xref: /freebsd/sys/netinet/sctp_pcb.c (revision 6e5dcc6113da649a79e5bc2c3ea9329bcd1d85d5)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
5  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
6  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
7  *
8  * Redistribution and use in source and binary forms, with or without
9  * modification, are permitted provided that the following conditions are met:
10  *
11  * a) Redistributions of source code must retain the above copyright notice,
12  *    this list of conditions and the following disclaimer.
13  *
14  * b) Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in
16  *    the documentation and/or other materials provided with the distribution.
17  *
18  * c) Neither the name of Cisco Systems, Inc. nor the names of its
19  *    contributors may be used to endorse or promote products derived
20  *    from this software without specific prior written permission.
21  *
22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
24  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
25  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
26  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
32  * THE POSSIBILITY OF SUCH DAMAGE.
33  */
34 
35 #include <netinet/sctp_os.h>
36 #include <sys/proc.h>
37 #include <netinet/sctp_var.h>
38 #include <netinet/sctp_sysctl.h>
39 #include <netinet/sctp_pcb.h>
40 #include <netinet/sctputil.h>
41 #include <netinet/sctp.h>
42 #include <netinet/sctp_header.h>
43 #include <netinet/sctp_asconf.h>
44 #include <netinet/sctp_output.h>
45 #include <netinet/sctp_timer.h>
46 #include <netinet/sctp_bsd_addr.h>
47 #if defined(INET) || defined(INET6)
48 #include <netinet/udp.h>
49 #endif
50 #ifdef INET6
51 #include <netinet6/ip6_var.h>
52 #endif
53 #include <sys/sched.h>
54 #include <sys/smp.h>
55 #include <sys/unistd.h>
56 
57 /* FIX: we don't handle multiple link local scopes */
58 /* "scopeless" replacement IN6_ARE_ADDR_EQUAL */
59 #ifdef INET6
60 int
61 SCTP6_ARE_ADDR_EQUAL(struct sockaddr_in6 *a, struct sockaddr_in6 *b)
62 {
63 	struct sockaddr_in6 tmp_a, tmp_b;
64 
65 	memcpy(&tmp_a, a, sizeof(struct sockaddr_in6));
66 	if (sa6_embedscope(&tmp_a, MODULE_GLOBAL(ip6_use_defzone)) != 0) {
67 		return (0);
68 	}
69 	memcpy(&tmp_b, b, sizeof(struct sockaddr_in6));
70 	if (sa6_embedscope(&tmp_b, MODULE_GLOBAL(ip6_use_defzone)) != 0) {
71 		return (0);
72 	}
73 	return (IN6_ARE_ADDR_EQUAL(&tmp_a.sin6_addr, &tmp_b.sin6_addr));
74 }
75 #endif
76 
77 void
78 sctp_fill_pcbinfo(struct sctp_pcbinfo *spcb)
79 {
80 	/*
81 	 * We really don't need to lock this, but I will just because it
82 	 * does not hurt.
83 	 */
84 	SCTP_INP_INFO_RLOCK();
85 	spcb->ep_count = SCTP_BASE_INFO(ipi_count_ep);
86 	spcb->asoc_count = SCTP_BASE_INFO(ipi_count_asoc);
87 	spcb->laddr_count = SCTP_BASE_INFO(ipi_count_laddr);
88 	spcb->raddr_count = SCTP_BASE_INFO(ipi_count_raddr);
89 	spcb->chk_count = SCTP_BASE_INFO(ipi_count_chunk);
90 	spcb->readq_count = SCTP_BASE_INFO(ipi_count_readq);
91 	spcb->stream_oque = SCTP_BASE_INFO(ipi_count_strmoq);
92 	spcb->free_chunks = SCTP_BASE_INFO(ipi_free_chunks);
93 	SCTP_INP_INFO_RUNLOCK();
94 }
95 
96 /*-
97  * Addresses are added to VRF's (Virtual Router's). For BSD we
98  * have only the default VRF 0. We maintain a hash list of
99  * VRF's. Each VRF has its own list of sctp_ifn's. Each of
100  * these has a list of addresses. When we add a new address
101  * to a VRF we lookup the ifn/ifn_index, if the ifn does
102  * not exist we create it and add it to the list of IFN's
103  * within the VRF. Once we have the sctp_ifn, we add the
104  * address to the list. So we look something like:
105  *
106  * hash-vrf-table
107  *   vrf-> ifn-> ifn -> ifn
108  *   vrf    |
109  *    ...   +--ifa-> ifa -> ifa
110  *   vrf
111  *
112  * We keep these separate lists since the SCTP subsystem will
113  * point to these from its source address selection nets structure.
114  * When an address is deleted it does not happen right away on
115  * the SCTP side, it gets scheduled. What we do when a
116  * delete happens is immediately remove the address from
117  * the master list and decrement the refcount. As our
118  * addip iterator works through and frees the src address
119  * selection pointing to the sctp_ifa, eventually the refcount
120  * will reach 0 and we will delete it. Note that it is assumed
121  * that any locking on system level ifn/ifa is done at the
122  * caller of these functions and these routines will only
123  * lock the SCTP structures as they add or delete things.
124  *
125  * Other notes on VRF concepts.
126  *  - An endpoint can be in multiple VRF's
127  *  - An association lives within a VRF and only one VRF.
128  *  - Any incoming packet we can deduce the VRF for by
129  *    looking at the mbuf/pak inbound (for BSD its VRF=0 :D)
130  *  - Any downward send call or connect call must supply the
131  *    VRF via ancillary data or via some sort of set default
132  *    VRF socket option call (again for BSD no brainer since
133  *    the VRF is always 0).
134  *  - An endpoint may add multiple VRF's to it.
135  *  - Listening sockets can accept associations in any
136  *    of the VRF's they are in but the assoc will end up
137  *    in only one VRF (gotten from the packet or connect/send).
138  *
139  */
140 
141 struct sctp_vrf *
142 sctp_allocate_vrf(int vrf_id)
143 {
144 	struct sctp_vrf *vrf = NULL;
145 	struct sctp_vrflist *bucket;
146 
147 	/* First allocate the VRF structure */
148 	vrf = sctp_find_vrf(vrf_id);
149 	if (vrf) {
150 		/* Already allocated */
151 		return (vrf);
152 	}
153 	SCTP_MALLOC(vrf, struct sctp_vrf *, sizeof(struct sctp_vrf),
154 	    SCTP_M_VRF);
155 	if (vrf == NULL) {
156 		/* No memory */
157 #ifdef INVARIANTS
158 		panic("No memory for VRF:%d", vrf_id);
159 #endif
160 		return (NULL);
161 	}
162 	/* setup the VRF */
163 	memset(vrf, 0, sizeof(struct sctp_vrf));
164 	vrf->vrf_id = vrf_id;
165 	LIST_INIT(&vrf->ifnlist);
166 	vrf->total_ifa_count = 0;
167 	vrf->refcount = 0;
168 	/* now also setup table ids */
169 	SCTP_INIT_VRF_TABLEID(vrf);
170 	/* Init the HASH of addresses */
171 	vrf->vrf_addr_hash = SCTP_HASH_INIT(SCTP_VRF_ADDR_HASH_SIZE,
172 	    &vrf->vrf_addr_hashmark);
173 	if (vrf->vrf_addr_hash == NULL) {
174 		/* No memory */
175 #ifdef INVARIANTS
176 		panic("No memory for VRF:%d", vrf_id);
177 #endif
178 		SCTP_FREE(vrf, SCTP_M_VRF);
179 		return (NULL);
180 	}
181 
182 	/* Add it to the hash table */
183 	bucket = &SCTP_BASE_INFO(sctp_vrfhash)[(vrf_id & SCTP_BASE_INFO(hashvrfmark))];
184 	LIST_INSERT_HEAD(bucket, vrf, next_vrf);
185 	atomic_add_int(&SCTP_BASE_INFO(ipi_count_vrfs), 1);
186 	return (vrf);
187 }
188 
189 struct sctp_ifn *
190 sctp_find_ifn(void *ifn, uint32_t ifn_index)
191 {
192 	struct sctp_ifn *sctp_ifnp;
193 	struct sctp_ifnlist *hash_ifn_head;
194 
195 	/*
196 	 * We assume the lock is held for the addresses if that's wrong
197 	 * problems could occur :-)
198 	 */
199 	SCTP_IPI_ADDR_LOCK_ASSERT();
200 	hash_ifn_head = &SCTP_BASE_INFO(vrf_ifn_hash)[(ifn_index & SCTP_BASE_INFO(vrf_ifn_hashmark))];
201 	LIST_FOREACH(sctp_ifnp, hash_ifn_head, next_bucket) {
202 		if (sctp_ifnp->ifn_index == ifn_index) {
203 			return (sctp_ifnp);
204 		}
205 		if (sctp_ifnp->ifn_p && ifn && (sctp_ifnp->ifn_p == ifn)) {
206 			return (sctp_ifnp);
207 		}
208 	}
209 	return (NULL);
210 }
211 
212 struct sctp_vrf *
213 sctp_find_vrf(uint32_t vrf_id)
214 {
215 	struct sctp_vrflist *bucket;
216 	struct sctp_vrf *liste;
217 
218 	bucket = &SCTP_BASE_INFO(sctp_vrfhash)[(vrf_id & SCTP_BASE_INFO(hashvrfmark))];
219 	LIST_FOREACH(liste, bucket, next_vrf) {
220 		if (vrf_id == liste->vrf_id) {
221 			return (liste);
222 		}
223 	}
224 	return (NULL);
225 }
226 
227 void
228 sctp_free_vrf(struct sctp_vrf *vrf)
229 {
230 	if (SCTP_DECREMENT_AND_CHECK_REFCOUNT(&vrf->refcount)) {
231 		if (vrf->vrf_addr_hash) {
232 			SCTP_HASH_FREE(vrf->vrf_addr_hash, vrf->vrf_addr_hashmark);
233 			vrf->vrf_addr_hash = NULL;
234 		}
235 		/* We zero'd the count */
236 		LIST_REMOVE(vrf, next_vrf);
237 		SCTP_FREE(vrf, SCTP_M_VRF);
238 		atomic_subtract_int(&SCTP_BASE_INFO(ipi_count_vrfs), 1);
239 	}
240 }
241 
242 void
243 sctp_free_ifn(struct sctp_ifn *sctp_ifnp)
244 {
245 	if (SCTP_DECREMENT_AND_CHECK_REFCOUNT(&sctp_ifnp->refcount)) {
246 		/* We zero'd the count */
247 		if (sctp_ifnp->vrf) {
248 			sctp_free_vrf(sctp_ifnp->vrf);
249 		}
250 		SCTP_FREE(sctp_ifnp, SCTP_M_IFN);
251 		atomic_subtract_int(&SCTP_BASE_INFO(ipi_count_ifns), 1);
252 	}
253 }
254 
255 void
256 sctp_update_ifn_mtu(uint32_t ifn_index, uint32_t mtu)
257 {
258 	struct sctp_ifn *sctp_ifnp;
259 
260 	sctp_ifnp = sctp_find_ifn((void *)NULL, ifn_index);
261 	if (sctp_ifnp != NULL) {
262 		sctp_ifnp->ifn_mtu = mtu;
263 	}
264 }
265 
266 void
267 sctp_free_ifa(struct sctp_ifa *sctp_ifap)
268 {
269 	if (SCTP_DECREMENT_AND_CHECK_REFCOUNT(&sctp_ifap->refcount)) {
270 		/* We zero'd the count */
271 		if (sctp_ifap->ifn_p) {
272 			sctp_free_ifn(sctp_ifap->ifn_p);
273 		}
274 		SCTP_FREE(sctp_ifap, SCTP_M_IFA);
275 		atomic_subtract_int(&SCTP_BASE_INFO(ipi_count_ifas), 1);
276 	}
277 }
278 
279 static void
280 sctp_delete_ifn(struct sctp_ifn *sctp_ifnp, int hold_addr_lock)
281 {
282 	struct sctp_ifn *found;
283 
284 	found = sctp_find_ifn(sctp_ifnp->ifn_p, sctp_ifnp->ifn_index);
285 	if (found == NULL) {
286 		/* Not in the list.. sorry */
287 		return;
288 	}
289 	if (hold_addr_lock == 0) {
290 		SCTP_IPI_ADDR_WLOCK();
291 	} else {
292 		SCTP_IPI_ADDR_WLOCK_ASSERT();
293 	}
294 	LIST_REMOVE(sctp_ifnp, next_bucket);
295 	LIST_REMOVE(sctp_ifnp, next_ifn);
296 	if (hold_addr_lock == 0) {
297 		SCTP_IPI_ADDR_WUNLOCK();
298 	}
299 	/* Take away the reference, and possibly free it */
300 	sctp_free_ifn(sctp_ifnp);
301 }
302 
303 void
304 sctp_mark_ifa_addr_down(uint32_t vrf_id, struct sockaddr *addr,
305     const char *if_name, uint32_t ifn_index)
306 {
307 	struct sctp_vrf *vrf;
308 	struct sctp_ifa *sctp_ifap;
309 
310 	SCTP_IPI_ADDR_RLOCK();
311 	vrf = sctp_find_vrf(vrf_id);
312 	if (vrf == NULL) {
313 		SCTPDBG(SCTP_DEBUG_PCB4, "Can't find vrf_id 0x%x\n", vrf_id);
314 		goto out;
315 	}
316 	sctp_ifap = sctp_find_ifa_by_addr(addr, vrf->vrf_id, SCTP_ADDR_LOCKED);
317 	if (sctp_ifap == NULL) {
318 		SCTPDBG(SCTP_DEBUG_PCB4, "Can't find sctp_ifap for address\n");
319 		goto out;
320 	}
321 	if (sctp_ifap->ifn_p == NULL) {
322 		SCTPDBG(SCTP_DEBUG_PCB4, "IFA has no IFN - can't mark unusable\n");
323 		goto out;
324 	}
325 	if (if_name) {
326 		if (strncmp(if_name, sctp_ifap->ifn_p->ifn_name, SCTP_IFNAMSIZ) != 0) {
327 			SCTPDBG(SCTP_DEBUG_PCB4, "IFN %s of IFA not the same as %s\n",
328 			    sctp_ifap->ifn_p->ifn_name, if_name);
329 			goto out;
330 		}
331 	} else {
332 		if (sctp_ifap->ifn_p->ifn_index != ifn_index) {
333 			SCTPDBG(SCTP_DEBUG_PCB4, "IFA owned by ifn_index:%d down command for ifn_index:%d - ignored\n",
334 			    sctp_ifap->ifn_p->ifn_index, ifn_index);
335 			goto out;
336 		}
337 	}
338 
339 	sctp_ifap->localifa_flags &= (~SCTP_ADDR_VALID);
340 	sctp_ifap->localifa_flags |= SCTP_ADDR_IFA_UNUSEABLE;
341 out:
342 	SCTP_IPI_ADDR_RUNLOCK();
343 }
344 
345 void
346 sctp_mark_ifa_addr_up(uint32_t vrf_id, struct sockaddr *addr,
347     const char *if_name, uint32_t ifn_index)
348 {
349 	struct sctp_vrf *vrf;
350 	struct sctp_ifa *sctp_ifap;
351 
352 	SCTP_IPI_ADDR_RLOCK();
353 	vrf = sctp_find_vrf(vrf_id);
354 	if (vrf == NULL) {
355 		SCTPDBG(SCTP_DEBUG_PCB4, "Can't find vrf_id 0x%x\n", vrf_id);
356 		goto out;
357 	}
358 	sctp_ifap = sctp_find_ifa_by_addr(addr, vrf->vrf_id, SCTP_ADDR_LOCKED);
359 	if (sctp_ifap == NULL) {
360 		SCTPDBG(SCTP_DEBUG_PCB4, "Can't find sctp_ifap for address\n");
361 		goto out;
362 	}
363 	if (sctp_ifap->ifn_p == NULL) {
364 		SCTPDBG(SCTP_DEBUG_PCB4, "IFA has no IFN - can't mark unusable\n");
365 		goto out;
366 	}
367 	if (if_name) {
368 		if (strncmp(if_name, sctp_ifap->ifn_p->ifn_name, SCTP_IFNAMSIZ) != 0) {
369 			SCTPDBG(SCTP_DEBUG_PCB4, "IFN %s of IFA not the same as %s\n",
370 			    sctp_ifap->ifn_p->ifn_name, if_name);
371 			goto out;
372 		}
373 	} else {
374 		if (sctp_ifap->ifn_p->ifn_index != ifn_index) {
375 			SCTPDBG(SCTP_DEBUG_PCB4, "IFA owned by ifn_index:%d down command for ifn_index:%d - ignored\n",
376 			    sctp_ifap->ifn_p->ifn_index, ifn_index);
377 			goto out;
378 		}
379 	}
380 
381 	sctp_ifap->localifa_flags &= (~SCTP_ADDR_IFA_UNUSEABLE);
382 	sctp_ifap->localifa_flags |= SCTP_ADDR_VALID;
383 out:
384 	SCTP_IPI_ADDR_RUNLOCK();
385 }
386 
387 /*-
388  * Add an ifa to an ifn.
389  * Register the interface as necessary.
390  * NOTE: ADDR write lock MUST be held.
391  */
392 static void
393 sctp_add_ifa_to_ifn(struct sctp_ifn *sctp_ifnp, struct sctp_ifa *sctp_ifap)
394 {
395 	int ifa_af;
396 
397 	LIST_INSERT_HEAD(&sctp_ifnp->ifalist, sctp_ifap, next_ifa);
398 	sctp_ifap->ifn_p = sctp_ifnp;
399 	atomic_add_int(&sctp_ifap->ifn_p->refcount, 1);
400 	/* update address counts */
401 	sctp_ifnp->ifa_count++;
402 	ifa_af = sctp_ifap->address.sa.sa_family;
403 	switch (ifa_af) {
404 #ifdef INET
405 	case AF_INET:
406 		sctp_ifnp->num_v4++;
407 		break;
408 #endif
409 #ifdef INET6
410 	case AF_INET6:
411 		sctp_ifnp->num_v6++;
412 		break;
413 #endif
414 	default:
415 		break;
416 	}
417 	if (sctp_ifnp->ifa_count == 1) {
418 		/* register the new interface */
419 		sctp_ifnp->registered_af = ifa_af;
420 	}
421 }
422 
423 /*-
424  * Remove an ifa from its ifn.
425  * If no more addresses exist, remove the ifn too. Otherwise, re-register
426  * the interface based on the remaining address families left.
427  * NOTE: ADDR write lock MUST be held.
428  */
429 static void
430 sctp_remove_ifa_from_ifn(struct sctp_ifa *sctp_ifap)
431 {
432 	LIST_REMOVE(sctp_ifap, next_ifa);
433 	if (sctp_ifap->ifn_p) {
434 		/* update address counts */
435 		sctp_ifap->ifn_p->ifa_count--;
436 		switch (sctp_ifap->address.sa.sa_family) {
437 #ifdef INET
438 		case AF_INET:
439 			sctp_ifap->ifn_p->num_v4--;
440 			break;
441 #endif
442 #ifdef INET6
443 		case AF_INET6:
444 			sctp_ifap->ifn_p->num_v6--;
445 			break;
446 #endif
447 		default:
448 			break;
449 		}
450 
451 		if (LIST_EMPTY(&sctp_ifap->ifn_p->ifalist)) {
452 			/* remove the ifn, possibly freeing it */
453 			sctp_delete_ifn(sctp_ifap->ifn_p, SCTP_ADDR_LOCKED);
454 		} else {
455 			/* re-register address family type, if needed */
456 			if ((sctp_ifap->ifn_p->num_v6 == 0) &&
457 			    (sctp_ifap->ifn_p->registered_af == AF_INET6)) {
458 				sctp_ifap->ifn_p->registered_af = AF_INET;
459 			} else if ((sctp_ifap->ifn_p->num_v4 == 0) &&
460 			    (sctp_ifap->ifn_p->registered_af == AF_INET)) {
461 				sctp_ifap->ifn_p->registered_af = AF_INET6;
462 			}
463 			/* free the ifn refcount */
464 			sctp_free_ifn(sctp_ifap->ifn_p);
465 		}
466 		sctp_ifap->ifn_p = NULL;
467 	}
468 }
469 
470 struct sctp_ifa *
471 sctp_add_addr_to_vrf(uint32_t vrf_id, void *ifn, uint32_t ifn_index,
472     uint32_t ifn_type, const char *if_name, void *ifa,
473     struct sockaddr *addr, uint32_t ifa_flags,
474     int dynamic_add)
475 {
476 	struct sctp_vrf *vrf;
477 	struct sctp_ifn *sctp_ifnp, *new_sctp_ifnp;
478 	struct sctp_ifa *sctp_ifap, *new_sctp_ifap;
479 	struct sctp_ifalist *hash_addr_head;
480 	struct sctp_ifnlist *hash_ifn_head;
481 	uint32_t hash_of_addr;
482 	int new_ifn_af = 0;
483 
484 #ifdef SCTP_DEBUG
485 	SCTPDBG(SCTP_DEBUG_PCB4, "vrf_id 0x%x: adding address: ", vrf_id);
486 	SCTPDBG_ADDR(SCTP_DEBUG_PCB4, addr);
487 #endif
488 	SCTP_MALLOC(new_sctp_ifnp, struct sctp_ifn *,
489 	    sizeof(struct sctp_ifn), SCTP_M_IFN);
490 	if (new_sctp_ifnp == NULL) {
491 #ifdef INVARIANTS
492 		panic("No memory for IFN");
493 #endif
494 		return (NULL);
495 	}
496 	SCTP_MALLOC(new_sctp_ifap, struct sctp_ifa *, sizeof(struct sctp_ifa), SCTP_M_IFA);
497 	if (new_sctp_ifap == NULL) {
498 #ifdef INVARIANTS
499 		panic("No memory for IFA");
500 #endif
501 		SCTP_FREE(new_sctp_ifnp, SCTP_M_IFN);
502 		return (NULL);
503 	}
504 
505 	SCTP_IPI_ADDR_WLOCK();
506 	sctp_ifnp = sctp_find_ifn(ifn, ifn_index);
507 	if (sctp_ifnp) {
508 		vrf = sctp_ifnp->vrf;
509 	} else {
510 		vrf = sctp_find_vrf(vrf_id);
511 		if (vrf == NULL) {
512 			vrf = sctp_allocate_vrf(vrf_id);
513 			if (vrf == NULL) {
514 				SCTP_IPI_ADDR_WUNLOCK();
515 				SCTP_FREE(new_sctp_ifnp, SCTP_M_IFN);
516 				SCTP_FREE(new_sctp_ifap, SCTP_M_IFA);
517 				return (NULL);
518 			}
519 		}
520 	}
521 	if (sctp_ifnp == NULL) {
522 		/*
523 		 * build one and add it, can't hold lock until after malloc
524 		 * done though.
525 		 */
526 		sctp_ifnp = new_sctp_ifnp;
527 		new_sctp_ifnp = NULL;
528 		memset(sctp_ifnp, 0, sizeof(struct sctp_ifn));
529 		sctp_ifnp->ifn_index = ifn_index;
530 		sctp_ifnp->ifn_p = ifn;
531 		sctp_ifnp->ifn_type = ifn_type;
532 		sctp_ifnp->refcount = 0;
533 		sctp_ifnp->vrf = vrf;
534 		atomic_add_int(&vrf->refcount, 1);
535 		sctp_ifnp->ifn_mtu = SCTP_GATHER_MTU_FROM_IFN_INFO(ifn, ifn_index);
536 		if (if_name != NULL) {
537 			SCTP_SNPRINTF(sctp_ifnp->ifn_name, SCTP_IFNAMSIZ, "%s", if_name);
538 		} else {
539 			SCTP_SNPRINTF(sctp_ifnp->ifn_name, SCTP_IFNAMSIZ, "%s", "unknown");
540 		}
541 		hash_ifn_head = &SCTP_BASE_INFO(vrf_ifn_hash)[(ifn_index & SCTP_BASE_INFO(vrf_ifn_hashmark))];
542 		LIST_INIT(&sctp_ifnp->ifalist);
543 		LIST_INSERT_HEAD(hash_ifn_head, sctp_ifnp, next_bucket);
544 		LIST_INSERT_HEAD(&vrf->ifnlist, sctp_ifnp, next_ifn);
545 		atomic_add_int(&SCTP_BASE_INFO(ipi_count_ifns), 1);
546 		new_ifn_af = 1;
547 	}
548 	sctp_ifap = sctp_find_ifa_by_addr(addr, vrf->vrf_id, SCTP_ADDR_LOCKED);
549 	if (sctp_ifap) {
550 		/* Hmm, it already exists? */
551 		if ((sctp_ifap->ifn_p) &&
552 		    (sctp_ifap->ifn_p->ifn_index == ifn_index)) {
553 			SCTPDBG(SCTP_DEBUG_PCB4, "Using existing ifn %s (0x%x) for ifa %p\n",
554 			    sctp_ifap->ifn_p->ifn_name, ifn_index,
555 			    (void *)sctp_ifap);
556 			if (new_ifn_af) {
557 				/* Remove the created one that we don't want */
558 				sctp_delete_ifn(sctp_ifnp, SCTP_ADDR_LOCKED);
559 			}
560 			if (sctp_ifap->localifa_flags & SCTP_BEING_DELETED) {
561 				/* easy to solve, just switch back to active */
562 				SCTPDBG(SCTP_DEBUG_PCB4, "Clearing deleted ifa flag\n");
563 				sctp_ifap->localifa_flags = SCTP_ADDR_VALID;
564 				sctp_ifap->ifn_p = sctp_ifnp;
565 				atomic_add_int(&sctp_ifap->ifn_p->refcount, 1);
566 			}
567 	exit_stage_left:
568 			SCTP_IPI_ADDR_WUNLOCK();
569 			if (new_sctp_ifnp != NULL) {
570 				SCTP_FREE(new_sctp_ifnp, SCTP_M_IFN);
571 			}
572 			SCTP_FREE(new_sctp_ifap, SCTP_M_IFA);
573 			return (sctp_ifap);
574 		} else {
575 			if (sctp_ifap->ifn_p) {
576 				/*
577 				 * The last IFN gets the address, remove the
578 				 * old one
579 				 */
580 				SCTPDBG(SCTP_DEBUG_PCB4, "Moving ifa %p from %s (0x%x) to %s (0x%x)\n",
581 				    (void *)sctp_ifap, sctp_ifap->ifn_p->ifn_name,
582 				    sctp_ifap->ifn_p->ifn_index, if_name,
583 				    ifn_index);
584 				/* remove the address from the old ifn */
585 				sctp_remove_ifa_from_ifn(sctp_ifap);
586 				/* move the address over to the new ifn */
587 				sctp_add_ifa_to_ifn(sctp_ifnp, sctp_ifap);
588 				goto exit_stage_left;
589 			} else {
590 				/* repair ifnp which was NULL ? */
591 				sctp_ifap->localifa_flags = SCTP_ADDR_VALID;
592 				SCTPDBG(SCTP_DEBUG_PCB4, "Repairing ifn %p for ifa %p\n",
593 				    (void *)sctp_ifnp, (void *)sctp_ifap);
594 				sctp_add_ifa_to_ifn(sctp_ifnp, sctp_ifap);
595 			}
596 			goto exit_stage_left;
597 		}
598 	}
599 	sctp_ifap = new_sctp_ifap;
600 	memset(sctp_ifap, 0, sizeof(struct sctp_ifa));
601 	sctp_ifap->ifn_p = sctp_ifnp;
602 	atomic_add_int(&sctp_ifnp->refcount, 1);
603 	sctp_ifap->vrf_id = vrf_id;
604 	sctp_ifap->ifa = ifa;
605 	memcpy(&sctp_ifap->address, addr, addr->sa_len);
606 	sctp_ifap->localifa_flags = SCTP_ADDR_VALID | SCTP_ADDR_DEFER_USE;
607 	sctp_ifap->flags = ifa_flags;
608 	/* Set scope */
609 	switch (sctp_ifap->address.sa.sa_family) {
610 #ifdef INET
611 	case AF_INET:
612 		{
613 			struct sockaddr_in *sin;
614 
615 			sin = &sctp_ifap->address.sin;
616 			if (SCTP_IFN_IS_IFT_LOOP(sctp_ifap->ifn_p) ||
617 			    (IN4_ISLOOPBACK_ADDRESS(&sin->sin_addr))) {
618 				sctp_ifap->src_is_loop = 1;
619 			}
620 			if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
621 				sctp_ifap->src_is_priv = 1;
622 			}
623 			sctp_ifnp->num_v4++;
624 			if (new_ifn_af)
625 				new_ifn_af = AF_INET;
626 			break;
627 		}
628 #endif
629 #ifdef INET6
630 	case AF_INET6:
631 		{
632 			/* ok to use deprecated addresses? */
633 			struct sockaddr_in6 *sin6;
634 
635 			sin6 = &sctp_ifap->address.sin6;
636 			if (SCTP_IFN_IS_IFT_LOOP(sctp_ifap->ifn_p) ||
637 			    (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr))) {
638 				sctp_ifap->src_is_loop = 1;
639 			}
640 			if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
641 				sctp_ifap->src_is_priv = 1;
642 			}
643 			sctp_ifnp->num_v6++;
644 			if (new_ifn_af)
645 				new_ifn_af = AF_INET6;
646 			break;
647 		}
648 #endif
649 	default:
650 		new_ifn_af = 0;
651 		break;
652 	}
653 	hash_of_addr = sctp_get_ifa_hash_val(&sctp_ifap->address.sa);
654 
655 	if ((sctp_ifap->src_is_priv == 0) &&
656 	    (sctp_ifap->src_is_loop == 0)) {
657 		sctp_ifap->src_is_glob = 1;
658 	}
659 	hash_addr_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)];
660 	LIST_INSERT_HEAD(hash_addr_head, sctp_ifap, next_bucket);
661 	sctp_ifap->refcount = 1;
662 	LIST_INSERT_HEAD(&sctp_ifnp->ifalist, sctp_ifap, next_ifa);
663 	sctp_ifnp->ifa_count++;
664 	vrf->total_ifa_count++;
665 	atomic_add_int(&SCTP_BASE_INFO(ipi_count_ifas), 1);
666 	if (new_ifn_af) {
667 		sctp_ifnp->registered_af = new_ifn_af;
668 	}
669 	SCTP_IPI_ADDR_WUNLOCK();
670 	if (new_sctp_ifnp != NULL) {
671 		SCTP_FREE(new_sctp_ifnp, SCTP_M_IFN);
672 	}
673 
674 	if (dynamic_add) {
675 		/*
676 		 * Bump up the refcount so that when the timer completes it
677 		 * will drop back down.
678 		 */
679 		struct sctp_laddr *wi;
680 
681 		atomic_add_int(&sctp_ifap->refcount, 1);
682 		wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
683 		if (wi == NULL) {
684 			/*
685 			 * Gak, what can we do? We have lost an address
686 			 * change can you say HOSED?
687 			 */
688 			SCTPDBG(SCTP_DEBUG_PCB4, "Lost an address change?\n");
689 			/* Opps, must decrement the count */
690 			sctp_del_addr_from_vrf(vrf_id, addr, ifn_index,
691 			    if_name);
692 			return (NULL);
693 		}
694 		SCTP_INCR_LADDR_COUNT();
695 		memset(wi, 0, sizeof(*wi));
696 		(void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
697 		wi->ifa = sctp_ifap;
698 		wi->action = SCTP_ADD_IP_ADDRESS;
699 
700 		SCTP_WQ_ADDR_LOCK();
701 		LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
702 		sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
703 		    (struct sctp_inpcb *)NULL,
704 		    (struct sctp_tcb *)NULL,
705 		    (struct sctp_nets *)NULL);
706 		SCTP_WQ_ADDR_UNLOCK();
707 	} else {
708 		/* it's ready for use */
709 		sctp_ifap->localifa_flags &= ~SCTP_ADDR_DEFER_USE;
710 	}
711 	return (sctp_ifap);
712 }
713 
714 void
715 sctp_del_addr_from_vrf(uint32_t vrf_id, struct sockaddr *addr,
716     uint32_t ifn_index, const char *if_name)
717 {
718 	struct sctp_vrf *vrf;
719 	struct sctp_ifa *sctp_ifap = NULL;
720 
721 	SCTP_IPI_ADDR_WLOCK();
722 	vrf = sctp_find_vrf(vrf_id);
723 	if (vrf == NULL) {
724 		SCTPDBG(SCTP_DEBUG_PCB4, "Can't find vrf_id 0x%x\n", vrf_id);
725 		goto out_now;
726 	}
727 
728 #ifdef SCTP_DEBUG
729 	SCTPDBG(SCTP_DEBUG_PCB4, "vrf_id 0x%x: deleting address:", vrf_id);
730 	SCTPDBG_ADDR(SCTP_DEBUG_PCB4, addr);
731 #endif
732 	sctp_ifap = sctp_find_ifa_by_addr(addr, vrf->vrf_id, SCTP_ADDR_LOCKED);
733 	if (sctp_ifap) {
734 		/* Validate the delete */
735 		if (sctp_ifap->ifn_p) {
736 			int valid = 0;
737 
738 			/*-
739 			 * The name has priority over the ifn_index
740 			 * if its given.
741 			 */
742 			if (if_name) {
743 				if (strncmp(if_name, sctp_ifap->ifn_p->ifn_name, SCTP_IFNAMSIZ) == 0) {
744 					/* They match its a correct delete */
745 					valid = 1;
746 				}
747 			}
748 			if (!valid) {
749 				/* last ditch check ifn_index */
750 				if (ifn_index == sctp_ifap->ifn_p->ifn_index) {
751 					valid = 1;
752 				}
753 			}
754 			if (!valid) {
755 				SCTPDBG(SCTP_DEBUG_PCB4, "ifn:%d ifname:%s does not match addresses\n",
756 				    ifn_index, ((if_name == NULL) ? "NULL" : if_name));
757 				SCTPDBG(SCTP_DEBUG_PCB4, "ifn:%d ifname:%s - ignoring delete\n",
758 				    sctp_ifap->ifn_p->ifn_index, sctp_ifap->ifn_p->ifn_name);
759 				SCTP_IPI_ADDR_WUNLOCK();
760 				return;
761 			}
762 		}
763 		SCTPDBG(SCTP_DEBUG_PCB4, "Deleting ifa %p\n", (void *)sctp_ifap);
764 		sctp_ifap->localifa_flags &= SCTP_ADDR_VALID;
765 		/*
766 		 * We don't set the flag. This means that the structure will
767 		 * hang around in EP's that have bound specific to it until
768 		 * they close. This gives us TCP like behavior if someone
769 		 * removes an address (or for that matter adds it right
770 		 * back).
771 		 */
772 		/* sctp_ifap->localifa_flags |= SCTP_BEING_DELETED; */
773 		vrf->total_ifa_count--;
774 		LIST_REMOVE(sctp_ifap, next_bucket);
775 		sctp_remove_ifa_from_ifn(sctp_ifap);
776 	}
777 #ifdef SCTP_DEBUG
778 	else {
779 		SCTPDBG(SCTP_DEBUG_PCB4, "Del Addr-ifn:%d Could not find address:",
780 		    ifn_index);
781 		SCTPDBG_ADDR(SCTP_DEBUG_PCB1, addr);
782 	}
783 #endif
784 
785 out_now:
786 	SCTP_IPI_ADDR_WUNLOCK();
787 	if (sctp_ifap) {
788 		struct sctp_laddr *wi;
789 
790 		wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
791 		if (wi == NULL) {
792 			/*
793 			 * Gak, what can we do? We have lost an address
794 			 * change can you say HOSED?
795 			 */
796 			SCTPDBG(SCTP_DEBUG_PCB4, "Lost an address change?\n");
797 
798 			/* Oops, must decrement the count */
799 			sctp_free_ifa(sctp_ifap);
800 			return;
801 		}
802 		SCTP_INCR_LADDR_COUNT();
803 		memset(wi, 0, sizeof(*wi));
804 		(void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
805 		wi->ifa = sctp_ifap;
806 		wi->action = SCTP_DEL_IP_ADDRESS;
807 		SCTP_WQ_ADDR_LOCK();
808 		/*
809 		 * Should this really be a tailq? As it is we will process
810 		 * the newest first :-0
811 		 */
812 		LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
813 		sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
814 		    (struct sctp_inpcb *)NULL,
815 		    (struct sctp_tcb *)NULL,
816 		    (struct sctp_nets *)NULL);
817 		SCTP_WQ_ADDR_UNLOCK();
818 	}
819 	return;
820 }
821 
822 static int
823 sctp_does_stcb_own_this_addr(struct sctp_tcb *stcb, struct sockaddr *to)
824 {
825 	int loopback_scope;
826 #if defined(INET)
827 	int ipv4_local_scope, ipv4_addr_legal;
828 #endif
829 #if defined(INET6)
830 	int local_scope, site_scope, ipv6_addr_legal;
831 #endif
832 	struct sctp_vrf *vrf;
833 	struct sctp_ifn *sctp_ifn;
834 	struct sctp_ifa *sctp_ifa;
835 
836 	loopback_scope = stcb->asoc.scope.loopback_scope;
837 #if defined(INET)
838 	ipv4_local_scope = stcb->asoc.scope.ipv4_local_scope;
839 	ipv4_addr_legal = stcb->asoc.scope.ipv4_addr_legal;
840 #endif
841 #if defined(INET6)
842 	local_scope = stcb->asoc.scope.local_scope;
843 	site_scope = stcb->asoc.scope.site_scope;
844 	ipv6_addr_legal = stcb->asoc.scope.ipv6_addr_legal;
845 #endif
846 
847 	SCTP_IPI_ADDR_RLOCK();
848 	vrf = sctp_find_vrf(stcb->asoc.vrf_id);
849 	if (vrf == NULL) {
850 		/* no vrf, no addresses */
851 		SCTP_IPI_ADDR_RUNLOCK();
852 		return (0);
853 	}
854 
855 	if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
856 		LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
857 			if ((loopback_scope == 0) &&
858 			    SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
859 				continue;
860 			}
861 			LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
862 				if (sctp_is_addr_restricted(stcb, sctp_ifa) &&
863 				    (!sctp_is_addr_pending(stcb, sctp_ifa))) {
864 					/*
865 					 * We allow pending addresses, where
866 					 * we have sent an asconf-add to be
867 					 * considered valid.
868 					 */
869 					continue;
870 				}
871 				if (sctp_ifa->address.sa.sa_family != to->sa_family) {
872 					continue;
873 				}
874 				switch (sctp_ifa->address.sa.sa_family) {
875 #ifdef INET
876 				case AF_INET:
877 					if (ipv4_addr_legal) {
878 						struct sockaddr_in *sin,
879 						           *rsin;
880 
881 						sin = &sctp_ifa->address.sin;
882 						rsin = (struct sockaddr_in *)to;
883 						if ((ipv4_local_scope == 0) &&
884 						    IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
885 							continue;
886 						}
887 						if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
888 						    &sin->sin_addr) != 0) {
889 							continue;
890 						}
891 						if (sin->sin_addr.s_addr == rsin->sin_addr.s_addr) {
892 							SCTP_IPI_ADDR_RUNLOCK();
893 							return (1);
894 						}
895 					}
896 					break;
897 #endif
898 #ifdef INET6
899 				case AF_INET6:
900 					if (ipv6_addr_legal) {
901 						struct sockaddr_in6 *sin6,
902 						            *rsin6;
903 
904 						sin6 = &sctp_ifa->address.sin6;
905 						rsin6 = (struct sockaddr_in6 *)to;
906 						if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
907 						    &sin6->sin6_addr) != 0) {
908 							continue;
909 						}
910 						if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
911 							if (local_scope == 0)
912 								continue;
913 							if (sin6->sin6_scope_id == 0) {
914 								if (sa6_recoverscope(sin6) != 0)
915 									continue;
916 							}
917 						}
918 						if ((site_scope == 0) &&
919 						    (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
920 							continue;
921 						}
922 						if (SCTP6_ARE_ADDR_EQUAL(sin6, rsin6)) {
923 							SCTP_IPI_ADDR_RUNLOCK();
924 							return (1);
925 						}
926 					}
927 					break;
928 #endif
929 				default:
930 					/* TSNH */
931 					break;
932 				}
933 			}
934 		}
935 	} else {
936 		struct sctp_laddr *laddr;
937 
938 		LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list, sctp_nxt_addr) {
939 			if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) {
940 				SCTPDBG(SCTP_DEBUG_PCB1, "ifa being deleted\n");
941 				continue;
942 			}
943 			if (sctp_is_addr_restricted(stcb, laddr->ifa) &&
944 			    (!sctp_is_addr_pending(stcb, laddr->ifa))) {
945 				/*
946 				 * We allow pending addresses, where we have
947 				 * sent an asconf-add to be considered
948 				 * valid.
949 				 */
950 				continue;
951 			}
952 			if (laddr->ifa->address.sa.sa_family != to->sa_family) {
953 				continue;
954 			}
955 			switch (to->sa_family) {
956 #ifdef INET
957 			case AF_INET:
958 				{
959 					struct sockaddr_in *sin, *rsin;
960 
961 					sin = &laddr->ifa->address.sin;
962 					rsin = (struct sockaddr_in *)to;
963 					if (sin->sin_addr.s_addr == rsin->sin_addr.s_addr) {
964 						SCTP_IPI_ADDR_RUNLOCK();
965 						return (1);
966 					}
967 					break;
968 				}
969 #endif
970 #ifdef INET6
971 			case AF_INET6:
972 				{
973 					struct sockaddr_in6 *sin6, *rsin6;
974 
975 					sin6 = &laddr->ifa->address.sin6;
976 					rsin6 = (struct sockaddr_in6 *)to;
977 					if (SCTP6_ARE_ADDR_EQUAL(sin6, rsin6)) {
978 						SCTP_IPI_ADDR_RUNLOCK();
979 						return (1);
980 					}
981 					break;
982 				}
983 
984 #endif
985 			default:
986 				/* TSNH */
987 				break;
988 			}
989 		}
990 	}
991 	SCTP_IPI_ADDR_RUNLOCK();
992 	return (0);
993 }
994 
995 static struct sctp_tcb *
996 sctp_tcb_special_locate(struct sctp_inpcb **inp_p, struct sockaddr *from,
997     struct sockaddr *to, struct sctp_nets **netp, uint32_t vrf_id)
998 {
999 	/**** ASSUMES THE CALLER holds the INP_INFO_RLOCK */
1000 	/*
1001 	 * If we support the TCP model, then we must now dig through to see
1002 	 * if we can find our endpoint in the list of tcp ep's.
1003 	 */
1004 	uint16_t lport, rport;
1005 	struct sctppcbhead *ephead;
1006 	struct sctp_inpcb *inp;
1007 	struct sctp_laddr *laddr;
1008 	struct sctp_tcb *stcb;
1009 	struct sctp_nets *net;
1010 
1011 	if ((to == NULL) || (from == NULL)) {
1012 		return (NULL);
1013 	}
1014 
1015 	switch (to->sa_family) {
1016 #ifdef INET
1017 	case AF_INET:
1018 		if (from->sa_family == AF_INET) {
1019 			lport = ((struct sockaddr_in *)to)->sin_port;
1020 			rport = ((struct sockaddr_in *)from)->sin_port;
1021 		} else {
1022 			return (NULL);
1023 		}
1024 		break;
1025 #endif
1026 #ifdef INET6
1027 	case AF_INET6:
1028 		if (from->sa_family == AF_INET6) {
1029 			lport = ((struct sockaddr_in6 *)to)->sin6_port;
1030 			rport = ((struct sockaddr_in6 *)from)->sin6_port;
1031 		} else {
1032 			return (NULL);
1033 		}
1034 		break;
1035 #endif
1036 	default:
1037 		return (NULL);
1038 	}
1039 	ephead = &SCTP_BASE_INFO(sctp_tcpephash)[SCTP_PCBHASH_ALLADDR((lport | rport), SCTP_BASE_INFO(hashtcpmark))];
1040 	/*
1041 	 * Ok now for each of the guys in this bucket we must look and see:
1042 	 * - Does the remote port match. - Does there single association's
1043 	 * addresses match this address (to). If so we update p_ep to point
1044 	 * to this ep and return the tcb from it.
1045 	 */
1046 	LIST_FOREACH(inp, ephead, sctp_hash) {
1047 		SCTP_INP_RLOCK(inp);
1048 		if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1049 			SCTP_INP_RUNLOCK(inp);
1050 			continue;
1051 		}
1052 		if (lport != inp->sctp_lport) {
1053 			SCTP_INP_RUNLOCK(inp);
1054 			continue;
1055 		}
1056 		switch (to->sa_family) {
1057 #ifdef INET
1058 		case AF_INET:
1059 			{
1060 				struct sockaddr_in *sin;
1061 
1062 				sin = (struct sockaddr_in *)to;
1063 				if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
1064 				    &sin->sin_addr) != 0) {
1065 					SCTP_INP_RUNLOCK(inp);
1066 					continue;
1067 				}
1068 				break;
1069 			}
1070 #endif
1071 #ifdef INET6
1072 		case AF_INET6:
1073 			{
1074 				struct sockaddr_in6 *sin6;
1075 
1076 				sin6 = (struct sockaddr_in6 *)to;
1077 				if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
1078 				    &sin6->sin6_addr) != 0) {
1079 					SCTP_INP_RUNLOCK(inp);
1080 					continue;
1081 				}
1082 				break;
1083 			}
1084 #endif
1085 		default:
1086 			SCTP_INP_RUNLOCK(inp);
1087 			continue;
1088 		}
1089 		if (inp->def_vrf_id != vrf_id) {
1090 			SCTP_INP_RUNLOCK(inp);
1091 			continue;
1092 		}
1093 		/* check to see if the ep has one of the addresses */
1094 		if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
1095 			/* We are NOT bound all, so look further */
1096 			int match = 0;
1097 
1098 			LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
1099 				if (laddr->ifa == NULL) {
1100 					SCTPDBG(SCTP_DEBUG_PCB1, "%s: NULL ifa\n", __func__);
1101 					continue;
1102 				}
1103 				if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) {
1104 					SCTPDBG(SCTP_DEBUG_PCB1, "ifa being deleted\n");
1105 					continue;
1106 				}
1107 				if (laddr->ifa->address.sa.sa_family ==
1108 				    to->sa_family) {
1109 					/* see if it matches */
1110 #ifdef INET
1111 					if (from->sa_family == AF_INET) {
1112 						struct sockaddr_in *intf_addr,
1113 						           *sin;
1114 
1115 						intf_addr = &laddr->ifa->address.sin;
1116 						sin = (struct sockaddr_in *)to;
1117 						if (sin->sin_addr.s_addr ==
1118 						    intf_addr->sin_addr.s_addr) {
1119 							match = 1;
1120 							break;
1121 						}
1122 					}
1123 #endif
1124 #ifdef INET6
1125 					if (from->sa_family == AF_INET6) {
1126 						struct sockaddr_in6 *intf_addr6;
1127 						struct sockaddr_in6 *sin6;
1128 
1129 						sin6 = (struct sockaddr_in6 *)
1130 						    to;
1131 						intf_addr6 = &laddr->ifa->address.sin6;
1132 
1133 						if (SCTP6_ARE_ADDR_EQUAL(sin6,
1134 						    intf_addr6)) {
1135 							match = 1;
1136 							break;
1137 						}
1138 					}
1139 #endif
1140 				}
1141 			}
1142 			if (match == 0) {
1143 				/* This endpoint does not have this address */
1144 				SCTP_INP_RUNLOCK(inp);
1145 				continue;
1146 			}
1147 		}
1148 		/*
1149 		 * Ok if we hit here the ep has the address, does it hold
1150 		 * the tcb?
1151 		 */
1152 		/* XXX: Why don't we TAILQ_FOREACH through sctp_asoc_list? */
1153 		stcb = LIST_FIRST(&inp->sctp_asoc_list);
1154 		if (stcb == NULL) {
1155 			SCTP_INP_RUNLOCK(inp);
1156 			continue;
1157 		}
1158 		SCTP_TCB_LOCK(stcb);
1159 		if (!sctp_does_stcb_own_this_addr(stcb, to)) {
1160 			SCTP_TCB_UNLOCK(stcb);
1161 			SCTP_INP_RUNLOCK(inp);
1162 			continue;
1163 		}
1164 		if (stcb->rport != rport) {
1165 			/* remote port does not match. */
1166 			SCTP_TCB_UNLOCK(stcb);
1167 			SCTP_INP_RUNLOCK(inp);
1168 			continue;
1169 		}
1170 		if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
1171 			SCTP_TCB_UNLOCK(stcb);
1172 			SCTP_INP_RUNLOCK(inp);
1173 			continue;
1174 		}
1175 		if (!sctp_does_stcb_own_this_addr(stcb, to)) {
1176 			SCTP_TCB_UNLOCK(stcb);
1177 			SCTP_INP_RUNLOCK(inp);
1178 			continue;
1179 		}
1180 		/* Does this TCB have a matching address? */
1181 		TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1182 			if (net->ro._l_addr.sa.sa_family != from->sa_family) {
1183 				/* not the same family, can't be a match */
1184 				continue;
1185 			}
1186 			switch (from->sa_family) {
1187 #ifdef INET
1188 			case AF_INET:
1189 				{
1190 					struct sockaddr_in *sin, *rsin;
1191 
1192 					sin = (struct sockaddr_in *)&net->ro._l_addr;
1193 					rsin = (struct sockaddr_in *)from;
1194 					if (sin->sin_addr.s_addr ==
1195 					    rsin->sin_addr.s_addr) {
1196 						/* found it */
1197 						if (netp != NULL) {
1198 							*netp = net;
1199 						}
1200 						/*
1201 						 * Update the endpoint
1202 						 * pointer
1203 						 */
1204 						*inp_p = inp;
1205 						SCTP_INP_RUNLOCK(inp);
1206 						return (stcb);
1207 					}
1208 					break;
1209 				}
1210 #endif
1211 #ifdef INET6
1212 			case AF_INET6:
1213 				{
1214 					struct sockaddr_in6 *sin6, *rsin6;
1215 
1216 					sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1217 					rsin6 = (struct sockaddr_in6 *)from;
1218 					if (SCTP6_ARE_ADDR_EQUAL(sin6,
1219 					    rsin6)) {
1220 						/* found it */
1221 						if (netp != NULL) {
1222 							*netp = net;
1223 						}
1224 						/*
1225 						 * Update the endpoint
1226 						 * pointer
1227 						 */
1228 						*inp_p = inp;
1229 						SCTP_INP_RUNLOCK(inp);
1230 						return (stcb);
1231 					}
1232 					break;
1233 				}
1234 #endif
1235 			default:
1236 				/* TSNH */
1237 				break;
1238 			}
1239 		}
1240 		SCTP_TCB_UNLOCK(stcb);
1241 		SCTP_INP_RUNLOCK(inp);
1242 	}
1243 	return (NULL);
1244 }
1245 
1246 /*
1247  * rules for use
1248  *
1249  * 1) If I return a NULL you must decrement any INP ref cnt. 2) If I find an
1250  * stcb, both will be locked (locked_tcb and stcb) but decrement will be done
1251  * (if locked == NULL). 3) Decrement happens on return ONLY if locked ==
1252  * NULL.
1253  */
1254 
1255 struct sctp_tcb *
1256 sctp_findassociation_ep_addr(struct sctp_inpcb **inp_p, struct sockaddr *remote,
1257     struct sctp_nets **netp, struct sockaddr *local, struct sctp_tcb *locked_tcb)
1258 {
1259 	struct sctpasochead *head;
1260 	struct sctp_inpcb *inp;
1261 	struct sctp_tcb *stcb = NULL;
1262 	struct sctp_nets *net;
1263 	uint16_t rport;
1264 
1265 	inp = *inp_p;
1266 	switch (remote->sa_family) {
1267 #ifdef INET
1268 	case AF_INET:
1269 		rport = (((struct sockaddr_in *)remote)->sin_port);
1270 		break;
1271 #endif
1272 #ifdef INET6
1273 	case AF_INET6:
1274 		rport = (((struct sockaddr_in6 *)remote)->sin6_port);
1275 		break;
1276 #endif
1277 	default:
1278 		return (NULL);
1279 	}
1280 	if (locked_tcb) {
1281 		/*
1282 		 * UN-lock so we can do proper locking here this occurs when
1283 		 * called from load_addresses_from_init.
1284 		 */
1285 		atomic_add_int(&locked_tcb->asoc.refcnt, 1);
1286 		SCTP_TCB_UNLOCK(locked_tcb);
1287 	}
1288 	SCTP_INP_INFO_RLOCK();
1289 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
1290 	    (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
1291 		/*-
1292 		 * Now either this guy is our listener or it's the
1293 		 * connector. If it is the one that issued the connect, then
1294 		 * it's only chance is to be the first TCB in the list. If
1295 		 * it is the acceptor, then do the special_lookup to hash
1296 		 * and find the real inp.
1297 		 */
1298 		if ((inp->sctp_socket) && SCTP_IS_LISTENING(inp)) {
1299 			/* to is peer addr, from is my addr */
1300 			stcb = sctp_tcb_special_locate(inp_p, remote, local,
1301 			    netp, inp->def_vrf_id);
1302 			if ((stcb != NULL) && (locked_tcb == NULL)) {
1303 				/* we have a locked tcb, lower refcount */
1304 				SCTP_INP_DECR_REF(inp);
1305 			}
1306 			if ((locked_tcb != NULL) && (locked_tcb != stcb)) {
1307 				SCTP_INP_RLOCK(locked_tcb->sctp_ep);
1308 				SCTP_TCB_LOCK(locked_tcb);
1309 				atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1310 				SCTP_INP_RUNLOCK(locked_tcb->sctp_ep);
1311 			}
1312 			SCTP_INP_INFO_RUNLOCK();
1313 			return (stcb);
1314 		} else {
1315 			SCTP_INP_WLOCK(inp);
1316 			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1317 				goto null_return;
1318 			}
1319 			stcb = LIST_FIRST(&inp->sctp_asoc_list);
1320 			if (stcb == NULL) {
1321 				goto null_return;
1322 			}
1323 			SCTP_TCB_LOCK(stcb);
1324 
1325 			if (stcb->rport != rport) {
1326 				/* remote port does not match. */
1327 				SCTP_TCB_UNLOCK(stcb);
1328 				goto null_return;
1329 			}
1330 			if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
1331 				SCTP_TCB_UNLOCK(stcb);
1332 				goto null_return;
1333 			}
1334 			if (local && !sctp_does_stcb_own_this_addr(stcb, local)) {
1335 				SCTP_TCB_UNLOCK(stcb);
1336 				goto null_return;
1337 			}
1338 			/* now look at the list of remote addresses */
1339 			TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1340 #ifdef INVARIANTS
1341 				if (net == (TAILQ_NEXT(net, sctp_next))) {
1342 					panic("Corrupt net list");
1343 				}
1344 #endif
1345 				if (net->ro._l_addr.sa.sa_family !=
1346 				    remote->sa_family) {
1347 					/* not the same family */
1348 					continue;
1349 				}
1350 				switch (remote->sa_family) {
1351 #ifdef INET
1352 				case AF_INET:
1353 					{
1354 						struct sockaddr_in *sin,
1355 						           *rsin;
1356 
1357 						sin = (struct sockaddr_in *)
1358 						    &net->ro._l_addr;
1359 						rsin = (struct sockaddr_in *)remote;
1360 						if (sin->sin_addr.s_addr ==
1361 						    rsin->sin_addr.s_addr) {
1362 							/* found it */
1363 							if (netp != NULL) {
1364 								*netp = net;
1365 							}
1366 							if (locked_tcb == NULL) {
1367 								SCTP_INP_DECR_REF(inp);
1368 							} else if (locked_tcb != stcb) {
1369 								SCTP_TCB_LOCK(locked_tcb);
1370 							}
1371 							if (locked_tcb) {
1372 								atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1373 							}
1374 
1375 							SCTP_INP_WUNLOCK(inp);
1376 							SCTP_INP_INFO_RUNLOCK();
1377 							return (stcb);
1378 						}
1379 						break;
1380 					}
1381 #endif
1382 #ifdef INET6
1383 				case AF_INET6:
1384 					{
1385 						struct sockaddr_in6 *sin6,
1386 						            *rsin6;
1387 
1388 						sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1389 						rsin6 = (struct sockaddr_in6 *)remote;
1390 						if (SCTP6_ARE_ADDR_EQUAL(sin6,
1391 						    rsin6)) {
1392 							/* found it */
1393 							if (netp != NULL) {
1394 								*netp = net;
1395 							}
1396 							if (locked_tcb == NULL) {
1397 								SCTP_INP_DECR_REF(inp);
1398 							} else if (locked_tcb != stcb) {
1399 								SCTP_TCB_LOCK(locked_tcb);
1400 							}
1401 							if (locked_tcb) {
1402 								atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1403 							}
1404 							SCTP_INP_WUNLOCK(inp);
1405 							SCTP_INP_INFO_RUNLOCK();
1406 							return (stcb);
1407 						}
1408 						break;
1409 					}
1410 #endif
1411 				default:
1412 					/* TSNH */
1413 					break;
1414 				}
1415 			}
1416 			SCTP_TCB_UNLOCK(stcb);
1417 		}
1418 	} else {
1419 		SCTP_INP_WLOCK(inp);
1420 		if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1421 			goto null_return;
1422 		}
1423 		head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(rport,
1424 		    inp->sctp_hashmark)];
1425 		LIST_FOREACH(stcb, head, sctp_tcbhash) {
1426 			if (stcb->rport != rport) {
1427 				/* remote port does not match */
1428 				continue;
1429 			}
1430 			SCTP_TCB_LOCK(stcb);
1431 			if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
1432 				SCTP_TCB_UNLOCK(stcb);
1433 				continue;
1434 			}
1435 			if (local && !sctp_does_stcb_own_this_addr(stcb, local)) {
1436 				SCTP_TCB_UNLOCK(stcb);
1437 				continue;
1438 			}
1439 			/* now look at the list of remote addresses */
1440 			TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1441 #ifdef INVARIANTS
1442 				if (net == (TAILQ_NEXT(net, sctp_next))) {
1443 					panic("Corrupt net list");
1444 				}
1445 #endif
1446 				if (net->ro._l_addr.sa.sa_family !=
1447 				    remote->sa_family) {
1448 					/* not the same family */
1449 					continue;
1450 				}
1451 				switch (remote->sa_family) {
1452 #ifdef INET
1453 				case AF_INET:
1454 					{
1455 						struct sockaddr_in *sin,
1456 						           *rsin;
1457 
1458 						sin = (struct sockaddr_in *)
1459 						    &net->ro._l_addr;
1460 						rsin = (struct sockaddr_in *)remote;
1461 						if (sin->sin_addr.s_addr ==
1462 						    rsin->sin_addr.s_addr) {
1463 							/* found it */
1464 							if (netp != NULL) {
1465 								*netp = net;
1466 							}
1467 							if (locked_tcb == NULL) {
1468 								SCTP_INP_DECR_REF(inp);
1469 							} else if (locked_tcb != stcb) {
1470 								SCTP_TCB_LOCK(locked_tcb);
1471 							}
1472 							if (locked_tcb) {
1473 								atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1474 							}
1475 							SCTP_INP_WUNLOCK(inp);
1476 							SCTP_INP_INFO_RUNLOCK();
1477 							return (stcb);
1478 						}
1479 						break;
1480 					}
1481 #endif
1482 #ifdef INET6
1483 				case AF_INET6:
1484 					{
1485 						struct sockaddr_in6 *sin6,
1486 						            *rsin6;
1487 
1488 						sin6 = (struct sockaddr_in6 *)
1489 						    &net->ro._l_addr;
1490 						rsin6 = (struct sockaddr_in6 *)remote;
1491 						if (SCTP6_ARE_ADDR_EQUAL(sin6,
1492 						    rsin6)) {
1493 							/* found it */
1494 							if (netp != NULL) {
1495 								*netp = net;
1496 							}
1497 							if (locked_tcb == NULL) {
1498 								SCTP_INP_DECR_REF(inp);
1499 							} else if (locked_tcb != stcb) {
1500 								SCTP_TCB_LOCK(locked_tcb);
1501 							}
1502 							if (locked_tcb) {
1503 								atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1504 							}
1505 							SCTP_INP_WUNLOCK(inp);
1506 							SCTP_INP_INFO_RUNLOCK();
1507 							return (stcb);
1508 						}
1509 						break;
1510 					}
1511 #endif
1512 				default:
1513 					/* TSNH */
1514 					break;
1515 				}
1516 			}
1517 			SCTP_TCB_UNLOCK(stcb);
1518 		}
1519 	}
1520 null_return:
1521 	/* clean up for returning null */
1522 	if (locked_tcb) {
1523 		SCTP_TCB_LOCK(locked_tcb);
1524 		atomic_subtract_int(&locked_tcb->asoc.refcnt, 1);
1525 	}
1526 	SCTP_INP_WUNLOCK(inp);
1527 	SCTP_INP_INFO_RUNLOCK();
1528 	/* not found */
1529 	return (NULL);
1530 }
1531 
1532 /*
1533  * Find an association for a specific endpoint using the association id given
1534  * out in the COMM_UP notification
1535  */
1536 struct sctp_tcb *
1537 sctp_findasoc_ep_asocid_locked(struct sctp_inpcb *inp, sctp_assoc_t asoc_id, int want_lock)
1538 {
1539 	/*
1540 	 * Use my the assoc_id to find a endpoint
1541 	 */
1542 	struct sctpasochead *head;
1543 	struct sctp_tcb *stcb;
1544 	uint32_t id;
1545 
1546 	if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1547 		SCTP_PRINTF("TSNH ep_associd0\n");
1548 		return (NULL);
1549 	}
1550 	id = (uint32_t)asoc_id;
1551 	head = &inp->sctp_asocidhash[SCTP_PCBHASH_ASOC(id, inp->hashasocidmark)];
1552 	if (head == NULL) {
1553 		/* invalid id TSNH */
1554 		SCTP_PRINTF("TSNH ep_associd1\n");
1555 		return (NULL);
1556 	}
1557 	LIST_FOREACH(stcb, head, sctp_tcbasocidhash) {
1558 		if (stcb->asoc.assoc_id == id) {
1559 			if (inp != stcb->sctp_ep) {
1560 				/*
1561 				 * some other guy has the same id active (id
1562 				 * collision ??).
1563 				 */
1564 				SCTP_PRINTF("TSNH ep_associd2\n");
1565 				continue;
1566 			}
1567 			if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
1568 				continue;
1569 			}
1570 			if (want_lock) {
1571 				SCTP_TCB_LOCK(stcb);
1572 			}
1573 			return (stcb);
1574 		}
1575 	}
1576 	return (NULL);
1577 }
1578 
1579 struct sctp_tcb *
1580 sctp_findassociation_ep_asocid(struct sctp_inpcb *inp, sctp_assoc_t asoc_id, int want_lock)
1581 {
1582 	struct sctp_tcb *stcb;
1583 
1584 	SCTP_INP_RLOCK(inp);
1585 	stcb = sctp_findasoc_ep_asocid_locked(inp, asoc_id, want_lock);
1586 	SCTP_INP_RUNLOCK(inp);
1587 	return (stcb);
1588 }
1589 
1590 /*
1591  * Endpoint probe expects that the INP_INFO is locked.
1592  */
1593 static struct sctp_inpcb *
1594 sctp_endpoint_probe(struct sockaddr *nam, struct sctppcbhead *head,
1595     uint16_t lport, uint32_t vrf_id)
1596 {
1597 	struct sctp_inpcb *inp;
1598 	struct sctp_laddr *laddr;
1599 #ifdef INET
1600 	struct sockaddr_in *sin;
1601 #endif
1602 #ifdef INET6
1603 	struct sockaddr_in6 *sin6;
1604 	struct sockaddr_in6 *intf_addr6;
1605 #endif
1606 	int fnd;
1607 
1608 #ifdef INET
1609 	sin = NULL;
1610 #endif
1611 #ifdef INET6
1612 	sin6 = NULL;
1613 #endif
1614 	switch (nam->sa_family) {
1615 #ifdef INET
1616 	case AF_INET:
1617 		sin = (struct sockaddr_in *)nam;
1618 		break;
1619 #endif
1620 #ifdef INET6
1621 	case AF_INET6:
1622 		sin6 = (struct sockaddr_in6 *)nam;
1623 		break;
1624 #endif
1625 	default:
1626 		/* unsupported family */
1627 		return (NULL);
1628 	}
1629 
1630 	if (head == NULL)
1631 		return (NULL);
1632 
1633 	LIST_FOREACH(inp, head, sctp_hash) {
1634 		SCTP_INP_RLOCK(inp);
1635 		if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1636 			SCTP_INP_RUNLOCK(inp);
1637 			continue;
1638 		}
1639 		if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) &&
1640 		    (inp->sctp_lport == lport)) {
1641 			/* got it */
1642 			switch (nam->sa_family) {
1643 #ifdef INET
1644 			case AF_INET:
1645 				if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1646 				    SCTP_IPV6_V6ONLY(inp)) {
1647 					/*
1648 					 * IPv4 on a IPv6 socket with ONLY
1649 					 * IPv6 set
1650 					 */
1651 					SCTP_INP_RUNLOCK(inp);
1652 					continue;
1653 				}
1654 				if (prison_check_ip4(inp->ip_inp.inp.inp_cred,
1655 				    &sin->sin_addr) != 0) {
1656 					SCTP_INP_RUNLOCK(inp);
1657 					continue;
1658 				}
1659 				break;
1660 #endif
1661 #ifdef INET6
1662 			case AF_INET6:
1663 				/*
1664 				 * A V6 address and the endpoint is NOT
1665 				 * bound V6
1666 				 */
1667 				if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
1668 					SCTP_INP_RUNLOCK(inp);
1669 					continue;
1670 				}
1671 				if (prison_check_ip6(inp->ip_inp.inp.inp_cred,
1672 				    &sin6->sin6_addr) != 0) {
1673 					SCTP_INP_RUNLOCK(inp);
1674 					continue;
1675 				}
1676 				break;
1677 #endif
1678 			default:
1679 				break;
1680 			}
1681 			/* does a VRF id match? */
1682 			fnd = 0;
1683 			if (inp->def_vrf_id == vrf_id)
1684 				fnd = 1;
1685 
1686 			SCTP_INP_RUNLOCK(inp);
1687 			if (!fnd)
1688 				continue;
1689 			return (inp);
1690 		}
1691 		SCTP_INP_RUNLOCK(inp);
1692 	}
1693 	switch (nam->sa_family) {
1694 #ifdef INET
1695 	case AF_INET:
1696 		if (sin->sin_addr.s_addr == INADDR_ANY) {
1697 			/* Can't hunt for one that has no address specified */
1698 			return (NULL);
1699 		}
1700 		break;
1701 #endif
1702 #ifdef INET6
1703 	case AF_INET6:
1704 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
1705 			/* Can't hunt for one that has no address specified */
1706 			return (NULL);
1707 		}
1708 		break;
1709 #endif
1710 	default:
1711 		break;
1712 	}
1713 	/*
1714 	 * ok, not bound to all so see if we can find a EP bound to this
1715 	 * address.
1716 	 */
1717 	LIST_FOREACH(inp, head, sctp_hash) {
1718 		SCTP_INP_RLOCK(inp);
1719 		if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1720 			SCTP_INP_RUNLOCK(inp);
1721 			continue;
1722 		}
1723 		if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL)) {
1724 			SCTP_INP_RUNLOCK(inp);
1725 			continue;
1726 		}
1727 		/*
1728 		 * Ok this could be a likely candidate, look at all of its
1729 		 * addresses
1730 		 */
1731 		if (inp->sctp_lport != lport) {
1732 			SCTP_INP_RUNLOCK(inp);
1733 			continue;
1734 		}
1735 		/* does a VRF id match? */
1736 		fnd = 0;
1737 		if (inp->def_vrf_id == vrf_id)
1738 			fnd = 1;
1739 
1740 		if (!fnd) {
1741 			SCTP_INP_RUNLOCK(inp);
1742 			continue;
1743 		}
1744 		LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
1745 			if (laddr->ifa == NULL) {
1746 				SCTPDBG(SCTP_DEBUG_PCB1, "%s: NULL ifa\n",
1747 				    __func__);
1748 				continue;
1749 			}
1750 			SCTPDBG(SCTP_DEBUG_PCB1, "Ok laddr->ifa:%p is possible, ",
1751 			    (void *)laddr->ifa);
1752 			if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) {
1753 				SCTPDBG(SCTP_DEBUG_PCB1, "Huh IFA being deleted\n");
1754 				continue;
1755 			}
1756 			if (laddr->ifa->address.sa.sa_family == nam->sa_family) {
1757 				/* possible, see if it matches */
1758 				switch (nam->sa_family) {
1759 #ifdef INET
1760 				case AF_INET:
1761 					if (sin->sin_addr.s_addr ==
1762 					    laddr->ifa->address.sin.sin_addr.s_addr) {
1763 						SCTP_INP_RUNLOCK(inp);
1764 						return (inp);
1765 					}
1766 					break;
1767 #endif
1768 #ifdef INET6
1769 				case AF_INET6:
1770 					intf_addr6 = &laddr->ifa->address.sin6;
1771 					if (SCTP6_ARE_ADDR_EQUAL(sin6,
1772 					    intf_addr6)) {
1773 						SCTP_INP_RUNLOCK(inp);
1774 						return (inp);
1775 					}
1776 					break;
1777 #endif
1778 				}
1779 			}
1780 		}
1781 		SCTP_INP_RUNLOCK(inp);
1782 	}
1783 	return (NULL);
1784 }
1785 
1786 static struct sctp_inpcb *
1787 sctp_isport_inuse(struct sctp_inpcb *inp, uint16_t lport, uint32_t vrf_id)
1788 {
1789 	struct sctppcbhead *head;
1790 	struct sctp_inpcb *t_inp;
1791 	int fnd;
1792 
1793 	head = &SCTP_BASE_INFO(sctp_ephash)[SCTP_PCBHASH_ALLADDR(lport,
1794 	    SCTP_BASE_INFO(hashmark))];
1795 	LIST_FOREACH(t_inp, head, sctp_hash) {
1796 		if (t_inp->sctp_lport != lport) {
1797 			continue;
1798 		}
1799 		/* is it in the VRF in question */
1800 		fnd = 0;
1801 		if (t_inp->def_vrf_id == vrf_id)
1802 			fnd = 1;
1803 		if (!fnd)
1804 			continue;
1805 
1806 		/* This one is in use. */
1807 		/* check the v6/v4 binding issue */
1808 		if ((t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1809 		    SCTP_IPV6_V6ONLY(t_inp)) {
1810 			if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1811 				/* collision in V6 space */
1812 				return (t_inp);
1813 			} else {
1814 				/* inp is BOUND_V4 no conflict */
1815 				continue;
1816 			}
1817 		} else if (t_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1818 			/* t_inp is bound v4 and v6, conflict always */
1819 			return (t_inp);
1820 		} else {
1821 			/* t_inp is bound only V4 */
1822 			if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
1823 			    SCTP_IPV6_V6ONLY(inp)) {
1824 				/* no conflict */
1825 				continue;
1826 			}
1827 			/* else fall through to conflict */
1828 		}
1829 		return (t_inp);
1830 	}
1831 	return (NULL);
1832 }
1833 
1834 int
1835 sctp_swap_inpcb_for_listen(struct sctp_inpcb *inp)
1836 {
1837 	/* For 1-2-1 with port reuse */
1838 	struct sctppcbhead *head;
1839 	struct sctp_inpcb *tinp, *ninp;
1840 
1841 	SCTP_INP_INFO_WLOCK_ASSERT();
1842 	SCTP_INP_WLOCK_ASSERT(inp);
1843 
1844 	if (sctp_is_feature_off(inp, SCTP_PCB_FLAGS_PORTREUSE)) {
1845 		/* only works with port reuse on */
1846 		return (-1);
1847 	}
1848 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) == 0) {
1849 		return (0);
1850 	}
1851 	SCTP_INP_WUNLOCK(inp);
1852 	head = &SCTP_BASE_INFO(sctp_ephash)[SCTP_PCBHASH_ALLADDR(inp->sctp_lport,
1853 	    SCTP_BASE_INFO(hashmark))];
1854 	/* Kick out all non-listeners to the TCP hash */
1855 	LIST_FOREACH_SAFE(tinp, head, sctp_hash, ninp) {
1856 		if (tinp->sctp_lport != inp->sctp_lport) {
1857 			continue;
1858 		}
1859 		if (tinp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
1860 			continue;
1861 		}
1862 		if (tinp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
1863 			continue;
1864 		}
1865 		if (SCTP_IS_LISTENING(tinp)) {
1866 			continue;
1867 		}
1868 		SCTP_INP_WLOCK(tinp);
1869 		LIST_REMOVE(tinp, sctp_hash);
1870 		head = &SCTP_BASE_INFO(sctp_tcpephash)[SCTP_PCBHASH_ALLADDR(tinp->sctp_lport, SCTP_BASE_INFO(hashtcpmark))];
1871 		tinp->sctp_flags |= SCTP_PCB_FLAGS_IN_TCPPOOL;
1872 		LIST_INSERT_HEAD(head, tinp, sctp_hash);
1873 		SCTP_INP_WUNLOCK(tinp);
1874 	}
1875 	SCTP_INP_WLOCK(inp);
1876 	/* Pull from where he was */
1877 	LIST_REMOVE(inp, sctp_hash);
1878 	inp->sctp_flags &= ~SCTP_PCB_FLAGS_IN_TCPPOOL;
1879 	head = &SCTP_BASE_INFO(sctp_ephash)[SCTP_PCBHASH_ALLADDR(inp->sctp_lport, SCTP_BASE_INFO(hashmark))];
1880 	LIST_INSERT_HEAD(head, inp, sctp_hash);
1881 	return (0);
1882 }
1883 
1884 struct sctp_inpcb *
1885 sctp_pcb_findep(struct sockaddr *nam, int find_tcp_pool, int have_lock,
1886     uint32_t vrf_id)
1887 {
1888 	/*
1889 	 * First we check the hash table to see if someone has this port
1890 	 * bound with just the port.
1891 	 */
1892 	struct sctp_inpcb *inp;
1893 	struct sctppcbhead *head;
1894 	int lport;
1895 	unsigned int i;
1896 #ifdef INET
1897 	struct sockaddr_in *sin;
1898 #endif
1899 #ifdef INET6
1900 	struct sockaddr_in6 *sin6;
1901 #endif
1902 
1903 	switch (nam->sa_family) {
1904 #ifdef INET
1905 	case AF_INET:
1906 		sin = (struct sockaddr_in *)nam;
1907 		lport = sin->sin_port;
1908 		break;
1909 #endif
1910 #ifdef INET6
1911 	case AF_INET6:
1912 		sin6 = (struct sockaddr_in6 *)nam;
1913 		lport = sin6->sin6_port;
1914 		break;
1915 #endif
1916 	default:
1917 		return (NULL);
1918 	}
1919 	/*
1920 	 * I could cheat here and just cast to one of the types but we will
1921 	 * do it right. It also provides the check against an Unsupported
1922 	 * type too.
1923 	 */
1924 	/* Find the head of the ALLADDR chain */
1925 	if (have_lock == 0) {
1926 		SCTP_INP_INFO_RLOCK();
1927 	}
1928 	head = &SCTP_BASE_INFO(sctp_ephash)[SCTP_PCBHASH_ALLADDR(lport,
1929 	    SCTP_BASE_INFO(hashmark))];
1930 	inp = sctp_endpoint_probe(nam, head, lport, vrf_id);
1931 
1932 	/*
1933 	 * If the TCP model exists it could be that the main listening
1934 	 * endpoint is gone but there still exists a connected socket for
1935 	 * this guy. If so we can return the first one that we find. This
1936 	 * may NOT be the correct one so the caller should be wary on the
1937 	 * returned INP. Currently the only caller that sets find_tcp_pool
1938 	 * is in bindx where we are verifying that a user CAN bind the
1939 	 * address. He either has bound it already, or someone else has, or
1940 	 * its open to bind, so this is good enough.
1941 	 */
1942 	if (inp == NULL && find_tcp_pool) {
1943 		for (i = 0; i < SCTP_BASE_INFO(hashtcpmark) + 1; i++) {
1944 			head = &SCTP_BASE_INFO(sctp_tcpephash)[i];
1945 			inp = sctp_endpoint_probe(nam, head, lport, vrf_id);
1946 			if (inp) {
1947 				break;
1948 			}
1949 		}
1950 	}
1951 	if (inp) {
1952 		SCTP_INP_INCR_REF(inp);
1953 	}
1954 	if (have_lock == 0) {
1955 		SCTP_INP_INFO_RUNLOCK();
1956 	}
1957 	return (inp);
1958 }
1959 
1960 /*
1961  * Find an association for an endpoint with the pointer to whom you want to
1962  * send to and the endpoint pointer. The address can be IPv4 or IPv6. We may
1963  * need to change the *to to some other struct like a mbuf...
1964  */
1965 struct sctp_tcb *
1966 sctp_findassociation_addr_sa(struct sockaddr *from, struct sockaddr *to,
1967     struct sctp_inpcb **inp_p, struct sctp_nets **netp, int find_tcp_pool,
1968     uint32_t vrf_id)
1969 {
1970 	struct sctp_inpcb *inp = NULL;
1971 	struct sctp_tcb *stcb;
1972 
1973 	SCTP_INP_INFO_RLOCK();
1974 	if (find_tcp_pool) {
1975 		if (inp_p != NULL) {
1976 			stcb = sctp_tcb_special_locate(inp_p, from, to, netp,
1977 			    vrf_id);
1978 		} else {
1979 			stcb = sctp_tcb_special_locate(&inp, from, to, netp,
1980 			    vrf_id);
1981 		}
1982 		if (stcb != NULL) {
1983 			SCTP_INP_INFO_RUNLOCK();
1984 			return (stcb);
1985 		}
1986 	}
1987 	inp = sctp_pcb_findep(to, 0, 1, vrf_id);
1988 	if (inp_p != NULL) {
1989 		*inp_p = inp;
1990 	}
1991 	SCTP_INP_INFO_RUNLOCK();
1992 	if (inp == NULL) {
1993 		return (NULL);
1994 	}
1995 	/*
1996 	 * ok, we have an endpoint, now lets find the assoc for it (if any)
1997 	 * we now place the source address or from in the to of the find
1998 	 * endpoint call. Since in reality this chain is used from the
1999 	 * inbound packet side.
2000 	 */
2001 	if (inp_p != NULL) {
2002 		stcb = sctp_findassociation_ep_addr(inp_p, from, netp, to,
2003 		    NULL);
2004 	} else {
2005 		stcb = sctp_findassociation_ep_addr(&inp, from, netp, to,
2006 		    NULL);
2007 	}
2008 	return (stcb);
2009 }
2010 
2011 /*
2012  * This routine will grub through the mbuf that is a INIT or INIT-ACK and
2013  * find all addresses that the sender has specified in any address list. Each
2014  * address will be used to lookup the TCB and see if one exits.
2015  */
2016 static struct sctp_tcb *
2017 sctp_findassociation_special_addr(struct mbuf *m, int offset,
2018     struct sctphdr *sh, struct sctp_inpcb **inp_p, struct sctp_nets **netp,
2019     struct sockaddr *dst)
2020 {
2021 	struct sctp_paramhdr *phdr, param_buf;
2022 #if defined(INET) || defined(INET6)
2023 	struct sctp_tcb *stcb;
2024 	uint16_t ptype;
2025 #endif
2026 	uint16_t plen;
2027 #ifdef INET
2028 	struct sockaddr_in sin4;
2029 #endif
2030 #ifdef INET6
2031 	struct sockaddr_in6 sin6;
2032 #endif
2033 
2034 #ifdef INET
2035 	memset(&sin4, 0, sizeof(sin4));
2036 	sin4.sin_len = sizeof(sin4);
2037 	sin4.sin_family = AF_INET;
2038 	sin4.sin_port = sh->src_port;
2039 #endif
2040 #ifdef INET6
2041 	memset(&sin6, 0, sizeof(sin6));
2042 	sin6.sin6_len = sizeof(sin6);
2043 	sin6.sin6_family = AF_INET6;
2044 	sin6.sin6_port = sh->src_port;
2045 #endif
2046 
2047 	offset += sizeof(struct sctp_init_chunk);
2048 
2049 	phdr = sctp_get_next_param(m, offset, &param_buf, sizeof(param_buf));
2050 	while (phdr != NULL) {
2051 		/* now we must see if we want the parameter */
2052 #if defined(INET) || defined(INET6)
2053 		ptype = ntohs(phdr->param_type);
2054 #endif
2055 		plen = ntohs(phdr->param_length);
2056 		if (plen == 0) {
2057 			break;
2058 		}
2059 #ifdef INET
2060 		if (ptype == SCTP_IPV4_ADDRESS &&
2061 		    plen == sizeof(struct sctp_ipv4addr_param)) {
2062 			/* Get the rest of the address */
2063 			struct sctp_ipv4addr_param ip4_param, *p4;
2064 
2065 			phdr = sctp_get_next_param(m, offset,
2066 			    (struct sctp_paramhdr *)&ip4_param, sizeof(ip4_param));
2067 			if (phdr == NULL) {
2068 				return (NULL);
2069 			}
2070 			p4 = (struct sctp_ipv4addr_param *)phdr;
2071 			memcpy(&sin4.sin_addr, &p4->addr, sizeof(p4->addr));
2072 			/* look it up */
2073 			stcb = sctp_findassociation_ep_addr(inp_p,
2074 			    (struct sockaddr *)&sin4, netp, dst, NULL);
2075 			if (stcb != NULL) {
2076 				return (stcb);
2077 			}
2078 		}
2079 #endif
2080 #ifdef INET6
2081 		if (ptype == SCTP_IPV6_ADDRESS &&
2082 		    plen == sizeof(struct sctp_ipv6addr_param)) {
2083 			/* Get the rest of the address */
2084 			struct sctp_ipv6addr_param ip6_param, *p6;
2085 
2086 			phdr = sctp_get_next_param(m, offset,
2087 			    (struct sctp_paramhdr *)&ip6_param, sizeof(ip6_param));
2088 			if (phdr == NULL) {
2089 				return (NULL);
2090 			}
2091 			p6 = (struct sctp_ipv6addr_param *)phdr;
2092 			memcpy(&sin6.sin6_addr, &p6->addr, sizeof(p6->addr));
2093 			/* look it up */
2094 			stcb = sctp_findassociation_ep_addr(inp_p,
2095 			    (struct sockaddr *)&sin6, netp, dst, NULL);
2096 			if (stcb != NULL) {
2097 				return (stcb);
2098 			}
2099 		}
2100 #endif
2101 		offset += SCTP_SIZE32(plen);
2102 		phdr = sctp_get_next_param(m, offset, &param_buf,
2103 		    sizeof(param_buf));
2104 	}
2105 	return (NULL);
2106 }
2107 
2108 static struct sctp_tcb *
2109 sctp_findassoc_by_vtag(struct sockaddr *from, struct sockaddr *to, uint32_t vtag,
2110     struct sctp_inpcb **inp_p, struct sctp_nets **netp, uint16_t rport,
2111     uint16_t lport, int skip_src_check, uint32_t vrf_id, uint32_t remote_tag)
2112 {
2113 	/*
2114 	 * Use my vtag to hash. If we find it we then verify the source addr
2115 	 * is in the assoc. If all goes well we save a bit on rec of a
2116 	 * packet.
2117 	 */
2118 	struct sctpasochead *head;
2119 	struct sctp_nets *net;
2120 	struct sctp_tcb *stcb;
2121 
2122 	SCTP_INP_INFO_RLOCK();
2123 	head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(vtag,
2124 	    SCTP_BASE_INFO(hashasocmark))];
2125 	LIST_FOREACH(stcb, head, sctp_asocs) {
2126 		SCTP_INP_RLOCK(stcb->sctp_ep);
2127 		if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
2128 			SCTP_INP_RUNLOCK(stcb->sctp_ep);
2129 			continue;
2130 		}
2131 		if (stcb->sctp_ep->def_vrf_id != vrf_id) {
2132 			SCTP_INP_RUNLOCK(stcb->sctp_ep);
2133 			continue;
2134 		}
2135 		SCTP_TCB_LOCK(stcb);
2136 		SCTP_INP_RUNLOCK(stcb->sctp_ep);
2137 		if (stcb->asoc.my_vtag == vtag) {
2138 			/* candidate */
2139 			if (stcb->rport != rport) {
2140 				SCTP_TCB_UNLOCK(stcb);
2141 				continue;
2142 			}
2143 			if (stcb->sctp_ep->sctp_lport != lport) {
2144 				SCTP_TCB_UNLOCK(stcb);
2145 				continue;
2146 			}
2147 			if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
2148 				SCTP_TCB_UNLOCK(stcb);
2149 				continue;
2150 			}
2151 			/* RRS:Need toaddr check here */
2152 			if (sctp_does_stcb_own_this_addr(stcb, to) == 0) {
2153 				/* Endpoint does not own this address */
2154 				SCTP_TCB_UNLOCK(stcb);
2155 				continue;
2156 			}
2157 			if (remote_tag) {
2158 				/*
2159 				 * If we have both vtags that's all we match
2160 				 * on
2161 				 */
2162 				if (stcb->asoc.peer_vtag == remote_tag) {
2163 					/*
2164 					 * If both tags match we consider it
2165 					 * conclusive and check NO
2166 					 * source/destination addresses
2167 					 */
2168 					goto conclusive;
2169 				}
2170 			}
2171 			if (skip_src_check) {
2172 		conclusive:
2173 				if (from) {
2174 					*netp = sctp_findnet(stcb, from);
2175 				} else {
2176 					*netp = NULL;	/* unknown */
2177 				}
2178 				if (inp_p)
2179 					*inp_p = stcb->sctp_ep;
2180 				SCTP_INP_INFO_RUNLOCK();
2181 				return (stcb);
2182 			}
2183 			net = sctp_findnet(stcb, from);
2184 			if (net) {
2185 				/* yep its him. */
2186 				*netp = net;
2187 				SCTP_STAT_INCR(sctps_vtagexpress);
2188 				*inp_p = stcb->sctp_ep;
2189 				SCTP_INP_INFO_RUNLOCK();
2190 				return (stcb);
2191 			} else {
2192 				/*
2193 				 * not him, this should only happen in rare
2194 				 * cases so I peg it.
2195 				 */
2196 				SCTP_STAT_INCR(sctps_vtagbogus);
2197 			}
2198 		}
2199 		SCTP_TCB_UNLOCK(stcb);
2200 	}
2201 	SCTP_INP_INFO_RUNLOCK();
2202 	return (NULL);
2203 }
2204 
2205 /*
2206  * Find an association with the pointer to the inbound IP packet. This can be
2207  * a IPv4 or IPv6 packet.
2208  */
2209 struct sctp_tcb *
2210 sctp_findassociation_addr(struct mbuf *m, int offset,
2211     struct sockaddr *src, struct sockaddr *dst,
2212     struct sctphdr *sh, struct sctp_chunkhdr *ch,
2213     struct sctp_inpcb **inp_p, struct sctp_nets **netp, uint32_t vrf_id)
2214 {
2215 	struct sctp_tcb *stcb;
2216 	struct sctp_inpcb *inp;
2217 
2218 	if (sh->v_tag) {
2219 		/* we only go down this path if vtag is non-zero */
2220 		stcb = sctp_findassoc_by_vtag(src, dst, ntohl(sh->v_tag),
2221 		    inp_p, netp, sh->src_port, sh->dest_port, 0, vrf_id, 0);
2222 		if (stcb) {
2223 			return (stcb);
2224 		}
2225 	}
2226 
2227 	if (inp_p) {
2228 		stcb = sctp_findassociation_addr_sa(src, dst, inp_p, netp,
2229 		    1, vrf_id);
2230 		inp = *inp_p;
2231 	} else {
2232 		stcb = sctp_findassociation_addr_sa(src, dst, &inp, netp,
2233 		    1, vrf_id);
2234 	}
2235 	SCTPDBG(SCTP_DEBUG_PCB1, "stcb:%p inp:%p\n", (void *)stcb, (void *)inp);
2236 	if (stcb == NULL && inp) {
2237 		/* Found a EP but not this address */
2238 		if ((ch->chunk_type == SCTP_INITIATION) ||
2239 		    (ch->chunk_type == SCTP_INITIATION_ACK)) {
2240 			/*-
2241 			 * special hook, we do NOT return linp or an
2242 			 * association that is linked to an existing
2243 			 * association that is under the TCP pool (i.e. no
2244 			 * listener exists). The endpoint finding routine
2245 			 * will always find a listener before examining the
2246 			 * TCP pool.
2247 			 */
2248 			if (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) {
2249 				if (inp_p) {
2250 					*inp_p = NULL;
2251 				}
2252 				return (NULL);
2253 			}
2254 			stcb = sctp_findassociation_special_addr(m,
2255 			    offset, sh, &inp, netp, dst);
2256 			if (inp_p != NULL) {
2257 				*inp_p = inp;
2258 			}
2259 		}
2260 	}
2261 	SCTPDBG(SCTP_DEBUG_PCB1, "stcb is %p\n", (void *)stcb);
2262 	return (stcb);
2263 }
2264 
2265 /*
2266  * lookup an association by an ASCONF lookup address.
2267  * if the lookup address is 0.0.0.0 or ::0, use the vtag to do the lookup
2268  */
2269 struct sctp_tcb *
2270 sctp_findassociation_ep_asconf(struct mbuf *m, int offset,
2271     struct sockaddr *dst, struct sctphdr *sh,
2272     struct sctp_inpcb **inp_p, struct sctp_nets **netp, uint32_t vrf_id)
2273 {
2274 	struct sctp_tcb *stcb;
2275 	union sctp_sockstore remote_store;
2276 	struct sctp_paramhdr param_buf, *phdr;
2277 	int ptype;
2278 	int zero_address = 0;
2279 #ifdef INET
2280 	struct sockaddr_in *sin;
2281 #endif
2282 #ifdef INET6
2283 	struct sockaddr_in6 *sin6;
2284 #endif
2285 
2286 	memset(&remote_store, 0, sizeof(remote_store));
2287 	phdr = sctp_get_next_param(m, offset + sizeof(struct sctp_asconf_chunk),
2288 	    &param_buf, sizeof(struct sctp_paramhdr));
2289 	if (phdr == NULL) {
2290 		SCTPDBG(SCTP_DEBUG_INPUT3, "%s: failed to get asconf lookup addr\n",
2291 		    __func__);
2292 		return NULL;
2293 	}
2294 	ptype = (int)((uint32_t)ntohs(phdr->param_type));
2295 	/* get the correlation address */
2296 	switch (ptype) {
2297 #ifdef INET6
2298 	case SCTP_IPV6_ADDRESS:
2299 		{
2300 			/* ipv6 address param */
2301 			struct sctp_ipv6addr_param *p6, p6_buf;
2302 
2303 			if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv6addr_param)) {
2304 				return NULL;
2305 			}
2306 			p6 = (struct sctp_ipv6addr_param *)sctp_get_next_param(m,
2307 			    offset + sizeof(struct sctp_asconf_chunk),
2308 			    &p6_buf.ph, sizeof(p6_buf));
2309 			if (p6 == NULL) {
2310 				SCTPDBG(SCTP_DEBUG_INPUT3, "%s: failed to get asconf v6 lookup addr\n",
2311 				    __func__);
2312 				return (NULL);
2313 			}
2314 			sin6 = &remote_store.sin6;
2315 			sin6->sin6_family = AF_INET6;
2316 			sin6->sin6_len = sizeof(*sin6);
2317 			sin6->sin6_port = sh->src_port;
2318 			memcpy(&sin6->sin6_addr, &p6->addr, sizeof(struct in6_addr));
2319 			if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
2320 				zero_address = 1;
2321 			break;
2322 		}
2323 #endif
2324 #ifdef INET
2325 	case SCTP_IPV4_ADDRESS:
2326 		{
2327 			/* ipv4 address param */
2328 			struct sctp_ipv4addr_param *p4, p4_buf;
2329 
2330 			if (ntohs(phdr->param_length) != sizeof(struct sctp_ipv4addr_param)) {
2331 				return NULL;
2332 			}
2333 			p4 = (struct sctp_ipv4addr_param *)sctp_get_next_param(m,
2334 			    offset + sizeof(struct sctp_asconf_chunk),
2335 			    &p4_buf.ph, sizeof(p4_buf));
2336 			if (p4 == NULL) {
2337 				SCTPDBG(SCTP_DEBUG_INPUT3, "%s: failed to get asconf v4 lookup addr\n",
2338 				    __func__);
2339 				return (NULL);
2340 			}
2341 			sin = &remote_store.sin;
2342 			sin->sin_family = AF_INET;
2343 			sin->sin_len = sizeof(*sin);
2344 			sin->sin_port = sh->src_port;
2345 			memcpy(&sin->sin_addr, &p4->addr, sizeof(struct in_addr));
2346 			if (sin->sin_addr.s_addr == INADDR_ANY)
2347 				zero_address = 1;
2348 			break;
2349 		}
2350 #endif
2351 	default:
2352 		/* invalid address param type */
2353 		return NULL;
2354 	}
2355 
2356 	if (zero_address) {
2357 		stcb = sctp_findassoc_by_vtag(NULL, dst, ntohl(sh->v_tag), inp_p,
2358 		    netp, sh->src_port, sh->dest_port, 1, vrf_id, 0);
2359 		if (stcb != NULL) {
2360 			SCTP_INP_DECR_REF(*inp_p);
2361 		}
2362 	} else {
2363 		stcb = sctp_findassociation_ep_addr(inp_p,
2364 		    &remote_store.sa, netp,
2365 		    dst, NULL);
2366 	}
2367 	return (stcb);
2368 }
2369 
2370 /*
2371  * allocate a sctp_inpcb and setup a temporary binding to a port/all
2372  * addresses. This way if we don't get a bind we by default pick a ephemeral
2373  * port with all addresses bound.
2374  */
2375 int
2376 sctp_inpcb_alloc(struct socket *so, uint32_t vrf_id)
2377 {
2378 	/*
2379 	 * we get called when a new endpoint starts up. We need to allocate
2380 	 * the sctp_inpcb structure from the zone and init it. Mark it as
2381 	 * unbound and find a port that we can use as an ephemeral with
2382 	 * INADDR_ANY. If the user binds later no problem we can then add in
2383 	 * the specific addresses. And setup the default parameters for the
2384 	 * EP.
2385 	 */
2386 	int i, error;
2387 	struct sctp_inpcb *inp;
2388 	struct sctp_pcb *m;
2389 	struct timeval time;
2390 	sctp_sharedkey_t *null_key;
2391 
2392 	error = 0;
2393 
2394 	SCTP_INP_INFO_WLOCK();
2395 	inp = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_ep), struct sctp_inpcb);
2396 	if (inp == NULL) {
2397 		SCTP_PRINTF("Out of SCTP-INPCB structures - no resources\n");
2398 		SCTP_INP_INFO_WUNLOCK();
2399 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOBUFS);
2400 		return (ENOBUFS);
2401 	}
2402 	/* zap it */
2403 	memset(inp, 0, sizeof(*inp));
2404 
2405 	/* bump generations */
2406 	/* setup socket pointers */
2407 	inp->sctp_socket = so;
2408 	inp->ip_inp.inp.inp_socket = so;
2409 	inp->ip_inp.inp.inp_cred = crhold(so->so_cred);
2410 #ifdef INET6
2411 	if (INP_SOCKAF(so) == AF_INET6) {
2412 		if (MODULE_GLOBAL(ip6_auto_flowlabel)) {
2413 			inp->ip_inp.inp.inp_flags |= IN6P_AUTOFLOWLABEL;
2414 		}
2415 		if (MODULE_GLOBAL(ip6_v6only)) {
2416 			inp->ip_inp.inp.inp_flags |= IN6P_IPV6_V6ONLY;
2417 		}
2418 	}
2419 #endif
2420 	inp->sctp_associd_counter = 1;
2421 	inp->partial_delivery_point = SCTP_SB_LIMIT_RCV(so) >> SCTP_PARTIAL_DELIVERY_SHIFT;
2422 	inp->sctp_frag_point = 0;
2423 	inp->max_cwnd = 0;
2424 	inp->sctp_cmt_on_off = SCTP_BASE_SYSCTL(sctp_cmt_on_off);
2425 	inp->ecn_supported = (uint8_t)SCTP_BASE_SYSCTL(sctp_ecn_enable);
2426 	inp->prsctp_supported = (uint8_t)SCTP_BASE_SYSCTL(sctp_pr_enable);
2427 	inp->auth_supported = (uint8_t)SCTP_BASE_SYSCTL(sctp_auth_enable);
2428 	inp->asconf_supported = (uint8_t)SCTP_BASE_SYSCTL(sctp_asconf_enable);
2429 	inp->reconfig_supported = (uint8_t)SCTP_BASE_SYSCTL(sctp_reconfig_enable);
2430 	inp->nrsack_supported = (uint8_t)SCTP_BASE_SYSCTL(sctp_nrsack_enable);
2431 	inp->pktdrop_supported = (uint8_t)SCTP_BASE_SYSCTL(sctp_pktdrop_enable);
2432 	inp->idata_supported = 0;
2433 	inp->rcv_edmid = SCTP_EDMID_NONE;
2434 
2435 	inp->fibnum = so->so_fibnum;
2436 	/* init the small hash table we use to track asocid <-> tcb */
2437 	inp->sctp_asocidhash = SCTP_HASH_INIT(SCTP_STACK_VTAG_HASH_SIZE, &inp->hashasocidmark);
2438 	if (inp->sctp_asocidhash == NULL) {
2439 		crfree(inp->ip_inp.inp.inp_cred);
2440 		SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_ep), inp);
2441 		SCTP_INP_INFO_WUNLOCK();
2442 		return (ENOBUFS);
2443 	}
2444 	SCTP_INCR_EP_COUNT();
2445 	inp->ip_inp.inp.inp_ip_ttl = MODULE_GLOBAL(ip_defttl);
2446 	SCTP_INP_INFO_WUNLOCK();
2447 
2448 	so->so_pcb = (caddr_t)inp;
2449 
2450 	if (SCTP_SO_TYPE(so) == SOCK_SEQPACKET) {
2451 		/* UDP style socket */
2452 		inp->sctp_flags = (SCTP_PCB_FLAGS_UDPTYPE |
2453 		    SCTP_PCB_FLAGS_UNBOUND);
2454 		/* Be sure it is NON-BLOCKING IO for UDP */
2455 		/* SCTP_SET_SO_NBIO(so); */
2456 	} else if (SCTP_SO_TYPE(so) == SOCK_STREAM) {
2457 		/* TCP style socket */
2458 		inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
2459 		    SCTP_PCB_FLAGS_UNBOUND);
2460 		/* Be sure we have blocking IO by default */
2461 		SOCK_LOCK(so);
2462 		SCTP_CLEAR_SO_NBIO(so);
2463 		SOCK_UNLOCK(so);
2464 	} else {
2465 		/*
2466 		 * unsupported socket type (RAW, etc)- in case we missed it
2467 		 * in protosw
2468 		 */
2469 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EOPNOTSUPP);
2470 		so->so_pcb = NULL;
2471 		crfree(inp->ip_inp.inp.inp_cred);
2472 		SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_ep), inp);
2473 		return (EOPNOTSUPP);
2474 	}
2475 	if (SCTP_BASE_SYSCTL(sctp_default_frag_interleave) == SCTP_FRAG_LEVEL_1) {
2476 		sctp_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE);
2477 		sctp_feature_off(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS);
2478 	} else if (SCTP_BASE_SYSCTL(sctp_default_frag_interleave) == SCTP_FRAG_LEVEL_2) {
2479 		sctp_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE);
2480 		sctp_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS);
2481 	} else if (SCTP_BASE_SYSCTL(sctp_default_frag_interleave) == SCTP_FRAG_LEVEL_0) {
2482 		sctp_feature_off(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE);
2483 		sctp_feature_off(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS);
2484 	}
2485 	inp->sctp_tcbhash = SCTP_HASH_INIT(SCTP_BASE_SYSCTL(sctp_pcbtblsize),
2486 	    &inp->sctp_hashmark);
2487 	if (inp->sctp_tcbhash == NULL) {
2488 		SCTP_PRINTF("Out of SCTP-INPCB->hashinit - no resources\n");
2489 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOBUFS);
2490 		so->so_pcb = NULL;
2491 		crfree(inp->ip_inp.inp.inp_cred);
2492 		SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_ep), inp);
2493 		return (ENOBUFS);
2494 	}
2495 	inp->def_vrf_id = vrf_id;
2496 
2497 	SCTP_INP_INFO_WLOCK();
2498 	SCTP_INP_LOCK_INIT(inp);
2499 	rw_init_flags(&inp->ip_inp.inp.inp_lock, "sctpinp",
2500 	    RW_RECURSE | RW_DUPOK);
2501 	SCTP_INP_READ_LOCK_INIT(inp);
2502 	SCTP_ASOC_CREATE_LOCK_INIT(inp);
2503 	/* lock the new ep */
2504 	SCTP_INP_WLOCK(inp);
2505 
2506 	/* add it to the info area */
2507 	LIST_INSERT_HEAD(&SCTP_BASE_INFO(listhead), inp, sctp_list);
2508 	SCTP_INP_INFO_WUNLOCK();
2509 
2510 	TAILQ_INIT(&inp->read_queue);
2511 	LIST_INIT(&inp->sctp_addr_list);
2512 
2513 	LIST_INIT(&inp->sctp_asoc_list);
2514 
2515 #ifdef SCTP_TRACK_FREED_ASOCS
2516 	/* TEMP CODE */
2517 	LIST_INIT(&inp->sctp_asoc_free_list);
2518 #endif
2519 	/* Init the timer structure for signature change */
2520 	SCTP_OS_TIMER_INIT(&inp->sctp_ep.signature_change.timer);
2521 	inp->sctp_ep.signature_change.type = SCTP_TIMER_TYPE_NEWCOOKIE;
2522 
2523 	/* now init the actual endpoint default data */
2524 	m = &inp->sctp_ep;
2525 
2526 	/* setup the base timeout information */
2527 	m->sctp_timeoutticks[SCTP_TIMER_SEND] = sctp_secs_to_ticks(SCTP_SEND_SEC);	/* needed ? */
2528 	m->sctp_timeoutticks[SCTP_TIMER_INIT] = sctp_secs_to_ticks(SCTP_INIT_SEC);	/* needed ? */
2529 	m->sctp_timeoutticks[SCTP_TIMER_RECV] = sctp_msecs_to_ticks(SCTP_BASE_SYSCTL(sctp_delayed_sack_time_default));
2530 	m->sctp_timeoutticks[SCTP_TIMER_HEARTBEAT] = sctp_msecs_to_ticks(SCTP_BASE_SYSCTL(sctp_heartbeat_interval_default));
2531 	m->sctp_timeoutticks[SCTP_TIMER_PMTU] = sctp_secs_to_ticks(SCTP_BASE_SYSCTL(sctp_pmtu_raise_time_default));
2532 	m->sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] = sctp_secs_to_ticks(SCTP_BASE_SYSCTL(sctp_shutdown_guard_time_default));
2533 	m->sctp_timeoutticks[SCTP_TIMER_SIGNATURE] = sctp_secs_to_ticks(SCTP_BASE_SYSCTL(sctp_secret_lifetime_default));
2534 	/* all max/min max are in ms */
2535 	m->sctp_maxrto = SCTP_BASE_SYSCTL(sctp_rto_max_default);
2536 	m->sctp_minrto = SCTP_BASE_SYSCTL(sctp_rto_min_default);
2537 	m->initial_rto = SCTP_BASE_SYSCTL(sctp_rto_initial_default);
2538 	m->initial_init_rto_max = SCTP_BASE_SYSCTL(sctp_init_rto_max_default);
2539 	m->sctp_sack_freq = SCTP_BASE_SYSCTL(sctp_sack_freq_default);
2540 	m->max_init_times = SCTP_BASE_SYSCTL(sctp_init_rtx_max_default);
2541 	m->max_send_times = SCTP_BASE_SYSCTL(sctp_assoc_rtx_max_default);
2542 	m->def_net_failure = SCTP_BASE_SYSCTL(sctp_path_rtx_max_default);
2543 	m->def_net_pf_threshold = SCTP_BASE_SYSCTL(sctp_path_pf_threshold);
2544 	m->sctp_sws_sender = SCTP_SWS_SENDER_DEF;
2545 	m->sctp_sws_receiver = SCTP_SWS_RECEIVER_DEF;
2546 	m->max_burst = SCTP_BASE_SYSCTL(sctp_max_burst_default);
2547 	m->fr_max_burst = SCTP_BASE_SYSCTL(sctp_fr_max_burst_default);
2548 
2549 	m->sctp_default_cc_module = SCTP_BASE_SYSCTL(sctp_default_cc_module);
2550 	m->sctp_default_ss_module = SCTP_BASE_SYSCTL(sctp_default_ss_module);
2551 	m->max_open_streams_intome = SCTP_BASE_SYSCTL(sctp_nr_incoming_streams_default);
2552 	/* number of streams to pre-open on a association */
2553 	m->pre_open_stream_count = SCTP_BASE_SYSCTL(sctp_nr_outgoing_streams_default);
2554 
2555 	m->default_mtu = 0;
2556 	/* Add adaptation cookie */
2557 	m->adaptation_layer_indicator = 0;
2558 	m->adaptation_layer_indicator_provided = 0;
2559 
2560 	/* seed random number generator */
2561 	m->random_counter = 1;
2562 	m->store_at = SCTP_SIGNATURE_SIZE;
2563 	SCTP_READ_RANDOM(m->random_numbers, sizeof(m->random_numbers));
2564 	sctp_fill_random_store(m);
2565 
2566 	/* Minimum cookie size */
2567 	m->size_of_a_cookie = (sizeof(struct sctp_init_msg) * 2) +
2568 	    sizeof(struct sctp_state_cookie);
2569 	m->size_of_a_cookie += SCTP_SIGNATURE_SIZE;
2570 
2571 	/* Setup the initial secret */
2572 	(void)SCTP_GETTIME_TIMEVAL(&time);
2573 	m->time_of_secret_change = (unsigned int)time.tv_sec;
2574 
2575 	for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
2576 		m->secret_key[0][i] = sctp_select_initial_TSN(m);
2577 	}
2578 	sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL);
2579 
2580 	/* How long is a cookie good for ? */
2581 	m->def_cookie_life = sctp_msecs_to_ticks(SCTP_BASE_SYSCTL(sctp_valid_cookie_life_default));
2582 	/*
2583 	 * Initialize authentication parameters
2584 	 */
2585 	m->local_hmacs = sctp_default_supported_hmaclist();
2586 	m->local_auth_chunks = sctp_alloc_chunklist();
2587 	if (inp->asconf_supported) {
2588 		sctp_auth_add_chunk(SCTP_ASCONF, m->local_auth_chunks);
2589 		sctp_auth_add_chunk(SCTP_ASCONF_ACK, m->local_auth_chunks);
2590 	}
2591 	m->default_dscp = 0;
2592 #ifdef INET6
2593 	m->default_flowlabel = 0;
2594 #endif
2595 	m->port = 0;		/* encapsulation disabled by default */
2596 	LIST_INIT(&m->shared_keys);
2597 	/* add default NULL key as key id 0 */
2598 	null_key = sctp_alloc_sharedkey();
2599 	sctp_insert_sharedkey(&m->shared_keys, null_key);
2600 	SCTP_INP_WUNLOCK(inp);
2601 #ifdef SCTP_LOG_CLOSING
2602 	sctp_log_closing(inp, NULL, 12);
2603 #endif
2604 	return (error);
2605 }
2606 
2607 void
2608 sctp_move_pcb_and_assoc(struct sctp_inpcb *old_inp, struct sctp_inpcb *new_inp,
2609     struct sctp_tcb *stcb)
2610 {
2611 	struct sctp_nets *net;
2612 	uint16_t lport, rport;
2613 	struct sctppcbhead *head;
2614 	struct sctp_laddr *laddr, *oladdr;
2615 
2616 	atomic_add_int(&stcb->asoc.refcnt, 1);
2617 	SCTP_TCB_UNLOCK(stcb);
2618 	SCTP_INP_INFO_WLOCK();
2619 	SCTP_INP_WLOCK(old_inp);
2620 	SCTP_INP_WLOCK(new_inp);
2621 	SCTP_TCB_LOCK(stcb);
2622 	atomic_subtract_int(&stcb->asoc.refcnt, 1);
2623 
2624 #ifdef INET6
2625 	if (old_inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2626 		new_inp->ip_inp.inp.inp_flags |= old_inp->ip_inp.inp.inp_flags & INP_CONTROLOPTS;
2627 		if (old_inp->ip_inp.inp.in6p_outputopts) {
2628 			new_inp->ip_inp.inp.in6p_outputopts = ip6_copypktopts(old_inp->ip_inp.inp.in6p_outputopts, M_NOWAIT);
2629 		}
2630 	}
2631 #endif
2632 #if defined(INET) && defined(INET6)
2633 	else
2634 #endif
2635 #ifdef INET
2636 	{
2637 		new_inp->ip_inp.inp.inp_ip_tos = old_inp->ip_inp.inp.inp_ip_tos;
2638 		new_inp->ip_inp.inp.inp_ip_ttl = old_inp->ip_inp.inp.inp_ip_ttl;
2639 	}
2640 #endif
2641 	new_inp->sctp_ep.time_of_secret_change =
2642 	    old_inp->sctp_ep.time_of_secret_change;
2643 	memcpy(new_inp->sctp_ep.secret_key, old_inp->sctp_ep.secret_key,
2644 	    sizeof(old_inp->sctp_ep.secret_key));
2645 	new_inp->sctp_ep.current_secret_number =
2646 	    old_inp->sctp_ep.current_secret_number;
2647 	new_inp->sctp_ep.last_secret_number =
2648 	    old_inp->sctp_ep.last_secret_number;
2649 	new_inp->sctp_ep.size_of_a_cookie = old_inp->sctp_ep.size_of_a_cookie;
2650 
2651 	/* make it so new data pours into the new socket */
2652 	stcb->sctp_socket = new_inp->sctp_socket;
2653 	stcb->sctp_ep = new_inp;
2654 
2655 	/* Copy the port across */
2656 	lport = new_inp->sctp_lport = old_inp->sctp_lport;
2657 	rport = stcb->rport;
2658 	/* Pull the tcb from the old association */
2659 	LIST_REMOVE(stcb, sctp_tcbhash);
2660 	LIST_REMOVE(stcb, sctp_tcblist);
2661 	if (stcb->asoc.in_asocid_hash) {
2662 		LIST_REMOVE(stcb, sctp_tcbasocidhash);
2663 	}
2664 	/* Now insert the new_inp into the TCP connected hash */
2665 	head = &SCTP_BASE_INFO(sctp_tcpephash)[SCTP_PCBHASH_ALLADDR((lport | rport), SCTP_BASE_INFO(hashtcpmark))];
2666 
2667 	LIST_INSERT_HEAD(head, new_inp, sctp_hash);
2668 	/* Its safe to access */
2669 	new_inp->sctp_flags &= ~SCTP_PCB_FLAGS_UNBOUND;
2670 
2671 	/* Now move the tcb into the endpoint list */
2672 	LIST_INSERT_HEAD(&new_inp->sctp_asoc_list, stcb, sctp_tcblist);
2673 	/*
2674 	 * Question, do we even need to worry about the ep-hash since we
2675 	 * only have one connection? Probably not :> so lets get rid of it
2676 	 * and not suck up any kernel memory in that.
2677 	 */
2678 	if (stcb->asoc.in_asocid_hash) {
2679 		struct sctpasochead *lhd;
2680 
2681 		lhd = &new_inp->sctp_asocidhash[SCTP_PCBHASH_ASOC(stcb->asoc.assoc_id,
2682 		    new_inp->hashasocidmark)];
2683 		LIST_INSERT_HEAD(lhd, stcb, sctp_tcbasocidhash);
2684 	}
2685 	/* Ok. Let's restart timer. */
2686 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2687 		sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, new_inp,
2688 		    stcb, net);
2689 	}
2690 
2691 	SCTP_INP_INFO_WUNLOCK();
2692 	if (new_inp->sctp_tcbhash != NULL) {
2693 		SCTP_HASH_FREE(new_inp->sctp_tcbhash, new_inp->sctp_hashmark);
2694 		new_inp->sctp_tcbhash = NULL;
2695 	}
2696 	if ((new_inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
2697 		/* Subset bound, so copy in the laddr list from the old_inp */
2698 		LIST_FOREACH(oladdr, &old_inp->sctp_addr_list, sctp_nxt_addr) {
2699 			laddr = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
2700 			if (laddr == NULL) {
2701 				/*
2702 				 * Gak, what can we do? This assoc is really
2703 				 * HOSED. We probably should send an abort
2704 				 * here.
2705 				 */
2706 				SCTPDBG(SCTP_DEBUG_PCB1, "Association hosed in TCP model, out of laddr memory\n");
2707 				continue;
2708 			}
2709 			SCTP_INCR_LADDR_COUNT();
2710 			memset(laddr, 0, sizeof(*laddr));
2711 			(void)SCTP_GETTIME_TIMEVAL(&laddr->start_time);
2712 			laddr->ifa = oladdr->ifa;
2713 			atomic_add_int(&laddr->ifa->refcount, 1);
2714 			LIST_INSERT_HEAD(&new_inp->sctp_addr_list, laddr,
2715 			    sctp_nxt_addr);
2716 			new_inp->laddr_count++;
2717 			if (oladdr == stcb->asoc.last_used_address) {
2718 				stcb->asoc.last_used_address = laddr;
2719 			}
2720 		}
2721 	}
2722 	/* Now any running timers need to be adjusted. */
2723 	if (stcb->asoc.dack_timer.ep == old_inp) {
2724 		SCTP_INP_DECR_REF(old_inp);
2725 		stcb->asoc.dack_timer.ep = new_inp;
2726 		SCTP_INP_INCR_REF(new_inp);
2727 	}
2728 	if (stcb->asoc.asconf_timer.ep == old_inp) {
2729 		SCTP_INP_DECR_REF(old_inp);
2730 		stcb->asoc.asconf_timer.ep = new_inp;
2731 		SCTP_INP_INCR_REF(new_inp);
2732 	}
2733 	if (stcb->asoc.strreset_timer.ep == old_inp) {
2734 		SCTP_INP_DECR_REF(old_inp);
2735 		stcb->asoc.strreset_timer.ep = new_inp;
2736 		SCTP_INP_INCR_REF(new_inp);
2737 	}
2738 	if (stcb->asoc.shut_guard_timer.ep == old_inp) {
2739 		SCTP_INP_DECR_REF(old_inp);
2740 		stcb->asoc.shut_guard_timer.ep = new_inp;
2741 		SCTP_INP_INCR_REF(new_inp);
2742 	}
2743 	if (stcb->asoc.autoclose_timer.ep == old_inp) {
2744 		SCTP_INP_DECR_REF(old_inp);
2745 		stcb->asoc.autoclose_timer.ep = new_inp;
2746 		SCTP_INP_INCR_REF(new_inp);
2747 	}
2748 	if (stcb->asoc.delete_prim_timer.ep == old_inp) {
2749 		SCTP_INP_DECR_REF(old_inp);
2750 		stcb->asoc.delete_prim_timer.ep = new_inp;
2751 		SCTP_INP_INCR_REF(new_inp);
2752 	}
2753 	/* now what about the nets? */
2754 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
2755 		if (net->pmtu_timer.ep == old_inp) {
2756 			SCTP_INP_DECR_REF(old_inp);
2757 			net->pmtu_timer.ep = new_inp;
2758 			SCTP_INP_INCR_REF(new_inp);
2759 		}
2760 		if (net->hb_timer.ep == old_inp) {
2761 			SCTP_INP_DECR_REF(old_inp);
2762 			net->hb_timer.ep = new_inp;
2763 			SCTP_INP_INCR_REF(new_inp);
2764 		}
2765 		if (net->rxt_timer.ep == old_inp) {
2766 			SCTP_INP_DECR_REF(old_inp);
2767 			net->rxt_timer.ep = new_inp;
2768 			SCTP_INP_INCR_REF(new_inp);
2769 		}
2770 	}
2771 	SCTP_INP_WUNLOCK(new_inp);
2772 	SCTP_INP_WUNLOCK(old_inp);
2773 }
2774 
2775 /*
2776  * insert an laddr entry with the given ifa for the desired list
2777  */
2778 static int
2779 sctp_insert_laddr(struct sctpladdr *list, struct sctp_ifa *ifa, uint32_t act)
2780 {
2781 	struct sctp_laddr *laddr;
2782 
2783 	laddr = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
2784 	if (laddr == NULL) {
2785 		/* out of memory? */
2786 		SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
2787 		return (EINVAL);
2788 	}
2789 	SCTP_INCR_LADDR_COUNT();
2790 	memset(laddr, 0, sizeof(*laddr));
2791 	(void)SCTP_GETTIME_TIMEVAL(&laddr->start_time);
2792 	laddr->ifa = ifa;
2793 	laddr->action = act;
2794 	atomic_add_int(&ifa->refcount, 1);
2795 	/* insert it */
2796 	LIST_INSERT_HEAD(list, laddr, sctp_nxt_addr);
2797 
2798 	return (0);
2799 }
2800 
2801 /*
2802  * Remove an laddr entry from the local address list (on an assoc)
2803  */
2804 static void
2805 sctp_remove_laddr(struct sctp_laddr *laddr)
2806 {
2807 
2808 	/* remove from the list */
2809 	LIST_REMOVE(laddr, sctp_nxt_addr);
2810 	sctp_free_ifa(laddr->ifa);
2811 	SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), laddr);
2812 	SCTP_DECR_LADDR_COUNT();
2813 }
2814 
2815 /*
2816  * Bind the socket, with the PCB and global info locks held.  Note, if a
2817  * socket address is specified, the PCB lock may be dropped and re-acquired.
2818  *
2819  * sctp_ifap is used to bypass normal local address validation checks.
2820  */
2821 int
2822 sctp_inpcb_bind_locked(struct sctp_inpcb *inp, struct sockaddr *addr,
2823     struct sctp_ifa *sctp_ifap, struct thread *td)
2824 {
2825 	/* bind a ep to a socket address */
2826 	struct sctppcbhead *head;
2827 	struct sctp_inpcb *inp_tmp;
2828 	struct inpcb *ip_inp;
2829 	int port_reuse_active = 0;
2830 	int bindall;
2831 	uint16_t lport;
2832 	int error;
2833 	uint32_t vrf_id;
2834 
2835 	KASSERT(td != NULL, ("%s: null thread", __func__));
2836 
2837 	error = 0;
2838 	lport = 0;
2839 	bindall = 1;
2840 	ip_inp = &inp->ip_inp.inp;
2841 
2842 	SCTP_INP_INFO_WLOCK_ASSERT();
2843 	SCTP_INP_WLOCK_ASSERT(inp);
2844 
2845 #ifdef SCTP_DEBUG
2846 	if (addr) {
2847 		SCTPDBG(SCTP_DEBUG_PCB1, "Bind called port: %d\n",
2848 		    ntohs(((struct sockaddr_in *)addr)->sin_port));
2849 		SCTPDBG(SCTP_DEBUG_PCB1, "Addr: ");
2850 		SCTPDBG_ADDR(SCTP_DEBUG_PCB1, addr);
2851 	}
2852 #endif
2853 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) == 0) {
2854 		error = EINVAL;
2855 		/* already did a bind, subsequent binds NOT allowed ! */
2856 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
2857 		goto out;
2858 	}
2859 	if (addr != NULL) {
2860 		switch (addr->sa_family) {
2861 #ifdef INET
2862 		case AF_INET:
2863 			{
2864 				struct sockaddr_in *sin;
2865 
2866 				/* IPV6_V6ONLY socket? */
2867 				if (SCTP_IPV6_V6ONLY(inp)) {
2868 					error = EINVAL;
2869 					SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
2870 					goto out;
2871 				}
2872 				if (addr->sa_len != sizeof(*sin)) {
2873 					error = EINVAL;
2874 					SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
2875 					goto out;
2876 				}
2877 
2878 				sin = (struct sockaddr_in *)addr;
2879 				lport = sin->sin_port;
2880 				/*
2881 				 * For LOOPBACK the prison_local_ip4() call
2882 				 * will transmute the ip address to the
2883 				 * proper value.
2884 				 */
2885 				if ((error = prison_local_ip4(td->td_ucred, &sin->sin_addr)) != 0) {
2886 					SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
2887 					goto out;
2888 				}
2889 				if (sin->sin_addr.s_addr != INADDR_ANY) {
2890 					bindall = 0;
2891 				}
2892 				break;
2893 			}
2894 #endif
2895 #ifdef INET6
2896 		case AF_INET6:
2897 			{
2898 				/*
2899 				 * Only for pure IPv6 Address. (No IPv4
2900 				 * Mapped!)
2901 				 */
2902 				struct sockaddr_in6 *sin6;
2903 
2904 				sin6 = (struct sockaddr_in6 *)addr;
2905 				if (addr->sa_len != sizeof(*sin6)) {
2906 					error = EINVAL;
2907 					SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
2908 					goto out;
2909 				}
2910 				lport = sin6->sin6_port;
2911 				/*
2912 				 * For LOOPBACK the prison_local_ip6() call
2913 				 * will transmute the ipv6 address to the
2914 				 * proper value.
2915 				 */
2916 				if ((error = prison_local_ip6(td->td_ucred, &sin6->sin6_addr,
2917 				    (SCTP_IPV6_V6ONLY(inp) != 0))) != 0) {
2918 					SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
2919 					goto out;
2920 				}
2921 				if (!IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
2922 					bindall = 0;
2923 					/* KAME hack: embed scopeid */
2924 					if (sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone)) != 0) {
2925 						error = EINVAL;
2926 						SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
2927 						goto out;
2928 					}
2929 				}
2930 				/* this must be cleared for ifa_ifwithaddr() */
2931 				sin6->sin6_scope_id = 0;
2932 				break;
2933 			}
2934 #endif
2935 		default:
2936 			error = EAFNOSUPPORT;
2937 			SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
2938 			goto out;
2939 		}
2940 	}
2941 	/* Setup a vrf_id to be the default for the non-bind-all case. */
2942 	vrf_id = inp->def_vrf_id;
2943 
2944 	if (lport) {
2945 		/*
2946 		 * Did the caller specify a port? if so we must see if an ep
2947 		 * already has this one bound.
2948 		 */
2949 		/* got to be root to get at low ports */
2950 		if (ntohs(lport) < IPPORT_RESERVED &&
2951 		    (error = priv_check(td, PRIV_NETINET_RESERVEDPORT)) != 0) {
2952 			goto out;
2953 		}
2954 		SCTP_INP_INCR_REF(inp);
2955 		SCTP_INP_WUNLOCK(inp);
2956 		if (bindall) {
2957 			vrf_id = inp->def_vrf_id;
2958 			inp_tmp = sctp_pcb_findep(addr, 0, 1, vrf_id);
2959 			if (inp_tmp != NULL) {
2960 				/*
2961 				 * lock guy returned and lower count note
2962 				 * that we are not bound so inp_tmp should
2963 				 * NEVER be inp. And it is this inp
2964 				 * (inp_tmp) that gets the reference bump,
2965 				 * so we must lower it.
2966 				 */
2967 				SCTP_INP_DECR_REF(inp_tmp);
2968 				/* unlock info */
2969 				if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_PORTREUSE)) &&
2970 				    (sctp_is_feature_on(inp_tmp, SCTP_PCB_FLAGS_PORTREUSE))) {
2971 					/*
2972 					 * Ok, must be one-2-one and
2973 					 * allowing port re-use
2974 					 */
2975 					port_reuse_active = 1;
2976 					goto continue_anyway;
2977 				}
2978 				SCTP_INP_WLOCK(inp);
2979 				SCTP_INP_DECR_REF(inp);
2980 				error = EADDRINUSE;
2981 				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
2982 				goto out;
2983 			}
2984 		} else {
2985 			inp_tmp = sctp_pcb_findep(addr, 0, 1, vrf_id);
2986 			if (inp_tmp != NULL) {
2987 				/*
2988 				 * lock guy returned and lower count note
2989 				 * that we are not bound so inp_tmp should
2990 				 * NEVER be inp. And it is this inp
2991 				 * (inp_tmp) that gets the reference bump,
2992 				 * so we must lower it.
2993 				 */
2994 				SCTP_INP_DECR_REF(inp_tmp);
2995 				/* unlock info */
2996 				if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_PORTREUSE)) &&
2997 				    (sctp_is_feature_on(inp_tmp, SCTP_PCB_FLAGS_PORTREUSE))) {
2998 					/*
2999 					 * Ok, must be one-2-one and
3000 					 * allowing port re-use
3001 					 */
3002 					port_reuse_active = 1;
3003 					goto continue_anyway;
3004 				}
3005 				SCTP_INP_WLOCK(inp);
3006 				SCTP_INP_DECR_REF(inp);
3007 				error = EADDRINUSE;
3008 				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
3009 				goto out;
3010 			}
3011 		}
3012 continue_anyway:
3013 		SCTP_INP_WLOCK(inp);
3014 		SCTP_INP_DECR_REF(inp);
3015 		if (bindall) {
3016 			/* verify that no lport is not used by a singleton */
3017 			if ((port_reuse_active == 0) &&
3018 			    (inp_tmp = sctp_isport_inuse(inp, lport, vrf_id))) {
3019 				/* Sorry someone already has this one bound */
3020 				if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_PORTREUSE)) &&
3021 				    (sctp_is_feature_on(inp_tmp, SCTP_PCB_FLAGS_PORTREUSE))) {
3022 					port_reuse_active = 1;
3023 				} else {
3024 					error = EADDRINUSE;
3025 					SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
3026 					goto out;
3027 				}
3028 			}
3029 		}
3030 	} else {
3031 		uint16_t first, last, candidate;
3032 		uint16_t count;
3033 
3034 		if (ip_inp->inp_flags & INP_HIGHPORT) {
3035 			first = MODULE_GLOBAL(ipport_hifirstauto);
3036 			last = MODULE_GLOBAL(ipport_hilastauto);
3037 		} else if (ip_inp->inp_flags & INP_LOWPORT) {
3038 			if ((error = priv_check(td, PRIV_NETINET_RESERVEDPORT)) != 0) {
3039 				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
3040 				goto out;
3041 			}
3042 			first = MODULE_GLOBAL(ipport_lowfirstauto);
3043 			last = MODULE_GLOBAL(ipport_lowlastauto);
3044 		} else {
3045 			first = MODULE_GLOBAL(ipport_firstauto);
3046 			last = MODULE_GLOBAL(ipport_lastauto);
3047 		}
3048 		if (first > last) {
3049 			uint16_t temp;
3050 
3051 			temp = first;
3052 			first = last;
3053 			last = temp;
3054 		}
3055 		count = last - first + 1;	/* number of candidates */
3056 		candidate = first + sctp_select_initial_TSN(&inp->sctp_ep) % (count);
3057 
3058 		for (;;) {
3059 			if (sctp_isport_inuse(inp, htons(candidate), inp->def_vrf_id) == NULL) {
3060 				lport = htons(candidate);
3061 				break;
3062 			}
3063 			if (--count == 0) {
3064 				error = EADDRINUSE;
3065 				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
3066 				goto out;
3067 			}
3068 			if (candidate == last)
3069 				candidate = first;
3070 			else
3071 				candidate = candidate + 1;
3072 		}
3073 	}
3074 	if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE |
3075 	    SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
3076 		/*
3077 		 * this really should not happen. The guy did a non-blocking
3078 		 * bind and then did a close at the same time.
3079 		 */
3080 		error = EINVAL;
3081 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
3082 		goto out;
3083 	}
3084 	/* ok we look clear to give out this port, so lets setup the binding */
3085 	if (bindall) {
3086 		/* binding to all addresses, so just set in the proper flags */
3087 		inp->sctp_flags |= SCTP_PCB_FLAGS_BOUNDALL;
3088 		/* set the automatic addr changes from kernel flag */
3089 		if (SCTP_BASE_SYSCTL(sctp_auto_asconf) == 0) {
3090 			sctp_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF);
3091 			sctp_feature_off(inp, SCTP_PCB_FLAGS_AUTO_ASCONF);
3092 		} else {
3093 			sctp_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF);
3094 			sctp_feature_on(inp, SCTP_PCB_FLAGS_AUTO_ASCONF);
3095 		}
3096 		if (SCTP_BASE_SYSCTL(sctp_multiple_asconfs) == 0) {
3097 			sctp_feature_off(inp, SCTP_PCB_FLAGS_MULTIPLE_ASCONFS);
3098 		} else {
3099 			sctp_feature_on(inp, SCTP_PCB_FLAGS_MULTIPLE_ASCONFS);
3100 		}
3101 		/*
3102 		 * set the automatic mobility_base from kernel flag (by
3103 		 * micchie)
3104 		 */
3105 		if (SCTP_BASE_SYSCTL(sctp_mobility_base) == 0) {
3106 			sctp_mobility_feature_off(inp, SCTP_MOBILITY_BASE);
3107 			sctp_mobility_feature_off(inp, SCTP_MOBILITY_PRIM_DELETED);
3108 		} else {
3109 			sctp_mobility_feature_on(inp, SCTP_MOBILITY_BASE);
3110 			sctp_mobility_feature_off(inp, SCTP_MOBILITY_PRIM_DELETED);
3111 		}
3112 		/*
3113 		 * set the automatic mobility_fasthandoff from kernel flag
3114 		 * (by micchie)
3115 		 */
3116 		if (SCTP_BASE_SYSCTL(sctp_mobility_fasthandoff) == 0) {
3117 			sctp_mobility_feature_off(inp, SCTP_MOBILITY_FASTHANDOFF);
3118 			sctp_mobility_feature_off(inp, SCTP_MOBILITY_PRIM_DELETED);
3119 		} else {
3120 			sctp_mobility_feature_on(inp, SCTP_MOBILITY_FASTHANDOFF);
3121 			sctp_mobility_feature_off(inp, SCTP_MOBILITY_PRIM_DELETED);
3122 		}
3123 	} else {
3124 		/*
3125 		 * bind specific, make sure flags is off and add a new
3126 		 * address structure to the sctp_addr_list inside the ep
3127 		 * structure.
3128 		 *
3129 		 * We will need to allocate one and insert it at the head.
3130 		 * The socketopt call can just insert new addresses in there
3131 		 * as well. It will also have to do the embed scope kame
3132 		 * hack too (before adding).
3133 		 */
3134 		struct sctp_ifa *ifa;
3135 		union sctp_sockstore store;
3136 
3137 		memset(&store, 0, sizeof(store));
3138 		switch (addr->sa_family) {
3139 #ifdef INET
3140 		case AF_INET:
3141 			memcpy(&store.sin, addr, sizeof(struct sockaddr_in));
3142 			store.sin.sin_port = 0;
3143 			break;
3144 #endif
3145 #ifdef INET6
3146 		case AF_INET6:
3147 			memcpy(&store.sin6, addr, sizeof(struct sockaddr_in6));
3148 			store.sin6.sin6_port = 0;
3149 			break;
3150 #endif
3151 		default:
3152 			break;
3153 		}
3154 		/*
3155 		 * first find the interface with the bound address need to
3156 		 * zero out the port to find the address! yuck! can't do
3157 		 * this earlier since need port for sctp_pcb_findep()
3158 		 */
3159 		if (sctp_ifap != NULL) {
3160 			ifa = sctp_ifap;
3161 		} else {
3162 			/*
3163 			 * Note for BSD we hit here always other O/S's will
3164 			 * pass things in via the sctp_ifap argument.
3165 			 */
3166 			ifa = sctp_find_ifa_by_addr(&store.sa,
3167 			    vrf_id, SCTP_ADDR_NOT_LOCKED);
3168 		}
3169 		if (ifa == NULL) {
3170 			error = EADDRNOTAVAIL;
3171 			/* Can't find an interface with that address */
3172 			SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
3173 			goto out;
3174 		}
3175 #ifdef INET6
3176 		if (addr->sa_family == AF_INET6) {
3177 			/* GAK, more FIXME IFA lock? */
3178 			if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
3179 				/* Can't bind a non-existent addr. */
3180 				error = EINVAL;
3181 				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, error);
3182 				goto out;
3183 			}
3184 		}
3185 #endif
3186 		/* we're not bound all */
3187 		inp->sctp_flags &= ~SCTP_PCB_FLAGS_BOUNDALL;
3188 		/* allow bindx() to send ASCONF's for binding changes */
3189 		sctp_feature_on(inp, SCTP_PCB_FLAGS_DO_ASCONF);
3190 		/* clear automatic addr changes from kernel flag */
3191 		sctp_feature_off(inp, SCTP_PCB_FLAGS_AUTO_ASCONF);
3192 
3193 		/* add this address to the endpoint list */
3194 		error = sctp_insert_laddr(&inp->sctp_addr_list, ifa, 0);
3195 		if (error != 0)
3196 			goto out;
3197 		inp->laddr_count++;
3198 	}
3199 	/* find the bucket */
3200 	if (port_reuse_active) {
3201 		/* Put it into tcp 1-2-1 hash */
3202 		head = &SCTP_BASE_INFO(sctp_tcpephash)[SCTP_PCBHASH_ALLADDR(lport, SCTP_BASE_INFO(hashtcpmark))];
3203 		inp->sctp_flags |= SCTP_PCB_FLAGS_IN_TCPPOOL;
3204 	} else {
3205 		head = &SCTP_BASE_INFO(sctp_ephash)[SCTP_PCBHASH_ALLADDR(lport, SCTP_BASE_INFO(hashmark))];
3206 	}
3207 	/* put it in the bucket */
3208 	LIST_INSERT_HEAD(head, inp, sctp_hash);
3209 	SCTPDBG(SCTP_DEBUG_PCB1, "Main hash to bind at head:%p, bound port:%d - in tcp_pool=%d\n",
3210 	    (void *)head, ntohs(lport), port_reuse_active);
3211 	/* set in the port */
3212 	inp->sctp_lport = lport;
3213 
3214 	/* turn off just the unbound flag */
3215 	KASSERT((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) != 0,
3216 	    ("%s: inp %p is already bound", __func__, inp));
3217 	inp->sctp_flags &= ~SCTP_PCB_FLAGS_UNBOUND;
3218 out:
3219 	return (error);
3220 }
3221 
3222 int
3223 sctp_inpcb_bind(struct socket *so, struct sockaddr *addr,
3224     struct sctp_ifa *sctp_ifap, struct thread *td)
3225 {
3226 	struct sctp_inpcb *inp;
3227 	int error;
3228 
3229 	inp = so->so_pcb;
3230 	SCTP_INP_INFO_WLOCK();
3231 	SCTP_INP_WLOCK(inp);
3232 	error = sctp_inpcb_bind_locked(inp, addr, sctp_ifap, td);
3233 	SCTP_INP_WUNLOCK(inp);
3234 	SCTP_INP_INFO_WUNLOCK();
3235 	return (error);
3236 }
3237 
3238 static void
3239 sctp_iterator_inp_being_freed(struct sctp_inpcb *inp)
3240 {
3241 	struct sctp_iterator *it, *nit;
3242 
3243 	/*
3244 	 * We enter with the only the ITERATOR_LOCK in place and a write
3245 	 * lock on the inp_info stuff.
3246 	 */
3247 	it = sctp_it_ctl.cur_it;
3248 	if (it && (it->vn != curvnet)) {
3249 		/* Its not looking at our VNET */
3250 		return;
3251 	}
3252 	if (it && (it->inp == inp)) {
3253 		/*
3254 		 * This is tricky and we hold the iterator lock, but when it
3255 		 * returns and gets the lock (when we release it) the
3256 		 * iterator will try to operate on inp. We need to stop that
3257 		 * from happening. But of course the iterator has a
3258 		 * reference on the stcb and inp. We can mark it and it will
3259 		 * stop.
3260 		 *
3261 		 * If its a single iterator situation, we set the end
3262 		 * iterator flag. Otherwise we set the iterator to go to the
3263 		 * next inp.
3264 		 *
3265 		 */
3266 		if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
3267 			sctp_it_ctl.iterator_flags |= SCTP_ITERATOR_STOP_CUR_IT;
3268 		} else {
3269 			sctp_it_ctl.iterator_flags |= SCTP_ITERATOR_STOP_CUR_INP;
3270 		}
3271 	}
3272 	/*
3273 	 * Now go through and remove any single reference to our inp that
3274 	 * may be still pending on the list
3275 	 */
3276 	SCTP_IPI_ITERATOR_WQ_LOCK();
3277 	TAILQ_FOREACH_SAFE(it, &sctp_it_ctl.iteratorhead, sctp_nxt_itr, nit) {
3278 		if (it->vn != curvnet) {
3279 			continue;
3280 		}
3281 		if (it->inp == inp) {
3282 			/* This one points to me is it inp specific? */
3283 			if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
3284 				/* Remove and free this one */
3285 				TAILQ_REMOVE(&sctp_it_ctl.iteratorhead,
3286 				    it, sctp_nxt_itr);
3287 				if (it->function_atend != NULL) {
3288 					(*it->function_atend) (it->pointer, it->val);
3289 				}
3290 				SCTP_FREE(it, SCTP_M_ITER);
3291 			} else {
3292 				it->inp = LIST_NEXT(it->inp, sctp_list);
3293 				if (it->inp) {
3294 					SCTP_INP_INCR_REF(it->inp);
3295 				}
3296 			}
3297 			/*
3298 			 * When its put in the refcnt is incremented so decr
3299 			 * it
3300 			 */
3301 			SCTP_INP_DECR_REF(inp);
3302 		}
3303 	}
3304 	SCTP_IPI_ITERATOR_WQ_UNLOCK();
3305 }
3306 
3307 /* release sctp_inpcb unbind the port */
3308 void
3309 sctp_inpcb_free(struct sctp_inpcb *inp, int immediate, int from)
3310 {
3311 	/*
3312 	 * Here we free a endpoint. We must find it (if it is in the Hash
3313 	 * table) and remove it from there. Then we must also find it in the
3314 	 * overall list and remove it from there. After all removals are
3315 	 * complete then any timer has to be stopped. Then start the actual
3316 	 * freeing. a) Any local lists. b) Any associations. c) The hash of
3317 	 * all associations. d) finally the ep itself.
3318 	 */
3319 	struct sctp_tcb *stcb, *nstcb;
3320 	struct sctp_laddr *laddr, *nladdr;
3321 	struct inpcb *ip_pcb;
3322 	struct socket *so;
3323 	int being_refed = 0;
3324 	struct sctp_queued_to_read *sq, *nsq;
3325 	int cnt;
3326 	sctp_sharedkey_t *shared_key, *nshared_key;
3327 
3328 #ifdef SCTP_LOG_CLOSING
3329 	sctp_log_closing(inp, NULL, 0);
3330 #endif
3331 	SCTP_ITERATOR_LOCK();
3332 	/* mark any iterators on the list or being processed */
3333 	sctp_iterator_inp_being_freed(inp);
3334 	SCTP_ITERATOR_UNLOCK();
3335 
3336 	SCTP_ASOC_CREATE_LOCK(inp);
3337 	SCTP_INP_INFO_WLOCK();
3338 	SCTP_INP_WLOCK(inp);
3339 	so = inp->sctp_socket;
3340 	KASSERT((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) != 0,
3341 	    ("%s: inp %p still has socket", __func__, inp));
3342 	KASSERT((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) == 0,
3343 	    ("%s: double free of inp %p", __func__, inp));
3344 	if (from == SCTP_CALLED_AFTER_CMPSET_OFCLOSE) {
3345 		inp->sctp_flags &= ~SCTP_PCB_FLAGS_CLOSE_IP;
3346 		/* socket is gone, so no more wakeups allowed */
3347 		inp->sctp_flags |= SCTP_PCB_FLAGS_DONT_WAKE;
3348 		inp->sctp_flags &= ~SCTP_PCB_FLAGS_WAKEINPUT;
3349 		inp->sctp_flags &= ~SCTP_PCB_FLAGS_WAKEOUTPUT;
3350 	}
3351 	/* First time through we have the socket lock, after that no more. */
3352 	sctp_timer_stop(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL,
3353 	    SCTP_FROM_SCTP_PCB + SCTP_LOC_1);
3354 
3355 	if (inp->control) {
3356 		sctp_m_freem(inp->control);
3357 		inp->control = NULL;
3358 	}
3359 	if (inp->pkt) {
3360 		sctp_m_freem(inp->pkt);
3361 		inp->pkt = NULL;
3362 	}
3363 	ip_pcb = &inp->ip_inp.inp;	/* we could just cast the main pointer
3364 					 * here but I will be nice :> (i.e.
3365 					 * ip_pcb = ep;) */
3366 	if (immediate == SCTP_FREE_SHOULD_USE_GRACEFUL_CLOSE) {
3367 		int cnt_in_sd;
3368 
3369 		cnt_in_sd = 0;
3370 		LIST_FOREACH_SAFE(stcb, &inp->sctp_asoc_list, sctp_tcblist, nstcb) {
3371 			SCTP_TCB_LOCK(stcb);
3372 			/* Disconnect the socket please. */
3373 			stcb->sctp_socket = NULL;
3374 			SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_CLOSED_SOCKET);
3375 			if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
3376 				/* Skip guys being freed */
3377 				cnt_in_sd++;
3378 				if (stcb->asoc.state & SCTP_STATE_IN_ACCEPT_QUEUE) {
3379 					/*
3380 					 * Special case - we did not start a
3381 					 * kill timer on the asoc due to it
3382 					 * was not closed. So go ahead and
3383 					 * start it now.
3384 					 */
3385 					SCTP_CLEAR_SUBSTATE(stcb, SCTP_STATE_IN_ACCEPT_QUEUE);
3386 					sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
3387 				}
3388 				SCTP_TCB_UNLOCK(stcb);
3389 				continue;
3390 			}
3391 			if (((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
3392 			    (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) &&
3393 			    (stcb->asoc.total_output_queue_size == 0)) {
3394 				/*
3395 				 * If we have data in queue, we don't want
3396 				 * to just free since the app may have done,
3397 				 * send()/close or connect/send/close. And
3398 				 * it wants the data to get across first.
3399 				 */
3400 				/* Just abandon things in the front states */
3401 				if (sctp_free_assoc(inp, stcb, SCTP_PCBFREE_NOFORCE,
3402 				    SCTP_FROM_SCTP_PCB + SCTP_LOC_2) == 0) {
3403 					cnt_in_sd++;
3404 				}
3405 				continue;
3406 			}
3407 			if ((stcb->asoc.size_on_reasm_queue > 0) ||
3408 			    (stcb->asoc.size_on_all_streams > 0) ||
3409 			    ((so != NULL) && (SCTP_SBAVAIL(&so->so_rcv) > 0))) {
3410 				/* Left with Data unread */
3411 				struct mbuf *op_err;
3412 
3413 				op_err = sctp_generate_cause(SCTP_CAUSE_USER_INITIATED_ABT, "");
3414 				stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_PCB + SCTP_LOC_3;
3415 				sctp_send_abort_tcb(stcb, op_err, SCTP_SO_LOCKED);
3416 				SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3417 				if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
3418 				    (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3419 					SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3420 				}
3421 				if (sctp_free_assoc(inp, stcb,
3422 				    SCTP_PCBFREE_NOFORCE, SCTP_FROM_SCTP_PCB + SCTP_LOC_4) == 0) {
3423 					cnt_in_sd++;
3424 				}
3425 				continue;
3426 			} else if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&
3427 				    TAILQ_EMPTY(&stcb->asoc.sent_queue) &&
3428 			    (stcb->asoc.stream_queue_cnt == 0)) {
3429 				if ((*stcb->asoc.ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, &stcb->asoc)) {
3430 					goto abort_anyway;
3431 				}
3432 				if ((SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_SENT) &&
3433 				    (SCTP_GET_STATE(stcb) != SCTP_STATE_SHUTDOWN_ACK_SENT)) {
3434 					struct sctp_nets *netp;
3435 
3436 					/*
3437 					 * there is nothing queued to send,
3438 					 * so I send shutdown
3439 					 */
3440 					if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
3441 					    (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3442 						SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3443 					}
3444 					SCTP_SET_STATE(stcb, SCTP_STATE_SHUTDOWN_SENT);
3445 					sctp_stop_timers_for_shutdown(stcb);
3446 					if (stcb->asoc.alternate) {
3447 						netp = stcb->asoc.alternate;
3448 					} else {
3449 						netp = stcb->asoc.primary_destination;
3450 					}
3451 					sctp_send_shutdown(stcb, netp);
3452 					sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN, stcb->sctp_ep, stcb,
3453 					    netp);
3454 					sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD, stcb->sctp_ep, stcb, NULL);
3455 					sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_LOCKED);
3456 				}
3457 			} else {
3458 				/* mark into shutdown pending */
3459 				SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING);
3460 				if ((*stcb->asoc.ss_functions.sctp_ss_is_user_msgs_incomplete) (stcb, &stcb->asoc)) {
3461 					SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_PARTIAL_MSG_LEFT);
3462 				}
3463 				if (TAILQ_EMPTY(&stcb->asoc.send_queue) &&
3464 				    TAILQ_EMPTY(&stcb->asoc.sent_queue) &&
3465 				    (stcb->asoc.state & SCTP_STATE_PARTIAL_MSG_LEFT)) {
3466 					struct mbuf *op_err;
3467 
3468 			abort_anyway:
3469 					op_err = sctp_generate_cause(SCTP_CAUSE_USER_INITIATED_ABT, "");
3470 					stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_PCB + SCTP_LOC_5;
3471 					sctp_send_abort_tcb(stcb, op_err, SCTP_SO_LOCKED);
3472 					SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3473 					if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
3474 					    (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3475 						SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3476 					}
3477 					if (sctp_free_assoc(inp, stcb,
3478 					    SCTP_PCBFREE_NOFORCE,
3479 					    SCTP_FROM_SCTP_PCB + SCTP_LOC_6) == 0) {
3480 						cnt_in_sd++;
3481 					}
3482 					continue;
3483 				} else {
3484 					sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_CLOSING, SCTP_SO_LOCKED);
3485 				}
3486 			}
3487 			cnt_in_sd++;
3488 			SCTP_TCB_UNLOCK(stcb);
3489 		}
3490 		/* now is there some left in our SHUTDOWN state? */
3491 		if (cnt_in_sd) {
3492 #ifdef SCTP_LOG_CLOSING
3493 			sctp_log_closing(inp, NULL, 2);
3494 #endif
3495 			inp->sctp_socket = NULL;
3496 			SCTP_INP_WUNLOCK(inp);
3497 			SCTP_ASOC_CREATE_UNLOCK(inp);
3498 			SCTP_INP_INFO_WUNLOCK();
3499 			return;
3500 		}
3501 	}
3502 	inp->sctp_socket = NULL;
3503 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) == 0) {
3504 		/*
3505 		 * ok, this guy has been bound. It's port is somewhere in
3506 		 * the SCTP_BASE_INFO(hash table). Remove it!
3507 		 */
3508 		LIST_REMOVE(inp, sctp_hash);
3509 		inp->sctp_flags |= SCTP_PCB_FLAGS_UNBOUND;
3510 	}
3511 
3512 	/*
3513 	 * If there is a timer running to kill us, forget it, since it may
3514 	 * have a contest on the INP lock.. which would cause us to die ...
3515 	 */
3516 	cnt = 0;
3517 	LIST_FOREACH_SAFE(stcb, &inp->sctp_asoc_list, sctp_tcblist, nstcb) {
3518 		SCTP_TCB_LOCK(stcb);
3519 		if (immediate != SCTP_FREE_SHOULD_USE_GRACEFUL_CLOSE) {
3520 			/* Disconnect the socket please */
3521 			stcb->sctp_socket = NULL;
3522 			SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_CLOSED_SOCKET);
3523 		}
3524 		if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
3525 			if (stcb->asoc.state & SCTP_STATE_IN_ACCEPT_QUEUE) {
3526 				SCTP_CLEAR_SUBSTATE(stcb, SCTP_STATE_IN_ACCEPT_QUEUE);
3527 				sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
3528 			}
3529 			cnt++;
3530 			SCTP_TCB_UNLOCK(stcb);
3531 			continue;
3532 		}
3533 		/* Free associations that are NOT killing us */
3534 		if ((SCTP_GET_STATE(stcb) != SCTP_STATE_COOKIE_WAIT) &&
3535 		    ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0)) {
3536 			struct mbuf *op_err;
3537 
3538 			op_err = sctp_generate_cause(SCTP_CAUSE_USER_INITIATED_ABT, "");
3539 			stcb->sctp_ep->last_abort_code = SCTP_FROM_SCTP_PCB + SCTP_LOC_7;
3540 			sctp_send_abort_tcb(stcb, op_err, SCTP_SO_LOCKED);
3541 			SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3542 		} else if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
3543 			cnt++;
3544 			SCTP_TCB_UNLOCK(stcb);
3545 			continue;
3546 		}
3547 		if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
3548 		    (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3549 			SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3550 		}
3551 		if (sctp_free_assoc(inp, stcb, SCTP_PCBFREE_FORCE,
3552 		    SCTP_FROM_SCTP_PCB + SCTP_LOC_8) == 0) {
3553 			cnt++;
3554 		}
3555 	}
3556 	if (cnt) {
3557 		/* Ok we have someone out there that will kill us */
3558 #ifdef SCTP_LOG_CLOSING
3559 		sctp_log_closing(inp, NULL, 3);
3560 #endif
3561 		SCTP_INP_WUNLOCK(inp);
3562 		SCTP_ASOC_CREATE_UNLOCK(inp);
3563 		SCTP_INP_INFO_WUNLOCK();
3564 		return;
3565 	}
3566 	if (SCTP_INP_LOCK_CONTENDED(inp))
3567 		being_refed++;
3568 	if (SCTP_INP_READ_CONTENDED(inp))
3569 		being_refed++;
3570 	if (SCTP_ASOC_CREATE_LOCK_CONTENDED(inp))
3571 		being_refed++;
3572 	/* NOTE: 0 refcount also means no timers are referencing us. */
3573 	if ((inp->refcount) ||
3574 	    (being_refed) ||
3575 	    (inp->sctp_flags & SCTP_PCB_FLAGS_CLOSE_IP)) {
3576 #ifdef SCTP_LOG_CLOSING
3577 		sctp_log_closing(inp, NULL, 4);
3578 #endif
3579 		sctp_timer_start(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL);
3580 		SCTP_INP_WUNLOCK(inp);
3581 		SCTP_ASOC_CREATE_UNLOCK(inp);
3582 		SCTP_INP_INFO_WUNLOCK();
3583 		return;
3584 	}
3585 	inp->sctp_ep.signature_change.type = 0;
3586 	inp->sctp_flags |= SCTP_PCB_FLAGS_SOCKET_ALLGONE;
3587 	/*
3588 	 * Remove it from the list .. last thing we need a lock for.
3589 	 */
3590 	LIST_REMOVE(inp, sctp_list);
3591 	SCTP_INP_WUNLOCK(inp);
3592 	SCTP_ASOC_CREATE_UNLOCK(inp);
3593 	SCTP_INP_INFO_WUNLOCK();
3594 
3595 #ifdef SCTP_LOG_CLOSING
3596 	sctp_log_closing(inp, NULL, 5);
3597 #endif
3598 	if ((inp->sctp_asocidhash) != NULL) {
3599 		SCTP_HASH_FREE(inp->sctp_asocidhash, inp->hashasocidmark);
3600 		inp->sctp_asocidhash = NULL;
3601 	}
3602 	/* sa_ignore FREED_MEMORY */
3603 	TAILQ_FOREACH_SAFE(sq, &inp->read_queue, next, nsq) {
3604 		/* Its only abandoned if it had data left */
3605 		if (sq->length)
3606 			SCTP_STAT_INCR(sctps_left_abandon);
3607 
3608 		TAILQ_REMOVE(&inp->read_queue, sq, next);
3609 		sctp_free_remote_addr(sq->whoFrom);
3610 		if (so)
3611 			SCTP_SB_DECR(&so->so_rcv, sq->length);
3612 		if (sq->data) {
3613 			sctp_m_freem(sq->data);
3614 			sq->data = NULL;
3615 		}
3616 		/*
3617 		 * no need to free the net count, since at this point all
3618 		 * assoc's are gone.
3619 		 */
3620 		sctp_free_a_readq(NULL, sq);
3621 	}
3622 	/* Now the sctp_pcb things */
3623 	/*
3624 	 * free each asoc if it is not already closed/free. we can't use the
3625 	 * macro here since le_next will get freed as part of the
3626 	 * sctp_free_assoc() call.
3627 	 */
3628 	if (ip_pcb->inp_options) {
3629 		(void)sctp_m_free(ip_pcb->inp_options);
3630 		ip_pcb->inp_options = 0;
3631 	}
3632 #ifdef INET6
3633 	if (ip_pcb->inp_vflag & INP_IPV6) {
3634 		ip6_freepcbopts(ip_pcb->in6p_outputopts);
3635 	}
3636 #endif				/* INET6 */
3637 	ip_pcb->inp_vflag = 0;
3638 	/* free up authentication fields */
3639 	if (inp->sctp_ep.local_auth_chunks != NULL)
3640 		sctp_free_chunklist(inp->sctp_ep.local_auth_chunks);
3641 	if (inp->sctp_ep.local_hmacs != NULL)
3642 		sctp_free_hmaclist(inp->sctp_ep.local_hmacs);
3643 
3644 	LIST_FOREACH_SAFE(shared_key, &inp->sctp_ep.shared_keys, next, nshared_key) {
3645 		LIST_REMOVE(shared_key, next);
3646 		sctp_free_sharedkey(shared_key);
3647 		/* sa_ignore FREED_MEMORY */
3648 	}
3649 
3650 	/*
3651 	 * if we have an address list the following will free the list of
3652 	 * ifaddr's that are set into this ep. Again macro limitations here,
3653 	 * since the LIST_FOREACH could be a bad idea.
3654 	 */
3655 	LIST_FOREACH_SAFE(laddr, &inp->sctp_addr_list, sctp_nxt_addr, nladdr) {
3656 		sctp_remove_laddr(laddr);
3657 	}
3658 
3659 #ifdef SCTP_TRACK_FREED_ASOCS
3660 	/* TEMP CODE */
3661 	LIST_FOREACH_SAFE(stcb, &inp->sctp_asoc_free_list, sctp_tcblist, nstcb) {
3662 		LIST_REMOVE(stcb, sctp_tcblist);
3663 		SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asoc), stcb);
3664 		SCTP_DECR_ASOC_COUNT();
3665 	}
3666 	/* *** END TEMP CODE *** */
3667 #endif
3668 	/* Now lets see about freeing the EP hash table. */
3669 	if (inp->sctp_tcbhash != NULL) {
3670 		SCTP_HASH_FREE(inp->sctp_tcbhash, inp->sctp_hashmark);
3671 		inp->sctp_tcbhash = NULL;
3672 	}
3673 	/* Now we must put the ep memory back into the zone pool */
3674 	crfree(inp->ip_inp.inp.inp_cred);
3675 	INP_LOCK_DESTROY(&inp->ip_inp.inp);
3676 	SCTP_INP_LOCK_DESTROY(inp);
3677 	SCTP_INP_READ_LOCK_DESTROY(inp);
3678 	SCTP_ASOC_CREATE_LOCK_DESTROY(inp);
3679 	SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_ep), inp);
3680 	SCTP_DECR_EP_COUNT();
3681 }
3682 
3683 struct sctp_nets *
3684 sctp_findnet(struct sctp_tcb *stcb, struct sockaddr *addr)
3685 {
3686 	struct sctp_nets *net;
3687 
3688 	/* locate the address */
3689 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
3690 		if (sctp_cmpaddr(addr, (struct sockaddr *)&net->ro._l_addr))
3691 			return (net);
3692 	}
3693 	return (NULL);
3694 }
3695 
3696 int
3697 sctp_is_address_on_local_host(struct sockaddr *addr, uint32_t vrf_id)
3698 {
3699 	struct sctp_ifa *sctp_ifa;
3700 
3701 	sctp_ifa = sctp_find_ifa_by_addr(addr, vrf_id, SCTP_ADDR_NOT_LOCKED);
3702 	if (sctp_ifa) {
3703 		return (1);
3704 	} else {
3705 		return (0);
3706 	}
3707 }
3708 
3709 /*
3710  * add's a remote endpoint address, done with the INIT/INIT-ACK as well as
3711  * when a ASCONF arrives that adds it. It will also initialize all the cwnd
3712  * stats of stuff.
3713  */
3714 int
3715 sctp_add_remote_addr(struct sctp_tcb *stcb, struct sockaddr *newaddr,
3716     struct sctp_nets **netp, uint16_t port, int set_scope, int from)
3717 {
3718 	/*
3719 	 * The following is redundant to the same lines in the
3720 	 * sctp_aloc_assoc() but is needed since others call the add address
3721 	 * function
3722 	 */
3723 	struct sctp_nets *net, *netfirst;
3724 	int addr_inscope;
3725 
3726 	SCTPDBG(SCTP_DEBUG_PCB1, "Adding an address (from:%d) to the peer: ",
3727 	    from);
3728 	SCTPDBG_ADDR(SCTP_DEBUG_PCB1, newaddr);
3729 
3730 	netfirst = sctp_findnet(stcb, newaddr);
3731 	if (netfirst) {
3732 		/*
3733 		 * Lie and return ok, we don't want to make the association
3734 		 * go away for this behavior. It will happen in the TCP
3735 		 * model in a connected socket. It does not reach the hash
3736 		 * table until after the association is built so it can't be
3737 		 * found. Mark as reachable, since the initial creation will
3738 		 * have been cleared and the NOT_IN_ASSOC flag will have
3739 		 * been added... and we don't want to end up removing it
3740 		 * back out.
3741 		 */
3742 		if (netfirst->dest_state & SCTP_ADDR_UNCONFIRMED) {
3743 			netfirst->dest_state = (SCTP_ADDR_REACHABLE |
3744 			    SCTP_ADDR_UNCONFIRMED);
3745 		} else {
3746 			netfirst->dest_state = SCTP_ADDR_REACHABLE;
3747 		}
3748 
3749 		return (0);
3750 	}
3751 	addr_inscope = 1;
3752 	switch (newaddr->sa_family) {
3753 #ifdef INET
3754 	case AF_INET:
3755 		{
3756 			struct sockaddr_in *sin;
3757 
3758 			sin = (struct sockaddr_in *)newaddr;
3759 			if (sin->sin_addr.s_addr == 0) {
3760 				/* Invalid address */
3761 				return (-1);
3762 			}
3763 			/* zero out the zero area */
3764 			memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
3765 
3766 			/* assure len is set */
3767 			sin->sin_len = sizeof(struct sockaddr_in);
3768 			if (set_scope) {
3769 				if (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) {
3770 					stcb->asoc.scope.ipv4_local_scope = 1;
3771 				}
3772 			} else {
3773 				/* Validate the address is in scope */
3774 				if ((IN4_ISPRIVATE_ADDRESS(&sin->sin_addr)) &&
3775 				    (stcb->asoc.scope.ipv4_local_scope == 0)) {
3776 					addr_inscope = 0;
3777 				}
3778 			}
3779 			break;
3780 		}
3781 #endif
3782 #ifdef INET6
3783 	case AF_INET6:
3784 		{
3785 			struct sockaddr_in6 *sin6;
3786 
3787 			sin6 = (struct sockaddr_in6 *)newaddr;
3788 			if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
3789 				/* Invalid address */
3790 				return (-1);
3791 			}
3792 			/* assure len is set */
3793 			sin6->sin6_len = sizeof(struct sockaddr_in6);
3794 			if (set_scope) {
3795 				if (sctp_is_address_on_local_host(newaddr, stcb->asoc.vrf_id)) {
3796 					stcb->asoc.scope.loopback_scope = 1;
3797 					stcb->asoc.scope.local_scope = 0;
3798 					stcb->asoc.scope.ipv4_local_scope = 1;
3799 					stcb->asoc.scope.site_scope = 1;
3800 				} else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
3801 					/*
3802 					 * If the new destination is a
3803 					 * LINK_LOCAL we must have common
3804 					 * site scope. Don't set the local
3805 					 * scope since we may not share all
3806 					 * links, only loopback can do this.
3807 					 * Links on the local network would
3808 					 * also be on our private network
3809 					 * for v4 too.
3810 					 */
3811 					stcb->asoc.scope.ipv4_local_scope = 1;
3812 					stcb->asoc.scope.site_scope = 1;
3813 				} else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr)) {
3814 					/*
3815 					 * If the new destination is
3816 					 * SITE_LOCAL then we must have site
3817 					 * scope in common.
3818 					 */
3819 					stcb->asoc.scope.site_scope = 1;
3820 				}
3821 			} else {
3822 				/* Validate the address is in scope */
3823 				if (IN6_IS_ADDR_LOOPBACK(&sin6->sin6_addr) &&
3824 				    (stcb->asoc.scope.loopback_scope == 0)) {
3825 					addr_inscope = 0;
3826 				} else if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr) &&
3827 				    (stcb->asoc.scope.local_scope == 0)) {
3828 					addr_inscope = 0;
3829 				} else if (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr) &&
3830 				    (stcb->asoc.scope.site_scope == 0)) {
3831 					addr_inscope = 0;
3832 				}
3833 			}
3834 			break;
3835 		}
3836 #endif
3837 	default:
3838 		/* not supported family type */
3839 		return (-1);
3840 	}
3841 	net = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_net), struct sctp_nets);
3842 	if (net == NULL) {
3843 		return (-1);
3844 	}
3845 	SCTP_INCR_RADDR_COUNT();
3846 	memset(net, 0, sizeof(struct sctp_nets));
3847 	(void)SCTP_GETTIME_TIMEVAL(&net->start_time);
3848 	memcpy(&net->ro._l_addr, newaddr, newaddr->sa_len);
3849 	switch (newaddr->sa_family) {
3850 #ifdef INET
3851 	case AF_INET:
3852 		((struct sockaddr_in *)&net->ro._l_addr)->sin_port = stcb->rport;
3853 		break;
3854 #endif
3855 #ifdef INET6
3856 	case AF_INET6:
3857 		((struct sockaddr_in6 *)&net->ro._l_addr)->sin6_port = stcb->rport;
3858 		break;
3859 #endif
3860 	default:
3861 		break;
3862 	}
3863 	net->addr_is_local = sctp_is_address_on_local_host(newaddr, stcb->asoc.vrf_id);
3864 	if (net->addr_is_local && ((set_scope || (from == SCTP_ADDR_IS_CONFIRMED)))) {
3865 		stcb->asoc.scope.loopback_scope = 1;
3866 		stcb->asoc.scope.ipv4_local_scope = 1;
3867 		stcb->asoc.scope.local_scope = 0;
3868 		stcb->asoc.scope.site_scope = 1;
3869 		addr_inscope = 1;
3870 	}
3871 	net->failure_threshold = stcb->asoc.def_net_failure;
3872 	net->pf_threshold = stcb->asoc.def_net_pf_threshold;
3873 	if (addr_inscope == 0) {
3874 		net->dest_state = (SCTP_ADDR_REACHABLE |
3875 		    SCTP_ADDR_OUT_OF_SCOPE);
3876 	} else {
3877 		if (from == SCTP_ADDR_IS_CONFIRMED)
3878 			/* SCTP_ADDR_IS_CONFIRMED is passed by connect_x */
3879 			net->dest_state = SCTP_ADDR_REACHABLE;
3880 		else
3881 			net->dest_state = SCTP_ADDR_REACHABLE |
3882 			    SCTP_ADDR_UNCONFIRMED;
3883 	}
3884 	/*
3885 	 * We set this to 0, the timer code knows that this means its an
3886 	 * initial value
3887 	 */
3888 	net->rto_needed = 1;
3889 	net->RTO = 0;
3890 	net->RTO_measured = 0;
3891 	stcb->asoc.numnets++;
3892 	net->ref_count = 1;
3893 	net->cwr_window_tsn = net->last_cwr_tsn = stcb->asoc.sending_seq - 1;
3894 	net->port = port;
3895 	net->dscp = stcb->asoc.default_dscp;
3896 #ifdef INET6
3897 	net->flowlabel = stcb->asoc.default_flowlabel;
3898 #endif
3899 	if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DONOT_HEARTBEAT)) {
3900 		net->dest_state |= SCTP_ADDR_NOHB;
3901 	} else {
3902 		net->dest_state &= ~SCTP_ADDR_NOHB;
3903 	}
3904 	if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DO_NOT_PMTUD)) {
3905 		net->dest_state |= SCTP_ADDR_NO_PMTUD;
3906 	} else {
3907 		net->dest_state &= ~SCTP_ADDR_NO_PMTUD;
3908 	}
3909 	net->heart_beat_delay = stcb->asoc.heart_beat_delay;
3910 	/* Init the timer structure */
3911 	SCTP_OS_TIMER_INIT(&net->rxt_timer.timer);
3912 	SCTP_OS_TIMER_INIT(&net->pmtu_timer.timer);
3913 	SCTP_OS_TIMER_INIT(&net->hb_timer.timer);
3914 
3915 	/* Now generate a route for this guy */
3916 #ifdef INET6
3917 	/* KAME hack: embed scopeid */
3918 	if (newaddr->sa_family == AF_INET6) {
3919 		struct sockaddr_in6 *sin6;
3920 
3921 		sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
3922 		(void)sa6_embedscope(sin6, MODULE_GLOBAL(ip6_use_defzone));
3923 		sin6->sin6_scope_id = 0;
3924 	}
3925 #endif
3926 	SCTP_RTALLOC((sctp_route_t *)&net->ro,
3927 	    stcb->asoc.vrf_id,
3928 	    stcb->sctp_ep->fibnum);
3929 
3930 	net->src_addr_selected = 0;
3931 	if (SCTP_ROUTE_HAS_VALID_IFN(&net->ro)) {
3932 		/* Get source address */
3933 		net->ro._s_addr = sctp_source_address_selection(stcb->sctp_ep,
3934 		    stcb,
3935 		    (sctp_route_t *)&net->ro,
3936 		    net,
3937 		    0,
3938 		    stcb->asoc.vrf_id);
3939 		if (stcb->asoc.default_mtu > 0) {
3940 			net->mtu = stcb->asoc.default_mtu;
3941 			switch (net->ro._l_addr.sa.sa_family) {
3942 #ifdef INET
3943 			case AF_INET:
3944 				net->mtu += SCTP_MIN_V4_OVERHEAD;
3945 				break;
3946 #endif
3947 #ifdef INET6
3948 			case AF_INET6:
3949 				net->mtu += SCTP_MIN_OVERHEAD;
3950 				break;
3951 #endif
3952 			default:
3953 				break;
3954 			}
3955 #if defined(INET) || defined(INET6)
3956 			if (net->port) {
3957 				net->mtu += (uint32_t)sizeof(struct udphdr);
3958 			}
3959 #endif
3960 		} else if (net->ro._s_addr != NULL) {
3961 			uint32_t imtu, rmtu, hcmtu;
3962 
3963 			net->src_addr_selected = 1;
3964 			/* Now get the interface MTU */
3965 			if (net->ro._s_addr->ifn_p != NULL) {
3966 				/*
3967 				 * XXX: Should we here just use
3968 				 * net->ro._s_addr->ifn_p->ifn_mtu
3969 				 */
3970 				imtu = SCTP_GATHER_MTU_FROM_IFN_INFO(net->ro._s_addr->ifn_p->ifn_p,
3971 				    net->ro._s_addr->ifn_p->ifn_index);
3972 			} else {
3973 				imtu = 0;
3974 			}
3975 			rmtu = SCTP_GATHER_MTU_FROM_ROUTE(net->ro._s_addr, &net->ro._l_addr.sa, net->ro.ro_nh);
3976 			hcmtu = sctp_hc_get_mtu(&net->ro._l_addr, stcb->sctp_ep->fibnum);
3977 			net->mtu = sctp_min_mtu(hcmtu, rmtu, imtu);
3978 		}
3979 	}
3980 	if (net->mtu == 0) {
3981 		if (stcb->asoc.default_mtu > 0) {
3982 			net->mtu = stcb->asoc.default_mtu;
3983 			switch (net->ro._l_addr.sa.sa_family) {
3984 #ifdef INET
3985 			case AF_INET:
3986 				net->mtu += SCTP_MIN_V4_OVERHEAD;
3987 				break;
3988 #endif
3989 #ifdef INET6
3990 			case AF_INET6:
3991 				net->mtu += SCTP_MIN_OVERHEAD;
3992 				break;
3993 #endif
3994 			default:
3995 				break;
3996 			}
3997 #if defined(INET) || defined(INET6)
3998 			if (net->port) {
3999 				net->mtu += (uint32_t)sizeof(struct udphdr);
4000 			}
4001 #endif
4002 		} else {
4003 			switch (newaddr->sa_family) {
4004 #ifdef INET
4005 			case AF_INET:
4006 				net->mtu = SCTP_DEFAULT_MTU;
4007 				break;
4008 #endif
4009 #ifdef INET6
4010 			case AF_INET6:
4011 				net->mtu = 1280;
4012 				break;
4013 #endif
4014 			default:
4015 				break;
4016 			}
4017 		}
4018 	}
4019 #if defined(INET) || defined(INET6)
4020 	if (net->port) {
4021 		net->mtu -= (uint32_t)sizeof(struct udphdr);
4022 	}
4023 #endif
4024 	if (from == SCTP_ALLOC_ASOC) {
4025 		stcb->asoc.smallest_mtu = net->mtu;
4026 	}
4027 	if (stcb->asoc.smallest_mtu > net->mtu) {
4028 		sctp_pathmtu_adjustment(stcb, net->mtu, true);
4029 	}
4030 #ifdef INET6
4031 	if (newaddr->sa_family == AF_INET6) {
4032 		struct sockaddr_in6 *sin6;
4033 
4034 		sin6 = (struct sockaddr_in6 *)&net->ro._l_addr;
4035 		(void)sa6_recoverscope(sin6);
4036 	}
4037 #endif
4038 
4039 	/* JRS - Use the congestion control given in the CC module */
4040 	if (stcb->asoc.cc_functions.sctp_set_initial_cc_param != NULL)
4041 		(*stcb->asoc.cc_functions.sctp_set_initial_cc_param) (stcb, net);
4042 
4043 	/*
4044 	 * CMT: CUC algo - set find_pseudo_cumack to TRUE (1) at beginning
4045 	 * of assoc (2005/06/27, iyengar@cis.udel.edu)
4046 	 */
4047 	net->find_pseudo_cumack = 1;
4048 	net->find_rtx_pseudo_cumack = 1;
4049 	/* Choose an initial flowid. */
4050 	net->flowid = stcb->asoc.my_vtag ^
4051 	    ntohs(stcb->rport) ^
4052 	    ntohs(stcb->sctp_ep->sctp_lport);
4053 	net->flowtype = M_HASHTYPE_OPAQUE_HASH;
4054 	if (netp) {
4055 		*netp = net;
4056 	}
4057 	netfirst = TAILQ_FIRST(&stcb->asoc.nets);
4058 	if (net->ro.ro_nh == NULL) {
4059 		/* Since we have no route put it at the back */
4060 		TAILQ_INSERT_TAIL(&stcb->asoc.nets, net, sctp_next);
4061 	} else if (netfirst == NULL) {
4062 		/* We are the first one in the pool. */
4063 		TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
4064 	} else if (netfirst->ro.ro_nh == NULL) {
4065 		/*
4066 		 * First one has NO route. Place this one ahead of the first
4067 		 * one.
4068 		 */
4069 		TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
4070 	} else if (net->ro.ro_nh->nh_ifp != netfirst->ro.ro_nh->nh_ifp) {
4071 		/*
4072 		 * This one has a different interface than the one at the
4073 		 * top of the list. Place it ahead.
4074 		 */
4075 		TAILQ_INSERT_HEAD(&stcb->asoc.nets, net, sctp_next);
4076 	} else {
4077 		/*
4078 		 * Ok we have the same interface as the first one. Move
4079 		 * forward until we find either a) one with a NULL route...
4080 		 * insert ahead of that b) one with a different ifp.. insert
4081 		 * after that. c) end of the list.. insert at the tail.
4082 		 */
4083 		struct sctp_nets *netlook;
4084 
4085 		do {
4086 			netlook = TAILQ_NEXT(netfirst, sctp_next);
4087 			if (netlook == NULL) {
4088 				/* End of the list */
4089 				TAILQ_INSERT_TAIL(&stcb->asoc.nets, net, sctp_next);
4090 				break;
4091 			} else if (netlook->ro.ro_nh == NULL) {
4092 				/* next one has NO route */
4093 				TAILQ_INSERT_BEFORE(netfirst, net, sctp_next);
4094 				break;
4095 			} else if (netlook->ro.ro_nh->nh_ifp != net->ro.ro_nh->nh_ifp) {
4096 				TAILQ_INSERT_AFTER(&stcb->asoc.nets, netlook,
4097 				    net, sctp_next);
4098 				break;
4099 			}
4100 			/* Shift forward */
4101 			netfirst = netlook;
4102 		} while (netlook != NULL);
4103 	}
4104 
4105 	/* got to have a primary set */
4106 	if (stcb->asoc.primary_destination == 0) {
4107 		stcb->asoc.primary_destination = net;
4108 	} else if ((stcb->asoc.primary_destination->ro.ro_nh == NULL) &&
4109 		    (net->ro.ro_nh) &&
4110 	    ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0)) {
4111 		/* No route to current primary adopt new primary */
4112 		stcb->asoc.primary_destination = net;
4113 	}
4114 	/* Validate primary is first */
4115 	net = TAILQ_FIRST(&stcb->asoc.nets);
4116 	if ((net != stcb->asoc.primary_destination) &&
4117 	    (stcb->asoc.primary_destination)) {
4118 		/*
4119 		 * first one on the list is NOT the primary sctp_cmpaddr()
4120 		 * is much more efficient if the primary is the first on the
4121 		 * list, make it so.
4122 		 */
4123 		TAILQ_REMOVE(&stcb->asoc.nets,
4124 		    stcb->asoc.primary_destination, sctp_next);
4125 		TAILQ_INSERT_HEAD(&stcb->asoc.nets,
4126 		    stcb->asoc.primary_destination, sctp_next);
4127 	}
4128 	return (0);
4129 }
4130 
4131 static uint32_t
4132 sctp_aloc_a_assoc_id(struct sctp_inpcb *inp, struct sctp_tcb *stcb)
4133 {
4134 	uint32_t id;
4135 	struct sctpasochead *head;
4136 	struct sctp_tcb *lstcb;
4137 
4138 try_again:
4139 	if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
4140 		/* TSNH */
4141 		return (0);
4142 	}
4143 	/*
4144 	 * We don't allow assoc id to be one of SCTP_FUTURE_ASSOC,
4145 	 * SCTP_CURRENT_ASSOC and SCTP_ALL_ASSOC.
4146 	 */
4147 	if (inp->sctp_associd_counter <= SCTP_ALL_ASSOC) {
4148 		inp->sctp_associd_counter = SCTP_ALL_ASSOC + 1;
4149 	}
4150 	id = inp->sctp_associd_counter;
4151 	inp->sctp_associd_counter++;
4152 	lstcb = sctp_findasoc_ep_asocid_locked(inp, (sctp_assoc_t)id, 0);
4153 	if (lstcb) {
4154 		goto try_again;
4155 	}
4156 	head = &inp->sctp_asocidhash[SCTP_PCBHASH_ASOC(id, inp->hashasocidmark)];
4157 	LIST_INSERT_HEAD(head, stcb, sctp_tcbasocidhash);
4158 	stcb->asoc.in_asocid_hash = 1;
4159 	return (id);
4160 }
4161 
4162 /*
4163  * allocate an association and add it to the endpoint. The caller must be
4164  * careful to add all additional addresses once they are know right away or
4165  * else the assoc will be may experience a blackout scenario.
4166  */
4167 static struct sctp_tcb *
4168 sctp_aloc_assoc_locked(struct sctp_inpcb *inp, struct sockaddr *firstaddr,
4169     int *error, uint32_t override_tag, uint32_t initial_tsn,
4170     uint32_t vrf_id, uint16_t o_streams, uint16_t port,
4171     struct thread *p,
4172     int initialize_auth_params)
4173 {
4174 	/* note the p argument is only valid in unbound sockets */
4175 
4176 	struct sctp_tcb *stcb;
4177 	struct sctp_association *asoc;
4178 	struct sctpasochead *head;
4179 	uint16_t rport;
4180 	int err;
4181 
4182 	SCTP_INP_INFO_WLOCK_ASSERT();
4183 	SCTP_INP_WLOCK_ASSERT(inp);
4184 
4185 	/*
4186 	 * Assumption made here: Caller has done a
4187 	 * sctp_findassociation_ep_addr(ep, addr's); to make sure the
4188 	 * address does not exist already.
4189 	 */
4190 	if (SCTP_BASE_INFO(ipi_count_asoc) >= SCTP_MAX_NUM_OF_ASOC) {
4191 		/* Hit max assoc, sorry no more */
4192 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOBUFS);
4193 		*error = ENOBUFS;
4194 		return (NULL);
4195 	}
4196 	if (firstaddr == NULL) {
4197 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
4198 		*error = EINVAL;
4199 		return (NULL);
4200 	}
4201 	if (inp->sctp_flags & (SCTP_PCB_FLAGS_SOCKET_GONE | SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
4202 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
4203 		*error = EINVAL;
4204 		return (NULL);
4205 	}
4206 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) &&
4207 	    ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_PORTREUSE)) ||
4208 	    (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
4209 		/*
4210 		 * If its in the TCP pool, its NOT allowed to create an
4211 		 * association. The parent listener needs to call
4212 		 * sctp_aloc_assoc.. or the one-2-many socket. If a peeled
4213 		 * off, or connected one does this.. its an error.
4214 		 */
4215 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
4216 		*error = EINVAL;
4217 		return (NULL);
4218 	}
4219 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
4220 	    (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
4221 		if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) ||
4222 		    (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED)) {
4223 			SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
4224 			*error = EINVAL;
4225 			return (NULL);
4226 		}
4227 	}
4228 	SCTPDBG(SCTP_DEBUG_PCB3, "Allocate an association for peer:");
4229 #ifdef SCTP_DEBUG
4230 	if (firstaddr) {
4231 		SCTPDBG_ADDR(SCTP_DEBUG_PCB3, firstaddr);
4232 		switch (firstaddr->sa_family) {
4233 #ifdef INET
4234 		case AF_INET:
4235 			SCTPDBG(SCTP_DEBUG_PCB3, "Port:%d\n",
4236 			    ntohs(((struct sockaddr_in *)firstaddr)->sin_port));
4237 			break;
4238 #endif
4239 #ifdef INET6
4240 		case AF_INET6:
4241 			SCTPDBG(SCTP_DEBUG_PCB3, "Port:%d\n",
4242 			    ntohs(((struct sockaddr_in6 *)firstaddr)->sin6_port));
4243 			break;
4244 #endif
4245 		default:
4246 			break;
4247 		}
4248 	} else {
4249 		SCTPDBG(SCTP_DEBUG_PCB3, "None\n");
4250 	}
4251 #endif				/* SCTP_DEBUG */
4252 	switch (firstaddr->sa_family) {
4253 #ifdef INET
4254 	case AF_INET:
4255 		{
4256 			struct sockaddr_in *sin;
4257 
4258 			sin = (struct sockaddr_in *)firstaddr;
4259 			if ((ntohs(sin->sin_port) == 0) ||
4260 			    (sin->sin_addr.s_addr == INADDR_ANY) ||
4261 			    (sin->sin_addr.s_addr == INADDR_BROADCAST) ||
4262 			    IN_MULTICAST(ntohl(sin->sin_addr.s_addr)) ||
4263 			    ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
4264 			    (SCTP_IPV6_V6ONLY(inp) != 0))) {
4265 				/* Invalid address */
4266 				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
4267 				*error = EINVAL;
4268 				return (NULL);
4269 			}
4270 			rport = sin->sin_port;
4271 			break;
4272 		}
4273 #endif
4274 #ifdef INET6
4275 	case AF_INET6:
4276 		{
4277 			struct sockaddr_in6 *sin6;
4278 
4279 			sin6 = (struct sockaddr_in6 *)firstaddr;
4280 			if ((ntohs(sin6->sin6_port) == 0) ||
4281 			    IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
4282 			    IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr) ||
4283 			    ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0)) {
4284 				/* Invalid address */
4285 				SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
4286 				*error = EINVAL;
4287 				return (NULL);
4288 			}
4289 			rport = sin6->sin6_port;
4290 			break;
4291 		}
4292 #endif
4293 	default:
4294 		/* not supported family type */
4295 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, EINVAL);
4296 		*error = EINVAL;
4297 		return (NULL);
4298 	}
4299 	if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
4300 		/*
4301 		 * If you have not performed a bind, then we need to do the
4302 		 * ephemeral bind for you.
4303 		 */
4304 		if ((err = sctp_inpcb_bind_locked(inp, NULL, NULL, p))) {
4305 			/* bind error, probably perm */
4306 			*error = err;
4307 			return (NULL);
4308 		}
4309 	}
4310 	stcb = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_asoc), struct sctp_tcb);
4311 	if (stcb == NULL) {
4312 		/* out of memory? */
4313 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOMEM);
4314 		*error = ENOMEM;
4315 		return (NULL);
4316 	}
4317 	SCTP_INCR_ASOC_COUNT();
4318 
4319 	memset(stcb, 0, sizeof(*stcb));
4320 	asoc = &stcb->asoc;
4321 
4322 	SCTP_TCB_LOCK_INIT(stcb);
4323 	stcb->rport = rport;
4324 	/* setup back pointer's */
4325 	stcb->sctp_ep = inp;
4326 	stcb->sctp_socket = inp->sctp_socket;
4327 	if ((err = sctp_init_asoc(inp, stcb, override_tag, initial_tsn, vrf_id, o_streams))) {
4328 		/* failed */
4329 		SCTP_TCB_LOCK_DESTROY(stcb);
4330 		SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asoc), stcb);
4331 		SCTP_DECR_ASOC_COUNT();
4332 		*error = err;
4333 		return (NULL);
4334 	}
4335 	SCTP_TCB_LOCK(stcb);
4336 
4337 	asoc->assoc_id = sctp_aloc_a_assoc_id(inp, stcb);
4338 	/* now that my_vtag is set, add it to the hash */
4339 	head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(stcb->asoc.my_vtag, SCTP_BASE_INFO(hashasocmark))];
4340 	/* put it in the bucket in the vtag hash of assoc's for the system */
4341 	LIST_INSERT_HEAD(head, stcb, sctp_asocs);
4342 
4343 	if (sctp_add_remote_addr(stcb, firstaddr, NULL, port, SCTP_DO_SETSCOPE, SCTP_ALLOC_ASOC)) {
4344 		/* failure.. memory error? */
4345 		if (asoc->strmout) {
4346 			SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
4347 			asoc->strmout = NULL;
4348 		}
4349 		if (asoc->mapping_array) {
4350 			SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
4351 			asoc->mapping_array = NULL;
4352 		}
4353 		if (asoc->nr_mapping_array) {
4354 			SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
4355 			asoc->nr_mapping_array = NULL;
4356 		}
4357 		SCTP_DECR_ASOC_COUNT();
4358 		SCTP_TCB_UNLOCK(stcb);
4359 		SCTP_TCB_LOCK_DESTROY(stcb);
4360 		LIST_REMOVE(stcb, sctp_asocs);
4361 		LIST_REMOVE(stcb, sctp_tcbasocidhash);
4362 		SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asoc), stcb);
4363 		SCTP_INP_WUNLOCK(inp);
4364 		SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOBUFS);
4365 		*error = ENOBUFS;
4366 		return (NULL);
4367 	}
4368 	/* Init all the timers */
4369 	SCTP_OS_TIMER_INIT(&asoc->dack_timer.timer);
4370 	SCTP_OS_TIMER_INIT(&asoc->strreset_timer.timer);
4371 	SCTP_OS_TIMER_INIT(&asoc->asconf_timer.timer);
4372 	SCTP_OS_TIMER_INIT(&asoc->shut_guard_timer.timer);
4373 	SCTP_OS_TIMER_INIT(&asoc->autoclose_timer.timer);
4374 	SCTP_OS_TIMER_INIT(&asoc->delete_prim_timer.timer);
4375 
4376 	LIST_INSERT_HEAD(&inp->sctp_asoc_list, stcb, sctp_tcblist);
4377 	/* now file the port under the hash as well */
4378 	if (inp->sctp_tcbhash != NULL) {
4379 		head = &inp->sctp_tcbhash[SCTP_PCBHASH_ALLADDR(stcb->rport,
4380 		    inp->sctp_hashmark)];
4381 		LIST_INSERT_HEAD(head, stcb, sctp_tcbhash);
4382 	}
4383 	if (initialize_auth_params == SCTP_INITIALIZE_AUTH_PARAMS) {
4384 		sctp_initialize_auth_params(inp, stcb);
4385 	}
4386 	SCTPDBG(SCTP_DEBUG_PCB1, "Association %p now allocated\n", (void *)stcb);
4387 	return (stcb);
4388 }
4389 
4390 struct sctp_tcb *
4391 sctp_aloc_assoc(struct sctp_inpcb *inp, struct sockaddr *firstaddr,
4392     int *error, uint32_t override_tag, uint32_t initial_tsn,
4393     uint32_t vrf_id, uint16_t o_streams, uint16_t port,
4394     struct thread *p,
4395     int initialize_auth_params)
4396 {
4397 	struct sctp_tcb *stcb;
4398 
4399 	SCTP_INP_INFO_WLOCK();
4400 	SCTP_INP_WLOCK(inp);
4401 	stcb = sctp_aloc_assoc_locked(inp, firstaddr, error, override_tag,
4402 	    initial_tsn, vrf_id, o_streams, port, p, initialize_auth_params);
4403 	SCTP_INP_INFO_WUNLOCK();
4404 	SCTP_INP_WUNLOCK(inp);
4405 	return (stcb);
4406 }
4407 
4408 struct sctp_tcb *
4409 sctp_aloc_assoc_connected(struct sctp_inpcb *inp, struct sockaddr *firstaddr,
4410     int *error, uint32_t override_tag, uint32_t initial_tsn,
4411     uint32_t vrf_id, uint16_t o_streams, uint16_t port,
4412     struct thread *p,
4413     int initialize_auth_params)
4414 {
4415 	struct sctp_tcb *stcb;
4416 
4417 	SCTP_INP_INFO_WLOCK();
4418 	SCTP_INP_WLOCK(inp);
4419 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
4420 	    SCTP_IS_LISTENING(inp)) {
4421 		SCTP_INP_INFO_WUNLOCK();
4422 		SCTP_INP_WUNLOCK(inp);
4423 		*error = EINVAL;
4424 		return (NULL);
4425 	}
4426 	stcb = sctp_aloc_assoc_locked(inp, firstaddr, error, override_tag,
4427 	    initial_tsn, vrf_id, o_streams, port, p, initialize_auth_params);
4428 	SCTP_INP_INFO_WUNLOCK();
4429 	if (stcb != NULL && (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)) {
4430 		inp->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
4431 		soisconnecting(inp->sctp_socket);
4432 	}
4433 	SCTP_INP_WUNLOCK(inp);
4434 	return (stcb);
4435 }
4436 
4437 void
4438 sctp_remove_net(struct sctp_tcb *stcb, struct sctp_nets *net)
4439 {
4440 	struct sctp_inpcb *inp;
4441 	struct sctp_association *asoc;
4442 
4443 	inp = stcb->sctp_ep;
4444 	asoc = &stcb->asoc;
4445 	asoc->numnets--;
4446 	TAILQ_REMOVE(&asoc->nets, net, sctp_next);
4447 	if (net == asoc->primary_destination) {
4448 		/* Reset primary */
4449 		struct sctp_nets *lnet;
4450 
4451 		lnet = TAILQ_FIRST(&asoc->nets);
4452 		/*
4453 		 * Mobility adaptation Ideally, if deleted destination is
4454 		 * the primary, it becomes a fast retransmission trigger by
4455 		 * the subsequent SET PRIMARY. (by micchie)
4456 		 */
4457 		if (sctp_is_mobility_feature_on(stcb->sctp_ep,
4458 		    SCTP_MOBILITY_BASE) ||
4459 		    sctp_is_mobility_feature_on(stcb->sctp_ep,
4460 		    SCTP_MOBILITY_FASTHANDOFF)) {
4461 			SCTPDBG(SCTP_DEBUG_ASCONF1, "remove_net: primary dst is deleting\n");
4462 			if (asoc->deleted_primary != NULL) {
4463 				SCTPDBG(SCTP_DEBUG_ASCONF1, "remove_net: deleted primary may be already stored\n");
4464 				goto out;
4465 			}
4466 			asoc->deleted_primary = net;
4467 			atomic_add_int(&net->ref_count, 1);
4468 			memset(&net->lastsa, 0, sizeof(net->lastsa));
4469 			memset(&net->lastsv, 0, sizeof(net->lastsv));
4470 			sctp_mobility_feature_on(stcb->sctp_ep,
4471 			    SCTP_MOBILITY_PRIM_DELETED);
4472 			sctp_timer_start(SCTP_TIMER_TYPE_PRIM_DELETED,
4473 			    stcb->sctp_ep, stcb, NULL);
4474 		}
4475 out:
4476 		/* Try to find a confirmed primary */
4477 		asoc->primary_destination = sctp_find_alternate_net(stcb, lnet, 0);
4478 	}
4479 	if (net == asoc->last_data_chunk_from) {
4480 		/* Reset primary */
4481 		asoc->last_data_chunk_from = TAILQ_FIRST(&asoc->nets);
4482 	}
4483 	if (net == asoc->last_control_chunk_from) {
4484 		/* Clear net */
4485 		asoc->last_control_chunk_from = NULL;
4486 	}
4487 	if (net == asoc->last_net_cmt_send_started) {
4488 		/* Clear net */
4489 		asoc->last_net_cmt_send_started = NULL;
4490 	}
4491 	if (net == stcb->asoc.alternate) {
4492 		sctp_free_remote_addr(stcb->asoc.alternate);
4493 		stcb->asoc.alternate = NULL;
4494 	}
4495 	sctp_timer_stop(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net,
4496 	    SCTP_FROM_SCTP_PCB + SCTP_LOC_9);
4497 	sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
4498 	    SCTP_FROM_SCTP_PCB + SCTP_LOC_10);
4499 	net->dest_state |= SCTP_ADDR_BEING_DELETED;
4500 	sctp_free_remote_addr(net);
4501 }
4502 
4503 /*
4504  * remove a remote endpoint address from an association, it will fail if the
4505  * address does not exist.
4506  */
4507 int
4508 sctp_del_remote_addr(struct sctp_tcb *stcb, struct sockaddr *remaddr)
4509 {
4510 	/*
4511 	 * Here we need to remove a remote address. This is quite simple, we
4512 	 * first find it in the list of address for the association
4513 	 * (tasoc->asoc.nets) and then if it is there, we do a LIST_REMOVE
4514 	 * on that item. Note we do not allow it to be removed if there are
4515 	 * no other addresses.
4516 	 */
4517 	struct sctp_association *asoc;
4518 	struct sctp_nets *net, *nnet;
4519 
4520 	asoc = &stcb->asoc;
4521 
4522 	/* locate the address */
4523 	TAILQ_FOREACH_SAFE(net, &asoc->nets, sctp_next, nnet) {
4524 		if (net->ro._l_addr.sa.sa_family != remaddr->sa_family) {
4525 			continue;
4526 		}
4527 		if (sctp_cmpaddr((struct sockaddr *)&net->ro._l_addr,
4528 		    remaddr)) {
4529 			/* we found the guy */
4530 			if (asoc->numnets < 2) {
4531 				/* Must have at LEAST two remote addresses */
4532 				return (-1);
4533 			} else {
4534 				sctp_remove_net(stcb, net);
4535 				return (0);
4536 			}
4537 		}
4538 	}
4539 	/* not found. */
4540 	return (-2);
4541 }
4542 
4543 static bool
4544 sctp_is_in_timewait(uint32_t tag, uint16_t lport, uint16_t rport, uint32_t now)
4545 {
4546 	struct sctpvtaghead *chain;
4547 	struct sctp_tagblock *twait_block;
4548 	int i;
4549 
4550 	SCTP_INP_INFO_LOCK_ASSERT();
4551 	chain = &SCTP_BASE_INFO(vtag_timewait)[(tag % SCTP_STACK_VTAG_HASH_SIZE)];
4552 	LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) {
4553 		for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) {
4554 			if ((twait_block->vtag_block[i].tv_sec_at_expire >= now) &&
4555 			    (twait_block->vtag_block[i].v_tag == tag) &&
4556 			    (twait_block->vtag_block[i].lport == lport) &&
4557 			    (twait_block->vtag_block[i].rport == rport)) {
4558 				return (true);
4559 			}
4560 		}
4561 	}
4562 	return (false);
4563 }
4564 
4565 static void
4566 sctp_set_vtag_block(struct sctp_timewait *vtag_block, uint32_t time,
4567     uint32_t tag, uint16_t lport, uint16_t rport)
4568 {
4569 	vtag_block->tv_sec_at_expire = time;
4570 	vtag_block->v_tag = tag;
4571 	vtag_block->lport = lport;
4572 	vtag_block->rport = rport;
4573 }
4574 
4575 static void
4576 sctp_add_vtag_to_timewait(uint32_t tag, uint16_t lport, uint16_t rport)
4577 {
4578 	struct sctpvtaghead *chain;
4579 	struct sctp_tagblock *twait_block;
4580 	struct timeval now;
4581 	uint32_t time;
4582 	int i;
4583 	bool set;
4584 
4585 	SCTP_INP_INFO_WLOCK_ASSERT();
4586 	(void)SCTP_GETTIME_TIMEVAL(&now);
4587 	time = (uint32_t)now.tv_sec + SCTP_BASE_SYSCTL(sctp_vtag_time_wait);
4588 	chain = &SCTP_BASE_INFO(vtag_timewait)[(tag % SCTP_STACK_VTAG_HASH_SIZE)];
4589 	set = false;
4590 	LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) {
4591 		/* Block(s) present, lets find space, and expire on the fly */
4592 		for (i = 0; i < SCTP_NUMBER_IN_VTAG_BLOCK; i++) {
4593 			if ((twait_block->vtag_block[i].v_tag == 0) && !set) {
4594 				sctp_set_vtag_block(twait_block->vtag_block + i, time, tag, lport, rport);
4595 				set = true;
4596 				continue;
4597 			}
4598 			if ((twait_block->vtag_block[i].v_tag != 0) &&
4599 			    (twait_block->vtag_block[i].tv_sec_at_expire < (uint32_t)now.tv_sec)) {
4600 				if (set) {
4601 					/* Audit expires this guy */
4602 					sctp_set_vtag_block(twait_block->vtag_block + i, 0, 0, 0, 0);
4603 				} else {
4604 					/* Reuse it for the new tag */
4605 					sctp_set_vtag_block(twait_block->vtag_block + i, time, tag, lport, rport);
4606 					set = true;
4607 				}
4608 			}
4609 		}
4610 		if (set) {
4611 			/*
4612 			 * We only do up to the block where we can place our
4613 			 * tag for audits
4614 			 */
4615 			break;
4616 		}
4617 	}
4618 	/* Need to add a new block to chain */
4619 	if (!set) {
4620 		SCTP_MALLOC(twait_block, struct sctp_tagblock *,
4621 		    sizeof(struct sctp_tagblock), SCTP_M_TIMW);
4622 		if (twait_block == NULL) {
4623 			return;
4624 		}
4625 		memset(twait_block, 0, sizeof(struct sctp_tagblock));
4626 		LIST_INSERT_HEAD(chain, twait_block, sctp_nxt_tagblock);
4627 		sctp_set_vtag_block(twait_block->vtag_block, time, tag, lport, rport);
4628 	}
4629 }
4630 
4631 void
4632 sctp_clean_up_stream(struct sctp_tcb *stcb, struct sctp_readhead *rh)
4633 {
4634 	struct sctp_tmit_chunk *chk, *nchk;
4635 	struct sctp_queued_to_read *control, *ncontrol;
4636 
4637 	TAILQ_FOREACH_SAFE(control, rh, next_instrm, ncontrol) {
4638 		TAILQ_REMOVE(rh, control, next_instrm);
4639 		control->on_strm_q = 0;
4640 		if (control->on_read_q == 0) {
4641 			sctp_free_remote_addr(control->whoFrom);
4642 			if (control->data) {
4643 				sctp_m_freem(control->data);
4644 				control->data = NULL;
4645 			}
4646 		}
4647 		/* Reassembly free? */
4648 		TAILQ_FOREACH_SAFE(chk, &control->reasm, sctp_next, nchk) {
4649 			TAILQ_REMOVE(&control->reasm, chk, sctp_next);
4650 			if (chk->data) {
4651 				sctp_m_freem(chk->data);
4652 				chk->data = NULL;
4653 			}
4654 			if (chk->holds_key_ref)
4655 				sctp_auth_key_release(stcb, chk->auth_keyid, SCTP_SO_LOCKED);
4656 			sctp_free_remote_addr(chk->whoTo);
4657 			SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_chunk), chk);
4658 			SCTP_DECR_CHK_COUNT();
4659 			/* sa_ignore FREED_MEMORY */
4660 		}
4661 		/*
4662 		 * We don't free the address here since all the net's were
4663 		 * freed above.
4664 		 */
4665 		if (control->on_read_q == 0) {
4666 			sctp_free_a_readq(stcb, control);
4667 		}
4668 	}
4669 }
4670 
4671 /*-
4672  * Free the association after un-hashing the remote port. This
4673  * function ALWAYS returns holding NO LOCK on the stcb. It DOES
4674  * expect that the input to this function IS a locked TCB.
4675  * It will return 0, if it did NOT destroy the association (instead
4676  * it unlocks it. It will return NON-zero if it either destroyed the
4677  * association OR the association is already destroyed.
4678  */
4679 int
4680 sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfree, int from_location)
4681 {
4682 	int i;
4683 	struct sctp_association *asoc;
4684 	struct sctp_nets *net, *nnet;
4685 	struct sctp_laddr *laddr, *naddr;
4686 	struct sctp_tmit_chunk *chk, *nchk;
4687 	struct sctp_asconf_addr *aparam, *naparam;
4688 	struct sctp_asconf_ack *aack, *naack;
4689 	struct sctp_stream_reset_list *strrst, *nstrrst;
4690 	struct sctp_queued_to_read *sq, *nsq;
4691 	struct sctp_stream_queue_pending *sp, *nsp;
4692 	sctp_sharedkey_t *shared_key, *nshared_key;
4693 	struct socket *so;
4694 
4695 	/* first, lets purge the entry from the hash table. */
4696 	SCTP_TCB_LOCK_ASSERT(stcb);
4697 
4698 #ifdef SCTP_LOG_CLOSING
4699 	sctp_log_closing(inp, stcb, 6);
4700 #endif
4701 	if (stcb->asoc.state == 0) {
4702 #ifdef SCTP_LOG_CLOSING
4703 		sctp_log_closing(inp, NULL, 7);
4704 #endif
4705 		/* there is no asoc, really TSNH :-0 */
4706 		return (1);
4707 	}
4708 	if (stcb->asoc.alternate) {
4709 		sctp_free_remote_addr(stcb->asoc.alternate);
4710 		stcb->asoc.alternate = NULL;
4711 	}
4712 	/* TEMP CODE */
4713 	if (stcb->freed_from_where == 0) {
4714 		/* Only record the first place free happened from */
4715 		stcb->freed_from_where = from_location;
4716 	}
4717 	/* TEMP CODE */
4718 
4719 	asoc = &stcb->asoc;
4720 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4721 	    (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE))
4722 		/* nothing around */
4723 		so = NULL;
4724 	else
4725 		so = inp->sctp_socket;
4726 
4727 	/*
4728 	 * We used timer based freeing if a reader or writer is in the way.
4729 	 * So we first check if we are actually being called from a timer,
4730 	 * if so we abort early if a reader or writer is still in the way.
4731 	 */
4732 	if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) &&
4733 	    (from_inpcbfree == SCTP_NORMAL_PROC)) {
4734 		/*
4735 		 * is it the timer driving us? if so are the reader/writers
4736 		 * gone?
4737 		 */
4738 		if (stcb->asoc.refcnt) {
4739 			/* nope, reader or writer in the way */
4740 			sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
4741 			/* no asoc destroyed */
4742 			SCTP_TCB_UNLOCK(stcb);
4743 #ifdef SCTP_LOG_CLOSING
4744 			sctp_log_closing(inp, stcb, 8);
4745 #endif
4746 			return (0);
4747 		}
4748 	}
4749 	/* Now clean up any other timers */
4750 	sctp_stop_association_timers(stcb, false);
4751 	/* Now the read queue needs to be cleaned up (only once) */
4752 	if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0) {
4753 		SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_ABOUT_TO_BE_FREED);
4754 		SCTP_INP_READ_LOCK(inp);
4755 		TAILQ_FOREACH(sq, &inp->read_queue, next) {
4756 			if (sq->stcb == stcb) {
4757 				sq->do_not_ref_stcb = 1;
4758 				sq->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
4759 				/*
4760 				 * If there is no end, there never will be
4761 				 * now.
4762 				 */
4763 				if (sq->end_added == 0) {
4764 					/* Held for PD-API, clear that. */
4765 					sq->pdapi_aborted = 1;
4766 					sq->held_length = 0;
4767 					if (sctp_stcb_is_feature_on(inp, stcb, SCTP_PCB_FLAGS_PDAPIEVNT) && (so != NULL)) {
4768 						sctp_ulp_notify(SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION,
4769 						    stcb,
4770 						    SCTP_PARTIAL_DELIVERY_ABORTED,
4771 						    (void *)sq,
4772 						    SCTP_SO_LOCKED);
4773 					}
4774 					/* Add an end to wake them */
4775 					sq->end_added = 1;
4776 				}
4777 			}
4778 		}
4779 		SCTP_INP_READ_UNLOCK(inp);
4780 		if (stcb->block_entry) {
4781 			SCTP_LTRACE_ERR_RET(inp, stcb, NULL, SCTP_FROM_SCTP_PCB, ECONNRESET);
4782 			stcb->block_entry->error = ECONNRESET;
4783 			stcb->block_entry = NULL;
4784 		}
4785 	}
4786 	if ((stcb->asoc.refcnt) || (stcb->asoc.state & SCTP_STATE_IN_ACCEPT_QUEUE)) {
4787 		/*
4788 		 * Someone holds a reference OR the socket is unaccepted
4789 		 * yet.
4790 		 */
4791 		if ((stcb->asoc.refcnt) ||
4792 		    (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4793 		    (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
4794 			SCTP_CLEAR_SUBSTATE(stcb, SCTP_STATE_IN_ACCEPT_QUEUE);
4795 			sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
4796 		}
4797 		if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4798 		    (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE))
4799 			/* nothing around */
4800 			so = NULL;
4801 		if (so) {
4802 			/* Wake any reader/writers */
4803 			sctp_sorwakeup(inp, so);
4804 			sctp_sowwakeup(inp, so);
4805 		}
4806 		SCTP_TCB_UNLOCK(stcb);
4807 
4808 #ifdef SCTP_LOG_CLOSING
4809 		sctp_log_closing(inp, stcb, 9);
4810 #endif
4811 		/* no asoc destroyed */
4812 		return (0);
4813 	}
4814 #ifdef SCTP_LOG_CLOSING
4815 	sctp_log_closing(inp, stcb, 10);
4816 #endif
4817 	/*
4818 	 * When I reach here, no others want to kill the assoc yet.. and I
4819 	 * own the lock. Now its possible an abort comes in when I do the
4820 	 * lock exchange below to grab all the locks to do the final take
4821 	 * out. to prevent this we increment the count, which will start a
4822 	 * timer and blow out above thus assuring us that we hold exclusive
4823 	 * killing of the asoc. Note that after getting back the TCB lock we
4824 	 * will go ahead and increment the counter back up and stop any
4825 	 * timer a passing stranger may have started :-S
4826 	 */
4827 	if (from_inpcbfree == SCTP_NORMAL_PROC) {
4828 		atomic_add_int(&stcb->asoc.refcnt, 1);
4829 
4830 		SCTP_TCB_UNLOCK(stcb);
4831 		SCTP_INP_INFO_WLOCK();
4832 		SCTP_INP_WLOCK(inp);
4833 		SCTP_TCB_LOCK(stcb);
4834 	}
4835 	/* Double check the GONE flag */
4836 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4837 	    (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE))
4838 		/* nothing around */
4839 		so = NULL;
4840 
4841 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
4842 	    (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
4843 		/*
4844 		 * For TCP type we need special handling when we are
4845 		 * connected. We also include the peel'ed off ones to.
4846 		 */
4847 		if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
4848 			inp->sctp_flags &= ~SCTP_PCB_FLAGS_CONNECTED;
4849 			inp->sctp_flags |= SCTP_PCB_FLAGS_WAS_CONNECTED;
4850 			if (so) {
4851 				SOCKBUF_LOCK(&so->so_rcv);
4852 				so->so_state &= ~(SS_ISCONNECTING |
4853 				    SS_ISDISCONNECTING |
4854 				    SS_ISCONFIRMING |
4855 				    SS_ISCONNECTED);
4856 				so->so_state |= SS_ISDISCONNECTED;
4857 				socantrcvmore_locked(so);
4858 				socantsendmore(so);
4859 				sctp_sowwakeup(inp, so);
4860 				sctp_sorwakeup(inp, so);
4861 				SCTP_SOWAKEUP(so);
4862 			}
4863 		}
4864 	}
4865 
4866 	/*
4867 	 * Make it invalid too, that way if its about to run it will abort
4868 	 * and return.
4869 	 */
4870 	/* re-increment the lock */
4871 	if (from_inpcbfree == SCTP_NORMAL_PROC) {
4872 		atomic_subtract_int(&stcb->asoc.refcnt, 1);
4873 	}
4874 	if (stcb->asoc.refcnt) {
4875 		SCTP_CLEAR_SUBSTATE(stcb, SCTP_STATE_IN_ACCEPT_QUEUE);
4876 		sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
4877 		if (from_inpcbfree == SCTP_NORMAL_PROC) {
4878 			SCTP_INP_INFO_WUNLOCK();
4879 			SCTP_INP_WUNLOCK(inp);
4880 		}
4881 		SCTP_TCB_UNLOCK(stcb);
4882 		return (0);
4883 	}
4884 	asoc->state = 0;
4885 	if (inp->sctp_tcbhash) {
4886 		LIST_REMOVE(stcb, sctp_tcbhash);
4887 	}
4888 	if (stcb->asoc.in_asocid_hash) {
4889 		LIST_REMOVE(stcb, sctp_tcbasocidhash);
4890 	}
4891 	if (inp->sctp_socket == NULL) {
4892 		stcb->sctp_socket = NULL;
4893 	}
4894 	/* Now lets remove it from the list of ALL associations in the EP */
4895 	LIST_REMOVE(stcb, sctp_tcblist);
4896 	if (from_inpcbfree == SCTP_NORMAL_PROC) {
4897 		SCTP_INP_INCR_REF(inp);
4898 		SCTP_INP_WUNLOCK(inp);
4899 	}
4900 	/* pull from vtag hash */
4901 	LIST_REMOVE(stcb, sctp_asocs);
4902 	sctp_add_vtag_to_timewait(asoc->my_vtag, inp->sctp_lport, stcb->rport);
4903 
4904 	/*
4905 	 * Now restop the timers to be sure this is paranoia at is finest!
4906 	 */
4907 	sctp_stop_association_timers(stcb, true);
4908 
4909 	/*
4910 	 * The chunk lists and such SHOULD be empty but we check them just
4911 	 * in case.
4912 	 */
4913 	/* anything on the wheel needs to be removed */
4914 	for (i = 0; i < asoc->streamoutcnt; i++) {
4915 		struct sctp_stream_out *outs;
4916 
4917 		outs = &asoc->strmout[i];
4918 		/* now clean up any chunks here */
4919 		TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
4920 			atomic_subtract_int(&asoc->stream_queue_cnt, 1);
4921 			TAILQ_REMOVE(&outs->outqueue, sp, next);
4922 			stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp);
4923 			sctp_free_spbufspace(stcb, asoc, sp);
4924 			if (sp->data) {
4925 				if (so) {
4926 					/* Still an open socket - report */
4927 					sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
4928 					    0, (void *)sp, SCTP_SO_LOCKED);
4929 				}
4930 				if (sp->data) {
4931 					sctp_m_freem(sp->data);
4932 					sp->data = NULL;
4933 					sp->tail_mbuf = NULL;
4934 					sp->length = 0;
4935 				}
4936 			}
4937 			if (sp->net) {
4938 				sctp_free_remote_addr(sp->net);
4939 				sp->net = NULL;
4940 			}
4941 			sctp_free_a_strmoq(stcb, sp, SCTP_SO_LOCKED);
4942 		}
4943 	}
4944 	/* sa_ignore FREED_MEMORY */
4945 	TAILQ_FOREACH_SAFE(strrst, &asoc->resetHead, next_resp, nstrrst) {
4946 		TAILQ_REMOVE(&asoc->resetHead, strrst, next_resp);
4947 		SCTP_FREE(strrst, SCTP_M_STRESET);
4948 	}
4949 	TAILQ_FOREACH_SAFE(sq, &asoc->pending_reply_queue, next, nsq) {
4950 		TAILQ_REMOVE(&asoc->pending_reply_queue, sq, next);
4951 		if (sq->data) {
4952 			sctp_m_freem(sq->data);
4953 			sq->data = NULL;
4954 		}
4955 		sctp_free_remote_addr(sq->whoFrom);
4956 		sq->whoFrom = NULL;
4957 		sq->stcb = NULL;
4958 		/* Free the ctl entry */
4959 		sctp_free_a_readq(stcb, sq);
4960 		/* sa_ignore FREED_MEMORY */
4961 	}
4962 	TAILQ_FOREACH_SAFE(chk, &asoc->free_chunks, sctp_next, nchk) {
4963 		TAILQ_REMOVE(&asoc->free_chunks, chk, sctp_next);
4964 		if (chk->data) {
4965 			sctp_m_freem(chk->data);
4966 			chk->data = NULL;
4967 		}
4968 		if (chk->holds_key_ref)
4969 			sctp_auth_key_release(stcb, chk->auth_keyid, SCTP_SO_LOCKED);
4970 		SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_chunk), chk);
4971 		SCTP_DECR_CHK_COUNT();
4972 		atomic_subtract_int(&SCTP_BASE_INFO(ipi_free_chunks), 1);
4973 		asoc->free_chunk_cnt--;
4974 		/* sa_ignore FREED_MEMORY */
4975 	}
4976 	/* pending send queue SHOULD be empty */
4977 	TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
4978 		if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
4979 			asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
4980 #ifdef INVARIANTS
4981 		} else {
4982 			panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
4983 #endif
4984 		}
4985 		TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
4986 		if (chk->data) {
4987 			if (so) {
4988 				/* Still a socket? */
4989 				sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
4990 				    0, chk, SCTP_SO_LOCKED);
4991 			}
4992 			if (chk->data) {
4993 				sctp_m_freem(chk->data);
4994 				chk->data = NULL;
4995 			}
4996 		}
4997 		if (chk->holds_key_ref)
4998 			sctp_auth_key_release(stcb, chk->auth_keyid, SCTP_SO_LOCKED);
4999 		if (chk->whoTo) {
5000 			sctp_free_remote_addr(chk->whoTo);
5001 			chk->whoTo = NULL;
5002 		}
5003 		SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_chunk), chk);
5004 		SCTP_DECR_CHK_COUNT();
5005 		/* sa_ignore FREED_MEMORY */
5006 	}
5007 	/* sent queue SHOULD be empty */
5008 	TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) {
5009 		if (chk->sent != SCTP_DATAGRAM_NR_ACKED) {
5010 			if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
5011 				asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
5012 #ifdef INVARIANTS
5013 			} else {
5014 				panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
5015 #endif
5016 			}
5017 		}
5018 		TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
5019 		if (chk->data) {
5020 			if (so) {
5021 				/* Still a socket? */
5022 				sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb,
5023 				    0, chk, SCTP_SO_LOCKED);
5024 			}
5025 			if (chk->data) {
5026 				sctp_m_freem(chk->data);
5027 				chk->data = NULL;
5028 			}
5029 		}
5030 		if (chk->holds_key_ref)
5031 			sctp_auth_key_release(stcb, chk->auth_keyid, SCTP_SO_LOCKED);
5032 		sctp_free_remote_addr(chk->whoTo);
5033 		SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_chunk), chk);
5034 		SCTP_DECR_CHK_COUNT();
5035 		/* sa_ignore FREED_MEMORY */
5036 	}
5037 #ifdef INVARIANTS
5038 	for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
5039 		if (stcb->asoc.strmout[i].chunks_on_queues > 0) {
5040 			panic("%u chunks left for stream %u.", stcb->asoc.strmout[i].chunks_on_queues, i);
5041 		}
5042 	}
5043 #endif
5044 	/* control queue MAY not be empty */
5045 	TAILQ_FOREACH_SAFE(chk, &asoc->control_send_queue, sctp_next, nchk) {
5046 		TAILQ_REMOVE(&asoc->control_send_queue, chk, sctp_next);
5047 		if (chk->data) {
5048 			sctp_m_freem(chk->data);
5049 			chk->data = NULL;
5050 		}
5051 		if (chk->holds_key_ref)
5052 			sctp_auth_key_release(stcb, chk->auth_keyid, SCTP_SO_LOCKED);
5053 		sctp_free_remote_addr(chk->whoTo);
5054 		SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_chunk), chk);
5055 		SCTP_DECR_CHK_COUNT();
5056 		/* sa_ignore FREED_MEMORY */
5057 	}
5058 	/* ASCONF queue MAY not be empty */
5059 	TAILQ_FOREACH_SAFE(chk, &asoc->asconf_send_queue, sctp_next, nchk) {
5060 		TAILQ_REMOVE(&asoc->asconf_send_queue, chk, sctp_next);
5061 		if (chk->data) {
5062 			sctp_m_freem(chk->data);
5063 			chk->data = NULL;
5064 		}
5065 		if (chk->holds_key_ref)
5066 			sctp_auth_key_release(stcb, chk->auth_keyid, SCTP_SO_LOCKED);
5067 		sctp_free_remote_addr(chk->whoTo);
5068 		SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_chunk), chk);
5069 		SCTP_DECR_CHK_COUNT();
5070 		/* sa_ignore FREED_MEMORY */
5071 	}
5072 	if (asoc->mapping_array) {
5073 		SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
5074 		asoc->mapping_array = NULL;
5075 	}
5076 	if (asoc->nr_mapping_array) {
5077 		SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
5078 		asoc->nr_mapping_array = NULL;
5079 	}
5080 	/* the stream outs */
5081 	if (asoc->strmout) {
5082 		SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
5083 		asoc->strmout = NULL;
5084 	}
5085 	asoc->strm_realoutsize = asoc->streamoutcnt = 0;
5086 	if (asoc->strmin) {
5087 		for (i = 0; i < asoc->streamincnt; i++) {
5088 			sctp_clean_up_stream(stcb, &asoc->strmin[i].inqueue);
5089 			sctp_clean_up_stream(stcb, &asoc->strmin[i].uno_inqueue);
5090 		}
5091 		SCTP_FREE(asoc->strmin, SCTP_M_STRMI);
5092 		asoc->strmin = NULL;
5093 	}
5094 	asoc->streamincnt = 0;
5095 	TAILQ_FOREACH_SAFE(net, &asoc->nets, sctp_next, nnet) {
5096 #ifdef INVARIANTS
5097 		if (SCTP_BASE_INFO(ipi_count_raddr) == 0) {
5098 			panic("no net's left alloc'ed, or list points to itself");
5099 		}
5100 #endif
5101 		TAILQ_REMOVE(&asoc->nets, net, sctp_next);
5102 		sctp_free_remote_addr(net);
5103 	}
5104 	LIST_FOREACH_SAFE(laddr, &asoc->sctp_restricted_addrs, sctp_nxt_addr, naddr) {
5105 		/* sa_ignore FREED_MEMORY */
5106 		sctp_remove_laddr(laddr);
5107 	}
5108 
5109 	/* pending asconf (address) parameters */
5110 	TAILQ_FOREACH_SAFE(aparam, &asoc->asconf_queue, next, naparam) {
5111 		/* sa_ignore FREED_MEMORY */
5112 		TAILQ_REMOVE(&asoc->asconf_queue, aparam, next);
5113 		SCTP_FREE(aparam, SCTP_M_ASC_ADDR);
5114 	}
5115 	TAILQ_FOREACH_SAFE(aack, &asoc->asconf_ack_sent, next, naack) {
5116 		/* sa_ignore FREED_MEMORY */
5117 		TAILQ_REMOVE(&asoc->asconf_ack_sent, aack, next);
5118 		if (aack->data != NULL) {
5119 			sctp_m_freem(aack->data);
5120 		}
5121 		SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asconf_ack), aack);
5122 	}
5123 	/* clean up auth stuff */
5124 	if (asoc->local_hmacs)
5125 		sctp_free_hmaclist(asoc->local_hmacs);
5126 	if (asoc->peer_hmacs)
5127 		sctp_free_hmaclist(asoc->peer_hmacs);
5128 
5129 	if (asoc->local_auth_chunks)
5130 		sctp_free_chunklist(asoc->local_auth_chunks);
5131 	if (asoc->peer_auth_chunks)
5132 		sctp_free_chunklist(asoc->peer_auth_chunks);
5133 
5134 	sctp_free_authinfo(&asoc->authinfo);
5135 
5136 	LIST_FOREACH_SAFE(shared_key, &asoc->shared_keys, next, nshared_key) {
5137 		LIST_REMOVE(shared_key, next);
5138 		sctp_free_sharedkey(shared_key);
5139 		/* sa_ignore FREED_MEMORY */
5140 	}
5141 
5142 	/* Insert new items here :> */
5143 
5144 	/* Get rid of LOCK */
5145 	SCTP_TCB_UNLOCK(stcb);
5146 	SCTP_TCB_LOCK_DESTROY(stcb);
5147 	if (from_inpcbfree == SCTP_NORMAL_PROC) {
5148 		SCTP_INP_INFO_WUNLOCK();
5149 		SCTP_INP_RLOCK(inp);
5150 	}
5151 #ifdef SCTP_TRACK_FREED_ASOCS
5152 	if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5153 		/* now clean up the tasoc itself */
5154 		SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asoc), stcb);
5155 		SCTP_DECR_ASOC_COUNT();
5156 	} else {
5157 		LIST_INSERT_HEAD(&inp->sctp_asoc_free_list, stcb, sctp_tcblist);
5158 	}
5159 #else
5160 	SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_asoc), stcb);
5161 	SCTP_DECR_ASOC_COUNT();
5162 #endif
5163 	if (from_inpcbfree == SCTP_NORMAL_PROC) {
5164 		if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5165 			/*
5166 			 * If its NOT the inp_free calling us AND sctp_close
5167 			 * as been called, we call back...
5168 			 */
5169 			SCTP_INP_RUNLOCK(inp);
5170 			/*
5171 			 * This will start the kill timer (if we are the
5172 			 * last one) since we hold an increment yet. But
5173 			 * this is the only safe way to do this since
5174 			 * otherwise if the socket closes at the same time
5175 			 * we are here we might collide in the cleanup.
5176 			 */
5177 			sctp_inpcb_free(inp,
5178 			    SCTP_FREE_SHOULD_USE_GRACEFUL_CLOSE,
5179 			    SCTP_CALLED_DIRECTLY_NOCMPSET);
5180 			SCTP_INP_DECR_REF(inp);
5181 		} else {
5182 			/* The socket is still open. */
5183 			SCTP_INP_DECR_REF(inp);
5184 			SCTP_INP_RUNLOCK(inp);
5185 		}
5186 	}
5187 	/* destroyed the asoc */
5188 #ifdef SCTP_LOG_CLOSING
5189 	sctp_log_closing(inp, NULL, 11);
5190 #endif
5191 	return (1);
5192 }
5193 
5194 /*
5195  * determine if a destination is "reachable" based upon the addresses bound
5196  * to the current endpoint (e.g. only v4 or v6 currently bound)
5197  */
5198 /*
5199  * FIX: if we allow assoc-level bindx(), then this needs to be fixed to use
5200  * assoc level v4/v6 flags, as the assoc *may* not have the same address
5201  * types bound as its endpoint
5202  */
5203 int
5204 sctp_destination_is_reachable(struct sctp_tcb *stcb, struct sockaddr *destaddr)
5205 {
5206 	struct sctp_inpcb *inp;
5207 	int answer;
5208 
5209 	/*
5210 	 * No locks here, the TCB, in all cases is already locked and an
5211 	 * assoc is up. There is either a INP lock by the caller applied (in
5212 	 * asconf case when deleting an address) or NOT in the HB case,
5213 	 * however if HB then the INP increment is up and the INP will not
5214 	 * be removed (on top of the fact that we have a TCB lock). So we
5215 	 * only want to read the sctp_flags, which is either bound-all or
5216 	 * not.. no protection needed since once an assoc is up you can't be
5217 	 * changing your binding.
5218 	 */
5219 	inp = stcb->sctp_ep;
5220 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
5221 		/* if bound all, destination is not restricted */
5222 		/*
5223 		 * RRS: Question during lock work: Is this correct? If you
5224 		 * are bound-all you still might need to obey the V4--V6
5225 		 * flags??? IMO this bound-all stuff needs to be removed!
5226 		 */
5227 		return (1);
5228 	}
5229 	/* NOTE: all "scope" checks are done when local addresses are added */
5230 	switch (destaddr->sa_family) {
5231 #ifdef INET6
5232 	case AF_INET6:
5233 		answer = inp->ip_inp.inp.inp_vflag & INP_IPV6;
5234 		break;
5235 #endif
5236 #ifdef INET
5237 	case AF_INET:
5238 		answer = inp->ip_inp.inp.inp_vflag & INP_IPV4;
5239 		break;
5240 #endif
5241 	default:
5242 		/* invalid family, so it's unreachable */
5243 		answer = 0;
5244 		break;
5245 	}
5246 	return (answer);
5247 }
5248 
5249 /*
5250  * update the inp_vflags on an endpoint
5251  */
5252 static void
5253 sctp_update_ep_vflag(struct sctp_inpcb *inp)
5254 {
5255 	struct sctp_laddr *laddr;
5256 
5257 	/* first clear the flag */
5258 	inp->ip_inp.inp.inp_vflag = 0;
5259 	/* set the flag based on addresses on the ep list */
5260 	LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
5261 		if (laddr->ifa == NULL) {
5262 			SCTPDBG(SCTP_DEBUG_PCB1, "%s: NULL ifa\n",
5263 			    __func__);
5264 			continue;
5265 		}
5266 
5267 		if (laddr->ifa->localifa_flags & SCTP_BEING_DELETED) {
5268 			continue;
5269 		}
5270 		switch (laddr->ifa->address.sa.sa_family) {
5271 #ifdef INET6
5272 		case AF_INET6:
5273 			inp->ip_inp.inp.inp_vflag |= INP_IPV6;
5274 			break;
5275 #endif
5276 #ifdef INET
5277 		case AF_INET:
5278 			inp->ip_inp.inp.inp_vflag |= INP_IPV4;
5279 			break;
5280 #endif
5281 		default:
5282 			break;
5283 		}
5284 	}
5285 }
5286 
5287 /*
5288  * Add the address to the endpoint local address list There is nothing to be
5289  * done if we are bound to all addresses
5290  */
5291 void
5292 sctp_add_local_addr_ep(struct sctp_inpcb *inp, struct sctp_ifa *ifa, uint32_t action)
5293 {
5294 	struct sctp_laddr *laddr;
5295 	struct sctp_tcb *stcb;
5296 	int fnd, error = 0;
5297 
5298 	fnd = 0;
5299 
5300 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
5301 		/* You are already bound to all. You have it already */
5302 		return;
5303 	}
5304 #ifdef INET6
5305 	if (ifa->address.sa.sa_family == AF_INET6) {
5306 		if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
5307 			/* Can't bind a non-useable addr. */
5308 			return;
5309 		}
5310 	}
5311 #endif
5312 	/* first, is it already present? */
5313 	LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
5314 		if (laddr->ifa == ifa) {
5315 			fnd = 1;
5316 			break;
5317 		}
5318 	}
5319 
5320 	if (fnd == 0) {
5321 		/* Not in the ep list */
5322 		error = sctp_insert_laddr(&inp->sctp_addr_list, ifa, action);
5323 		if (error != 0)
5324 			return;
5325 		inp->laddr_count++;
5326 		/* update inp_vflag flags */
5327 		switch (ifa->address.sa.sa_family) {
5328 #ifdef INET6
5329 		case AF_INET6:
5330 			inp->ip_inp.inp.inp_vflag |= INP_IPV6;
5331 			break;
5332 #endif
5333 #ifdef INET
5334 		case AF_INET:
5335 			inp->ip_inp.inp.inp_vflag |= INP_IPV4;
5336 			break;
5337 #endif
5338 		default:
5339 			break;
5340 		}
5341 		LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
5342 			sctp_add_local_addr_restricted(stcb, ifa);
5343 		}
5344 	}
5345 	return;
5346 }
5347 
5348 /*
5349  * select a new (hopefully reachable) destination net (should only be used
5350  * when we deleted an ep addr that is the only usable source address to reach
5351  * the destination net)
5352  */
5353 static void
5354 sctp_select_primary_destination(struct sctp_tcb *stcb)
5355 {
5356 	struct sctp_nets *net;
5357 
5358 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
5359 		/* for now, we'll just pick the first reachable one we find */
5360 		if (net->dest_state & SCTP_ADDR_UNCONFIRMED)
5361 			continue;
5362 		if (sctp_destination_is_reachable(stcb,
5363 		    (struct sockaddr *)&net->ro._l_addr)) {
5364 			/* found a reachable destination */
5365 			stcb->asoc.primary_destination = net;
5366 		}
5367 	}
5368 	/* I can't there from here! ...we're gonna die shortly... */
5369 }
5370 
5371 /*
5372  * Delete the address from the endpoint local address list. There is nothing
5373  * to be done if we are bound to all addresses
5374  */
5375 void
5376 sctp_del_local_addr_ep(struct sctp_inpcb *inp, struct sctp_ifa *ifa)
5377 {
5378 	struct sctp_laddr *laddr;
5379 	int fnd;
5380 
5381 	fnd = 0;
5382 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
5383 		/* You are already bound to all. You have it already */
5384 		return;
5385 	}
5386 	LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
5387 		if (laddr->ifa == ifa) {
5388 			fnd = 1;
5389 			break;
5390 		}
5391 	}
5392 	if (fnd && (inp->laddr_count < 2)) {
5393 		/* can't delete unless there are at LEAST 2 addresses */
5394 		return;
5395 	}
5396 	if (fnd) {
5397 		/*
5398 		 * clean up any use of this address go through our
5399 		 * associations and clear any last_used_address that match
5400 		 * this one for each assoc, see if a new primary_destination
5401 		 * is needed
5402 		 */
5403 		struct sctp_tcb *stcb;
5404 
5405 		/* clean up "next_addr_touse" */
5406 		if (inp->next_addr_touse == laddr)
5407 			/* delete this address */
5408 			inp->next_addr_touse = NULL;
5409 
5410 		/* clean up "last_used_address" */
5411 		LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
5412 			struct sctp_nets *net;
5413 
5414 			SCTP_TCB_LOCK(stcb);
5415 			if (stcb->asoc.last_used_address == laddr)
5416 				/* delete this address */
5417 				stcb->asoc.last_used_address = NULL;
5418 			/*
5419 			 * Now spin through all the nets and purge any ref
5420 			 * to laddr
5421 			 */
5422 			TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
5423 				if (net->ro._s_addr == laddr->ifa) {
5424 					/* Yep, purge src address selected */
5425 					RO_NHFREE(&net->ro);
5426 					sctp_free_ifa(net->ro._s_addr);
5427 					net->ro._s_addr = NULL;
5428 					net->src_addr_selected = 0;
5429 				}
5430 			}
5431 			SCTP_TCB_UNLOCK(stcb);
5432 		}		/* for each tcb */
5433 		/* remove it from the ep list */
5434 		sctp_remove_laddr(laddr);
5435 		inp->laddr_count--;
5436 		/* update inp_vflag flags */
5437 		sctp_update_ep_vflag(inp);
5438 	}
5439 	return;
5440 }
5441 
5442 /*
5443  * Add the address to the TCB local address restricted list.
5444  * This is a "pending" address list (eg. addresses waiting for an
5445  * ASCONF-ACK response) and cannot be used as a valid source address.
5446  */
5447 void
5448 sctp_add_local_addr_restricted(struct sctp_tcb *stcb, struct sctp_ifa *ifa)
5449 {
5450 	struct sctp_laddr *laddr;
5451 	struct sctpladdr *list;
5452 
5453 	/*
5454 	 * Assumes TCB is locked.. and possibly the INP. May need to
5455 	 * confirm/fix that if we need it and is not the case.
5456 	 */
5457 	list = &stcb->asoc.sctp_restricted_addrs;
5458 
5459 #ifdef INET6
5460 	if (ifa->address.sa.sa_family == AF_INET6) {
5461 		if (ifa->localifa_flags & SCTP_ADDR_IFA_UNUSEABLE) {
5462 			/* Can't bind a non-existent addr. */
5463 			return;
5464 		}
5465 	}
5466 #endif
5467 	/* does the address already exist? */
5468 	LIST_FOREACH(laddr, list, sctp_nxt_addr) {
5469 		if (laddr->ifa == ifa) {
5470 			return;
5471 		}
5472 	}
5473 
5474 	/* add to the list */
5475 	(void)sctp_insert_laddr(list, ifa, 0);
5476 	return;
5477 }
5478 
5479 /*
5480  * Remove a local address from the TCB local address restricted list
5481  */
5482 void
5483 sctp_del_local_addr_restricted(struct sctp_tcb *stcb, struct sctp_ifa *ifa)
5484 {
5485 	struct sctp_inpcb *inp;
5486 	struct sctp_laddr *laddr;
5487 
5488 	/*
5489 	 * This is called by asconf work. It is assumed that a) The TCB is
5490 	 * locked and b) The INP is locked. This is true in as much as I can
5491 	 * trace through the entry asconf code where I did these locks.
5492 	 * Again, the ASCONF code is a bit different in that it does lock
5493 	 * the INP during its work often times. This must be since we don't
5494 	 * want other proc's looking up things while what they are looking
5495 	 * up is changing :-D
5496 	 */
5497 
5498 	inp = stcb->sctp_ep;
5499 	/* if subset bound and don't allow ASCONF's, can't delete last */
5500 	if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) &&
5501 	    sctp_is_feature_off(inp, SCTP_PCB_FLAGS_DO_ASCONF)) {
5502 		if (stcb->sctp_ep->laddr_count < 2) {
5503 			/* can't delete last address */
5504 			return;
5505 		}
5506 	}
5507 	LIST_FOREACH(laddr, &stcb->asoc.sctp_restricted_addrs, sctp_nxt_addr) {
5508 		/* remove the address if it exists */
5509 		if (laddr->ifa == NULL)
5510 			continue;
5511 		if (laddr->ifa == ifa) {
5512 			sctp_remove_laddr(laddr);
5513 			return;
5514 		}
5515 	}
5516 
5517 	/* address not found! */
5518 	return;
5519 }
5520 
5521 /* sysctl */
5522 static int sctp_max_number_of_assoc = SCTP_MAX_NUM_OF_ASOC;
5523 static int sctp_scale_up_for_address = SCTP_SCALE_FOR_ADDR;
5524 
5525 #if defined(SCTP_MCORE_INPUT) && defined(SMP)
5526 struct sctp_mcore_ctrl *sctp_mcore_workers = NULL;
5527 int *sctp_cpuarry = NULL;
5528 
5529 void
5530 sctp_queue_to_mcore(struct mbuf *m, int off, int cpu_to_use)
5531 {
5532 	/* Queue a packet to a processor for the specified core */
5533 	struct sctp_mcore_queue *qent;
5534 	struct sctp_mcore_ctrl *wkq;
5535 	int need_wake = 0;
5536 
5537 	if (sctp_mcore_workers == NULL) {
5538 		/* Something went way bad during setup */
5539 		sctp_input_with_port(m, off, 0);
5540 		return;
5541 	}
5542 	SCTP_MALLOC(qent, struct sctp_mcore_queue *,
5543 	    (sizeof(struct sctp_mcore_queue)),
5544 	    SCTP_M_MCORE);
5545 	if (qent == NULL) {
5546 		/* This is trouble  */
5547 		sctp_input_with_port(m, off, 0);
5548 		return;
5549 	}
5550 	qent->vn = curvnet;
5551 	qent->m = m;
5552 	qent->off = off;
5553 	qent->v6 = 0;
5554 	wkq = &sctp_mcore_workers[cpu_to_use];
5555 	SCTP_MCORE_QLOCK(wkq);
5556 
5557 	TAILQ_INSERT_TAIL(&wkq->que, qent, next);
5558 	if (wkq->running == 0) {
5559 		need_wake = 1;
5560 	}
5561 	SCTP_MCORE_QUNLOCK(wkq);
5562 	if (need_wake) {
5563 		wakeup(&wkq->running);
5564 	}
5565 }
5566 
5567 static void
5568 sctp_mcore_thread(void *arg)
5569 {
5570 
5571 	struct sctp_mcore_ctrl *wkq;
5572 	struct sctp_mcore_queue *qent;
5573 
5574 	wkq = (struct sctp_mcore_ctrl *)arg;
5575 	struct mbuf *m;
5576 	int off, v6;
5577 
5578 	/* Wait for first tickle */
5579 	SCTP_MCORE_LOCK(wkq);
5580 	wkq->running = 0;
5581 	msleep(&wkq->running,
5582 	    &wkq->core_mtx,
5583 	    0, "wait for pkt", 0);
5584 	SCTP_MCORE_UNLOCK(wkq);
5585 
5586 	/* Bind to our cpu */
5587 	thread_lock(curthread);
5588 	sched_bind(curthread, wkq->cpuid);
5589 	thread_unlock(curthread);
5590 
5591 	/* Now lets start working */
5592 	SCTP_MCORE_LOCK(wkq);
5593 	/* Now grab lock and go */
5594 	for (;;) {
5595 		SCTP_MCORE_QLOCK(wkq);
5596 skip_sleep:
5597 		wkq->running = 1;
5598 		qent = TAILQ_FIRST(&wkq->que);
5599 		if (qent) {
5600 			TAILQ_REMOVE(&wkq->que, qent, next);
5601 			SCTP_MCORE_QUNLOCK(wkq);
5602 			CURVNET_SET(qent->vn);
5603 			m = qent->m;
5604 			off = qent->off;
5605 			v6 = qent->v6;
5606 			SCTP_FREE(qent, SCTP_M_MCORE);
5607 			if (v6 == 0) {
5608 				sctp_input_with_port(m, off, 0);
5609 			} else {
5610 				SCTP_PRINTF("V6 not yet supported\n");
5611 				sctp_m_freem(m);
5612 			}
5613 			CURVNET_RESTORE();
5614 			SCTP_MCORE_QLOCK(wkq);
5615 		}
5616 		wkq->running = 0;
5617 		if (!TAILQ_EMPTY(&wkq->que)) {
5618 			goto skip_sleep;
5619 		}
5620 		SCTP_MCORE_QUNLOCK(wkq);
5621 		msleep(&wkq->running,
5622 		    &wkq->core_mtx,
5623 		    0, "wait for pkt", 0);
5624 	}
5625 }
5626 
5627 static void
5628 sctp_startup_mcore_threads(void)
5629 {
5630 	int i, cpu;
5631 
5632 	if (mp_ncpus == 1)
5633 		return;
5634 
5635 	if (sctp_mcore_workers != NULL) {
5636 		/*
5637 		 * Already been here in some previous vnet?
5638 		 */
5639 		return;
5640 	}
5641 	SCTP_MALLOC(sctp_mcore_workers, struct sctp_mcore_ctrl *,
5642 	    ((mp_maxid + 1) * sizeof(struct sctp_mcore_ctrl)),
5643 	    SCTP_M_MCORE);
5644 	if (sctp_mcore_workers == NULL) {
5645 		/* TSNH I hope */
5646 		return;
5647 	}
5648 	memset(sctp_mcore_workers, 0, ((mp_maxid + 1) *
5649 	    sizeof(struct sctp_mcore_ctrl)));
5650 	/* Init the structures */
5651 	for (i = 0; i <= mp_maxid; i++) {
5652 		TAILQ_INIT(&sctp_mcore_workers[i].que);
5653 		SCTP_MCORE_LOCK_INIT(&sctp_mcore_workers[i]);
5654 		SCTP_MCORE_QLOCK_INIT(&sctp_mcore_workers[i]);
5655 		sctp_mcore_workers[i].cpuid = i;
5656 	}
5657 	if (sctp_cpuarry == NULL) {
5658 		SCTP_MALLOC(sctp_cpuarry, int *,
5659 		    (mp_ncpus * sizeof(int)),
5660 		    SCTP_M_MCORE);
5661 		i = 0;
5662 		CPU_FOREACH(cpu) {
5663 			sctp_cpuarry[i] = cpu;
5664 			i++;
5665 		}
5666 	}
5667 	/* Now start them all */
5668 	CPU_FOREACH(cpu) {
5669 		(void)kproc_create(sctp_mcore_thread,
5670 		    (void *)&sctp_mcore_workers[cpu],
5671 		    &sctp_mcore_workers[cpu].thread_proc,
5672 		    0,
5673 		    SCTP_KTHREAD_PAGES,
5674 		    SCTP_MCORE_NAME);
5675 	}
5676 }
5677 #endif
5678 
5679 void
5680 sctp_pcb_init(void)
5681 {
5682 	/*
5683 	 * SCTP initialization for the PCB structures should be called by
5684 	 * the sctp_init() function.
5685 	 */
5686 	int i;
5687 	struct timeval tv;
5688 
5689 	if (SCTP_BASE_VAR(sctp_pcb_initialized) != 0) {
5690 		/* error I was called twice */
5691 		return;
5692 	}
5693 	SCTP_BASE_VAR(sctp_pcb_initialized) = 1;
5694 
5695 #if defined(SCTP_LOCAL_TRACE_BUF)
5696 	memset(&SCTP_BASE_SYSCTL(sctp_log), 0, sizeof(struct sctp_log));
5697 #endif
5698 #if defined(SMP) && defined(SCTP_USE_PERCPU_STAT)
5699 	SCTP_MALLOC(SCTP_BASE_STATS, struct sctpstat *,
5700 	    ((mp_maxid + 1) * sizeof(struct sctpstat)),
5701 	    SCTP_M_MCORE);
5702 #endif
5703 	(void)SCTP_GETTIME_TIMEVAL(&tv);
5704 #if defined(SMP) && defined(SCTP_USE_PERCPU_STAT)
5705 	memset(SCTP_BASE_STATS, 0, sizeof(struct sctpstat) * (mp_maxid + 1));
5706 	SCTP_BASE_STATS[PCPU_GET(cpuid)].sctps_discontinuitytime.tv_sec = (uint32_t)tv.tv_sec;
5707 	SCTP_BASE_STATS[PCPU_GET(cpuid)].sctps_discontinuitytime.tv_usec = (uint32_t)tv.tv_usec;
5708 #else
5709 	memset(&SCTP_BASE_STATS, 0, sizeof(struct sctpstat));
5710 	SCTP_BASE_STAT(sctps_discontinuitytime).tv_sec = (uint32_t)tv.tv_sec;
5711 	SCTP_BASE_STAT(sctps_discontinuitytime).tv_usec = (uint32_t)tv.tv_usec;
5712 #endif
5713 	/* init the empty list of (All) Endpoints */
5714 	LIST_INIT(&SCTP_BASE_INFO(listhead));
5715 
5716 	/* init the hash table of endpoints */
5717 	TUNABLE_INT_FETCH("net.inet.sctp.tcbhashsize", &SCTP_BASE_SYSCTL(sctp_hashtblsize));
5718 	TUNABLE_INT_FETCH("net.inet.sctp.pcbhashsize", &SCTP_BASE_SYSCTL(sctp_pcbtblsize));
5719 	TUNABLE_INT_FETCH("net.inet.sctp.chunkscale", &SCTP_BASE_SYSCTL(sctp_chunkscale));
5720 	SCTP_BASE_INFO(sctp_asochash) = SCTP_HASH_INIT((SCTP_BASE_SYSCTL(sctp_hashtblsize) * 31),
5721 	    &SCTP_BASE_INFO(hashasocmark));
5722 	SCTP_BASE_INFO(sctp_ephash) = SCTP_HASH_INIT(SCTP_BASE_SYSCTL(sctp_hashtblsize),
5723 	    &SCTP_BASE_INFO(hashmark));
5724 	SCTP_BASE_INFO(sctp_tcpephash) = SCTP_HASH_INIT(SCTP_BASE_SYSCTL(sctp_hashtblsize),
5725 	    &SCTP_BASE_INFO(hashtcpmark));
5726 	SCTP_BASE_INFO(hashtblsize) = SCTP_BASE_SYSCTL(sctp_hashtblsize);
5727 	SCTP_BASE_INFO(sctp_vrfhash) = SCTP_HASH_INIT(SCTP_SIZE_OF_VRF_HASH,
5728 	    &SCTP_BASE_INFO(hashvrfmark));
5729 
5730 	SCTP_BASE_INFO(vrf_ifn_hash) = SCTP_HASH_INIT(SCTP_VRF_IFN_HASH_SIZE,
5731 	    &SCTP_BASE_INFO(vrf_ifn_hashmark));
5732 	/* init the zones */
5733 	/*
5734 	 * FIX ME: Should check for NULL returns, but if it does fail we are
5735 	 * doomed to panic anyways... add later maybe.
5736 	 */
5737 	SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_ep), "sctp_ep",
5738 	    sizeof(struct sctp_inpcb), maxsockets);
5739 
5740 	SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_asoc), "sctp_asoc",
5741 	    sizeof(struct sctp_tcb), sctp_max_number_of_assoc);
5742 
5743 	SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_laddr), "sctp_laddr",
5744 	    sizeof(struct sctp_laddr),
5745 	    (sctp_max_number_of_assoc * sctp_scale_up_for_address));
5746 
5747 	SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_net), "sctp_raddr",
5748 	    sizeof(struct sctp_nets),
5749 	    (sctp_max_number_of_assoc * sctp_scale_up_for_address));
5750 
5751 	SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_chunk), "sctp_chunk",
5752 	    sizeof(struct sctp_tmit_chunk),
5753 	    (sctp_max_number_of_assoc * SCTP_BASE_SYSCTL(sctp_chunkscale)));
5754 
5755 	SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_readq), "sctp_readq",
5756 	    sizeof(struct sctp_queued_to_read),
5757 	    (sctp_max_number_of_assoc * SCTP_BASE_SYSCTL(sctp_chunkscale)));
5758 
5759 	SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_strmoq), "sctp_stream_msg_out",
5760 	    sizeof(struct sctp_stream_queue_pending),
5761 	    (sctp_max_number_of_assoc * SCTP_BASE_SYSCTL(sctp_chunkscale)));
5762 
5763 	SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_asconf), "sctp_asconf",
5764 	    sizeof(struct sctp_asconf),
5765 	    (sctp_max_number_of_assoc * SCTP_BASE_SYSCTL(sctp_chunkscale)));
5766 
5767 	SCTP_ZONE_INIT(SCTP_BASE_INFO(ipi_zone_asconf_ack), "sctp_asconf_ack",
5768 	    sizeof(struct sctp_asconf_ack),
5769 	    (sctp_max_number_of_assoc * SCTP_BASE_SYSCTL(sctp_chunkscale)));
5770 
5771 	/* Master Lock INIT for info structure */
5772 	SCTP_INP_INFO_LOCK_INIT();
5773 	SCTP_STATLOG_INIT_LOCK();
5774 
5775 	SCTP_IPI_COUNT_INIT();
5776 	SCTP_IPI_ADDR_INIT();
5777 #ifdef SCTP_PACKET_LOGGING
5778 	SCTP_IP_PKTLOG_INIT();
5779 #endif
5780 	LIST_INIT(&SCTP_BASE_INFO(addr_wq));
5781 
5782 	SCTP_WQ_ADDR_INIT();
5783 	/* not sure if we need all the counts */
5784 	SCTP_BASE_INFO(ipi_count_ep) = 0;
5785 	/* assoc/tcb zone info */
5786 	SCTP_BASE_INFO(ipi_count_asoc) = 0;
5787 	/* local addrlist zone info */
5788 	SCTP_BASE_INFO(ipi_count_laddr) = 0;
5789 	/* remote addrlist zone info */
5790 	SCTP_BASE_INFO(ipi_count_raddr) = 0;
5791 	/* chunk info */
5792 	SCTP_BASE_INFO(ipi_count_chunk) = 0;
5793 
5794 	/* socket queue zone info */
5795 	SCTP_BASE_INFO(ipi_count_readq) = 0;
5796 
5797 	/* stream out queue cont */
5798 	SCTP_BASE_INFO(ipi_count_strmoq) = 0;
5799 
5800 	SCTP_BASE_INFO(ipi_free_strmoq) = 0;
5801 	SCTP_BASE_INFO(ipi_free_chunks) = 0;
5802 
5803 	SCTP_OS_TIMER_INIT(&SCTP_BASE_INFO(addr_wq_timer.timer));
5804 
5805 	/* Init the TIMEWAIT list */
5806 	for (i = 0; i < SCTP_STACK_VTAG_HASH_SIZE; i++) {
5807 		LIST_INIT(&SCTP_BASE_INFO(vtag_timewait)[i]);
5808 	}
5809 	sctp_startup_iterator();
5810 
5811 #if defined(SCTP_MCORE_INPUT) && defined(SMP)
5812 	sctp_startup_mcore_threads();
5813 #endif
5814 
5815 	/*
5816 	 * INIT the default VRF which for BSD is the only one, other O/S's
5817 	 * may have more. But initially they must start with one and then
5818 	 * add the VRF's as addresses are added.
5819 	 */
5820 	sctp_init_vrf_list(SCTP_DEFAULT_VRF);
5821 }
5822 
5823 /*
5824  * Assumes that the SCTP_BASE_INFO() lock is NOT held.
5825  */
5826 void
5827 sctp_pcb_finish(void)
5828 {
5829 	struct sctp_vrflist *vrf_bucket;
5830 	struct sctp_vrf *vrf, *nvrf;
5831 	struct sctp_ifn *ifn, *nifn;
5832 	struct sctp_ifa *ifa, *nifa;
5833 	struct sctpvtaghead *chain;
5834 	struct sctp_tagblock *twait_block, *prev_twait_block;
5835 	struct sctp_laddr *wi, *nwi;
5836 	int i;
5837 	struct sctp_iterator *it, *nit;
5838 
5839 	if (SCTP_BASE_VAR(sctp_pcb_initialized) == 0) {
5840 		SCTP_PRINTF("%s: race condition on teardown.\n", __func__);
5841 		return;
5842 	}
5843 	SCTP_BASE_VAR(sctp_pcb_initialized) = 0;
5844 	/*
5845 	 * In FreeBSD the iterator thread never exits but we do clean up.
5846 	 * The only way FreeBSD reaches here is if we have VRF's but we
5847 	 * still add the ifdef to make it compile on old versions.
5848 	 */
5849 retry:
5850 	SCTP_IPI_ITERATOR_WQ_LOCK();
5851 	/*
5852 	 * sctp_iterator_worker() might be working on an it entry without
5853 	 * holding the lock.  We won't find it on the list either and
5854 	 * continue and free/destroy it.  While holding the lock, spin, to
5855 	 * avoid the race condition as sctp_iterator_worker() will have to
5856 	 * wait to re-acquire the lock.
5857 	 */
5858 	if (sctp_it_ctl.iterator_running != 0 || sctp_it_ctl.cur_it != NULL) {
5859 		SCTP_IPI_ITERATOR_WQ_UNLOCK();
5860 		SCTP_PRINTF("%s: Iterator running while we held the lock. Retry. "
5861 		    "cur_it=%p\n", __func__, sctp_it_ctl.cur_it);
5862 		DELAY(10);
5863 		goto retry;
5864 	}
5865 	TAILQ_FOREACH_SAFE(it, &sctp_it_ctl.iteratorhead, sctp_nxt_itr, nit) {
5866 		if (it->vn != curvnet) {
5867 			continue;
5868 		}
5869 		TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
5870 		if (it->function_atend != NULL) {
5871 			(*it->function_atend) (it->pointer, it->val);
5872 		}
5873 		SCTP_FREE(it, SCTP_M_ITER);
5874 	}
5875 	SCTP_IPI_ITERATOR_WQ_UNLOCK();
5876 	SCTP_ITERATOR_LOCK();
5877 	if ((sctp_it_ctl.cur_it) &&
5878 	    (sctp_it_ctl.cur_it->vn == curvnet)) {
5879 		sctp_it_ctl.iterator_flags |= SCTP_ITERATOR_STOP_CUR_IT;
5880 	}
5881 	SCTP_ITERATOR_UNLOCK();
5882 	SCTP_OS_TIMER_STOP_DRAIN(&SCTP_BASE_INFO(addr_wq_timer.timer));
5883 	SCTP_WQ_ADDR_LOCK();
5884 	LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) {
5885 		LIST_REMOVE(wi, sctp_nxt_addr);
5886 		SCTP_DECR_LADDR_COUNT();
5887 		if (wi->action == SCTP_DEL_IP_ADDRESS) {
5888 			SCTP_FREE(wi->ifa, SCTP_M_IFA);
5889 		}
5890 		SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_laddr), wi);
5891 	}
5892 	SCTP_WQ_ADDR_UNLOCK();
5893 
5894 	/*
5895 	 * free the vrf/ifn/ifa lists and hashes (be sure address monitor is
5896 	 * destroyed first).
5897 	 */
5898 	SCTP_IPI_ADDR_WLOCK();
5899 	vrf_bucket = &SCTP_BASE_INFO(sctp_vrfhash)[(SCTP_DEFAULT_VRFID & SCTP_BASE_INFO(hashvrfmark))];
5900 	LIST_FOREACH_SAFE(vrf, vrf_bucket, next_vrf, nvrf) {
5901 		LIST_FOREACH_SAFE(ifn, &vrf->ifnlist, next_ifn, nifn) {
5902 			LIST_FOREACH_SAFE(ifa, &ifn->ifalist, next_ifa, nifa) {
5903 				/* free the ifa */
5904 				LIST_REMOVE(ifa, next_bucket);
5905 				LIST_REMOVE(ifa, next_ifa);
5906 				SCTP_FREE(ifa, SCTP_M_IFA);
5907 			}
5908 			/* free the ifn */
5909 			LIST_REMOVE(ifn, next_bucket);
5910 			LIST_REMOVE(ifn, next_ifn);
5911 			SCTP_FREE(ifn, SCTP_M_IFN);
5912 		}
5913 		SCTP_HASH_FREE(vrf->vrf_addr_hash, vrf->vrf_addr_hashmark);
5914 		/* free the vrf */
5915 		LIST_REMOVE(vrf, next_vrf);
5916 		SCTP_FREE(vrf, SCTP_M_VRF);
5917 	}
5918 	SCTP_IPI_ADDR_WUNLOCK();
5919 	/* free the vrf hashes */
5920 	SCTP_HASH_FREE(SCTP_BASE_INFO(sctp_vrfhash), SCTP_BASE_INFO(hashvrfmark));
5921 	SCTP_HASH_FREE(SCTP_BASE_INFO(vrf_ifn_hash), SCTP_BASE_INFO(vrf_ifn_hashmark));
5922 
5923 	/*
5924 	 * free the TIMEWAIT list elements malloc'd in the function
5925 	 * sctp_add_vtag_to_timewait()...
5926 	 */
5927 	for (i = 0; i < SCTP_STACK_VTAG_HASH_SIZE; i++) {
5928 		chain = &SCTP_BASE_INFO(vtag_timewait)[i];
5929 		if (!LIST_EMPTY(chain)) {
5930 			prev_twait_block = NULL;
5931 			LIST_FOREACH(twait_block, chain, sctp_nxt_tagblock) {
5932 				if (prev_twait_block) {
5933 					SCTP_FREE(prev_twait_block, SCTP_M_TIMW);
5934 				}
5935 				prev_twait_block = twait_block;
5936 			}
5937 			SCTP_FREE(prev_twait_block, SCTP_M_TIMW);
5938 		}
5939 	}
5940 
5941 	/* free the locks and mutexes */
5942 #ifdef SCTP_PACKET_LOGGING
5943 	SCTP_IP_PKTLOG_DESTROY();
5944 #endif
5945 	SCTP_IPI_ADDR_DESTROY();
5946 	SCTP_STATLOG_DESTROY();
5947 	SCTP_INP_INFO_LOCK_DESTROY();
5948 
5949 	SCTP_WQ_ADDR_DESTROY();
5950 
5951 	/* Get rid of other stuff too. */
5952 	if (SCTP_BASE_INFO(sctp_asochash) != NULL)
5953 		SCTP_HASH_FREE(SCTP_BASE_INFO(sctp_asochash), SCTP_BASE_INFO(hashasocmark));
5954 	if (SCTP_BASE_INFO(sctp_ephash) != NULL)
5955 		SCTP_HASH_FREE(SCTP_BASE_INFO(sctp_ephash), SCTP_BASE_INFO(hashmark));
5956 	if (SCTP_BASE_INFO(sctp_tcpephash) != NULL)
5957 		SCTP_HASH_FREE(SCTP_BASE_INFO(sctp_tcpephash), SCTP_BASE_INFO(hashtcpmark));
5958 
5959 	SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_ep));
5960 	SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_asoc));
5961 	SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_laddr));
5962 	SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_net));
5963 	SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_chunk));
5964 	SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_readq));
5965 	SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_strmoq));
5966 	SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_asconf));
5967 	SCTP_ZONE_DESTROY(SCTP_BASE_INFO(ipi_zone_asconf_ack));
5968 #if defined(SMP) && defined(SCTP_USE_PERCPU_STAT)
5969 	SCTP_FREE(SCTP_BASE_STATS, SCTP_M_MCORE);
5970 #endif
5971 }
5972 
5973 int
5974 sctp_load_addresses_from_init(struct sctp_tcb *stcb, struct mbuf *m,
5975     int offset, int limit,
5976     struct sockaddr *src, struct sockaddr *dst,
5977     struct sockaddr *altsa, uint16_t port)
5978 {
5979 	/*
5980 	 * grub through the INIT pulling addresses and loading them to the
5981 	 * nets structure in the asoc. The from address in the mbuf should
5982 	 * also be loaded (if it is not already). This routine can be called
5983 	 * with either INIT or INIT-ACK's as long as the m points to the IP
5984 	 * packet and the offset points to the beginning of the parameters.
5985 	 */
5986 	struct sctp_inpcb *inp;
5987 	struct sctp_nets *net, *nnet, *net_tmp;
5988 	struct sctp_paramhdr *phdr, param_buf;
5989 	struct sctp_tcb *stcb_tmp;
5990 	uint16_t ptype, plen;
5991 	struct sockaddr *sa;
5992 	uint8_t random_store[SCTP_PARAM_BUFFER_SIZE];
5993 	struct sctp_auth_random *p_random = NULL;
5994 	uint16_t random_len = 0;
5995 	uint8_t hmacs_store[SCTP_PARAM_BUFFER_SIZE];
5996 	struct sctp_auth_hmac_algo *hmacs = NULL;
5997 	uint16_t hmacs_len = 0;
5998 	uint8_t saw_asconf = 0;
5999 	uint8_t saw_asconf_ack = 0;
6000 	uint8_t chunks_store[SCTP_PARAM_BUFFER_SIZE];
6001 	struct sctp_auth_chunk_list *chunks = NULL;
6002 	uint16_t num_chunks = 0;
6003 	sctp_key_t *new_key;
6004 	uint32_t keylen;
6005 	int got_random = 0, got_hmacs = 0, got_chklist = 0;
6006 	uint8_t peer_supports_ecn;
6007 	uint8_t peer_supports_prsctp;
6008 	uint8_t peer_supports_auth;
6009 	uint8_t peer_supports_asconf;
6010 	uint8_t peer_supports_asconf_ack;
6011 	uint8_t peer_supports_reconfig;
6012 	uint8_t peer_supports_nrsack;
6013 	uint8_t peer_supports_pktdrop;
6014 	uint8_t peer_supports_idata;
6015 #ifdef INET
6016 	struct sockaddr_in sin;
6017 #endif
6018 #ifdef INET6
6019 	struct sockaddr_in6 sin6;
6020 #endif
6021 
6022 	/* First get the destination address setup too. */
6023 #ifdef INET
6024 	memset(&sin, 0, sizeof(sin));
6025 	sin.sin_family = AF_INET;
6026 	sin.sin_len = sizeof(sin);
6027 	sin.sin_port = stcb->rport;
6028 #endif
6029 #ifdef INET6
6030 	memset(&sin6, 0, sizeof(sin6));
6031 	sin6.sin6_family = AF_INET6;
6032 	sin6.sin6_len = sizeof(struct sockaddr_in6);
6033 	sin6.sin6_port = stcb->rport;
6034 #endif
6035 	if (altsa) {
6036 		sa = altsa;
6037 	} else {
6038 		sa = src;
6039 	}
6040 	peer_supports_idata = 0;
6041 	peer_supports_ecn = 0;
6042 	peer_supports_prsctp = 0;
6043 	peer_supports_auth = 0;
6044 	peer_supports_asconf = 0;
6045 	peer_supports_asconf_ack = 0;
6046 	peer_supports_reconfig = 0;
6047 	peer_supports_nrsack = 0;
6048 	peer_supports_pktdrop = 0;
6049 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
6050 		/* mark all addresses that we have currently on the list */
6051 		net->dest_state |= SCTP_ADDR_NOT_IN_ASSOC;
6052 	}
6053 	/* does the source address already exist? if so skip it */
6054 	inp = stcb->sctp_ep;
6055 	atomic_add_int(&stcb->asoc.refcnt, 1);
6056 	stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net_tmp, dst, stcb);
6057 	atomic_subtract_int(&stcb->asoc.refcnt, 1);
6058 
6059 	if ((stcb_tmp == NULL && inp == stcb->sctp_ep) || inp == NULL) {
6060 		/* we must add the source address */
6061 		/* no scope set here since we have a tcb already. */
6062 		switch (sa->sa_family) {
6063 #ifdef INET
6064 		case AF_INET:
6065 			if (stcb->asoc.scope.ipv4_addr_legal) {
6066 				if (sctp_add_remote_addr(stcb, sa, NULL, port, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_2)) {
6067 					return (-1);
6068 				}
6069 			}
6070 			break;
6071 #endif
6072 #ifdef INET6
6073 		case AF_INET6:
6074 			if (stcb->asoc.scope.ipv6_addr_legal) {
6075 				if (sctp_add_remote_addr(stcb, sa, NULL, port, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_3)) {
6076 					return (-2);
6077 				}
6078 			}
6079 			break;
6080 #endif
6081 		default:
6082 			break;
6083 		}
6084 	} else {
6085 		if (net_tmp != NULL && stcb_tmp == stcb) {
6086 			net_tmp->dest_state &= ~SCTP_ADDR_NOT_IN_ASSOC;
6087 		} else if (stcb_tmp != stcb) {
6088 			/* It belongs to another association? */
6089 			if (stcb_tmp)
6090 				SCTP_TCB_UNLOCK(stcb_tmp);
6091 			return (-3);
6092 		}
6093 	}
6094 	if (stcb->asoc.state == 0) {
6095 		/* the assoc was freed? */
6096 		return (-4);
6097 	}
6098 	/* now we must go through each of the params. */
6099 	phdr = sctp_get_next_param(m, offset, &param_buf, sizeof(param_buf));
6100 	while (phdr) {
6101 		ptype = ntohs(phdr->param_type);
6102 		plen = ntohs(phdr->param_length);
6103 		/*
6104 		 * SCTP_PRINTF("ptype => %0x, plen => %d\n",
6105 		 * (uint32_t)ptype, (int)plen);
6106 		 */
6107 		if (offset + plen > limit) {
6108 			break;
6109 		}
6110 		if (plen < sizeof(struct sctp_paramhdr)) {
6111 			break;
6112 		}
6113 #ifdef INET
6114 		if (ptype == SCTP_IPV4_ADDRESS) {
6115 			if (stcb->asoc.scope.ipv4_addr_legal) {
6116 				struct sctp_ipv4addr_param *p4, p4_buf;
6117 
6118 				/* ok get the v4 address and check/add */
6119 				phdr = sctp_get_next_param(m, offset,
6120 				    (struct sctp_paramhdr *)&p4_buf,
6121 				    sizeof(p4_buf));
6122 				if (plen != sizeof(struct sctp_ipv4addr_param) ||
6123 				    phdr == NULL) {
6124 					return (-5);
6125 				}
6126 				p4 = (struct sctp_ipv4addr_param *)phdr;
6127 				sin.sin_addr.s_addr = p4->addr;
6128 				if (IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) {
6129 					/* Skip multi-cast addresses */
6130 					goto next_param;
6131 				}
6132 				if ((sin.sin_addr.s_addr == INADDR_BROADCAST) ||
6133 				    (sin.sin_addr.s_addr == INADDR_ANY)) {
6134 					goto next_param;
6135 				}
6136 				sa = (struct sockaddr *)&sin;
6137 				inp = stcb->sctp_ep;
6138 				atomic_add_int(&stcb->asoc.refcnt, 1);
6139 				stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net,
6140 				    dst, stcb);
6141 				atomic_subtract_int(&stcb->asoc.refcnt, 1);
6142 
6143 				if ((stcb_tmp == NULL && inp == stcb->sctp_ep) ||
6144 				    inp == NULL) {
6145 					/* we must add the source address */
6146 					/*
6147 					 * no scope set since we have a tcb
6148 					 * already
6149 					 */
6150 
6151 					/*
6152 					 * we must validate the state again
6153 					 * here
6154 					 */
6155 			add_it_now:
6156 					if (stcb->asoc.state == 0) {
6157 						/* the assoc was freed? */
6158 						return (-7);
6159 					}
6160 					if (sctp_add_remote_addr(stcb, sa, NULL, port, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_4)) {
6161 						return (-8);
6162 					}
6163 				} else if (stcb_tmp == stcb) {
6164 					if (stcb->asoc.state == 0) {
6165 						/* the assoc was freed? */
6166 						return (-10);
6167 					}
6168 					if (net != NULL) {
6169 						/* clear flag */
6170 						net->dest_state &=
6171 						    ~SCTP_ADDR_NOT_IN_ASSOC;
6172 					}
6173 				} else {
6174 					/*
6175 					 * strange, address is in another
6176 					 * assoc? straighten out locks.
6177 					 */
6178 					if (stcb_tmp) {
6179 						if (SCTP_GET_STATE(stcb_tmp) == SCTP_STATE_COOKIE_WAIT) {
6180 							struct mbuf *op_err;
6181 							char msg[SCTP_DIAG_INFO_LEN];
6182 
6183 							/*
6184 							 * in setup state we
6185 							 * abort this guy
6186 							 */
6187 							SCTP_SNPRINTF(msg, sizeof(msg),
6188 							    "%s:%d at %s", __FILE__, __LINE__, __func__);
6189 							op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
6190 							    msg);
6191 							sctp_abort_an_association(stcb_tmp->sctp_ep,
6192 							    stcb_tmp, op_err, false,
6193 							    SCTP_SO_NOT_LOCKED);
6194 							goto add_it_now;
6195 						}
6196 						SCTP_TCB_UNLOCK(stcb_tmp);
6197 					}
6198 
6199 					if (stcb->asoc.state == 0) {
6200 						/* the assoc was freed? */
6201 						return (-12);
6202 					}
6203 					return (-13);
6204 				}
6205 			}
6206 		} else
6207 #endif
6208 #ifdef INET6
6209 		if (ptype == SCTP_IPV6_ADDRESS) {
6210 			if (stcb->asoc.scope.ipv6_addr_legal) {
6211 				/* ok get the v6 address and check/add */
6212 				struct sctp_ipv6addr_param *p6, p6_buf;
6213 
6214 				phdr = sctp_get_next_param(m, offset,
6215 				    (struct sctp_paramhdr *)&p6_buf,
6216 				    sizeof(p6_buf));
6217 				if (plen != sizeof(struct sctp_ipv6addr_param) ||
6218 				    phdr == NULL) {
6219 					return (-14);
6220 				}
6221 				p6 = (struct sctp_ipv6addr_param *)phdr;
6222 				memcpy((caddr_t)&sin6.sin6_addr, p6->addr,
6223 				    sizeof(p6->addr));
6224 				if (IN6_IS_ADDR_MULTICAST(&sin6.sin6_addr)) {
6225 					/* Skip multi-cast addresses */
6226 					goto next_param;
6227 				}
6228 				if (IN6_IS_ADDR_LINKLOCAL(&sin6.sin6_addr)) {
6229 					/*
6230 					 * Link local make no sense without
6231 					 * scope
6232 					 */
6233 					goto next_param;
6234 				}
6235 				sa = (struct sockaddr *)&sin6;
6236 				inp = stcb->sctp_ep;
6237 				atomic_add_int(&stcb->asoc.refcnt, 1);
6238 				stcb_tmp = sctp_findassociation_ep_addr(&inp, sa, &net,
6239 				    dst, stcb);
6240 				atomic_subtract_int(&stcb->asoc.refcnt, 1);
6241 				if (stcb_tmp == NULL &&
6242 				    (inp == stcb->sctp_ep || inp == NULL)) {
6243 					/*
6244 					 * we must validate the state again
6245 					 * here
6246 					 */
6247 			add_it_now6:
6248 					if (stcb->asoc.state == 0) {
6249 						/* the assoc was freed? */
6250 						return (-16);
6251 					}
6252 					/*
6253 					 * we must add the address, no scope
6254 					 * set
6255 					 */
6256 					if (sctp_add_remote_addr(stcb, sa, NULL, port, SCTP_DONOT_SETSCOPE, SCTP_LOAD_ADDR_5)) {
6257 						return (-17);
6258 					}
6259 				} else if (stcb_tmp == stcb) {
6260 					/*
6261 					 * we must validate the state again
6262 					 * here
6263 					 */
6264 					if (stcb->asoc.state == 0) {
6265 						/* the assoc was freed? */
6266 						return (-19);
6267 					}
6268 					if (net != NULL) {
6269 						/* clear flag */
6270 						net->dest_state &=
6271 						    ~SCTP_ADDR_NOT_IN_ASSOC;
6272 					}
6273 				} else {
6274 					/*
6275 					 * strange, address is in another
6276 					 * assoc? straighten out locks.
6277 					 */
6278 					if (stcb_tmp) {
6279 						if (SCTP_GET_STATE(stcb_tmp) == SCTP_STATE_COOKIE_WAIT) {
6280 							struct mbuf *op_err;
6281 							char msg[SCTP_DIAG_INFO_LEN];
6282 
6283 							/*
6284 							 * in setup state we
6285 							 * abort this guy
6286 							 */
6287 							SCTP_SNPRINTF(msg, sizeof(msg),
6288 							    "%s:%d at %s", __FILE__, __LINE__, __func__);
6289 							op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
6290 							    msg);
6291 							sctp_abort_an_association(stcb_tmp->sctp_ep,
6292 							    stcb_tmp, op_err, false,
6293 							    SCTP_SO_NOT_LOCKED);
6294 							goto add_it_now6;
6295 						}
6296 						SCTP_TCB_UNLOCK(stcb_tmp);
6297 					}
6298 					if (stcb->asoc.state == 0) {
6299 						/* the assoc was freed? */
6300 						return (-21);
6301 					}
6302 					return (-22);
6303 				}
6304 			}
6305 		} else
6306 #endif
6307 		if (ptype == SCTP_ECN_CAPABLE) {
6308 			peer_supports_ecn = 1;
6309 		} else if (ptype == SCTP_ULP_ADAPTATION) {
6310 			if (stcb->asoc.state != SCTP_STATE_OPEN) {
6311 				struct sctp_adaptation_layer_indication ai,
6312 				                                *aip;
6313 
6314 				phdr = sctp_get_next_param(m, offset,
6315 				    (struct sctp_paramhdr *)&ai, sizeof(ai));
6316 				aip = (struct sctp_adaptation_layer_indication *)phdr;
6317 				if (aip) {
6318 					stcb->asoc.peers_adaptation = ntohl(aip->indication);
6319 					stcb->asoc.adaptation_needed = 1;
6320 				}
6321 			}
6322 		} else if (ptype == SCTP_SET_PRIM_ADDR) {
6323 			struct sctp_asconf_addr_param lstore, *fee;
6324 			int lptype;
6325 			struct sockaddr *lsa = NULL;
6326 #ifdef INET
6327 			struct sctp_asconf_addrv4_param *fii;
6328 #endif
6329 
6330 			if (stcb->asoc.asconf_supported == 0) {
6331 				return (-100);
6332 			}
6333 			if (plen > sizeof(lstore)) {
6334 				return (-23);
6335 			}
6336 			if (plen < sizeof(struct sctp_asconf_addrv4_param)) {
6337 				return (-101);
6338 			}
6339 			phdr = sctp_get_next_param(m, offset,
6340 			    (struct sctp_paramhdr *)&lstore,
6341 			    plen);
6342 			if (phdr == NULL) {
6343 				return (-24);
6344 			}
6345 			fee = (struct sctp_asconf_addr_param *)phdr;
6346 			lptype = ntohs(fee->addrp.ph.param_type);
6347 			switch (lptype) {
6348 #ifdef INET
6349 			case SCTP_IPV4_ADDRESS:
6350 				if (plen !=
6351 				    sizeof(struct sctp_asconf_addrv4_param)) {
6352 					SCTP_PRINTF("Sizeof setprim in init/init ack not %d but %d - ignored\n",
6353 					    (int)sizeof(struct sctp_asconf_addrv4_param),
6354 					    plen);
6355 				} else {
6356 					fii = (struct sctp_asconf_addrv4_param *)fee;
6357 					sin.sin_addr.s_addr = fii->addrp.addr;
6358 					lsa = (struct sockaddr *)&sin;
6359 				}
6360 				break;
6361 #endif
6362 #ifdef INET6
6363 			case SCTP_IPV6_ADDRESS:
6364 				if (plen !=
6365 				    sizeof(struct sctp_asconf_addr_param)) {
6366 					SCTP_PRINTF("Sizeof setprim (v6) in init/init ack not %d but %d - ignored\n",
6367 					    (int)sizeof(struct sctp_asconf_addr_param),
6368 					    plen);
6369 				} else {
6370 					memcpy(sin6.sin6_addr.s6_addr,
6371 					    fee->addrp.addr,
6372 					    sizeof(fee->addrp.addr));
6373 					lsa = (struct sockaddr *)&sin6;
6374 				}
6375 				break;
6376 #endif
6377 			default:
6378 				break;
6379 			}
6380 			if (lsa) {
6381 				(void)sctp_set_primary_addr(stcb, sa, NULL);
6382 			}
6383 		} else if (ptype == SCTP_HAS_NAT_SUPPORT) {
6384 			stcb->asoc.peer_supports_nat = 1;
6385 		} else if (ptype == SCTP_PRSCTP_SUPPORTED) {
6386 			/* Peer supports pr-sctp */
6387 			peer_supports_prsctp = 1;
6388 		} else if (ptype == SCTP_ZERO_CHECKSUM_ACCEPTABLE) {
6389 			struct sctp_zero_checksum_acceptable zero_chksum,
6390 			                             *zero_chksum_p;
6391 
6392 			phdr = sctp_get_next_param(m, offset,
6393 			    (struct sctp_paramhdr *)&zero_chksum,
6394 			    sizeof(struct sctp_zero_checksum_acceptable));
6395 			if (phdr != NULL) {
6396 				/*
6397 				 * Only send zero checksums if the upper
6398 				 * layer has enabled the support for the
6399 				 * same method as allowed by the peer.
6400 				 */
6401 				zero_chksum_p = (struct sctp_zero_checksum_acceptable *)phdr;
6402 				if ((ntohl(zero_chksum_p->edmid) != SCTP_EDMID_NONE) &&
6403 				    (ntohl(zero_chksum_p->edmid) == stcb->asoc.rcv_edmid)) {
6404 					stcb->asoc.snd_edmid = stcb->asoc.rcv_edmid;
6405 				}
6406 			}
6407 		} else if (ptype == SCTP_SUPPORTED_CHUNK_EXT) {
6408 			/* A supported extension chunk */
6409 			struct sctp_supported_chunk_types_param *pr_supported;
6410 			uint8_t local_store[SCTP_PARAM_BUFFER_SIZE];
6411 			int num_ent, i;
6412 
6413 			if (plen > sizeof(local_store)) {
6414 				return (-35);
6415 			}
6416 			phdr = sctp_get_next_param(m, offset,
6417 			    (struct sctp_paramhdr *)&local_store, plen);
6418 			if (phdr == NULL) {
6419 				return (-25);
6420 			}
6421 			pr_supported = (struct sctp_supported_chunk_types_param *)phdr;
6422 			num_ent = plen - sizeof(struct sctp_paramhdr);
6423 			for (i = 0; i < num_ent; i++) {
6424 				switch (pr_supported->chunk_types[i]) {
6425 				case SCTP_ASCONF:
6426 					peer_supports_asconf = 1;
6427 					break;
6428 				case SCTP_ASCONF_ACK:
6429 					peer_supports_asconf_ack = 1;
6430 					break;
6431 				case SCTP_FORWARD_CUM_TSN:
6432 					peer_supports_prsctp = 1;
6433 					break;
6434 				case SCTP_PACKET_DROPPED:
6435 					peer_supports_pktdrop = 1;
6436 					break;
6437 				case SCTP_NR_SELECTIVE_ACK:
6438 					peer_supports_nrsack = 1;
6439 					break;
6440 				case SCTP_STREAM_RESET:
6441 					peer_supports_reconfig = 1;
6442 					break;
6443 				case SCTP_AUTHENTICATION:
6444 					peer_supports_auth = 1;
6445 					break;
6446 				case SCTP_IDATA:
6447 					peer_supports_idata = 1;
6448 					break;
6449 				default:
6450 					/* one I have not learned yet */
6451 					break;
6452 				}
6453 			}
6454 		} else if (ptype == SCTP_RANDOM) {
6455 			if (plen > sizeof(random_store))
6456 				break;
6457 			if (got_random) {
6458 				/* already processed a RANDOM */
6459 				goto next_param;
6460 			}
6461 			phdr = sctp_get_next_param(m, offset,
6462 			    (struct sctp_paramhdr *)random_store,
6463 			    plen);
6464 			if (phdr == NULL)
6465 				return (-26);
6466 			p_random = (struct sctp_auth_random *)phdr;
6467 			random_len = plen - sizeof(*p_random);
6468 			/* enforce the random length */
6469 			if (random_len != SCTP_AUTH_RANDOM_SIZE_REQUIRED) {
6470 				SCTPDBG(SCTP_DEBUG_AUTH1, "SCTP: invalid RANDOM len\n");
6471 				return (-27);
6472 			}
6473 			got_random = 1;
6474 		} else if (ptype == SCTP_HMAC_LIST) {
6475 			uint16_t num_hmacs;
6476 			uint16_t i;
6477 
6478 			if (plen > sizeof(hmacs_store))
6479 				break;
6480 			if (got_hmacs) {
6481 				/* already processed a HMAC list */
6482 				goto next_param;
6483 			}
6484 			phdr = sctp_get_next_param(m, offset,
6485 			    (struct sctp_paramhdr *)hmacs_store,
6486 			    plen);
6487 			if (phdr == NULL)
6488 				return (-28);
6489 			hmacs = (struct sctp_auth_hmac_algo *)phdr;
6490 			hmacs_len = plen - sizeof(*hmacs);
6491 			num_hmacs = hmacs_len / sizeof(hmacs->hmac_ids[0]);
6492 			/* validate the hmac list */
6493 			if (sctp_verify_hmac_param(hmacs, num_hmacs)) {
6494 				return (-29);
6495 			}
6496 			if (stcb->asoc.peer_hmacs != NULL)
6497 				sctp_free_hmaclist(stcb->asoc.peer_hmacs);
6498 			stcb->asoc.peer_hmacs = sctp_alloc_hmaclist(num_hmacs);
6499 			if (stcb->asoc.peer_hmacs != NULL) {
6500 				for (i = 0; i < num_hmacs; i++) {
6501 					(void)sctp_auth_add_hmacid(stcb->asoc.peer_hmacs,
6502 					    ntohs(hmacs->hmac_ids[i]));
6503 				}
6504 			}
6505 			got_hmacs = 1;
6506 		} else if (ptype == SCTP_CHUNK_LIST) {
6507 			int i;
6508 
6509 			if (plen > sizeof(chunks_store))
6510 				break;
6511 			if (got_chklist) {
6512 				/* already processed a Chunks list */
6513 				goto next_param;
6514 			}
6515 			phdr = sctp_get_next_param(m, offset,
6516 			    (struct sctp_paramhdr *)chunks_store,
6517 			    plen);
6518 			if (phdr == NULL)
6519 				return (-30);
6520 			chunks = (struct sctp_auth_chunk_list *)phdr;
6521 			num_chunks = plen - sizeof(*chunks);
6522 			if (stcb->asoc.peer_auth_chunks != NULL)
6523 				sctp_clear_chunklist(stcb->asoc.peer_auth_chunks);
6524 			else
6525 				stcb->asoc.peer_auth_chunks = sctp_alloc_chunklist();
6526 			for (i = 0; i < num_chunks; i++) {
6527 				(void)sctp_auth_add_chunk(chunks->chunk_types[i],
6528 				    stcb->asoc.peer_auth_chunks);
6529 				/* record asconf/asconf-ack if listed */
6530 				if (chunks->chunk_types[i] == SCTP_ASCONF)
6531 					saw_asconf = 1;
6532 				if (chunks->chunk_types[i] == SCTP_ASCONF_ACK)
6533 					saw_asconf_ack = 1;
6534 			}
6535 			got_chklist = 1;
6536 		} else if ((ptype == SCTP_HEARTBEAT_INFO) ||
6537 			    (ptype == SCTP_STATE_COOKIE) ||
6538 			    (ptype == SCTP_UNRECOG_PARAM) ||
6539 			    (ptype == SCTP_COOKIE_PRESERVE) ||
6540 			    (ptype == SCTP_SUPPORTED_ADDRTYPE) ||
6541 			    (ptype == SCTP_ADD_IP_ADDRESS) ||
6542 			    (ptype == SCTP_DEL_IP_ADDRESS) ||
6543 			    (ptype == SCTP_ERROR_CAUSE_IND) ||
6544 		    (ptype == SCTP_SUCCESS_REPORT)) {
6545 			/* don't care */
6546 		} else {
6547 			if ((ptype & 0x8000) == 0x0000) {
6548 				/*
6549 				 * must stop processing the rest of the
6550 				 * param's. Any report bits were handled
6551 				 * with the call to
6552 				 * sctp_arethere_unrecognized_parameters()
6553 				 * when the INIT or INIT-ACK was first seen.
6554 				 */
6555 				break;
6556 			}
6557 		}
6558 
6559 next_param:
6560 		offset += SCTP_SIZE32(plen);
6561 		if (offset >= limit) {
6562 			break;
6563 		}
6564 		phdr = sctp_get_next_param(m, offset, &param_buf,
6565 		    sizeof(param_buf));
6566 	}
6567 	/* Now check to see if we need to purge any addresses */
6568 	TAILQ_FOREACH_SAFE(net, &stcb->asoc.nets, sctp_next, nnet) {
6569 		if ((net->dest_state & SCTP_ADDR_NOT_IN_ASSOC) ==
6570 		    SCTP_ADDR_NOT_IN_ASSOC) {
6571 			/* This address has been removed from the asoc */
6572 			/* remove and free it */
6573 			stcb->asoc.numnets--;
6574 			TAILQ_REMOVE(&stcb->asoc.nets, net, sctp_next);
6575 			if (net == stcb->asoc.alternate) {
6576 				sctp_free_remote_addr(stcb->asoc.alternate);
6577 				stcb->asoc.alternate = NULL;
6578 			}
6579 			if (net == stcb->asoc.primary_destination) {
6580 				stcb->asoc.primary_destination = NULL;
6581 				sctp_select_primary_destination(stcb);
6582 			}
6583 			sctp_free_remote_addr(net);
6584 		}
6585 	}
6586 	if ((stcb->asoc.ecn_supported == 1) &&
6587 	    (peer_supports_ecn == 0)) {
6588 		stcb->asoc.ecn_supported = 0;
6589 	}
6590 	if ((stcb->asoc.prsctp_supported == 1) &&
6591 	    (peer_supports_prsctp == 0)) {
6592 		stcb->asoc.prsctp_supported = 0;
6593 	}
6594 	if ((stcb->asoc.auth_supported == 1) &&
6595 	    ((peer_supports_auth == 0) ||
6596 	    (got_random == 0) || (got_hmacs == 0))) {
6597 		stcb->asoc.auth_supported = 0;
6598 	}
6599 	if ((stcb->asoc.asconf_supported == 1) &&
6600 	    ((peer_supports_asconf == 0) || (peer_supports_asconf_ack == 0) ||
6601 	    (stcb->asoc.auth_supported == 0) ||
6602 	    (saw_asconf == 0) || (saw_asconf_ack == 0))) {
6603 		stcb->asoc.asconf_supported = 0;
6604 	}
6605 	if ((stcb->asoc.reconfig_supported == 1) &&
6606 	    (peer_supports_reconfig == 0)) {
6607 		stcb->asoc.reconfig_supported = 0;
6608 	}
6609 	if ((stcb->asoc.idata_supported == 1) &&
6610 	    (peer_supports_idata == 0)) {
6611 		stcb->asoc.idata_supported = 0;
6612 	}
6613 	if ((stcb->asoc.nrsack_supported == 1) &&
6614 	    (peer_supports_nrsack == 0)) {
6615 		stcb->asoc.nrsack_supported = 0;
6616 	}
6617 	if ((stcb->asoc.pktdrop_supported == 1) &&
6618 	    (peer_supports_pktdrop == 0)) {
6619 		stcb->asoc.pktdrop_supported = 0;
6620 	}
6621 	/* validate authentication required parameters */
6622 	if ((peer_supports_auth == 0) && (got_chklist == 1)) {
6623 		/* peer does not support auth but sent a chunks list? */
6624 		return (-31);
6625 	}
6626 	if ((peer_supports_asconf == 1) && (peer_supports_auth == 0)) {
6627 		/* peer supports asconf but not auth? */
6628 		return (-32);
6629 	} else if ((peer_supports_asconf == 1) &&
6630 		    (peer_supports_auth == 1) &&
6631 	    ((saw_asconf == 0) || (saw_asconf_ack == 0))) {
6632 		return (-33);
6633 	}
6634 	/* concatenate the full random key */
6635 	keylen = sizeof(*p_random) + random_len + sizeof(*hmacs) + hmacs_len;
6636 	if (chunks != NULL) {
6637 		keylen += sizeof(*chunks) + num_chunks;
6638 	}
6639 	new_key = sctp_alloc_key(keylen);
6640 	if (new_key != NULL) {
6641 		/* copy in the RANDOM */
6642 		if (p_random != NULL) {
6643 			keylen = sizeof(*p_random) + random_len;
6644 			memcpy(new_key->key, p_random, keylen);
6645 		} else {
6646 			keylen = 0;
6647 		}
6648 		/* append in the AUTH chunks */
6649 		if (chunks != NULL) {
6650 			memcpy(new_key->key + keylen, chunks,
6651 			    sizeof(*chunks) + num_chunks);
6652 			keylen += sizeof(*chunks) + num_chunks;
6653 		}
6654 		/* append in the HMACs */
6655 		if (hmacs != NULL) {
6656 			memcpy(new_key->key + keylen, hmacs,
6657 			    sizeof(*hmacs) + hmacs_len);
6658 		}
6659 	} else {
6660 		/* failed to get memory for the key */
6661 		return (-34);
6662 	}
6663 	if (stcb->asoc.authinfo.peer_random != NULL)
6664 		sctp_free_key(stcb->asoc.authinfo.peer_random);
6665 	stcb->asoc.authinfo.peer_random = new_key;
6666 	sctp_clear_cachedkeys(stcb, stcb->asoc.authinfo.assoc_keyid);
6667 	sctp_clear_cachedkeys(stcb, stcb->asoc.authinfo.recv_keyid);
6668 
6669 	return (0);
6670 }
6671 
6672 int
6673 sctp_set_primary_addr(struct sctp_tcb *stcb, struct sockaddr *sa,
6674     struct sctp_nets *net)
6675 {
6676 	/* make sure the requested primary address exists in the assoc */
6677 	if (net == NULL && sa)
6678 		net = sctp_findnet(stcb, sa);
6679 
6680 	if (net == NULL) {
6681 		/* didn't find the requested primary address! */
6682 		return (-1);
6683 	} else {
6684 		/* set the primary address */
6685 		if (net->dest_state & SCTP_ADDR_UNCONFIRMED) {
6686 			/* Must be confirmed, so queue to set */
6687 			net->dest_state |= SCTP_ADDR_REQ_PRIMARY;
6688 			return (0);
6689 		}
6690 		stcb->asoc.primary_destination = net;
6691 		if (((net->dest_state & SCTP_ADDR_PF) == 0) &&
6692 		    (stcb->asoc.alternate != NULL)) {
6693 			sctp_free_remote_addr(stcb->asoc.alternate);
6694 			stcb->asoc.alternate = NULL;
6695 		}
6696 		net = TAILQ_FIRST(&stcb->asoc.nets);
6697 		if (net != stcb->asoc.primary_destination) {
6698 			/*
6699 			 * first one on the list is NOT the primary
6700 			 * sctp_cmpaddr() is much more efficient if the
6701 			 * primary is the first on the list, make it so.
6702 			 */
6703 			TAILQ_REMOVE(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next);
6704 			TAILQ_INSERT_HEAD(&stcb->asoc.nets, stcb->asoc.primary_destination, sctp_next);
6705 		}
6706 		return (0);
6707 	}
6708 }
6709 
6710 bool
6711 sctp_is_vtag_good(uint32_t tag, uint16_t lport, uint16_t rport, struct timeval *now)
6712 {
6713 	struct sctpasochead *head;
6714 	struct sctp_tcb *stcb;
6715 
6716 	SCTP_INP_INFO_LOCK_ASSERT();
6717 
6718 	head = &SCTP_BASE_INFO(sctp_asochash)[SCTP_PCBHASH_ASOC(tag, SCTP_BASE_INFO(hashasocmark))];
6719 	LIST_FOREACH(stcb, head, sctp_asocs) {
6720 		/*
6721 		 * We choose not to lock anything here. TCB's can't be
6722 		 * removed since we have the read lock, so they can't be
6723 		 * freed on us, same thing for the INP. I may be wrong with
6724 		 * this assumption, but we will go with it for now :-)
6725 		 */
6726 		if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
6727 			continue;
6728 		}
6729 		if (stcb->asoc.my_vtag == tag) {
6730 			/* candidate */
6731 			if (stcb->rport != rport) {
6732 				continue;
6733 			}
6734 			if (stcb->sctp_ep->sctp_lport != lport) {
6735 				continue;
6736 			}
6737 			/* The tag is currently used, so don't use it. */
6738 			return (false);
6739 		}
6740 	}
6741 	return (!sctp_is_in_timewait(tag, lport, rport, (uint32_t)now->tv_sec));
6742 }
6743 
6744 static void
6745 sctp_drain_mbufs(struct sctp_tcb *stcb)
6746 {
6747 	/*
6748 	 * We must hunt this association for MBUF's past the cumack (i.e.
6749 	 * out of order data that we can renege on).
6750 	 */
6751 	struct sctp_association *asoc;
6752 	struct sctp_tmit_chunk *chk, *nchk;
6753 	uint32_t cumulative_tsn_p1;
6754 	struct sctp_queued_to_read *control, *ncontrol;
6755 	int cnt, strmat;
6756 	uint32_t gap, i;
6757 	int fnd = 0;
6758 
6759 	/* We look for anything larger than the cum-ack + 1 */
6760 
6761 	asoc = &stcb->asoc;
6762 	if (asoc->cumulative_tsn == asoc->highest_tsn_inside_map) {
6763 		/* none we can reneg on. */
6764 		return;
6765 	}
6766 	SCTP_STAT_INCR(sctps_protocol_drains_done);
6767 	cumulative_tsn_p1 = asoc->cumulative_tsn + 1;
6768 	cnt = 0;
6769 	/* Ok that was fun, now we will drain all the inbound streams? */
6770 	for (strmat = 0; strmat < asoc->streamincnt; strmat++) {
6771 		TAILQ_FOREACH_SAFE(control, &asoc->strmin[strmat].inqueue, next_instrm, ncontrol) {
6772 #ifdef INVARIANTS
6773 			if (control->on_strm_q != SCTP_ON_ORDERED) {
6774 				panic("Huh control: %p on_q: %d -- not ordered?",
6775 				    control, control->on_strm_q);
6776 			}
6777 #endif
6778 			if (SCTP_TSN_GT(control->sinfo_tsn, cumulative_tsn_p1)) {
6779 				/* Yep it is above cum-ack */
6780 				cnt++;
6781 				SCTP_CALC_TSN_TO_GAP(gap, control->sinfo_tsn, asoc->mapping_array_base_tsn);
6782 				KASSERT(control->length > 0, ("control has zero length"));
6783 				if (asoc->size_on_all_streams >= control->length) {
6784 					asoc->size_on_all_streams -= control->length;
6785 				} else {
6786 #ifdef INVARIANTS
6787 					panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
6788 #else
6789 					asoc->size_on_all_streams = 0;
6790 #endif
6791 				}
6792 				sctp_ucount_decr(asoc->cnt_on_all_streams);
6793 				SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap);
6794 				if (control->on_read_q) {
6795 					TAILQ_REMOVE(&stcb->sctp_ep->read_queue, control, next);
6796 					control->on_read_q = 0;
6797 				}
6798 				TAILQ_REMOVE(&asoc->strmin[strmat].inqueue, control, next_instrm);
6799 				control->on_strm_q = 0;
6800 				if (control->data) {
6801 					sctp_m_freem(control->data);
6802 					control->data = NULL;
6803 				}
6804 				sctp_free_remote_addr(control->whoFrom);
6805 				/* Now its reasm? */
6806 				TAILQ_FOREACH_SAFE(chk, &control->reasm, sctp_next, nchk) {
6807 					cnt++;
6808 					SCTP_CALC_TSN_TO_GAP(gap, chk->rec.data.tsn, asoc->mapping_array_base_tsn);
6809 					KASSERT(chk->send_size > 0, ("chunk has zero length"));
6810 					if (asoc->size_on_reasm_queue >= chk->send_size) {
6811 						asoc->size_on_reasm_queue -= chk->send_size;
6812 					} else {
6813 #ifdef INVARIANTS
6814 						panic("size_on_reasm_queue = %u smaller than chunk length %u", asoc->size_on_reasm_queue, chk->send_size);
6815 #else
6816 						asoc->size_on_reasm_queue = 0;
6817 #endif
6818 					}
6819 					sctp_ucount_decr(asoc->cnt_on_reasm_queue);
6820 					SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap);
6821 					TAILQ_REMOVE(&control->reasm, chk, sctp_next);
6822 					if (chk->data) {
6823 						sctp_m_freem(chk->data);
6824 						chk->data = NULL;
6825 					}
6826 					sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
6827 				}
6828 				sctp_free_a_readq(stcb, control);
6829 			}
6830 		}
6831 		TAILQ_FOREACH_SAFE(control, &asoc->strmin[strmat].uno_inqueue, next_instrm, ncontrol) {
6832 #ifdef INVARIANTS
6833 			if (control->on_strm_q != SCTP_ON_UNORDERED) {
6834 				panic("Huh control: %p on_q: %d -- not unordered?",
6835 				    control, control->on_strm_q);
6836 			}
6837 #endif
6838 			if (SCTP_TSN_GT(control->sinfo_tsn, cumulative_tsn_p1)) {
6839 				/* Yep it is above cum-ack */
6840 				cnt++;
6841 				SCTP_CALC_TSN_TO_GAP(gap, control->sinfo_tsn, asoc->mapping_array_base_tsn);
6842 				KASSERT(control->length > 0, ("control has zero length"));
6843 				if (asoc->size_on_all_streams >= control->length) {
6844 					asoc->size_on_all_streams -= control->length;
6845 				} else {
6846 #ifdef INVARIANTS
6847 					panic("size_on_all_streams = %u smaller than control length %u", asoc->size_on_all_streams, control->length);
6848 #else
6849 					asoc->size_on_all_streams = 0;
6850 #endif
6851 				}
6852 				sctp_ucount_decr(asoc->cnt_on_all_streams);
6853 				SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap);
6854 				if (control->on_read_q) {
6855 					TAILQ_REMOVE(&stcb->sctp_ep->read_queue, control, next);
6856 					control->on_read_q = 0;
6857 				}
6858 				TAILQ_REMOVE(&asoc->strmin[strmat].uno_inqueue, control, next_instrm);
6859 				control->on_strm_q = 0;
6860 				if (control->data) {
6861 					sctp_m_freem(control->data);
6862 					control->data = NULL;
6863 				}
6864 				sctp_free_remote_addr(control->whoFrom);
6865 				/* Now its reasm? */
6866 				TAILQ_FOREACH_SAFE(chk, &control->reasm, sctp_next, nchk) {
6867 					cnt++;
6868 					SCTP_CALC_TSN_TO_GAP(gap, chk->rec.data.tsn, asoc->mapping_array_base_tsn);
6869 					KASSERT(chk->send_size > 0, ("chunk has zero length"));
6870 					if (asoc->size_on_reasm_queue >= chk->send_size) {
6871 						asoc->size_on_reasm_queue -= chk->send_size;
6872 					} else {
6873 #ifdef INVARIANTS
6874 						panic("size_on_reasm_queue = %u smaller than chunk length %u", asoc->size_on_reasm_queue, chk->send_size);
6875 #else
6876 						asoc->size_on_reasm_queue = 0;
6877 #endif
6878 					}
6879 					sctp_ucount_decr(asoc->cnt_on_reasm_queue);
6880 					SCTP_UNSET_TSN_PRESENT(asoc->mapping_array, gap);
6881 					TAILQ_REMOVE(&control->reasm, chk, sctp_next);
6882 					if (chk->data) {
6883 						sctp_m_freem(chk->data);
6884 						chk->data = NULL;
6885 					}
6886 					sctp_free_a_chunk(stcb, chk, SCTP_SO_NOT_LOCKED);
6887 				}
6888 				sctp_free_a_readq(stcb, control);
6889 			}
6890 		}
6891 	}
6892 	if (cnt) {
6893 		/* We must back down to see what the new highest is */
6894 		for (i = asoc->highest_tsn_inside_map; SCTP_TSN_GE(i, asoc->mapping_array_base_tsn); i--) {
6895 			SCTP_CALC_TSN_TO_GAP(gap, i, asoc->mapping_array_base_tsn);
6896 			if (SCTP_IS_TSN_PRESENT(asoc->mapping_array, gap)) {
6897 				asoc->highest_tsn_inside_map = i;
6898 				fnd = 1;
6899 				break;
6900 			}
6901 		}
6902 		if (!fnd) {
6903 			asoc->highest_tsn_inside_map = asoc->mapping_array_base_tsn - 1;
6904 		}
6905 
6906 		/*
6907 		 * Question, should we go through the delivery queue? The
6908 		 * only reason things are on here is the app not reading OR
6909 		 * a p-d-api up. An attacker COULD send enough in to
6910 		 * initiate the PD-API and then send a bunch of stuff to
6911 		 * other streams... these would wind up on the delivery
6912 		 * queue.. and then we would not get to them. But in order
6913 		 * to do this I then have to back-track and un-deliver
6914 		 * sequence numbers in streams.. el-yucko. I think for now
6915 		 * we will NOT look at the delivery queue and leave it to be
6916 		 * something to consider later. An alternative would be to
6917 		 * abort the P-D-API with a notification and then deliver
6918 		 * the data.... Or another method might be to keep track of
6919 		 * how many times the situation occurs and if we see a
6920 		 * possible attack underway just abort the association.
6921 		 */
6922 #ifdef SCTP_DEBUG
6923 		SCTPDBG(SCTP_DEBUG_PCB1, "Freed %d chunks from reneg harvest\n", cnt);
6924 #endif
6925 		/*
6926 		 * Now do we need to find a new
6927 		 * asoc->highest_tsn_inside_map?
6928 		 */
6929 		asoc->last_revoke_count = cnt;
6930 		sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL,
6931 		    SCTP_FROM_SCTP_PCB + SCTP_LOC_11);
6932 		/* sa_ignore NO_NULL_CHK */
6933 		sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
6934 		sctp_chunk_output(stcb->sctp_ep, stcb, SCTP_OUTPUT_FROM_DRAIN, SCTP_SO_NOT_LOCKED);
6935 	}
6936 	/*
6937 	 * Another issue, in un-setting the TSN's in the mapping array we
6938 	 * DID NOT adjust the highest_tsn marker.  This will cause one of
6939 	 * two things to occur. It may cause us to do extra work in checking
6940 	 * for our mapping array movement. More importantly it may cause us
6941 	 * to SACK every datagram. This may not be a bad thing though since
6942 	 * we will recover once we get our cum-ack above and all this stuff
6943 	 * we dumped recovered.
6944 	 */
6945 }
6946 
6947 static void
6948 sctp_drain(void)
6949 {
6950 	struct epoch_tracker et;
6951 
6952 	VNET_ITERATOR_DECL(vnet_iter);
6953 
6954 	NET_EPOCH_ENTER(et);
6955 	/*
6956 	 * We must walk the PCB lists for ALL associations here. The system
6957 	 * is LOW on MBUF's and needs help. This is where reneging will
6958 	 * occur. We really hope this does NOT happen!
6959 	 */
6960 	VNET_LIST_RLOCK_NOSLEEP();
6961 	VNET_FOREACH(vnet_iter) {
6962 		CURVNET_SET(vnet_iter);
6963 		struct sctp_inpcb *inp;
6964 		struct sctp_tcb *stcb;
6965 
6966 		SCTP_STAT_INCR(sctps_protocol_drain_calls);
6967 		if (SCTP_BASE_SYSCTL(sctp_do_drain) == 0) {
6968 #ifdef VIMAGE
6969 			continue;
6970 #else
6971 			NET_EPOCH_EXIT(et);
6972 			return;
6973 #endif
6974 		}
6975 		SCTP_INP_INFO_RLOCK();
6976 		LIST_FOREACH(inp, &SCTP_BASE_INFO(listhead), sctp_list) {
6977 			/* For each endpoint */
6978 			SCTP_INP_RLOCK(inp);
6979 			LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
6980 				/* For each association */
6981 				SCTP_TCB_LOCK(stcb);
6982 				sctp_drain_mbufs(stcb);
6983 				SCTP_TCB_UNLOCK(stcb);
6984 			}
6985 			SCTP_INP_RUNLOCK(inp);
6986 		}
6987 		SCTP_INP_INFO_RUNLOCK();
6988 		CURVNET_RESTORE();
6989 	}
6990 	VNET_LIST_RUNLOCK_NOSLEEP();
6991 	NET_EPOCH_EXIT(et);
6992 }
6993 
6994 EVENTHANDLER_DEFINE(vm_lowmem, sctp_drain, NULL, LOWMEM_PRI_DEFAULT);
6995 EVENTHANDLER_DEFINE(mbuf_lowmem, sctp_drain, NULL, LOWMEM_PRI_DEFAULT);
6996 
6997 /*
6998  * start a new iterator
6999  * iterates through all endpoints and associations based on the pcb_state
7000  * flags and asoc_state.  "af" (mandatory) is executed for all matching
7001  * assocs and "ef" (optional) is executed when the iterator completes.
7002  * "inpf" (optional) is executed for each new endpoint as it is being
7003  * iterated through. inpe (optional) is called when the inp completes
7004  * its way through all the stcbs.
7005  */
7006 int
7007 sctp_initiate_iterator(inp_func inpf,
7008     asoc_func af,
7009     inp_func inpe,
7010     uint32_t pcb_state,
7011     uint32_t pcb_features,
7012     uint32_t asoc_state,
7013     void *argp,
7014     uint32_t argi,
7015     end_func ef,
7016     struct sctp_inpcb *s_inp,
7017     uint8_t chunk_output_off)
7018 {
7019 	struct sctp_iterator *it = NULL;
7020 
7021 	if (af == NULL) {
7022 		return (-1);
7023 	}
7024 	if (SCTP_BASE_VAR(sctp_pcb_initialized) == 0) {
7025 		SCTP_PRINTF("%s: abort on initialize being %d\n", __func__,
7026 		    SCTP_BASE_VAR(sctp_pcb_initialized));
7027 		return (-1);
7028 	}
7029 	SCTP_MALLOC(it, struct sctp_iterator *, sizeof(struct sctp_iterator),
7030 	    SCTP_M_ITER);
7031 	if (it == NULL) {
7032 		SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTP_PCB, ENOMEM);
7033 		return (-1);
7034 	}
7035 	memset(it, 0, sizeof(*it));
7036 	it->function_assoc = af;
7037 	it->function_inp = inpf;
7038 	if (inpf)
7039 		it->done_current_ep = 0;
7040 	else
7041 		it->done_current_ep = 1;
7042 	it->function_atend = ef;
7043 	it->pointer = argp;
7044 	it->val = argi;
7045 	it->pcb_flags = pcb_state;
7046 	it->pcb_features = pcb_features;
7047 	it->asoc_state = asoc_state;
7048 	it->function_inp_end = inpe;
7049 	it->no_chunk_output = chunk_output_off;
7050 	it->vn = curvnet;
7051 	if (s_inp) {
7052 		/* Assume lock is held here */
7053 		it->inp = s_inp;
7054 		SCTP_INP_INCR_REF(it->inp);
7055 		it->iterator_flags = SCTP_ITERATOR_DO_SINGLE_INP;
7056 	} else {
7057 		SCTP_INP_INFO_RLOCK();
7058 		it->inp = LIST_FIRST(&SCTP_BASE_INFO(listhead));
7059 		if (it->inp) {
7060 			SCTP_INP_INCR_REF(it->inp);
7061 		}
7062 		SCTP_INP_INFO_RUNLOCK();
7063 		it->iterator_flags = SCTP_ITERATOR_DO_ALL_INP;
7064 	}
7065 	SCTP_IPI_ITERATOR_WQ_LOCK();
7066 	if (SCTP_BASE_VAR(sctp_pcb_initialized) == 0) {
7067 		SCTP_IPI_ITERATOR_WQ_UNLOCK();
7068 		SCTP_PRINTF("%s: rollback on initialize being %d it=%p\n", __func__,
7069 		    SCTP_BASE_VAR(sctp_pcb_initialized), it);
7070 		SCTP_FREE(it, SCTP_M_ITER);
7071 		return (-1);
7072 	}
7073 	TAILQ_INSERT_TAIL(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
7074 	if (sctp_it_ctl.iterator_running == 0) {
7075 		sctp_wakeup_iterator();
7076 	}
7077 	SCTP_IPI_ITERATOR_WQ_UNLOCK();
7078 	/* sa_ignore MEMLEAK {memory is put on the tailq for the iterator} */
7079 	return (0);
7080 }
7081 
7082 /*
7083  * Atomically add flags to the sctp_flags of an inp.
7084  * To be used when the write lock of the inp is not held.
7085  */
7086 void
7087 sctp_pcb_add_flags(struct sctp_inpcb *inp, uint32_t flags)
7088 {
7089 	uint32_t old_flags, new_flags;
7090 
7091 	do {
7092 		old_flags = inp->sctp_flags;
7093 		new_flags = old_flags | flags;
7094 	} while (atomic_cmpset_int(&inp->sctp_flags, old_flags, new_flags) == 0);
7095 }
7096