the VRF in question */
2004                 fnd = 0;
2005                 if (t_inp->def_vrf_id == vrf_id)
2006                         fnd = 1;
2007                 if (!fnd)
2008                         continue;
2009
2010                 /* This one is in use. */
2011                 /* check the v6/v4 binding issue */
2012                 if ((t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2013                     SCTP_IPV6_V6ONLY(t_inp)) {
2014                         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2015                                 /* collision in V6 space */
2016                                 return (1);
2017                         } else {
2018                                 /* inp is BOUND_V4 no conflict */
2019                                 continue;
2020                         }
2021                 } else if (t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2022                         /* t_inp is bound v4 and v6, conflict always */
2023                         return (1);
2024                 } else {
2025                         /* t_inp is bound only V4 */
2026                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
2027                             SCTP_IPV6_V6ONLY(inp)) {
2028                                 /* no conflict */
2029                                 continue;
2030                         }
2031                         /* else fall through to conflict */
2032                 }
2033                 return (1);
2034         }
2035         return (0);
2036 }
2037
2038
2039
2040 int
2041 sctp_inpcb_bind(struct socket *so, struct sockaddr *addr, struct thread *p)
2042 {
2043         /* bind a ep to a socket address */
2044         struct sctppcbhead *head;
2045         struct sctp_inpcb *inp, *inp_tmp;
2046         struct inpcb *ip_inp;
2047         int bindall;
2048         uint16_t lport;
2049         int error;
2050         uint32_t vrf_id;
2051
2052         lport = 0;
2053         error = 0;
2054         bindall = 1;
2055         inp = (struct sctp_inpcb *)so->so_pcb;
2056         ip_inp = (struct inpcb *)so->so_pcb;
2057 #ifdef SCTP_DEBUG
2058         if (addr) {
2059                 SCTPDBG(SCTP_DEBUG_PCB1, "Bind called port:%d\n",
2060                     ntohs(((struct sockaddr_in *)addr)->sin_port));
2061                 SCTPDBG(SCTP_DEBUG_PCB1, "Addr :");
2062                 SCTPDBG_ADDR(SCTP_DEBUG_PCB1, addr);
2063         }
2064 #endif
2065         if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) == 0) {
2066                 /* already did a bind, subsequent binds NOT allowed ! */
2067                 return (EINVAL);
2068         }
2069         if (addr != NULL) {
2070                 if (addr->sa_family == AF_INET) {
2071                         struct sockaddr_in *sin;
2072
2073                         /* IPV6_V6ONLY socket? */
2074                         if (SCTP_IPV6_V6ONLY(ip_inp)) {
2075                                 return (EINVAL);
2076                         }
2077                         if (addr->sa_len != sizeof(*sin))
2078                                 return (EINVAL);
2079
2080                         sin = (struct sockaddr_in *)addr;
2081                         lport = sin->sin_port;
2082
2083                         if (sin->sin_addr.s_addr != INADDR_ANY) {
2084                                 bindall = 0;
2085                         }
2086                 } else if (addr->sa_family == AF_INET6) {
2087                         /* Only for pure IPv6 Address. (No IPv4 Mapped!) */
2088                         struct sockaddr_in6 *sin6;
2089
2090                         sin6 = (struct sockaddr_in6 *)addr;
2091
2092                         if (addr->sa_len != sizeof(*sin6))
2093                                 return (EINVAL);
2094
2095                         lport = sin6->sin6_port;
2096                         if (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2097                                 bindall = 0;
2098                                 /* KAME hack: embed scopeid */
2099                                 if (sa6_embedscope(sin6, ip6_use_defzone) != 0)
2100                                         return (EINVAL);
2101                         }
2102                         /* this must be cleared for ifa_ifwithaddr() */
2103                         sin6->sin6_scope_id = 0;
2104                 } else {
2105                         return (EAFNOSUPPORT);
2106                 }
2107         }
2108         /* Setup a vrf_id to be the default for the non-bind-all case. */
2109         vrf_id = inp->def_vrf_id;
2110
2111         SCTP_INP_INFO_WLOCK();
2112         SCTP_INP_WLOCK(inp);
2113         /* increase our count due to the unlock we do */
2114         SCTP_INP_INCR_REF(inp);
2115         if (lport) {
2116                 /*
2117                  * Did the caller specify a port? if so we must see if a ep
2118                  * already has this one bound.
2119                  */
2120                 /* got to be root to get at low ports */
2121                 if (ntohs(lport) < IPPORT_RESERVED) {
2122                         if (p && (error =
2123                             priv_check_cred(p->td_ucred,
2124                             PRIV_NETINET_RESERVEDPORT,
2125                             SUSER_ALLOWJAIL
2126                             )
2127                             )) {
2128                                 SCTP_INP_DECR_REF(inp);
2129                                 SCTP_INP_WUNLOCK(inp);
2130                                 SCTP_INP_INFO_WUNLOCK();
2131                                 return (error);
2132                         }
2133                 }
2134                 if (p == NULL) {
2135                         SCTP_INP_DECR_REF(inp);
2136                         SCTP_INP_WUNLOCK(inp);
2137                         SCTP_INP_INFO_WUNLOCK();
2138                         return (error);
2139                 }
2140                 SCTP_INP_WUNLOCK(inp);
2141                 if (bindall) {
2142                         vrf_id = inp->def_vrf_id;
2143                         inp_tmp = sctp_pcb_findep(addr, 0, 1, vrf_id);
2144                         if (inp_tmp != NULL) {
2145                                 /*
2146                                  * lock guy returned and lower count note
2147                                  * that we are not bound so inp_tmp should
2148                                  * NEVER be inp. And it is this inp
2149                                  * (inp_tmp) that gets the reference bump,
2150                                  * so we must lower it.
2151                                  */
2152                                 SCTP_INP_DECR_REF(inp_tmp);
2153                                 SCTP_INP_DECR_REF(inp);
2154                                 /* unlock info */
2155                                 SCTP_INP_INFO_WUNLOCK();
2156                                 return (EADDRNOTAVAIL);
2157                         }
2158                 } else {
2159                         inp_tmp = sctp_pcb_findep(addr, 0, 1, vrf_id);
2160                         if (inp_tmp != NULL) {
2161                                 /*
2162                                  * lock guy returned and lower count note
2163                                  * that we are not bound so inp_tmp should
2164                                  * NEVER be inp. And it is this inp
2165                                  * (inp_tmp) that gets the reference bump,
2166                                  * so we must lower it.
2167                                  */
2168                                 SCTP_INP_DECR_REF(inp_tmp);
2169                                 SCTP_INP_DECR_REF(inp);
2170                                 /* unlock info */
2171                                 SCTP_INP_INFO_WUNLOCK();
2172                                 return (EADDRNOTAVAIL);
2173                         }
2174                 }
2175                 SCTP_INP_WLOCK(inp);
2176                 if (bindall) {
2177                         /* verify that no lport is not used by a singleton */
2178                         if (sctp_isport_inuse(inp, lport, vrf_id)) {
2179                                 /* Sorry someone already has this one bound */
2180                                 SCTP_INP_DECR_REF(inp);
2181                                 SCTP_INP_WUNLOCK(inp);
2182                                 SCTP_INP_INFO_WUNLOCK();
2183                                 return (EADDRNOTAVAIL);
2184                         }
2185                 }
2186         } else {
2187                 /*
2188                  * get any port but lets make sure no one has any address
2189                  * with this port bound
2190                  */
2191
2192                 /*
2193                  * setup the inp to the top (I could use the union but this
2194                  * is just as easy
2195                  */
2196                 uint32_t port_guess;
2197                 uint16_t port_attempt;
2198                 int not_done = 1;
2199                 int not_found = 1;
2200
2201                 while (not_done) {
2202                         port_guess = sctp_select_initial_TSN(&inp->sctp_ep);
2203                         port_attempt = (port_guess & 0x0000ffff);
2204                         if (port_attempt == 0) {
2205                                 goto next_half;
2206                         }
2207                         if (port_attempt < IPPORT_RESERVED) {
2208                                 port_attempt += IPPORT_RESERVED;
2209                         }
2210                         not_found = 1;
2211                         vrf_id = inp->def_vrf_id;
2212                         if (sctp_isport_inuse(inp, htons(port_attempt),
2213                             vrf_id) == 1) {
2214                                 /* got a port we can use */
2215                                 not_found = 0;
2216                         }
2217                         if (not_found == 1) {
2218                                 /* We can use this port */
2219                                 not_done = 0;
2220                                 continue;
2221                         }
2222                         /* try upper half */
2223         next_half:
2224                         port_attempt = ((port_guess >> 16) & 0x0000ffff);
2225
2226                         if (port_attempt == 0) {
2227                                 goto last_try;
2228                         }
2229                         if (port_attempt < IPPORT_RESERVED) {
2230                                 port_attempt += IPPORT_RESERVED;
2231                         }
2232                         not_found = 1;
2233                         vrf_id = inp->def_vrf_id;
2234                         if (sctp_isport_inuse(inp, htons(port_attempt),
2235                             vrf_id) == 1) {
2236                                 /* got a port we can use */
2237                                 not_found = 0;
2238                         }
2239                         if (not_found == 1) {
2240                                 /* We can use this port */
2241                                 not_done = 0;
2242                                 continue;
2243                         }
2244                         /* try two half's added together */
2245         last_try:
2246                         port_attempt = (((port_guess >> 16) & 0x0000ffff) +
2247                             (port_guess & 0x0000ffff));
2248                         if (port_attempt == 0) {
2249                                 /* get a new random number */
2250                                 continue;
2251                         }
2252                         if (port_attempt < IPPORT_RESERVED) {
2253                                 port_attempt += IPPORT_RESERVED;
2254                         }
2255                         not_found = 1;
2256                         vrf_id = inp->def_vrf_id;
2257                         if (sctp_isport_inuse(inp, htons(port_attempt), vrf_id) == 1) {
2258                                 /* got a port we can use */
2259                                 not_found = 0;
2260                         }
2261                         if (not_found == 1) {
2262                                 /* We can use this port */
2263                                 not_done = 0;
2264                                 continue;
2265                         }
2266                 }
2267                 /* we don't get out of the loop until we have a port */
2268                 lport = htons(port_attempt);
2269         }
2270         SCTP_INP_DECR_REF(inp);
2271         if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE |
2272             SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
2273                 /*
2274                  * this really should not happen. The guy did a non-blocking
2275                  * bind and then did a close at the same time.
2276                  */
2277                 SCTP_INP_WUNLOCK(inp);
2278                 SCTP_INP_INFO_WUNLOCK();
2279                 return (EINVAL);
2280         }
2281         /* ok we look clear to give out this port, so lets setup the binding */
2282         if (bindall) {
2283                 /* binding to all addresses, so just set in the proper flags */
2284                 inp->sctp_flags |= SCTP_PCB_FLAGS_BOUNDALL;
2285                 sctp_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF);
2286                 /* set the automatic addr changes from kernel flag */
2287                 if (sctp_auto_asconf == 0) {
2288                         sctp_feature_off(inp, SCTP_PCB_FLAGS_AUTO_ASCONF);
2289                 } else {
2290                         sctp_feature_on(inp, SCTP_PCB_FLAGS_AUTO_ASCONF);
2291                 }
2292         } else {
2293                 /*
2294                  * bind specific, make sure flags is off and add a new
2295                  * address structure to the sctp_addr_list inside the ep
2296                  * structure.
2297                  *
2298                  * We will need to allocate one and insert it at the head. The
2299                  * socketopt call can just insert new addresses in there as
2300                  * well. It will also have to do the embed scope kame hack
2301                  * too (before adding).
2302                  */
2303                 struct sctp_ifa *ifa;
2304                 struct sockaddr_storage store_sa;
2305
2306                 memset(&store_sa, 0, sizeof(store_sa));
2307                 if (addr->sa_family == AF_INET) {
2308                         struct sockaddr_in *sin;
2309
2310                         sin = (struct sockaddr_in *)&store_sa;
2311                         memcpy(sin, addr, sizeof(struct sockaddr_in));
2312                         sin->sin_port = 0;
2313                 } else if (addr->sa_family == AF_INET6) {
2314                         struct sockaddr_in6 *sin6;
2315
2316                         sin6 = (struct sockaddr_in6 *)&store_sa;
2317                         memcpy(sin6, addr, sizeof(struct sockaddr_in6));
2318                         sin6->sin6_port = 0;
2319                 }
2320                 /*
2321                  * first find the interface with the bound address need to
2322                  * zero out the port to find the address! yuck! can't do
2323                  * this earlier since need port for sctp_pcb_findep()
2324                  */
2325                 ifa = sctp_find_ifa_by_addr((struct sockaddr *)&store_sa,
2326                     vrf_id, 0);
2327                 if (ifa == NULL) {
2328                         /* Can't find an interface with that address */
2329                         SCTP_INP_WUNLOCK(inp);
2330                         SCTP_INP_INFO_WUNLOCK();
2331                         return (EADDRNOTAVAIL);
2332                 }
2333                 if (addr->sa_family == AF_INET6) {
2334                         /* GAK, more FIXME IFA lock? */
2335                         if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
2336                                 /* Can't bind a non-existent addr. */
2337                                 SCTP_INP_WUNLOCK(inp);
2338                                 SCTP_INP_INFO_WUNLOCK();
2339                                 return (EINVAL);
2340                         }
2341                 }
2342                 /* we're not bound all */
2343                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_BOUNDALL;
2344                 /* allow bindx() to send ASCONF's for binding changes */
2345                 sctp_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF);
2346                 /* set the automatic addr changes from kernel flag */
2347                 if (sctp_auto_asconf == 0) {
2348                         sctp_feature_off(inp, SCTP_PCB_FLAGS_AUTO_ASCONF);
2349                 } else {
2350                         sctp_feature_on(inp, SCTP_PCB_FLAGS_AUTO_ASCONF);
2351                 }
2352
2353                 /* add this address to the endpoint list */
2354                 error = sctp_insert_laddr(&inp->sctp_addr_list, ifa, 0);
2355                 if (error != 0) {
2356                         SCTP_INP_WUNLOCK(inp);
2357                         SCTP_INP_INFO_WUNLOCK();
2358                         return (error);
2359                 }
2360                 inp->laddr_count++;
2361         }
2362         /* find the bucket */
2363         head = &sctppcbinfo.sctp_ephash[SCTP_PCBHASH_ALLADDR(lport,
2364             sctppcbinfo.hashmark)];
2365         /* put it in the bucket */
2366         LIST_INSERT_HEAD(head, inp, sctp_hash);
2367         SCTPDBG(SCTP_DEBUG_PCB1, "Main hash to bind at head:%p, bound port:%d\n",
2368             head, ntohs(lport));
2369         /* set in the port */
2370         inp->sctp_lport = lport;
2371
2372         /* turn off just the unbound flag */
2373         inp->sctp_flags &= ~SCTP_PCB_FLAGS_UNBOUND;
2374         SCTP_INP_WUNLOCK(inp);
2375         SCTP_INP_INFO_WUNLOCK();
2376         return (0);
2377 }
2378
2379
2380 static void
2381 sctp_iterator_inp_being_freed(struct sctp_inpcb *inp, struct sctp_inpcb *inp_next)
2382 {
2383         struct sctp_iterator *it;
2384
2385         /*
2386          * We enter with the only the ITERATOR_LOCK in place and a write
2387          * lock on the inp_info stuff.
2388          */
2389
2390         /*
2391          * Go through all iterators, we must do this since it is possible
2392          * that some iterator does NOT have the lock, but is waiting for it.
2393          * And the one that had the lock has either moved in the last
2394          * iteration or we just cleared it above. We need to find all of
2395          * those guys. The list of iterators should never be very big
2396          * though.
2397          */
2398         TAILQ_FOREACH(it, &sctppcbinfo.iteratorhead, sctp_nxt_itr) {
2399                 if (it == inp->inp_starting_point_for_iterator)
2400                         /* skip this guy, he's special */
2401                         continue;
2402                 if (it->inp == inp) {
2403                         /*
2404                          * This is tricky and we DON'T lock the iterator.
2405                          * Reason is he's running but waiting for me since
2406                          * inp->inp_starting_point_for_iterator has the lock
2407                          * on me (the guy above we skipped). This tells us
2408                          * its is not running but waiting for
2409                          * inp->inp_starting_point_for_iterator to be
2410                          * released by the guy that does have our INP in a
2411                          * lock.
2412                          */
2413                         if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
2414                                 it->inp = NULL;
2415                                 it->stcb = NULL;
2416                         } else {
2417                                 /* set him up to do the next guy not me */
2418                                 it->inp = inp_next;
2419                                 it->stcb = NULL;
2420                         }
2421                 }
2422         }
2423         it = inp->inp_starting_point_for_iterator;
2424         if (it) {
2425                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
2426                         it->inp = NULL;
2427                 } else {
2428                         it->inp = inp_next;
2429                 }
2430                 it->stcb = NULL;
2431         }
2432 }
2433
2434 /* release sctp_inpcb unbind the port */
2435 void
2436 sctp_inpcb_free(struct sctp_inpcb *inp, int immediate, int from)
2437 {
2438         /*
2439          * Here we free a endpoint. We must find it (if it is in the Hash
2440          * table) and remove it from there. Then we must also find it in the
2441          * overall list and remove it from there. After all removals are
2442          * complete then any timer has to be stopped. Then start the actual
2443          * freeing. a) Any local lists. b) Any associations. c) The hash of
2444          * all associations. d) finally the ep itself.
2445          */
2446         struct sctp_pcb *m;
2447         struct sctp_inpcb *inp_save;
2448         struct sctp_tcb *asoc, *nasoc;
2449         struct sctp_laddr *laddr, *nladdr;
2450         struct inpcb *ip_pcb;
2451         struct socket *so;
2452
2453         struct sctp_queued_to_read *sq;
2454
2455
2456         int cnt;
2457         sctp_sharedkey_t *shared_key;
2458
2459
2460 #ifdef SCTP_LOG_CLOSING
2461         sctp_log_closing(inp, NULL, 0);
2462 #endif
2463
2464         SCTP_ITERATOR_LOCK();
2465         so = inp->sctp_socket;
2466         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
2467                 /* been here before.. eeks.. get out of here */
2468                 SCTP_PRINTF("This conflict in free SHOULD not be happening!\n");
2469                 SCTP_ITERATOR_UNLOCK();
2470 #ifdef SCTP_LOG_CLOSING
2471                 sctp_log_closing(inp, NULL, 1);
2472 #endif
2473                 return;
2474         }
2475         SCTP_ASOC_CREATE_LOCK(inp);
2476         SCTP_INP_INFO_WLOCK();
2477
2478         SCTP_INP_WLOCK(inp);
2479         /* First time through we have the socket lock, after that no more. */
2480         if (from == SCTP_CALLED_AFTER_CMPSET_OFCLOSE) {
2481                 /*
2482                  * Once we are in we can remove the flag from = 1 is only
2483                  * passed from the actual closing routines that are called
2484                  * via the sockets layer.
2485                  */
2486                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_CLOSE_IP;
2487         }
2488         sctp_timer_stop(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL,
2489             SCTP_FROM_SCTP_PCB + SCTP_LOC_1);
2490
2491         if (inp->control) {
2492                 sctp_m_freem(inp->control);
2493                 inp->control = NULL;
2494         }
2495         if (inp->pkt) {
2496                 sctp_m_freem(inp->pkt);
2497                 inp->pkt = NULL;
2498         }
2499         m = &inp->sctp_ep;
2500         ip_pcb = &inp->ip_inp.inp;      /* we could just cast the main pointer
2501                                          * here but I will be nice :> (i.e.
2502                                          * ip_pcb = ep;) */
2503         if (immediate == SCTP_FREE_SHOULD_USE_GRACEFUL_CLOSE) {
2504                 int cnt_in_sd;
2505
2506                 cnt_in_sd = 0;
2507                 for ((asoc = LIST_FIRST(&inp->sctp_asoc_list)); asoc != NULL;
2508                     asoc = nasoc) {
2509                         nasoc = LIST_NEXT(asoc, sctp_tcblist);
2510                         if (asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
2511                                 /* Skip guys being freed */
2512                                 asoc->sctp_socket = NULL;
2513                                 cnt_in_sd++;
2514                                 continue;
2515                         }
2516                         if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_COOKIE_WAIT) ||
2517                             (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_COOKIE_ECHOED)) {
2518                                 /* Just abandon things in the front states */
2519                                 if (asoc->asoc.total_output_queue_size == 0) {
2520                                         sctp_free_assoc(inp, asoc, SCTP_PCBFREE_NOFORCE, SCTP_FROM_SCTP_PCB + SCTP_LOC_2);
2521                                         continue;
2522                                 }
2523                         }
2524                         SCTP_TCB_LOCK(asoc);
2525                         /* Disconnect the socket please */
2526                         asoc->sctp_socket = NULL;
2527                         asoc->asoc.state |= SCTP_STATE_CLOSED_SOCKET;
2528                         if ((asoc->asoc.size_on_reasm_queue > 0) ||
2529                             (asoc->asoc.control_pdapi) ||
2530                             (asoc->asoc.size_on_all_streams > 0) ||
2531                             (so && (so->so_rcv.sb_cc > 0))
2532                             ) {
2533                                 /* Left with Data unread */
2534                                 struct mbuf *op_err;
2535
2536                                 op_err = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)),
2537                                     0, M_DONTWAIT, 1, MT_DATA);
2538                                 if (op_err) {
2539                                         /* Fill in the user initiated abort */
2540                                         struct sctp_paramhdr *ph;
2541                                         uint32_t *ippp;
2542
2543                                         SCTP_BUF_LEN(op_err) =
2544                                             sizeof(struct sctp_paramhdr) + sizeof(uint32_t);
2545                                         ph = mtod(op_err,
2546                                             struct sctp_paramhdr *);
2547                                         ph->param_type = htons(
2548                                             SCTP_CAUSE_USER_INITIATED_ABT);
2549                                         ph->param_length = htons(SCTP_BUF_LEN(op_err));
2550                                         ippp = (uint32_t *) (ph + 1);
2551                                         *ippp = htonl(SCTP_FROM_SCTP_PCB + SCTP_LOC_3);
2552                                 }
2553                                 asoc->sctp_ep->last_abort_code = SCTP_FROM_SCTP_PCB + SCTP_LOC_3;
2554                                 sctp_send_abort_tcb(asoc, op_err);
2555                                 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
2556                                 if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_OPEN) ||
2557                                     (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2558                                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
2559                                 }
2560                                 sctp_free_assoc(inp, asoc, SCTP_PCBFREE_NOFORCE, SCTP_FROM_SCTP_PCB + SCTP_LOC_4);
2561                                 continue;
2562                         } else if (TAILQ_EMPTY(&asoc->asoc.send_queue) &&
2563                                     TAILQ_EMPTY(&asoc->asoc.sent_queue) &&
2564                                     (asoc->asoc.stream_queue_cnt == 0)
2565                             ) {
2566                                 if (asoc->asoc.locked_on_sending) {
2567                                         goto abort_anyway;
2568                                 }
2569                                 if ((SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_SHUTDOWN_SENT) &&
2570                                     (SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
2571                                         /*
2572                                          * there is nothing queued to send,
2573                                          * so I send shutdown
2574                                          */
2575                                         sctp_send_shutdown(asoc, asoc->asoc.primary_destination);
2576                                         if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_OPEN) ||
2577                                             (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2578                                                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
2579                                         }
2580                                         asoc->asoc.state = SCTP_STATE_SHUTDOWN_SENT;
2581                                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, asoc->sctp_ep, asoc,
2582                                             asoc->asoc.primary_destination);
2583                                         sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, asoc->sctp_ep, asoc,
2584                                             asoc->asoc.primary_destination);
2585                                         sctp_chunk_output(inp, asoc, SCTP_OUTPUT_FROM_SHUT_TMR);
2586                                 }
2587                         } else {
2588                                 /* mark into shutdown pending */
2589                                 struct sctp_stream_queue_pending *sp;
2590
2591                                 asoc->asoc.state |= SCTP_STATE_SHUTDOWN_PENDING;
2592                                 sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, asoc->sctp_ep, asoc,
2593                                     asoc->asoc.primary_destination);
2594                                 if (asoc->asoc.locked_on_sending) {
2595                                         sp = TAILQ_LAST(&((asoc->asoc.locked_on_sending)->outqueue),
2596                                             sctp_streamhead);
2597                                         if (sp == NULL) {
2598                                                 SCTP_PRINTF("Error, sp is NULL, locked on sending is %p strm:%d\n",
2599                                                     asoc->asoc.locked_on_sending,
2600                                                     asoc->asoc.locked_on_sending->stream_no);
2601                                         } else {
2602                                                 if ((sp->length == 0) && (sp->msg_is_complete == 0))
2603                                                         asoc->asoc.state |= SCTP_STATE_PARTIAL_MSG_LEFT;
2604                                         }
2605                                 }
2606                                 if (TAILQ_EMPTY(&asoc->asoc.send_queue) &&
2607                                     TAILQ_EMPTY(&asoc->asoc.sent_queue) &&
2608                                     (asoc->asoc.state & SCTP_STATE_PARTIAL_MSG_LEFT)) {
2609                                         struct mbuf *op_err;
2610
2611                         abort_anyway:
2612                                         op_err = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)),
2613                                             0, M_DONTWAIT, 1, MT_DATA);
2614                                         if (op_err) {
2615                                                 /*
2616                                                  * Fill in the user
2617                                                  * initiated abort
2618                                                  */
2619                                                 struct sctp_paramhdr *ph;
2620                                                 uint32_t *ippp;
2621
2622                                                 SCTP_BUF_LEN(op_err) =
2623                                                     (sizeof(struct sctp_paramhdr) +
2624                                                     sizeof(uint32_t));
2625                                                 ph = mtod(op_err,
2626                                                     struct sctp_paramhdr *);
2627                                                 ph->param_type = htons(
2628                                                     SCTP_CAUSE_USER_INITIATED_ABT);
2629                                                 ph->param_length = htons(SCTP_BUF_LEN(op_err));
2630                                                 ippp = (uint32_t *) (ph + 1);
2631                                                 *ippp = htonl(SCTP_FROM_SCTP_PCB + SCTP_LOC_5);
2632                                         }
2633                                         asoc->sctp_ep->last_abort_code = SCTP_FROM_SCTP_PCB + SCTP_LOC_5;
2634                                         sctp_send_abort_tcb(asoc, op_err);
2635                                         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
2636                                         if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_OPEN) ||
2637                                             (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2638                                                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
2639                                         }
2640                                         sctp_free_assoc(inp, asoc, SCTP_PCBFREE_NOFORCE, SCTP_FROM_SCTP_PCB + SCTP_LOC_6);
2641                                         continue;
2642                                 }
2643                         }
2644                         cnt_in_sd++;
2645                         SCTP_TCB_UNLOCK(asoc);
2646                 }
2647                 /* now is there some left in our SHUTDOWN state? */
2648                 if (cnt_in_sd) {
2649                         SCTP_INP_WUNLOCK(inp);
2650                         SCTP_ASOC_CREATE_UNLOCK(inp);
2651                         SCTP_INP_INFO_WUNLOCK();
2652                         SCTP_ITERATOR_UNLOCK();
2653 #ifdef SCTP_LOG_CLOSING
2654                         sctp_log_closing(inp, NULL, 2);
2655 #endif
2656                         return;
2657                 }
2658         }
2659         inp->sctp_socket = NULL;
2660         if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) !=
2661             SCTP_PCB_FLAGS_UNBOUND) {
2662                 /*
2663                  * ok, this guy has been bound. It's port is somewhere in
2664                  * the sctppcbinfo hash table. Remove it!
2665                  */
2666                 LIST_REMOVE(inp, sctp_hash);
2667                 inp->sctp_flags |= SCTP_PCB_FLAGS_UNBOUND;
2668         }
2669         /*
2670          * If there is a timer running to kill us, forget it, since it may
2671          * have a contest on the INP lock.. which would cause us to die ...
2672          */
2673         cnt = 0;
2674         for ((asoc = LIST_FIRST(&inp->sctp_asoc_list)); asoc != NULL;
2675             asoc = nasoc) {
2676                 nasoc = LIST_NEXT(asoc, sctp_tcblist);
2677                 if (asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
2678                         cnt++;
2679                         continue;
2680                 }
2681                 /* Free associations that are NOT killing us */
2682                 SCTP_TCB_LOCK(asoc);
2683                 if ((SCTP_GET_STATE(&asoc->asoc) != SCTP_STATE_COOKIE_WAIT) &&
2684                     ((asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0)) {
2685                         struct mbuf *op_err;
2686                         uint32_t *ippp;
2687
2688                         op_err = sctp_get_mbuf_for_msg((sizeof(struct sctp_paramhdr) + sizeof(uint32_t)),
2689                             0, M_DONTWAIT, 1, MT_DATA);
2690                         if (op_err) {
2691                                 /* Fill in the user initiated abort */
2692                                 struct sctp_paramhdr *ph;
2693
2694                                 SCTP_BUF_LEN(op_err) = (sizeof(struct sctp_paramhdr) +
2695                                     sizeof(uint32_t));
2696                                 ph = mtod(op_err, struct sctp_paramhdr *);
2697                                 ph->param_type = htons(
2698                                     SCTP_CAUSE_USER_INITIATED_ABT);
2699                                 ph->param_length = htons(SCTP_BUF_LEN(op_err));
2700                                 ippp = (uint32_t *) (ph + 1);
2701                                 *ippp = htonl(SCTP_FROM_SCTP_PCB + SCTP_LOC_7);
2702
2703                         }
2704                         asoc->sctp_ep->last_abort_code = SCTP_FROM_SCTP_PCB + SCTP_LOC_7;
2705                         sctp_send_abort_tcb(asoc, op_err);
2706                         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
2707                 } else if (asoc->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
2708                         cnt++;
2709                         SCTP_TCB_UNLOCK(asoc);
2710                         continue;
2711                 }
2712                 if ((SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_OPEN) ||
2713                     (SCTP_GET_STATE(&asoc->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
2714                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
2715                 }
2716                 sctp_free_assoc(inp, asoc, SCTP_PCBFREE_FORCE, SCTP_FROM_SCTP_PCB + SCTP_LOC_8);
2717         }
2718         if (cnt) {
2719                 /* Ok we have someone out there that will kill us */
2720                 (void)SCTP_OS_TIMER_STOP(&inp->sctp_ep.signature_change.timer);
2721                 SCTP_INP_WUNLOCK(inp);
2722                 SCTP_ASOC_CREATE_UNLOCK(inp);
2723                 SCTP_INP_INFO_WUNLOCK();
2724                 SCTP_ITERATOR_UNLOCK();
2725 #ifdef SCTP_LOG_CLOSING
2726                 sctp_log_closing(inp, NULL, 3);
2727 #endif
2728                 return;
2729         }
2730         if ((inp->refcount) || (inp->sctp_flags & SCTP_PCB_FLAGS_CLOSE_IP)) {
2731                 (void)SCTP_OS_TIMER_STOP(&inp->sctp_ep.signature_change.timer);
2732                 sctp_timer_start(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL);
2733                 SCTP_INP_WUNLOCK(inp);
2734                 SCTP_ASOC_CREATE_UNLOCK(inp);
2735                 SCTP_INP_INFO_WUNLOCK();
2736                 SCTP_ITERATOR_UNLOCK();
2737 #ifdef SCTP_LOG_CLOSING
2738                 sctp_log_closing(inp, NULL, 4);
2739 #endif
2740                 return;
2741         }
2742         (void)SCTP_OS_TIMER_STOP(&inp->sctp_ep.signature_change.timer);
2743         inp->sctp_ep.signature_change.type = 0;
2744         inp->sctp_flags |= SCTP_PCB_FLAGS_SOCKET_ALLGONE;
2745
2746 #ifdef SCTP_LOG_CLOSING
2747         sctp_log_closing(inp, NULL, 5);
2748 #endif
2749
2750         (void)SCTP_OS_TIMER_STOP(&inp->sctp_ep.signature_change.timer);
2751         inp->sctp_ep.signature_change.type = SCTP_TIMER_TYPE_NONE;
2752         /* Clear the read queue */
2753         /* sa_ignore FREED_MEMORY */
2754         while ((sq = TAILQ_FIRST(&inp->read_queue)) != NULL) {
2755                 /* Its only abandoned if it had data left */
2756                 if (sq->length)
2757                         SCTP_STAT_INCR(sctps_left_abandon);
2758
2759                 TAILQ_REMOVE(&inp->read_queue, sq, next);
2760                 sctp_free_remote_addr(sq->whoFrom);
2761                 if (so)
2762                         so->so_rcv.sb_cc -= sq->length;
2763                 if (sq->data) {
2764                         sctp_m_freem(sq->data);
2765                         sq->data = NULL;
2766                 }
2767                 /*
2768                  * no need to free the net count, since at this point all
2769                  * assoc's are gone.
2770                  */
2771                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_readq, sq);
2772                 SCTP_DECR_READQ_COUNT();
2773         }
2774         /* Now the sctp_pcb things */
2775         /*
2776          * free each asoc if it is not already closed/free. we can't use the
2777          * macro here since le_next will get freed as part of the
2778          * sctp_free_assoc() call.
2779          */
2780         cnt = 0;
2781         if (so) {
2782 #ifdef IPSEC
2783                 ipsec4_delete_pcbpolicy(ip_pcb);
2784 #endif                          /* IPSEC */
2785
2786                 /* Unlocks not needed since the socket is gone now */
2787         }
2788         if (ip_pcb->inp_options) {
2789                 (void)sctp_m_free(ip_pcb->inp_options);
2790                 ip_pcb->inp_options = 0;
2791         }
2792         if (ip_pcb->inp_moptions) {
2793                 ip_freemoptions(ip_pcb->inp_moptions);
2794                 ip_pcb->inp_moptions = 0;
2795         }
2796 #ifdef INET6
2797         if (ip_pcb->inp_vflag & INP_IPV6) {
2798                 struct in6pcb *in6p;
2799
2800                 in6p = (struct in6pcb *)inp;
2801                 ip6_freepcbopts(in6p->in6p_outputopts);
2802         }
2803 #endif                          /* INET6 */
2804         ip_pcb->inp_vflag = 0;
2805         /* free up authentication fields */
2806         if (inp->sctp_ep.local_auth_chunks != NULL)
2807                 sctp_free_chunklist(inp->sctp_ep.local_auth_chunks);
2808         if (inp->sctp_ep.local_hmacs != NULL)
2809                 sctp_free_hmaclist(inp->sctp_ep.local_hmacs);
2810
2811         shared_key = LIST_FIRST(&inp->sctp_ep.shared_keys);
2812         while (shared_key) {
2813                 LIST_REMOVE(shared_key, next);
2814                 sctp_free_sharedkey(shared_key);
2815                 /* sa_ignore FREED_MEMORY */
2816                 shared_key = LIST_FIRST(&inp->sctp_ep.shared_keys);
2817         }
2818
2819         inp_save = LIST_NEXT(inp, sctp_list);
2820         LIST_REMOVE(inp, sctp_list);
2821
2822         /* fix any iterators only after out of the list */
2823         sctp_iterator_inp_being_freed(inp, inp_save);
2824         /*
2825          * if we have an address list the following will free the list of
2826          * ifaddr's that are set into this ep. Again macro limitations here,
2827          * since the LIST_FOREACH could be a bad idea.
2828          */
2829         for ((laddr = LIST_FIRST(&inp->sctp_addr_list)); laddr != NULL;
2830             laddr = nladdr) {
2831                 nladdr = LIST_NEXT(laddr, sctp_nxt_addr);
2832                 sctp_remove_laddr(laddr);
2833         }
2834
2835 #ifdef SCTP_TRACK_FREED_ASOCS
2836         /* TEMP CODE */
2837         for ((asoc = LIST_FIRST(&inp->sctp_asoc_free_list)); asoc != NULL;
2838             asoc = nasoc) {
2839                 nasoc = LIST_NEXT(asoc, sctp_tcblist);
2840                 LIST_REMOVE(asoc, sctp_tcblist);
2841                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, asoc);
2842                 SCTP_DECR_ASOC_COUNT();
2843         }
2844         /* *** END TEMP CODE *** */
2845 #endif
2846         /* Now lets see about freeing the EP hash table. */
2847         if (inp->sctp_tcbhash != NULL) {
2848                 SCTP_HASH_FREE(inp->sctp_tcbhash, inp->sctp_hashmark);
2849                 inp->sctp_tcbhash = NULL;
2850         }
2851         /* Now we must put the ep memory back into the zone pool */
2852         SCTP_INP_LOCK_DESTROY(inp);
2853         SCTP_INP_READ_DESTROY(inp);
2854         SCTP_ASOC_CREATE_LOCK_DESTROY(inp);
2855         SCTP_INP_INFO_WUNLOCK();
2856
2857         SCTP_ITERATOR_UNLOCK();
2858
2859         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp);
2860         SCTP_DECR_EP_COUNT();
2861
2862 }
2863
2864
2865 struct sctp_nets *
2866 sctp_findnet(struct sctp_tcb *stcb, struct sockaddr *addr)
2867 {
2868         struct sctp_nets *net;
2869
2870         /* locate the address */
2871         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2872                 if (sctp_cmpaddr(addr, (struct sockaddr *)&net->ro._l_addr))
2873                         return (net);
2874         }
2875         return (NULL);
2876 }
2877
2878
2879 int
2880 sctp_is_address_on_local_host(struct sockaddr *addr, uint32_t vrf_id)
2881 {
2882         struct sctp_ifa *sctp_ifa;
2883
2884         sctp_ifa = sctp_find_ifa_by_addr(addr, vrf_id, 0);
2885         if (sctp_ifa) {
2886                 return (1);
2887         } else {
2888                 return (0);
2889         }
2890 }
2891
2892 void
2893 sctp_set_initial_cc_param(struct sctp_tcb *stcb, struct sctp_nets *net)
2894 {
2895         net->cwnd = min((net->mtu * 4), max((2 * net->mtu), SCTP_INITIAL_CWND));
2896         /* we always get at LEAST 2 MTU's */
2897         if (net->cwnd < (2 * net->mtu)) {
2898                 net->cwnd = 2 * net->mtu;
2899         }
2900         net->ssthresh = stcb->asoc.peers_rwnd;
2901 }
2902
2903
2904
2905 /*
2906  * add's a remote endpoint address, done with the INIT/INIT-ACK as well as
2907  * when a ASCONF arrives that adds it. It will also initialize all the cwnd
2908  * stats of stuff.
2909  */
2910 int
2911 sctp_add_remote_addr(struct sctp_tcb *stcb, struct sockaddr *newaddr,
2912     int set_scope, int from)
2913 {
2914         /*
2915          * The following is redundant to the same lines in the
2916          * sctp_aloc_assoc() but is needed since other's call the add
2917          * address function
2918          */
2919         struct sctp_nets *net, *netfirst;
2920         int addr_inscope;
2921
2922         SCTPDBG(SCTP_DEBUG_PCB1, "Adding an address (from:%d) to the peer: ",
2923             from);
2924         SCTPDBG_ADDR(SCTP_DEBUG_PCB1, newaddr);
2925
2926         netfirst = sctp_findnet(stcb, newaddr);
2927         if (netfirst) {
2928                 /*
2929                  * Lie and return ok, we don't want to make the association
2930                  * go away for this behavior. It will happen in the TCP
2931                  * model in a connected socket. It does not reach the hash
2932                  * table until after the association is built so it can't be
2933                  * found. Mark as reachable, since the initial creation will
2934                  * have been cleared and the NOT_IN_ASSOC flag will have
2935                  * been added... and we don't want to end up removing it
2936                  * back out.
2937                  */
2938                 if (netfirst->dest_state & SCTP_ADDR_UNCONFIRMED) {
2939                         netfirst->dest_state = (SCTP_ADDR_REACHABLE |
2940                             SCTP_ADDR_UNCONFIRMED);
2941                 } else {
2942                         netfirst->dest_state = SCTP_ADDR_REACHABLE;
2943                 }
2944
2945                 return (0);
2946         }
2947         addr_inscope = 1;
2948         if (newaddr->sa_family == AF_INET) {
2949                 struct sockaddr_in *sin;
2950
2951                 sin = (struct sockaddr_in *)newaddr;
2952                 if (sin->sin_addr.s_addr == 0) {
2953                         /* Invalid address */
2954                         return (-1);
2955                 }
2956                 /* zero out the bzero area */
2957                 memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
2958
2959                 /* assure len is set */
2960                 sin->sin_len = sizeof(struct sockaddr_in);
2961                 if (set_scope) {
2962 #ifdef SCTP_DONT_DO_PRIVADDR_SCOPE
2963                         stcb->ipv4_local_scope = 1;
2964 #else
2965                         if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
2966                                 stcb->asoc.ipv4_local_scope = 1;
2967                         }
2968 #endif                          /* SCTP_DONT_DO_PRIVADDR_SCOPE */
2969                 } else {
2970                         /* Validate the address is in scope */
2971                         if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) &&
2972                             (stcb->asoc.ipv4_local_scope == 0)) {
2973                                 addr_inscope = 0;
2974                         }
2975                 }
2976         } else if (newaddr->sa_family == AF_INET6) {
2977                 struct sockaddr_in6 *sin6;
2978
2979                 sin6 = (struct sockaddr_in6 *)newaddr;
2980                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2981                         /* Invalid address */
2982                         return (-1);
2983                 }
2984                 /* assure len is set */
2985                 sin6->sin6_len = sizeof(struct sockaddr_in6);
2986                 if (set_scope) {
2987                         if (sctp_is_address_on_local_host(newaddr, stcb->asoc.vrf_id)) {
2988                                 stcb->asoc.loopback_scope = 1;
2989                                 stcb->asoc.local_scope = 0;
2990                                 stcb->asoc.ipv4_local_scope = 1;
2991                                 stcb->asoc.site_scope = 1;
2992                         } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
2993                                 /*
2994                                  * If the new destination is a LINK_LOCAL we
2995                                  * must have common site scope. Don't set
2996                                  * the local scope since we may not share
2997                                  * all links, only loopback can do this.
2998                                  * Links on the local network would also be
2999                                  * on our private network for v4 too.
3000                                  */
3001                                 stcb->asoc.ipv4_local_scope = 1;
3002                                 stcb->asoc.site_scope = 1;
3003                         } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
3004                                 /*
3005                                  * If the new destination is SITE_LOCAL then
3006                                  * we must have site scope in common.
3007                                  */
3008                                 stcb->asoc.site_scope = 1;
3009                         }
3010                 } else {
3011                         /* Validate the address is in scope */
3012                         if (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr) &&
3013                             (stcb->asoc.loopback_scope == 0)) {
3014                                 addr_inscope = 0;
3015                         } else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) &&
3016                             (stcb->asoc.local_scope == 0)) {
3017                                 addr_inscope = 0;
3018                         } else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr) &&
3019                             (stcb->asoc.site_scope == 0)) {
3020                                 addr_inscope = 0;
3021                         }
3022                 }
3023         } else {
3024                 /* not supported family type */
3025                 return (-1);
3026         }
3027         net = SCTP_ZONE_GET(sctppcbinfo.ipi_zone_net, struct sctp_nets);
3028         if (net == NULL) {
3029                 return (-1);
3030         }
3031         SCTP_INCR_RADDR_COUNT();
3032         bzero(net, sizeof(*net));
3033         (void)SCTP_GETTIME_TIMEVAL(&net->start_time);
3034         memcpy(&net->ro._l_addr, newaddr, newaddr->sa_len);
3035         if (newaddr->sa_family == AF_INET) {
3036                 ((struct sockaddr_in *)&net->ro._l_addr)->sin_port = stcb->rport;
3037         } else if (newaddr->sa_family == AF_INET6) {
3038                 ((struct sockaddr_in6 *)&net->ro._l_addr)->sin6_port = stcb->rport;
3039         }
3040         net->addr_is_local = sctp_is_address_on_local_host(newaddr, stcb->asoc.vrf_id);
3041         if (net->addr_is_local && ((set_scope || (from == SCTP_ADDR_IS_CONFIRMED)))) {
3042                 stcb->asoc.loopback_scope = 1;
3043                 stcb->asoc.ipv4_local_scope = 1;
3044                 stcb->asoc.local_scope = 0;
3045                 stcb->asoc.site_scope = 1;
3046                 addr_inscope = 1;
3047         }
3048         net->failure_threshold = stcb->asoc.def_net_failure;
3049         if (addr_inscope == 0) {
3050                 net->dest_state = (SCTP_ADDR_REACHABLE |
3051                     SCTP_ADDR_OUT_OF_SCOPE);
3052         } else {
3053                 if (from == SCTP_ADDR_IS_CONFIRMED)
3054                         /* SCTP_ADDR_IS_CONFIRMED is passed by connect_x */
3055                         net->dest_state = SCTP_ADDR_REACHABLE;
3056                 else
3057                         net->dest_state = SCTP_ADDR_REACHABLE |
3058                             SCTP_ADDR_UNCONFIRMED;
3059         }
3060         net->RTO = stcb->asoc.initial_rto;
3061         stcb->asoc.numnets++;
3062         *(&net->ref_count) = 1;
3063         net->tos_flowlabel = 0;
3064 #ifdef INET
3065         if (newaddr->sa_family == AF_INET)
3066                 net->tos_flowlabel = stcb->asoc.default_tos;
3067 #endif
3068 #ifdef INET6
3069         if (newaddr->sa_family == AF_INET6)
3070                 net->tos_flowlabel = stcb->asoc.default_flowlabel;
3071 #endif
3072         /* Init the timer structure */
3073         SCTP_OS_TIMER_INIT(&net->rxt_timer.timer);
3074         SCTP_OS_TIMER_INIT(&net->fr_timer.timer);
3075         SCTP_OS_TIMER_INIT(&net->pmtu_timer.timer);
3076
3077         /* Now generate a route for this guy */
3078         /* KAME hack: embed scopeid */
3079         if (newaddr->sa_family == AF_INET6) {
3080                 struct sockaddr_in6 *sin6;
3081
3082                 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
3083                 (void)sa6_embedscope(sin6, ip6_use_defzone);
3084                 sin6->sin6_scope_id = 0;
3085         }
3086         SCTP_RTALLOC((sctp_route_t *) & net->ro, stcb->asoc.vrf_id,
3087             stcb->asoc.table_id);
3088
3089         if (newaddr->sa_family == AF_INET6) {
3090                 struct sockaddr_in6 *sin6;
3091
3092                 sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
3093                 (void)sa6_recoverscope(sin6);
3094         }
3095         if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro)) {
3096                 /* Get source address */
3097                 net->ro._s_addr = sctp_source_address_selection(stcb->sctp_ep,
3098                     stcb,
3099                     (sctp_route_t *) & net->ro,
3100                     net,
3101                     0,
3102                     stcb->asoc.vrf_id);
3103                 /* Now get the interface MTU */
3104                 if (net->ro._s_addr && net->ro._s_addr->ifn_p) {
3105                         net->mtu = SCTP_GATHER_MTU_FROM_INTFC(net->ro._s_addr->ifn_p);
3106                 } else {
3107                         net->mtu = 0;
3108                 }
3109 #ifdef SCTP_PRINT_FOR_B_AND_M
3110                 SCTP_PRINTF("We have found an interface mtu of %d\n", net->mtu);
3111 #endif
3112                 if (net->mtu == 0) {
3113                         /* Huh ?? */
3114                         net->mtu = SCTP_DEFAULT_MTU;
3115                 } else {
3116                         uint32_t rmtu;
3117
3118                         rmtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, net->ro.ro_rt);
3119 #ifdef SCTP_PRINT_FOR_B_AND_M
3120                         SCTP_PRINTF("The route mtu is %d\n", rmtu);
3121 #endif
3122                         if (rmtu == 0) {
3123                                 /*
3124                                  * Start things off to match mtu of
3125                                  * interface please.
3126                                  */
3127                                 SCTP_SET_MTU_OF_ROUTE(&net->ro._l_addr.sa,
3128                                     net->ro.ro_rt, net->mtu);
3129                         } else {
3130                                 /*
3131                                  * we take the route mtu over the interface,
3132                                  * since the route may be leading out the
3133                                  * loopback, or a different interface.
3134                                  */
3135                                 net->mtu = rmtu;
3136                         }
3137                 }
3138                 if (from == SCTP_ALLOC_ASOC) {
3139 #ifdef SCTP_PRINT_FOR_B_AND_M
3140                         SCTP_PRINTF("New assoc sets mtu to :%d\n", net->mtu);
3141 #endif
3142                         stcb->asoc.smallest_mtu = net->mtu;
3143                 }
3144         } else {
3145                 net->mtu = stcb->asoc.smallest_mtu;
3146         }
3147         if (stcb->asoc.smallest_mtu > net->mtu) {
3148 #ifdef SCTP_PRINT_FOR_B_AND_M
3149                 SCTP_PRINTF("new address mtu:%d smaller than smallest:%d\n",
3150                     net->mtu, stcb->asoc.smallest_mtu);
3151 #endif
3152                 stcb->asoc.smallest_mtu = net->mtu;
3153         }
3154         /*
3155          * We take the max of the burst limit times a MTU or the
3156          * INITIAL_CWND. We then limit this to 4 MTU's of sending.
3157          */
3158         sctp_set_initial_cc_param(stcb, net);
3159
3160
3161 #if defined(SCTP_CWND_MONITOR) || defined(SCTP_CWND_LOGGING)
3162         sctp_log_cwnd(stcb, net, 0, SCTP_CWND_INITIALIZATION);
3163 #endif
3164
3165         /*
3166          * CMT: CUC algo - set find_pseudo_cumack to TRUE (1) at beginning
3167          * of assoc (2005/06/27, iyengar@cis.udel.edu)
3168          */
3169         net->find_pseudo_cumack = 1;
3170         net->find_rtx_pseudo_cumack = 1;
3171         net->src_addr_selected = 0;
3172         netfirst = TAILQ_FIRST(&stcb->asoc.nets);
3173         if (net->ro.ro_rt == NULL) {
3174                 /* Since we have no route put it at the back */
3175                 TAILQ_INSERT_TAIL(&stcb->asoc.nets, net, sctp_next);
3176         } else if (netfirst == NULL) {
3177                 /* We are the first one in the pool. */
3178                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
3179         } else if (netfirst->ro.ro_rt == NULL) {
3180                 /*
3181                  * First one has NO route. Place this one ahead of the first
3182                  * one.
3183                  */
3184                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
3185         } else if (net->ro.ro_rt->rt_ifp != netfirst->ro.ro_rt->rt_ifp) {
3186                 /*
3187                  * This one has a different interface than the one at the
3188                  * top of the list. Place it ahead.
3189                  */
3190                 TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
3191         } else {
3192                 /*
3193                  * Ok we have the same interface as the first one. Move
3194                  * forward until we find either a) one with a NULL route...
3195                  * insert ahead of that b) one with a different ifp.. insert
3196                  * after that. c) end of the list.. insert at the tail.
3197                  */
3198                 struct sctp_nets *netlook;
3199
3200                 do {
3201                         netlook = TAILQ_NEXT(netfirst, sctp_next);
3202                         if (netlook == NULL) {
3203                                 /* End of the list */
3204                                 TAILQ_INSERT_TAIL(&stcb->asoc.nets, net, sctp_next);
3205                                 break;
3206                         } else if (netlook->ro.ro_rt == NULL) {
3207                                 /* next one has NO route */
3208                                 TAILQ_INSERT_BEFORE(netfirst, net, sctp_next);
3209                                 break;
3210                         } else if (netlook->ro.ro_rt->rt_ifp != net->ro.ro_rt->rt_ifp) {
3211                                 TAILQ_INSERT_AFTER(&stcb->asoc.nets, netlook,
3212                                     net, sctp_next);
3213                                 break;
3214                         }
3215                         /* Shift forward */
3216                         netfirst = netlook;
3217                 } while (netlook != NULL);
3218         }
3219
3220         /* got to have a primary set */
3221         if (stcb->asoc.primary_destination == 0) {
3222                 stcb->asoc.primary_destination = net;
3223         } else if ((stcb->asoc.primary_destination->ro.ro_rt == NULL) &&
3224                     (net->ro.ro_rt) &&
3225             ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0)) {
3226                 /* No route to current primary adopt new primary */
3227                 stcb->asoc.primary_destination = net;
3228         }
3229         sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, stcb->sctp_ep, stcb,
3230             net);
3231         /* Validate primary is first */
3232         net = TAILQ_FIRST(&stcb->asoc.nets);
3233         if ((net != stcb->asoc.primary_destination) &&
3234             (stcb->asoc.primary_destination)) {
3235                 /*
3236                  * first one on the list is NOT the primary sctp_cmpaddr()
3237                  * is much more efficent if the primary is the first on the
3238                  * list, make it so.
3239                  */
3240                 TAILQ_REMOVE(&stcb->asoc.nets,
3241                     stcb->asoc.primary_destination, sctp_next);
3242                 TAILQ_INSERT_HEAD(&stcb->asoc.nets,
3243                     stcb->asoc.primary_destination, sctp_next);
3244         }
3245         return (0);
3246 }
3247
3248
3249 /*
3250  * allocate an association and add it to the endpoint. The caller must be
3251  * careful to add all additional addresses once they are know right away or
3252  * else the assoc will be may experience a blackout scenario.
3253  */
3254 struct sctp_tcb *
3255 sctp_aloc_assoc(struct sctp_inpcb *inp, struct sockaddr *firstaddr,
3256     int for_a_init, int *error, uint32_t override_tag, uint32_t vrf_id)
3257 {
3258         struct sctp_tcb *stcb;
3259         struct sctp_association *asoc;
3260         struct sctpasochead *head;
3261         uint16_t rport;
3262         int err;
3263
3264         /*
3265          * Assumption made here: Caller has done a
3266          * sctp_findassociation_ep_addr(ep, addr's); to make sure the
3267          * address does not exist already.
3268          */
3269         if (sctppcbinfo.ipi_count_asoc >= SCTP_MAX_NUM_OF_ASOC) {
3270                 /* Hit max assoc, sorry no more */
3271                 *error = ENOBUFS;
3272                 return (NULL);
3273         }
3274         if (firstaddr == NULL) {
3275                 *error = EINVAL;
3276                 return (NULL);
3277         }
3278         SCTP_INP_RLOCK(inp);
3279         if (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) {
3280                 /*
3281                  * If its in the TCP pool, its NOT allowed to create an
3282                  * association. The parent listener needs to call
3283                  * sctp_aloc_assoc.. or the one-2-many socket. If a peeled
3284                  * off, or connected one does this.. its an error.
3285                  */
3286                 SCTP_INP_RUNLOCK(inp);
3287                 *error = EINVAL;
3288                 return (NULL);
3289         }
3290         SCTPDBG(SCTP_DEBUG_PCB3, "Allocate an association for peer:");
3291 #ifdef SCTP_DEBUG
3292         if (firstaddr) {
3293                 SCTPDBG_ADDR(SCTP_DEBUG_PCB3, firstaddr);
3294                 SCTPDBG(SCTP_DEBUG_PCB3, "Port:%d\n",
3295                     ntohs(((struct sockaddr_in *)firstaddr)->sin_port));
3296         } else {
3297                 SCTPDBG(SCTP_DEBUG_PCB3, "None\n");
3298         }
3299 #endif                          /* SCTP_DEBUG */
3300         if (firstaddr->sa_family == AF_INET) {
3301                 struct sockaddr_in *sin;
3302
3303                 sin = (struct sockaddr_in *)firstaddr;
3304                 if ((sin->sin_port == 0) || (sin->sin_addr.s_addr == 0)) {
3305                         /* Invalid address */
3306                         SCTP_INP_RUNLOCK(inp);
3307                         *error = EINVAL;
3308                         return (NULL);
3309                 }
3310                 rport = sin->sin_port;
3311         } else if (firstaddr->sa_family == AF_INET6) {
3312                 struct sockaddr_in6 *sin6;
3313
3314                 sin6 = (struct sockaddr_in6 *)firstaddr;
3315                 if ((sin6->sin6_port == 0) ||
3316                     (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))) {
3317                         /* Invalid address */
3318                         SCTP_INP_RUNLOCK(inp);
3319                         *error = EINVAL;
3320                         return (NULL);
3321                 }
3322                 rport = sin6->sin6_port;
3323         } else {
3324                 /* not supported family type */
3325                 SCTP_INP_RUNLOCK(inp);
3326                 *error = EINVAL;
3327                 return (NULL);
3328         }
3329         SCTP_INP_RUNLOCK(inp);
3330         if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
3331                 /*
3332                  * If you have not performed a bind, then we need to do the
3333                  * ephemerial bind for you.
3334                  */
3335                 if ((err = sctp_inpcb_bind(inp->sctp_socket,
3336                     (struct sockaddr *)NULL,
3337                     (struct thread *)NULL
3338                     ))) {
3339                         /* bind error, probably perm */
3340                         *error = err;
3341                         return (NULL);
3342                 }
3343         }
3344         stcb = SCTP_ZONE_GET(sctppcbinfo.ipi_zone_asoc, struct sctp_tcb);
3345         if (stcb == NULL) {
3346                 /* out of memory? */
3347                 *error = ENOMEM;
3348                 return (NULL);
3349         }
3350         SCTP_INCR_ASOC_COUNT();
3351
3352         bzero(stcb, sizeof(*stcb));
3353         asoc = &stcb->asoc;
3354         SCTP_TCB_LOCK_INIT(stcb);
3355         SCTP_TCB_SEND_LOCK_INIT(stcb);
3356         /* setup back pointer's */
3357         stcb->sctp_ep = inp;
3358         stcb->sctp_socket = inp->sctp_socket;
3359         if ((err = sctp_init_asoc(inp, asoc, for_a_init, override_tag, vrf_id))) {
3360                 /* failed */
3361                 SCTP_TCB_LOCK_DESTROY(stcb);
3362                 SCTP_TCB_SEND_LOCK_DESTROY(stcb);
3363                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb);
3364                 SCTP_DECR_ASOC_COUNT();
3365                 *error = err;
3366                 return (NULL);
3367         }
3368         /* and the port */
3369         stcb->rport = rport;
3370         SCTP_INP_INFO_WLOCK();
3371         SCTP_INP_WLOCK(inp);
3372         if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE | SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
3373                 /* inpcb freed while alloc going on */
3374                 SCTP_TCB_LOCK_DESTROY(stcb);
3375                 SCTP_TCB_SEND_LOCK_DESTROY(stcb);
3376                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb);
3377                 SCTP_INP_WUNLOCK(inp);
3378                 SCTP_INP_INFO_WUNLOCK();
3379                 SCTP_DECR_ASOC_COUNT();
3380                 *error = EINVAL;
3381                 return (NULL);
3382         }
3383         SCTP_TCB_LOCK(stcb);
3384
3385         /* now that my_vtag is set, add it to the hash */
3386         head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag,
3387             sctppcbinfo.hashasocmark)];
3388         /* put it in the bucket in the vtag hash of assoc's for the system */
3389         LIST_INSERT_HEAD(head, stcb, sctp_asocs);
3390         SCTP_INP_INFO_WUNLOCK();
3391
3392         if ((err = sctp_add_remote_addr(stcb, firstaddr, SCTP_DO_SETSCOPE, SCTP_ALLOC_ASOC))) {
3393                 /* failure.. memory error? */
3394                 if (asoc->strmout)
3395                         SCTP_FREE(asoc->strmout);
3396                 if (asoc->mapping_array)
3397                         SCTP_FREE(asoc->mapping_array);
3398
3399                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb);
3400                 SCTP_DECR_ASOC_COUNT();
3401                 SCTP_TCB_LOCK_DESTROY(stcb);
3402                 SCTP_TCB_SEND_LOCK_DESTROY(stcb);
3403                 SCTP_INP_WUNLOCK(inp);
3404                 *error = ENOBUFS;
3405                 return (NULL);
3406         }
3407         /* Init all the timers */
3408         SCTP_OS_TIMER_INIT(&asoc->hb_timer.timer);
3409         SCTP_OS_TIMER_INIT(&asoc->dack_timer.timer);
3410         SCTP_OS_TIMER_INIT(&asoc->strreset_timer.timer);
3411         SCTP_OS_TIMER_INIT(&asoc->asconf_timer.timer);
3412         SCTP_OS_TIMER_INIT(&asoc->shut_guard_timer.timer);
3413         SCTP_OS_TIMER_INIT(&asoc->autoclose_timer.timer);
3414         SCTP_OS_TIMER_INIT(&asoc->delayed_event_timer.timer);
3415
3416         LIST_INSERT_HEAD(&inp->sctp_asoc_list, stcb, sctp_tcblist);
3417         /* now file the port under the hash as well */
3418         if (inp->sctp_tcbhash != NULL) {
3419                 head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(stcb->rport,
3420                     inp->sctp_hashmark)];
3421                 LIST_INSERT_HEAD(head, stcb, sctp_tcbhash);
3422         }
3423         SCTP_INP_WUNLOCK(inp);
3424         SCTPDBG(SCTP_DEBUG_PCB1, "Association %p now allocated\n", stcb);
3425         return (stcb);
3426 }
3427
3428
3429 void
3430 sctp_remove_net(struct sctp_tcb *stcb, struct sctp_nets *net)
3431 {
3432         struct sctp_association *asoc;
3433
3434         asoc = &stcb->asoc;
3435         asoc->numnets--;
3436         TAILQ_REMOVE(&asoc->nets, net, sctp_next);
3437         if (net == asoc->primary_destination) {
3438                 /* Reset primary */
3439                 struct sctp_nets *lnet;
3440
3441                 lnet = TAILQ_FIRST(&asoc->nets);
3442                 /* Try to find a confirmed primary */
3443                 asoc->primary_destination = sctp_find_alternate_net(stcb, lnet, 0);
3444         }
3445         if (net == asoc->last_data_chunk_from) {
3446                 /* Reset primary */
3447                 asoc->last_data_chunk_from = TAILQ_FIRST(&asoc->nets);
3448         }
3449         if (net == asoc->last_control_chunk_from) {
3450                 /* Clear net */
3451                 asoc->last_control_chunk_from = NULL;
3452         }
3453         sctp_free_remote_addr(net);
3454 }
3455
3456 /*
3457  * remove a remote endpoint address from an association, it will fail if the
3458  * address does not exist.
3459  */
3460 int
3461 sctp_del_remote_addr(struct sctp_tcb *stcb, struct sockaddr *remaddr)
3462 {
3463         /*
3464          * Here we need to remove a remote address. This is quite simple, we
3465          * first find it in the list of address for the association
3466          * (tasoc->asoc.nets) and then if it is there, we do a LIST_REMOVE
3467          * on that item. Note we do not allow it to be removed if there are
3468          * no other addresses.
3469          */
3470         struct sctp_association *asoc;
3471         struct sctp_nets *net, *net_tmp;
3472
3473         asoc = &stcb->asoc;
3474
3475         /* locate the address */
3476         for (net = TAILQ_FIRST(&asoc->nets); net != NULL; net = net_tmp) {
3477                 net_tmp = TAILQ_NEXT(net, sctp_next);
3478                 if (net->ro._l_addr.sa.sa_family != remaddr->sa_family) {
3479                         continue;
3480                 }
3481                 if (sctp_cmpaddr((struct sockaddr *)&net->ro._l_addr,
3482                     remaddr)) {
3483                         /* we found the guy */
3484                         if (asoc->numnets < 2) {
3485                                 /* Must have at LEAST two remote addresses */
3486                                 return (-1);
3487                         } else {
3488                                 sctp_remove_net(stcb, net);
3489                                 return (0);
3490                         }
3491                 }
3492         }
3493         /* not found. */
3494         return (-2);
3495 }
3496
3497
3498 void
3499 sctp_add_vtag_to_timewait(struct sctp_inpcb *inp, uint32_t tag, uint32_t time)
3500 {
3501         struct sctpvtaghead *chain;
3502         struct sctp_tagblock *twait_block;
3503         struct timeval now;
3504         int set, i;
3505
3506         (void)SCTP_GETTIME_TIMEVAL(&now);
3507         chain = &sctppcbinfo.vtag_timewait[(tag % SCTP_STACK_VTAG_HASH_SIZE)];
3508         set = 0;
3509         if (!SCTP_LIST_EMPTY(chain)) {
3510                 /* Block(s) present, lets find space, and expire on the fly */
3511                 LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) {
3512                         for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) {
3513                                 if ((twait_block->vtag_block[i].v_tag == 0) &&
3514                                     !set) {
3515                                         twait_block->vtag_block[i].tv_sec_at_expire =
3516                                             now.tv_sec + time;
3517                                         twait_block->vtag_block[i].v_tag = tag;
3518                                         set = 1;
3519                                 } else if ((twait_block->vtag_block[i].v_tag) &&
3520                                             ((long)twait_block->vtag_block[i].tv_sec_at_expire >
3521                                     now.tv_sec)) {
3522                                         /* Audit expires this guy */
3523                                         twait_block->vtag_block[i].tv_sec_at_expire = 0;
3524                                         twait_block->vtag_block[i].v_tag = 0;
3525                                         if (set == 0) {
3526                                                 /* Reuse it for my new tag */
3527                                                 twait_block->vtag_block[0].tv_sec_at_expire = now.tv_sec + SCTP_TIME_WAIT;
3528                                                 twait_block->vtag_block[0].v_tag = tag;
3529                                                 set = 1;
3530                                         }
3531                                 }
3532                         }
3533                         if (set) {
3534                                 /*
3535                                  * We only do up to the block where we can
3536                                  * place our tag for audits
3537                                  */
3538                                 break;
3539                         }
3540                 }
3541         }
3542         /* Need to add a new block to chain */
3543         if (!set) {
3544                 SCTP_MALLOC(twait_block, struct sctp_tagblock *,
3545                     sizeof(struct sctp_tagblock), "TimeWait");
3546                 if (twait_block == NULL) {
3547                         return;
3548                 }
3549                 memset(twait_block, 0, sizeof(struct sctp_tagblock));
3550                 LIST_INSERT_HEAD(chain, twait_block, sctp_nxt_tagblock);
3551                 twait_block->vtag_block[0].tv_sec_at_expire = now.tv_sec +
3552                     SCTP_TIME_WAIT;
3553                 twait_block->vtag_block[0].v_tag = tag;
3554         }
3555 }
3556
3557
3558 static void
3559 sctp_iterator_asoc_being_freed(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
3560 {
3561         struct sctp_iterator *it;
3562
3563         /*
3564          * Unlock the tcb lock we do this so we avoid a dead lock scenario
3565          * where the iterator is waiting on the TCB lock and the TCB lock is
3566          * waiting on the iterator lock.
3567          */
3568         it = stcb->asoc.stcb_starting_point_for_iterator;
3569         if (it == NULL) {
3570                 return;
3571         }
3572         if (it->inp != stcb->sctp_ep) {
3573                 /* hmm, focused on the wrong one? */
3574                 return;
3575         }
3576         if (it->stcb != stcb) {
3577                 return;
3578         }
3579         it->stcb = LIST_NEXT(stcb, sctp_tcblist);
3580         if (it->stcb == NULL) {
3581                 /* done with all asoc's in this assoc */
3582                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
3583                         it->inp = NULL;
3584                 } else {
3585                         it->inp = LIST_NEXT(inp, sctp_list);
3586                 }
3587         }
3588 }
3589
3590
3591 /*
3592  * Free the association after un-hashing the remote port.
3593  */
3594 int
3595 sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfree, int from_location)
3596 {
3597         int i;
3598         struct sctp_association *asoc;
3599         struct sctp_nets *net, *prev;
3600         struct sctp_laddr *laddr;
3601         struct sctp_tmit_chunk *chk;
3602         struct sctp_asconf_addr *aparam;
3603         struct sctp_stream_reset_list *liste;
3604         struct sctp_queued_to_read *sq;
3605         struct sctp_stream_queue_pending *sp;
3606         sctp_sharedkey_t *shared_key;
3607         struct socket *so;
3608         int ccnt = 0;
3609         int cnt = 0;
3610
3611         /* first, lets purge the entry from the hash table. */
3612
3613 #ifdef SCTP_LOG_CLOSING
3614         sctp_log_closing(inp, stcb, 6);
3615 #endif
3616         if (stcb->asoc.state == 0) {
3617 #ifdef SCTP_LOG_CLOSING
3618                 sctp_log_closing(inp, NULL, 7);
3619 #endif
3620                 /* there is no asoc, really TSNH :-0 */
3621                 return (1);
3622         }
3623         /* TEMP CODE */
3624         if (stcb->freed_from_where == 0) {
3625                 /* Only record the first place free happened from */
3626                 stcb->freed_from_where = from_location;
3627         }
3628         /* TEMP CODE */
3629
3630         asoc = &stcb->asoc;
3631         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3632             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE))
3633                 /* nothing around */
3634                 so = NULL;
3635         else
3636                 so = inp->sctp_socket;
3637
3638         /*
3639          * We used timer based freeing if a reader or writer is in the way.
3640          * So we first check if we are actually being called from a timer,
3641          * if so we abort early if a reader or writer is still in the way.
3642          */
3643         if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) &&
3644             (from_inpcbfree == SCTP_NORMAL_PROC)) {
3645                 /*
3646                  * is it the timer driving us? if so are the reader/writers
3647                  * gone?
3648                  */
3649                 if (stcb->asoc.refcnt) {
3650                         /* nope, reader or writer in the way */
3651                         sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
3652                         /* no asoc destroyed */
3653                         SCTP_TCB_UNLOCK(stcb);
3654 #ifdef SCTP_LOG_CLOSING
3655                         sctp_log_closing(inp, stcb, 8);
3656 #endif
3657                         return (0);
3658                 }
3659         }
3660         /* now clean up any other timers */
3661         (void)SCTP_OS_TIMER_STOP(&asoc->hb_timer.timer);
3662         asoc->hb_timer.self = NULL;
3663         (void)SCTP_OS_TIMER_STOP(&asoc->dack_timer.timer);
3664         asoc->dack_timer.self = NULL;
3665         (void)SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
3666         /*-
3667          * For stream reset we don't blast this unless
3668          * it is a str-reset timer, it might be the
3669          * free-asoc timer which we DON'T want to
3670          * disturb.
3671          */
3672         if (asoc->strreset_timer.type == SCTP_TIMER_TYPE_STRRESET)
3673                 asoc->strreset_timer.self = NULL;
3674         (void)SCTP_OS_TIMER_STOP(&asoc->asconf_timer.timer);
3675         asoc->asconf_timer.self = NULL;
3676         (void)SCTP_OS_TIMER_STOP(&asoc->autoclose_timer.timer);
3677         asoc->autoclose_timer.self = NULL;
3678         (void)SCTP_OS_TIMER_STOP(&asoc->shut_guard_timer.timer);
3679         asoc->shut_guard_timer.self = NULL;
3680         (void)SCTP_OS_TIMER_STOP(&asoc->delayed_event_timer.timer);
3681         asoc->delayed_event_timer.self = NULL;
3682         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3683                 (void)SCTP_OS_TIMER_STOP(&net->fr_timer.timer);
3684                 net->fr_timer.self = NULL;
3685                 (void)SCTP_OS_TIMER_STOP(&net->rxt_timer.timer);
3686                 net->rxt_timer.self = NULL;
3687                 (void)SCTP_OS_TIMER_STOP(&net->pmtu_timer.timer);
3688                 net->pmtu_timer.self = NULL;
3689         }
3690         /* Now the read queue needs to be cleaned up (only once) */
3691         cnt = 0;
3692         if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0) {
3693                 stcb->asoc.state |= SCTP_STATE_ABOUT_TO_BE_FREED;
3694                 SCTP_INP_READ_LOCK(inp);
3695                 TAILQ_FOREACH(sq, &inp->read_queue, next) {
3696                         if (sq->stcb == stcb) {
3697                                 sq->do_not_ref_stcb = 1;
3698                                 sq->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
3699                                 /*
3700                                  * If there is no end, there never will be
3701                                  * now.
3702                                  */
3703                                 if (sq->end_added == 0) {
3704                                         /* Held for PD-API clear that. */
3705                                         sq->pdapi_aborted = 1;
3706                                         sq->held_length = 0;
3707                                         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_PDAPIEVNT)) {
3708                                                 /*
3709                                                  * Need to add a PD-API
3710                                                  * aborted indication.
3711                                                  * Setting the control_pdapi
3712                                                  * assures that it will be
3713                                                  * added right after this
3714                                                  * msg.
3715                                                  */
3716                                                 uint32_t strseq;
3717
3718                                                 stcb->asoc.control_pdapi = sq;
3719                                                 strseq = (sq->sinfo_stream << 16) | sq->sinfo_ssn;
3720                                                 sctp_notify_partial_delivery_indication(stcb,
3721                                                     SCTP_PARTIAL_DELIVERY_ABORTED, 1, strseq);
3722                                                 stcb->asoc.control_pdapi = NULL;
3723                                         }
3724                                 }
3725                                 /* Add an end to wake them */
3726                                 sq->end_added = 1;
3727                                 cnt++;
3728                         }
3729                 }
3730                 SCTP_INP_READ_UNLOCK(inp);
3731                 if (stcb->block_entry) {
3732                         cnt++;
3733                         stcb->block_entry->error = ECONNRESET;
3734                         stcb->block_entry = NULL;
3735                 }
3736         }
3737         if ((from_inpcbfree != SCTP_PCBFREE_FORCE) && (stcb->asoc.refcnt)) {
3738                 /*
3739                  * reader or writer in the way, we have hopefully given him
3740                  * something to chew on above.
3741                  */
3742                 sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
3743                 SCTP_TCB_UNLOCK(stcb);
3744                 if (so) {
3745                         SCTP_INP_RLOCK(inp);
3746                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3747                             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE))
3748                                 /* nothing around */
3749                                 so = NULL;
3750                         if (so) {
3751                                 /* Wake any reader/writers */
3752                                 sctp_sorwakeup(inp, so);
3753                                 sctp_sowwakeup(inp, so);
3754                         }
3755                         SCTP_INP_RUNLOCK(inp);
3756
3757                 }
3758 #ifdef SCTP_LOG_CLOSING
3759                 sctp_log_closing(inp, stcb, 9);
3760 #endif
3761                 /* no asoc destroyed */
3762                 return (0);
3763         }
3764 #ifdef SCTP_LOG_CLOSING
3765         sctp_log_closing(inp, stcb, 10);
3766 #endif
3767         /*
3768          * When I reach here, no others want to kill the assoc yet.. and I
3769          * own the lock. Now its possible an abort comes in when I do the
3770          * lock exchange below to grab all the locks to do the final take
3771          * out. to prevent this we increment the count, which will start a
3772          * timer and blow out above thus assuring us that we hold exclusive
3773          * killing of the asoc. Note that after getting back the TCB lock we
3774          * will go ahead and increment the counter back up and stop any
3775          * timer a passing stranger may have started :-S
3776          */
3777         if (from_inpcbfree == SCTP_NORMAL_PROC) {
3778                 atomic_add_int(&stcb->asoc.refcnt, 1);
3779
3780                 SCTP_TCB_UNLOCK(stcb);
3781
3782                 SCTP_ITERATOR_LOCK();
3783                 SCTP_INP_INFO_WLOCK();
3784                 SCTP_INP_WLOCK(inp);
3785                 SCTP_TCB_LOCK(stcb);
3786         }
3787         /* Double check the GONE flag */
3788         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3789             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE))
3790                 /* nothing around */
3791                 so = NULL;
3792
3793         if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3794             (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
3795                 /*
3796                  * For TCP type we need special handling when we are
3797                  * connected. We also include the peel'ed off ones to.
3798                  */
3799                 if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
3800                         inp->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED;
3801                         inp->sctp_flags |= SCTP_PCB_FLAGS_WAS_CONNECTED;
3802                         if (so) {
3803                                 SOCK_LOCK(so);
3804                                 if (so->so_rcv.sb_cc == 0) {
3805                                         so->so_state &= ~(SS_ISCONNECTING |
3806                                             SS_ISDISCONNECTING |
3807                                             SS_ISCONFIRMING |
3808                                             SS_ISCONNECTED);
3809                                 }
3810                                 SOCK_UNLOCK(so);
3811                                 sctp_sowwakeup(inp, so);
3812                                 sctp_sorwakeup(inp, so);
3813                                 SCTP_SOWAKEUP(so);
3814                         }
3815                 }
3816         }
3817         /*
3818          * Make it invalid too, that way if its about to run it will abort
3819          * and return.
3820          */
3821         sctp_iterator_asoc_being_freed(inp, stcb);
3822         /* re-increment the lock */
3823         if (from_inpcbfree == SCTP_NORMAL_PROC) {
3824                 atomic_add_int(&stcb->asoc.refcnt, -1);
3825         }
3826         asoc->state = 0;
3827         if (inp->sctp_tcbhash) {
3828                 LIST_REMOVE(stcb, sctp_tcbhash);
3829         }
3830         if (stcb->asoc.in_restart_hash) {
3831                 LIST_REMOVE(stcb, sctp_tcbrestarhash);
3832         }
3833         /* Now lets remove it from the list of ALL associations in the EP */
3834         LIST_REMOVE(stcb, sctp_tcblist);
3835         if (from_inpcbfree == SCTP_NORMAL_PROC) {
3836                 SCTP_INP_INCR_REF(inp);
3837                 SCTP_INP_WUNLOCK(inp);
3838                 SCTP_ITERATOR_UNLOCK();
3839         }
3840         /* pull from vtag hash */
3841         LIST_REMOVE(stcb, sctp_asocs);
3842         sctp_add_vtag_to_timewait(inp, asoc->my_vtag, SCTP_TIME_WAIT);
3843
3844
3845         /*
3846          * Now restop the timers to be sure - this is paranoia at is finest!
3847          */
3848         (void)SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
3849         (void)SCTP_OS_TIMER_STOP(&asoc->hb_timer.timer);
3850         (void)SCTP_OS_TIMER_STOP(&asoc->dack_timer.timer);
3851         (void)SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
3852         (void)SCTP_OS_TIMER_STOP(&asoc->asconf_timer.timer);
3853         (void)SCTP_OS_TIMER_STOP(&asoc->shut_guard_timer.timer);
3854         (void)SCTP_OS_TIMER_STOP(&asoc->autoclose_timer.timer);
3855         (void)SCTP_OS_TIMER_STOP(&asoc->delayed_event_timer.timer);
3856
3857         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
3858                 (void)SCTP_OS_TIMER_STOP(&net->fr_timer.timer);
3859                 (void)SCTP_OS_TIMER_STOP(&net->rxt_timer.timer);
3860                 (void)SCTP_OS_TIMER_STOP(&net->pmtu_timer.timer);
3861         }
3862
3863         asoc->strreset_timer.type = SCTP_TIMER_TYPE_NONE;
3864         prev = NULL;
3865         /*
3866          * The chunk lists and such SHOULD be empty but we check them just
3867          * in case.
3868          */
3869         /* anything on the wheel needs to be removed */
3870         for (i = 0; i < asoc->streamoutcnt; i++) {
3871                 struct sctp_stream_out *outs;
3872
3873                 outs = &asoc->strmout[i];
3874                 /* now clean up any chunks here */
3875                 sp = TAILQ_FIRST(&outs->outqueue);
3876                 while (sp) {
3877                         TAILQ_REMOVE(&outs->outqueue, sp, next);
3878                         if (sp->data) {
3879                                 sctp_m_freem(sp->data);
3880                                 sp->data = NULL;
3881                                 sp->tail_mbuf = NULL;
3882                         }
3883                         sctp_free_remote_addr(sp->net);
3884                         sctp_free_spbufspace(stcb, asoc, sp);
3885                         /* Free the zone stuff  */
3886                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_strmoq, sp);
3887                         SCTP_DECR_STRMOQ_COUNT();
3888                         /* sa_ignore FREED_MEMORY */
3889                         sp = TAILQ_FIRST(&outs->outqueue);
3890                 }
3891         }
3892
3893         /* sa_ignore FREED_MEMORY */
3894         while ((liste = TAILQ_FIRST(&asoc->resetHead)) != NULL) {
3895                 TAILQ_REMOVE(&asoc->resetHead, liste, next_resp);
3896                 SCTP_FREE(liste);
3897         }
3898
3899         sq = TAILQ_FIRST(&asoc->pending_reply_queue);
3900         while (sq) {
3901                 TAILQ_REMOVE(&asoc->pending_reply_queue, sq, next);
3902                 if (sq->data) {
3903                         sctp_m_freem(sq->data);
3904                         sq->data = NULL;
3905                 }
3906                 sctp_free_remote_addr(sq->whoFrom);
3907                 sq->whoFrom = NULL;
3908                 sq->stcb = NULL;
3909                 /* Free the ctl entry */
3910                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_readq, sq);
3911                 SCTP_DECR_READQ_COUNT();
3912                 /* sa_ignore FREED_MEMORY */
3913                 sq = TAILQ_FIRST(&asoc->pending_reply_queue);
3914         }
3915
3916         chk = TAILQ_FIRST(&asoc->free_chunks);
3917         while (chk) {
3918                 TAILQ_REMOVE(&asoc->free_chunks, chk, sctp_next);
3919                 if (chk->data) {
3920                         sctp_m_freem(chk->data);
3921                         chk->data = NULL;
3922                 }
3923                 ccnt++;
3924                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
3925                 SCTP_DECR_CHK_COUNT();
3926                 atomic_subtract_int(&sctppcbinfo.ipi_free_chunks, 1);
3927                 asoc->free_chunk_cnt--;
3928                 /* sa_ignore FREED_MEMORY */
3929                 chk = TAILQ_FIRST(&asoc->free_chunks);
3930         }
3931         /* pending send queue SHOULD be empty */
3932         if (!TAILQ_EMPTY(&asoc->send_queue)) {
3933                 chk = TAILQ_FIRST(&asoc->send_queue);
3934                 while (chk) {
3935                         TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
3936                         if (chk->data) {
3937                                 sctp_m_freem(chk->data);
3938                                 chk->data = NULL;
3939                         }
3940                         ccnt++;
3941                         sctp_free_remote_addr(chk->whoTo);
3942                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
3943                         SCTP_DECR_CHK_COUNT();
3944                         /* sa_ignore FREED_MEMORY */
3945                         chk = TAILQ_FIRST(&asoc->send_queue);
3946                 }
3947         }
3948 /*
3949   if(ccnt) {
3950   printf("Freed %d from send_queue\n", ccnt);
3951   ccnt = 0;
3952   }
3953 */
3954         /* sent queue SHOULD be empty */
3955         if (!TAILQ_EMPTY(&asoc->sent_queue)) {
3956                 chk = TAILQ_FIRST(&asoc->sent_queue);
3957                 while (chk) {
3958                         TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
3959                         if (chk->data) {
3960                                 sctp_m_freem(chk->data);
3961                                 chk->data = NULL;
3962                         }
3963                         ccnt++;
3964                         sctp_free_remote_addr(chk->whoTo);
3965                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
3966                         SCTP_DECR_CHK_COUNT();
3967                         /* sa_ignore FREED_MEMORY */
3968                         chk = TAILQ_FIRST(&asoc->sent_queue);
3969                 }
3970         }
3971 /*
3972   if(ccnt) {
3973   printf("Freed %d from sent_queue\n", ccnt);
3974   ccnt = 0;
3975   }
3976 */
3977         /* control queue MAY not be empty */
3978         if (!TAILQ_EMPTY(&asoc->control_send_queue)) {
3979                 chk = TAILQ_FIRST(&asoc->control_send_queue);
3980                 while (chk) {
3981                         TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
3982                         if (chk->data) {
3983                                 sctp_m_freem(chk->data);
3984                                 chk->data = NULL;
3985                         }
3986                         ccnt++;
3987                         sctp_free_remote_addr(chk->whoTo);
3988                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
3989                         SCTP_DECR_CHK_COUNT();
3990                         /* sa_ignore FREED_MEMORY */
3991                         chk = TAILQ_FIRST(&asoc->control_send_queue);
3992                 }
3993         }
3994 /*
3995   if(ccnt) {
3996   printf("Freed %d from ctrl_queue\n", ccnt);
3997   ccnt = 0;
3998   }
3999 */
4000         if (!TAILQ_EMPTY(&asoc->reasmqueue)) {
4001                 chk = TAILQ_FIRST(&asoc->reasmqueue);
4002                 while (chk) {
4003                         TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
4004                         if (chk->data) {
4005                                 sctp_m_freem(chk->data);
4006                                 chk->data = NULL;
4007                         }
4008                         sctp_free_remote_addr(chk->whoTo);
4009                         ccnt++;
4010                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_chunk, chk);
4011                         SCTP_DECR_CHK_COUNT();
4012                         /* sa_ignore FREED_MEMORY */
4013                         chk = TAILQ_FIRST(&asoc->reasmqueue);
4014                 }
4015         }
4016 /*
4017   if(ccnt) {
4018   printf("Freed %d from reasm_queue\n", ccnt);
4019   ccnt = 0;
4020   }
4021 */
4022         if (asoc->mapping_array) {
4023                 SCTP_FREE(asoc->mapping_array);
4024                 asoc->mapping_array = NULL;
4025         }
4026         /* the stream outs */
4027         if (asoc->strmout) {
4028                 SCTP_FREE(asoc->strmout);
4029                 asoc->strmout = NULL;
4030         }
4031         asoc->streamoutcnt = 0;
4032         if (asoc->strmin) {
4033                 struct sctp_queued_to_read *ctl;
4034
4035                 for (i = 0; i < asoc->streamincnt; i++) {
4036                         if (!TAILQ_EMPTY(&asoc->strmin[i].inqueue)) {
4037                                 /* We have somethings on the streamin queue */
4038                                 ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue);
4039                                 while (ctl) {
4040                                         TAILQ_REMOVE(&asoc->strmin[i].inqueue,
4041                                             ctl, next);
4042                                         sctp_free_remote_addr(ctl->whoFrom);
4043                                         if (ctl->data) {
4044                                                 sctp_m_freem(ctl->data);
4045                                                 ctl->data = NULL;
4046                                         }
4047                                         /*
4048                                          * We don't free the address here
4049                                          * since all the net's were freed
4050                                          * above.
4051                                          */
4052                                         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_readq, ctl);
4053                                         SCTP_DECR_READQ_COUNT();
4054                                         ctl = TAILQ_FIRST(&asoc->strmin[i].inqueue);
4055                                 }
4056                         }
4057                 }
4058                 SCTP_FREE(asoc->strmin);
4059                 asoc->strmin = NULL;
4060         }
4061         asoc->streamincnt = 0;
4062         while (!TAILQ_EMPTY(&asoc->nets)) {
4063                 /* sa_ignore FREED_MEMORY */
4064                 net = TAILQ_FIRST(&asoc->nets);
4065                 /* pull from list */
4066                 if ((sctppcbinfo.ipi_count_raddr == 0) || (prev == net)) {
4067 #ifdef INVARIANTS
4068                         panic("no net's left alloc'ed, or list points to itself");
4069 #endif
4070                         break;
4071                 }
4072                 prev = net;
4073                 TAILQ_REMOVE(&asoc->nets, net, sctp_next);
4074                 sctp_free_remote_addr(net);
4075         }
4076
4077         while (!SCTP_LIST_EMPTY(&asoc->sctp_restricted_addrs)) {
4078                 /* sa_ignore FREED_MEMORY */
4079                 laddr = LIST_FIRST(&asoc->sctp_restricted_addrs);
4080                 sctp_remove_laddr(laddr);
4081         }
4082
4083         /* pending asconf (address) parameters */
4084         while (!TAILQ_EMPTY(&asoc->asconf_queue)) {
4085                 /* sa_ignore FREED_MEMORY */
4086                 aparam = TAILQ_FIRST(&asoc->asconf_queue);
4087                 TAILQ_REMOVE(&asoc->asconf_queue, aparam, next);
4088                 SCTP_FREE(aparam);
4089         }
4090         if (asoc->last_asconf_ack_sent != NULL) {
4091                 sctp_m_freem(asoc->last_asconf_ack_sent);
4092                 asoc->last_asconf_ack_sent = NULL;
4093         }
4094         /* clean up auth stuff */
4095         if (asoc->local_hmacs)
4096                 sctp_free_hmaclist(asoc->local_hmacs);
4097         if (asoc->peer_hmacs)
4098                 sctp_free_hmaclist(asoc->peer_hmacs);
4099
4100         if (asoc->local_auth_chunks)
4101                 sctp_free_chunklist(asoc->local_auth_chunks);
4102         if (asoc->peer_auth_chunks)
4103                 sctp_free_chunklist(asoc->peer_auth_chunks);
4104
4105         sctp_free_authinfo(&asoc->authinfo);
4106
4107         shared_key = LIST_FIRST(&asoc->shared_keys);
4108         while (shared_key) {
4109                 LIST_REMOVE(shared_key, next);
4110                 sctp_free_sharedkey(shared_key);
4111                 /* sa_ignore FREED_MEMORY */
4112                 shared_key = LIST_FIRST(&asoc->shared_keys);
4113         }
4114
4115         /* Insert new items here :> */
4116
4117         /* Get rid of LOCK */
4118         SCTP_TCB_LOCK_DESTROY(stcb);
4119         SCTP_TCB_SEND_LOCK_DESTROY(stcb);
4120         if (from_inpcbfree == SCTP_NORMAL_PROC) {
4121                 SCTP_INP_INFO_WUNLOCK();
4122                 SCTP_INP_RLOCK(inp);
4123         }
4124 #ifdef SCTP_TRACK_FREED_ASOCS
4125         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4126                 /* now clean up the tasoc itself */
4127                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb);
4128                 SCTP_DECR_ASOC_COUNT();
4129         } else {
4130                 LIST_INSERT_HEAD(&inp->sctp_asoc_free_list, stcb, sctp_tcblist);
4131         }
4132 #else
4133         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_asoc, stcb);
4134         SCTP_DECR_ASOC_COUNT();
4135 #endif
4136         if (from_inpcbfree == SCTP_NORMAL_PROC) {
4137                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4138                         /*
4139                          * If its NOT the inp_free calling us AND sctp_close
4140                          * as been called, we call back...
4141                          */
4142                         SCTP_INP_RUNLOCK(inp);
4143                         /*
4144                          * This will start the kill timer (if we are the
4145                          * lastone) since we hold an increment yet. But this
4146                          * is the only safe way to do this since otherwise
4147                          * if the socket closes at the same time we are here
4148                          * we might collide in the cleanup.
4149                          */
4150                         sctp_inpcb_free(inp,
4151                             SCTP_FREE_SHOULD_USE_GRACEFUL_CLOSE,
4152                             SCTP_CALLED_DIRECTLY_NOCMPSET);
4153                         SCTP_INP_DECR_REF(inp);
4154                         goto out_of;
4155                 } else {
4156                         /* The socket is still open. */
4157                         SCTP_INP_DECR_REF(inp);
4158                 }
4159         }
4160         if (from_inpcbfree == SCTP_NORMAL_PROC) {
4161                 SCTP_INP_RUNLOCK(inp);
4162         }
4163 out_of:
4164         /* destroyed the asoc */
4165 #ifdef SCTP_LOG_CLOSING
4166         sctp_log_closing(inp, NULL, 11);
4167 #endif
4168         return (1);
4169 }
4170
4171
4172
4173 /*
4174  * determine if a destination is "reachable" based upon the addresses bound
4175  * to the current endpoint (e.g. only v4 or v6 currently bound)
4176  */
4177 /*
4178  * FIX: if we allow assoc-level bindx(), then this needs to be fixed to use
4179  * assoc level v4/v6 flags, as the assoc *may* not have the same address
4180  * types bound as its endpoint
4181  */
4182 int
4183 sctp_destination_is_reachable(struct sctp_tcb *stcb, struct sockaddr *destaddr)
4184 {
4185         struct sctp_inpcb *inp;
4186         int answer;
4187
4188         /*
4189          * No locks here, the TCB, in all cases is already locked and an
4190          * assoc is up. There is either a INP lock by the caller applied (in
4191          * asconf case when deleting an address) or NOT in the HB case,
4192          * however if HB then the INP increment is up and the INP will not
4193          * be removed (on top of the fact that we have a TCB lock). So we
4194          * only want to read the sctp_flags, which is either bound-all or
4195          * not.. no protection needed since once an assoc is up you can't be
4196          * changing your binding.
4197          */
4198         inp = stcb->sctp_ep;
4199         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
4200                 /* if bound all, destination is not restricted */
4201                 /*
4202                  * RRS: Question during lock work: Is this correct? If you
4203                  * are bound-all you still might need to obey the V4--V6
4204                  * flags??? IMO this bound-all stuff needs to be removed!
4205                  */
4206                 return (1);
4207         }
4208         /* NOTE: all "scope" checks are done when local addresses are added */
4209         if (destaddr->sa_family == AF_INET6) {
4210                 answer = inp->ip_inp.inp.inp_vflag & INP_IPV6;
4211         } else if (destaddr->sa_family == AF_INET) {
4212                 answer = inp->ip_inp.inp.inp_vflag & INP_IPV4;
4213         } else {
4214                 /* invalid family, so it's unreachable */
4215                 answer = 0;
4216         }
4217         return (answer);
4218 }
4219
4220 /*
4221  * update the inp_vflags on an endpoint
4222  */
4223 static void
4224 sctp_update_ep_vflag(struct sctp_inpcb *inp)
4225 {
4226         struct sctp_laddr *laddr;
4227
4228         /* first clear the flag */
4229         inp->ip_inp.inp.inp_vflag = 0;
4230         /* set the flag based on addresses on the ep list */
4231         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
4232                 if (laddr->ifa == NULL) {
4233                         SCTPDBG(SCTP_DEBUG_PCB1, "%s: NULL ifa\n",
4234                             __FUNCTION__);
4235                         continue;
4236                 }
4237                 if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) {
4238                         continue;
4239                 }
4240                 if (laddr->ifa->address.sa.sa_family == AF_INET6) {
4241                         inp->ip_inp.inp.inp_vflag |= INP_IPV6;
4242                 } else if (laddr->ifa->address.sa.sa_family == AF_INET) {
4243                         inp->ip_inp.inp.inp_vflag |= INP_IPV4;
4244                 }
4245         }
4246 }
4247
4248 /*
4249  * Add the address to the endpoint local address list There is nothing to be
4250  * done if we are bound to all addresses
4251  */
4252 void
4253 sctp_add_local_addr_ep(struct sctp_inpcb *inp, struct sctp_ifa *ifa, uint32_t action)
4254 {
4255         struct sctp_laddr *laddr;
4256         int fnd, error = 0;
4257
4258         fnd = 0;
4259
4260         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
4261                 /* You are already bound to all. You have it already */
4262                 return;
4263         }
4264         if (ifa->address.sa.sa_family == AF_INET6) {
4265                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
4266                         /* Can't bind a non-useable addr. */
4267                         return;
4268                 }
4269         }
4270         /* first, is it already present? */
4271         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
4272                 if (laddr->ifa == ifa) {
4273                         fnd = 1;
4274                         break;
4275                 }
4276         }
4277
4278         if (fnd == 0) {
4279                 /* Not in the ep list */
4280                 error = sctp_insert_laddr(&inp->sctp_addr_list, ifa, action);
4281                 if (error != 0)
4282                         return;
4283                 inp->laddr_count++;
4284                 /* update inp_vflag flags */
4285                 if (ifa->address.sa.sa_family == AF_INET6) {
4286                         inp->ip_inp.inp.inp_vflag |= INP_IPV6;
4287                 } else if (ifa->address.sa.sa_family == AF_INET) {
4288                         inp->ip_inp.inp.inp_vflag |= INP_IPV4;
4289                 }
4290         }
4291         return;
4292 }
4293
4294
4295 /*
4296  * select a new (hopefully reachable) destination net (should only be used
4297  * when we deleted an ep addr that is the only usable source address to reach
4298  * the destination net)
4299  */
4300 static void
4301 sctp_select_primary_destination(struct sctp_tcb *stcb)
4302 {
4303         struct sctp_nets *net;
4304
4305         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
4306                 /* for now, we'll just pick the first reachable one we find */
4307                 if (net->dest_state & SCTP_ADDR_UNCONFIRMED)
4308                         continue;
4309                 if (sctp_destination_is_reachable(stcb,
4310                     (struct sockaddr *)&net->ro._l_addr)) {
4311                         /* found a reachable destination */
4312                         stcb->asoc.primary_destination = net;
4313                 }
4314         }
4315         /* I can't there from here! ...we're gonna die shortly... */
4316 }
4317
4318
4319 /*
4320  * Delete the address from the endpoint local address list There is nothing
4321  * to be done if we are bound to all addresses
4322  */
4323 void
4324 sctp_del_local_addr_ep(struct sctp_inpcb *inp, struct sctp_ifa *ifa)
4325 {
4326         struct sctp_laddr *laddr;
4327         int fnd;
4328
4329         fnd = 0;
4330         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
4331                 /* You are already bound to all. You have it already */
4332                 return;
4333         }
4334         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
4335                 if (laddr->ifa == ifa) {
4336                         fnd = 1;
4337                         break;
4338                 }
4339         }
4340         if (fnd && (inp->laddr_count < 2)) {
4341                 /* can't delete unless there are at LEAST 2 addresses */
4342                 return;
4343         }
4344         if (fnd) {
4345                 /*
4346                  * clean up any use of this address go through our
4347                  * associations and clear any last_used_address that match
4348                  * this one for each assoc, see if a new primary_destination
4349                  * is needed
4350                  */
4351                 struct sctp_tcb *stcb;
4352
4353                 /* clean up "next_addr_touse" */
4354                 if (inp->next_addr_touse == laddr)
4355                         /* delete this address */
4356                         inp->next_addr_touse = NULL;
4357
4358                 /* clean up "last_used_address" */
4359                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
4360                         struct sctp_nets *net;
4361
4362                         SCTP_TCB_LOCK(stcb);
4363                         if (stcb->asoc.last_used_address == laddr)
4364                                 /* delete this address */
4365                                 stcb->asoc.last_used_address = NULL;
4366                         /*
4367                          * Now spin through all the nets and purge any ref
4368                          * to laddr
4369                          */
4370                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
4371                                 if (net->ro._s_addr &&
4372                                     (net->ro._s_addr->ifa == laddr->ifa)) {
4373                                         /* Yep, purge src address selected */
4374                                         sctp_rtentry_t *rt;
4375
4376                                         /* delete this address if cached */
4377                                         rt = net->ro.ro_rt;
4378                                         if (rt != NULL) {
4379                                                 RTFREE(rt);
4380                                                 net->ro.ro_rt = NULL;
4381                                         }
4382                                         sctp_free_ifa(net->ro._s_addr);
4383                                         net->ro._s_addr = NULL;
4384                                         net->src_addr_selected = 0;
4385                                 }
4386                         }
4387                         SCTP_TCB_UNLOCK(stcb);
4388                 }               /* for each tcb */
4389                 /* remove it from the ep list */
4390                 sctp_remove_laddr(laddr);
4391                 inp->laddr_count--;
4392                 /* update inp_vflag flags */
4393                 sctp_update_ep_vflag(inp);
4394         }
4395         return;
4396 }
4397
4398 /*
4399  * Add the addr to the TCB local address list For the BOUNDALL or dynamic
4400  * case, this is a "pending" address list (eg. addresses waiting for an
4401  * ASCONF-ACK response) For the subset binding, static case, this is a
4402  * "valid" address list
4403  */
4404 void
4405 sctp_add_local_addr_assoc(struct sctp_tcb *stcb, struct sctp_ifa *ifa, int restricted_list)
4406 {
4407         struct sctp_inpcb *inp;
4408         struct sctp_laddr *laddr;
4409         struct sctpladdr *list;
4410
4411         /*
4412          * Assumes TCB is locked.. and possibly the INP. May need to
4413          * confirm/fix that if we need it and is not the case.
4414          */
4415         list = &stcb->asoc.sctp_restricted_addrs;
4416
4417         inp = stcb->sctp_ep;
4418         if (ifa->address.sa.sa_family == AF_INET6) {
4419                 if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
4420                         /* Can't bind a non-existent addr. */
4421                         return;
4422                 }
4423         }
4424         /* does the address already exist? */
4425         LIST_FOREACH(laddr, list, sctp_nxt_addr) {
4426                 if (laddr->ifa == ifa) {
4427                         return;
4428                 }
4429         }
4430
4431         /* add to the list */
4432         (void)sctp_insert_laddr(list, ifa, 0);
4433         return;
4434 }
4435
4436 /*
4437  * insert an laddr entry with the given ifa for the desired list
4438  */
4439 int
4440 sctp_insert_laddr(struct sctpladdr *list, struct sctp_ifa *ifa, uint32_t act)
4441 {
4442         struct sctp_laddr *laddr;
4443
4444         laddr = SCTP_ZONE_GET(sctppcbinfo.ipi_zone_laddr, struct sctp_laddr);
4445         if (laddr == NULL) {
4446                 /* out of memory? */
4447                 return (EINVAL);
4448         }
4449         SCTP_INCR_LADDR_COUNT();
4450         bzero(laddr, sizeof(*laddr));
4451         laddr->ifa = ifa;
4452         laddr->action = act;
4453         atomic_add_int(&ifa->refcount, 1);
4454         /* insert it */
4455         LIST_INSERT_HEAD(list, laddr, sctp_nxt_addr);
4456
4457         return (0);
4458 }
4459
4460 /*
4461  * Remove an laddr entry from the local address list (on an assoc)
4462  */
4463 void
4464 sctp_remove_laddr(struct sctp_laddr *laddr)
4465 {
4466
4467         /* remove from the list */
4468         LIST_REMOVE(laddr, sctp_nxt_addr);
4469         sctp_free_ifa(laddr->ifa);
4470         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr);
4471         SCTP_DECR_LADDR_COUNT();
4472 }
4473
4474 /*
4475  * Remove an address from the TCB local address list
4476  */
4477 void
4478 sctp_del_local_addr_assoc(struct sctp_tcb *stcb, struct sctp_ifa *ifa)
4479 {
4480         struct sctp_inpcb *inp;
4481         struct sctp_laddr *laddr;
4482
4483         /*
4484          * This is called by asconf work. It is assumed that a) The TCB is
4485          * locked and b) The INP is locked. This is true in as much as I can
4486          * trace through the entry asconf code where I did these locks.
4487          * Again, the ASCONF code is a bit different in that it does lock
4488          * the INP during its work often times. This must be since we don't
4489          * want other proc's looking up things while what they are looking
4490          * up is changing :-D
4491          */
4492
4493         inp = stcb->sctp_ep;
4494         /* if subset bound and don't allow ASCONF's, can't delete last */
4495         if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) &&
4496             (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF) == 0)) {
4497                 if (stcb->asoc.numnets < 2) {
4498                         /* can't delete last address */
4499                         return;
4500                 }
4501         }
4502         LIST_FOREACH(laddr, &stcb->asoc.sctp_restricted_addrs, sctp_nxt_addr) {
4503                 /* remove the address if it exists */
4504                 if (laddr->ifa == NULL)
4505                         continue;
4506                 if (laddr->ifa == ifa) {
4507                         sctp_remove_laddr(laddr);
4508                         return;
4509                 }
4510         }
4511
4512         /* address not found! */
4513         return;
4514 }
4515
4516 static char sctp_pcb_initialized = 0;
4517
4518 /*
4519  * Temporarily remove for __APPLE__ until we use the Tiger equivalents
4520  */
4521 /* sysctl */
4522 static int sctp_max_number_of_assoc = SCTP_MAX_NUM_OF_ASOC;
4523 static int sctp_scale_up_for_address = SCTP_SCALE_FOR_ADDR;
4524
4525 void
4526 sctp_pcb_init()
4527 {
4528         /*
4529          * SCTP initialization for the PCB structures should be called by
4530          * the sctp_init() funciton.
4531          */
4532         int i;
4533
4534         if (sctp_pcb_initialized != 0) {
4535                 /* error I was called twice */
4536                 return;
4537         }
4538         sctp_pcb_initialized = 1;
4539
4540         bzero(&sctpstat, sizeof(struct sctpstat));
4541         (void)SCTP_GETTIME_TIMEVAL(&sctpstat.sctps_discontinuitytime);
4542         /* init the empty list of (All) Endpoints */
4543         LIST_INIT(&sctppcbinfo.listhead);
4544
4545         /* init the iterator head */
4546         TAILQ_INIT(&sctppcbinfo.iteratorhead);
4547
4548         /* init the hash table of endpoints */
4549         TUNABLE_INT_FETCH("net.inet.sctp.tcbhashsize", &sctp_hashtblsize);
4550         TUNABLE_INT_FETCH("net.inet.sctp.pcbhashsize", &sctp_pcbtblsize);
4551         TUNABLE_INT_FETCH("net.inet.sctp.chunkscale", &sctp_chunkscale);
4552         sctppcbinfo.sctp_asochash = SCTP_HASH_INIT((sctp_hashtblsize * 31),
4553             &sctppcbinfo.hashasocmark);
4554         sctppcbinfo.sctp_ephash = SCTP_HASH_INIT(sctp_hashtblsize,
4555             &sctppcbinfo.hashmark);
4556         sctppcbinfo.sctp_tcpephash = SCTP_HASH_INIT(sctp_hashtblsize,
4557             &sctppcbinfo.hashtcpmark);
4558         sctppcbinfo.hashtblsize = sctp_hashtblsize;
4559
4560         /* init the small hash table we use to track restarted asoc's */
4561         sctppcbinfo.sctp_restarthash = SCTP_HASH_INIT(SCTP_STACK_VTAG_HASH_SIZE,
4562             &sctppcbinfo.hashrestartmark);
4563
4564
4565         sctppcbinfo.sctp_vrfhash = SCTP_HASH_INIT(SCTP_SIZE_OF_VRF_HASH,
4566             &sctppcbinfo.hashvrfmark);
4567
4568         /* init the zones */
4569         /*
4570          * FIX ME: Should check for NULL returns, but if it does fail we are
4571          * doomed to panic anyways... add later maybe.
4572          */
4573         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_ep, "sctp_ep",
4574             sizeof(struct sctp_inpcb), maxsockets);
4575
4576         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_asoc, "sctp_asoc",
4577             sizeof(struct sctp_tcb), sctp_max_number_of_assoc);
4578
4579         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_laddr, "sctp_laddr",
4580             sizeof(struct sctp_laddr),
4581             (sctp_max_number_of_assoc * sctp_scale_up_for_address));
4582
4583         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_net, "sctp_raddr",
4584             sizeof(struct sctp_nets),
4585             (sctp_max_number_of_assoc * sctp_scale_up_for_address));
4586
4587         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_chunk, "sctp_chunk",
4588             sizeof(struct sctp_tmit_chunk),
4589             (sctp_max_number_of_assoc * sctp_chunkscale));
4590
4591         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_readq, "sctp_readq",
4592             sizeof(struct sctp_queued_to_read),
4593             (sctp_max_number_of_assoc * sctp_chunkscale));
4594
4595         SCTP_ZONE_INIT(sctppcbinfo.ipi_zone_strmoq, "sctp_stream_msg_out",
4596             sizeof(struct sctp_stream_queue_pending),
4597             (sctp_max_number_of_assoc * sctp_chunkscale));
4598
4599         /* Master Lock INIT for info structure */
4600         SCTP_INP_INFO_LOCK_INIT();
4601         SCTP_STATLOG_INIT_LOCK();
4602         SCTP_ITERATOR_LOCK_INIT();
4603
4604         SCTP_IPI_COUNT_INIT();
4605         SCTP_IPI_ADDR_INIT();
4606         SCTP_IPI_ITERATOR_WQ_INIT();
4607
4608         LIST_INIT(&sctppcbinfo.addr_wq);
4609
4610         /* not sure if we need all the counts */
4611         sctppcbinfo.ipi_count_ep = 0;
4612         /* assoc/tcb zone info */
4613         sctppcbinfo.ipi_count_asoc = 0;
4614         /* local addrlist zone info */
4615         sctppcbinfo.ipi_count_laddr = 0;
4616         /* remote addrlist zone info */
4617         sctppcbinfo.ipi_count_raddr = 0;
4618         /* chunk info */
4619         sctppcbinfo.ipi_count_chunk = 0;
4620
4621         /* socket queue zone info */
4622         sctppcbinfo.ipi_count_readq = 0;
4623
4624         /* stream out queue cont */
4625         sctppcbinfo.ipi_count_strmoq = 0;
4626
4627         sctppcbinfo.ipi_free_strmoq = 0;
4628         sctppcbinfo.ipi_free_chunks = 0;
4629
4630         SCTP_OS_TIMER_INIT(&sctppcbinfo.addr_wq_timer.timer);
4631
4632         /* Init the TIMEWAIT list */
4633         for (i = 0; i < SCTP_STACK_VTAG_HASH_SIZE; i++) {
4634                 LIST_INIT(&sctppcbinfo.vtag_timewait[i]);
4635         }
4636
4637 #if defined(SCTP_USE_THREAD_BASED_ITERATOR)
4638         sctppcbinfo.iterator_running = 0;
4639         sctp_startup_iterator();
4640 #endif
4641
4642         /*
4643          * INIT the default VRF which for BSD is the only one, other O/S's
4644          * may have more. But initially they must start with one and then
4645          * add the VRF's as addresses are added.
4646          */
4647         sctp_init_vrf_list(SCTP_DEFAULT_VRF);
4648
4649 }
4650
4651
4652 int
4653 sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m,
4654     int iphlen, int offset, int limit, struct sctphdr *sh,
4655     struct sockaddr *altsa)
4656 {
4657         /*
4658          * grub through the INIT pulling addresses and loading them to the
4659          * nets structure in the asoc. The from address in the mbuf should
4660          * also be loaded (if it is not already). This routine can be called
4661          * with either INIT or INIT-ACK's as long as the m points to the IP
4662          * packet and the offset points to the beginning of the parameters.
4663          */
4664         struct sctp_inpcb *inp, *l_inp;
4665         struct sctp_nets *net, *net_tmp;
4666         struct ip *iph;
4667         struct sctp_paramhdr *phdr, parm_buf;
4668         struct sctp_tcb *stcb_tmp;
4669         uint16_t ptype, plen;
4670         struct sockaddr *sa;
4671         struct sockaddr_storage dest_store;
4672         struct sockaddr *local_sa = (struct sockaddr *)&dest_store;
4673         struct sockaddr_in sin;
4674         struct sockaddr_in6 sin6;
4675         uint8_t random_store[SCTP_PARAM_BUFFER_SIZE];
4676         struct sctp_auth_random *p_random = NULL;
4677         uint16_t random_len = 0;
4678         uint8_t hmacs_store[SCTP_PARAM_BUFFER_SIZE];
4679         struct sctp_auth_hmac_algo *hmacs = NULL;
4680         uint16_t hmacs_len = 0;
4681         uint8_t chunks_store[SCTP_PARAM_BUFFER_SIZE];
4682         struct sctp_auth_chunk_list *chunks = NULL;
4683         uint16_t num_chunks = 0;
4684         sctp_key_t *new_key;
4685         uint32_t keylen;
4686         int got_random = 0, got_hmacs = 0, got_chklist = 0;
4687
4688         /* First get the destination address setup too. */
4689         memset(&sin, 0, sizeof(sin));
4690         memset(&sin6, 0, sizeof(sin6));
4691
4692         sin.sin_family = AF_INET;
4693         sin.sin_len = sizeof(sin);
4694         sin.sin_port = stcb->rport;
4695
4696         sin6.sin6_family = AF_INET6;
4697         sin6.sin6_len = sizeof(struct sockaddr_in6);
4698         sin6.sin6_port = stcb->rport;
4699         if (altsa == NULL) {
4700                 iph = mtod(m, struct ip *);
4701                 if (iph->ip_v == IPVERSION) {
4702                         /* its IPv4 */
4703                         struct sockaddr_in *sin_2;
4704
4705                         sin_2 = (struct sockaddr_in *)(local_sa);
4706                         memset(sin_2, 0, sizeof(sin));
4707                         sin_2->sin_family = AF_INET;
4708                         sin_2->sin_len = sizeof(sin);
4709                         sin_2->sin_port = sh->dest_port;
4710                         sin_2->sin_addr.s_addr = iph->ip_dst.s_addr;
4711                         sin.sin_addr = iph->ip_src;
4712                         sa = (struct sockaddr *)&sin;
4713                 } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
4714                         /* its IPv6 */
4715                         struct ip6_hdr *ip6;
4716                         struct sockaddr_in6 *sin6_2;
4717
4718                         ip6 = mtod(m, struct ip6_hdr *);
4719                         sin6_2 = (struct sockaddr_in6 *)(local_sa);
4720                         memset(sin6_2, 0, sizeof(sin6));
4721                         sin6_2->sin6_family = AF_INET6;
4722                         sin6_2->sin6_len = sizeof(struct sockaddr_in6);
4723                         sin6_2->sin6_port = sh->dest_port;
4724                         sin6.sin6_addr = ip6->ip6_src;
4725                         sa = (struct sockaddr *)&sin6;
4726                 } else {
4727                         sa = NULL;
4728                 }
4729         } else {
4730                 /*
4731                  * For cookies we use the src address NOT from the packet
4732                  * but from the original INIT
4733                  */
4734                 sa = altsa;
4735         }
4736         /* Turn off ECN until we get through all params */
4737         stcb->asoc.ecn_allowed = 0;
4738         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
4739                 /* mark all addresses that we have currently on the list */
4740                 net->dest_state |= SCTP_ADDR_NOT_IN_ASSOC;
4741         }
4742         /* does the source address already exist? if so skip it */
4743         l_inp = inp = stcb->sctp_ep;
4744
4745         atomic_add_int(&stcb->asoc.refcnt, 1);
4746         stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net_tmp, local_sa, stcb);
4747         atomic_add_int(&stcb->asoc.refcnt, -1);
4748
4749         if ((stcb_tmp == NULL && inp == stcb->sctp_ep) || inp == NULL) {
4750                 /* we must add the source address */
4751                 /* no scope set here since we have a tcb already. */
4752                 if ((sa->sa_family == AF_INET) &&
4753                     (stcb->asoc.ipv4_addr_legal)) {
4754                         if (sctp_add_remote_addr(stcb, sa, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_2)) {
4755                                 return (-1);
4756                         }
4757                 } else if ((sa->sa_family == AF_INET6) &&
4758                     (stcb->asoc.ipv6_addr_legal)) {
4759                         if (sctp_add_remote_addr(stcb, sa, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_3)) {
4760                                 return (-2);
4761                         }
4762                 }
4763         } else {
4764                 if (net_tmp != NULL && stcb_tmp == stcb) {
4765                         net_tmp->dest_state &= ~SCTP_ADDR_NOT_IN_ASSOC;
4766                 } else if (stcb_tmp != stcb) {
4767                         /* It belongs to another association? */
4768                         SCTP_TCB_UNLOCK(stcb_tmp);
4769                         return (-3);
4770                 }
4771         }
4772         if (stcb->asoc.state == 0) {
4773                 /* the assoc was freed? */
4774                 return (-4);
4775         }
4776         /* now we must go through each of the params. */
4777         phdr = sctp_get_next_param(m, offset, &parm_buf, sizeof(parm_buf));
4778         while (phdr) {
4779                 ptype = ntohs(phdr->param_type);
4780                 plen = ntohs(phdr->param_length);
4781                 /*
4782                  * printf("ptype => %0x, plen => %d\n", (uint32_t)ptype,
4783                  * (int)plen);
4784                  */
4785                 if (offset + plen > limit) {
4786                         break;
4787                 }
4788                 if (plen == 0) {
4789                         break;
4790                 }
4791                 if (ptype == SCTP_IPV4_ADDRESS) {
4792                         if (stcb->asoc.ipv4_addr_legal) {
4793                                 struct sctp_ipv4addr_param *p4, p4_buf;
4794
4795                                 /* ok get the v4 address and check/add */
4796                                 phdr = sctp_get_next_param(m, offset,
4797                                     (struct sctp_paramhdr *)&p4_buf, sizeof(p4_buf));
4798                                 if (plen != sizeof(struct sctp_ipv4addr_param) ||
4799                                     phdr == NULL) {
4800                                         return (-5);
4801                                 }
4802                                 p4 = (struct sctp_ipv4addr_param *)phdr;
4803                                 sin.sin_addr.s_addr = p4->addr;
4804                                 if (IN_MULTICAST(sin.sin_addr.s_addr)) {
4805                                         /* Skip multi-cast addresses */
4806                                         goto next_param;
4807                                 }
4808                                 if ((sin.sin_addr.s_addr == INADDR_BROADCAST) ||
4809                                     (sin.sin_addr.s_addr == INADDR_ANY)) {
4810                                         goto next_param;
4811                                 }
4812                                 sa = (struct sockaddr *)&sin;
4813                                 inp = stcb->sctp_ep;
4814                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4815                                 stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net,
4816                                     local_sa, stcb);
4817                                 atomic_add_int(&stcb->asoc.refcnt, -1);
4818
4819                                 if ((stcb_tmp == NULL && inp == stcb->sctp_ep) ||
4820                                     inp == NULL) {
4821                                         /* we must add the source address */
4822                                         /*
4823                                          * no scope set since we have a tcb
4824                                          * already
4825                                          */
4826
4827                                         /*
4828                                          * we must validate the state again
4829                                          * here
4830                                          */
4831                                         if (stcb->asoc.state == 0) {
4832                                                 /* the assoc was freed? */
4833                                                 return (-7);
4834                                         }
4835                                         if (sctp_add_remote_addr(stcb, sa, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_4)) {
4836                                                 return (-8);
4837                                         }
4838                                 } else if (stcb_tmp == stcb) {
4839                                         if (stcb->asoc.state == 0) {
4840                                                 /* the assoc was freed? */
4841                                                 return (-10);
4842                                         }
4843                                         if (net != NULL) {
4844                                                 /* clear flag */
4845                                                 net->dest_state &=
4846                                                     ~SCTP_ADDR_NOT_IN_ASSOC;
4847                                         }
4848                                 } else {
4849                                         /*
4850                                          * strange, address is in another
4851                                          * assoc? straighten out locks.
4852                                          */
4853                                         if (stcb->asoc.state == 0) {
4854                                                 /* the assoc was freed? */
4855                                                 return (-12);
4856                                         }
4857                                         return (-13);
4858                                 }
4859                         }
4860                 } else if (ptype == SCTP_IPV6_ADDRESS) {
4861                         if (stcb->asoc.ipv6_addr_legal) {
4862                                 /* ok get the v6 address and check/add */
4863                                 struct sctp_ipv6addr_param *p6, p6_buf;
4864
4865                                 phdr = sctp_get_next_param(m, offset,
4866                                     (struct sctp_paramhdr *)&p6_buf, sizeof(p6_buf));
4867                                 if (plen != sizeof(struct sctp_ipv6addr_param) ||
4868                                     phdr == NULL) {
4869                                         return (-14);
4870                                 }
4871                                 p6 = (struct sctp_ipv6addr_param *)phdr;
4872                                 memcpy((caddr_t)&sin6.sin6_addr, p6->addr,
4873                                     sizeof(p6->addr));
4874                                 if (IN6_IS_ADDR_MULTICAST(&sin6.sin6_addr)) {
4875                                         /* Skip multi-cast addresses */
4876                                         goto next_param;
4877                                 }
4878                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6.sin6_addr)) {
4879                                         /*
4880                                          * Link local make no sense without
4881                                          * scope
4882                                          */
4883                                         goto next_param;
4884                                 }
4885                                 sa = (struct sockaddr *)&sin6;
4886                                 inp = stcb->sctp_ep;
4887                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4888                                 stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net,
4889                                     local_sa, stcb);
4890                                 atomic_add_int(&stcb->asoc.refcnt, -1);
4891                                 if (stcb_tmp == NULL && (inp == stcb->sctp_ep ||
4892                                     inp == NULL)) {
4893                                         /*
4894                                          * we must validate the state again
4895                                          * here
4896                                          */
4897                                         if (stcb->asoc.state == 0) {
4898                                                 /* the assoc was freed? */
4899                                                 return (-16);
4900                                         }
4901                                         /*
4902                                          * we must add the address, no scope
4903                                          * set
4904                                          */
4905                                         if (sctp_add_remote_addr(stcb, sa, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_5)) {
4906                                                 return (-17);
4907                                         }
4908                                 } else if (stcb_tmp == stcb) {
4909                                         /*
4910                                          * we must validate the state again
4911                                          * here
4912                                          */
4913                                         if (stcb->asoc.state == 0) {
4914                                                 /* the assoc was freed? */
4915                                                 return (-19);
4916                                         }
4917                                         if (net != NULL) {
4918                                                 /* clear flag */
4919                                                 net->dest_state &=
4920                                                     ~SCTP_ADDR_NOT_IN_ASSOC;
4921                                         }
4922                                 } else {
4923                                         /*
4924                                          * strange, address is in another
4925                                          * assoc? straighten out locks.
4926                                          */
4927                                         if (stcb->asoc.state == 0) {
4928                                                 /* the assoc was freed? */
4929                                                 return (-21);
4930                                         }
4931                                         return (-22);
4932                                 }
4933                         }
4934                 } else if (ptype == SCTP_ECN_CAPABLE) {
4935                         stcb->asoc.ecn_allowed = 1;
4936                 } else if (ptype == SCTP_ULP_ADAPTATION) {
4937                         if (stcb->asoc.state != SCTP_STATE_OPEN) {
4938                                 struct sctp_adaptation_layer_indication ai,
4939                                                                 *aip;
4940
4941                                 phdr = sctp_get_next_param(m, offset,
4942                                     (struct sctp_paramhdr *)&ai, sizeof(ai));
4943                                 aip = (struct sctp_adaptation_layer_indication *)phdr;
4944                                 if (aip) {
4945                                         sctp_ulp_notify(SCTP_NOTIFY_ADAPTATION_INDICATION,
4946                                             stcb, ntohl(aip->indication), NULL);
4947                                 }
4948                         }
4949                 } else if (ptype == SCTP_SET_PRIM_ADDR) {
4950                         struct sctp_asconf_addr_param lstore, *fee;
4951                         struct sctp_asconf_addrv4_param *fii;
4952                         int lptype;
4953                         struct sockaddr *lsa = NULL;
4954
4955                         stcb->asoc.peer_supports_asconf = 1;
4956                         if (plen > sizeof(lstore)) {
4957                                 return (-23);
4958                         }
4959                         phdr = sctp_get_next_param(m, offset,
4960                             (struct sctp_paramhdr *)&lstore, min(plen, sizeof(lstore)));
4961                         if (phdr == NULL) {
4962                                 return (-24);
4963                         }
4964                         fee = (struct sctp_asconf_addr_param *)phdr;
4965                         lptype = ntohs(fee->addrp.ph.param_type);
4966                         if (lptype == SCTP_IPV4_ADDRESS) {
4967                                 if (plen !=
4968                                     sizeof(struct sctp_asconf_addrv4_param)) {
4969                                         SCTP_PRINTF("Sizeof setprim in init/init ack not %d but %d - ignored\n",
4970                                             (int)sizeof(struct sctp_asconf_addrv4_param),
4971                                             plen);
4972                                 } else {
4973                                         fii = (struct sctp_asconf_addrv4_param *)fee;
4974                                         sin.sin_addr.s_addr = fii->addrp.addr;
4975                                         lsa = (struct sockaddr *)&sin;
4976                                 }
4977                         } else if (lptype == SCTP_IPV6_ADDRESS) {
4978                                 if (plen !=
4979                                     sizeof(struct sctp_asconf_addr_param)) {
4980                                         SCTP_PRINTF("Sizeof setprim (v6) in init/init ack not %d but %d - ignored\n",
4981                                             (int)sizeof(struct sctp_asconf_addr_param),
4982                                             plen);
4983                                 } else {
4984                                         memcpy(sin6.sin6_addr.s6_addr,
4985                                             fee->addrp.addr,
4986                                             sizeof(fee->addrp.addr));
4987                                         lsa = (struct sockaddr *)&sin6;
4988                                 }
4989                         }
4990                         if (lsa) {
4991                                 (void)sctp_set_primary_addr(stcb, sa, NULL);
4992                         }
4993                 } else if (ptype == SCTP_PRSCTP_SUPPORTED) {
4994                         /* Peer supports pr-sctp */
4995                         stcb->asoc.peer_supports_prsctp = 1;
4996                 } else if (ptype == SCTP_SUPPORTED_CHUNK_EXT) {
4997                         /* A supported extension chunk */
4998                         struct sctp_supported_chunk_types_param *pr_supported;
4999                         uint8_t local_store[SCTP_PARAM_BUFFER_SIZE];
5000                         int num_ent, i;
5001
5002                         phdr = sctp_get_next_param(m, offset,
5003                             (struct sctp_paramhdr *)&local_store, min(sizeof(local_store), plen));
5004                         if (phdr == NULL) {
5005                                 return (-25);
5006                         }
5007                         stcb->asoc.peer_supports_asconf = 0;
5008                         stcb->asoc.peer_supports_prsctp = 0;
5009                         stcb->asoc.peer_supports_pktdrop = 0;
5010                         stcb->asoc.peer_supports_strreset = 0;
5011                         stcb->asoc.peer_supports_auth = 0;
5012                         pr_supported = (struct sctp_supported_chunk_types_param *)phdr;
5013                         num_ent = plen - sizeof(struct sctp_paramhdr);
5014                         for (i = 0; i < num_ent; i++) {
5015                                 switch (pr_supported->chunk_types[i]) {
5016                                 case SCTP_ASCONF:
5017                                 case SCTP_ASCONF_ACK:
5018                                         stcb->asoc.peer_supports_asconf = 1;
5019                                         break;
5020                                 case SCTP_FORWARD_CUM_TSN:
5021                                         stcb->asoc.peer_supports_prsctp = 1;
5022                                         break;
5023                                 case SCTP_PACKET_DROPPED:
5024                                         stcb->asoc.peer_supports_pktdrop = 1;
5025                                         break;
5026                                 case SCTP_STREAM_RESET:
5027                                         stcb->asoc.peer_supports_strreset = 1;
5028                                         break;
5029                                 case SCTP_AUTHENTICATION:
5030                                         stcb->asoc.peer_supports_auth = 1;
5031                                         break;
5032                                 default:
5033                                         /* one I have not learned yet */
5034                                         break;
5035
5036                                 }
5037                         }
5038                 } else if (ptype == SCTP_ECN_NONCE_SUPPORTED) {
5039                         /* Peer supports ECN-nonce */
5040                         stcb->asoc.peer_supports_ecn_nonce = 1;
5041                         stcb->asoc.ecn_nonce_allowed = 1;
5042                 } else if (ptype == SCTP_RANDOM) {
5043                         if (plen > sizeof(random_store))
5044                                 break;
5045                         if (got_random) {
5046                                 /* already processed a RANDOM */
5047                                 goto next_param;
5048                         }
5049                         phdr = sctp_get_next_param(m, offset,
5050                             (struct sctp_paramhdr *)random_store,
5051                             min(sizeof(random_store), plen));
5052                         if (phdr == NULL)
5053                                 return (-26);
5054                         p_random = (struct sctp_auth_random *)phdr;
5055                         random_len = plen - sizeof(*p_random);
5056                         /* enforce the random length */
5057                         if (random_len != SCTP_AUTH_RANDOM_SIZE_REQUIRED) {
5058                                 SCTPDBG(SCTP_DEBUG_AUTH1, "SCTP: invalid RANDOM len\n");
5059                                 return (-27);
5060                         }
5061                         got_random = 1;
5062                 } else if (ptype == SCTP_HMAC_LIST) {
5063                         int num_hmacs;
5064                         int i;
5065
5066                         if (plen > sizeof(hmacs_store))
5067                                 break;
5068                         if (got_hmacs) {
5069                                 /* already processed a HMAC list */
5070                                 goto next_param;
5071                         }
5072                         phdr = sctp_get_next_param(m, offset,
5073                             (struct sctp_paramhdr *)hmacs_store,
5074                             min(plen, sizeof(hmacs_store)));
5075                         if (phdr == NULL)
5076                                 return (-28);
5077                         hmacs = (struct sctp_auth_hmac_algo *)phdr;
5078                         hmacs_len = plen - sizeof(*hmacs);
5079                         num_hmacs = hmacs_len / sizeof(hmacs->hmac_ids[0]);
5080                         /* validate the hmac list */
5081                         if (sctp_verify_hmac_param(hmacs, num_hmacs)) {
5082                                 return (-29);
5083                         }
5084                         if (stcb->asoc.peer_hmacs != NULL)
5085                                 sctp_free_hmaclist(stcb->asoc.peer_hmacs);
5086                         stcb->asoc.peer_hmacs = sctp_alloc_hmaclist(num_hmacs);
5087                         if (stcb->asoc.peer_hmacs != NULL) {
5088                                 for (i = 0; i < num_hmacs; i++) {
5089                                         (void)sctp_auth_add_hmacid(stcb->asoc.peer_hmacs,
5090                                             ntohs(hmacs->hmac_ids[i]));
5091                                 }
5092                         }
5093                         got_hmacs = 1;
5094                 } else if (ptype == SCTP_CHUNK_LIST) {
5095                         int i;
5096
5097                         if (plen > sizeof(chunks_store))
5098                                 break;
5099                         if (got_chklist) {
5100                                 /* already processed a Chunks list */
5101                                 goto next_param;
5102                         }
5103                         phdr = sctp_get_next_param(m, offset,
5104                             (struct sctp_paramhdr *)chunks_store,
5105                             min(plen, sizeof(chunks_store)));
5106                         if (phdr == NULL)
5107                                 return (-30);
5108                         chunks = (struct sctp_auth_chunk_list *)phdr;
5109                         num_chunks = plen - sizeof(*chunks);
5110                         if (stcb->asoc.peer_auth_chunks != NULL)
5111                                 sctp_clear_chunklist(stcb->asoc.peer_auth_chunks);
5112                         else
5113                                 stcb->asoc.peer_auth_chunks = sctp_alloc_chunklist();
5114                         for (i = 0; i < num_chunks; i++) {
5115                                 (void)sctp_auth_add_chunk(chunks->chunk_types[i],
5116                                     stcb->asoc.peer_auth_chunks);
5117                         }
5118                         got_chklist = 1;
5119                 } else if ((ptype == SCTP_HEARTBEAT_INFO) ||
5120                             (ptype == SCTP_STATE_COOKIE) ||
5121                             (ptype == SCTP_UNRECOG_PARAM) ||
5122                             (ptype == SCTP_COOKIE_PRESERVE) ||
5123                             (ptype == SCTP_SUPPORTED_ADDRTYPE) ||
5124                             (ptype == SCTP_ADD_IP_ADDRESS) ||
5125                             (ptype == SCTP_DEL_IP_ADDRESS) ||
5126                             (ptype == SCTP_ERROR_CAUSE_IND) ||
5127                     (ptype == SCTP_SUCCESS_REPORT)) {
5128                          /* don't care */ ;
5129                 } else {
5130                         if ((ptype & 0x8000) == 0x0000) {
5131                                 /*
5132                                  * must stop processing the rest of the
5133                                  * param's. Any report bits were handled
5134                                  * with the call to
5135                                  * sctp_arethere_unrecognized_parameters()
5136                                  * when the INIT or INIT-ACK was first seen.
5137                                  */
5138                                 break;
5139                         }
5140                 }
5141 next_param:
5142                 offset += SCTP_SIZE32(plen);
5143                 if (offset >= limit) {
5144                         break;
5145                 }
5146                 phdr = sctp_get_next_param(m, offset, &parm_buf,
5147                     sizeof(parm_buf));
5148         }
5149         /* Now check to see if we need to purge any addresses */
5150         for (net = TAILQ_FIRST(&stcb->asoc.nets); net != NULL; net = net_tmp) {
5151                 net_tmp = TAILQ_NEXT(net, sctp_next);
5152                 if ((net->dest_state & SCTP_ADDR_NOT_IN_ASSOC) ==
5153                     SCTP_ADDR_NOT_IN_ASSOC) {
5154                         /* This address has been removed from the asoc */
5155                         /* remove and free it */
5156                         stcb->asoc.numnets--;
5157                         TAILQ_REMOVE(&stcb->asoc.nets, net, sctp_next);
5158                         sctp_free_remote_addr(net);
5159                         if (net == stcb->asoc.primary_destination) {
5160                                 stcb->asoc.primary_destination = NULL;
5161                                 sctp_select_primary_destination(stcb);
5162                         }
5163                 }
5164         }
5165         /* validate authentication required parameters */
5166         if (got_random && got_hmacs) {
5167                 stcb->asoc.peer_supports_auth = 1;
5168         } else {
5169                 stcb->asoc.peer_supports_auth = 0;
5170         }
5171         if (!stcb->asoc.peer_supports_auth && got_chklist) {
5172                 /* peer does not support auth but sent a chunks list? */
5173                 return (-31);
5174         }
5175         if (!sctp_asconf_auth_nochk && stcb->asoc.peer_supports_asconf &&
5176             !stcb->asoc.peer_supports_auth) {
5177                 /* peer supports asconf but not auth? */
5178                 return (-32);
5179         }
5180         /* concatenate the full random key */
5181 #ifdef SCTP_AUTH_DRAFT_04
5182         keylen = random_len;
5183         new_key = sctp_alloc_key(keylen);
5184         if (new_key != NULL) {
5185                 /* copy in the RANDOM */
5186                 if (p_random != NULL)
5187                         bcopy(p_random->random_data, new_key->key, random_len);
5188         }
5189 #else
5190         keylen = sizeof(*p_random) + random_len + sizeof(*chunks) + num_chunks +
5191             sizeof(*hmacs) + hmacs_len;
5192         new_key = sctp_alloc_key(keylen);
5193         if (new_key != NULL) {
5194                 /* copy in the RANDOM */
5195                 if (p_random != NULL) {
5196                         keylen = sizeof(*p_random) + random_len;
5197                         bcopy(p_random, new_key->key, keylen);
5198                 }
5199                 /* append in the AUTH chunks */
5200                 if (chunks != NULL) {
5201                         bcopy(chunks, new_key->key + keylen,
5202                             sizeof(*chunks) + num_chunks);
5203                         keylen += sizeof(*chunks) + num_chunks;
5204                 }
5205                 /* append in the HMACs */
5206                 if (hmacs != NULL) {
5207                         bcopy(hmacs, new_key->key + keylen,
5208                             sizeof(*hmacs) + hmacs_len);
5209                 }
5210         }
5211 #endif
5212         else {
5213                 /* failed to get memory for the key */
5214                 return (-33);
5215         }
5216         if (stcb->asoc.authinfo.peer_random != NULL)
5217                 sctp_free_key(stcb->asoc.authinfo.peer_random);
5218         stcb->asoc.authinfo.peer_random = new_key;
5219 #ifdef SCTP_AUTH_DRAFT_04
5220         /* don't include the chunks and hmacs for draft -04 */
5221         stcb->asoc.authinfo.peer_random->keylen = random_len;
5222 #endif
5223         sctp_clear_cachedkeys(stcb, stcb->asoc.authinfo.assoc_keyid);
5224         sctp_clear_cachedkeys(stcb, stcb->asoc.authinfo.recv_keyid);
5225
5226         return (0);
5227 }
5228
5229 int
5230 sctp_set_primary_addr(struct sctp_tcb *stcb, struct sockaddr *sa,
5231     struct sctp_nets *net)
5232 {
5233         /* make sure the requested primary address exists in the assoc */
5234         if (net == NULL && sa)
5235                 net = sctp_findnet(stcb, sa);
5236
5237         if (net == NULL) {
5238                 /* didn't find the requested primary address! */
5239                 return (-1);
5240         } else {
5241                 /* set the primary address */
5242                 if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {
5243                         /* Must be confirmed, so queue to set */
5244                         net->dest_state |= SCTP_ADDR_REQ_PRIMARY;
5245                         return (0);
5246                 }
5247                 stcb->asoc.primary_destination = net;
5248                 net->dest_state &= ~SCTP_ADDR_WAS_PRIMARY;
5249                 net = TAILQ_FIRST(&stcb->asoc.nets);
5250                 if (net != stcb->asoc.primary_destination) {
5251                         /*
5252                          * first one on the list is NOT the primary
5253                          * sctp_cmpaddr() is much more efficent if the
5254                          * primary is the first on the list, make it so.
5255                          */
5256                         TAILQ_REMOVE(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next);
5257                         TAILQ_INSERT_HEAD(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next);
5258                 }
5259                 return (0);
5260         }
5261 }
5262
5263
5264 int
5265 sctp_is_vtag_good(struct sctp_inpcb *inp, uint32_t tag, struct timeval *now)
5266 {
5267         /*
5268          * This function serves two purposes. It will see if a TAG can be
5269          * re-used and return 1 for yes it is ok and 0 for don't use that
5270          * tag. A secondary function it will do is purge out old tags that
5271          * can be removed.
5272          */
5273         struct sctpasochead *head;
5274         struct sctpvtaghead *chain;
5275         struct sctp_tagblock *twait_block;
5276         struct sctp_tcb *stcb;
5277         int i;
5278
5279         SCTP_INP_INFO_WLOCK();
5280         chain = &sctppcbinfo.vtag_timewait[(tag % SCTP_STACK_VTAG_HASH_SIZE)];
5281         /* First is the vtag in use ? */
5282
5283         head = &sctppcbinfo.sctp_asochash[SCTP_PCBHASH_ASOC(tag,
5284             sctppcbinfo.hashasocmark)];
5285         if (head == NULL) {
5286                 goto check_restart;
5287         }
5288         LIST_FOREACH(stcb, head, sctp_asocs) {
5289
5290                 if (stcb->asoc.my_vtag == tag) {
5291                         /*
5292                          * We should remove this if and return 0 always if
5293                          * we want vtags unique across all endpoints. For
5294                          * now within a endpoint is ok.
5295                          */
5296                         if (inp == stcb->sctp_ep) {
5297                                 /* bad tag, in use */
5298                                 SCTP_INP_INFO_WUNLOCK();
5299                                 return (0);
5300                         }
5301                 }
5302         }
5303 check_restart:
5304         /* Now lets check the restart hash */
5305         head = &sctppcbinfo.sctp_restarthash[SCTP_PCBHASH_ASOC(tag,
5306             sctppcbinfo.hashrestartmark)];
5307         if (head == NULL) {
5308                 goto check_time_wait;
5309         }
5310         LIST_FOREACH(stcb, head, sctp_tcbrestarhash) {
5311                 if (stcb->asoc.assoc_id == tag) {
5312                         /* candidate */
5313                         if (inp == stcb->sctp_ep) {
5314                                 /* bad tag, in use */
5315                                 SCTP_INP_INFO_WUNLOCK();
5316                                 return (0);
5317                         }
5318                 }
5319         }
5320 check_time_wait:
5321         /* Now what about timed wait ? */
5322         if (!SCTP_LIST_EMPTY(chain)) {
5323                 /*
5324                  * Block(s) are present, lets see if we have this tag in the
5325                  * list
5326                  */
5327                 LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) {
5328                         for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) {
5329                                 if (twait_block->vtag_block[i].v_tag == 0) {
5330                                         /* not used */
5331                                         continue;
5332                                 } else if ((long)twait_block->vtag_block[i].tv_sec_at_expire >
5333                                     now->tv_sec) {
5334                                         /* Audit expires this guy */
5335                                         twait_block->vtag_block[i].tv_sec_at_expire = 0;
5336                                         twait_block->vtag_block[i].v_tag = 0;
5337                                 } else if (twait_block->vtag_block[i].v_tag ==
5338                                     tag) {
5339                                         /* Bad tag, sorry :< */
5340                                         SCTP_INP_INFO_WUNLOCK();
5341                                         return (0);
5342                                 }
5343                         }
5344                 }
5345         }
5346         /* Not found, ok to use the tag */
5347         SCTP_INP_INFO_WUNLOCK();
5348         return (1);
5349 }
5350
5351
5352 static sctp_assoc_t reneged_asoc_ids[256];
5353 static uint8_t reneged_at = 0;
5354
5355
5356 static void
5357 sctp_drain_mbufs(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
5358 {
5359         /*
5360          * We must hunt this association for MBUF's past the cumack (i.e.
5361          * out of order data that we can renege on).
5362          */
5363         struct sctp_association *asoc;
5364         struct sctp_tmit_chunk *chk, *nchk;
5365         uint32_t cumulative_tsn_p1, tsn;
5366         struct sctp_queued_to_read *ctl, *nctl;
5367         int cnt, strmat, gap;
5368
5369         /* We look for anything larger than the cum-ack + 1 */
5370
5371         SCTP_STAT_INCR(sctps_protocol_drain_calls);
5372         if (sctp_do_drain == 0) {
5373                 return;
5374         }
5375         asoc = &stcb->asoc;
5376         if (asoc->cumulative_tsn == asoc->highest_tsn_inside_map) {
5377                 /* none we can reneg on. */
5378                 return;
5379         }
5380         SCTP_STAT_INCR(sctps_protocol_drains_done);
5381         cumulative_tsn_p1 = asoc->cumulative_tsn + 1;
5382         cnt = 0;
5383         /* First look in the re-assembly queue */
5384         chk = TAILQ_FIRST(&asoc->reasmqueue);
5385         while (chk) {
5386                 /* Get the next one */
5387                 nchk = TAILQ_NEXT(chk, sctp_next);
5388                 if (compare_with_wrap(chk->rec.data.TSN_seq,
5389                     cumulative_tsn_p1, MAX_TSN)) {
5390                         /* Yep it is above cum-ack */
5391                         cnt++;
5392                         tsn = chk->rec.data.TSN_seq;
5393                         if (tsn >= asoc->mapping_array_base_tsn) {
5394                                 gap = tsn - asoc->mapping_array_base_tsn;
5395                         } else {
5396                                 gap = (MAX_TSN - asoc->mapping_array_base_tsn) +
5397                                     tsn + 1;
5398                         }
5399                         asoc->size_on_reasm_queue = sctp_sbspace_sub(asoc->size_on_reasm_queue, chk->send_size);
5400                         sctp_ucount_decr(asoc->cnt_on_reasm_queue);
5401                         SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap);
5402                         TAILQ_REMOVE(&asoc->reasmqueue, chk, sctp_next);
5403                         if (chk->data) {
5404                                 sctp_m_freem(chk->data);
5405                                 chk->data = NULL;
5406                         }
5407                         sctp_free_remote_addr(chk->whoTo);
5408                         sctp_free_a_chunk(stcb, chk);
5409                 }
5410                 chk = nchk;
5411         }
5412         /* Ok that was fun, now we will drain all the inbound streams? */
5413         for (strmat = 0; strmat < asoc->streamincnt; strmat++) {
5414                 ctl = TAILQ_FIRST(&asoc->strmin[strmat].inqueue);
5415                 while (ctl) {
5416                         nctl = TAILQ_NEXT(ctl, next);
5417                         if (compare_with_wrap(ctl->sinfo_tsn,
5418                             cumulative_tsn_p1, MAX_TSN)) {
5419                                 /* Yep it is above cum-ack */
5420                                 cnt++;
5421                                 tsn = ctl->sinfo_tsn;
5422                                 if (tsn >= asoc->mapping_array_base_tsn) {
5423                                         gap = tsn -
5424                                             asoc->mapping_array_base_tsn;
5425                                 } else {
5426                                         gap = (MAX_TSN -
5427                                             asoc->mapping_array_base_tsn) +
5428                                             tsn + 1;
5429                                 }
5430                                 asoc->size_on_all_streams = sctp_sbspace_sub(asoc->size_on_all_streams, ctl->length);
5431                                 sctp_ucount_decr(asoc->cnt_on_all_streams);
5432
5433                                 SCTP_UNSET_TSN_PRESENT(asoc->mapping_array,
5434                                     gap);
5435                                 TAILQ_REMOVE(&asoc->strmin[strmat].inqueue,
5436                                     ctl, next);
5437                                 if (ctl->data) {
5438                                         sctp_m_freem(ctl->data);
5439                                         ctl->data = NULL;
5440                                 }
5441                                 sctp_free_remote_addr(ctl->whoFrom);
5442                                 SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_readq, ctl);
5443                                 SCTP_DECR_READQ_COUNT();
5444                         }
5445                         ctl = nctl;
5446                 }
5447         }
5448         /*
5449          * Question, should we go through the delivery queue? The only
5450          * reason things are on here is the app not reading OR a p-d-api up.
5451          * An attacker COULD send enough in to initiate the PD-API and then
5452          * send a bunch of stuff to other streams... these would wind up on
5453          * the delivery queue.. and then we would not get to them. But in
5454          * order to do this I then have to back-track and un-deliver
5455          * sequence numbers in streams.. el-yucko. I think for now we will
5456          * NOT look at the delivery queue and leave it to be something to
5457          * consider later. An alternative would be to abort the P-D-API with
5458          * a notification and then deliver the data.... Or another method
5459          * might be to keep track of how many times the situation occurs and
5460          * if we see a possible attack underway just abort the association.
5461          */
5462 #ifdef SCTP_DEBUG
5463         if (cnt) {
5464                 SCTPDBG(SCTP_DEBUG_PCB1, "Freed %d chunks from reneg harvest\n", cnt);
5465         }
5466 #endif
5467         if (cnt) {
5468                 /*
5469                  * Now do we need to find a new
5470                  * asoc->highest_tsn_inside_map?
5471                  */
5472                 if (asoc->highest_tsn_inside_map >= asoc->mapping_array_base_tsn) {
5473                         gap = asoc->highest_tsn_inside_map - asoc->mapping_array_base_tsn;
5474                 } else {
5475                         gap = (MAX_TSN - asoc->mapping_array_base_tsn) +
5476                             asoc->highest_tsn_inside_map + 1;
5477                 }
5478                 if (gap >= (asoc->mapping_array_size << 3)) {
5479                         /*
5480                          * Something bad happened or cum-ack and high were
5481                          * behind the base, but if so earlier checks should
5482                          * have found NO data... wierd... we will start at
5483                          * end of mapping array.
5484                          */
5485                         SCTP_PRINTF("Gap was larger than array?? %d set to max:%d maparraymax:%x\n",
5486                             (int)gap,
5487                             (int)(asoc->mapping_array_size << 3),
5488                             (int)asoc->highest_tsn_inside_map);
5489                         gap = asoc->mapping_array_size << 3;
5490                 }
5491                 while (gap > 0) {
5492                         if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap)) {
5493                                 /* found the new highest */
5494                                 asoc->highest_tsn_inside_map = asoc->mapping_array_base_tsn + gap;
5495                                 break;
5496                         }
5497                         gap--;
5498                 }
5499                 if (gap == 0) {
5500                         /* Nothing left in map */
5501                         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
5502                         asoc->mapping_array_base_tsn = asoc->cumulative_tsn + 1;
5503                         asoc->highest_tsn_inside_map = asoc->cumulative_tsn;
5504                 }
5505                 asoc->last_revoke_count = cnt;
5506                 (void)SCTP_OS_TIMER_STOP(&stcb->asoc.dack_timer.timer);
5507                 sctp_send_sack(stcb);
5508                 sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_DRAIN);
5509                 reneged_asoc_ids[reneged_at] = sctp_get_associd(stcb);
5510                 reneged_at++;
5511         }
5512         /*
5513          * Another issue, in un-setting the TSN's in the mapping array we
5514          * DID NOT adjust the higest_tsn marker.  This will cause one of two
5515          * things to occur. It may cause us to do extra work in checking for
5516          * our mapping array movement. More importantly it may cause us to
5517          * SACK every datagram. This may not be a bad thing though since we
5518          * will recover once we get our cum-ack above and all this stuff we
5519          * dumped recovered.
5520          */
5521 }
5522
5523 void
5524 sctp_drain()
5525 {
5526         /*
5527          * We must walk the PCB lists for ALL associations here. The system
5528          * is LOW on MBUF's and needs help. This is where reneging will
5529          * occur. We really hope this does NOT happen!
5530          */
5531         struct sctp_inpcb *inp;
5532         struct sctp_tcb *stcb;
5533
5534         SCTP_INP_INFO_RLOCK();
5535         LIST_FOREACH(inp, &sctppcbinfo.listhead, sctp_list) {
5536                 /* For each endpoint */
5537                 SCTP_INP_RLOCK(inp);
5538                 LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
5539                         /* For each association */
5540                         SCTP_TCB_LOCK(stcb);
5541                         sctp_drain_mbufs(inp, stcb);
5542                         SCTP_TCB_UNLOCK(stcb);
5543                 }
5544                 SCTP_INP_RUNLOCK(inp);
5545         }
5546         SCTP_INP_INFO_RUNLOCK();
5547 }
5548
5549 /*
5550  * start a new iterator
5551  * iterates through all endpoints and associations based on the pcb_state
5552  * flags and asoc_state.  "af" (mandatory) is executed for all matching
5553  * assocs and "ef" (optional) is executed when the iterator completes.
5554  * "inpf" (optional) is executed for each new endpoint as it is being
5555  * iterated through. inpe (optional) is called when the inp completes
5556  * its way through all the stcbs.
5557  */
5558 int
5559 sctp_initiate_iterator(inp_func inpf,
5560     asoc_func af,
5561     inp_func inpe,
5562     uint32_t pcb_state,
5563     uint32_t pcb_features,
5564     uint32_t asoc_state,
5565     void *argp,
5566     uint32_t argi,
5567     end_func ef,
5568     struct sctp_inpcb *s_inp,
5569     uint8_t chunk_output_off)
5570 {
5571         struct sctp_iterator *it = NULL;
5572
5573         if (af == NULL) {
5574                 return (-1);
5575         }
5576         SCTP_MALLOC(it, struct sctp_iterator *, sizeof(struct sctp_iterator),
5577             "Iterator");
5578         if (it == NULL) {
5579                 return (ENOMEM);
5580         }
5581         memset(it, 0, sizeof(*it));
5582         it->function_assoc = af;
5583         it->function_inp = inpf;
5584         if (inpf)
5585                 it->done_current_ep = 0;
5586         else
5587                 it->done_current_ep = 1;
5588         it->function_atend = ef;
5589         it->pointer = argp;
5590         it->val = argi;
5591         it->pcb_flags = pcb_state;
5592         it->pcb_features = pcb_features;
5593         it->asoc_state = asoc_state;
5594         it->function_inp_end = inpe;
5595         it->no_chunk_output = chunk_output_off;
5596         if (s_inp) {
5597                 it->inp = s_inp;
5598                 it->iterator_flags = SCTP_ITERATOR_DO_SINGLE_INP;
5599         } else {
5600                 SCTP_INP_INFO_RLOCK();
5601                 it->inp = LIST_FIRST(&sctppcbinfo.listhead);
5602
5603                 SCTP_INP_INFO_RUNLOCK();
5604                 it->iterator_flags = SCTP_ITERATOR_DO_ALL_INP;
5605
5606         }
5607         SCTP_IPI_ITERATOR_WQ_LOCK();
5608         if (it->inp) {
5609                 SCTP_INP_INCR_REF(it->inp);
5610         }
5611         TAILQ_INSERT_TAIL(&sctppcbinfo.iteratorhead, it, sctp_nxt_itr);
5612 #if defined(SCTP_USE_THREAD_BASED_ITERATOR)
5613         if (sctppcbinfo.iterator_running == 0) {
5614                 sctp_wakeup_iterator();
5615         }
5616         SCTP_IPI_ITERATOR_WQ_UNLOCK();
5617 #else
5618         if (it->inp)
5619                 SCTP_INP_DECR_REF(it->inp);
5620         SCTP_IPI_ITERATOR_WQ_UNLOCK();
5621         /* Init the timer */
5622         SCTP_OS_TIMER_INIT(&it->tmr.timer);
5623         /* add to the list of all iterators */
5624         sctp_timer_start(SCTP_TIMER_TYPE_ITERATOR, (struct sctp_inpcb *)it,
5625             NULL, NULL);
5626 #endif
5627         /* sa_ignore MEMLEAK {memory is put on the tailq for the iterator} */
5628         return (0);
5629 }