- most all includes (#include <>) migrate to the sctp_os_bsd.h file

 - Finally all splxx() are removed
 - Count error fixed in mapping array which might
   cause a wrong cumack generation.
 - Invariants around panic for case D + printf when no invariants.
 - one-to-one model race condition fixed by using
   a pre-formed connection and then completing the
   work so accept won't happen on a non-formed
   association.
 - Some additional paranoia checks in sctp_output.
 - Locks that were missing in the accept code.

Approved by:	gnn

28 files changed, 193 insertions, 883 deletions

diff --git a/sys/netinet/sctp_asconf.c b/sys/netinet/sctp_asconf.c
index 4ef29c6..500d2eb 100644
--- a/sys/netinet/sctp_asconf.c
+++ b/sys/netinet/sctp_asconf.c
@@ -32,47 +32,6 @@
 
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
-
-
-
-#include "opt_ipsec.h"
-#include "opt_compat.h"
-#include "opt_inet6.h"
-#include "opt_inet.h"
-
-#include "opt_sctp.h"
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/malloc.h>
-#include <sys/mbuf.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/kernel.h>
-#include <sys/sysctl.h>
-
-#include <net/if.h>
-#include <net/if_types.h>
-#include <net/route.h>
-
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/in_pcb.h>
-#include <netinet/in_var.h>
-#include <netinet/ip_var.h>
-
-#ifdef INET6
-#include <netinet/ip6.h>
-#include <netinet6/ip6_var.h>
-#include <netinet6/in6_pcb.h>
-#include <netinet/icmp6.h>
-#include <netinet6/nd6.h>
-#include <netinet6/scope6_var.h>
-#endif				/* INET6 */
-
-#include <netinet/in_pcb.h>
-
 #include <netinet/sctp_os.h>
 #include <netinet/sctp_var.h>
 #include <netinet/sctp_pcb.h>
@@ -1847,7 +1806,6 @@ static void
 sctp_addr_mgmt_ep(struct sctp_inpcb *inp, struct ifaddr *ifa, uint16_t type)
 {
 	struct sctp_tcb *stcb;
-	int s;
 
 
 	SCTP_INP_WLOCK(inp);
@@ -1915,14 +1873,12 @@ sctp_addr_mgmt_ep(struct sctp_inpcb *inp, struct ifaddr *ifa, uint16_t type)
 			/* drop through and notify all asocs */
 		}
 	}
-	s = splnet();
 	/* process for all associations for this endpoint */
 	LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
 		SCTP_TCB_LOCK(stcb);
 		sctp_addr_mgmt_assoc(inp, stcb, ifa, type);
 		SCTP_TCB_UNLOCK(stcb);
 	}
-	splx(s);
 	SCTP_INP_WUNLOCK(inp);
 }
 
@@ -1933,7 +1889,6 @@ static void
 sctp_addr_mgmt_restrict_ep(struct sctp_inpcb *inp, struct ifaddr *ifa)
 {
 	struct sctp_tcb *stcb;
-	int s;
 
 	/* is this endpoint bound to all? */
 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) == 0) {
@@ -1943,7 +1898,6 @@ sctp_addr_mgmt_restrict_ep(struct sctp_inpcb *inp, struct ifaddr *ifa)
 		 */
 		return;
 	}
-	s = splnet();
 	SCTP_INP_RLOCK(inp);
 	/* process for all associations for this endpoint */
 	LIST_FOREACH(stcb, &inp->sctp_asoc_list, sctp_tcblist) {
@@ -1952,7 +1906,6 @@ sctp_addr_mgmt_restrict_ep(struct sctp_inpcb *inp, struct ifaddr *ifa)
 		sctp_add_local_addr_assoc(stcb, ifa);
 		SCTP_TCB_UNLOCK(stcb);
 	}
-	splx(s);
 	SCTP_INP_RUNLOCK(inp);
 }
 
diff --git a/sys/netinet/sctp_asconf.h b/sys/netinet/sctp_asconf.h
index df9e465..2bece63 100644
--- a/sys/netinet/sctp_asconf.h
+++ b/sys/netinet/sctp_asconf.h
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved.
+ * Copyright (c) 2001-2007, Cisco Systems, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -36,9 +36,6 @@ __FBSDID("$FreeBSD$");
 #ifndef _NETINET_SCTP_ASCONF_H_
 #define _NETINET_SCTP_ASCONF_H_
 
-#include <sys/malloc.h>
-
-
 #if defined(_KERNEL)
 
 /*
diff --git a/sys/netinet/sctp_auth.c b/sys/netinet/sctp_auth.c
index d5fe70a..6c7572f 100644
--- a/sys/netinet/sctp_auth.c
+++ b/sys/netinet/sctp_auth.c
@@ -31,29 +31,6 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
-#include "opt_sctp.h"
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/malloc.h>
-#include <sys/mbuf.h>
-#include <sys/domain.h>
-#include <sys/protosw.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/proc.h>
-#include <sys/kernel.h>
-#include <sys/sysctl.h>
-
-#include <net/if.h>
-#include <net/if_types.h>
-#include <net/route.h>
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/in_pcb.h>
-#include <netinet/in_var.h>
-#include <netinet/ip_var.h>
-
 #include <netinet/sctp_os.h>
 #include <netinet/sctp.h>
 #include <netinet/sctp_header.h>
diff --git a/sys/netinet/sctp_bsd_addr.c b/sys/netinet/sctp_bsd_addr.c
index 6cdbc6c..fb33fa8 100644
--- a/sys/netinet/sctp_bsd_addr.c
+++ b/sys/netinet/sctp_bsd_addr.c
@@ -33,69 +33,6 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
-#include "opt_ipsec.h"
-#include "opt_compat.h"
-#include "opt_inet6.h"
-#include "opt_inet.h"
-#include "opt_sctp.h"
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/malloc.h>
-#include <sys/mbuf.h>
-#include <sys/domain.h>
-#include <sys/protosw.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/proc.h>
-#include <sys/kernel.h>
-#include <sys/sysctl.h>
-#include <sys/resourcevar.h>
-#include <sys/uio.h>
-#ifdef INET6
-#include <sys/domain.h>
-#endif
-
-#include <sys/limits.h>
-#include <machine/cpu.h>
-
-#include <net/if.h>
-#include <net/if_types.h>
-
-#include <net/if_var.h>
-
-#include <net/route.h>
-
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/in_pcb.h>
-#include <netinet/in_var.h>
-#include <netinet/ip_var.h>
-
-#ifdef INET6
-#include <netinet/ip6.h>
-#include <netinet6/ip6_var.h>
-#include <netinet6/scope6_var.h>
-#include <netinet6/nd6.h>
-
-#include <netinet6/in6_pcb.h>
-
-#include <netinet/icmp6.h>
-
-#endif				/* INET6 */
-
-
-
-#ifndef in6pcb
-#define in6pcb		inpcb
-#endif
-
-
-#ifdef IPSEC
-#include <netinet6/ipsec.h>
-#include <netkey/key.h>
-#endif				/* IPSEC */
-
 #include <netinet/sctp_os.h>
 #include <netinet/sctp_var.h>
 #include <netinet/sctp_pcb.h>
@@ -109,6 +46,7 @@ __FBSDID("$FreeBSD$");
 #include <netinet/sctp_asconf.h>
 #include <netinet/sctp_indata.h>
 
+
 /* XXX
  * This module needs to be rewritten with an eye towards getting
  * rid of the user of ifa.. and use another list method George
diff --git a/sys/netinet/sctp_bsd_addr.h b/sys/netinet/sctp_bsd_addr.h
index f997684..ad7b5b8 100644
--- a/sys/netinet/sctp_bsd_addr.h
+++ b/sys/netinet/sctp_bsd_addr.h
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved.
+ * Copyright (c) 2001-2007, Cisco Systems, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -34,16 +34,10 @@ __FBSDID("$FreeBSD$");
 #ifndef __sctp_bsd_addr_h__
 #define __sctp_bsd_addr_h__
 
-
-
-
 #include <netinet/sctp_header.h>
 
-
-
 #if defined(_KERNEL)
 
-
 int sctp_is_addr_restricted(struct sctp_tcb *, struct sockaddr *);
 
 
diff --git a/sys/netinet/sctp_constants.h b/sys/netinet/sctp_constants.h
index 06490d3..9d23e4f 100644
--- a/sys/netinet/sctp_constants.h
+++ b/sys/netinet/sctp_constants.h
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved.
+ * Copyright (c) 2001-2007, Cisco Systems, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -924,11 +924,8 @@ __FBSDID("$FreeBSD$");
      (((u_char *)&(a)->s_addr)[3] == 1))
 
 
-
-
 #if defined(_KERNEL)
 
-
 #define SCTP_GETTIME_TIMEVAL(x)	(getmicrouptime(x))
 #define SCTP_GETPTIME_TIMEVAL(x)	(microuptime(x))
 /*#if defined(__FreeBSD__) || defined(__APPLE__)*/
diff --git a/sys/netinet/sctp_crc32.h b/sys/netinet/sctp_crc32.h
index c9d41c9..30d7d6e 100644
--- a/sys/netinet/sctp_crc32.h
+++ b/sys/netinet/sctp_crc32.h
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved.
+ * Copyright (c) 2001-2007, Cisco Systems, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -36,9 +36,6 @@ __FBSDID("$FreeBSD$");
 #ifndef __crc32c_h__
 #define __crc32c_h__
 
-
-#include <sys/types.h>
-
 #ifndef SCTP_USE_ADLER32
 
 #if defined(_KERNEL)
@@ -49,8 +46,6 @@ uint32_t old_update_crc32(uint32_t, unsigned char *, unsigned int);
 uint32_t sctp_csum_finalize(uint32_t);
 
 
-
-
 #endif				/* _KERNEL */
 #endif				/* !SCTP_USE_ADLER32 */
 #endif				/* __crc32c_h__ */
diff --git a/sys/netinet/sctp_indata.c b/sys/netinet/sctp_indata.c
index 232362a..97dcfab 100644
--- a/sys/netinet/sctp_indata.c
+++ b/sys/netinet/sctp_indata.c
@@ -33,43 +33,6 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
-
-#include "opt_ipsec.h"
-#include "opt_inet6.h"
-#include "opt_inet.h"
-
-#include "opt_sctp.h"
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/mbuf.h>
-#include <sys/malloc.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/sysctl.h>
-
-#include <net/if.h>
-#include <net/route.h>
-
-
-#include <sys/limits.h>
-#include <machine/cpu.h>
-
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#ifdef INET6
-#include <netinet/ip6.h>
-#endif				/* INET6 */
-#include <netinet/in_pcb.h>
-#include <netinet/in_var.h>
-#include <netinet/ip_var.h>
-#ifdef INET6
-#include <netinet6/ip6_var.h>
-#endif				/* INET6 */
-#include <netinet/ip_icmp.h>
-#include <netinet/icmp_var.h>
-
 #include <netinet/sctp_os.h>
 #include <netinet/sctp_var.h>
 #include <netinet/sctp_pcb.h>
@@ -80,10 +43,6 @@ __FBSDID("$FreeBSD$");
 #include <netinet/sctp_indata.h>
 #include <netinet/sctp_uio.h>
 #include <netinet/sctp_timer.h>
-#ifdef IPSEC
-#include <netinet6/ipsec.h>
-#include <netkey/key.h>
-#endif				/* IPSEC */
 
 
 #ifdef SCTP_DEBUG
@@ -2181,7 +2140,7 @@ sctp_sack_check(struct sctp_tcb *stcb, int ok_to_sack, int was_a_gap, int *abort
 	 */
 	struct sctp_association *asoc;
 	int i, at;
-	int all_ones;
+	int all_ones, last_all_ones = 0;
 	int slide_from, slide_end, lgap, distance;
 
 #ifdef SCTP_MAP_LOGGING
@@ -2214,14 +2173,16 @@ sctp_sack_check(struct sctp_tcb *stcb, int ok_to_sack, int was_a_gap, int *abort
 	for (i = 0; i < stcb->asoc.mapping_array_size; i++) {
 		if (asoc->mapping_array[i] == 0xff) {
 			at += 8;
+			last_all_ones = 1;
 		} else {
 			/* there is a 0 bit */
 			all_ones = 0;
 			at += sctp_map_lookup_tab[asoc->mapping_array[i]];
+			last_all_ones = 0;
 			break;
 		}
 	}
-	asoc->cumulative_tsn = asoc->mapping_array_base_tsn + at;
+	asoc->cumulative_tsn = asoc->mapping_array_base_tsn + (at - last_all_ones);
 	/* at is one off, since in the table a embedded -1 is present */
 	at++;
 
diff --git a/sys/netinet/sctp_indata.h b/sys/netinet/sctp_indata.h
index 0dc0ae4..394e4c9 100644
--- a/sys/netinet/sctp_indata.h
+++ b/sys/netinet/sctp_indata.h
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved.
+ * Copyright (c) 2001-2007, Cisco Systems, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -36,13 +36,8 @@ __FBSDID("$FreeBSD$");
 #ifndef __sctp_indata_h__
 #define __sctp_indata_h__
 
-
-
-
-
 #if defined(_KERNEL)
 
-
 struct sctp_queued_to_read *
 sctp_build_readq_entry(struct sctp_tcb *stcb,
     struct sctp_nets *net,
diff --git a/sys/netinet/sctp_input.c b/sys/netinet/sctp_input.c
index 5287423..0a6fdea 100644
--- a/sys/netinet/sctp_input.c
+++ b/sys/netinet/sctp_input.c
@@ -33,47 +33,6 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
-#include "opt_ipsec.h"
-#include "opt_compat.h"
-#include "opt_inet6.h"
-#include "opt_inet.h"
-#include "opt_sctp.h"
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/malloc.h>
-#include <sys/mbuf.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/sysctl.h>
-#include <sys/domain.h>
-#include <sys/protosw.h>
-#include <sys/kernel.h>
-#include <sys/errno.h>
-#include <sys/syslog.h>
-
-#include <sys/limits.h>
-#include <machine/cpu.h>
-
-#include <net/if.h>
-#include <net/route.h>
-#include <net/if_types.h>
-
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/in_pcb.h>
-#include <netinet/in_var.h>
-#include <netinet/ip_var.h>
-
-#ifdef INET6
-#include <netinet/ip6.h>
-#include <netinet6/ip6_var.h>
-#endif				/* INET6 */
-
-#include <netinet/ip_icmp.h>
-#include <netinet/icmp_var.h>
-
 #include <netinet/sctp_os.h>
 #include <netinet/sctp_var.h>
 #include <netinet/sctp_pcb.h>
@@ -85,14 +44,6 @@ __FBSDID("$FreeBSD$");
 #include <netinet/sctp_indata.h>
 #include <netinet/sctp_asconf.h>
 
-#include <netinet/ip_options.h>
-
-
-#ifdef IPSEC
-#include <netinet6/ipsec.h>
-#include <netkey/key.h>
-#endif				/* IPSEC */
-
 
 #ifdef SCTP_DEBUG
 extern uint32_t sctp_debug_on;
@@ -913,7 +864,7 @@ sctp_handle_error(struct sctp_chunkhdr *ch,
 		case SCTP_CAUSE_DELETING_SRC_ADDR:
 			/*
 			 * We should NOT get these here, but in a
-			 * ASCONF-ACK. n
+			 * ASCONF-ACK.
 			 */
 #ifdef SCTP_DEBUG
 			if (sctp_debug_on & SCTP_DEBUG_INPUT2) {
@@ -926,7 +877,7 @@ sctp_handle_error(struct sctp_chunkhdr *ch,
 			/*
 			 * And what, pray tell do we do with the fact that
 			 * the peer is out of resources? Not really sure we
-			 * could do anything but abort. I suspect this n		 *
+			 * could do anything but abort. I suspect this
 			 * should have came WITH an abort instead of in a
 			 * OP-ERROR.
 			 */
@@ -1180,7 +1131,12 @@ sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset,
 		 * to get into the OPEN state
 		 */
 		if (ntohl(initack_cp->init.initial_tsn) != asoc->init_seq_number) {
+#ifdef INVARIANTS
 			panic("Case D and non-match seq?");
+#else
+			printf("Case D, seq non-match %x vs %x?\n",
+			    ntohl(initack_cp->init.initial_tsn), asoc->init_seq_number);
+#endif
 		}
 		switch SCTP_GET_STATE
 			(asoc) {
@@ -1519,14 +1475,13 @@ sctp_process_cookie_existing(struct mbuf *m, int iphlen, int offset,
 
 		return (stcb);
 	}
-	/* if we are not a restart we need the assoc_id field pop'd */
-	asoc->assoc_id = ntohl(initack_cp->init.initiate_tag);
 	if (how_indx < sizeof(asoc->cookie_how))
 		asoc->cookie_how[how_indx] = 16;
 	/* all other cases... */
 	return (NULL);
 }
 
+
 /*
  * handle a state cookie for a new association m: input packet mbuf chain--
  * assumes a pullup on IP/SCTP/COOKIE-ECHO chunk note: this is a "split" mbuf
@@ -2165,7 +2120,7 @@ sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset,
 			 */
 			NET_LOCK_GIANT();
 			SCTP_TCB_UNLOCK((*stcb));
-			so = sonewconn(oso, SS_ISCONNECTED
+			so = sonewconn(oso, 0
 			    );
 			NET_UNLOCK_GIANT();
 			SCTP_INP_WLOCK((*stcb)->sctp_ep);
@@ -2187,9 +2142,16 @@ sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset,
 				return (NULL);
 			}
 			inp = (struct sctp_inpcb *)so->so_pcb;
+			SCTP_INP_INCR_REF(inp);
+			/*
+			 * We add the unbound flag here so that if we get an
+			 * soabort() before we get the move_pcb done, we
+			 * will properly cleanup.
+			 */
 			inp->sctp_flags = (SCTP_PCB_FLAGS_TCPTYPE |
 			    SCTP_PCB_FLAGS_CONNECTED |
 			    SCTP_PCB_FLAGS_IN_TCPPOOL |
+			    SCTP_PCB_FLAGS_UNBOUND |
 			    (SCTP_PCB_COPY_FLAGS & (*inp_p)->sctp_flags) |
 			    SCTP_PCB_FLAGS_DONT_WAKE);
 			inp->sctp_features = (*inp_p)->sctp_features;
@@ -2218,13 +2180,32 @@ sctp_handle_cookie_echo(struct mbuf *m, int iphlen, int offset,
 			 * another and get the tcb in the right place.
 			 */
 			sctp_move_pcb_and_assoc(*inp_p, inp, *stcb);
-
 			sctp_pull_off_control_to_new_inp((*inp_p), inp, *stcb);
 
+			/*
+			 * now we must check to see if we were aborted while
+			 * the move was going on and the lock/unlock
+			 * happened.
+			 */
+			if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
+				/*
+				 * yep it was, we leave the assoc attached
+				 * to the socket since the sctp_inpcb_free()
+				 * call will send an abort for us.
+				 */
+				SCTP_INP_DECR_REF(inp);
+				return (NULL);
+			}
+			SCTP_INP_DECR_REF(inp);
 			/* Switch over to the new guy */
 			*inp_p = inp;
-
 			sctp_ulp_notify(notification, *stcb, 0, NULL);
+
+			/*
+			 * Pull it from the incomplete queue and wake the
+			 * guy
+			 */
+			soisconnected(so);
 			return (m);
 		}
 	}
@@ -4678,7 +4659,6 @@ sctp_input(i_pak, off)
 #endif
 	struct mbuf *m;
 	int iphlen;
-	int s;
 	uint8_t ecn_bits;
 	struct ip *ip;
 	struct sctphdr *sh;
@@ -4880,12 +4860,10 @@ sctp_skip_csum_4:
 	offset -= sizeof(struct sctp_chunkhdr);
 
 	ecn_bits = ip->ip_tos;
-	s = splnet();
 
 	sctp_common_input_processing(&m, iphlen, offset, length, sh, ch,
 	    inp, stcb, net, ecn_bits);
 	/* inp's ref-count reduced && stcb unlocked */
-	splx(s);
 	if (m) {
 		sctp_m_freem(m);
 	}
diff --git a/sys/netinet/sctp_input.h b/sys/netinet/sctp_input.h
index e6be0f7..c34b8cc 100644
--- a/sys/netinet/sctp_input.h
+++ b/sys/netinet/sctp_input.h
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved.
+ * Copyright (c) 2001-2007, Cisco Systems, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -36,9 +36,6 @@ __FBSDID("$FreeBSD$");
 #ifndef __sctp_input_h__
 #define __sctp_input_h__
 
-
-
-
 #if defined(_KERNEL)
 int
 sctp_common_input_processing(struct mbuf **, int, int, int,
diff --git a/sys/netinet/sctp_os.h b/sys/netinet/sctp_os.h
index a4545b3..aacf877 100644
--- a/sys/netinet/sctp_os.h
+++ b/sys/netinet/sctp_os.h
@@ -60,4 +60,5 @@ __FBSDID("$FreeBSD$");
 
 
 
+
 #endif
diff --git a/sys/netinet/sctp_os_bsd.h b/sys/netinet/sctp_os_bsd.h
index 80e2970..eb2993e 100644
--- a/sys/netinet/sctp_os_bsd.h
+++ b/sys/netinet/sctp_os_bsd.h
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2006, Cisco Systems, Inc. All rights reserved.
+ * Copyright (c) 2006-2007, Cisco Systems, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -31,17 +31,78 @@
 __FBSDID("$FreeBSD$");
 #ifndef __sctp_os_bsd_h__
 #define __sctp_os_bsd_h__
-
 /*
  * includes
  */
+#include "opt_ipsec.h"
+#include "opt_compat.h"
+#include "opt_inet6.h"
+#include "opt_inet.h"
+#include "opt_sctp.h"
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/malloc.h>
+#include <sys/kernel.h>
+#include <sys/sysctl.h>
+#include <sys/mbuf.h>
+#include <sys/protosw.h>
+#include <sys/socket.h>
+#include <sys/socketvar.h>
+#include <sys/sysctl.h>
+#include <sys/resourcevar.h>
+#include <sys/uio.h>
+#include <sys/priv.h>
 #include <sys/random.h>
+#include <sys/limits.h>
+#include <sys/queue.h>
+#include <machine/cpu.h>
+
+#include <net/if.h>
+#include <net/if_types.h>
+#include <net/if_var.h>
+#include <net/route.h>
+
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/ip.h>
+#include <netinet/in_pcb.h>
+#include <netinet/in_var.h>
+#include <netinet/ip_var.h>
+#include <netinet/ip_icmp.h>
+#include <netinet/icmp_var.h>
+
+
+#ifdef IPSEC
+#include <netinet6/ipsec.h>
+#include <netkey/key.h>
+#endif				/* IPSEC */
+
+#ifdef INET6
+#include <sys/domain.h>
+#ifdef IPSEC
+#include <netinet6/ipsec6.h>
+#endif
+#include <netinet/ip6.h>
+#include <netinet6/ip6_var.h>
+#include <netinet6/in6_pcb.h>
+#include <netinet/icmp6.h>
+#include <netinet6/ip6protosw.h>
+#include <netinet6/nd6.h>
+#include <netinet6/scope6_var.h>
+#endif				/* INET6 */
+
+#include <netinet/ip_options.h>
+
+
+#ifndef in6pcb
+#define in6pcb		inpcb
+#endif
+
+
 
 /*
  *
  */
-typedef struct mbuf *sctp_mbuf_t;
-
 #define USER_ADDR_NULL	(NULL)	/* FIX ME: temp */
 
 /*
diff --git a/sys/netinet/sctp_output.c b/sys/netinet/sctp_output.c
index a6c129d..d1ceb6b 100644
--- a/sys/netinet/sctp_output.c
+++ b/sys/netinet/sctp_output.c
@@ -33,69 +33,8 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
-#include "opt_ipsec.h"
-#include "opt_compat.h"
-#include "opt_inet6.h"
-#include "opt_inet.h"
-#include "opt_sctp.h"
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/malloc.h>
-#include <sys/mbuf.h>
-#include <sys/domain.h>
-#include <sys/protosw.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/proc.h>
-#include <sys/kernel.h>
-#include <sys/sysctl.h>
-#include <sys/resourcevar.h>
-#include <sys/uio.h>
-#ifdef INET6
-#include <sys/domain.h>
-#endif
-
-#include <sys/limits.h>
-#include <machine/cpu.h>
-
-#include <net/if.h>
-#include <net/if_types.h>
-
-#include <net/if_var.h>
-
-#include <net/route.h>
-
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/in_pcb.h>
-#include <netinet/in_var.h>
-#include <netinet/ip_var.h>
-
-#ifdef INET6
-#include <netinet/ip6.h>
-#include <netinet6/ip6_var.h>
-#include <netinet6/scope6_var.h>
-#include <netinet6/nd6.h>
-
-#include <netinet6/in6_pcb.h>
-
-#include <netinet/icmp6.h>
-
-#endif				/* INET6 */
-
-
-
-#ifndef in6pcb
-#define in6pcb		inpcb
-#endif
-
-#ifdef IPSEC
-#include <netinet6/ipsec.h>
-#include <netkey/key.h>
-#endif				/* IPSEC */
-
 #include <netinet/sctp_os.h>
+#include <sys/proc.h>
 #include <netinet/sctp_var.h>
 #include <netinet/sctp_header.h>
 #include <netinet/sctp_pcb.h>
@@ -5085,6 +5024,7 @@ out_gu:
 			}
 			sp->some_taken = some_taken;
 			sp->length += to_move;
+			chk->data = NULL;
 			sctp_free_a_chunk(stcb, chk);
 			SCTP_TCB_SEND_UNLOCK(stcb);
 			goto out_gu;
@@ -5957,6 +5897,15 @@ again_one_more_time:
 						}
 						if (((chk->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) == SCTP_DATA_LAST_FRAG) &&
 						    ((chk->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0))
+							/*
+							 * Count number of
+							 * user msg's that
+							 * were fragmented
+							 * we do this by
+							 * counting when we
+							 * see a LAST
+							 * fragment only.
+							 */
 							SCTP_STAT_INCR_COUNTER64(sctps_fragusrmsgs);
 					}
 					if ((mtu == 0) || (r_mtu == 0) || (one_chunk)) {
@@ -7726,6 +7675,10 @@ sctp_send_sack(struct sctp_tcb *stcb)
 					mergeable = 1;
 				}
 			}
+			if (limit_reached) {
+				/* Reached the limit stop */
+				break;
+			}
 			jstart = 0;
 			offset += 8;
 		}
@@ -9223,11 +9176,10 @@ sctp_sosend(struct socket *so,
 )
 {
 	struct sctp_inpcb *inp;
-	int s, error, use_rcvinfo = 0;
+	int error, use_rcvinfo = 0;
 	struct sctp_sndrcvinfo srcv;
 
 	inp = (struct sctp_inpcb *)so->so_pcb;
-	s = splnet();
 	if (control) {
 		/* process cmsg snd/rcv info (maybe a assoc-id) */
 		if (sctp_find_cmsg(SCTP_SNDRCV, (void *)&srcv, control,
@@ -9238,7 +9190,6 @@ sctp_sosend(struct socket *so,
 	}
 	error = sctp_lower_sosend(so, addr, uio, top, control, flags,
 	    use_rcvinfo, &srcv, p);
-	splx(s);
 	return (error);
 }
 
@@ -9259,7 +9210,12 @@ sctp_lower_sosend(struct socket *so,
 	unsigned int sndlen, max_len;
 	int error, len;
 	struct mbuf *top = NULL;
-	int s, queue_only = 0, queue_only_for_init = 0;
+
+#if defined(__NetBSD__) || defined(__OpenBSD_)
+	int s;
+
+#endif
+	int queue_only = 0, queue_only_for_init = 0;
 	int free_cnt_applied = 0;
 	int un_sent = 0;
 	int now_filled = 0;
@@ -9284,7 +9240,6 @@ sctp_lower_sosend(struct socket *so,
 	t_inp = inp = (struct sctp_inpcb *)so->so_pcb;
 	if (inp == NULL) {
 		error = EFAULT;
-		splx(s);
 		goto out_unlocked;
 	}
 	atomic_add_int(&inp->total_sends, 1);
@@ -9295,20 +9250,17 @@ sctp_lower_sosend(struct socket *so,
 		top = SCTP_HEADER_TO_CHAIN(i_pak);
 	}
 
-	s = splnet();
 	hold_tcblock = 0;
 
 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
 	    (inp->sctp_socket->so_qlimit)) {
 		/* The listener can NOT send */
 		error = EFAULT;
-		splx(s);
 		goto out_unlocked;
 	}
 	if ((use_rcvinfo) && srcv) {
 		if (INVALID_SINFO_FLAG(srcv->sinfo_flags) || PR_SCTP_INVALID_POLICY(srcv->sinfo_flags)) {
 			error = EINVAL;
-			splx(s);
 			goto out_unlocked;
 		}
 		if (srcv->sinfo_flags)
@@ -9318,7 +9270,6 @@ sctp_lower_sosend(struct socket *so,
 			/* its a sendall */
 			error = sctp_sendall(inp, uio, top, srcv);
 			top = NULL;
-			splx(s);
 			goto out_unlocked;
 		}
 	}
@@ -9329,7 +9280,6 @@ sctp_lower_sosend(struct socket *so,
 		if (stcb == NULL) {
 			SCTP_INP_RUNLOCK(inp);
 			error = ENOTCONN;
-			splx(s);
 			goto out_unlocked;
 		}
 		hold_tcblock = 0;
@@ -9378,14 +9328,12 @@ sctp_lower_sosend(struct socket *so,
 		    (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
 			/* Should I really unlock ? */
 			error = EFAULT;
-			splx(s);
 			goto out_unlocked;
 
 		}
 		if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) &&
 		    (addr->sa_family == AF_INET6)) {
 			error = EINVAL;
-			splx(s);
 			goto out_unlocked;
 		}
 		SCTP_INP_WLOCK(inp);
@@ -9404,11 +9352,9 @@ sctp_lower_sosend(struct socket *so,
 	if (stcb == NULL) {
 		if (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
 			error = ENOTCONN;
-			splx(s);
 			goto out_unlocked;
 		} else if (addr == NULL) {
 			error = ENOENT;
-			splx(s);
 			goto out_unlocked;
 		} else {
 			/*
@@ -9424,14 +9370,12 @@ sctp_lower_sosend(struct socket *so,
 				 * or EOF a non-existant assoc with no data
 				 */
 				error = ENOENT;
-				splx(s);
 				goto out_unlocked;
 			}
 			/* get an asoc/stcb struct */
 			stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0);
 			if (stcb == NULL) {
 				/* Error is setup for us in the call */
-				splx(s);
 				goto out_unlocked;
 			}
 			if (create_lock_applied) {
@@ -9505,7 +9449,12 @@ sctp_lower_sosend(struct socket *so,
 							if (had_lock) {
 								SCTP_TCB_LOCK(stcb);
 							}
-							asoc->strmout = tmp_str;
+							if (asoc->strmout == NULL) {
+								asoc->strmout = tmp_str;
+							} else {
+								SCTP_FREE(asoc->strmout);
+								asoc->strmout = tmp_str;
+							}
 						}
 						for (i = 0; i < asoc->streamoutcnt; i++) {
 							/*
@@ -9567,7 +9516,6 @@ sctp_lower_sosend(struct socket *so,
 		    sctp_max_chunks_on_queue)) {
 			error = EWOULDBLOCK;
 			atomic_add_int(&stcb->sctp_ep->total_nospaces, 1);
-			splx(s);
 			goto out_unlocked;
 		}
 	}
@@ -9612,7 +9560,6 @@ sctp_lower_sosend(struct socket *so,
 			;
 		} else {
 			error = ECONNRESET;
-			splx(s);
 			goto out_unlocked;
 		}
 	}
@@ -9741,7 +9688,6 @@ sctp_lower_sosend(struct socket *so,
 		SCTP_TCB_UNLOCK(stcb);
 		hold_tcblock = 0;
 	}
-	splx(s);
 	/* Is the stream no. valid? */
 	if (srcv->sinfo_stream >= asoc->streamoutcnt) {
 		/* Invalid stream number */
@@ -10279,7 +10225,6 @@ skip_out_eof:
 	}
 	if ((queue_only == 0) && (nagle_applies == 0) && (stcb->asoc.peers_rwnd && un_sent)) {
 		/* we can attempt to send too. */
-		s = splnet();
 		if (hold_tcblock == 0) {
 			/*
 			 * If there is activity recv'ing sacks no need to
@@ -10292,7 +10237,6 @@ skip_out_eof:
 		} else {
 			sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_USR_SEND);
 		}
-		splx(s);
 	} else if ((queue_only == 0) &&
 		    (stcb->asoc.peers_rwnd == 0) &&
 	    (stcb->asoc.total_flight == 0)) {
diff --git a/sys/netinet/sctp_output.h b/sys/netinet/sctp_output.h
index 0915fff..e6dca42 100644
--- a/sys/netinet/sctp_output.h
+++ b/sys/netinet/sctp_output.h
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved.
+ * Copyright (c) 2001-2007, Cisco Systems, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -36,13 +36,8 @@ __FBSDID("$FreeBSD$");
 #ifndef __sctp_output_h__
 #define __sctp_output_h__
 
-
-
-
 #include <netinet/sctp_header.h>
 
-
-
 #if defined(_KERNEL)
 void sctp_send_initiate(struct sctp_inpcb *, struct sctp_tcb *);
 
diff --git a/sys/netinet/sctp_pcb.c b/sys/netinet/sctp_pcb.c
index b9934b6..f089616 100644
--- a/sys/netinet/sctp_pcb.c
+++ b/sys/netinet/sctp_pcb.c
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved.
+ * Copyright (c) 2001-2007, Cisco Systems, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -32,51 +32,9 @@
 
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
-#include "opt_ipsec.h"
-#include "opt_compat.h"
-#include "opt_inet6.h"
-#include "opt_inet.h"
-#include "opt_sctp.h"
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/malloc.h>
-#include <sys/mbuf.h>
-#include <sys/domain.h>
-#include <sys/protosw.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/priv.h>
-#include <sys/proc.h>
-#include <sys/kernel.h>
-#include <sys/sysctl.h>
-
-#include <sys/limits.h>
-#include <machine/cpu.h>
-
-#include <net/if.h>
-#include <net/if_types.h>
-#include <net/route.h>
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/in_pcb.h>
-#include <netinet/in_var.h>
-#include <netinet/ip_var.h>
-
-#ifdef INET6
-#include <netinet/ip6.h>
-#include <netinet6/ip6_var.h>
-#include <netinet6/scope6_var.h>
-#include <netinet6/in6_pcb.h>
-#endif				/* INET6 */
-
-#ifdef IPSEC
-#include <netinet6/ipsec.h>
-#include <netkey/key.h>
-#endif				/* IPSEC */
 
 #include <netinet/sctp_os.h>
+#include <sys/proc.h>
 #include <netinet/sctp_var.h>
 #include <netinet/sctp_pcb.h>
 #include <netinet/sctputil.h>
@@ -1546,6 +1504,7 @@ sctp_move_pcb_and_assoc(struct sctp_inpcb *old_inp, struct sctp_inpcb *new_inp,
 	SCTP_INP_WLOCK(new_inp);
 	SCTP_TCB_LOCK(stcb);
 
+
 	new_inp->sctp_ep.time_of_secret_change =
 	    old_inp->sctp_ep.time_of_secret_change;
 	memcpy(new_inp->sctp_ep.secret_key, old_inp->sctp_ep.secret_key,
@@ -1572,6 +1531,8 @@ sctp_move_pcb_and_assoc(struct sctp_inpcb *old_inp, struct sctp_inpcb *new_inp,
 	    sctppcbinfo.hashtcpmark)];
 
 	LIST_INSERT_HEAD(head, new_inp, sctp_hash);
+	/* Its safe to access */
+	new_inp->sctp_flags &= ~SCTP_PCB_FLAGS_UNBOUND;
 
 	/* Now move the tcb into the endpoint list */
 	LIST_INSERT_HEAD(&new_inp->sctp_asoc_list, stcb, sctp_tcblist);
@@ -2062,10 +2023,9 @@ sctp_inpcb_free(struct sctp_inpcb *inp, int immediate, int from)
 
 	struct sctp_queued_to_read *sq;
 
-	int s, cnt;
+	int cnt;
 	sctp_sharedkey_t *shared_key;
 
-	s = splnet();
 
 #ifdef SCTP_LOG_CLOSING
 	sctp_log_closing(inp, NULL, 0);
@@ -2075,7 +2035,6 @@ sctp_inpcb_free(struct sctp_inpcb *inp, int immediate, int from)
 	so = inp->sctp_socket;
 	if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) {
 		/* been here before.. eeks.. get out of here */
-		splx(s);
 		printf("This conflict in free SHOULD not be happening!\n");
 		SCTP_ITERATOR_UNLOCK();
 #ifdef SCTP_LOG_CLOSING
@@ -2256,8 +2215,6 @@ sctp_inpcb_free(struct sctp_inpcb *inp, int immediate, int from)
 		}
 		/* now is there some left in our SHUTDOWN state? */
 		if (cnt_in_sd) {
-			splx(s);
-
 			SCTP_INP_WUNLOCK(inp);
 			SCTP_ASOC_CREATE_UNLOCK(inp);
 			SCTP_INP_INFO_WUNLOCK();
@@ -2467,7 +2424,6 @@ sctp_inpcb_free(struct sctp_inpcb *inp, int immediate, int from)
 	SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_ep, inp);
 	SCTP_DECR_EP_COUNT();
 
-	splx(s);
 }
 
 
@@ -3219,10 +3175,9 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfre
 	sctp_sharedkey_t *shared_key;
 	struct socket *so;
 	int ccnt = 0;
-	int s, cnt = 0;
+	int cnt = 0;
 
 	/* first, lets purge the entry from the hash table. */
-	s = splnet();
 
 #ifdef SCTP_LOG_CLOSING
 	sctp_log_closing(inp, stcb, 6);
@@ -3231,7 +3186,6 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfre
 #ifdef SCTP_LOG_CLOSING
 		sctp_log_closing(inp, NULL, 7);
 #endif
-		splx(s);
 		/* there is no asoc, really TSNH :-0 */
 		return (1);
 	}
@@ -3266,7 +3220,6 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfre
 			sctp_timer_start(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
 			/* no asoc destroyed */
 			SCTP_TCB_UNLOCK(stcb);
-			splx(s);
 #ifdef SCTP_LOG_CLOSING
 			sctp_log_closing(inp, stcb, 8);
 #endif
@@ -3352,7 +3305,6 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfre
 			SCTP_INP_RUNLOCK(inp);
 
 		}
-		splx(s);
 #ifdef SCTP_LOG_CLOSING
 		sctp_log_closing(inp, stcb, 9);
 #endif
@@ -3761,7 +3713,6 @@ sctp_free_assoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int from_inpcbfre
 		SCTP_INP_RUNLOCK(inp);
 	}
 out_of:
-	splx(s);
 	/* destroyed the asoc */
 #ifdef SCTP_LOG_CLOSING
 	sctp_log_closing(inp, NULL, 11);
@@ -4041,14 +3992,10 @@ int
 sctp_insert_laddr(struct sctpladdr *list, struct ifaddr *ifa)
 {
 	struct sctp_laddr *laddr;
-	int s;
-
-	s = splnet();
 
 	laddr = (struct sctp_laddr *)SCTP_ZONE_GET(sctppcbinfo.ipi_zone_laddr);
 	if (laddr == NULL) {
 		/* out of memory? */
-		splx(s);
 		return (EINVAL);
 	}
 	SCTP_INCR_LADDR_COUNT();
@@ -4057,7 +4004,6 @@ sctp_insert_laddr(struct sctpladdr *list, struct ifaddr *ifa)
 	/* insert it */
 	LIST_INSERT_HEAD(list, laddr, sctp_nxt_addr);
 
-	splx(s);
 	return (0);
 }
 
@@ -4067,14 +4013,11 @@ sctp_insert_laddr(struct sctpladdr *list, struct ifaddr *ifa)
 void
 sctp_remove_laddr(struct sctp_laddr *laddr)
 {
-	int s;
 
-	s = splnet();
 	/* remove from the list */
 	LIST_REMOVE(laddr, sctp_nxt_addr);
 	SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, laddr);
 	SCTP_DECR_LADDR_COUNT();
-	splx(s);
 }
 
 /*
@@ -5250,7 +5193,6 @@ sctp_initiate_iterator(inp_func inpf, asoc_func af, uint32_t pcb_state,
     end_func ef, struct sctp_inpcb *s_inp, uint8_t chunk_output_off)
 {
 	struct sctp_iterator *it = NULL;
-	int s;
 
 	if (af == NULL) {
 		return (-1);
@@ -5286,9 +5228,7 @@ sctp_initiate_iterator(inp_func inpf, asoc_func af, uint32_t pcb_state,
 	SCTP_INP_INFO_WLOCK();
 	LIST_INSERT_HEAD(&sctppcbinfo.iteratorhead, it, sctp_nxt_itr);
 	SCTP_INP_INFO_WUNLOCK();
-	s = splnet();
 	sctp_timer_start(SCTP_TIMER_TYPE_ITERATOR, (struct sctp_inpcb *)it,
 	    NULL, NULL);
-	splx(s);
 	return (0);
 }
diff --git a/sys/netinet/sctp_pcb.h b/sys/netinet/sctp_pcb.h
index d64d97a..e822d41 100644
--- a/sys/netinet/sctp_pcb.h
+++ b/sys/netinet/sctp_pcb.h
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved.
+ * Copyright (c) 2001-2007, Cisco Systems, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -36,36 +36,8 @@ __FBSDID("$FreeBSD$");
 #ifndef __sctp_pcb_h__
 #define __sctp_pcb_h__
 
-
-
-/*
- * We must have V6 so the size of the proto can be calculated. Otherwise we
- * would not allocate enough for Net/Open BSD :-<
- */
-
-#if defined(_KERNEL)
-#include <net/pfil.h>
-#endif
-
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <net/if.h>
-#include <net/if_types.h>
-#include <net/if_var.h>
-#include <net/route.h>
-#include <netinet/in.h>
-#include <netinet/ip6.h>
-#include <netinet6/ip6_var.h>
-#include <netinet6/ip6protosw.h>
-#include <netinet6/in6_var.h>
-#include <netinet6/in6_pcb.h>
-
-#ifndef in6pcb
-#define in6pcb		inpcb
-#endif
-
-#include <netinet/sctp.h>
 #include <netinet/sctp_os.h>
+#include <netinet/sctp.h>
 #include <netinet/sctp_constants.h>
 
 LIST_HEAD(sctppcbhead, sctp_inpcb);
@@ -396,7 +368,6 @@ struct sctp_tcb {
 #include <netinet/sctp_lock_bsd.h>
 
 
-
 #if defined(_KERNEL)
 
 extern struct sctp_epinfo sctppcbinfo;
diff --git a/sys/netinet/sctp_peeloff.c b/sys/netinet/sctp_peeloff.c
index 2589598..d621947 100644
--- a/sys/netinet/sctp_peeloff.c
+++ b/sys/netinet/sctp_peeloff.c
@@ -33,41 +33,6 @@
 
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
-
-#include "opt_ipsec.h"
-#include "opt_inet6.h"
-#include "opt_inet.h"
-
-#include "opt_sctp.h"
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/kernel.h>
-#include <sys/malloc.h>
-#include <sys/mbuf.h>
-#include <sys/domain.h>
-#include <sys/proc.h>
-#include <sys/protosw.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/sysctl.h>
-#include <sys/syslog.h>
-#include <net/if.h>
-#include <net/route.h>
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#ifdef INET6
-#include <netinet/ip6.h>
-#endif
-#include <netinet/in_pcb.h>
-#include <netinet/in_var.h>
-#include <netinet/ip_var.h>
-#ifdef INET6
-#include <netinet6/ip6_var.h>
-#endif
-#include <netinet/ip_icmp.h>
-#include <netinet/icmp_var.h>
 #include <netinet/sctp_os.h>
 #include <netinet/sctp_pcb.h>
 #include <netinet/sctp.h>
@@ -77,11 +42,6 @@ __FBSDID("$FreeBSD$");
 #include <netinet/sctputil.h>
 #include <netinet/sctp_auth.h>
 
-#ifdef IPSEC
-#include <netinet6/ipsec.h>
-#include <netkey/key.h>
-#endif				/* IPSEC */
-
 
 #ifdef SCTP_DEBUG
 extern uint32_t sctp_debug_on;
diff --git a/sys/netinet/sctp_peeloff.h b/sys/netinet/sctp_peeloff.h
index 226b5d6..1f8b55e 100644
--- a/sys/netinet/sctp_peeloff.h
+++ b/sys/netinet/sctp_peeloff.h
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved.
+ * Copyright (c) 2001-2007, Cisco Systems, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -36,10 +36,6 @@ __FBSDID("$FreeBSD$");
 #ifndef __sctp_peeloff_h__
 #define __sctp_peeloff_h__
 
-#include <sys/types.h>
-#include <sys/socketvar.h>
-#include <sys/socket.h>
-
 
 
 
diff --git a/sys/netinet/sctp_structs.h b/sys/netinet/sctp_structs.h
index 8f53fce..d96e7d8 100644
--- a/sys/netinet/sctp_structs.h
+++ b/sys/netinet/sctp_structs.h
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved.
+ * Copyright (c) 2001-2007, Cisco Systems, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -36,14 +36,6 @@ __FBSDID("$FreeBSD$");
 #ifndef __sctp_structs_h__
 #define __sctp_structs_h__
 
-#include <sys/queue.h>
-#include <sys/socket.h>
-
-#ifdef IPSEC
-#include <netinet6/ipsec.h>
-#include <netkey/key.h>
-#endif
-
 #include <netinet/sctp_os.h>
 #include <netinet/sctp_header.h>
 #include <netinet/sctp_uio.h>
diff --git a/sys/netinet/sctp_timer.c b/sys/netinet/sctp_timer.c
index dae2a81..d065dbe 100644
--- a/sys/netinet/sctp_timer.c
+++ b/sys/netinet/sctp_timer.c
@@ -33,56 +33,12 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
-#include "opt_ipsec.h"
-#include "opt_compat.h"
-#include "opt_inet6.h"
-#include "opt_inet.h"
-#include "opt_sctp.h"
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/malloc.h>
-#include <sys/mbuf.h>
-#include <sys/domain.h>
-#include <sys/protosw.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/proc.h>
-#include <sys/kernel.h>
-#include <sys/sysctl.h>
-#ifdef INET6
-#include <sys/domain.h>
-#endif
-
-#include <sys/limits.h>
-
-#include <net/if.h>
-#include <net/if_types.h>
-#include <net/route.h>
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
 #define _IP_VHL
-#include <netinet/ip.h>
-#include <netinet/in_pcb.h>
-#include <netinet/in_var.h>
-#include <netinet/ip_var.h>
-
-#ifdef INET6
-#include <netinet/ip6.h>
-#include <netinet6/ip6_var.h>
-#include <netinet6/scope6_var.h>
-#endif				/* INET6 */
-
+#include <netinet/sctp_os.h>
 #include <netinet/sctp_pcb.h>
-
-#ifdef IPSEC
-#include <netinet6/ipsec.h>
-#include <netkey/key.h>
-#endif				/* IPSEC */
 #ifdef INET6
 #include <netinet6/sctp6_var.h>
 #endif
-#include <netinet/sctp_os.h>
 #include <netinet/sctp_var.h>
 #include <netinet/sctp_timer.h>
 #include <netinet/sctputil.h>
@@ -91,7 +47,6 @@ __FBSDID("$FreeBSD$");
 #include <netinet/sctp_indata.h>
 #include <netinet/sctp_asconf.h>
 #include <netinet/sctp_input.h>
-
 #include <netinet/sctp.h>
 #include <netinet/sctp_uio.h>
 
diff --git a/sys/netinet/sctp_timer.h b/sys/netinet/sctp_timer.h
index 6ce4b89..b8d4a64 100644
--- a/sys/netinet/sctp_timer.h
+++ b/sys/netinet/sctp_timer.h
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved.
+ * Copyright (c) 2001-2007, Cisco Systems, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -35,8 +35,6 @@ __FBSDID("$FreeBSD$");
 #ifndef __sctp_timer_h__
 #define __sctp_timer_h__
 
-
-
 #if defined(_KERNEL)
 
 void
diff --git a/sys/netinet/sctp_usrreq.c b/sys/netinet/sctp_usrreq.c
index c60f4e9..673e13e 100644
--- a/sys/netinet/sctp_usrreq.c
+++ b/sys/netinet/sctp_usrreq.c
@@ -32,44 +32,8 @@
 
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
-
-
-#include "opt_ipsec.h"
-#include "opt_inet6.h"
-#include "opt_inet.h"
-
-#include "opt_sctp.h"
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/kernel.h>
-#include <sys/malloc.h>
-#include <sys/mbuf.h>
-#include <sys/domain.h>
-#include <sys/priv.h>
-#include <sys/proc.h>
-#include <sys/protosw.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/sysctl.h>
-#include <sys/syslog.h>
-#include <net/if.h>
-#include <net/if_types.h>
-#include <net/if_var.h>
-#include <net/route.h>
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/ip6.h>
-#include <netinet/in_pcb.h>
-#include <netinet/in_var.h>
-#include <netinet/ip_var.h>
-#include <netinet6/ip6_var.h>
-#include <netinet6/in6_var.h>
-#include <netinet6/scope6_var.h>
-#include <netinet/ip_icmp.h>
-#include <netinet/icmp_var.h>
 #include <netinet/sctp_os.h>
+#include <sys/proc.h>
 #include <netinet/sctp_pcb.h>
 #include <netinet/sctp_header.h>
 #include <netinet/sctp_var.h>
@@ -83,21 +47,6 @@ __FBSDID("$FreeBSD$");
 #include <netinet/sctp_timer.h>
 #include <netinet/sctp_auth.h>
 
-#ifdef IPSEC
-#include <netinet6/ipsec.h>
-#include <netkey/key.h>
-#endif				/* IPSEC */
-
-
-
-
-#ifndef in6pcb
-#define in6pcb		inpcb
-#endif
-#ifndef sotoin6pcb
-#define sotoin6pcb      sotoinpcb
-#endif
-
 
 
 /*
@@ -436,8 +385,6 @@ sctp_ctlinput(cmd, sa, vip)
 {
 	struct ip *ip = vip;
 	struct sctphdr *sh;
-	int s;
-
 
 	if (sa->sa_family != AF_INET ||
 	    ((struct sockaddr_in *)sa)->sin_addr.s_addr == INADDR_ANY) {
@@ -469,7 +416,6 @@ sctp_ctlinput(cmd, sa, vip)
 		 * 'from' holds our local endpoint address. Thus we reverse
 		 * the to and the from in the lookup.
 		 */
-		s = splnet();
 		stcb = sctp_findassociation_addr_sa((struct sockaddr *)&from,
 		    (struct sockaddr *)&to,
 		    &inp, &net, 1);
@@ -497,7 +443,6 @@ sctp_ctlinput(cmd, sa, vip)
 				SCTP_INP_WUNLOCK(inp);
 			}
 		}
-		splx(s);
 	}
 	return;
 }
@@ -956,14 +901,12 @@ static void
 sctp_abort(struct socket *so)
 {
 	struct sctp_inpcb *inp;
-	int s;
 	uint32_t flags;
 
 	inp = (struct sctp_inpcb *)so->so_pcb;
 	if (inp == 0)
 		return;
 
-	s = splnet();
 sctp_must_try_again:
 	flags = inp->sctp_flags;
 #ifdef SCTP_LOG_CLOSING
@@ -999,7 +942,6 @@ sctp_must_try_again:
 			goto sctp_must_try_again;
 		}
 	}
-	splx(s);
 	return;
 }
 
@@ -1008,26 +950,22 @@ sctp_attach(struct socket *so, int proto, struct thread *p)
 {
 	struct sctp_inpcb *inp;
 	struct inpcb *ip_inp;
-	int s, error;
+	int error;
 
 #ifdef IPSEC
 	uint32_t flags;
 
 #endif
-	s = splnet();
 	inp = (struct sctp_inpcb *)so->so_pcb;
 	if (inp != 0) {
-		splx(s);
 		return EINVAL;
 	}
 	error = soreserve(so, sctp_sendspace, sctp_recvspace);
 	if (error) {
-		splx(s);
 		return error;
 	}
 	error = sctp_inpcb_alloc(so);
 	if (error) {
-		splx(s);
 		return error;
 	}
 	inp = (struct sctp_inpcb *)so->so_pcb;
@@ -1056,7 +994,6 @@ sctp_attach(struct socket *so, int proto, struct thread *p)
 	}
 #endif				/* IPSEC */
 	SCTP_INP_WUNLOCK(inp);
-	splx(s);
 	return 0;
 }
 
@@ -1064,7 +1001,7 @@ static int
 sctp_bind(struct socket *so, struct sockaddr *addr, struct thread *p)
 {
 	struct sctp_inpcb *inp;
-	int s, error;
+	int error;
 
 #ifdef INET6
 	if (addr && addr->sa_family != AF_INET)
@@ -1076,9 +1013,7 @@ sctp_bind(struct socket *so, struct sockaddr *addr, struct thread *p)
 	if (inp == 0)
 		return EINVAL;
 
-	s = splnet();
 	error = sctp_inpcb_bind(so, addr, p);
-	splx(s);
 	return error;
 }
 
@@ -1237,19 +1172,15 @@ static int
 sctp_disconnect(struct socket *so)
 {
 	struct sctp_inpcb *inp;
-	int s;
 
-	s = splnet();
 	inp = (struct sctp_inpcb *)so->so_pcb;
 	if (inp == NULL) {
-		splx(s);
 		return (ENOTCONN);
 	}
 	SCTP_INP_RLOCK(inp);
 	if (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
 		if (LIST_EMPTY(&inp->sctp_asoc_list)) {
 			/* No connection */
-			splx(s);
 			SCTP_INP_RUNLOCK(inp);
 			return (0);
 		} else {
@@ -1258,7 +1189,6 @@ sctp_disconnect(struct socket *so)
 
 			stcb = LIST_FIRST(&inp->sctp_asoc_list);
 			if (stcb == NULL) {
-				splx(s);
 				SCTP_INP_RUNLOCK(inp);
 				return (EINVAL);
 			}
@@ -1301,7 +1231,6 @@ sctp_disconnect(struct socket *so)
 				}
 				sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_3);
 				/* No unlock tcb assoc is gone */
-				splx(s);
 				return (0);
 			}
 			if (TAILQ_EMPTY(&asoc->send_queue) &&
@@ -1391,20 +1320,17 @@ sctp_disconnect(struct socket *so)
 					}
 					SCTP_INP_RUNLOCK(inp);
 					sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_5);
-					splx(s);
 					return (0);
 				}
 			}
 			SCTP_TCB_UNLOCK(stcb);
 			SCTP_INP_RUNLOCK(inp);
-			splx(s);
 			return (0);
 		}
 		/* not reached */
 	} else {
 		/* UDP model does not support this */
 		SCTP_INP_RUNLOCK(inp);
-		splx(s);
 		return EOPNOTSUPP;
 	}
 }
@@ -1413,12 +1339,9 @@ int
 sctp_shutdown(struct socket *so)
 {
 	struct sctp_inpcb *inp;
-	int s;
 
-	s = splnet();
 	inp = (struct sctp_inpcb *)so->so_pcb;
 	if (inp == 0) {
-		splx(s);
 		return EINVAL;
 	}
 	SCTP_INP_RLOCK(inp);
@@ -1427,7 +1350,6 @@ sctp_shutdown(struct socket *so)
 		/* Restore the flags that the soshutdown took away. */
 		so->so_rcv.sb_state &= ~SBS_CANTRCVMORE;
 		/* This proc will wakeup for read and do nothing (I hope) */
-		splx(s);
 		SCTP_INP_RUNLOCK(inp);
 		return (EOPNOTSUPP);
 	}
@@ -1448,7 +1370,6 @@ sctp_shutdown(struct socket *so)
 			 * made after an abort or something. Nothing to do
 			 * now.
 			 */
-			splx(s);
 			return (0);
 		}
 		SCTP_TCB_LOCK(stcb);
@@ -1532,7 +1453,6 @@ sctp_shutdown(struct socket *so)
 	}
 skip_unlock:
 	SCTP_INP_RUNLOCK(inp);
-	splx(s);
 	return 0;
 }
 
@@ -1804,8 +1724,6 @@ sctp_do_connect_x(struct socket *so,
     int delay
 )
 {
-	int s = splnet();
-
 	int error = 0;
 	int creat_lock_on = 0;
 	struct sctp_tcb *stcb = NULL;
@@ -1821,11 +1739,9 @@ sctp_do_connect_x(struct socket *so,
 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
 	    (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED)) {
 		/* We are already connected AND the TCP model */
-		splx(s);
 		return (EADDRINUSE);
 	}
 	if (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) {
-		splx(s);
 		return (EINVAL);
 	}
 	if (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) {
@@ -1834,7 +1750,6 @@ sctp_do_connect_x(struct socket *so,
 		SCTP_INP_RUNLOCK(inp);
 	}
 	if (stcb) {
-		splx(s);
 		return (EALREADY);
 
 	}
@@ -1889,7 +1804,6 @@ sctp_do_connect_x(struct socket *so,
 #ifdef INET6
 	if (((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) &&
 	    (num_v6 > 0)) {
-		splx(s);
 		error = EINVAL;
 		goto out_now;
 	}
@@ -1975,7 +1889,6 @@ out_now:
 	if (creat_lock_on)
 		SCTP_ASOC_CREATE_UNLOCK(inp);
 	SCTP_INP_DECR_REF(inp);
-	splx(s);
 	return error;
 }
 
@@ -3250,8 +3163,9 @@ sctp_optsset(struct socket *so,
     struct thread *p
 )
 {
-	int error, *mopt, set_opt, s;
+	int error, *mopt, set_opt;
 	struct mbuf *m;
+
 	struct sctp_tcb *stcb = NULL;
 	struct sctp_inpcb *inp;
 
@@ -3760,10 +3674,8 @@ sctp_optsset(struct socket *so,
 			    send_out, (stcb->asoc.str_reset_seq_in - 3),
 			    send_in, send_tsn);
 
-			s = splnet();
 			sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_REQ);
 			SCTP_TCB_UNLOCK(stcb);
-			splx(s);
 
 		}
 		break;
@@ -4570,12 +4482,10 @@ sctp_ctloutput(struct socket *so, struct sockopt *sopt)
 {
 	struct mbuf *m = NULL;
 	struct sctp_inpcb *inp;
-	int s, error;
+	int error;
 
 	inp = (struct sctp_inpcb *)so->so_pcb;
-	s = splnet();
 	if (inp == 0) {
-		splx(s);
 		/* I made the same as TCP since we are not setup? */
 		return (ECONNRESET);
 	}
@@ -4587,7 +4497,6 @@ sctp_ctloutput(struct socket *so, struct sockopt *sopt)
 		else
 #endif				/* INET6 */
 			error = ip_ctloutput(so, sopt);
-		splx(s);
 		return (error);
 	}
 	if (sopt->sopt_valsize) {
@@ -4598,7 +4507,6 @@ sctp_ctloutput(struct socket *so, struct sockopt *sopt)
 		}
 		if (m == NULL) {
 			sctp_m_freem(m);
-			splx(s);
 			return (ENOBUFS);
 		}
 		if (sopt->sopt_valsize > M_TRAILINGSPACE(m)) {
@@ -4627,7 +4535,6 @@ sctp_ctloutput(struct socket *so, struct sockopt *sopt)
 		sctp_m_freem(m);
 	}
 out:
-	splx(s);
 	return (error);
 }
 
@@ -4635,8 +4542,6 @@ out:
 static int
 sctp_connect(struct socket *so, struct sockaddr *addr, struct thread *p)
 {
-	int s = splnet();
-
 	int error = 0;
 	int create_lock_on = 0;
 	struct sctp_inpcb *inp;
@@ -4644,7 +4549,6 @@ sctp_connect(struct socket *so, struct sockaddr *addr, struct thread *p)
 
 	inp = (struct sctp_inpcb *)so->so_pcb;
 	if (inp == 0) {
-		splx(s);
 		/* I made the same as TCP since we are not setup? */
 		return (ECONNRESET);
 	}
@@ -4710,7 +4614,6 @@ sctp_connect(struct socket *so, struct sockaddr *addr, struct thread *p)
 	stcb = sctp_aloc_assoc(inp, addr, 1, &error, 0);
 	if (stcb == NULL) {
 		/* Gak! no memory */
-		splx(s);
 		return (error);
 	}
 	if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
@@ -4732,7 +4635,6 @@ out_now:
 	if (stcb)
 		SCTP_TCB_UNLOCK(stcb);
 	SCTP_INP_DECR_REF(inp);
-	splx(s);
 	return error;
 }
 
@@ -4747,14 +4649,12 @@ sctp_listen(struct socket *so, int backlog, struct thread *p)
 	 * sys/kern/uipc_socket.c module to reverse this but this MUST be in
 	 * place if the socket API for SCTP is to work properly.
 	 */
-	int s = splnet();
 
 	int error = 0;
 	struct sctp_inpcb *inp;
 
 	inp = (struct sctp_inpcb *)so->so_pcb;
 	if (inp == 0) {
-		splx(s);
 		/* I made the same as TCP since we are not setup? */
 		return (ECONNRESET);
 	}
@@ -4771,7 +4671,6 @@ sctp_listen(struct socket *so, int backlog, struct thread *p)
 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
 	    (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED)) {
 		/* We are already connected AND the TCP model */
-		splx(s);
 		SCTP_INP_RUNLOCK(inp);
 		SOCK_UNLOCK(so);
 		return (EADDRINUSE);
@@ -4782,7 +4681,6 @@ sctp_listen(struct socket *so, int backlog, struct thread *p)
 		if ((error = sctp_inpcb_bind(so, NULL, p))) {
 			/* bind error, probably perm */
 			SOCK_UNLOCK(so);
-			splx(s);
 			return (error);
 		}
 	} else {
@@ -4800,7 +4698,6 @@ sctp_listen(struct socket *so, int backlog, struct thread *p)
 		so->so_options &= ~SO_ACCEPTCONN;
 	}
 	SOCK_UNLOCK(so);
-	splx(s);
 	return (error);
 }
 
@@ -4809,8 +4706,6 @@ static int sctp_defered_wakeup_cnt = 0;
 int
 sctp_accept(struct socket *so, struct sockaddr **addr)
 {
-	int s = splnet();
-
 	struct sctp_tcb *stcb;
 	struct sctp_inpcb *inp;
 	union sctp_sockstore store;
@@ -4821,7 +4716,6 @@ sctp_accept(struct socket *so, struct sockaddr **addr)
 	inp = (struct sctp_inpcb *)so->so_pcb;
 
 	if (inp == 0) {
-		splx(s);
 		return (ECONNRESET);
 	}
 	SCTP_INP_RLOCK(inp);
@@ -4829,13 +4723,11 @@ sctp_accept(struct socket *so, struct sockaddr **addr)
 		return (ENOTSUP);
 	}
 	if (so->so_state & SS_ISDISCONNECTED) {
-		splx(s);
 		SCTP_INP_RUNLOCK(inp);
 		return (ECONNABORTED);
 	}
 	stcb = LIST_FIRST(&inp->sctp_asoc_list);
 	if (stcb == NULL) {
-		splx(s);
 		SCTP_INP_RUNLOCK(inp);
 		return (ECONNRESET);
 	}
@@ -4869,18 +4761,22 @@ sctp_accept(struct socket *so, struct sockaddr **addr)
 	}
 	/* Wake any delayed sleep action */
 	if (inp->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE) {
+		SCTP_INP_WLOCK(inp);
 		inp->sctp_flags &= ~SCTP_PCB_FLAGS_DONT_WAKE;
 		if (inp->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT) {
 			inp->sctp_flags &= ~SCTP_PCB_FLAGS_WAKEOUTPUT;
+			SCTP_INP_WUNLOCK(inp);
 			SOCKBUF_LOCK(&inp->sctp_socket->so_snd);
 			if (sowriteable(inp->sctp_socket)) {
 				sowwakeup_locked(inp->sctp_socket);
 			} else {
 				SOCKBUF_UNLOCK(&inp->sctp_socket->so_snd);
 			}
+			SCTP_INP_WLOCK(inp);
 		}
 		if (inp->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT) {
 			inp->sctp_flags &= ~SCTP_PCB_FLAGS_WAKEINPUT;
+			SCTP_INP_WUNLOCK(inp);
 			SOCKBUF_LOCK(&inp->sctp_socket->so_rcv);
 			if (soreadable(inp->sctp_socket)) {
 				sctp_defered_wakeup_cnt++;
@@ -4888,9 +4784,10 @@ sctp_accept(struct socket *so, struct sockaddr **addr)
 			} else {
 				SOCKBUF_UNLOCK(&inp->sctp_socket->so_rcv);
 			}
+			SCTP_INP_WLOCK(inp);
 		}
+		SCTP_INP_WUNLOCK(inp);
 	}
-	splx(s);
 	return (0);
 }
 
@@ -4899,7 +4796,6 @@ sctp_ingetaddr(struct socket *so, struct sockaddr **addr)
 {
 	struct sockaddr_in *sin;
 
-	int s;
 	struct sctp_inpcb *inp;
 
 	/*
@@ -4908,10 +4804,8 @@ sctp_ingetaddr(struct socket *so, struct sockaddr **addr)
 	SCTP_MALLOC_SONAME(sin, struct sockaddr_in *, sizeof *sin);
 	sin->sin_family = AF_INET;
 	sin->sin_len = sizeof(*sin);
-	s = splnet();
 	inp = (struct sctp_inpcb *)so->so_pcb;
 	if (!inp) {
-		splx(s);
 		SCTP_FREE_SONAME(sin);
 		return ECONNRESET;
 	}
@@ -4972,14 +4866,12 @@ sctp_ingetaddr(struct socket *so, struct sockaddr **addr)
 			}
 		}
 		if (!fnd) {
-			splx(s);
 			SCTP_FREE_SONAME(sin);
 			SCTP_INP_RUNLOCK(inp);
 			return ENOENT;
 		}
 	}
 	SCTP_INP_RUNLOCK(inp);
-	splx(s);
 	(*addr) = (struct sockaddr *)sin;
 	return (0);
 }
@@ -4989,7 +4881,7 @@ sctp_peeraddr(struct socket *so, struct sockaddr **addr)
 {
 	struct sockaddr_in *sin = (struct sockaddr_in *)*addr;
 
-	int s, fnd;
+	int fnd;
 	struct sockaddr_in *sin_a;
 	struct sctp_inpcb *inp;
 	struct sctp_tcb *stcb;
@@ -5003,8 +4895,6 @@ sctp_peeraddr(struct socket *so, struct sockaddr **addr)
 		/* UDP type and listeners will drop out here */
 		return (ENOTCONN);
 	}
-	s = splnet();
-
 	SCTP_MALLOC_SONAME(sin, struct sockaddr_in *, sizeof *sin);
 	sin->sin_family = AF_INET;
 	sin->sin_len = sizeof(*sin);
@@ -5012,7 +4902,6 @@ sctp_peeraddr(struct socket *so, struct sockaddr **addr)
 	/* We must recapture incase we blocked */
 	inp = (struct sctp_inpcb *)so->so_pcb;
 	if (!inp) {
-		splx(s);
 		SCTP_FREE_SONAME(sin);
 		return ECONNRESET;
 	}
@@ -5022,7 +4911,6 @@ sctp_peeraddr(struct socket *so, struct sockaddr **addr)
 		SCTP_TCB_LOCK(stcb);
 	SCTP_INP_RUNLOCK(inp);
 	if (stcb == NULL) {
-		splx(s);
 		SCTP_FREE_SONAME(sin);
 		return ECONNRESET;
 	}
@@ -5039,11 +4927,9 @@ sctp_peeraddr(struct socket *so, struct sockaddr **addr)
 	SCTP_TCB_UNLOCK(stcb);
 	if (!fnd) {
 		/* No IPv4 address */
-		splx(s);
 		SCTP_FREE_SONAME(sin);
 		return ENOENT;
 	}
-	splx(s);
 	(*addr) = (struct sockaddr *)sin;
 	return (0);
 }
diff --git a/sys/netinet/sctp_var.h b/sys/netinet/sctp_var.h
index b2daa85..8cfe411 100644
--- a/sys/netinet/sctp_var.h
+++ b/sys/netinet/sctp_var.h
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved.
+ * Copyright (c) 2001-2007, Cisco Systems, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -216,7 +216,6 @@ __FBSDID("$FreeBSD$");
 #endif
 
 
-
 #if defined(_KERNEL)
 
 #ifdef SYSCTL_DECL
diff --git a/sys/netinet/sctputil.c b/sys/netinet/sctputil.c
index 6867347..bbefbb6 100644
--- a/sys/netinet/sctputil.c
+++ b/sys/netinet/sctputil.c
@@ -33,72 +33,6 @@
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
 
-
-#include "opt_ipsec.h"
-#include "opt_compat.h"
-#include "opt_inet6.h"
-#include "opt_inet.h"
-#include "opt_sctp.h"
-
-#include <sys/param.h>
-#include <sys/systm.h>
-#include <sys/fcntl.h>
-#include <sys/lock.h>
-#include <sys/malloc.h>
-#include <sys/mbuf.h>
-#include <sys/domain.h>
-#include <sys/file.h>		/* for struct knote */
-#include <sys/kernel.h>
-#include <sys/event.h>
-#include <sys/poll.h>
-
-#include <sys/protosw.h>
-#include <sys/socket.h>
-#include <sys/socketvar.h>
-#include <sys/proc.h>
-#include <sys/kernel.h>
-#include <sys/resourcevar.h>
-#include <sys/signalvar.h>
-#include <sys/sysctl.h>
-#include <sys/uio.h>
-#include <sys/jail.h>
-
-#include <net/radix.h>
-#include <net/route.h>
-
-#ifdef INET6
-#include <sys/domain.h>
-#endif
-
-#include <sys/limits.h>
-#include <sys/mac.h>
-#include <sys/mutex.h>
-
-#include <net/if.h>
-#include <net/if_types.h>
-#include <net/route.h>
-
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/in_pcb.h>
-#include <netinet/in_var.h>
-#include <netinet/ip_var.h>
-
-#ifdef INET6
-#include <netinet/ip6.h>
-#include <netinet6/ip6_var.h>
-
-#include <netinet6/in6_pcb.h>
-
-#include <netinet6/scope6_var.h>
-#endif				/* INET6 */
-
-#ifdef IPSEC
-#include <netinet6/ipsec.h>
-#include <netkey/key.h>
-#endif				/* IPSEC */
-
 #include <netinet/sctp_os.h>
 #include <netinet/sctp_pcb.h>
 #include <netinet/sctputil.h>
@@ -826,16 +760,13 @@ sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 void
 sctp_audit_log(uint8_t ev, uint8_t fd)
 {
-	int s;
 
-	s = splnet();
 	sctp_audit_data[sctp_audit_indx][0] = ev;
 	sctp_audit_data[sctp_audit_indx][1] = fd;
 	sctp_audit_indx++;
 	if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 		sctp_audit_indx = 0;
 	}
-	splx(s);
 }
 
 #endif
@@ -1239,11 +1170,10 @@ sctp_timeout_handler(void *t)
 	struct sctp_tcb *stcb;
 	struct sctp_nets *net;
 	struct sctp_timer *tmr;
-	int s, did_output;
+	int did_output;
 	struct sctp_iterator *it = NULL;
 
 
-	s = splnet();
 	tmr = (struct sctp_timer *)t;
 	inp = (struct sctp_inpcb *)tmr->ep;
 	stcb = (struct sctp_tcb *)tmr->tcb;
@@ -1261,7 +1191,6 @@ sctp_timeout_handler(void *t)
 		 * printf("Stale SCTP timer fired (%p), ignoring...\n",
 		 * tmr);
 		 */
-		splx(s);
 		return;
 	}
 	tmr->stopped_from = 0xa001;
@@ -1270,12 +1199,10 @@ sctp_timeout_handler(void *t)
 		 * printf("SCTP timer fired with invalid type: 0x%x\n",
 		 * tmr->type);
 		 */
-		splx(s);
 		return;
 	}
 	tmr->stopped_from = 0xa002;
 	if ((tmr->type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL)) {
-		splx(s);
 		return;
 	}
 	/* if this is an iterator timeout, get the struct and clear inp */
@@ -1293,7 +1220,6 @@ sctp_timeout_handler(void *t)
 		    (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNGUARD) &&
 		    (tmr->type != SCTP_TIMER_TYPE_ASOCKILL))
 		    ) {
-			splx(s);
 			SCTP_INP_DECR_REF(inp);
 			return;
 		}
@@ -1301,7 +1227,6 @@ sctp_timeout_handler(void *t)
 	tmr->stopped_from = 0xa004;
 	if (stcb) {
 		if (stcb->asoc.state == 0) {
-			splx(s);
 			if (inp) {
 				SCTP_INP_DECR_REF(inp);
 			}
@@ -1315,7 +1240,6 @@ sctp_timeout_handler(void *t)
 	}
 #endif				/* SCTP_DEBUG */
 	if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
-		splx(s);
 		if (inp) {
 			SCTP_INP_DECR_REF(inp);
 		}
@@ -1599,7 +1523,6 @@ out_no_decr:
 		printf("Timer now complete (type %d)\n", tmr->type);
 	}
 #endif				/* SCTP_DEBUG */
-	splx(s);
 	if (inp) {
 	}
 }
@@ -3278,6 +3201,7 @@ sctp_report_all_outbound(struct sctp_tcb *stcb, int holds_lock)
 		chk = TAILQ_FIRST(&asoc->send_queue);
 		while (chk) {
 			TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
+			asoc->send_queue_cnt--;
 			if (chk->data) {
 				/*
 				 * trim off the sctp chunk header(it should
@@ -3306,6 +3230,7 @@ sctp_report_all_outbound(struct sctp_tcb *stcb, int holds_lock)
 		chk = TAILQ_FIRST(&asoc->sent_queue);
 		while (chk) {
 			TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
+			asoc->sent_queue_cnt--;
 			if (chk->data) {
 				/*
 				 * trim off the sctp chunk header(it should
@@ -4252,7 +4177,7 @@ sctp_sorecvmsg(struct socket *so,
 	int block_allowed = 1;
 	int freed_so_far = 0;
 	int copied_so_far = 0;
-	int s, in_eeor_mode = 0;
+	int in_eeor_mode = 0;
 	int no_rcv_needed = 0;
 	uint32_t rwnd_req = 0;
 	int hold_sblock = 0;
@@ -4285,7 +4210,6 @@ sctp_sorecvmsg(struct socket *so,
 	if (inp == NULL) {
 		return (EFAULT);
 	}
-	s = splnet();
 	rwnd_req = (so->so_rcv.sb_hiwat >> SCTP_RWND_HIWAT_SHIFT);
 	/* Must be at least a MTU's worth */
 	if (rwnd_req < SCTP_MIN_RWND)
@@ -4678,10 +4602,8 @@ get_more_data:
 				SCTP_INP_READ_UNLOCK(inp);
 				hold_rlock = 0;
 			}
-			splx(s);
 			if (cp_len > 0)
 				error = uiomove(mtod(m, char *), cp_len, uio);
-			s = splnet();
 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
 			sctp_misc_ints(SCTP_SORCV_DOESCPY,
 			    so->so_rcv.sb_cc,
@@ -5174,11 +5096,9 @@ get_more_data2:
 						SOCKBUF_UNLOCK(&so->so_rcv);
 						hold_sblock = 0;
 					}
-					splx(s);
 					*mp = SCTP_M_COPYM(m, 0, cp_len,
 					    M_TRYWAIT
 					    );
-					s = splnet();
 #ifdef SCTP_LOCK_LOGGING
 					sctp_log_lock(inp, stcb, SCTP_LOG_LOCK_SOCKBUF_R);
 #endif
@@ -5264,7 +5184,6 @@ out:
 		/* Save the value back for next time */
 		stcb->freed_by_sorcv_sincelast = freed_so_far;
 	}
-	splx(s);
 #ifdef SCTP_RECV_RWND_LOGGING
 	if (stcb) {
 		sctp_misc_ints(SCTP_SORECV_DONE,
diff --git a/sys/netinet/sctputil.h b/sys/netinet/sctputil.h
index e43df07..b6dd2b4 100644
--- a/sys/netinet/sctputil.h
+++ b/sys/netinet/sctputil.h
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved.
+ * Copyright (c) 2001-2007, Cisco Systems, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met:
@@ -37,7 +37,6 @@ __FBSDID("$FreeBSD$");
 #define __sctputil_h__
 
 
-
 #if defined(_KERNEL)
 
 #ifdef SCTP_MBUF_LOGGING
diff --git a/sys/netinet6/sctp6_usrreq.c b/sys/netinet6/sctp6_usrreq.c
index 4d16816..d7c3a3e 100644
--- a/sys/netinet6/sctp6_usrreq.c
+++ b/sys/netinet6/sctp6_usrreq.c
@@ -30,83 +30,34 @@
 /*	$KAME: sctp6_usrreq.c,v 1.38 2005/08/24 08:08:56 suz Exp $	*/
 #include <sys/cdefs.h>
 __FBSDID("$FreeBSD$");
-#include "opt_inet.h"
-#include "opt_inet6.h"
-#include "opt_inet.h"
-#include "opt_ipsec.h"
-#include "opt_sctp.h"
-
-#include <sys/param.h>
-#include <sys/kernel.h>
-#include <sys/mbuf.h>
-#include <sys/domain.h>
-#include <sys/protosw.h>
-#include <sys/socket.h>
-#include <sys/malloc.h>
-#include <sys/socketvar.h>
-#include <sys/sysctl.h>
-#include <sys/errno.h>
-#include <sys/stat.h>
-#include <sys/systm.h>
-#include <sys/syslog.h>
-#include <sys/priv.h>
-#include <sys/proc.h>
-#include <net/if.h>
-#include <net/route.h>
-#include <net/if_types.h>
-#include <netinet/in.h>
-#include <netinet/in_systm.h>
-#include <netinet/ip.h>
-#include <netinet/in_pcb.h>
-#include <netinet/in_var.h>
-#include <netinet/ip_var.h>
+
 #include <netinet/sctp_os.h>
+#include <sys/proc.h>
 #include <netinet/sctp_pcb.h>
 #include <netinet/sctp_header.h>
 #include <netinet/sctp_var.h>
-#include <netinet/sctputil.h>
 #include <netinet/sctp_output.h>
-#include <netinet/sctp_bsd_addr.h>
 #include <netinet/sctp_input.h>
-#include <netinet/sctp_asconf.h>
-#include <netinet6/ip6_var.h>
-#include <netinet6/scope6_var.h>
 #include <netinet/sctp_bsd_addr.h>
-#include <netinet/ip6.h>
-#include <netinet6/in6_pcb.h>
-#include <netinet/icmp6.h>
+#include <netinet/sctp_uio.h>
+#include <netinet/sctp_asconf.h>
+#include <netinet/sctputil.h>
+#include <netinet/sctp_indata.h>
+#include <netinet/sctp_asconf.h>
+#include <netinet/sctp_timer.h>
+#include <netinet/sctp_auth.h>
 #include <netinet6/sctp6_var.h>
-#include <netinet6/ip6protosw.h>
-#include <netinet6/nd6.h>
 
-#ifdef IPSEC
-#include <netinet6/ipsec.h>
-#include <netinet6/ipsec6.h>
-#endif				/* IPSEC */
 
-#if defined(NFAITH) && NFAITH > 0
-#include <net/if_faith.h>
-#endif
 
+#ifdef SCTP_DEBUG
+extern uint32_t sctp_debug_on;
 
+#endif				/* SCTP_DEBUG */
 
 extern struct protosw inetsw[];
 
 
-#ifndef in6pcb
-#define in6pcb		inpcb
-#endif
-#ifndef sotoin6pcb
-#define sotoin6pcb      sotoinpcb
-#endif
-
-
-#ifdef SCTP_DEBUG
-extern u_int32_t sctp_debug_on;
-
-#endif
-
-
 
 extern int sctp_no_csum_on_loopback;
 
@@ -131,7 +82,6 @@ sctp6_input(mp, offp, proto)
 	u_int8_t ecn_bits;
 	struct sctp_tcb *stcb = NULL;
 	int off = *offp;
-	int s;
 
 	m = SCTP_HEADER_TO_CHAIN(*mp);
 
@@ -275,11 +225,9 @@ sctp_skip_csum:
 	/* Length now holds the total packet length payload + iphlen */
 	length = ntohs(ip6->ip6_plen) + iphlen;
 
-	s = splnet();
 	(void)sctp_common_input_processing(&m, iphlen, offset, length, sh, ch,
 	    in6p, stcb, net, ecn_bits);
 	/* inp's ref-count reduced && stcb unlocked */
-	splx(s);
 	/* XXX this stuff below gets moved to appropriate parts later... */
 	if (m)
 		m_freem(m);
@@ -391,7 +339,7 @@ sctp6_ctlinput(cmd, pktdst, d)
 {
 	struct sctphdr sh;
 	struct ip6ctlparam *ip6cp = NULL;
-	int s, cm;
+	int cm;
 
 	if (pktdst->sa_family != AF_INET6 ||
 	    pktdst->sa_len != sizeof(struct sockaddr_in6))
@@ -436,7 +384,6 @@ sctp6_ctlinput(cmd, pktdst, d)
 		final.sin6_family = AF_INET6;
 		final.sin6_addr = ((struct sockaddr_in6 *)pktdst)->sin6_addr;
 		final.sin6_port = sh.dest_port;
-		s = splnet();
 		stcb = sctp_findassociation_addr_sa((struct sockaddr *)ip6cp->ip6c_src,
 		    (struct sockaddr *)&final,
 		    &inp, &net, 1);
@@ -474,7 +421,6 @@ sctp6_ctlinput(cmd, pktdst, d)
 			if (stcb)
 				SCTP_TCB_UNLOCK(stcb);
 		}
-		splx(s);
 	}
 }
 
@@ -554,13 +500,11 @@ static void
 sctp6_abort(struct socket *so)
 {
 	struct sctp_inpcb *inp;
-	int s;
 	uint32_t flags;
 
 	inp = (struct sctp_inpcb *)so->so_pcb;
 	if (inp == 0)
 		return;
-	s = splnet();
 sctp_must_try_again:
 	flags = inp->sctp_flags;
 #ifdef SCTP_LOG_CLOSING
@@ -595,7 +539,6 @@ sctp_must_try_again:
 			goto sctp_must_try_again;
 		}
 	}
-	splx(s);
 	return;
 }
 
@@ -603,7 +546,7 @@ static int
 sctp6_attach(struct socket *so, int proto, struct thread *p)
 {
 	struct in6pcb *inp6;
-	int s, error;
+	int error;
 	struct sctp_inpcb *inp;
 
 	inp = (struct sctp_inpcb *)so->so_pcb;
@@ -615,9 +558,7 @@ sctp6_attach(struct socket *so, int proto, struct thread *p)
 		if (error)
 			return error;
 	}
-	s = splnet();
 	error = sctp_inpcb_alloc(so);
-	splx(s);
 	if (error)
 		return error;
 	inp = (struct sctp_inpcb *)so->so_pcb;
@@ -647,7 +588,7 @@ sctp6_bind(struct socket *so, struct sockaddr *addr, struct thread *p)
 {
 	struct sctp_inpcb *inp;
 	struct in6pcb *inp6;
-	int s, error;
+	int error;
 
 	inp = (struct sctp_inpcb *)so->so_pcb;
 	if (inp == 0)
@@ -674,9 +615,7 @@ sctp6_bind(struct socket *so, struct sockaddr *addr, struct thread *p)
 				in6_sin6_2_sin(&sin, sin6_p);
 				inp6->inp_vflag |= INP_IPV4;
 				inp6->inp_vflag &= ~INP_IPV6;
-				s = splnet();
 				error = sctp_inpcb_bind(so, (struct sockaddr *)&sin, p);
-				splx(s);
 				return error;
 			}
 		}
@@ -696,9 +635,7 @@ sctp6_bind(struct socket *so, struct sockaddr *addr, struct thread *p)
 				return EINVAL;
 		}
 	}
-	s = splnet();
 	error = sctp_inpcb_bind(so, addr, p);
-	splx(s);
 	return error;
 }
 
@@ -771,19 +708,15 @@ static int
 sctp6_disconnect(struct socket *so)
 {
 	struct sctp_inpcb *inp;
-	int s;
 
-	s = splnet();		/* XXX */
 	inp = (struct sctp_inpcb *)so->so_pcb;
 	if (inp == NULL) {
-		splx(s);
 		return (ENOTCONN);
 	}
 	SCTP_INP_RLOCK(inp);
 	if (inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
 		if (LIST_EMPTY(&inp->sctp_asoc_list)) {
 			/* No connection */
-			splx(s);
 			SCTP_INP_RUNLOCK(inp);
 			return (ENOTCONN);
 		} else {
@@ -793,7 +726,6 @@ sctp6_disconnect(struct socket *so)
 
 			stcb = LIST_FIRST(&inp->sctp_asoc_list);
 			if (stcb == NULL) {
-				splx(s);
 				SCTP_INP_RUNLOCK(inp);
 				return (EINVAL);
 			}
@@ -832,7 +764,6 @@ sctp6_disconnect(struct socket *so)
 				sctp_free_assoc(inp, stcb, SCTP_DONOT_SETSCOPE,
 				    SCTP_FROM_SCTP6_USRREQ + SCTP_LOC_2);
 				/* No unlock tcb assoc is gone */
-				splx(s);
 				return (0);
 			}
 			if (!TAILQ_EMPTY(&asoc->out_wheel)) {
@@ -882,13 +813,11 @@ sctp6_disconnect(struct socket *so)
 			}
 			SCTP_TCB_UNLOCK(stcb);
 			SCTP_INP_RUNLOCK(inp);
-			splx(s);
 			return (0);
 		}
 	} else {
 		/* UDP model does not support this */
 		SCTP_INP_RUNLOCK(inp);
-		splx(s);
 		return EOPNOTSUPP;
 	}
 }
@@ -1010,8 +939,6 @@ connected_type:
 static int
 sctp6_connect(struct socket *so, struct sockaddr *addr, struct thread *p)
 {
-	int s = splnet();
-
 	int error = 0;
 	struct sctp_inpcb *inp;
 	struct in6pcb *inp6;
@@ -1026,7 +953,6 @@ sctp6_connect(struct socket *so, struct sockaddr *addr, struct thread *p)
 	inp6 = (struct in6pcb *)so->so_pcb;
 	inp = (struct sctp_inpcb *)so->so_pcb;
 	if (inp == 0) {
-		splx(s);
 		return (ECONNRESET);	/* I made the same as TCP since we are
 					 * not setup? */
 	}
@@ -1038,7 +964,6 @@ sctp6_connect(struct socket *so, struct sockaddr *addr, struct thread *p)
 		SCTP_INP_RUNLOCK(inp);
 		error = sctp6_bind(so, NULL, p);
 		if (error) {
-			splx(s);
 			SCTP_ASOC_CREATE_UNLOCK(inp);
 
 			return (error);
@@ -1048,7 +973,6 @@ sctp6_connect(struct socket *so, struct sockaddr *addr, struct thread *p)
 	if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
 	    (inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED)) {
 		/* We are already connected AND the TCP model */
-		splx(s);
 		SCTP_INP_RUNLOCK(inp);
 		SCTP_ASOC_CREATE_UNLOCK(inp);
 		return (EADDRINUSE);
@@ -1061,13 +985,11 @@ sctp6_connect(struct socket *so, struct sockaddr *addr, struct thread *p)
 		 * addr or v4-mapped addr
 		 */
 		if (addr->sa_family == AF_INET) {
-			splx(s);
 			SCTP_INP_RUNLOCK(inp);
 			SCTP_ASOC_CREATE_UNLOCK(inp);
 			return EINVAL;
 		}
 		if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
-			splx(s);
 			SCTP_INP_RUNLOCK(inp);
 			SCTP_ASOC_CREATE_UNLOCK(inp);
 			return EINVAL;
@@ -1080,7 +1002,6 @@ sctp6_connect(struct socket *so, struct sockaddr *addr, struct thread *p)
 			addr = (struct sockaddr *)&ss;
 		} else {
 			/* mapped addresses aren't enabled */
-			splx(s);
 			SCTP_INP_RUNLOCK(inp);
 			SCTP_ASOC_CREATE_UNLOCK(inp);
 			return EINVAL;
@@ -1112,7 +1033,6 @@ sctp6_connect(struct socket *so, struct sockaddr *addr, struct thread *p)
 		/* Already have or am bring up an association */
 		SCTP_ASOC_CREATE_UNLOCK(inp);
 		SCTP_TCB_UNLOCK(stcb);
-		splx(s);
 		return (EALREADY);
 	}
 	/* We are GOOD to go */
@@ -1120,7 +1040,6 @@ sctp6_connect(struct socket *so, struct sockaddr *addr, struct thread *p)
 	SCTP_ASOC_CREATE_UNLOCK(inp);
 	if (stcb == NULL) {
 		/* Gak! no memory */
-		splx(s);
 		return (error);
 	}
 	if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) {
@@ -1136,7 +1055,6 @@ sctp6_connect(struct socket *so, struct sockaddr *addr, struct thread *p)
 
 	sctp_send_initiate(inp, stcb);
 	SCTP_TCB_UNLOCK(stcb);
-	splx(s);
 	return error;
 }
 
@@ -1301,19 +1219,17 @@ sctp6_in6getaddr(struct socket *so, struct sockaddr **nam)
 	struct sockaddr *addr;
 
 	struct in6pcb *inp6 = sotoin6pcb(so);
-	int error, s;
+	int error;
 
 	if (inp6 == NULL)
 		return EINVAL;
 
-	s = splnet();
 	/* allow v6 addresses precedence */
 	error = sctp6_getaddr(so, nam);
 	if (error) {
 		/* try v4 next if v6 failed */
 		error = sctp_ingetaddr(so, nam);
 		if (error) {
-			splx(s);
 			return (error);
 		}
 		addr = *nam;
@@ -1325,7 +1241,6 @@ sctp6_in6getaddr(struct socket *so, struct sockaddr **nam)
 			memcpy(addr, &sin6, sizeof(struct sockaddr_in6));
 		}
 	}
-	splx(s);
 	return (error);
 }
 
@@ -1336,19 +1251,17 @@ sctp6_getpeeraddr(struct socket *so, struct sockaddr **nam)
 	struct sockaddr *addr = *nam;
 
 	struct in6pcb *inp6 = sotoin6pcb(so);
-	int error, s;
+	int error;
 
 	if (inp6 == NULL)
 		return EINVAL;
 
-	s = splnet();
 	/* allow v6 addresses precedence */
 	error = sctp6_peeraddr(so, nam);
 	if (error) {
 		/* try v4 next if v6 failed */
 		error = sctp_peeraddr(so, nam);
 		if (error) {
-			splx(s);
 			return (error);
 		}
 		/* if I'm V6ONLY, convert it to v4-mapped */
@@ -1359,7 +1272,6 @@ sctp6_getpeeraddr(struct socket *so, struct sockaddr **nam)
 			memcpy(addr, &sin6, sizeof(struct sockaddr_in6));
 		}
 	}
-	splx(s);
 	return error;
 }
 
diff --git a/sys/netinet6/sctp6_var.h b/sys/netinet6/sctp6_var.h
index 454a414..0599070 100644
--- a/sys/netinet6/sctp6_var.h
+++ b/sys/netinet6/sctp6_var.h
@@ -1,5 +1,5 @@
 /*-
- * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved.
+ * Copyright (c) 2001-2007, Cisco Systems, Inc. All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions are met: