xref: /freebsd/sys/netinet6/sctp6_usrreq.c (revision f856af0466c076beef4ea9b15d088e1119a945b8)
1 /*-
2  * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved.
3  *
4  * Redistribution and use in source and binary forms, with or without
5  * modification, are permitted provided that the following conditions are met:
6  *
7  * a) Redistributions of source code must retain the above copyright notice,
8  *   this list of conditions and the following disclaimer.
9  *
10  * b) Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in
12  *   the documentation and/or other materials provided with the distribution.
13  *
14  * c) Neither the name of Cisco Systems, Inc. nor the names of its
15  *    contributors may be used to endorse or promote products derived
16  *    from this software without specific prior written permission.
17  *
18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
20  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
22  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
28  * THE POSSIBILITY OF SUCH DAMAGE.
29  */
30 /*	$KAME: sctp6_usrreq.c,v 1.38 2005/08/24 08:08:56 suz Exp $	*/
31 #include <sys/cdefs.h>
32 __FBSDID("$FreeBSD$");
33 #include "opt_inet.h"
34 #include "opt_inet6.h"
35 #include "opt_inet.h"
36 #include "opt_ipsec.h"
37 #include "opt_sctp.h"
38 
39 #include <sys/param.h>
40 #include <sys/kernel.h>
41 #include <sys/mbuf.h>
42 #include <sys/domain.h>
43 #include <sys/protosw.h>
44 #include <sys/socket.h>
45 #include <sys/malloc.h>
46 #include <sys/socketvar.h>
47 #include <sys/sysctl.h>
48 #include <sys/errno.h>
49 #include <sys/stat.h>
50 #include <sys/systm.h>
51 #include <sys/syslog.h>
52 #include <sys/priv.h>
53 #include <sys/proc.h>
54 #include <net/if.h>
55 #include <net/route.h>
56 #include <net/if_types.h>
57 #include <netinet/in.h>
58 #include <netinet/in_systm.h>
59 #include <netinet/ip.h>
60 #include <netinet/in_pcb.h>
61 #include <netinet/in_var.h>
62 #include <netinet/ip_var.h>
63 #include <netinet/sctp_os.h>
64 #include <netinet/sctp_pcb.h>
65 #include <netinet/sctp_header.h>
66 #include <netinet/sctp_var.h>
67 #include <netinet/sctputil.h>
68 #include <netinet/sctp_output.h>
69 #include <netinet/sctp_bsd_addr.h>
70 #include <netinet/sctp_input.h>
71 #include <netinet/sctp_asconf.h>
72 #include <netinet6/ip6_var.h>
73 #include <netinet6/scope6_var.h>
74 #include <netinet/sctp_bsd_addr.h>
75 #include <netinet/ip6.h>
76 #include <netinet6/in6_pcb.h>
77 #include <netinet/icmp6.h>
78 #include <netinet6/sctp6_var.h>
79 #include <netinet6/ip6protosw.h>
80 #include <netinet6/nd6.h>
81 
82 #ifdef IPSEC
83 #include <netinet6/ipsec.h>
84 #include <netinet6/ipsec6.h>
85 #endif				/* IPSEC */
86 
87 #if defined(NFAITH) && NFAITH > 0
88 #include <net/if_faith.h>
89 #endif
90 
91 
92 
93 extern struct protosw inetsw[];
94 
95 
96 #ifndef in6pcb
97 #define in6pcb		inpcb
98 #endif
99 #ifndef sotoin6pcb
100 #define sotoin6pcb      sotoinpcb
101 #endif
102 
103 
104 #ifdef SCTP_DEBUG
105 extern u_int32_t sctp_debug_on;
106 
107 #endif
108 
109 
110 
111 extern int sctp_no_csum_on_loopback;
112 
113 int
114 sctp6_input(mp, offp, proto)
115 	struct mbuf **mp;
116 	int *offp;
117 
118 	int proto;
119 
120 {
121 	struct mbuf *m;
122 	struct ip6_hdr *ip6;
123 	struct sctphdr *sh;
124 	struct sctp_inpcb *in6p = NULL;
125 	struct sctp_nets *net;
126 	int refcount_up = 0;
127 	u_int32_t check, calc_check;
128 	struct inpcb *in6p_ip;
129 	struct sctp_chunkhdr *ch;
130 	int length, mlen, offset, iphlen;
131 	u_int8_t ecn_bits;
132 	struct sctp_tcb *stcb = NULL;
133 	int off = *offp;
134 	int s;
135 
136 	m = SCTP_HEADER_TO_CHAIN(*mp);
137 
138 	ip6 = mtod(m, struct ip6_hdr *);
139 #ifndef PULLDOWN_TEST
140 	/* If PULLDOWN_TEST off, must be in a single mbuf. */
141 	IP6_EXTHDR_CHECK(m, off, (int)(sizeof(*sh) + sizeof(*ch)), IPPROTO_DONE);
142 	sh = (struct sctphdr *)((caddr_t)ip6 + off);
143 	ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(*sh));
144 #else
145 	/* Ensure that (sctphdr + sctp_chunkhdr) in a row. */
146 	IP6_EXTHDR_GET(sh, struct sctphdr *, m, off, sizeof(*sh) + sizeof(*ch));
147 	if (sh == NULL) {
148 		SCTP_STAT_INCR(sctps_hdrops);
149 		return IPPROTO_DONE;
150 	}
151 	ch = (struct sctp_chunkhdr *)((caddr_t)sh + sizeof(struct sctphdr));
152 #endif
153 
154 	iphlen = off;
155 	offset = iphlen + sizeof(*sh) + sizeof(*ch);
156 
157 #if defined(NFAITH) && NFAITH > 0
158 
159 	if (faithprefix_p != NULL && (*faithprefix_p) (&ip6->ip6_dst)) {
160 		/* XXX send icmp6 host/port unreach? */
161 		goto bad;
162 	}
163 #endif				/* NFAITH defined and > 0 */
164 	SCTP_STAT_INCR(sctps_recvpackets);
165 	SCTP_STAT_INCR_COUNTER64(sctps_inpackets);
166 #ifdef SCTP_DEBUG
167 	if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
168 		printf("V6 input gets a packet iphlen:%d pktlen:%d\n", iphlen, SCTP_HEADER_LEN((*mp)));
169 	}
170 #endif
171 	if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
172 		/* No multi-cast support in SCTP */
173 		goto bad;
174 	}
175 	/* destination port of 0 is illegal, based on RFC2960. */
176 	if (sh->dest_port == 0)
177 		goto bad;
178 	if ((sctp_no_csum_on_loopback == 0) ||
179 	    (!SCTP_IS_IT_LOOPBACK(m))) {
180 		/*
181 		 * we do NOT validate things from the loopback if the sysctl
182 		 * is set to 1.
183 		 */
184 		check = sh->checksum;	/* save incoming checksum */
185 		if ((check == 0) && (sctp_no_csum_on_loopback)) {
186 			/*
187 			 * special hook for where we got a local address
188 			 * somehow routed across a non IFT_LOOP type
189 			 * interface
190 			 */
191 			if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &ip6->ip6_dst))
192 				goto sctp_skip_csum;
193 		}
194 		sh->checksum = 0;	/* prepare for calc */
195 		calc_check = sctp_calculate_sum(m, &mlen, iphlen);
196 		if (calc_check != check) {
197 #ifdef SCTP_DEBUG
198 			if (sctp_debug_on & SCTP_DEBUG_INPUT1) {
199 				printf("Bad CSUM on SCTP packet calc_check:%x check:%x  m:%p mlen:%d iphlen:%d\n",
200 				    calc_check, check, m,
201 				    mlen, iphlen);
202 			}
203 #endif
204 			stcb = sctp_findassociation_addr(m, iphlen, offset - sizeof(*ch),
205 			    sh, ch, &in6p, &net);
206 			/* in6p's ref-count increased && stcb locked */
207 			if ((in6p) && (stcb)) {
208 				sctp_send_packet_dropped(stcb, net, m, iphlen, 1);
209 				sctp_chunk_output((struct sctp_inpcb *)in6p, stcb, 2);
210 			} else if ((in6p != NULL) && (stcb == NULL)) {
211 				refcount_up = 1;
212 			}
213 			SCTP_STAT_INCR(sctps_badsum);
214 			SCTP_STAT_INCR_COUNTER32(sctps_checksumerrors);
215 			goto bad;
216 		}
217 		sh->checksum = calc_check;
218 	}
219 sctp_skip_csum:
220 	net = NULL;
221 	/*
222 	 * Locate pcb and tcb for datagram sctp_findassociation_addr() wants
223 	 * IP/SCTP/first chunk header...
224 	 */
225 	stcb = sctp_findassociation_addr(m, iphlen, offset - sizeof(*ch),
226 	    sh, ch, &in6p, &net);
227 	/* in6p's ref-count increased */
228 	if (in6p == NULL) {
229 		struct sctp_init_chunk *init_chk, chunk_buf;
230 
231 		SCTP_STAT_INCR(sctps_noport);
232 		if (ch->chunk_type == SCTP_INITIATION) {
233 			/*
234 			 * we do a trick here to get the INIT tag, dig in
235 			 * and get the tag from the INIT and put it in the
236 			 * common header.
237 			 */
238 			init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
239 			    iphlen + sizeof(*sh), sizeof(*init_chk),
240 			    (u_int8_t *) & chunk_buf);
241 			sh->v_tag = init_chk->init.initiate_tag;
242 		}
243 		if (ch->chunk_type == SCTP_SHUTDOWN_ACK) {
244 			sctp_send_shutdown_complete2(m, iphlen, sh);
245 			goto bad;
246 		}
247 		if (ch->chunk_type == SCTP_SHUTDOWN_COMPLETE) {
248 			goto bad;
249 		}
250 		if (ch->chunk_type != SCTP_ABORT_ASSOCIATION)
251 			sctp_send_abort(m, iphlen, sh, 0, NULL);
252 		goto bad;
253 	} else if (stcb == NULL) {
254 		refcount_up = 1;
255 	}
256 	in6p_ip = (struct inpcb *)in6p;
257 #ifdef IPSEC
258 	/*
259 	 * Check AH/ESP integrity.
260 	 */
261 	if (in6p_ip && (ipsec6_in_reject(m, in6p_ip))) {
262 /* XXX */
263 		ipsec6stat.in_polvio++;
264 		goto bad;
265 	}
266 #endif				/* IPSEC */
267 
268 
269 	/*
270 	 * CONTROL chunk processing
271 	 */
272 	offset -= sizeof(*ch);
273 	ecn_bits = ((ntohl(ip6->ip6_flow) >> 20) & 0x000000ff);
274 
275 	/* Length now holds the total packet length payload + iphlen */
276 	length = ntohs(ip6->ip6_plen) + iphlen;
277 
278 	s = splnet();
279 	(void)sctp_common_input_processing(&m, iphlen, offset, length, sh, ch,
280 	    in6p, stcb, net, ecn_bits);
281 	/* inp's ref-count reduced && stcb unlocked */
282 	splx(s);
283 	/* XXX this stuff below gets moved to appropriate parts later... */
284 	if (m)
285 		m_freem(m);
286 	if ((in6p) && refcount_up) {
287 		/* reduce ref-count */
288 		SCTP_INP_WLOCK(in6p);
289 		SCTP_INP_DECR_REF(in6p);
290 		SCTP_INP_WUNLOCK(in6p);
291 	}
292 	return IPPROTO_DONE;
293 
294 bad:
295 	if (stcb)
296 		SCTP_TCB_UNLOCK(stcb);
297 
298 	if ((in6p) && refcount_up) {
299 		/* reduce ref-count */
300 		SCTP_INP_WLOCK(in6p);
301 		SCTP_INP_DECR_REF(in6p);
302 		SCTP_INP_WUNLOCK(in6p);
303 	}
304 	if (m)
305 		m_freem(m);
306 	return IPPROTO_DONE;
307 }
308 
309 
310 static void
311 sctp6_notify_mbuf(struct sctp_inpcb *inp,
312     struct icmp6_hdr *icmp6,
313     struct sctphdr *sh,
314     struct sctp_tcb *stcb,
315     struct sctp_nets *net)
316 {
317 	u_int32_t nxtsz;
318 
319 	if ((inp == NULL) || (stcb == NULL) || (net == NULL) ||
320 	    (icmp6 == NULL) || (sh == NULL)) {
321 		goto out;
322 	}
323 	/* First do we even look at it? */
324 	if (ntohl(sh->v_tag) != (stcb->asoc.peer_vtag))
325 		goto out;
326 
327 	if (icmp6->icmp6_type != ICMP6_PACKET_TOO_BIG) {
328 		/* not PACKET TO BIG */
329 		goto out;
330 	}
331 	/*
332 	 * ok we need to look closely. We could even get smarter and look at
333 	 * anyone that we sent to in case we get a different ICMP that tells
334 	 * us there is no way to reach a host, but for this impl, all we
335 	 * care about is MTU discovery.
336 	 */
337 	nxtsz = ntohl(icmp6->icmp6_mtu);
338 	/* Stop any PMTU timer */
339 	sctp_timer_stop(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, NULL, SCTP_FROM_SCTP6_USRREQ + SCTP_LOC_1);
340 
341 	/* Adjust destination size limit */
342 	if (net->mtu > nxtsz) {
343 		net->mtu = nxtsz;
344 	}
345 	/* now what about the ep? */
346 	if (stcb->asoc.smallest_mtu > nxtsz) {
347 		struct sctp_tmit_chunk *chk;
348 
349 		/* Adjust that too */
350 		stcb->asoc.smallest_mtu = nxtsz;
351 		/* now off to subtract IP_DF flag if needed */
352 
353 		TAILQ_FOREACH(chk, &stcb->asoc.send_queue, sctp_next) {
354 			if ((u_int32_t) (chk->send_size + IP_HDR_SIZE) > nxtsz) {
355 				chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
356 			}
357 		}
358 		TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
359 			if ((u_int32_t) (chk->send_size + IP_HDR_SIZE) > nxtsz) {
360 				/*
361 				 * For this guy we also mark for immediate
362 				 * resend since we sent to big of chunk
363 				 */
364 				chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
365 				if (chk->sent != SCTP_DATAGRAM_RESEND)
366 					stcb->asoc.sent_queue_retran_cnt++;
367 				chk->sent = SCTP_DATAGRAM_RESEND;
368 				chk->rec.data.doing_fast_retransmit = 0;
369 
370 				chk->sent = SCTP_DATAGRAM_RESEND;
371 				/* Clear any time so NO RTT is being done */
372 				chk->sent_rcv_time.tv_sec = 0;
373 				chk->sent_rcv_time.tv_usec = 0;
374 				stcb->asoc.total_flight -= chk->send_size;
375 				net->flight_size -= chk->send_size;
376 			}
377 		}
378 	}
379 	sctp_timer_start(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, NULL);
380 out:
381 	if (stcb)
382 		SCTP_TCB_UNLOCK(stcb);
383 }
384 
385 
386 void
387 sctp6_ctlinput(cmd, pktdst, d)
388 	int cmd;
389 	struct sockaddr *pktdst;
390 	void *d;
391 {
392 	struct sctphdr sh;
393 	struct ip6ctlparam *ip6cp = NULL;
394 	int s, cm;
395 
396 	if (pktdst->sa_family != AF_INET6 ||
397 	    pktdst->sa_len != sizeof(struct sockaddr_in6))
398 		return;
399 
400 	if ((unsigned)cmd >= PRC_NCMDS)
401 		return;
402 	if (PRC_IS_REDIRECT(cmd)) {
403 		d = NULL;
404 	} else if (inet6ctlerrmap[cmd] == 0) {
405 		return;
406 	}
407 	/* if the parameter is from icmp6, decode it. */
408 	if (d != NULL) {
409 		ip6cp = (struct ip6ctlparam *)d;
410 	} else {
411 		ip6cp = (struct ip6ctlparam *)NULL;
412 	}
413 
414 	if (ip6cp) {
415 		/*
416 		 * XXX: We assume that when IPV6 is non NULL, M and OFF are
417 		 * valid.
418 		 */
419 		/* check if we can safely examine src and dst ports */
420 		struct sctp_inpcb *inp = NULL;
421 		struct sctp_tcb *stcb = NULL;
422 		struct sctp_nets *net = NULL;
423 		struct sockaddr_in6 final;
424 
425 		if (ip6cp->ip6c_m == NULL)
426 			return;
427 
428 		bzero(&sh, sizeof(sh));
429 		bzero(&final, sizeof(final));
430 		inp = NULL;
431 		net = NULL;
432 		m_copydata(ip6cp->ip6c_m, ip6cp->ip6c_off, sizeof(sh),
433 		    (caddr_t)&sh);
434 		ip6cp->ip6c_src->sin6_port = sh.src_port;
435 		final.sin6_len = sizeof(final);
436 		final.sin6_family = AF_INET6;
437 		final.sin6_addr = ((struct sockaddr_in6 *)pktdst)->sin6_addr;
438 		final.sin6_port = sh.dest_port;
439 		s = splnet();
440 		stcb = sctp_findassociation_addr_sa((struct sockaddr *)ip6cp->ip6c_src,
441 		    (struct sockaddr *)&final,
442 		    &inp, &net, 1);
443 		/* inp's ref-count increased && stcb locked */
444 		if (stcb != NULL && inp && (inp->sctp_socket != NULL)) {
445 			if (cmd == PRC_MSGSIZE) {
446 				sctp6_notify_mbuf(inp,
447 				    ip6cp->ip6c_icmp6,
448 				    &sh,
449 				    stcb,
450 				    net);
451 				/* inp's ref-count reduced && stcb unlocked */
452 			} else {
453 				if (cmd == PRC_HOSTDEAD) {
454 					cm = EHOSTUNREACH;
455 				} else {
456 					cm = inet6ctlerrmap[cmd];
457 				}
458 				sctp_notify(inp, cm, &sh,
459 				    (struct sockaddr *)&final,
460 				    stcb, net);
461 				/* inp's ref-count reduced && stcb unlocked */
462 			}
463 		} else {
464 			if (PRC_IS_REDIRECT(cmd) && inp) {
465 				in6_rtchange((struct in6pcb *)inp,
466 				    inet6ctlerrmap[cmd]);
467 			}
468 			if (inp) {
469 				/* reduce inp's ref-count */
470 				SCTP_INP_WLOCK(inp);
471 				SCTP_INP_DECR_REF(inp);
472 				SCTP_INP_WUNLOCK(inp);
473 			}
474 			if (stcb)
475 				SCTP_TCB_UNLOCK(stcb);
476 		}
477 		splx(s);
478 	}
479 }
480 
481 /*
482  * this routine can probably be collasped into the one in sctp_userreq.c
483  * since they do the same thing and now we lookup with a sockaddr
484  */
485 static int
486 sctp6_getcred(SYSCTL_HANDLER_ARGS)
487 {
488 	struct xucred xuc;
489 	struct sockaddr_in6 addrs[2];
490 	struct sctp_inpcb *inp;
491 	struct sctp_nets *net;
492 	struct sctp_tcb *stcb;
493 	int error;
494 
495 	/*
496 	 * XXXRW: Other instances of getcred use SUSER_ALLOWJAIL, as socket
497 	 * visibility is scoped using cr_canseesocket(), which it is not
498 	 * here.
499 	 */
500 	error = priv_check_cred(req->td->td_ucred, PRIV_NETINET_RESERVEDPORT,
501 	    0);
502 	if (error)
503 		return (error);
504 
505 	if (req->newlen != sizeof(addrs))
506 		return (EINVAL);
507 	if (req->oldlen != sizeof(struct ucred))
508 		return (EINVAL);
509 	error = SYSCTL_IN(req, addrs, sizeof(addrs));
510 	if (error)
511 		return (error);
512 
513 	stcb = sctp_findassociation_addr_sa(sin6tosa(&addrs[0]),
514 	    sin6tosa(&addrs[1]),
515 	    &inp, &net, 1);
516 	if (stcb == NULL || inp == NULL || inp->sctp_socket == NULL) {
517 		if ((inp != NULL) && (stcb == NULL)) {
518 			/* reduce ref-count */
519 			SCTP_INP_WLOCK(inp);
520 			SCTP_INP_DECR_REF(inp);
521 			goto cred_can_cont;
522 		}
523 		error = ENOENT;
524 		goto out;
525 	}
526 	SCTP_TCB_UNLOCK(stcb);
527 	/*
528 	 * We use the write lock here, only since in the error leg we need
529 	 * it. If we used RLOCK, then we would have to
530 	 * wlock/decr/unlock/rlock. Which in theory could create a hole.
531 	 * Better to use higher wlock.
532 	 */
533 	SCTP_INP_WLOCK(inp);
534 cred_can_cont:
535 	error = cr_canseesocket(req->td->td_ucred, inp->sctp_socket);
536 	if (error) {
537 		SCTP_INP_WUNLOCK(inp);
538 		goto out;
539 	}
540 	cru2x(inp->sctp_socket->so_cred, &xuc);
541 	SCTP_INP_WUNLOCK(inp);
542 	error = SYSCTL_OUT(req, &xuc, sizeof(struct xucred));
543 out:
544 	return (error);
545 }
546 
547 SYSCTL_PROC(_net_inet6_sctp6, OID_AUTO, getcred, CTLTYPE_OPAQUE | CTLFLAG_RW,
548     0, 0,
549     sctp6_getcred, "S,ucred", "Get the ucred of a SCTP6 connection");
550 
551 
552 /* This is the same as the sctp_abort() could be made common */
553 static void
554 sctp6_abort(struct socket *so)
555 {
556 	struct sctp_inpcb *inp;
557 	int s;
558 	uint32_t flags;
559 
560 	inp = (struct sctp_inpcb *)so->so_pcb;
561 	if (inp == 0)
562 		return;
563 	s = splnet();
564 sctp_must_try_again:
565 	flags = inp->sctp_flags;
566 #ifdef SCTP_LOG_CLOSING
567 	sctp_log_closing(inp, NULL, 17);
568 #endif
569 	if (((flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) &&
570 	    (atomic_cmpset_int(&inp->sctp_flags, flags, (flags | SCTP_PCB_FLAGS_SOCKET_GONE | SCTP_PCB_FLAGS_CLOSE_IP)))) {
571 #ifdef SCTP_LOG_CLOSING
572 		sctp_log_closing(inp, NULL, 16);
573 #endif
574 		sctp_inpcb_free(inp, 1, 0);
575 		SOCK_LOCK(so);
576 		so->so_snd.sb_cc = 0;
577 		so->so_snd.sb_mb = NULL;
578 		so->so_snd.sb_mbcnt = 0;
579 
580 		/*
581 		 * same for the rcv ones, they are only here for the
582 		 * accounting/select.
583 		 */
584 		so->so_rcv.sb_cc = 0;
585 		so->so_rcv.sb_mb = NULL;
586 		so->so_rcv.sb_mbcnt = 0;
587 		/*
588 		 * Now null out the reference, we are completely detached.
589 		 */
590 		so->so_pcb = NULL;
591 		SOCK_UNLOCK(so);
592 	} else {
593 		flags = inp->sctp_flags;
594 		if ((flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) {
595 			goto sctp_must_try_again;
596 		}
597 	}
598 	splx(s);
599 	return;
600 }
601 
602 static int
603 sctp6_attach(struct socket *so, int proto, struct thread *p)
604 {
605 	struct in6pcb *inp6;
606 	int s, error;
607 	struct sctp_inpcb *inp;
608 
609 	inp = (struct sctp_inpcb *)so->so_pcb;
610 	if (inp != NULL)
611 		return EINVAL;
612 
613 	if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
614 		error = soreserve(so, sctp_sendspace, sctp_recvspace);
615 		if (error)
616 			return error;
617 	}
618 	s = splnet();
619 	error = sctp_inpcb_alloc(so);
620 	splx(s);
621 	if (error)
622 		return error;
623 	inp = (struct sctp_inpcb *)so->so_pcb;
624 	inp->sctp_flags |= SCTP_PCB_FLAGS_BOUND_V6;	/* I'm v6! */
625 	inp6 = (struct in6pcb *)inp;
626 
627 	inp6->inp_vflag |= INP_IPV6;
628 	inp6->in6p_hops = -1;	/* use kernel default */
629 	inp6->in6p_cksum = -1;	/* just to be sure */
630 #ifdef INET
631 	/*
632 	 * XXX: ugly!! IPv4 TTL initialization is necessary for an IPv6
633 	 * socket as well, because the socket may be bound to an IPv6
634 	 * wildcard address, which may match an IPv4-mapped IPv6 address.
635 	 */
636 	inp6->inp_ip_ttl = ip_defttl;
637 #endif
638 	/*
639 	 * Hmm what about the IPSEC stuff that is missing here but in
640 	 * sctp_attach()?
641 	 */
642 	return 0;
643 }
644 
645 static int
646 sctp6_bind(struct socket *so, struct sockaddr *addr, struct thread *p)
647 {
648 	struct sctp_inpcb *inp;
649 	struct in6pcb *inp6;
650 	int s, error;
651 
652 	inp = (struct sctp_inpcb *)so->so_pcb;
653 	if (inp == 0)
654 		return EINVAL;
655 
656 	inp6 = (struct in6pcb *)inp;
657 	inp6->inp_vflag &= ~INP_IPV4;
658 	inp6->inp_vflag |= INP_IPV6;
659 	if (addr != NULL &&
660 	    (inp6->inp_flags & IN6P_IPV6_V6ONLY)
661 	    == 0) {
662 		if (addr->sa_family == AF_INET) {
663 			/* binding v4 addr to v6 socket, so reset flags */
664 			inp6->inp_vflag |= INP_IPV4;
665 			inp6->inp_vflag &= ~INP_IPV6;
666 		} else {
667 			struct sockaddr_in6 *sin6_p;
668 
669 			sin6_p = (struct sockaddr_in6 *)addr;
670 
671 			if (IN6_IS_ADDR_UNSPECIFIED(&sin6_p->sin6_addr)) {
672 				inp6->inp_vflag |= INP_IPV4;
673 			} else if (IN6_IS_ADDR_V4MAPPED(&sin6_p->sin6_addr)) {
674 				struct sockaddr_in sin;
675 
676 				in6_sin6_2_sin(&sin, sin6_p);
677 				inp6->inp_vflag |= INP_IPV4;
678 				inp6->inp_vflag &= ~INP_IPV6;
679 				s = splnet();
680 				error = sctp_inpcb_bind(so, (struct sockaddr *)&sin, p);
681 				splx(s);
682 				return error;
683 			}
684 		}
685 	} else if (addr != NULL) {
686 		/* IPV6_V6ONLY socket */
687 		if (addr->sa_family == AF_INET) {
688 			/* can't bind v4 addr to v6 only socket! */
689 			return EINVAL;
690 		} else {
691 			struct sockaddr_in6 *sin6_p;
692 
693 			sin6_p = (struct sockaddr_in6 *)addr;
694 
695 			if (IN6_IS_ADDR_V4MAPPED(&sin6_p->sin6_addr))
696 				/* can't bind v4-mapped addrs either! */
697 				/* NOTE: we don't support SIIT */
698 				return EINVAL;
699 		}
700 	}
701 	s = splnet();
702 	error = sctp_inpcb_bind(so, addr, p);
703 	splx(s);
704 	return error;
705 }
706 
707 
708 static void
709 sctp6_close(struct socket *so)
710 {
711 	struct sctp_inpcb *inp;
712 	uint32_t flags;
713 
714 	inp = (struct sctp_inpcb *)so->so_pcb;
715 	if (inp == 0)
716 		return;
717 
718 	/*
719 	 * Inform all the lower layer assoc that we are done.
720 	 */
721 sctp_must_try_again:
722 	flags = inp->sctp_flags;
723 #ifdef SCTP_LOG_CLOSING
724 	sctp_log_closing(inp, NULL, 17);
725 #endif
726 	if (((flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) &&
727 	    (atomic_cmpset_int(&inp->sctp_flags, flags, (flags | SCTP_PCB_FLAGS_SOCKET_GONE | SCTP_PCB_FLAGS_CLOSE_IP)))) {
728 		if (((so->so_options & SO_LINGER) && (so->so_linger == 0)) ||
729 		    (so->so_rcv.sb_cc > 0)) {
730 #ifdef SCTP_LOG_CLOSING
731 			sctp_log_closing(inp, NULL, 13);
732 #endif
733 			sctp_inpcb_free(inp, 1, 1);
734 		} else {
735 #ifdef SCTP_LOG_CLOSING
736 			sctp_log_closing(inp, NULL, 14);
737 #endif
738 			sctp_inpcb_free(inp, 0, 1);
739 		}
740 		/*
741 		 * The socket is now detached, no matter what the state of
742 		 * the SCTP association.
743 		 */
744 		SOCK_LOCK(so);
745 		so->so_snd.sb_cc = 0;
746 		so->so_snd.sb_mb = NULL;
747 		so->so_snd.sb_mbcnt = 0;
748 
749 		/*
750 		 * same for the rcv ones, they are only here for the
751 		 * accounting/select.
752 		 */
753 		so->so_rcv.sb_cc = 0;
754 		so->so_rcv.sb_mb = NULL;
755 		so->so_rcv.sb_mbcnt = 0;
756 		/*
757 		 * Now null out the reference, we are completely detached.
758 		 */
759 		so->so_pcb = NULL;
760 		SOCK_UNLOCK(so);
761 	} else {
762 		flags = inp->sctp_flags;
763 		if ((flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) {
764 			goto sctp_must_try_again;
765 		}
766 	}
767 	return;
768 
769 }
770 
771 
772 static int
773 sctp6_disconnect(struct socket *so)
774 {
775 	struct sctp_inpcb *inp;
776 	int s;
777 
778 	s = splnet();		/* XXX */
779 	inp = (struct sctp_inpcb *)so->so_pcb;
780 	if (inp == NULL) {
781 		splx(s);
782 		return (ENOTCONN);
783 	}
784 	SCTP_INP_RLOCK(inp);
785 	if (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
786 		if (LIST_EMPTY(&inp->sctp_asoc_list)) {
787 			/* No connection */
788 			splx(s);
789 			SCTP_INP_RUNLOCK(inp);
790 			return (ENOTCONN);
791 		} else {
792 			int some_on_streamwheel = 0;
793 			struct sctp_association *asoc;
794 			struct sctp_tcb *stcb;
795 
796 			stcb = LIST_FIRST(&inp->sctp_asoc_list);
797 			if (stcb == NULL) {
798 				splx(s);
799 				SCTP_INP_RUNLOCK(inp);
800 				return (EINVAL);
801 			}
802 			SCTP_TCB_LOCK(stcb);
803 			asoc = &stcb->asoc;
804 			if (((so->so_options & SO_LINGER) &&
805 			    (so->so_linger == 0)) ||
806 			    (so->so_rcv.sb_cc > 0)) {
807 				if (SCTP_GET_STATE(asoc) !=
808 				    SCTP_STATE_COOKIE_WAIT) {
809 					/* Left with Data unread */
810 					struct mbuf *err;
811 
812 					err = NULL;
813 					MGET(err, M_DONTWAIT, MT_DATA);
814 					if (err) {
815 						/*
816 						 * Fill in the user
817 						 * initiated abort
818 						 */
819 						struct sctp_paramhdr *ph;
820 
821 						ph = mtod(err, struct sctp_paramhdr *);
822 						SCTP_BUF_LEN(err) = sizeof(struct sctp_paramhdr);
823 						ph->param_type = htons(SCTP_CAUSE_USER_INITIATED_ABT);
824 						ph->param_length = htons(SCTP_BUF_LEN(err));
825 					}
826 					sctp_send_abort_tcb(stcb, err);
827 					SCTP_STAT_INCR_COUNTER32(sctps_aborted);
828 				}
829 				SCTP_INP_RUNLOCK(inp);
830 				if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
831 				    (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
832 					SCTP_STAT_DECR_GAUGE32(sctps_currestab);
833 				}
834 				sctp_free_assoc(inp, stcb, SCTP_DONOT_SETSCOPE,
835 				    SCTP_FROM_SCTP6_USRREQ + SCTP_LOC_2);
836 				/* No unlock tcb assoc is gone */
837 				splx(s);
838 				return (0);
839 			}
840 			if (!TAILQ_EMPTY(&asoc->out_wheel)) {
841 				/* Check to see if some data queued */
842 				struct sctp_stream_out *outs;
843 
844 				TAILQ_FOREACH(outs, &asoc->out_wheel,
845 				    next_spoke) {
846 					if (!TAILQ_EMPTY(&outs->outqueue)) {
847 						some_on_streamwheel = 1;
848 						break;
849 					}
850 				}
851 			}
852 			if (TAILQ_EMPTY(&asoc->send_queue) &&
853 			    TAILQ_EMPTY(&asoc->sent_queue) &&
854 			    (some_on_streamwheel == 0)) {
855 				/* nothing queued to send, so I'm done... */
856 				if ((SCTP_GET_STATE(asoc) !=
857 				    SCTP_STATE_SHUTDOWN_SENT) &&
858 				    (SCTP_GET_STATE(asoc) !=
859 				    SCTP_STATE_SHUTDOWN_ACK_SENT)) {
860 					/* only send SHUTDOWN the first time */
861 					sctp_send_shutdown(stcb, stcb->asoc.primary_destination);
862 					sctp_chunk_output(stcb->sctp_ep, stcb, 1);
863 					asoc->state = SCTP_STATE_SHUTDOWN_SENT;
864 					SCTP_STAT_DECR_GAUGE32(sctps_currestab);
865 					sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWN,
866 					    stcb->sctp_ep, stcb,
867 					    asoc->primary_destination);
868 					sctp_timer_start(SCTP_TIMER_TYPE_SHUTDOWNGUARD,
869 					    stcb->sctp_ep, stcb,
870 					    asoc->primary_destination);
871 				}
872 			} else {
873 				/*
874 				 * we still got (or just got) data to send,
875 				 * so set SHUTDOWN_PENDING
876 				 */
877 				/*
878 				 * XXX sockets draft says that MSG_EOF
879 				 * should be sent with no data.  currently,
880 				 * we will allow user data to be sent first
881 				 * and move to SHUTDOWN-PENDING
882 				 */
883 				asoc->state |= SCTP_STATE_SHUTDOWN_PENDING;
884 			}
885 			SCTP_TCB_UNLOCK(stcb);
886 			SCTP_INP_RUNLOCK(inp);
887 			splx(s);
888 			return (0);
889 		}
890 	} else {
891 		/* UDP model does not support this */
892 		SCTP_INP_RUNLOCK(inp);
893 		splx(s);
894 		return EOPNOTSUPP;
895 	}
896 }
897 
898 int
899 sctp_sendm(struct socket *so, int flags, struct mbuf *m, struct sockaddr *addr,
900     struct mbuf *control, struct thread *p);
901 
902 
903 
904 static int
905 sctp6_send(struct socket *so, int flags, struct mbuf *m, struct sockaddr *addr,
906     struct mbuf *control, struct thread *p)
907 {
908 	struct sctp_inpcb *inp;
909 	struct inpcb *in_inp;
910 	struct in6pcb *inp6;
911 
912 #ifdef INET
913 	struct sockaddr_in6 *sin6;
914 
915 #endif				/* INET */
916 	/* No SPL needed since sctp_output does this */
917 
918 	inp = (struct sctp_inpcb *)so->so_pcb;
919 	if (inp == NULL) {
920 		if (control) {
921 			m_freem(control);
922 			control = NULL;
923 		}
924 		m_freem(m);
925 		return EINVAL;
926 	}
927 	in_inp = (struct inpcb *)inp;
928 	inp6 = (struct in6pcb *)inp;
929 	/*
930 	 * For the TCP model we may get a NULL addr, if we are a connected
931 	 * socket thats ok.
932 	 */
933 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) &&
934 	    (addr == NULL)) {
935 		goto connected_type;
936 	}
937 	if (addr == NULL) {
938 		m_freem(m);
939 		if (control) {
940 			m_freem(control);
941 			control = NULL;
942 		}
943 		return (EDESTADDRREQ);
944 	}
945 #ifdef INET
946 	sin6 = (struct sockaddr_in6 *)addr;
947 	if (
948 
949 	    (inp6->inp_flags & IN6P_IPV6_V6ONLY)
950 	    ) {
951 		/*
952 		 * if IPV6_V6ONLY flag, we discard datagrams destined to a
953 		 * v4 addr or v4-mapped addr
954 		 */
955 		if (addr->sa_family == AF_INET) {
956 			return EINVAL;
957 		}
958 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
959 			return EINVAL;
960 		}
961 	}
962 	if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
963 		if (!ip6_v6only) {
964 			struct sockaddr_in sin;
965 
966 			/* convert v4-mapped into v4 addr and send */
967 			in6_sin6_2_sin(&sin, sin6);
968 			return sctp_sendm(so, flags, m, (struct sockaddr *)&sin,
969 			    control, p);
970 		} else {
971 			/* mapped addresses aren't enabled */
972 			return EINVAL;
973 		}
974 	}
975 #endif				/* INET */
976 connected_type:
977 	/* now what about control */
978 	if (control) {
979 		if (inp->control) {
980 			printf("huh? control set?\n");
981 			m_freem(inp->control);
982 			inp->control = NULL;
983 		}
984 		inp->control = control;
985 	}
986 	/* Place the data */
987 	if (inp->pkt) {
988 		SCTP_BUF_NEXT(inp->pkt_last) = m;
989 		inp->pkt_last = m;
990 	} else {
991 		inp->pkt_last = inp->pkt = m;
992 	}
993 	if (
994 	/* FreeBSD and MacOSX uses a flag passed */
995 	    ((flags & PRUS_MORETOCOME) == 0)
996 	    ) {
997 		/*
998 		 * note with the current version this code will only be used
999 		 * by OpenBSD, NetBSD and FreeBSD have methods for
1000 		 * re-defining sosend() to use sctp_sosend().  One can
1001 		 * optionaly switch back to this code (by changing back the
1002 		 * defininitions but this is not advisable.
1003 		 */
1004 		int ret;
1005 
1006 		ret = sctp_output(inp, inp->pkt, addr, inp->control, p, flags);
1007 		inp->pkt = NULL;
1008 		inp->control = NULL;
1009 		return (ret);
1010 	} else {
1011 		return (0);
1012 	}
1013 }
1014 
1015 static int
1016 sctp6_connect(struct socket *so, struct sockaddr *addr, struct thread *p)
1017 {
1018 	int s = splnet();
1019 
1020 	int error = 0;
1021 	struct sctp_inpcb *inp;
1022 	struct in6pcb *inp6;
1023 	struct sctp_tcb *stcb;
1024 
1025 #ifdef INET
1026 	struct sockaddr_in6 *sin6;
1027 	struct sockaddr_storage ss;
1028 
1029 #endif				/* INET */
1030 
1031 	inp6 = (struct in6pcb *)so->so_pcb;
1032 	inp = (struct sctp_inpcb *)so->so_pcb;
1033 	if (inp == 0) {
1034 		splx(s);
1035 		return (ECONNRESET);	/* I made the same as TCP since we are
1036 					 * not setup? */
1037 	}
1038 	SCTP_ASOC_CREATE_LOCK(inp);
1039 	SCTP_INP_RLOCK(inp);
1040 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) ==
1041 	    SCTP_PCB_FLAGS_UNBOUND) {
1042 		/* Bind a ephemeral port */
1043 		SCTP_INP_RUNLOCK(inp);
1044 		error = sctp6_bind(so, NULL, p);
1045 		if (error) {
1046 			splx(s);
1047 			SCTP_ASOC_CREATE_UNLOCK(inp);
1048 
1049 			return (error);
1050 		}
1051 		SCTP_INP_RLOCK(inp);
1052 	}
1053 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
1054 	    (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED)) {
1055 		/* We are already connected AND the TCP model */
1056 		splx(s);
1057 		SCTP_INP_RUNLOCK(inp);
1058 		SCTP_ASOC_CREATE_UNLOCK(inp);
1059 		return (EADDRINUSE);
1060 	}
1061 #ifdef INET
1062 	sin6 = (struct sockaddr_in6 *)addr;
1063 	if (
1064 	    (inp6->inp_flags & IN6P_IPV6_V6ONLY)
1065 	    ) {
1066 		/*
1067 		 * if IPV6_V6ONLY flag, ignore connections destined to a v4
1068 		 * addr or v4-mapped addr
1069 		 */
1070 		if (addr->sa_family == AF_INET) {
1071 			splx(s);
1072 			SCTP_INP_RUNLOCK(inp);
1073 			SCTP_ASOC_CREATE_UNLOCK(inp);
1074 			return EINVAL;
1075 		}
1076 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
1077 			splx(s);
1078 			SCTP_INP_RUNLOCK(inp);
1079 			SCTP_ASOC_CREATE_UNLOCK(inp);
1080 			return EINVAL;
1081 		}
1082 	}
1083 	if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
1084 		if (!ip6_v6only) {
1085 			/* convert v4-mapped into v4 addr */
1086 			in6_sin6_2_sin((struct sockaddr_in *)&ss, sin6);
1087 			addr = (struct sockaddr *)&ss;
1088 		} else {
1089 			/* mapped addresses aren't enabled */
1090 			splx(s);
1091 			SCTP_INP_RUNLOCK(inp);
1092 			SCTP_ASOC_CREATE_UNLOCK(inp);
1093 			return EINVAL;
1094 		}
1095 	} else
1096 #endif				/* INET */
1097 		addr = addr;	/* for true v6 address case */
1098 
1099 	/* Now do we connect? */
1100 	if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
1101 		stcb = LIST_FIRST(&inp->sctp_asoc_list);
1102 		if (stcb)
1103 			SCTP_TCB_UNLOCK(stcb);
1104 		SCTP_INP_RUNLOCK(inp);
1105 	} else {
1106 		SCTP_INP_RUNLOCK(inp);
1107 		SCTP_INP_WLOCK(inp);
1108 		SCTP_INP_INCR_REF(inp);
1109 		SCTP_INP_WUNLOCK(inp);
1110 		stcb = sctp_findassociation_ep_addr(&inp, addr, NULL, NULL, NULL);
1111 		if (stcb == NULL) {
1112 			SCTP_INP_WLOCK(inp);
1113 			SCTP_INP_DECR_REF(inp);
1114 			SCTP_INP_WUNLOCK(inp);
1115 		}
1116 	}
1117 
1118 	if (stcb != NULL) {
1119 		/* Already have or am bring up an association */
1120 		SCTP_ASOC_CREATE_UNLOCK(inp);
1121 		SCTP_TCB_UNLOCK(stcb);
1122 		splx(s);
1123 		return (EALREADY);
1124 	}
1125 	/* We are GOOD to go */
1126 	stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0);
1127 	SCTP_ASOC_CREATE_UNLOCK(inp);
1128 	if (stcb == NULL) {
1129 		/* Gak! no memory */
1130 		splx(s);
1131 		return (error);
1132 	}
1133 	if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
1134 		stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_CONNECTED;
1135 		/* Set the connected flag so we can queue data */
1136 		soisconnecting(so);
1137 	}
1138 	stcb->asoc.state = SCTP_STATE_COOKIE_WAIT;
1139 	SCTP_GETTIME_TIMEVAL(&stcb->asoc.time_entered);
1140 
1141 	/* initialize authentication parameters for the assoc */
1142 	sctp_initialize_auth_params(inp, stcb);
1143 
1144 	sctp_send_initiate(inp, stcb);
1145 	SCTP_TCB_UNLOCK(stcb);
1146 	splx(s);
1147 	return error;
1148 }
1149 
1150 static int
1151 sctp6_getaddr(struct socket *so, struct sockaddr **addr)
1152 {
1153 	struct sockaddr_in6 *sin6;
1154 
1155 	struct sctp_inpcb *inp;
1156 
1157 	int error;
1158 
1159 
1160 	/*
1161 	 * Do the malloc first in case it blocks.
1162 	 */
1163 	SCTP_MALLOC_SONAME(sin6, struct sockaddr_in6 *, sizeof *sin6);
1164 	sin6->sin6_family = AF_INET6;
1165 	sin6->sin6_len = sizeof(*sin6);
1166 
1167 	inp = (struct sctp_inpcb *)so->so_pcb;
1168 	if (inp == NULL) {
1169 		SCTP_FREE_SONAME(sin6);
1170 		return ECONNRESET;
1171 	}
1172 	SCTP_INP_RLOCK(inp);
1173 	sin6->sin6_port = inp->sctp_lport;
1174 	if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
1175 		/* For the bound all case you get back 0 */
1176 		if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
1177 			struct sctp_tcb *stcb;
1178 			struct sockaddr_in6 *sin_a6;
1179 			struct sctp_nets *net;
1180 			int fnd;
1181 
1182 			stcb = LIST_FIRST(&inp->sctp_asoc_list);
1183 			if (stcb == NULL) {
1184 				goto notConn6;
1185 			}
1186 			fnd = 0;
1187 			sin_a6 = NULL;
1188 			TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1189 				sin_a6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1190 				if (sin_a6 == NULL)
1191 					/* this will make coverity happy */
1192 					continue;
1193 
1194 				if (sin_a6->sin6_family == AF_INET6) {
1195 					fnd = 1;
1196 					break;
1197 				}
1198 			}
1199 			if ((!fnd) || (sin_a6 == NULL)) {
1200 				/* punt */
1201 				goto notConn6;
1202 			}
1203 			sin6->sin6_addr = sctp_ipv6_source_address_selection(
1204 			    inp, stcb, (struct route *)&net->ro, net, 0);
1205 
1206 		} else {
1207 			/* For the bound all case you get back 0 */
1208 	notConn6:
1209 			memset(&sin6->sin6_addr, 0, sizeof(sin6->sin6_addr));
1210 		}
1211 	} else {
1212 		/* Take the first IPv6 address in the list */
1213 		struct sctp_laddr *laddr;
1214 		int fnd = 0;
1215 
1216 		LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
1217 			if (laddr->ifa->ifa_addr->sa_family == AF_INET6) {
1218 				struct sockaddr_in6 *sin_a;
1219 
1220 				sin_a = (struct sockaddr_in6 *)laddr->ifa->ifa_addr;
1221 				sin6->sin6_addr = sin_a->sin6_addr;
1222 				fnd = 1;
1223 				break;
1224 			}
1225 		}
1226 		if (!fnd) {
1227 			SCTP_FREE_SONAME(sin6);
1228 			SCTP_INP_RUNLOCK(inp);
1229 			return ENOENT;
1230 		}
1231 	}
1232 	SCTP_INP_RUNLOCK(inp);
1233 	/* Scoping things for v6 */
1234 	if ((error = sa6_recoverscope(sin6)) != 0) {
1235 		SCTP_FREE_SONAME(sin6);
1236 		return (error);
1237 	}
1238 	(*addr) = (struct sockaddr *)sin6;
1239 	return (0);
1240 }
1241 
1242 static int
1243 sctp6_peeraddr(struct socket *so, struct sockaddr **addr)
1244 {
1245 	struct sockaddr_in6 *sin6 = (struct sockaddr_in6 *)*addr;
1246 
1247 	int fnd;
1248 	struct sockaddr_in6 *sin_a6;
1249 	struct sctp_inpcb *inp;
1250 	struct sctp_tcb *stcb;
1251 	struct sctp_nets *net;
1252 
1253 	int error;
1254 
1255 
1256 	/*
1257 	 * Do the malloc first in case it blocks.
1258 	 */
1259 	inp = (struct sctp_inpcb *)so->so_pcb;
1260 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
1261 		/* UDP type and listeners will drop out here */
1262 		return (ENOTCONN);
1263 	}
1264 	SCTP_MALLOC_SONAME(sin6, struct sockaddr_in6 *, sizeof *sin6);
1265 	sin6->sin6_family = AF_INET6;
1266 	sin6->sin6_len = sizeof(*sin6);
1267 
1268 	/* We must recapture incase we blocked */
1269 	inp = (struct sctp_inpcb *)so->so_pcb;
1270 	if (inp == NULL) {
1271 		SCTP_FREE_SONAME(sin6);
1272 		return ECONNRESET;
1273 	}
1274 	SCTP_INP_RLOCK(inp);
1275 	stcb = LIST_FIRST(&inp->sctp_asoc_list);
1276 	if (stcb)
1277 		SCTP_TCB_LOCK(stcb);
1278 	SCTP_INP_RUNLOCK(inp);
1279 	if (stcb == NULL) {
1280 		SCTP_FREE_SONAME(sin6);
1281 		return ECONNRESET;
1282 	}
1283 	fnd = 0;
1284 	TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1285 		sin_a6 = (struct sockaddr_in6 *)&net->ro._l_addr;
1286 		if (sin_a6->sin6_family == AF_INET6) {
1287 			fnd = 1;
1288 			sin6->sin6_port = stcb->rport;
1289 			sin6->sin6_addr = sin_a6->sin6_addr;
1290 			break;
1291 		}
1292 	}
1293 	SCTP_TCB_UNLOCK(stcb);
1294 	if (!fnd) {
1295 		/* No IPv4 address */
1296 		SCTP_FREE_SONAME(sin6);
1297 		return ENOENT;
1298 	}
1299 	if ((error = sa6_recoverscope(sin6)) != 0)
1300 		return (error);
1301 	*addr = (struct sockaddr *)sin6;
1302 	return (0);
1303 }
1304 
1305 static int
1306 sctp6_in6getaddr(struct socket *so, struct sockaddr **nam)
1307 {
1308 	struct sockaddr *addr;
1309 
1310 	struct in6pcb *inp6 = sotoin6pcb(so);
1311 	int error, s;
1312 
1313 	if (inp6 == NULL)
1314 		return EINVAL;
1315 
1316 	s = splnet();
1317 	/* allow v6 addresses precedence */
1318 	error = sctp6_getaddr(so, nam);
1319 	if (error) {
1320 		/* try v4 next if v6 failed */
1321 		error = sctp_ingetaddr(so, nam);
1322 		if (error) {
1323 			splx(s);
1324 			return (error);
1325 		}
1326 		addr = *nam;
1327 		/* if I'm V6ONLY, convert it to v4-mapped */
1328 		if (
1329 		    (inp6->inp_flags & IN6P_IPV6_V6ONLY)
1330 		    ) {
1331 			struct sockaddr_in6 sin6;
1332 
1333 			in6_sin_2_v4mapsin6((struct sockaddr_in *)addr, &sin6);
1334 			memcpy(addr, &sin6, sizeof(struct sockaddr_in6));
1335 		}
1336 	}
1337 	splx(s);
1338 	return (error);
1339 }
1340 
1341 
1342 static int
1343 sctp6_getpeeraddr(struct socket *so, struct sockaddr **nam)
1344 {
1345 	struct sockaddr *addr = *nam;
1346 
1347 	struct in6pcb *inp6 = sotoin6pcb(so);
1348 	int error, s;
1349 
1350 	if (inp6 == NULL)
1351 		return EINVAL;
1352 
1353 	s = splnet();
1354 	/* allow v6 addresses precedence */
1355 	error = sctp6_peeraddr(so, nam);
1356 	if (error) {
1357 		/* try v4 next if v6 failed */
1358 		error = sctp_peeraddr(so, nam);
1359 		if (error) {
1360 			splx(s);
1361 			return (error);
1362 		}
1363 		/* if I'm V6ONLY, convert it to v4-mapped */
1364 		if (
1365 		    (inp6->inp_flags & IN6P_IPV6_V6ONLY)
1366 		    ) {
1367 			struct sockaddr_in6 sin6;
1368 
1369 			in6_sin_2_v4mapsin6((struct sockaddr_in *)addr, &sin6);
1370 			memcpy(addr, &sin6, sizeof(struct sockaddr_in6));
1371 		}
1372 	}
1373 	splx(s);
1374 	return error;
1375 }
1376 
1377 struct pr_usrreqs sctp6_usrreqs = {
1378 	.pru_abort = sctp6_abort,
1379 	.pru_accept = sctp_accept,
1380 	.pru_attach = sctp6_attach,
1381 	.pru_bind = sctp6_bind,
1382 	.pru_connect = sctp6_connect,
1383 	.pru_control = in6_control,
1384 	.pru_close = sctp6_close,
1385 	.pru_detach = sctp6_close,
1386 	.pru_sopoll = sopoll_generic,
1387 	.pru_disconnect = sctp6_disconnect,
1388 	.pru_listen = sctp_listen,
1389 	.pru_peeraddr = sctp6_getpeeraddr,
1390 	.pru_send = sctp6_send,
1391 	.pru_shutdown = sctp_shutdown,
1392 	.pru_sockaddr = sctp6_in6getaddr,
1393 	.pru_sosend = sctp_sosend,
1394 	.pru_soreceive = sctp_soreceive
1395 };
1396