sys/netinet/sctputil.c

   1 /*-
   2  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_pcb.h>
  38 #include <netinet/sctputil.h>
  39 #include <netinet/sctp_var.h>
  40 #include <netinet/sctp_sysctl.h>
  41 #ifdef INET6
  42 #include <netinet6/sctp6_var.h>
  43 #endif
  44 #include <netinet/sctp_header.h>
  45 #include <netinet/sctp_output.h>
  46 #include <netinet/sctp_uio.h>
  47 #include <netinet/sctp_timer.h>
  48 #include <netinet/sctp_indata.h>/* for sctp_deliver_data() */
  49 #include <netinet/sctp_auth.h>
  50 #include <netinet/sctp_asconf.h>
  51 #include <netinet/sctp_bsd_addr.h>
  52 #if defined(INET6) || defined(INET)
  53 #include <netinet/tcp_var.h>
  54 #endif
  55 #include <netinet/udp.h>
  56 #include <netinet/udp_var.h>
  57 #include <sys/proc.h>
  58 #ifdef INET6
  59 #include <netinet/icmp6.h>
  60 #endif
  61
  62
  63 #ifndef KTR_SCTP
  64 #define KTR_SCTP KTR_SUBSYS
  65 #endif
  66
  67 extern const struct sctp_cc_functions sctp_cc_functions[];
  68 extern const struct sctp_ss_functions sctp_ss_functions[];
  69
  70 void
  71 sctp_sblog(struct sockbuf *sb, struct sctp_tcb *stcb, int from, int incr)
  72 {
  73         struct sctp_cwnd_log sctp_clog;
  74
  75         sctp_clog.x.sb.stcb = stcb;
  76         sctp_clog.x.sb.so_sbcc = sb->sb_cc;
  77         if (stcb)
  78                 sctp_clog.x.sb.stcb_sbcc = stcb->asoc.sb_cc;
  79         else
  80                 sctp_clog.x.sb.stcb_sbcc = 0;
  81         sctp_clog.x.sb.incr = incr;
  82         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
  83             SCTP_LOG_EVENT_SB,
  84             from,
  85             sctp_clog.x.misc.log1,
  86             sctp_clog.x.misc.log2,
  87             sctp_clog.x.misc.log3,
  88             sctp_clog.x.misc.log4);
  89 }
  90
  91 void
  92 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc)
  93 {
  94         struct sctp_cwnd_log sctp_clog;
  95
  96         sctp_clog.x.close.inp = (void *)inp;
  97         sctp_clog.x.close.sctp_flags = inp->sctp_flags;
  98         if (stcb) {
  99                 sctp_clog.x.close.stcb = (void *)stcb;
 100                 sctp_clog.x.close.state = (uint16_t)stcb->asoc.state;
 101         } else {
 102                 sctp_clog.x.close.stcb = 0;
 103                 sctp_clog.x.close.state = 0;
 104         }
 105         sctp_clog.x.close.loc = loc;
 106         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 107             SCTP_LOG_EVENT_CLOSE,
 108             0,
 109             sctp_clog.x.misc.log1,
 110             sctp_clog.x.misc.log2,
 111             sctp_clog.x.misc.log3,
 112             sctp_clog.x.misc.log4);
 113 }
 114
 115 void
 116 rto_logging(struct sctp_nets *net, int from)
 117 {
 118         struct sctp_cwnd_log sctp_clog;
 119
 120         memset(&sctp_clog, 0, sizeof(sctp_clog));
 121         sctp_clog.x.rto.net = (void *)net;
 122         sctp_clog.x.rto.rtt = net->rtt / 1000;
 123         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 124             SCTP_LOG_EVENT_RTT,
 125             from,
 126             sctp_clog.x.misc.log1,
 127             sctp_clog.x.misc.log2,
 128             sctp_clog.x.misc.log3,
 129             sctp_clog.x.misc.log4);
 130 }
 131
 132 void
 133 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from)
 134 {
 135         struct sctp_cwnd_log sctp_clog;
 136
 137         sctp_clog.x.strlog.stcb = stcb;
 138         sctp_clog.x.strlog.n_tsn = tsn;
 139         sctp_clog.x.strlog.n_sseq = sseq;
 140         sctp_clog.x.strlog.e_tsn = 0;
 141         sctp_clog.x.strlog.e_sseq = 0;
 142         sctp_clog.x.strlog.strm = stream;
 143         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 144             SCTP_LOG_EVENT_STRM,
 145             from,
 146             sctp_clog.x.misc.log1,
 147             sctp_clog.x.misc.log2,
 148             sctp_clog.x.misc.log3,
 149             sctp_clog.x.misc.log4);
 150 }
 151
 152 void
 153 sctp_log_nagle_event(struct sctp_tcb *stcb, int action)
 154 {
 155         struct sctp_cwnd_log sctp_clog;
 156
 157         sctp_clog.x.nagle.stcb = (void *)stcb;
 158         sctp_clog.x.nagle.total_flight = stcb->asoc.total_flight;
 159         sctp_clog.x.nagle.total_in_queue = stcb->asoc.total_output_queue_size;
 160         sctp_clog.x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue;
 161         sctp_clog.x.nagle.count_in_flight = stcb->asoc.total_flight_count;
 162         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 163             SCTP_LOG_EVENT_NAGLE,
 164             action,
 165             sctp_clog.x.misc.log1,
 166             sctp_clog.x.misc.log2,
 167             sctp_clog.x.misc.log3,
 168             sctp_clog.x.misc.log4);
 169 }
 170
 171 void
 172 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from)
 173 {
 174         struct sctp_cwnd_log sctp_clog;
 175
 176         sctp_clog.x.sack.cumack = cumack;
 177         sctp_clog.x.sack.oldcumack = old_cumack;
 178         sctp_clog.x.sack.tsn = tsn;
 179         sctp_clog.x.sack.numGaps = gaps;
 180         sctp_clog.x.sack.numDups = dups;
 181         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 182             SCTP_LOG_EVENT_SACK,
 183             from,
 184             sctp_clog.x.misc.log1,
 185             sctp_clog.x.misc.log2,
 186             sctp_clog.x.misc.log3,
 187             sctp_clog.x.misc.log4);
 188 }
 189
 190 void
 191 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from)
 192 {
 193         struct sctp_cwnd_log sctp_clog;
 194
 195         memset(&sctp_clog, 0, sizeof(sctp_clog));
 196         sctp_clog.x.map.base = map;
 197         sctp_clog.x.map.cum = cum;
 198         sctp_clog.x.map.high = high;
 199         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 200             SCTP_LOG_EVENT_MAP,
 201             from,
 202             sctp_clog.x.misc.log1,
 203             sctp_clog.x.misc.log2,
 204             sctp_clog.x.misc.log3,
 205             sctp_clog.x.misc.log4);
 206 }
 207
 208 void
 209 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn, int from)
 210 {
 211         struct sctp_cwnd_log sctp_clog;
 212
 213         memset(&sctp_clog, 0, sizeof(sctp_clog));
 214         sctp_clog.x.fr.largest_tsn = biggest_tsn;
 215         sctp_clog.x.fr.largest_new_tsn = biggest_new_tsn;
 216         sctp_clog.x.fr.tsn = tsn;
 217         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 218             SCTP_LOG_EVENT_FR,
 219             from,
 220             sctp_clog.x.misc.log1,
 221             sctp_clog.x.misc.log2,
 222             sctp_clog.x.misc.log3,
 223             sctp_clog.x.misc.log4);
 224 }
 225
 226 #ifdef SCTP_MBUF_LOGGING
 227 void
 228 sctp_log_mb(struct mbuf *m, int from)
 229 {
 230         struct sctp_cwnd_log sctp_clog;
 231
 232         sctp_clog.x.mb.mp = m;
 233         sctp_clog.x.mb.mbuf_flags = (uint8_t)(SCTP_BUF_GET_FLAGS(m));
 234         sctp_clog.x.mb.size = (uint16_t)(SCTP_BUF_LEN(m));
 235         sctp_clog.x.mb.data = SCTP_BUF_AT(m, 0);
 236         if (SCTP_BUF_IS_EXTENDED(m)) {
 237                 sctp_clog.x.mb.ext = SCTP_BUF_EXTEND_BASE(m);
 238                 sctp_clog.x.mb.refcnt = (uint8_t)(SCTP_BUF_EXTEND_REFCNT(m));
 239         } else {
 240                 sctp_clog.x.mb.ext = 0;
 241                 sctp_clog.x.mb.refcnt = 0;
 242         }
 243         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 244             SCTP_LOG_EVENT_MBUF,
 245             from,
 246             sctp_clog.x.misc.log1,
 247             sctp_clog.x.misc.log2,
 248             sctp_clog.x.misc.log3,
 249             sctp_clog.x.misc.log4);
 250 }
 251
 252 void
 253 sctp_log_mbc(struct mbuf *m, int from)
 254 {
 255         struct mbuf *mat;
 256
 257         for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) {
 258                 sctp_log_mb(mat, from);
 259         }
 260 }
 261 #endif
 262
 263 void
 264 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk, int from)
 265 {
 266         struct sctp_cwnd_log sctp_clog;
 267
 268         if (control == NULL) {
 269                 SCTP_PRINTF("Gak log of NULL?\n");
 270                 return;
 271         }
 272         sctp_clog.x.strlog.stcb = control->stcb;
 273         sctp_clog.x.strlog.n_tsn = control->sinfo_tsn;
 274         sctp_clog.x.strlog.n_sseq = (uint16_t)control->mid;
 275         sctp_clog.x.strlog.strm = control->sinfo_stream;
 276         if (poschk != NULL) {
 277                 sctp_clog.x.strlog.e_tsn = poschk->sinfo_tsn;
 278                 sctp_clog.x.strlog.e_sseq = (uint16_t)poschk->mid;
 279         } else {
 280                 sctp_clog.x.strlog.e_tsn = 0;
 281                 sctp_clog.x.strlog.e_sseq = 0;
 282         }
 283         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 284             SCTP_LOG_EVENT_STRM,
 285             from,
 286             sctp_clog.x.misc.log1,
 287             sctp_clog.x.misc.log2,
 288             sctp_clog.x.misc.log3,
 289             sctp_clog.x.misc.log4);
 290 }
 291
 292 void
 293 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from)
 294 {
 295         struct sctp_cwnd_log sctp_clog;
 296
 297         sctp_clog.x.cwnd.net = net;
 298         if (stcb->asoc.send_queue_cnt > 255)
 299                 sctp_clog.x.cwnd.cnt_in_send = 255;
 300         else
 301                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 302         if (stcb->asoc.stream_queue_cnt > 255)
 303                 sctp_clog.x.cwnd.cnt_in_str = 255;
 304         else
 305                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 306
 307         if (net) {
 308                 sctp_clog.x.cwnd.cwnd_new_value = net->cwnd;
 309                 sctp_clog.x.cwnd.inflight = net->flight_size;
 310                 sctp_clog.x.cwnd.pseudo_cumack = net->pseudo_cumack;
 311                 sctp_clog.x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack;
 312                 sctp_clog.x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack;
 313         }
 314         if (SCTP_CWNDLOG_PRESEND == from) {
 315                 sctp_clog.x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd;
 316         }
 317         sctp_clog.x.cwnd.cwnd_augment = augment;
 318         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 319             SCTP_LOG_EVENT_CWND,
 320             from,
 321             sctp_clog.x.misc.log1,
 322             sctp_clog.x.misc.log2,
 323             sctp_clog.x.misc.log3,
 324             sctp_clog.x.misc.log4);
 325 }
 326
 327 void
 328 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from)
 329 {
 330         struct sctp_cwnd_log sctp_clog;
 331
 332         memset(&sctp_clog, 0, sizeof(sctp_clog));
 333         if (inp) {
 334                 sctp_clog.x.lock.sock = (void *)inp->sctp_socket;
 335
 336         } else {
 337                 sctp_clog.x.lock.sock = (void *)NULL;
 338         }
 339         sctp_clog.x.lock.inp = (void *)inp;
 340         if (stcb) {
 341                 sctp_clog.x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx);
 342         } else {
 343                 sctp_clog.x.lock.tcb_lock = SCTP_LOCK_UNKNOWN;
 344         }
 345         if (inp) {
 346                 sctp_clog.x.lock.inp_lock = mtx_owned(&inp->inp_mtx);
 347                 sctp_clog.x.lock.create_lock = mtx_owned(&inp->inp_create_mtx);
 348         } else {
 349                 sctp_clog.x.lock.inp_lock = SCTP_LOCK_UNKNOWN;
 350                 sctp_clog.x.lock.create_lock = SCTP_LOCK_UNKNOWN;
 351         }
 352         sctp_clog.x.lock.info_lock = rw_wowned(&SCTP_BASE_INFO(ipi_ep_mtx));
 353         if (inp && (inp->sctp_socket)) {
 354                 sctp_clog.x.lock.sock_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 355                 sctp_clog.x.lock.sockrcvbuf_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 356                 sctp_clog.x.lock.socksndbuf_lock = mtx_owned(&(inp->sctp_socket->so_snd.sb_mtx));
 357         } else {
 358                 sctp_clog.x.lock.sock_lock = SCTP_LOCK_UNKNOWN;
 359                 sctp_clog.x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN;
 360                 sctp_clog.x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN;
 361         }
 362         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 363             SCTP_LOG_LOCK_EVENT,
 364             from,
 365             sctp_clog.x.misc.log1,
 366             sctp_clog.x.misc.log2,
 367             sctp_clog.x.misc.log3,
 368             sctp_clog.x.misc.log4);
 369 }
 370
 371 void
 372 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from)
 373 {
 374         struct sctp_cwnd_log sctp_clog;
 375
 376         memset(&sctp_clog, 0, sizeof(sctp_clog));
 377         sctp_clog.x.cwnd.net = net;
 378         sctp_clog.x.cwnd.cwnd_new_value = error;
 379         sctp_clog.x.cwnd.inflight = net->flight_size;
 380         sctp_clog.x.cwnd.cwnd_augment = burst;
 381         if (stcb->asoc.send_queue_cnt > 255)
 382                 sctp_clog.x.cwnd.cnt_in_send = 255;
 383         else
 384                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 385         if (stcb->asoc.stream_queue_cnt > 255)
 386                 sctp_clog.x.cwnd.cnt_in_str = 255;
 387         else
 388                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 389         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 390             SCTP_LOG_EVENT_MAXBURST,
 391             from,
 392             sctp_clog.x.misc.log1,
 393             sctp_clog.x.misc.log2,
 394             sctp_clog.x.misc.log3,
 395             sctp_clog.x.misc.log4);
 396 }
 397
 398 void
 399 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead)
 400 {
 401         struct sctp_cwnd_log sctp_clog;
 402
 403         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 404         sctp_clog.x.rwnd.send_size = snd_size;
 405         sctp_clog.x.rwnd.overhead = overhead;
 406         sctp_clog.x.rwnd.new_rwnd = 0;
 407         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 408             SCTP_LOG_EVENT_RWND,
 409             from,
 410             sctp_clog.x.misc.log1,
 411             sctp_clog.x.misc.log2,
 412             sctp_clog.x.misc.log3,
 413             sctp_clog.x.misc.log4);
 414 }
 415
 416 void
 417 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval)
 418 {
 419         struct sctp_cwnd_log sctp_clog;
 420
 421         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 422         sctp_clog.x.rwnd.send_size = flight_size;
 423         sctp_clog.x.rwnd.overhead = overhead;
 424         sctp_clog.x.rwnd.new_rwnd = a_rwndval;
 425         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 426             SCTP_LOG_EVENT_RWND,
 427             from,
 428             sctp_clog.x.misc.log1,
 429             sctp_clog.x.misc.log2,
 430             sctp_clog.x.misc.log3,
 431             sctp_clog.x.misc.log4);
 432 }
 433
 434 #ifdef SCTP_MBCNT_LOGGING
 435 static void
 436 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt)
 437 {
 438         struct sctp_cwnd_log sctp_clog;
 439
 440         sctp_clog.x.mbcnt.total_queue_size = total_oq;
 441         sctp_clog.x.mbcnt.size_change = book;
 442         sctp_clog.x.mbcnt.total_queue_mb_size = total_mbcnt_q;
 443         sctp_clog.x.mbcnt.mbcnt_change = mbcnt;
 444         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 445             SCTP_LOG_EVENT_MBCNT,
 446             from,
 447             sctp_clog.x.misc.log1,
 448             sctp_clog.x.misc.log2,
 449             sctp_clog.x.misc.log3,
 450             sctp_clog.x.misc.log4);
 451 }
 452 #endif
 453
 454 void
 455 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d)
 456 {
 457         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 458             SCTP_LOG_MISC_EVENT,
 459             from,
 460             a, b, c, d);
 461 }
 462
 463 void
 464 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t wake_cnt, int from)
 465 {
 466         struct sctp_cwnd_log sctp_clog;
 467
 468         sctp_clog.x.wake.stcb = (void *)stcb;
 469         sctp_clog.x.wake.wake_cnt = wake_cnt;
 470         sctp_clog.x.wake.flight = stcb->asoc.total_flight_count;
 471         sctp_clog.x.wake.send_q = stcb->asoc.send_queue_cnt;
 472         sctp_clog.x.wake.sent_q = stcb->asoc.sent_queue_cnt;
 473
 474         if (stcb->asoc.stream_queue_cnt < 0xff)
 475                 sctp_clog.x.wake.stream_qcnt = (uint8_t)stcb->asoc.stream_queue_cnt;
 476         else
 477                 sctp_clog.x.wake.stream_qcnt = 0xff;
 478
 479         if (stcb->asoc.chunks_on_out_queue < 0xff)
 480                 sctp_clog.x.wake.chunks_on_oque = (uint8_t)stcb->asoc.chunks_on_out_queue;
 481         else
 482                 sctp_clog.x.wake.chunks_on_oque = 0xff;
 483
 484         sctp_clog.x.wake.sctpflags = 0;
 485         /* set in the defered mode stuff */
 486         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE)
 487                 sctp_clog.x.wake.sctpflags |= 1;
 488         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT)
 489                 sctp_clog.x.wake.sctpflags |= 2;
 490         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT)
 491                 sctp_clog.x.wake.sctpflags |= 4;
 492         /* what about the sb */
 493         if (stcb->sctp_socket) {
 494                 struct socket *so = stcb->sctp_socket;
 495
 496                 sctp_clog.x.wake.sbflags = (uint8_t)((so->so_snd.sb_flags & 0x00ff));
 497         } else {
 498                 sctp_clog.x.wake.sbflags = 0xff;
 499         }
 500         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 501             SCTP_LOG_EVENT_WAKE,
 502             from,
 503             sctp_clog.x.misc.log1,
 504             sctp_clog.x.misc.log2,
 505             sctp_clog.x.misc.log3,
 506             sctp_clog.x.misc.log4);
 507 }
 508
 509 void
 510 sctp_log_block(uint8_t from, struct sctp_association *asoc, size_t sendlen)
 511 {
 512         struct sctp_cwnd_log sctp_clog;
 513
 514         sctp_clog.x.blk.onsb = asoc->total_output_queue_size;
 515         sctp_clog.x.blk.send_sent_qcnt = (uint16_t)(asoc->send_queue_cnt + asoc->sent_queue_cnt);
 516         sctp_clog.x.blk.peer_rwnd = asoc->peers_rwnd;
 517         sctp_clog.x.blk.stream_qcnt = (uint16_t)asoc->stream_queue_cnt;
 518         sctp_clog.x.blk.chunks_on_oque = (uint16_t)asoc->chunks_on_out_queue;
 519         sctp_clog.x.blk.flight_size = (uint16_t)(asoc->total_flight / 1024);
 520         sctp_clog.x.blk.sndlen = (uint32_t)sendlen;
 521         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 522             SCTP_LOG_EVENT_BLOCK,
 523             from,
 524             sctp_clog.x.misc.log1,
 525             sctp_clog.x.misc.log2,
 526             sctp_clog.x.misc.log3,
 527             sctp_clog.x.misc.log4);
 528 }
 529
 530 int
 531 sctp_fill_stat_log(void *optval SCTP_UNUSED, size_t *optsize SCTP_UNUSED)
 532 {
 533         /* May need to fix this if ktrdump does not work */
 534         return (0);
 535 }
 536
 537 #ifdef SCTP_AUDITING_ENABLED
 538 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2];
 539 static int sctp_audit_indx = 0;
 540
 541 static
 542 void
 543 sctp_print_audit_report(void)
 544 {
 545         int i;
 546         int cnt;
 547
 548         cnt = 0;
 549         for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) {
 550                 if ((sctp_audit_data[i][0] == 0xe0) &&
 551                     (sctp_audit_data[i][1] == 0x01)) {
 552                         cnt = 0;
 553                         SCTP_PRINTF("\n");
 554                 } else if (sctp_audit_data[i][0] == 0xf0) {
 555                         cnt = 0;
 556                         SCTP_PRINTF("\n");
 557                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 558                     (sctp_audit_data[i][1] == 0x01)) {
 559                         SCTP_PRINTF("\n");
 560                         cnt = 0;
 561                 }
 562                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0],
 563                     (uint32_t)sctp_audit_data[i][1]);
 564                 cnt++;
 565                 if ((cnt % 14) == 0)
 566                         SCTP_PRINTF("\n");
 567         }
 568         for (i = 0; i < sctp_audit_indx; i++) {
 569                 if ((sctp_audit_data[i][0] == 0xe0) &&
 570                     (sctp_audit_data[i][1] == 0x01)) {
 571                         cnt = 0;
 572                         SCTP_PRINTF("\n");
 573                 } else if (sctp_audit_data[i][0] == 0xf0) {
 574                         cnt = 0;
 575                         SCTP_PRINTF("\n");
 576                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 577                     (sctp_audit_data[i][1] == 0x01)) {
 578                         SCTP_PRINTF("\n");
 579                         cnt = 0;
 580                 }
 581                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0],
 582                     (uint32_t)sctp_audit_data[i][1]);
 583                 cnt++;
 584                 if ((cnt % 14) == 0)
 585                         SCTP_PRINTF("\n");
 586         }
 587         SCTP_PRINTF("\n");
 588 }
 589
 590 void
 591 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 592     struct sctp_nets *net)
 593 {
 594         int resend_cnt, tot_out, rep, tot_book_cnt;
 595         struct sctp_nets *lnet;
 596         struct sctp_tmit_chunk *chk;
 597
 598         sctp_audit_data[sctp_audit_indx][0] = 0xAA;
 599         sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from;
 600         sctp_audit_indx++;
 601         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 602                 sctp_audit_indx = 0;
 603         }
 604         if (inp == NULL) {
 605                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 606                 sctp_audit_data[sctp_audit_indx][1] = 0x01;
 607                 sctp_audit_indx++;
 608                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 609                         sctp_audit_indx = 0;
 610                 }
 611                 return;
 612         }
 613         if (stcb == NULL) {
 614                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 615                 sctp_audit_data[sctp_audit_indx][1] = 0x02;
 616                 sctp_audit_indx++;
 617                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 618                         sctp_audit_indx = 0;
 619                 }
 620                 return;
 621         }
 622         sctp_audit_data[sctp_audit_indx][0] = 0xA1;
 623         sctp_audit_data[sctp_audit_indx][1] =
 624             (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 625         sctp_audit_indx++;
 626         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 627                 sctp_audit_indx = 0;
 628         }
 629         rep = 0;
 630         tot_book_cnt = 0;
 631         resend_cnt = tot_out = 0;
 632         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 633                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 634                         resend_cnt++;
 635                 } else if (chk->sent < SCTP_DATAGRAM_RESEND) {
 636                         tot_out += chk->book_size;
 637                         tot_book_cnt++;
 638                 }
 639         }
 640         if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) {
 641                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 642                 sctp_audit_data[sctp_audit_indx][1] = 0xA1;
 643                 sctp_audit_indx++;
 644                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 645                         sctp_audit_indx = 0;
 646                 }
 647                 SCTP_PRINTF("resend_cnt:%d asoc-tot:%d\n",
 648                     resend_cnt, stcb->asoc.sent_queue_retran_cnt);
 649                 rep = 1;
 650                 stcb->asoc.sent_queue_retran_cnt = resend_cnt;
 651                 sctp_audit_data[sctp_audit_indx][0] = 0xA2;
 652                 sctp_audit_data[sctp_audit_indx][1] =
 653                     (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 654                 sctp_audit_indx++;
 655                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 656                         sctp_audit_indx = 0;
 657                 }
 658         }
 659         if (tot_out != stcb->asoc.total_flight) {
 660                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 661                 sctp_audit_data[sctp_audit_indx][1] = 0xA2;
 662                 sctp_audit_indx++;
 663                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 664                         sctp_audit_indx = 0;
 665                 }
 666                 rep = 1;
 667                 SCTP_PRINTF("tot_flt:%d asoc_tot:%d\n", tot_out,
 668                     (int)stcb->asoc.total_flight);
 669                 stcb->asoc.total_flight = tot_out;
 670         }
 671         if (tot_book_cnt != stcb->asoc.total_flight_count) {
 672                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 673                 sctp_audit_data[sctp_audit_indx][1] = 0xA5;
 674                 sctp_audit_indx++;
 675                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 676                         sctp_audit_indx = 0;
 677                 }
 678                 rep = 1;
 679                 SCTP_PRINTF("tot_flt_book:%d\n", tot_book_cnt);
 680
 681                 stcb->asoc.total_flight_count = tot_book_cnt;
 682         }
 683         tot_out = 0;
 684         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 685                 tot_out += lnet->flight_size;
 686         }
 687         if (tot_out != stcb->asoc.total_flight) {
 688                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 689                 sctp_audit_data[sctp_audit_indx][1] = 0xA3;
 690                 sctp_audit_indx++;
 691                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 692                         sctp_audit_indx = 0;
 693                 }
 694                 rep = 1;
 695                 SCTP_PRINTF("real flight:%d net total was %d\n",
 696                     stcb->asoc.total_flight, tot_out);
 697                 /* now corrective action */
 698                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 699
 700                         tot_out = 0;
 701                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 702                                 if ((chk->whoTo == lnet) &&
 703                                     (chk->sent < SCTP_DATAGRAM_RESEND)) {
 704                                         tot_out += chk->book_size;
 705                                 }
 706                         }
 707                         if (lnet->flight_size != tot_out) {
 708                                 SCTP_PRINTF("net:%p flight was %d corrected to %d\n",
 709                                     (void *)lnet, lnet->flight_size,
 710                                     tot_out);
 711                                 lnet->flight_size = tot_out;
 712                         }
 713                 }
 714         }
 715         if (rep) {
 716                 sctp_print_audit_report();
 717         }
 718 }
 719
 720 void
 721 sctp_audit_log(uint8_t ev, uint8_t fd)
 722 {
 723
 724         sctp_audit_data[sctp_audit_indx][0] = ev;
 725         sctp_audit_data[sctp_audit_indx][1] = fd;
 726         sctp_audit_indx++;
 727         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 728                 sctp_audit_indx = 0;
 729         }
 730 }
 731
 732 #endif
 733
 734 /*
 735  * sctp_stop_timers_for_shutdown() should be called
 736  * when entering the SHUTDOWN_SENT or SHUTDOWN_ACK_SENT
 737  * state to make sure that all timers are stopped.
 738  */
 739 void
 740 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb)
 741 {
 742         struct sctp_association *asoc;
 743         struct sctp_nets *net;
 744
 745         asoc = &stcb->asoc;
 746
 747         (void)SCTP_OS_TIMER_STOP(&asoc->dack_timer.timer);
 748         (void)SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
 749         (void)SCTP_OS_TIMER_STOP(&asoc->asconf_timer.timer);
 750         (void)SCTP_OS_TIMER_STOP(&asoc->autoclose_timer.timer);
 751         (void)SCTP_OS_TIMER_STOP(&asoc->delayed_event_timer.timer);
 752         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
 753                 (void)SCTP_OS_TIMER_STOP(&net->pmtu_timer.timer);
 754                 (void)SCTP_OS_TIMER_STOP(&net->hb_timer.timer);
 755         }
 756 }
 757
 758 /*
 759  * a list of sizes based on typical mtu's, used only if next hop size not
 760  * returned.
 761  */
 762 static uint32_t sctp_mtu_sizes[] = {
 763         68,
 764         296,
 765         508,
 766         512,
 767         544,
 768         576,
 769         1006,
 770         1492,
 771         1500,
 772         1536,
 773         2002,
 774         2048,
 775         4352,
 776         4464,
 777         8166,
 778         17914,
 779         32000,
 780         65535
 781 };
 782
 783 /*
 784  * Return the largest MTU smaller than val. If there is no
 785  * entry, just return val.
 786  */
 787 uint32_t
 788 sctp_get_prev_mtu(uint32_t val)
 789 {
 790         uint32_t i;
 791
 792         if (val <= sctp_mtu_sizes[0]) {
 793                 return (val);
 794         }
 795         for (i = 1; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 796                 if (val <= sctp_mtu_sizes[i]) {
 797                         break;
 798                 }
 799         }
 800         return (sctp_mtu_sizes[i - 1]);
 801 }
 802
 803 /*
 804  * Return the smallest MTU larger than val. If there is no
 805  * entry, just return val.
 806  */
 807 uint32_t
 808 sctp_get_next_mtu(uint32_t val)
 809 {
 810         /* select another MTU that is just bigger than this one */
 811         uint32_t i;
 812
 813         for (i = 0; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 814                 if (val < sctp_mtu_sizes[i]) {
 815                         return (sctp_mtu_sizes[i]);
 816                 }
 817         }
 818         return (val);
 819 }
 820
 821 void
 822 sctp_fill_random_store(struct sctp_pcb *m)
 823 {
 824         /*
 825          * Here we use the MD5/SHA-1 to hash with our good randomNumbers and
 826          * our counter. The result becomes our good random numbers and we
 827          * then setup to give these out. Note that we do no locking to
 828          * protect this. This is ok, since if competing folks call this we
 829          * will get more gobbled gook in the random store which is what we
 830          * want. There is a danger that two guys will use the same random
 831          * numbers, but thats ok too since that is random as well :->
 832          */
 833         m->store_at = 0;
 834         (void)sctp_hmac(SCTP_HMAC, (uint8_t *)m->random_numbers,
 835             sizeof(m->random_numbers), (uint8_t *)&m->random_counter,
 836             sizeof(m->random_counter), (uint8_t *)m->random_store);
 837         m->random_counter++;
 838 }
 839
 840 uint32_t
 841 sctp_select_initial_TSN(struct sctp_pcb *inp)
 842 {
 843         /*
 844          * A true implementation should use random selection process to get
 845          * the initial stream sequence number, using RFC1750 as a good
 846          * guideline
 847          */
 848         uint32_t x, *xp;
 849         uint8_t *p;
 850         int store_at, new_store;
 851
 852         if (inp->initial_sequence_debug != 0) {
 853                 uint32_t ret;
 854
 855                 ret = inp->initial_sequence_debug;
 856                 inp->initial_sequence_debug++;
 857                 return (ret);
 858         }
 859 retry:
 860         store_at = inp->store_at;
 861         new_store = store_at + sizeof(uint32_t);
 862         if (new_store >= (SCTP_SIGNATURE_SIZE - 3)) {
 863                 new_store = 0;
 864         }
 865         if (!atomic_cmpset_int(&inp->store_at, store_at, new_store)) {
 866                 goto retry;
 867         }
 868         if (new_store == 0) {
 869                 /* Refill the random store */
 870                 sctp_fill_random_store(inp);
 871         }
 872         p = &inp->random_store[store_at];
 873         xp = (uint32_t *)p;
 874         x = *xp;
 875         return (x);
 876 }
 877
 878 uint32_t
 879 sctp_select_a_tag(struct sctp_inpcb *inp, uint16_t lport, uint16_t rport, int check)
 880 {
 881         uint32_t x;
 882         struct timeval now;
 883
 884         if (check) {
 885                 (void)SCTP_GETTIME_TIMEVAL(&now);
 886         }
 887         for (;;) {
 888                 x = sctp_select_initial_TSN(&inp->sctp_ep);
 889                 if (x == 0) {
 890                         /* we never use 0 */
 891                         continue;
 892                 }
 893                 if (!check || sctp_is_vtag_good(x, lport, rport, &now)) {
 894                         break;
 895                 }
 896         }
 897         return (x);
 898 }
 899
 900 int32_t
 901 sctp_map_assoc_state(int kernel_state)
 902 {
 903         int32_t user_state;
 904
 905         if (kernel_state & SCTP_STATE_WAS_ABORTED) {
 906                 user_state = SCTP_CLOSED;
 907         } else if (kernel_state & SCTP_STATE_SHUTDOWN_PENDING) {
 908                 user_state = SCTP_SHUTDOWN_PENDING;
 909         } else {
 910                 switch (kernel_state & SCTP_STATE_MASK) {
 911                 case SCTP_STATE_EMPTY:
 912                         user_state = SCTP_CLOSED;
 913                         break;
 914                 case SCTP_STATE_INUSE:
 915                         user_state = SCTP_CLOSED;
 916                         break;
 917                 case SCTP_STATE_COOKIE_WAIT:
 918                         user_state = SCTP_COOKIE_WAIT;
 919                         break;
 920                 case SCTP_STATE_COOKIE_ECHOED:
 921                         user_state = SCTP_COOKIE_ECHOED;
 922                         break;
 923                 case SCTP_STATE_OPEN:
 924                         user_state = SCTP_ESTABLISHED;
 925                         break;
 926                 case SCTP_STATE_SHUTDOWN_SENT:
 927                         user_state = SCTP_SHUTDOWN_SENT;
 928                         break;
 929                 case SCTP_STATE_SHUTDOWN_RECEIVED:
 930                         user_state = SCTP_SHUTDOWN_RECEIVED;
 931                         break;
 932                 case SCTP_STATE_SHUTDOWN_ACK_SENT:
 933                         user_state = SCTP_SHUTDOWN_ACK_SENT;
 934                         break;
 935                 default:
 936                         user_state = SCTP_CLOSED;
 937                         break;
 938                 }
 939         }
 940         return (user_state);
 941 }
 942
 943 int
 944 sctp_init_asoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 945     uint32_t override_tag, uint32_t vrf_id, uint16_t o_strms)
 946 {
 947         struct sctp_association *asoc;
 948
 949         /*
 950          * Anything set to zero is taken care of by the allocation routine's
 951          * bzero
 952          */
 953
 954         /*
 955          * Up front select what scoping to apply on addresses I tell my peer
 956          * Not sure what to do with these right now, we will need to come up
 957          * with a way to set them. We may need to pass them through from the
 958          * caller in the sctp_aloc_assoc() function.
 959          */
 960         int i;
 961 #if defined(SCTP_DETAILED_STR_STATS)
 962         int j;
 963 #endif
 964
 965         asoc = &stcb->asoc;
 966         /* init all variables to a known value. */
 967         SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_INUSE);
 968         asoc->max_burst = inp->sctp_ep.max_burst;
 969         asoc->fr_max_burst = inp->sctp_ep.fr_max_burst;
 970         asoc->heart_beat_delay = TICKS_TO_MSEC(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]);
 971         asoc->cookie_life = inp->sctp_ep.def_cookie_life;
 972         asoc->sctp_cmt_on_off = inp->sctp_cmt_on_off;
 973         asoc->ecn_supported = inp->ecn_supported;
 974         asoc->prsctp_supported = inp->prsctp_supported;
 975         asoc->idata_supported = inp->idata_supported;
 976         asoc->auth_supported = inp->auth_supported;
 977         asoc->asconf_supported = inp->asconf_supported;
 978         asoc->reconfig_supported = inp->reconfig_supported;
 979         asoc->nrsack_supported = inp->nrsack_supported;
 980         asoc->pktdrop_supported = inp->pktdrop_supported;
 981         asoc->idata_supported = inp->idata_supported;
 982         asoc->sctp_cmt_pf = (uint8_t)0;
 983         asoc->sctp_frag_point = inp->sctp_frag_point;
 984         asoc->sctp_features = inp->sctp_features;
 985         asoc->default_dscp = inp->sctp_ep.default_dscp;
 986         asoc->max_cwnd = inp->max_cwnd;
 987 #ifdef INET6
 988         if (inp->sctp_ep.default_flowlabel) {
 989                 asoc->default_flowlabel = inp->sctp_ep.default_flowlabel;
 990         } else {
 991                 if (inp->ip_inp.inp.inp_flags & IN6P_AUTOFLOWLABEL) {
 992                         asoc->default_flowlabel = sctp_select_initial_TSN(&inp->sctp_ep);
 993                         asoc->default_flowlabel &= 0x000fffff;
 994                         asoc->default_flowlabel |= 0x80000000;
 995                 } else {
 996                         asoc->default_flowlabel = 0;
 997                 }
 998         }
 999 #endif
1000         asoc->sb_send_resv = 0;
1001         if (override_tag) {
1002                 asoc->my_vtag = override_tag;
1003         } else {
1004                 asoc->my_vtag = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
1005         }
1006         /* Get the nonce tags */
1007         asoc->my_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
1008         asoc->peer_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
1009         asoc->vrf_id = vrf_id;
1010
1011 #ifdef SCTP_ASOCLOG_OF_TSNS
1012         asoc->tsn_in_at = 0;
1013         asoc->tsn_out_at = 0;
1014         asoc->tsn_in_wrapped = 0;
1015         asoc->tsn_out_wrapped = 0;
1016         asoc->cumack_log_at = 0;
1017         asoc->cumack_log_atsnt = 0;
1018 #endif
1019 #ifdef SCTP_FS_SPEC_LOG
1020         asoc->fs_index = 0;
1021 #endif
1022         asoc->refcnt = 0;
1023         asoc->assoc_up_sent = 0;
1024         asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number = asoc->sending_seq =
1025             sctp_select_initial_TSN(&inp->sctp_ep);
1026         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
1027         /* we are optimisitic here */
1028         asoc->peer_supports_nat = 0;
1029         asoc->sent_queue_retran_cnt = 0;
1030
1031         /* for CMT */
1032         asoc->last_net_cmt_send_started = NULL;
1033
1034         /* This will need to be adjusted */
1035         asoc->last_acked_seq = asoc->init_seq_number - 1;
1036         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1037         asoc->asconf_seq_in = asoc->last_acked_seq;
1038
1039         /* here we are different, we hold the next one we expect */
1040         asoc->str_reset_seq_in = asoc->last_acked_seq + 1;
1041
1042         asoc->initial_init_rto_max = inp->sctp_ep.initial_init_rto_max;
1043         asoc->initial_rto = inp->sctp_ep.initial_rto;
1044
1045         asoc->max_init_times = inp->sctp_ep.max_init_times;
1046         asoc->max_send_times = inp->sctp_ep.max_send_times;
1047         asoc->def_net_failure = inp->sctp_ep.def_net_failure;
1048         asoc->def_net_pf_threshold = inp->sctp_ep.def_net_pf_threshold;
1049         asoc->free_chunk_cnt = 0;
1050
1051         asoc->iam_blocking = 0;
1052         asoc->context = inp->sctp_context;
1053         asoc->local_strreset_support = inp->local_strreset_support;
1054         asoc->def_send = inp->def_send;
1055         asoc->delayed_ack = TICKS_TO_MSEC(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]);
1056         asoc->sack_freq = inp->sctp_ep.sctp_sack_freq;
1057         asoc->pr_sctp_cnt = 0;
1058         asoc->total_output_queue_size = 0;
1059
1060         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1061                 asoc->scope.ipv6_addr_legal = 1;
1062                 if (SCTP_IPV6_V6ONLY(inp) == 0) {
1063                         asoc->scope.ipv4_addr_legal = 1;
1064                 } else {
1065                         asoc->scope.ipv4_addr_legal = 0;
1066                 }
1067         } else {
1068                 asoc->scope.ipv6_addr_legal = 0;
1069                 asoc->scope.ipv4_addr_legal = 1;
1070         }
1071
1072         asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(inp->sctp_socket), SCTP_MINIMAL_RWND);
1073         asoc->peers_rwnd = SCTP_SB_LIMIT_RCV(inp->sctp_socket);
1074
1075         asoc->smallest_mtu = inp->sctp_frag_point;
1076         asoc->minrto = inp->sctp_ep.sctp_minrto;
1077         asoc->maxrto = inp->sctp_ep.sctp_maxrto;
1078
1079         asoc->stream_locked_on = 0;
1080         asoc->ecn_echo_cnt_onq = 0;
1081         asoc->stream_locked = 0;
1082
1083         asoc->send_sack = 1;
1084
1085         LIST_INIT(&asoc->sctp_restricted_addrs);
1086
1087         TAILQ_INIT(&asoc->nets);
1088         TAILQ_INIT(&asoc->pending_reply_queue);
1089         TAILQ_INIT(&asoc->asconf_ack_sent);
1090         /* Setup to fill the hb random cache at first HB */
1091         asoc->hb_random_idx = 4;
1092
1093         asoc->sctp_autoclose_ticks = inp->sctp_ep.auto_close_time;
1094
1095         stcb->asoc.congestion_control_module = inp->sctp_ep.sctp_default_cc_module;
1096         stcb->asoc.cc_functions = sctp_cc_functions[inp->sctp_ep.sctp_default_cc_module];
1097
1098         stcb->asoc.stream_scheduling_module = inp->sctp_ep.sctp_default_ss_module;
1099         stcb->asoc.ss_functions = sctp_ss_functions[inp->sctp_ep.sctp_default_ss_module];
1100
1101         /*
1102          * Now the stream parameters, here we allocate space for all streams
1103          * that we request by default.
1104          */
1105         asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams =
1106             o_strms;
1107         SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *,
1108             asoc->streamoutcnt * sizeof(struct sctp_stream_out),
1109             SCTP_M_STRMO);
1110         if (asoc->strmout == NULL) {
1111                 /* big trouble no memory */
1112                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1113                 return (ENOMEM);
1114         }
1115         for (i = 0; i < asoc->streamoutcnt; i++) {
1116                 /*
1117                  * inbound side must be set to 0xffff, also NOTE when we get
1118                  * the INIT-ACK back (for INIT sender) we MUST reduce the
1119                  * count (streamoutcnt) but first check if we sent to any of
1120                  * the upper streams that were dropped (if some were). Those
1121                  * that were dropped must be notified to the upper layer as
1122                  * failed to send.
1123                  */
1124                 asoc->strmout[i].next_mid_ordered = 0;
1125                 asoc->strmout[i].next_mid_unordered = 0;
1126                 TAILQ_INIT(&asoc->strmout[i].outqueue);
1127                 asoc->strmout[i].chunks_on_queues = 0;
1128 #if defined(SCTP_DETAILED_STR_STATS)
1129                 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) {
1130                         asoc->strmout[i].abandoned_sent[j] = 0;
1131                         asoc->strmout[i].abandoned_unsent[j] = 0;
1132                 }
1133 #else
1134                 asoc->strmout[i].abandoned_sent[0] = 0;
1135                 asoc->strmout[i].abandoned_unsent[0] = 0;
1136 #endif
1137                 asoc->strmout[i].sid = i;
1138                 asoc->strmout[i].last_msg_incomplete = 0;
1139                 asoc->strmout[i].state = SCTP_STREAM_OPENING;
1140                 asoc->ss_functions.sctp_ss_init_stream(stcb, &asoc->strmout[i], NULL);
1141         }
1142         asoc->ss_functions.sctp_ss_init(stcb, asoc, 0);
1143
1144         /* Now the mapping array */
1145         asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY;
1146         SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size,
1147             SCTP_M_MAP);
1148         if (asoc->mapping_array == NULL) {
1149                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1150                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1151                 return (ENOMEM);
1152         }
1153         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
1154         SCTP_MALLOC(asoc->nr_mapping_array, uint8_t *, asoc->mapping_array_size,
1155             SCTP_M_MAP);
1156         if (asoc->nr_mapping_array == NULL) {
1157                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1158                 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1159                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1160                 return (ENOMEM);
1161         }
1162         memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
1163
1164         /* Now the init of the other outqueues */
1165         TAILQ_INIT(&asoc->free_chunks);
1166         TAILQ_INIT(&asoc->control_send_queue);
1167         TAILQ_INIT(&asoc->asconf_send_queue);
1168         TAILQ_INIT(&asoc->send_queue);
1169         TAILQ_INIT(&asoc->sent_queue);
1170         TAILQ_INIT(&asoc->resetHead);
1171         asoc->max_inbound_streams = inp->sctp_ep.max_open_streams_intome;
1172         TAILQ_INIT(&asoc->asconf_queue);
1173         /* authentication fields */
1174         asoc->authinfo.random = NULL;
1175         asoc->authinfo.active_keyid = 0;
1176         asoc->authinfo.assoc_key = NULL;
1177         asoc->authinfo.assoc_keyid = 0;
1178         asoc->authinfo.recv_key = NULL;
1179         asoc->authinfo.recv_keyid = 0;
1180         LIST_INIT(&asoc->shared_keys);
1181         asoc->marked_retrans = 0;
1182         asoc->port = inp->sctp_ep.port;
1183         asoc->timoinit = 0;
1184         asoc->timodata = 0;
1185         asoc->timosack = 0;
1186         asoc->timoshutdown = 0;
1187         asoc->timoheartbeat = 0;
1188         asoc->timocookie = 0;
1189         asoc->timoshutdownack = 0;
1190         (void)SCTP_GETTIME_TIMEVAL(&asoc->start_time);
1191         asoc->discontinuity_time = asoc->start_time;
1192         for (i = 0; i < SCTP_PR_SCTP_MAX + 1; i++) {
1193                 asoc->abandoned_unsent[i] = 0;
1194                 asoc->abandoned_sent[i] = 0;
1195         }
1196         /*
1197          * sa_ignore MEMLEAK {memory is put in the assoc mapping array and
1198          * freed later when the association is freed.
1199          */
1200         return (0);
1201 }
1202
1203 void
1204 sctp_print_mapping_array(struct sctp_association *asoc)
1205 {
1206         unsigned int i, limit;
1207
1208         SCTP_PRINTF("Mapping array size: %d, baseTSN: %8.8x, cumAck: %8.8x, highestTSN: (%8.8x, %8.8x).\n",
1209             asoc->mapping_array_size,
1210             asoc->mapping_array_base_tsn,
1211             asoc->cumulative_tsn,
1212             asoc->highest_tsn_inside_map,
1213             asoc->highest_tsn_inside_nr_map);
1214         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1215                 if (asoc->mapping_array[limit - 1] != 0) {
1216                         break;
1217                 }
1218         }
1219         SCTP_PRINTF("Renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1220         for (i = 0; i < limit; i++) {
1221                 SCTP_PRINTF("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1222         }
1223         if (limit % 16)
1224                 SCTP_PRINTF("\n");
1225         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1226                 if (asoc->nr_mapping_array[limit - 1]) {
1227                         break;
1228                 }
1229         }
1230         SCTP_PRINTF("Non renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1231         for (i = 0; i < limit; i++) {
1232                 SCTP_PRINTF("%2.2x%c", asoc->nr_mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1233         }
1234         if (limit % 16)
1235                 SCTP_PRINTF("\n");
1236 }
1237
1238 int
1239 sctp_expand_mapping_array(struct sctp_association *asoc, uint32_t needed)
1240 {
1241         /* mapping array needs to grow */
1242         uint8_t *new_array1, *new_array2;
1243         uint32_t new_size;
1244
1245         new_size = asoc->mapping_array_size + ((needed + 7) / 8 + SCTP_MAPPING_ARRAY_INCR);
1246         SCTP_MALLOC(new_array1, uint8_t *, new_size, SCTP_M_MAP);
1247         SCTP_MALLOC(new_array2, uint8_t *, new_size, SCTP_M_MAP);
1248         if ((new_array1 == NULL) || (new_array2 == NULL)) {
1249                 /* can't get more, forget it */
1250                 SCTP_PRINTF("No memory for expansion of SCTP mapping array %d\n", new_size);
1251                 if (new_array1) {
1252                         SCTP_FREE(new_array1, SCTP_M_MAP);
1253                 }
1254                 if (new_array2) {
1255                         SCTP_FREE(new_array2, SCTP_M_MAP);
1256                 }
1257                 return (-1);
1258         }
1259         memset(new_array1, 0, new_size);
1260         memset(new_array2, 0, new_size);
1261         memcpy(new_array1, asoc->mapping_array, asoc->mapping_array_size);
1262         memcpy(new_array2, asoc->nr_mapping_array, asoc->mapping_array_size);
1263         SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1264         SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
1265         asoc->mapping_array = new_array1;
1266         asoc->nr_mapping_array = new_array2;
1267         asoc->mapping_array_size = new_size;
1268         return (0);
1269 }
1270
1271
1272 static void
1273 sctp_iterator_work(struct sctp_iterator *it)
1274 {
1275         int iteration_count = 0;
1276         int inp_skip = 0;
1277         int first_in = 1;
1278         struct sctp_inpcb *tinp;
1279
1280         SCTP_INP_INFO_RLOCK();
1281         SCTP_ITERATOR_LOCK();
1282         sctp_it_ctl.cur_it = it;
1283         if (it->inp) {
1284                 SCTP_INP_RLOCK(it->inp);
1285                 SCTP_INP_DECR_REF(it->inp);
1286         }
1287         if (it->inp == NULL) {
1288                 /* iterator is complete */
1289 done_with_iterator:
1290                 sctp_it_ctl.cur_it = NULL;
1291                 SCTP_ITERATOR_UNLOCK();
1292                 SCTP_INP_INFO_RUNLOCK();
1293                 if (it->function_atend != NULL) {
1294                         (*it->function_atend) (it->pointer, it->val);
1295                 }
1296                 SCTP_FREE(it, SCTP_M_ITER);
1297                 return;
1298         }
1299 select_a_new_ep:
1300         if (first_in) {
1301                 first_in = 0;
1302         } else {
1303                 SCTP_INP_RLOCK(it->inp);
1304         }
1305         while (((it->pcb_flags) &&
1306             ((it->inp->sctp_flags & it->pcb_flags) != it->pcb_flags)) ||
1307             ((it->pcb_features) &&
1308             ((it->inp->sctp_features & it->pcb_features) != it->pcb_features))) {
1309                 /* endpoint flags or features don't match, so keep looking */
1310                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1311                         SCTP_INP_RUNLOCK(it->inp);
1312                         goto done_with_iterator;
1313                 }
1314                 tinp = it->inp;
1315                 it->inp = LIST_NEXT(it->inp, sctp_list);
1316                 SCTP_INP_RUNLOCK(tinp);
1317                 if (it->inp == NULL) {
1318                         goto done_with_iterator;
1319                 }
1320                 SCTP_INP_RLOCK(it->inp);
1321         }
1322         /* now go through each assoc which is in the desired state */
1323         if (it->done_current_ep == 0) {
1324                 if (it->function_inp != NULL)
1325                         inp_skip = (*it->function_inp) (it->inp, it->pointer, it->val);
1326                 it->done_current_ep = 1;
1327         }
1328         if (it->stcb == NULL) {
1329                 /* run the per instance function */
1330                 it->stcb = LIST_FIRST(&it->inp->sctp_asoc_list);
1331         }
1332         if ((inp_skip) || it->stcb == NULL) {
1333                 if (it->function_inp_end != NULL) {
1334                         inp_skip = (*it->function_inp_end) (it->inp,
1335                             it->pointer,
1336                             it->val);
1337                 }
1338                 SCTP_INP_RUNLOCK(it->inp);
1339                 goto no_stcb;
1340         }
1341         while (it->stcb) {
1342                 SCTP_TCB_LOCK(it->stcb);
1343                 if (it->asoc_state && ((it->stcb->asoc.state & it->asoc_state) != it->asoc_state)) {
1344                         /* not in the right state... keep looking */
1345                         SCTP_TCB_UNLOCK(it->stcb);
1346                         goto next_assoc;
1347                 }
1348                 /* see if we have limited out the iterator loop */
1349                 iteration_count++;
1350                 if (iteration_count > SCTP_ITERATOR_MAX_AT_ONCE) {
1351                         /* Pause to let others grab the lock */
1352                         atomic_add_int(&it->stcb->asoc.refcnt, 1);
1353                         SCTP_TCB_UNLOCK(it->stcb);
1354                         SCTP_INP_INCR_REF(it->inp);
1355                         SCTP_INP_RUNLOCK(it->inp);
1356                         SCTP_ITERATOR_UNLOCK();
1357                         SCTP_INP_INFO_RUNLOCK();
1358                         SCTP_INP_INFO_RLOCK();
1359                         SCTP_ITERATOR_LOCK();
1360                         if (sctp_it_ctl.iterator_flags) {
1361                                 /* We won't be staying here */
1362                                 SCTP_INP_DECR_REF(it->inp);
1363                                 atomic_add_int(&it->stcb->asoc.refcnt, -1);
1364                                 if (sctp_it_ctl.iterator_flags &
1365                                     SCTP_ITERATOR_STOP_CUR_IT) {
1366                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_IT;
1367                                         goto done_with_iterator;
1368                                 }
1369                                 if (sctp_it_ctl.iterator_flags &
1370                                     SCTP_ITERATOR_STOP_CUR_INP) {
1371                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_INP;
1372                                         goto no_stcb;
1373                                 }
1374                                 /* If we reach here huh? */
1375                                 SCTP_PRINTF("Unknown it ctl flag %x\n",
1376                                     sctp_it_ctl.iterator_flags);
1377                                 sctp_it_ctl.iterator_flags = 0;
1378                         }
1379                         SCTP_INP_RLOCK(it->inp);
1380                         SCTP_INP_DECR_REF(it->inp);
1381                         SCTP_TCB_LOCK(it->stcb);
1382                         atomic_add_int(&it->stcb->asoc.refcnt, -1);
1383                         iteration_count = 0;
1384                 }
1385                 /* run function on this one */
1386                 (*it->function_assoc) (it->inp, it->stcb, it->pointer, it->val);
1387
1388                 /*
1389                  * we lie here, it really needs to have its own type but
1390                  * first I must verify that this won't effect things :-0
1391                  */
1392                 if (it->no_chunk_output == 0)
1393                         sctp_chunk_output(it->inp, it->stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1394
1395                 SCTP_TCB_UNLOCK(it->stcb);
1396 next_assoc:
1397                 it->stcb = LIST_NEXT(it->stcb, sctp_tcblist);
1398                 if (it->stcb == NULL) {
1399                         /* Run last function */
1400                         if (it->function_inp_end != NULL) {
1401                                 inp_skip = (*it->function_inp_end) (it->inp,
1402                                     it->pointer,
1403                                     it->val);
1404                         }
1405                 }
1406         }
1407         SCTP_INP_RUNLOCK(it->inp);
1408 no_stcb:
1409         /* done with all assocs on this endpoint, move on to next endpoint */
1410         it->done_current_ep = 0;
1411         if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1412                 it->inp = NULL;
1413         } else {
1414                 it->inp = LIST_NEXT(it->inp, sctp_list);
1415         }
1416         if (it->inp == NULL) {
1417                 goto done_with_iterator;
1418         }
1419         goto select_a_new_ep;
1420 }
1421
1422 void
1423 sctp_iterator_worker(void)
1424 {
1425         struct sctp_iterator *it, *nit;
1426
1427         /* This function is called with the WQ lock in place */
1428
1429         sctp_it_ctl.iterator_running = 1;
1430         TAILQ_FOREACH_SAFE(it, &sctp_it_ctl.iteratorhead, sctp_nxt_itr, nit) {
1431                 /* now lets work on this one */
1432                 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
1433                 SCTP_IPI_ITERATOR_WQ_UNLOCK();
1434                 CURVNET_SET(it->vn);
1435                 sctp_iterator_work(it);
1436                 CURVNET_RESTORE();
1437                 SCTP_IPI_ITERATOR_WQ_LOCK();
1438                 /* sa_ignore FREED_MEMORY */
1439         }
1440         sctp_it_ctl.iterator_running = 0;
1441         return;
1442 }
1443
1444
1445 static void
1446 sctp_handle_addr_wq(void)
1447 {
1448         /* deal with the ADDR wq from the rtsock calls */
1449         struct sctp_laddr *wi, *nwi;
1450         struct sctp_asconf_iterator *asc;
1451
1452         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
1453             sizeof(struct sctp_asconf_iterator), SCTP_M_ASC_IT);
1454         if (asc == NULL) {
1455                 /* Try later, no memory */
1456                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
1457                     (struct sctp_inpcb *)NULL,
1458                     (struct sctp_tcb *)NULL,
1459                     (struct sctp_nets *)NULL);
1460                 return;
1461         }
1462         LIST_INIT(&asc->list_of_work);
1463         asc->cnt = 0;
1464
1465         LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) {
1466                 LIST_REMOVE(wi, sctp_nxt_addr);
1467                 LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
1468                 asc->cnt++;
1469         }
1470
1471         if (asc->cnt == 0) {
1472                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1473         } else {
1474                 int ret;
1475
1476                 ret = sctp_initiate_iterator(sctp_asconf_iterator_ep,
1477                     sctp_asconf_iterator_stcb,
1478                     NULL,       /* No ep end for boundall */
1479                     SCTP_PCB_FLAGS_BOUNDALL,
1480                     SCTP_PCB_ANY_FEATURES,
1481                     SCTP_ASOC_ANY_STATE,
1482                     (void *)asc, 0,
1483                     sctp_asconf_iterator_end, NULL, 0);
1484                 if (ret) {
1485                         SCTP_PRINTF("Failed to initiate iterator for handle_addr_wq\n");
1486                         /*
1487                          * Freeing if we are stopping or put back on the
1488                          * addr_wq.
1489                          */
1490                         if (SCTP_BASE_VAR(sctp_pcb_initialized) == 0) {
1491                                 sctp_asconf_iterator_end(asc, 0);
1492                         } else {
1493                                 LIST_FOREACH(wi, &asc->list_of_work, sctp_nxt_addr) {
1494                                         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
1495                                 }
1496                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1497                         }
1498                 }
1499         }
1500 }
1501
1502 void
1503 sctp_timeout_handler(void *t)
1504 {
1505         struct sctp_inpcb *inp;
1506         struct sctp_tcb *stcb;
1507         struct sctp_nets *net;
1508         struct sctp_timer *tmr;
1509         struct mbuf *op_err;
1510 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1511         struct socket *so;
1512 #endif
1513         int did_output;
1514         int type;
1515
1516         tmr = (struct sctp_timer *)t;
1517         inp = (struct sctp_inpcb *)tmr->ep;
1518         stcb = (struct sctp_tcb *)tmr->tcb;
1519         net = (struct sctp_nets *)tmr->net;
1520         CURVNET_SET((struct vnet *)tmr->vnet);
1521         did_output = 1;
1522
1523 #ifdef SCTP_AUDITING_ENABLED
1524         sctp_audit_log(0xF0, (uint8_t)tmr->type);
1525         sctp_auditing(3, inp, stcb, net);
1526 #endif
1527
1528         /* sanity checks... */
1529         if (tmr->self != (void *)tmr) {
1530                 /*
1531                  * SCTP_PRINTF("Stale SCTP timer fired (%p), ignoring...\n",
1532                  * (void *)tmr);
1533                  */
1534                 CURVNET_RESTORE();
1535                 return;
1536         }
1537         tmr->stopped_from = 0xa001;
1538         if (!SCTP_IS_TIMER_TYPE_VALID(tmr->type)) {
1539                 /*
1540                  * SCTP_PRINTF("SCTP timer fired with invalid type: 0x%x\n",
1541                  * tmr->type);
1542                  */
1543                 CURVNET_RESTORE();
1544                 return;
1545         }
1546         tmr->stopped_from = 0xa002;
1547         if ((tmr->type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL)) {
1548                 CURVNET_RESTORE();
1549                 return;
1550         }
1551         /* if this is an iterator timeout, get the struct and clear inp */
1552         tmr->stopped_from = 0xa003;
1553         if (inp) {
1554                 SCTP_INP_INCR_REF(inp);
1555                 if ((inp->sctp_socket == NULL) &&
1556                     ((tmr->type != SCTP_TIMER_TYPE_INPKILL) &&
1557                     (tmr->type != SCTP_TIMER_TYPE_INIT) &&
1558                     (tmr->type != SCTP_TIMER_TYPE_SEND) &&
1559                     (tmr->type != SCTP_TIMER_TYPE_RECV) &&
1560                     (tmr->type != SCTP_TIMER_TYPE_HEARTBEAT) &&
1561                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWN) &&
1562                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNACK) &&
1563                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNGUARD) &&
1564                     (tmr->type != SCTP_TIMER_TYPE_ASOCKILL))) {
1565                         SCTP_INP_DECR_REF(inp);
1566                         CURVNET_RESTORE();
1567                         return;
1568                 }
1569         }
1570         tmr->stopped_from = 0xa004;
1571         if (stcb) {
1572                 atomic_add_int(&stcb->asoc.refcnt, 1);
1573                 if (stcb->asoc.state == 0) {
1574                         atomic_add_int(&stcb->asoc.refcnt, -1);
1575                         if (inp) {
1576                                 SCTP_INP_DECR_REF(inp);
1577                         }
1578                         CURVNET_RESTORE();
1579                         return;
1580                 }
1581         }
1582         type = tmr->type;
1583         tmr->stopped_from = 0xa005;
1584         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer type %d goes off\n", type);
1585         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1586                 if (inp) {
1587                         SCTP_INP_DECR_REF(inp);
1588                 }
1589                 if (stcb) {
1590                         atomic_add_int(&stcb->asoc.refcnt, -1);
1591                 }
1592                 CURVNET_RESTORE();
1593                 return;
1594         }
1595         tmr->stopped_from = 0xa006;
1596
1597         if (stcb) {
1598                 SCTP_TCB_LOCK(stcb);
1599                 atomic_add_int(&stcb->asoc.refcnt, -1);
1600                 if ((type != SCTP_TIMER_TYPE_ASOCKILL) &&
1601                     ((stcb->asoc.state == 0) ||
1602                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED))) {
1603                         SCTP_TCB_UNLOCK(stcb);
1604                         if (inp) {
1605                                 SCTP_INP_DECR_REF(inp);
1606                         }
1607                         CURVNET_RESTORE();
1608                         return;
1609                 }
1610         } else if (inp != NULL) {
1611                 if (type != SCTP_TIMER_TYPE_INPKILL) {
1612                         SCTP_INP_WLOCK(inp);
1613                 }
1614         } else {
1615                 SCTP_WQ_ADDR_LOCK();
1616         }
1617         /* record in stopped what t-o occurred */
1618         tmr->stopped_from = type;
1619
1620         /* mark as being serviced now */
1621         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
1622                 /*
1623                  * Callout has been rescheduled.
1624                  */
1625                 goto get_out;
1626         }
1627         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1628                 /*
1629                  * Not active, so no action.
1630                  */
1631                 goto get_out;
1632         }
1633         SCTP_OS_TIMER_DEACTIVATE(&tmr->timer);
1634
1635         /* call the handler for the appropriate timer type */
1636         switch (type) {
1637         case SCTP_TIMER_TYPE_ADDR_WQ:
1638                 sctp_handle_addr_wq();
1639                 break;
1640         case SCTP_TIMER_TYPE_SEND:
1641                 if ((stcb == NULL) || (inp == NULL)) {
1642                         break;
1643                 }
1644                 SCTP_STAT_INCR(sctps_timodata);
1645                 stcb->asoc.timodata++;
1646                 stcb->asoc.num_send_timers_up--;
1647                 if (stcb->asoc.num_send_timers_up < 0) {
1648                         stcb->asoc.num_send_timers_up = 0;
1649                 }
1650                 SCTP_TCB_LOCK_ASSERT(stcb);
1651                 if (sctp_t3rxt_timer(inp, stcb, net)) {
1652                         /* no need to unlock on tcb its gone */
1653
1654                         goto out_decr;
1655                 }
1656                 SCTP_TCB_LOCK_ASSERT(stcb);
1657 #ifdef SCTP_AUDITING_ENABLED
1658                 sctp_auditing(4, inp, stcb, net);
1659 #endif
1660                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1661                 if ((stcb->asoc.num_send_timers_up == 0) &&
1662                     (stcb->asoc.sent_queue_cnt > 0)) {
1663                         struct sctp_tmit_chunk *chk;
1664
1665                         /*
1666                          * safeguard. If there on some on the sent queue
1667                          * somewhere but no timers running something is
1668                          * wrong... so we start a timer on the first chunk
1669                          * on the send queue on whatever net it is sent to.
1670                          */
1671                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1672                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb,
1673                             chk->whoTo);
1674                 }
1675                 break;
1676         case SCTP_TIMER_TYPE_INIT:
1677                 if ((stcb == NULL) || (inp == NULL)) {
1678                         break;
1679                 }
1680                 SCTP_STAT_INCR(sctps_timoinit);
1681                 stcb->asoc.timoinit++;
1682                 if (sctp_t1init_timer(inp, stcb, net)) {
1683                         /* no need to unlock on tcb its gone */
1684                         goto out_decr;
1685                 }
1686                 /* We do output but not here */
1687                 did_output = 0;
1688                 break;
1689         case SCTP_TIMER_TYPE_RECV:
1690                 if ((stcb == NULL) || (inp == NULL)) {
1691                         break;
1692                 }
1693                 SCTP_STAT_INCR(sctps_timosack);
1694                 stcb->asoc.timosack++;
1695                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
1696 #ifdef SCTP_AUDITING_ENABLED
1697                 sctp_auditing(4, inp, stcb, net);
1698 #endif
1699                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR, SCTP_SO_NOT_LOCKED);
1700                 break;
1701         case SCTP_TIMER_TYPE_SHUTDOWN:
1702                 if ((stcb == NULL) || (inp == NULL)) {
1703                         break;
1704                 }
1705                 if (sctp_shutdown_timer(inp, stcb, net)) {
1706                         /* no need to unlock on tcb its gone */
1707                         goto out_decr;
1708                 }
1709                 SCTP_STAT_INCR(sctps_timoshutdown);
1710                 stcb->asoc.timoshutdown++;
1711 #ifdef SCTP_AUDITING_ENABLED
1712                 sctp_auditing(4, inp, stcb, net);
1713 #endif
1714                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_NOT_LOCKED);
1715                 break;
1716         case SCTP_TIMER_TYPE_HEARTBEAT:
1717                 if ((stcb == NULL) || (inp == NULL) || (net == NULL)) {
1718                         break;
1719                 }
1720                 SCTP_STAT_INCR(sctps_timoheartbeat);
1721                 stcb->asoc.timoheartbeat++;
1722                 if (sctp_heartbeat_timer(inp, stcb, net)) {
1723                         /* no need to unlock on tcb its gone */
1724                         goto out_decr;
1725                 }
1726 #ifdef SCTP_AUDITING_ENABLED
1727                 sctp_auditing(4, inp, stcb, net);
1728 #endif
1729                 if (!(net->dest_state & SCTP_ADDR_NOHB)) {
1730                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net);
1731                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR, SCTP_SO_NOT_LOCKED);
1732                 }
1733                 break;
1734         case SCTP_TIMER_TYPE_COOKIE:
1735                 if ((stcb == NULL) || (inp == NULL)) {
1736                         break;
1737                 }
1738                 if (sctp_cookie_timer(inp, stcb, net)) {
1739                         /* no need to unlock on tcb its gone */
1740                         goto out_decr;
1741                 }
1742                 SCTP_STAT_INCR(sctps_timocookie);
1743                 stcb->asoc.timocookie++;
1744 #ifdef SCTP_AUDITING_ENABLED
1745                 sctp_auditing(4, inp, stcb, net);
1746 #endif
1747                 /*
1748                  * We consider T3 and Cookie timer pretty much the same with
1749                  * respect to where from in chunk_output.
1750                  */
1751                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1752                 break;
1753         case SCTP_TIMER_TYPE_NEWCOOKIE:
1754                 {
1755                         struct timeval tv;
1756                         int i, secret;
1757
1758                         if (inp == NULL) {
1759                                 break;
1760                         }
1761                         SCTP_STAT_INCR(sctps_timosecret);
1762                         (void)SCTP_GETTIME_TIMEVAL(&tv);
1763                         inp->sctp_ep.time_of_secret_change = tv.tv_sec;
1764                         inp->sctp_ep.last_secret_number =
1765                             inp->sctp_ep.current_secret_number;
1766                         inp->sctp_ep.current_secret_number++;
1767                         if (inp->sctp_ep.current_secret_number >=
1768                             SCTP_HOW_MANY_SECRETS) {
1769                                 inp->sctp_ep.current_secret_number = 0;
1770                         }
1771                         secret = (int)inp->sctp_ep.current_secret_number;
1772                         for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1773                                 inp->sctp_ep.secret_key[secret][i] =
1774                                     sctp_select_initial_TSN(&inp->sctp_ep);
1775                         }
1776                         sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, stcb, net);
1777                 }
1778                 did_output = 0;
1779                 break;
1780         case SCTP_TIMER_TYPE_PATHMTURAISE:
1781                 if ((stcb == NULL) || (inp == NULL)) {
1782                         break;
1783                 }
1784                 SCTP_STAT_INCR(sctps_timopathmtu);
1785                 sctp_pathmtu_timer(inp, stcb, net);
1786                 did_output = 0;
1787                 break;
1788         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1789                 if ((stcb == NULL) || (inp == NULL)) {
1790                         break;
1791                 }
1792                 if (sctp_shutdownack_timer(inp, stcb, net)) {
1793                         /* no need to unlock on tcb its gone */
1794                         goto out_decr;
1795                 }
1796                 SCTP_STAT_INCR(sctps_timoshutdownack);
1797                 stcb->asoc.timoshutdownack++;
1798 #ifdef SCTP_AUDITING_ENABLED
1799                 sctp_auditing(4, inp, stcb, net);
1800 #endif
1801                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR, SCTP_SO_NOT_LOCKED);
1802                 break;
1803         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1804                 if ((stcb == NULL) || (inp == NULL)) {
1805                         break;
1806                 }
1807                 SCTP_STAT_INCR(sctps_timoshutdownguard);
1808                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
1809                     "Shutdown guard timer expired");
1810                 sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
1811                 /* no need to unlock on tcb its gone */
1812                 goto out_decr;
1813
1814         case SCTP_TIMER_TYPE_STRRESET:
1815                 if ((stcb == NULL) || (inp == NULL)) {
1816                         break;
1817                 }
1818                 if (sctp_strreset_timer(inp, stcb, net)) {
1819                         /* no need to unlock on tcb its gone */
1820                         goto out_decr;
1821                 }
1822                 SCTP_STAT_INCR(sctps_timostrmrst);
1823                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR, SCTP_SO_NOT_LOCKED);
1824                 break;
1825         case SCTP_TIMER_TYPE_ASCONF:
1826                 if ((stcb == NULL) || (inp == NULL)) {
1827                         break;
1828                 }
1829                 if (sctp_asconf_timer(inp, stcb, net)) {
1830                         /* no need to unlock on tcb its gone */
1831                         goto out_decr;
1832                 }
1833                 SCTP_STAT_INCR(sctps_timoasconf);
1834 #ifdef SCTP_AUDITING_ENABLED
1835                 sctp_auditing(4, inp, stcb, net);
1836 #endif
1837                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR, SCTP_SO_NOT_LOCKED);
1838                 break;
1839         case SCTP_TIMER_TYPE_PRIM_DELETED:
1840                 if ((stcb == NULL) || (inp == NULL)) {
1841                         break;
1842                 }
1843                 sctp_delete_prim_timer(inp, stcb, net);
1844                 SCTP_STAT_INCR(sctps_timodelprim);
1845                 break;
1846
1847         case SCTP_TIMER_TYPE_AUTOCLOSE:
1848                 if ((stcb == NULL) || (inp == NULL)) {
1849                         break;
1850                 }
1851                 SCTP_STAT_INCR(sctps_timoautoclose);
1852                 sctp_autoclose_timer(inp, stcb, net);
1853                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED);
1854                 did_output = 0;
1855                 break;
1856         case SCTP_TIMER_TYPE_ASOCKILL:
1857                 if ((stcb == NULL) || (inp == NULL)) {
1858                         break;
1859                 }
1860                 SCTP_STAT_INCR(sctps_timoassockill);
1861                 /* Can we free it yet? */
1862                 SCTP_INP_DECR_REF(inp);
1863                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL,
1864                     SCTP_FROM_SCTPUTIL + SCTP_LOC_1);
1865 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1866                 so = SCTP_INP_SO(inp);
1867                 atomic_add_int(&stcb->asoc.refcnt, 1);
1868                 SCTP_TCB_UNLOCK(stcb);
1869                 SCTP_SOCKET_LOCK(so, 1);
1870                 SCTP_TCB_LOCK(stcb);
1871                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1872 #endif
1873                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
1874                     SCTP_FROM_SCTPUTIL + SCTP_LOC_2);
1875 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1876                 SCTP_SOCKET_UNLOCK(so, 1);
1877 #endif
1878                 /*
1879                  * free asoc, always unlocks (or destroy's) so prevent
1880                  * duplicate unlock or unlock of a free mtx :-0
1881                  */
1882                 stcb = NULL;
1883                 goto out_no_decr;
1884         case SCTP_TIMER_TYPE_INPKILL:
1885                 SCTP_STAT_INCR(sctps_timoinpkill);
1886                 if (inp == NULL) {
1887                         break;
1888                 }
1889                 /*
1890                  * special case, take away our increment since WE are the
1891                  * killer
1892                  */
1893                 SCTP_INP_DECR_REF(inp);
1894                 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL,
1895                     SCTP_FROM_SCTPUTIL + SCTP_LOC_3);
1896                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
1897                     SCTP_CALLED_FROM_INPKILL_TIMER);
1898                 inp = NULL;
1899                 goto out_no_decr;
1900         default:
1901                 SCTPDBG(SCTP_DEBUG_TIMER1, "sctp_timeout_handler:unknown timer %d\n",
1902                     type);
1903                 break;
1904         }
1905 #ifdef SCTP_AUDITING_ENABLED
1906         sctp_audit_log(0xF1, (uint8_t)type);
1907         if (inp)
1908                 sctp_auditing(5, inp, stcb, net);
1909 #endif
1910         if ((did_output) && stcb) {
1911                 /*
1912                  * Now we need to clean up the control chunk chain if an
1913                  * ECNE is on it. It must be marked as UNSENT again so next
1914                  * call will continue to send it until such time that we get
1915                  * a CWR, to remove it. It is, however, less likely that we
1916                  * will find a ecn echo on the chain though.
1917                  */
1918                 sctp_fix_ecn_echo(&stcb->asoc);
1919         }
1920 get_out:
1921         if (stcb) {
1922                 SCTP_TCB_UNLOCK(stcb);
1923         } else if (inp != NULL) {
1924                 SCTP_INP_WUNLOCK(inp);
1925         } else {
1926                 SCTP_WQ_ADDR_UNLOCK();
1927         }
1928
1929 out_decr:
1930         if (inp) {
1931                 SCTP_INP_DECR_REF(inp);
1932         }
1933 out_no_decr:
1934         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer now complete (type = %d)\n", type);
1935         CURVNET_RESTORE();
1936 }
1937
1938 void
1939 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1940     struct sctp_nets *net)
1941 {
1942         uint32_t to_ticks;
1943         struct sctp_timer *tmr;
1944
1945         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL))
1946                 return;
1947
1948         tmr = NULL;
1949         if (stcb) {
1950                 SCTP_TCB_LOCK_ASSERT(stcb);
1951         }
1952         switch (t_type) {
1953         case SCTP_TIMER_TYPE_ADDR_WQ:
1954                 /* Only 1 tick away :-) */
1955                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
1956                 to_ticks = SCTP_ADDRESS_TICK_DELAY;
1957                 break;
1958         case SCTP_TIMER_TYPE_SEND:
1959                 /* Here we use the RTO timer */
1960                 {
1961                         int rto_val;
1962
1963                         if ((stcb == NULL) || (net == NULL)) {
1964                                 return;
1965                         }
1966                         tmr = &net->rxt_timer;
1967                         if (net->RTO == 0) {
1968                                 rto_val = stcb->asoc.initial_rto;
1969                         } else {
1970                                 rto_val = net->RTO;
1971                         }
1972                         to_ticks = MSEC_TO_TICKS(rto_val);
1973                 }
1974                 break;
1975         case SCTP_TIMER_TYPE_INIT:
1976                 /*
1977                  * Here we use the INIT timer default usually about 1
1978                  * minute.
1979                  */
1980                 if ((stcb == NULL) || (net == NULL)) {
1981                         return;
1982                 }
1983                 tmr = &net->rxt_timer;
1984                 if (net->RTO == 0) {
1985                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1986                 } else {
1987                         to_ticks = MSEC_TO_TICKS(net->RTO);
1988                 }
1989                 break;
1990         case SCTP_TIMER_TYPE_RECV:
1991                 /*
1992                  * Here we use the Delayed-Ack timer value from the inp
1993                  * ususually about 200ms.
1994                  */
1995                 if (stcb == NULL) {
1996                         return;
1997                 }
1998                 tmr = &stcb->asoc.dack_timer;
1999                 to_ticks = MSEC_TO_TICKS(stcb->asoc.delayed_ack);
2000                 break;
2001         case SCTP_TIMER_TYPE_SHUTDOWN:
2002                 /* Here we use the RTO of the destination. */
2003                 if ((stcb == NULL) || (net == NULL)) {
2004                         return;
2005                 }
2006                 if (net->RTO == 0) {
2007                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2008                 } else {
2009                         to_ticks = MSEC_TO_TICKS(net->RTO);
2010                 }
2011                 tmr = &net->rxt_timer;
2012                 break;
2013         case SCTP_TIMER_TYPE_HEARTBEAT:
2014                 /*
2015                  * the net is used here so that we can add in the RTO. Even
2016                  * though we use a different timer. We also add the HB timer
2017                  * PLUS a random jitter.
2018                  */
2019                 if ((stcb == NULL) || (net == NULL)) {
2020                         return;
2021                 } else {
2022                         uint32_t rndval;
2023                         uint32_t jitter;
2024
2025                         if ((net->dest_state & SCTP_ADDR_NOHB) &&
2026                             !(net->dest_state & SCTP_ADDR_UNCONFIRMED)) {
2027                                 return;
2028                         }
2029                         if (net->RTO == 0) {
2030                                 to_ticks = stcb->asoc.initial_rto;
2031                         } else {
2032                                 to_ticks = net->RTO;
2033                         }
2034                         rndval = sctp_select_initial_TSN(&inp->sctp_ep);
2035                         jitter = rndval % to_ticks;
2036                         if (jitter >= (to_ticks >> 1)) {
2037                                 to_ticks = to_ticks + (jitter - (to_ticks >> 1));
2038                         } else {
2039                                 to_ticks = to_ticks - jitter;
2040                         }
2041                         if (!(net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
2042                             !(net->dest_state & SCTP_ADDR_PF)) {
2043                                 to_ticks += net->heart_beat_delay;
2044                         }
2045                         /*
2046                          * Now we must convert the to_ticks that are now in
2047                          * ms to ticks.
2048                          */
2049                         to_ticks = MSEC_TO_TICKS(to_ticks);
2050                         tmr = &net->hb_timer;
2051                 }
2052                 break;
2053         case SCTP_TIMER_TYPE_COOKIE:
2054                 /*
2055                  * Here we can use the RTO timer from the network since one
2056                  * RTT was compelete. If a retran happened then we will be
2057                  * using the RTO initial value.
2058                  */
2059                 if ((stcb == NULL) || (net == NULL)) {
2060                         return;
2061                 }
2062                 if (net->RTO == 0) {
2063                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2064                 } else {
2065                         to_ticks = MSEC_TO_TICKS(net->RTO);
2066                 }
2067                 tmr = &net->rxt_timer;
2068                 break;
2069         case SCTP_TIMER_TYPE_NEWCOOKIE:
2070                 /*
2071                  * nothing needed but the endpoint here ususually about 60
2072                  * minutes.
2073                  */
2074                 tmr = &inp->sctp_ep.signature_change;
2075                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE];
2076                 break;
2077         case SCTP_TIMER_TYPE_ASOCKILL:
2078                 if (stcb == NULL) {
2079                         return;
2080                 }
2081                 tmr = &stcb->asoc.strreset_timer;
2082                 to_ticks = MSEC_TO_TICKS(SCTP_ASOC_KILL_TIMEOUT);
2083                 break;
2084         case SCTP_TIMER_TYPE_INPKILL:
2085                 /*
2086                  * The inp is setup to die. We re-use the signature_chage
2087                  * timer since that has stopped and we are in the GONE
2088                  * state.
2089                  */
2090                 tmr = &inp->sctp_ep.signature_change;
2091                 to_ticks = MSEC_TO_TICKS(SCTP_INP_KILL_TIMEOUT);
2092                 break;
2093         case SCTP_TIMER_TYPE_PATHMTURAISE:
2094                 /*
2095                  * Here we use the value found in the EP for PMTU ususually
2096                  * about 10 minutes.
2097                  */
2098                 if ((stcb == NULL) || (net == NULL)) {
2099                         return;
2100                 }
2101                 if (net->dest_state & SCTP_ADDR_NO_PMTUD) {
2102                         return;
2103                 }
2104                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU];
2105                 tmr = &net->pmtu_timer;
2106                 break;
2107         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2108                 /* Here we use the RTO of the destination */
2109                 if ((stcb == NULL) || (net == NULL)) {
2110                         return;
2111                 }
2112                 if (net->RTO == 0) {
2113                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2114                 } else {
2115                         to_ticks = MSEC_TO_TICKS(net->RTO);
2116                 }
2117                 tmr = &net->rxt_timer;
2118                 break;
2119         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2120                 /*
2121                  * Here we use the endpoints shutdown guard timer usually
2122                  * about 3 minutes.
2123                  */
2124                 if (stcb == NULL) {
2125                         return;
2126                 }
2127                 if (inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] == 0) {
2128                         to_ticks = 5 * MSEC_TO_TICKS(stcb->asoc.maxrto);
2129                 } else {
2130                         to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN];
2131                 }
2132                 tmr = &stcb->asoc.shut_guard_timer;
2133                 break;
2134         case SCTP_TIMER_TYPE_STRRESET:
2135                 /*
2136                  * Here the timer comes from the stcb but its value is from
2137                  * the net's RTO.
2138                  */
2139                 if ((stcb == NULL) || (net == NULL)) {
2140                         return;
2141                 }
2142                 if (net->RTO == 0) {
2143                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2144                 } else {
2145                         to_ticks = MSEC_TO_TICKS(net->RTO);
2146                 }
2147                 tmr = &stcb->asoc.strreset_timer;
2148                 break;
2149         case SCTP_TIMER_TYPE_ASCONF:
2150                 /*
2151                  * Here the timer comes from the stcb but its value is from
2152                  * the net's RTO.
2153                  */
2154                 if ((stcb == NULL) || (net == NULL)) {
2155                         return;
2156                 }
2157                 if (net->RTO == 0) {
2158                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2159                 } else {
2160                         to_ticks = MSEC_TO_TICKS(net->RTO);
2161                 }
2162                 tmr = &stcb->asoc.asconf_timer;
2163                 break;
2164         case SCTP_TIMER_TYPE_PRIM_DELETED:
2165                 if ((stcb == NULL) || (net != NULL)) {
2166                         return;
2167                 }
2168                 to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2169                 tmr = &stcb->asoc.delete_prim_timer;
2170                 break;
2171         case SCTP_TIMER_TYPE_AUTOCLOSE:
2172                 if (stcb == NULL) {
2173                         return;
2174                 }
2175                 if (stcb->asoc.sctp_autoclose_ticks == 0) {
2176                         /*
2177                          * Really an error since stcb is NOT set to
2178                          * autoclose
2179                          */
2180                         return;
2181                 }
2182                 to_ticks = stcb->asoc.sctp_autoclose_ticks;
2183                 tmr = &stcb->asoc.autoclose_timer;
2184                 break;
2185         default:
2186                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2187                     __func__, t_type);
2188                 return;
2189                 break;
2190         }
2191         if ((to_ticks <= 0) || (tmr == NULL)) {
2192                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: %d:software error to_ticks:%d tmr:%p not set ??\n",
2193                     __func__, t_type, to_ticks, (void *)tmr);
2194                 return;
2195         }
2196         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
2197                 /*
2198                  * we do NOT allow you to have it already running. if it is
2199                  * we leave the current one up unchanged
2200                  */
2201                 return;
2202         }
2203         /* At this point we can proceed */
2204         if (t_type == SCTP_TIMER_TYPE_SEND) {
2205                 stcb->asoc.num_send_timers_up++;
2206         }
2207         tmr->stopped_from = 0;
2208         tmr->type = t_type;
2209         tmr->ep = (void *)inp;
2210         tmr->tcb = (void *)stcb;
2211         tmr->net = (void *)net;
2212         tmr->self = (void *)tmr;
2213         tmr->vnet = (void *)curvnet;
2214         tmr->ticks = sctp_get_tick_count();
2215         (void)SCTP_OS_TIMER_START(&tmr->timer, to_ticks, sctp_timeout_handler, tmr);
2216         return;
2217 }
2218
2219 void
2220 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2221     struct sctp_nets *net, uint32_t from)
2222 {
2223         struct sctp_timer *tmr;
2224
2225         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) &&
2226             (inp == NULL))
2227                 return;
2228
2229         tmr = NULL;
2230         if (stcb) {
2231                 SCTP_TCB_LOCK_ASSERT(stcb);
2232         }
2233         switch (t_type) {
2234         case SCTP_TIMER_TYPE_ADDR_WQ:
2235                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2236                 break;
2237         case SCTP_TIMER_TYPE_SEND:
2238                 if ((stcb == NULL) || (net == NULL)) {
2239                         return;
2240                 }
2241                 tmr = &net->rxt_timer;
2242                 break;
2243         case SCTP_TIMER_TYPE_INIT:
2244                 if ((stcb == NULL) || (net == NULL)) {
2245                         return;
2246                 }
2247                 tmr = &net->rxt_timer;
2248                 break;
2249         case SCTP_TIMER_TYPE_RECV:
2250                 if (stcb == NULL) {
2251                         return;
2252                 }
2253                 tmr = &stcb->asoc.dack_timer;
2254                 break;
2255         case SCTP_TIMER_TYPE_SHUTDOWN:
2256                 if ((stcb == NULL) || (net == NULL)) {
2257                         return;
2258                 }
2259                 tmr = &net->rxt_timer;
2260                 break;
2261         case SCTP_TIMER_TYPE_HEARTBEAT:
2262                 if ((stcb == NULL) || (net == NULL)) {
2263                         return;
2264                 }
2265                 tmr = &net->hb_timer;
2266                 break;
2267         case SCTP_TIMER_TYPE_COOKIE:
2268                 if ((stcb == NULL) || (net == NULL)) {
2269                         return;
2270                 }
2271                 tmr = &net->rxt_timer;
2272                 break;
2273         case SCTP_TIMER_TYPE_NEWCOOKIE:
2274                 /* nothing needed but the endpoint here */
2275                 tmr = &inp->sctp_ep.signature_change;
2276                 /*
2277                  * We re-use the newcookie timer for the INP kill timer. We
2278                  * must assure that we do not kill it by accident.
2279                  */
2280                 break;
2281         case SCTP_TIMER_TYPE_ASOCKILL:
2282                 /*
2283                  * Stop the asoc kill timer.
2284                  */
2285                 if (stcb == NULL) {
2286                         return;
2287                 }
2288                 tmr = &stcb->asoc.strreset_timer;
2289                 break;
2290
2291         case SCTP_TIMER_TYPE_INPKILL:
2292                 /*
2293                  * The inp is setup to die. We re-use the signature_chage
2294                  * timer since that has stopped and we are in the GONE
2295                  * state.
2296                  */
2297                 tmr = &inp->sctp_ep.signature_change;
2298                 break;
2299         case SCTP_TIMER_TYPE_PATHMTURAISE:
2300                 if ((stcb == NULL) || (net == NULL)) {
2301                         return;
2302                 }
2303                 tmr = &net->pmtu_timer;
2304                 break;
2305         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2306                 if ((stcb == NULL) || (net == NULL)) {
2307                         return;
2308                 }
2309                 tmr = &net->rxt_timer;
2310                 break;
2311         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2312                 if (stcb == NULL) {
2313                         return;
2314                 }
2315                 tmr = &stcb->asoc.shut_guard_timer;
2316                 break;
2317         case SCTP_TIMER_TYPE_STRRESET:
2318                 if (stcb == NULL) {
2319                         return;
2320                 }
2321                 tmr = &stcb->asoc.strreset_timer;
2322                 break;
2323         case SCTP_TIMER_TYPE_ASCONF:
2324                 if (stcb == NULL) {
2325                         return;
2326                 }
2327                 tmr = &stcb->asoc.asconf_timer;
2328                 break;
2329         case SCTP_TIMER_TYPE_PRIM_DELETED:
2330                 if (stcb == NULL) {
2331                         return;
2332                 }
2333                 tmr = &stcb->asoc.delete_prim_timer;
2334                 break;
2335         case SCTP_TIMER_TYPE_AUTOCLOSE:
2336                 if (stcb == NULL) {
2337                         return;
2338                 }
2339                 tmr = &stcb->asoc.autoclose_timer;
2340                 break;
2341         default:
2342                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2343                     __func__, t_type);
2344                 break;
2345         }
2346         if (tmr == NULL) {
2347                 return;
2348         }
2349         if ((tmr->type != t_type) && tmr->type) {
2350                 /*
2351                  * Ok we have a timer that is under joint use. Cookie timer
2352                  * per chance with the SEND timer. We therefore are NOT
2353                  * running the timer that the caller wants stopped.  So just
2354                  * return.
2355                  */
2356                 return;
2357         }
2358         if ((t_type == SCTP_TIMER_TYPE_SEND) && (stcb != NULL)) {
2359                 stcb->asoc.num_send_timers_up--;
2360                 if (stcb->asoc.num_send_timers_up < 0) {
2361                         stcb->asoc.num_send_timers_up = 0;
2362                 }
2363         }
2364         tmr->self = NULL;
2365         tmr->stopped_from = from;
2366         (void)SCTP_OS_TIMER_STOP(&tmr->timer);
2367         return;
2368 }
2369
2370 uint32_t
2371 sctp_calculate_len(struct mbuf *m)
2372 {
2373         uint32_t tlen = 0;
2374         struct mbuf *at;
2375
2376         at = m;
2377         while (at) {
2378                 tlen += SCTP_BUF_LEN(at);
2379                 at = SCTP_BUF_NEXT(at);
2380         }
2381         return (tlen);
2382 }
2383
2384 void
2385 sctp_mtu_size_reset(struct sctp_inpcb *inp,
2386     struct sctp_association *asoc, uint32_t mtu)
2387 {
2388         /*
2389          * Reset the P-MTU size on this association, this involves changing
2390          * the asoc MTU, going through ANY chunk+overhead larger than mtu to
2391          * allow the DF flag to be cleared.
2392          */
2393         struct sctp_tmit_chunk *chk;
2394         unsigned int eff_mtu, ovh;
2395
2396         asoc->smallest_mtu = mtu;
2397         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2398                 ovh = SCTP_MIN_OVERHEAD;
2399         } else {
2400                 ovh = SCTP_MIN_V4_OVERHEAD;
2401         }
2402         eff_mtu = mtu - ovh;
2403         TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
2404                 if (chk->send_size > eff_mtu) {
2405                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2406                 }
2407         }
2408         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
2409                 if (chk->send_size > eff_mtu) {
2410                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2411                 }
2412         }
2413 }
2414
2415
2416 /*
2417  * given an association and starting time of the current RTT period return
2418  * RTO in number of msecs net should point to the current network
2419  */
2420
2421 uint32_t
2422 sctp_calculate_rto(struct sctp_tcb *stcb,
2423     struct sctp_association *asoc,
2424     struct sctp_nets *net,
2425     struct timeval *told,
2426     int safe, int rtt_from_sack)
2427 {
2428         /*-
2429          * given an association and the starting time of the current RTT
2430          * period (in value1/value2) return RTO in number of msecs.
2431          */
2432         int32_t rtt;            /* RTT in ms */
2433         uint32_t new_rto;
2434         int first_measure = 0;
2435         struct timeval now, then, *old;
2436
2437         /* Copy it out for sparc64 */
2438         if (safe == sctp_align_unsafe_makecopy) {
2439                 old = &then;
2440                 memcpy(&then, told, sizeof(struct timeval));
2441         } else if (safe == sctp_align_safe_nocopy) {
2442                 old = told;
2443         } else {
2444                 /* error */
2445                 SCTP_PRINTF("Huh, bad rto calc call\n");
2446                 return (0);
2447         }
2448         /************************/
2449         /* 1. calculate new RTT */
2450         /************************/
2451         /* get the current time */
2452         if (stcb->asoc.use_precise_time) {
2453                 (void)SCTP_GETPTIME_TIMEVAL(&now);
2454         } else {
2455                 (void)SCTP_GETTIME_TIMEVAL(&now);
2456         }
2457         timevalsub(&now, old);
2458         /* store the current RTT in us */
2459         net->rtt = (uint64_t)1000000 *(uint64_t)now.tv_sec +
2460                 (uint64_t)now.tv_usec;
2461
2462         /* compute rtt in ms */
2463         rtt = (int32_t)(net->rtt / 1000);
2464         if ((asoc->cc_functions.sctp_rtt_calculated) && (rtt_from_sack == SCTP_RTT_FROM_DATA)) {
2465                 /*
2466                  * Tell the CC module that a new update has just occurred
2467                  * from a sack
2468                  */
2469                 (*asoc->cc_functions.sctp_rtt_calculated) (stcb, net, &now);
2470         }
2471         /*
2472          * Do we need to determine the lan? We do this only on sacks i.e.
2473          * RTT being determined from data not non-data (HB/INIT->INITACK).
2474          */
2475         if ((rtt_from_sack == SCTP_RTT_FROM_DATA) &&
2476             (net->lan_type == SCTP_LAN_UNKNOWN)) {
2477                 if (net->rtt > SCTP_LOCAL_LAN_RTT) {
2478                         net->lan_type = SCTP_LAN_INTERNET;
2479                 } else {
2480                         net->lan_type = SCTP_LAN_LOCAL;
2481                 }
2482         }
2483         /***************************/
2484         /* 2. update RTTVAR & SRTT */
2485         /***************************/
2486         /*-
2487          * Compute the scaled average lastsa and the
2488          * scaled variance lastsv as described in van Jacobson
2489          * Paper "Congestion Avoidance and Control", Annex A.
2490          *
2491          * (net->lastsa >> SCTP_RTT_SHIFT) is the srtt
2492          * (net->lastsa >> SCTP_RTT_VAR_SHIFT) is the rttvar
2493          */
2494         if (net->RTO_measured) {
2495                 rtt -= (net->lastsa >> SCTP_RTT_SHIFT);
2496                 net->lastsa += rtt;
2497                 if (rtt < 0) {
2498                         rtt = -rtt;
2499                 }
2500                 rtt -= (net->lastsv >> SCTP_RTT_VAR_SHIFT);
2501                 net->lastsv += rtt;
2502                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2503                         rto_logging(net, SCTP_LOG_RTTVAR);
2504                 }
2505         } else {
2506                 /* First RTO measurment */
2507                 net->RTO_measured = 1;
2508                 first_measure = 1;
2509                 net->lastsa = rtt << SCTP_RTT_SHIFT;
2510                 net->lastsv = (rtt / 2) << SCTP_RTT_VAR_SHIFT;
2511                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2512                         rto_logging(net, SCTP_LOG_INITIAL_RTT);
2513                 }
2514         }
2515         if (net->lastsv == 0) {
2516                 net->lastsv = SCTP_CLOCK_GRANULARITY;
2517         }
2518         new_rto = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
2519         if ((new_rto > SCTP_SAT_NETWORK_MIN) &&
2520             (stcb->asoc.sat_network_lockout == 0)) {
2521                 stcb->asoc.sat_network = 1;
2522         } else if ((!first_measure) && stcb->asoc.sat_network) {
2523                 stcb->asoc.sat_network = 0;
2524                 stcb->asoc.sat_network_lockout = 1;
2525         }
2526         /* bound it, per C6/C7 in Section 5.3.1 */
2527         if (new_rto < stcb->asoc.minrto) {
2528                 new_rto = stcb->asoc.minrto;
2529         }
2530         if (new_rto > stcb->asoc.maxrto) {
2531                 new_rto = stcb->asoc.maxrto;
2532         }
2533         /* we are now returning the RTO */
2534         return (new_rto);
2535 }
2536
2537 /*
2538  * return a pointer to a contiguous piece of data from the given mbuf chain
2539  * starting at 'off' for 'len' bytes.  If the desired piece spans more than
2540  * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size
2541  * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain.
2542  */
2543 caddr_t
2544 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t *in_ptr)
2545 {
2546         uint32_t count;
2547         uint8_t *ptr;
2548
2549         ptr = in_ptr;
2550         if ((off < 0) || (len <= 0))
2551                 return (NULL);
2552
2553         /* find the desired start location */
2554         while ((m != NULL) && (off > 0)) {
2555                 if (off < SCTP_BUF_LEN(m))
2556                         break;
2557                 off -= SCTP_BUF_LEN(m);
2558                 m = SCTP_BUF_NEXT(m);
2559         }
2560         if (m == NULL)
2561                 return (NULL);
2562
2563         /* is the current mbuf large enough (eg. contiguous)? */
2564         if ((SCTP_BUF_LEN(m) - off) >= len) {
2565                 return (mtod(m, caddr_t)+off);
2566         } else {
2567                 /* else, it spans more than one mbuf, so save a temp copy... */
2568                 while ((m != NULL) && (len > 0)) {
2569                         count = min(SCTP_BUF_LEN(m) - off, len);
2570                         memcpy(ptr, mtod(m, caddr_t)+off, count);
2571                         len -= count;
2572                         ptr += count;
2573                         off = 0;
2574                         m = SCTP_BUF_NEXT(m);
2575                 }
2576                 if ((m == NULL) && (len > 0))
2577                         return (NULL);
2578                 else
2579                         return ((caddr_t)in_ptr);
2580         }
2581 }
2582
2583
2584
2585 struct sctp_paramhdr *
2586 sctp_get_next_param(struct mbuf *m,
2587     int offset,
2588     struct sctp_paramhdr *pull,
2589     int pull_limit)
2590 {
2591         /* This just provides a typed signature to Peter's Pull routine */
2592         return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit,
2593             (uint8_t *)pull));
2594 }
2595
2596
2597 struct mbuf *
2598 sctp_add_pad_tombuf(struct mbuf *m, int padlen)
2599 {
2600         struct mbuf *m_last;
2601         caddr_t dp;
2602
2603         if (padlen > 3) {
2604                 return (NULL);
2605         }
2606         if (padlen <= M_TRAILINGSPACE(m)) {
2607                 /*
2608                  * The easy way. We hope the majority of the time we hit
2609                  * here :)
2610                  */
2611                 m_last = m;
2612         } else {
2613                 /* Hard way we must grow the mbuf chain */
2614                 m_last = sctp_get_mbuf_for_msg(padlen, 0, M_NOWAIT, 1, MT_DATA);
2615                 if (m_last == NULL) {
2616                         return (NULL);
2617                 }
2618                 SCTP_BUF_LEN(m_last) = 0;
2619                 SCTP_BUF_NEXT(m_last) = NULL;
2620                 SCTP_BUF_NEXT(m) = m_last;
2621         }
2622         dp = mtod(m_last, caddr_t)+SCTP_BUF_LEN(m_last);
2623         SCTP_BUF_LEN(m_last) += padlen;
2624         memset(dp, 0, padlen);
2625         return (m_last);
2626 }
2627
2628 struct mbuf *
2629 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf)
2630 {
2631         /* find the last mbuf in chain and pad it */
2632         struct mbuf *m_at;
2633
2634         if (last_mbuf != NULL) {
2635                 return (sctp_add_pad_tombuf(last_mbuf, padval));
2636         } else {
2637                 for (m_at = m; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
2638                         if (SCTP_BUF_NEXT(m_at) == NULL) {
2639                                 return (sctp_add_pad_tombuf(m_at, padval));
2640                         }
2641                 }
2642         }
2643         return (NULL);
2644 }
2645
2646 static void
2647 sctp_notify_assoc_change(uint16_t state, struct sctp_tcb *stcb,
2648     uint16_t error, struct sctp_abort_chunk *abort, uint8_t from_peer, int so_locked
2649 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2650     SCTP_UNUSED
2651 #endif
2652 )
2653 {
2654         struct mbuf *m_notify;
2655         struct sctp_assoc_change *sac;
2656         struct sctp_queued_to_read *control;
2657         unsigned int notif_len;
2658         uint16_t abort_len;
2659         unsigned int i;
2660 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2661         struct socket *so;
2662 #endif
2663
2664         if (stcb == NULL) {
2665                 return;
2666         }
2667         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVASSOCEVNT)) {
2668                 notif_len = (unsigned int)sizeof(struct sctp_assoc_change);
2669                 if (abort != NULL) {
2670                         abort_len = ntohs(abort->ch.chunk_length);
2671                 } else {
2672                         abort_len = 0;
2673                 }
2674                 if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
2675                         notif_len += SCTP_ASSOC_SUPPORTS_MAX;
2676                 } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
2677                         notif_len += abort_len;
2678                 }
2679                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
2680                 if (m_notify == NULL) {
2681                         /* Retry with smaller value. */
2682                         notif_len = (unsigned int)sizeof(struct sctp_assoc_change);
2683                         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
2684                         if (m_notify == NULL) {
2685                                 goto set_error;
2686                         }
2687                 }
2688                 SCTP_BUF_NEXT(m_notify) = NULL;
2689                 sac = mtod(m_notify, struct sctp_assoc_change *);
2690                 memset(sac, 0, notif_len);
2691                 sac->sac_type = SCTP_ASSOC_CHANGE;
2692                 sac->sac_flags = 0;
2693                 sac->sac_length = sizeof(struct sctp_assoc_change);
2694                 sac->sac_state = state;
2695                 sac->sac_error = error;
2696                 /* XXX verify these stream counts */
2697                 sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
2698                 sac->sac_inbound_streams = stcb->asoc.streamincnt;
2699                 sac->sac_assoc_id = sctp_get_associd(stcb);
2700                 if (notif_len > sizeof(struct sctp_assoc_change)) {
2701                         if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
2702                                 i = 0;
2703                                 if (stcb->asoc.prsctp_supported == 1) {
2704                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_PR;
2705                                 }
2706                                 if (stcb->asoc.auth_supported == 1) {
2707                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_AUTH;
2708                                 }
2709                                 if (stcb->asoc.asconf_supported == 1) {
2710                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_ASCONF;
2711                                 }
2712                                 if (stcb->asoc.idata_supported == 1) {
2713                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_INTERLEAVING;
2714                                 }
2715                                 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_MULTIBUF;
2716                                 if (stcb->asoc.reconfig_supported == 1) {
2717                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_RE_CONFIG;
2718                                 }
2719                                 sac->sac_length += i;
2720                         } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
2721                                 memcpy(sac->sac_info, abort, abort_len);
2722                                 sac->sac_length += abort_len;
2723                         }
2724                 }
2725                 SCTP_BUF_LEN(m_notify) = sac->sac_length;
2726                 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2727                     0, 0, stcb->asoc.context, 0, 0, 0,
2728                     m_notify);
2729                 if (control != NULL) {
2730                         control->length = SCTP_BUF_LEN(m_notify);
2731                         control->spec_flags = M_NOTIFICATION;
2732                         /* not that we need this */
2733                         control->tail_mbuf = m_notify;
2734                         sctp_add_to_readq(stcb->sctp_ep, stcb,
2735                             control,
2736                             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD,
2737                             so_locked);
2738                 } else {
2739                         sctp_m_freem(m_notify);
2740                 }
2741         }
2742         /*
2743          * For 1-to-1 style sockets, we send up and error when an ABORT
2744          * comes in.
2745          */
2746 set_error:
2747         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2748             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2749             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
2750                 SOCK_LOCK(stcb->sctp_socket);
2751                 if (from_peer) {
2752                         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) {
2753                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNREFUSED);
2754                                 stcb->sctp_socket->so_error = ECONNREFUSED;
2755                         } else {
2756                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
2757                                 stcb->sctp_socket->so_error = ECONNRESET;
2758                         }
2759                 } else {
2760                         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) ||
2761                             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) {
2762                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ETIMEDOUT);
2763                                 stcb->sctp_socket->so_error = ETIMEDOUT;
2764                         } else {
2765                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNABORTED);
2766                                 stcb->sctp_socket->so_error = ECONNABORTED;
2767                         }
2768                 }
2769         }
2770         /* Wake ANY sleepers */
2771 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2772         so = SCTP_INP_SO(stcb->sctp_ep);
2773         if (!so_locked) {
2774                 atomic_add_int(&stcb->asoc.refcnt, 1);
2775                 SCTP_TCB_UNLOCK(stcb);
2776                 SCTP_SOCKET_LOCK(so, 1);
2777                 SCTP_TCB_LOCK(stcb);
2778                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2779                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2780                         SCTP_SOCKET_UNLOCK(so, 1);
2781                         return;
2782                 }
2783         }
2784 #endif
2785         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2786             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2787             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
2788                 socantrcvmore_locked(stcb->sctp_socket);
2789         }
2790         sorwakeup(stcb->sctp_socket);
2791         sowwakeup(stcb->sctp_socket);
2792 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2793         if (!so_locked) {
2794                 SCTP_SOCKET_UNLOCK(so, 1);
2795         }
2796 #endif
2797 }
2798
2799 static void
2800 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
2801     struct sockaddr *sa, uint32_t error, int so_locked
2802 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2803     SCTP_UNUSED
2804 #endif
2805 )
2806 {
2807         struct mbuf *m_notify;
2808         struct sctp_paddr_change *spc;
2809         struct sctp_queued_to_read *control;
2810
2811         if ((stcb == NULL) ||
2812             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPADDREVNT)) {
2813                 /* event not enabled */
2814                 return;
2815         }
2816         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 0, M_NOWAIT, 1, MT_DATA);
2817         if (m_notify == NULL)
2818                 return;
2819         SCTP_BUF_LEN(m_notify) = 0;
2820         spc = mtod(m_notify, struct sctp_paddr_change *);
2821         memset(spc, 0, sizeof(struct sctp_paddr_change));
2822         spc->spc_type = SCTP_PEER_ADDR_CHANGE;
2823         spc->spc_flags = 0;
2824         spc->spc_length = sizeof(struct sctp_paddr_change);
2825         switch (sa->sa_family) {
2826 #ifdef INET
2827         case AF_INET:
2828 #ifdef INET6
2829                 if (sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
2830                         in6_sin_2_v4mapsin6((struct sockaddr_in *)sa,
2831                             (struct sockaddr_in6 *)&spc->spc_aaddr);
2832                 } else {
2833                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2834                 }
2835 #else
2836                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2837 #endif
2838                 break;
2839 #endif
2840 #ifdef INET6
2841         case AF_INET6:
2842                 {
2843                         struct sockaddr_in6 *sin6;
2844
2845                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6));
2846
2847                         sin6 = (struct sockaddr_in6 *)&spc->spc_aaddr;
2848                         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2849                                 if (sin6->sin6_scope_id == 0) {
2850                                         /* recover scope_id for user */
2851                                         (void)sa6_recoverscope(sin6);
2852                                 } else {
2853                                         /* clear embedded scope_id for user */
2854                                         in6_clearscope(&sin6->sin6_addr);
2855                                 }
2856                         }
2857                         break;
2858                 }
2859 #endif
2860         default:
2861                 /* TSNH */
2862                 break;
2863         }
2864         spc->spc_state = state;
2865         spc->spc_error = error;
2866         spc->spc_assoc_id = sctp_get_associd(stcb);
2867
2868         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_paddr_change);
2869         SCTP_BUF_NEXT(m_notify) = NULL;
2870
2871         /* append to socket */
2872         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2873             0, 0, stcb->asoc.context, 0, 0, 0,
2874             m_notify);
2875         if (control == NULL) {
2876                 /* no memory */
2877                 sctp_m_freem(m_notify);
2878                 return;
2879         }
2880         control->length = SCTP_BUF_LEN(m_notify);
2881         control->spec_flags = M_NOTIFICATION;
2882         /* not that we need this */
2883         control->tail_mbuf = m_notify;
2884         sctp_add_to_readq(stcb->sctp_ep, stcb,
2885             control,
2886             &stcb->sctp_socket->so_rcv, 1,
2887             SCTP_READ_LOCK_NOT_HELD,
2888             so_locked);
2889 }
2890
2891
2892 static void
2893 sctp_notify_send_failed(struct sctp_tcb *stcb, uint8_t sent, uint32_t error,
2894     struct sctp_tmit_chunk *chk, int so_locked
2895 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2896     SCTP_UNUSED
2897 #endif
2898 )
2899 {
2900         struct mbuf *m_notify;
2901         struct sctp_send_failed *ssf;
2902         struct sctp_send_failed_event *ssfe;
2903         struct sctp_queued_to_read *control;
2904         struct sctp_chunkhdr *chkhdr;
2905         int notifhdr_len, chk_len, chkhdr_len, padding_len, payload_len;
2906
2907         if ((stcb == NULL) ||
2908             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
2909             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
2910                 /* event not enabled */
2911                 return;
2912         }
2913         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2914                 notifhdr_len = sizeof(struct sctp_send_failed_event);
2915         } else {
2916                 notifhdr_len = sizeof(struct sctp_send_failed);
2917         }
2918         m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA);
2919         if (m_notify == NULL)
2920                 /* no space left */
2921                 return;
2922         SCTP_BUF_LEN(m_notify) = notifhdr_len;
2923         if (stcb->asoc.idata_supported) {
2924                 chkhdr_len = sizeof(struct sctp_idata_chunk);
2925         } else {
2926                 chkhdr_len = sizeof(struct sctp_data_chunk);
2927         }
2928         /* Use some defaults in case we can't access the chunk header */
2929         if (chk->send_size >= chkhdr_len) {
2930                 payload_len = chk->send_size - chkhdr_len;
2931         } else {
2932                 payload_len = 0;
2933         }
2934         padding_len = 0;
2935         if (chk->data != NULL) {
2936                 chkhdr = mtod(chk->data, struct sctp_chunkhdr *);
2937                 if (chkhdr != NULL) {
2938                         chk_len = ntohs(chkhdr->chunk_length);
2939                         if ((chk_len >= chkhdr_len) &&
2940                             (chk->send_size >= chk_len) &&
2941                             (chk->send_size - chk_len < 4)) {
2942                                 padding_len = chk->send_size - chk_len;
2943                                 payload_len = chk->send_size - chkhdr_len - padding_len;
2944                         }
2945                 }
2946         }
2947         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2948                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
2949                 memset(ssfe, 0, notifhdr_len);
2950                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
2951                 if (sent) {
2952                         ssfe->ssfe_flags = SCTP_DATA_SENT;
2953                 } else {
2954                         ssfe->ssfe_flags = SCTP_DATA_UNSENT;
2955                 }
2956                 ssfe->ssfe_length = (uint32_t)(notifhdr_len + payload_len);
2957                 ssfe->ssfe_error = error;
2958                 /* not exactly what the user sent in, but should be close :) */
2959                 ssfe->ssfe_info.snd_sid = chk->rec.data.sid;
2960                 ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags;
2961                 ssfe->ssfe_info.snd_ppid = chk->rec.data.ppid;
2962                 ssfe->ssfe_info.snd_context = chk->rec.data.context;
2963                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
2964                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
2965         } else {
2966                 ssf = mtod(m_notify, struct sctp_send_failed *);
2967                 memset(ssf, 0, notifhdr_len);
2968                 ssf->ssf_type = SCTP_SEND_FAILED;
2969                 if (sent) {
2970                         ssf->ssf_flags = SCTP_DATA_SENT;
2971                 } else {
2972                         ssf->ssf_flags = SCTP_DATA_UNSENT;
2973                 }
2974                 ssf->ssf_length = (uint32_t)(notifhdr_len + payload_len);
2975                 ssf->ssf_error = error;
2976                 /* not exactly what the user sent in, but should be close :) */
2977                 ssf->ssf_info.sinfo_stream = chk->rec.data.sid;
2978                 ssf->ssf_info.sinfo_ssn = (uint16_t)chk->rec.data.mid;
2979                 ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags;
2980                 ssf->ssf_info.sinfo_ppid = chk->rec.data.ppid;
2981                 ssf->ssf_info.sinfo_context = chk->rec.data.context;
2982                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
2983                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
2984         }
2985         if (chk->data != NULL) {
2986                 /* Trim off the sctp chunk header (it should be there) */
2987                 if (chk->send_size == chkhdr_len + payload_len + padding_len) {
2988                         m_adj(chk->data, chkhdr_len);
2989                         m_adj(chk->data, -padding_len);
2990                         sctp_mbuf_crush(chk->data);
2991                         chk->send_size -= (chkhdr_len + padding_len);
2992                 }
2993         }
2994         SCTP_BUF_NEXT(m_notify) = chk->data;
2995         /* Steal off the mbuf */
2996         chk->data = NULL;
2997         /*
2998          * For this case, we check the actual socket buffer, since the assoc
2999          * is going away we don't want to overfill the socket buffer for a
3000          * non-reader
3001          */
3002         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3003                 sctp_m_freem(m_notify);
3004                 return;
3005         }
3006         /* append to socket */
3007         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3008             0, 0, stcb->asoc.context, 0, 0, 0,
3009             m_notify);
3010         if (control == NULL) {
3011                 /* no memory */
3012                 sctp_m_freem(m_notify);
3013                 return;
3014         }
3015         control->length = SCTP_BUF_LEN(m_notify);
3016         control->spec_flags = M_NOTIFICATION;
3017         /* not that we need this */
3018         control->tail_mbuf = m_notify;
3019         sctp_add_to_readq(stcb->sctp_ep, stcb,
3020             control,
3021             &stcb->sctp_socket->so_rcv, 1,
3022             SCTP_READ_LOCK_NOT_HELD,
3023             so_locked);
3024 }
3025
3026
3027 static void
3028 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
3029     struct sctp_stream_queue_pending *sp, int so_locked
3030 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3031     SCTP_UNUSED
3032 #endif
3033 )
3034 {
3035         struct mbuf *m_notify;
3036         struct sctp_send_failed *ssf;
3037         struct sctp_send_failed_event *ssfe;
3038         struct sctp_queued_to_read *control;
3039         int notifhdr_len;
3040
3041         if ((stcb == NULL) ||
3042             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
3043             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
3044                 /* event not enabled */
3045                 return;
3046         }
3047         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3048                 notifhdr_len = sizeof(struct sctp_send_failed_event);
3049         } else {
3050                 notifhdr_len = sizeof(struct sctp_send_failed);
3051         }
3052         m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA);
3053         if (m_notify == NULL) {
3054                 /* no space left */
3055                 return;
3056         }
3057         SCTP_BUF_LEN(m_notify) = notifhdr_len;
3058         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3059                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
3060                 memset(ssfe, 0, notifhdr_len);
3061                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
3062                 ssfe->ssfe_flags = SCTP_DATA_UNSENT;
3063                 ssfe->ssfe_length = (uint32_t)(notifhdr_len + sp->length);
3064                 ssfe->ssfe_error = error;
3065                 /* not exactly what the user sent in, but should be close :) */
3066                 ssfe->ssfe_info.snd_sid = sp->sid;
3067                 if (sp->some_taken) {
3068                         ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG;
3069                 } else {
3070                         ssfe->ssfe_info.snd_flags = SCTP_DATA_NOT_FRAG;
3071                 }
3072                 ssfe->ssfe_info.snd_ppid = sp->ppid;
3073                 ssfe->ssfe_info.snd_context = sp->context;
3074                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
3075                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
3076         } else {
3077                 ssf = mtod(m_notify, struct sctp_send_failed *);
3078                 memset(ssf, 0, notifhdr_len);
3079                 ssf->ssf_type = SCTP_SEND_FAILED;
3080                 ssf->ssf_flags = SCTP_DATA_UNSENT;
3081                 ssf->ssf_length = (uint32_t)(notifhdr_len + sp->length);
3082                 ssf->ssf_error = error;
3083                 /* not exactly what the user sent in, but should be close :) */
3084                 ssf->ssf_info.sinfo_stream = sp->sid;
3085                 ssf->ssf_info.sinfo_ssn = 0;
3086                 if (sp->some_taken) {
3087                         ssf->ssf_info.sinfo_flags = SCTP_DATA_LAST_FRAG;
3088                 } else {
3089                         ssf->ssf_info.sinfo_flags = SCTP_DATA_NOT_FRAG;
3090                 }
3091                 ssf->ssf_info.sinfo_ppid = sp->ppid;
3092                 ssf->ssf_info.sinfo_context = sp->context;
3093                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
3094                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
3095         }
3096         SCTP_BUF_NEXT(m_notify) = sp->data;
3097
3098         /* Steal off the mbuf */
3099         sp->data = NULL;
3100         /*
3101          * For this case, we check the actual socket buffer, since the assoc
3102          * is going away we don't want to overfill the socket buffer for a
3103          * non-reader
3104          */
3105         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3106                 sctp_m_freem(m_notify);
3107                 return;
3108         }
3109         /* append to socket */
3110         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3111             0, 0, stcb->asoc.context, 0, 0, 0,
3112             m_notify);
3113         if (control == NULL) {
3114                 /* no memory */
3115                 sctp_m_freem(m_notify);
3116                 return;
3117         }
3118         control->length = SCTP_BUF_LEN(m_notify);
3119         control->spec_flags = M_NOTIFICATION;
3120         /* not that we need this */
3121         control->tail_mbuf = m_notify;
3122         sctp_add_to_readq(stcb->sctp_ep, stcb,
3123             control,
3124             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3125 }
3126
3127
3128
3129 static void
3130 sctp_notify_adaptation_layer(struct sctp_tcb *stcb)
3131 {
3132         struct mbuf *m_notify;
3133         struct sctp_adaptation_event *sai;
3134         struct sctp_queued_to_read *control;
3135
3136         if ((stcb == NULL) ||
3137             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ADAPTATIONEVNT)) {
3138                 /* event not enabled */
3139                 return;
3140         }
3141         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_NOWAIT, 1, MT_DATA);
3142         if (m_notify == NULL)
3143                 /* no space left */
3144                 return;
3145         SCTP_BUF_LEN(m_notify) = 0;
3146         sai = mtod(m_notify, struct sctp_adaptation_event *);
3147         memset(sai, 0, sizeof(struct sctp_adaptation_event));
3148         sai->sai_type = SCTP_ADAPTATION_INDICATION;
3149         sai->sai_flags = 0;
3150         sai->sai_length = sizeof(struct sctp_adaptation_event);
3151         sai->sai_adaptation_ind = stcb->asoc.peers_adaptation;
3152         sai->sai_assoc_id = sctp_get_associd(stcb);
3153
3154         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_adaptation_event);
3155         SCTP_BUF_NEXT(m_notify) = NULL;
3156
3157         /* append to socket */
3158         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3159             0, 0, stcb->asoc.context, 0, 0, 0,
3160             m_notify);
3161         if (control == NULL) {
3162                 /* no memory */
3163                 sctp_m_freem(m_notify);
3164                 return;
3165         }
3166         control->length = SCTP_BUF_LEN(m_notify);
3167         control->spec_flags = M_NOTIFICATION;
3168         /* not that we need this */
3169         control->tail_mbuf = m_notify;
3170         sctp_add_to_readq(stcb->sctp_ep, stcb,
3171             control,
3172             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3173 }
3174
3175 /* This always must be called with the read-queue LOCKED in the INP */
3176 static void
3177 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb, uint32_t error,
3178     uint32_t val, int so_locked
3179 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3180     SCTP_UNUSED
3181 #endif
3182 )
3183 {
3184         struct mbuf *m_notify;
3185         struct sctp_pdapi_event *pdapi;
3186         struct sctp_queued_to_read *control;
3187         struct sockbuf *sb;
3188
3189         if ((stcb == NULL) ||
3190             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_PDAPIEVNT)) {
3191                 /* event not enabled */
3192                 return;
3193         }
3194         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
3195                 return;
3196         }
3197         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 0, M_NOWAIT, 1, MT_DATA);
3198         if (m_notify == NULL)
3199                 /* no space left */
3200                 return;
3201         SCTP_BUF_LEN(m_notify) = 0;
3202         pdapi = mtod(m_notify, struct sctp_pdapi_event *);
3203         memset(pdapi, 0, sizeof(struct sctp_pdapi_event));
3204         pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
3205         pdapi->pdapi_flags = 0;
3206         pdapi->pdapi_length = sizeof(struct sctp_pdapi_event);
3207         pdapi->pdapi_indication = error;
3208         pdapi->pdapi_stream = (val >> 16);
3209         pdapi->pdapi_seq = (val & 0x0000ffff);
3210         pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
3211
3212         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_pdapi_event);
3213         SCTP_BUF_NEXT(m_notify) = NULL;
3214         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3215             0, 0, stcb->asoc.context, 0, 0, 0,
3216             m_notify);
3217         if (control == NULL) {
3218                 /* no memory */
3219                 sctp_m_freem(m_notify);
3220                 return;
3221         }
3222         control->length = SCTP_BUF_LEN(m_notify);
3223         control->spec_flags = M_NOTIFICATION;
3224         /* not that we need this */
3225         control->tail_mbuf = m_notify;
3226         sb = &stcb->sctp_socket->so_rcv;
3227         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3228                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m_notify));
3229         }
3230         sctp_sballoc(stcb, sb, m_notify);
3231         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3232                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3233         }
3234         control->end_added = 1;
3235         if (stcb->asoc.control_pdapi)
3236                 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next);
3237         else {
3238                 /* we really should not see this case */
3239                 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next);
3240         }
3241         if (stcb->sctp_ep && stcb->sctp_socket) {
3242                 /* This should always be the case */
3243 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3244                 struct socket *so;
3245
3246                 so = SCTP_INP_SO(stcb->sctp_ep);
3247                 if (!so_locked) {
3248                         atomic_add_int(&stcb->asoc.refcnt, 1);
3249                         SCTP_TCB_UNLOCK(stcb);
3250                         SCTP_SOCKET_LOCK(so, 1);
3251                         SCTP_TCB_LOCK(stcb);
3252                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
3253                         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3254                                 SCTP_SOCKET_UNLOCK(so, 1);
3255                                 return;
3256                         }
3257                 }
3258 #endif
3259                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
3260 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3261                 if (!so_locked) {
3262                         SCTP_SOCKET_UNLOCK(so, 1);
3263                 }
3264 #endif
3265         }
3266 }
3267
3268 static void
3269 sctp_notify_shutdown_event(struct sctp_tcb *stcb)
3270 {
3271         struct mbuf *m_notify;
3272         struct sctp_shutdown_event *sse;
3273         struct sctp_queued_to_read *control;
3274
3275         /*
3276          * For TCP model AND UDP connected sockets we will send an error up
3277          * when an SHUTDOWN completes
3278          */
3279         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3280             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
3281                 /* mark socket closed for read/write and wakeup! */
3282 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3283                 struct socket *so;
3284
3285                 so = SCTP_INP_SO(stcb->sctp_ep);
3286                 atomic_add_int(&stcb->asoc.refcnt, 1);
3287                 SCTP_TCB_UNLOCK(stcb);
3288                 SCTP_SOCKET_LOCK(so, 1);
3289                 SCTP_TCB_LOCK(stcb);
3290                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3291                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
3292                         SCTP_SOCKET_UNLOCK(so, 1);
3293                         return;
3294                 }
3295 #endif
3296                 socantsendmore(stcb->sctp_socket);
3297 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3298                 SCTP_SOCKET_UNLOCK(so, 1);
3299 #endif
3300         }
3301         if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT)) {
3302                 /* event not enabled */
3303                 return;
3304         }
3305         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 0, M_NOWAIT, 1, MT_DATA);
3306         if (m_notify == NULL)
3307                 /* no space left */
3308                 return;
3309         sse = mtod(m_notify, struct sctp_shutdown_event *);
3310         memset(sse, 0, sizeof(struct sctp_shutdown_event));
3311         sse->sse_type = SCTP_SHUTDOWN_EVENT;
3312         sse->sse_flags = 0;
3313         sse->sse_length = sizeof(struct sctp_shutdown_event);
3314         sse->sse_assoc_id = sctp_get_associd(stcb);
3315
3316         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_shutdown_event);
3317         SCTP_BUF_NEXT(m_notify) = NULL;
3318
3319         /* append to socket */
3320         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3321             0, 0, stcb->asoc.context, 0, 0, 0,
3322             m_notify);
3323         if (control == NULL) {
3324                 /* no memory */
3325                 sctp_m_freem(m_notify);
3326                 return;
3327         }
3328         control->length = SCTP_BUF_LEN(m_notify);
3329         control->spec_flags = M_NOTIFICATION;
3330         /* not that we need this */
3331         control->tail_mbuf = m_notify;
3332         sctp_add_to_readq(stcb->sctp_ep, stcb,
3333             control,
3334             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3335 }
3336
3337 static void
3338 sctp_notify_sender_dry_event(struct sctp_tcb *stcb,
3339     int so_locked
3340 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3341     SCTP_UNUSED
3342 #endif
3343 )
3344 {
3345         struct mbuf *m_notify;
3346         struct sctp_sender_dry_event *event;
3347         struct sctp_queued_to_read *control;
3348
3349         if ((stcb == NULL) ||
3350             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DRYEVNT)) {
3351                 /* event not enabled */
3352                 return;
3353         }
3354         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_sender_dry_event), 0, M_NOWAIT, 1, MT_DATA);
3355         if (m_notify == NULL) {
3356                 /* no space left */
3357                 return;
3358         }
3359         SCTP_BUF_LEN(m_notify) = 0;
3360         event = mtod(m_notify, struct sctp_sender_dry_event *);
3361         memset(event, 0, sizeof(struct sctp_sender_dry_event));
3362         event->sender_dry_type = SCTP_SENDER_DRY_EVENT;
3363         event->sender_dry_flags = 0;
3364         event->sender_dry_length = sizeof(struct sctp_sender_dry_event);
3365         event->sender_dry_assoc_id = sctp_get_associd(stcb);
3366
3367         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_sender_dry_event);
3368         SCTP_BUF_NEXT(m_notify) = NULL;
3369
3370         /* append to socket */
3371         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3372             0, 0, stcb->asoc.context, 0, 0, 0,
3373             m_notify);
3374         if (control == NULL) {
3375                 /* no memory */
3376                 sctp_m_freem(m_notify);
3377                 return;
3378         }
3379         control->length = SCTP_BUF_LEN(m_notify);
3380         control->spec_flags = M_NOTIFICATION;
3381         /* not that we need this */
3382         control->tail_mbuf = m_notify;
3383         sctp_add_to_readq(stcb->sctp_ep, stcb, control,
3384             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3385 }
3386
3387
3388 void
3389 sctp_notify_stream_reset_add(struct sctp_tcb *stcb, uint16_t numberin, uint16_t numberout, int flag)
3390 {
3391         struct mbuf *m_notify;
3392         struct sctp_queued_to_read *control;
3393         struct sctp_stream_change_event *stradd;
3394
3395         if ((stcb == NULL) ||
3396             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT))) {
3397                 /* event not enabled */
3398                 return;
3399         }
3400         if ((stcb->asoc.peer_req_out) && flag) {
3401                 /* Peer made the request, don't tell the local user */
3402                 stcb->asoc.peer_req_out = 0;
3403                 return;
3404         }
3405         stcb->asoc.peer_req_out = 0;
3406         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_stream_change_event), 0, M_NOWAIT, 1, MT_DATA);
3407         if (m_notify == NULL)
3408                 /* no space left */
3409                 return;
3410         SCTP_BUF_LEN(m_notify) = 0;
3411         stradd = mtod(m_notify, struct sctp_stream_change_event *);
3412         memset(stradd, 0, sizeof(struct sctp_stream_change_event));
3413         stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT;
3414         stradd->strchange_flags = flag;
3415         stradd->strchange_length = sizeof(struct sctp_stream_change_event);
3416         stradd->strchange_assoc_id = sctp_get_associd(stcb);
3417         stradd->strchange_instrms = numberin;
3418         stradd->strchange_outstrms = numberout;
3419         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_stream_change_event);
3420         SCTP_BUF_NEXT(m_notify) = NULL;
3421         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3422                 /* no space */
3423                 sctp_m_freem(m_notify);
3424                 return;
3425         }
3426         /* append to socket */
3427         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3428             0, 0, stcb->asoc.context, 0, 0, 0,
3429             m_notify);
3430         if (control == NULL) {
3431                 /* no memory */
3432                 sctp_m_freem(m_notify);
3433                 return;
3434         }
3435         control->length = SCTP_BUF_LEN(m_notify);
3436         control->spec_flags = M_NOTIFICATION;
3437         /* not that we need this */
3438         control->tail_mbuf = m_notify;
3439         sctp_add_to_readq(stcb->sctp_ep, stcb,
3440             control,
3441             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3442 }
3443
3444 void
3445 sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb, uint32_t sending_tsn, uint32_t recv_tsn, int flag)
3446 {
3447         struct mbuf *m_notify;
3448         struct sctp_queued_to_read *control;
3449         struct sctp_assoc_reset_event *strasoc;
3450
3451         if ((stcb == NULL) ||
3452             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT))) {
3453                 /* event not enabled */
3454                 return;
3455         }
3456         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_reset_event), 0, M_NOWAIT, 1, MT_DATA);
3457         if (m_notify == NULL)
3458                 /* no space left */
3459                 return;
3460         SCTP_BUF_LEN(m_notify) = 0;
3461         strasoc = mtod(m_notify, struct sctp_assoc_reset_event *);
3462         memset(strasoc, 0, sizeof(struct sctp_assoc_reset_event));
3463         strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT;
3464         strasoc->assocreset_flags = flag;
3465         strasoc->assocreset_length = sizeof(struct sctp_assoc_reset_event);
3466         strasoc->assocreset_assoc_id = sctp_get_associd(stcb);
3467         strasoc->assocreset_local_tsn = sending_tsn;
3468         strasoc->assocreset_remote_tsn = recv_tsn;
3469         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_reset_event);
3470         SCTP_BUF_NEXT(m_notify) = NULL;
3471         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3472                 /* no space */
3473                 sctp_m_freem(m_notify);
3474                 return;
3475         }
3476         /* append to socket */
3477         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3478             0, 0, stcb->asoc.context, 0, 0, 0,
3479             m_notify);
3480         if (control == NULL) {
3481                 /* no memory */
3482                 sctp_m_freem(m_notify);
3483                 return;
3484         }
3485         control->length = SCTP_BUF_LEN(m_notify);
3486         control->spec_flags = M_NOTIFICATION;
3487         /* not that we need this */
3488         control->tail_mbuf = m_notify;
3489         sctp_add_to_readq(stcb->sctp_ep, stcb,
3490             control,
3491             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3492 }
3493
3494
3495
3496 static void
3497 sctp_notify_stream_reset(struct sctp_tcb *stcb,
3498     int number_entries, uint16_t *list, int flag)
3499 {
3500         struct mbuf *m_notify;
3501         struct sctp_queued_to_read *control;
3502         struct sctp_stream_reset_event *strreset;
3503         int len;
3504
3505         if ((stcb == NULL) ||
3506             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_RESETEVNT))) {
3507                 /* event not enabled */
3508                 return;
3509         }
3510         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
3511         if (m_notify == NULL)
3512                 /* no space left */
3513                 return;
3514         SCTP_BUF_LEN(m_notify) = 0;
3515         len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
3516         if (len > M_TRAILINGSPACE(m_notify)) {
3517                 /* never enough room */
3518                 sctp_m_freem(m_notify);
3519                 return;
3520         }
3521         strreset = mtod(m_notify, struct sctp_stream_reset_event *);
3522         memset(strreset, 0, len);
3523         strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
3524         strreset->strreset_flags = flag;
3525         strreset->strreset_length = len;
3526         strreset->strreset_assoc_id = sctp_get_associd(stcb);
3527         if (number_entries) {
3528                 int i;
3529
3530                 for (i = 0; i < number_entries; i++) {
3531                         strreset->strreset_stream_list[i] = ntohs(list[i]);
3532                 }
3533         }
3534         SCTP_BUF_LEN(m_notify) = len;
3535         SCTP_BUF_NEXT(m_notify) = NULL;
3536         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3537                 /* no space */
3538                 sctp_m_freem(m_notify);
3539                 return;
3540         }
3541         /* append to socket */
3542         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3543             0, 0, stcb->asoc.context, 0, 0, 0,
3544             m_notify);
3545         if (control == NULL) {
3546                 /* no memory */
3547                 sctp_m_freem(m_notify);
3548                 return;
3549         }
3550         control->length = SCTP_BUF_LEN(m_notify);
3551         control->spec_flags = M_NOTIFICATION;
3552         /* not that we need this */
3553         control->tail_mbuf = m_notify;
3554         sctp_add_to_readq(stcb->sctp_ep, stcb,
3555             control,
3556             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3557 }
3558
3559
3560 static void
3561 sctp_notify_remote_error(struct sctp_tcb *stcb, uint16_t error, struct sctp_error_chunk *chunk)
3562 {
3563         struct mbuf *m_notify;
3564         struct sctp_remote_error *sre;
3565         struct sctp_queued_to_read *control;
3566         unsigned int notif_len;
3567         uint16_t chunk_len;
3568
3569         if ((stcb == NULL) ||
3570             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPEERERR)) {
3571                 return;
3572         }
3573         if (chunk != NULL) {
3574                 chunk_len = ntohs(chunk->ch.chunk_length);
3575         } else {
3576                 chunk_len = 0;
3577         }
3578         notif_len = (unsigned int)(sizeof(struct sctp_remote_error) + chunk_len);
3579         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3580         if (m_notify == NULL) {
3581                 /* Retry with smaller value. */
3582                 notif_len = (unsigned int)sizeof(struct sctp_remote_error);
3583                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3584                 if (m_notify == NULL) {
3585                         return;
3586                 }
3587         }
3588         SCTP_BUF_NEXT(m_notify) = NULL;
3589         sre = mtod(m_notify, struct sctp_remote_error *);
3590         memset(sre, 0, notif_len);
3591         sre->sre_type = SCTP_REMOTE_ERROR;
3592         sre->sre_flags = 0;
3593         sre->sre_length = sizeof(struct sctp_remote_error);
3594         sre->sre_error = error;
3595         sre->sre_assoc_id = sctp_get_associd(stcb);
3596         if (notif_len > sizeof(struct sctp_remote_error)) {
3597                 memcpy(sre->sre_data, chunk, chunk_len);
3598                 sre->sre_length += chunk_len;
3599         }
3600         SCTP_BUF_LEN(m_notify) = sre->sre_length;
3601         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3602             0, 0, stcb->asoc.context, 0, 0, 0,
3603             m_notify);
3604         if (control != NULL) {
3605                 control->length = SCTP_BUF_LEN(m_notify);
3606                 control->spec_flags = M_NOTIFICATION;
3607                 /* not that we need this */
3608                 control->tail_mbuf = m_notify;
3609                 sctp_add_to_readq(stcb->sctp_ep, stcb,
3610                     control,
3611                     &stcb->sctp_socket->so_rcv, 1,
3612                     SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3613         } else {
3614                 sctp_m_freem(m_notify);
3615         }
3616 }
3617
3618
3619 void
3620 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb,
3621     uint32_t error, void *data, int so_locked
3622 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3623     SCTP_UNUSED
3624 #endif
3625 )
3626 {
3627         if ((stcb == NULL) ||
3628             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3629             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3630             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3631                 /* If the socket is gone we are out of here */
3632                 return;
3633         }
3634         if (stcb->sctp_socket->so_rcv.sb_state & SBS_CANTRCVMORE) {
3635                 return;
3636         }
3637         if ((stcb->asoc.state & SCTP_STATE_COOKIE_WAIT) ||
3638             (stcb->asoc.state & SCTP_STATE_COOKIE_ECHOED)) {
3639                 if ((notification == SCTP_NOTIFY_INTERFACE_DOWN) ||
3640                     (notification == SCTP_NOTIFY_INTERFACE_UP) ||
3641                     (notification == SCTP_NOTIFY_INTERFACE_CONFIRMED)) {
3642                         /* Don't report these in front states */
3643                         return;
3644                 }
3645         }
3646         switch (notification) {
3647         case SCTP_NOTIFY_ASSOC_UP:
3648                 if (stcb->asoc.assoc_up_sent == 0) {
3649                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, NULL, 0, so_locked);
3650                         stcb->asoc.assoc_up_sent = 1;
3651                 }
3652                 if (stcb->asoc.adaptation_needed && (stcb->asoc.adaptation_sent == 0)) {
3653                         sctp_notify_adaptation_layer(stcb);
3654                 }
3655                 if (stcb->asoc.auth_supported == 0) {
3656                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3657                             NULL, so_locked);
3658                 }
3659                 break;
3660         case SCTP_NOTIFY_ASSOC_DOWN:
3661                 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, NULL, 0, so_locked);
3662                 break;
3663         case SCTP_NOTIFY_INTERFACE_DOWN:
3664                 {
3665                         struct sctp_nets *net;
3666
3667                         net = (struct sctp_nets *)data;
3668                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE,
3669                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
3670                         break;
3671                 }
3672         case SCTP_NOTIFY_INTERFACE_UP:
3673                 {
3674                         struct sctp_nets *net;
3675
3676                         net = (struct sctp_nets *)data;
3677                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE,
3678                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
3679                         break;
3680                 }
3681         case SCTP_NOTIFY_INTERFACE_CONFIRMED:
3682                 {
3683                         struct sctp_nets *net;
3684
3685                         net = (struct sctp_nets *)data;
3686                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED,
3687                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
3688                         break;
3689                 }
3690         case SCTP_NOTIFY_SPECIAL_SP_FAIL:
3691                 sctp_notify_send_failed2(stcb, error,
3692                     (struct sctp_stream_queue_pending *)data, so_locked);
3693                 break;
3694         case SCTP_NOTIFY_SENT_DG_FAIL:
3695                 sctp_notify_send_failed(stcb, 1, error,
3696                     (struct sctp_tmit_chunk *)data, so_locked);
3697                 break;
3698         case SCTP_NOTIFY_UNSENT_DG_FAIL:
3699                 sctp_notify_send_failed(stcb, 0, error,
3700                     (struct sctp_tmit_chunk *)data, so_locked);
3701                 break;
3702         case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION:
3703                 {
3704                         uint32_t val;
3705
3706                         val = *((uint32_t *)data);
3707
3708                         sctp_notify_partial_delivery_indication(stcb, error, val, so_locked);
3709                         break;
3710                 }
3711         case SCTP_NOTIFY_ASSOC_LOC_ABORTED:
3712                 if (((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_WAIT) ||
3713                     ((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_ECHOED)) {
3714                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 0, so_locked);
3715                 } else {
3716                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 0, so_locked);
3717                 }
3718                 break;
3719         case SCTP_NOTIFY_ASSOC_REM_ABORTED:
3720                 if (((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_WAIT) ||
3721                     ((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_ECHOED)) {
3722                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 1, so_locked);
3723                 } else {
3724                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 1, so_locked);
3725                 }
3726                 break;
3727         case SCTP_NOTIFY_ASSOC_RESTART:
3728                 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, NULL, 0, so_locked);
3729                 if (stcb->asoc.auth_supported == 0) {
3730                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3731                             NULL, so_locked);
3732                 }
3733                 break;
3734         case SCTP_NOTIFY_STR_RESET_SEND:
3735                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_OUTGOING_SSN);
3736                 break;
3737         case SCTP_NOTIFY_STR_RESET_RECV:
3738                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_INCOMING);
3739                 break;
3740         case SCTP_NOTIFY_STR_RESET_FAILED_OUT:
3741                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
3742                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_FAILED));
3743                 break;
3744         case SCTP_NOTIFY_STR_RESET_DENIED_OUT:
3745                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
3746                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_DENIED));
3747                 break;
3748         case SCTP_NOTIFY_STR_RESET_FAILED_IN:
3749                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
3750                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_FAILED));
3751                 break;
3752         case SCTP_NOTIFY_STR_RESET_DENIED_IN:
3753                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
3754                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_DENIED));
3755                 break;
3756         case SCTP_NOTIFY_ASCONF_ADD_IP:
3757                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data,
3758                     error, so_locked);
3759                 break;
3760         case SCTP_NOTIFY_ASCONF_DELETE_IP:
3761                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data,
3762                     error, so_locked);
3763                 break;
3764         case SCTP_NOTIFY_ASCONF_SET_PRIMARY:
3765                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data,
3766                     error, so_locked);
3767                 break;
3768         case SCTP_NOTIFY_PEER_SHUTDOWN:
3769                 sctp_notify_shutdown_event(stcb);
3770                 break;
3771         case SCTP_NOTIFY_AUTH_NEW_KEY:
3772                 sctp_notify_authentication(stcb, SCTP_AUTH_NEW_KEY, error,
3773                     (uint16_t)(uintptr_t)data,
3774                     so_locked);
3775                 break;
3776         case SCTP_NOTIFY_AUTH_FREE_KEY:
3777                 sctp_notify_authentication(stcb, SCTP_AUTH_FREE_KEY, error,
3778                     (uint16_t)(uintptr_t)data,
3779                     so_locked);
3780                 break;
3781         case SCTP_NOTIFY_NO_PEER_AUTH:
3782                 sctp_notify_authentication(stcb, SCTP_AUTH_NO_AUTH, error,
3783                     (uint16_t)(uintptr_t)data,
3784                     so_locked);
3785                 break;
3786         case SCTP_NOTIFY_SENDER_DRY:
3787                 sctp_notify_sender_dry_event(stcb, so_locked);
3788                 break;
3789         case SCTP_NOTIFY_REMOTE_ERROR:
3790                 sctp_notify_remote_error(stcb, error, data);
3791                 break;
3792         default:
3793                 SCTPDBG(SCTP_DEBUG_UTIL1, "%s: unknown notification %xh (%u)\n",
3794                     __func__, notification, notification);
3795                 break;
3796         }                       /* end switch */
3797 }
3798
3799 void
3800 sctp_report_all_outbound(struct sctp_tcb *stcb, uint16_t error, int holds_lock, int so_locked
3801 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3802     SCTP_UNUSED
3803 #endif
3804 )
3805 {
3806         struct sctp_association *asoc;
3807         struct sctp_stream_out *outs;
3808         struct sctp_tmit_chunk *chk, *nchk;
3809         struct sctp_stream_queue_pending *sp, *nsp;
3810         int i;
3811
3812         if (stcb == NULL) {
3813                 return;
3814         }
3815         asoc = &stcb->asoc;
3816         if (asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) {
3817                 /* already being freed */
3818                 return;
3819         }
3820         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3821             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3822             (asoc->state & SCTP_STATE_CLOSED_SOCKET)) {
3823                 return;
3824         }
3825         /* now through all the gunk freeing chunks */
3826         if (holds_lock == 0) {
3827                 SCTP_TCB_SEND_LOCK(stcb);
3828         }
3829         /* sent queue SHOULD be empty */
3830         TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) {
3831                 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
3832                 asoc->sent_queue_cnt--;
3833                 if (chk->sent != SCTP_DATAGRAM_NR_ACKED) {
3834                         if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
3835                                 asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
3836 #ifdef INVARIANTS
3837                         } else {
3838                                 panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
3839 #endif
3840                         }
3841                 }
3842                 if (chk->data != NULL) {
3843                         sctp_free_bufspace(stcb, asoc, chk, 1);
3844                         sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb,
3845                             error, chk, so_locked);
3846                         if (chk->data) {
3847                                 sctp_m_freem(chk->data);
3848                                 chk->data = NULL;
3849                         }
3850                 }
3851                 sctp_free_a_chunk(stcb, chk, so_locked);
3852                 /* sa_ignore FREED_MEMORY */
3853         }
3854         /* pending send queue SHOULD be empty */
3855         TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
3856                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
3857                 asoc->send_queue_cnt--;
3858                 if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
3859                         asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
3860 #ifdef INVARIANTS
3861                 } else {
3862                         panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
3863 #endif
3864                 }
3865                 if (chk->data != NULL) {
3866                         sctp_free_bufspace(stcb, asoc, chk, 1);
3867                         sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
3868                             error, chk, so_locked);
3869                         if (chk->data) {
3870                                 sctp_m_freem(chk->data);
3871                                 chk->data = NULL;
3872                         }
3873                 }
3874                 sctp_free_a_chunk(stcb, chk, so_locked);
3875                 /* sa_ignore FREED_MEMORY */
3876         }
3877         for (i = 0; i < asoc->streamoutcnt; i++) {
3878                 /* For each stream */
3879                 outs = &asoc->strmout[i];
3880                 /* clean up any sends there */
3881                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
3882                         atomic_subtract_int(&asoc->stream_queue_cnt, 1);
3883                         TAILQ_REMOVE(&outs->outqueue, sp, next);
3884                         stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, holds_lock);
3885                         sctp_free_spbufspace(stcb, asoc, sp);
3886                         if (sp->data) {
3887                                 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
3888                                     error, (void *)sp, so_locked);
3889                                 if (sp->data) {
3890                                         sctp_m_freem(sp->data);
3891                                         sp->data = NULL;
3892                                         sp->tail_mbuf = NULL;
3893                                         sp->length = 0;
3894                                 }
3895                         }
3896                         if (sp->net) {
3897                                 sctp_free_remote_addr(sp->net);
3898                                 sp->net = NULL;
3899                         }
3900                         /* Free the chunk */
3901                         sctp_free_a_strmoq(stcb, sp, so_locked);
3902                         /* sa_ignore FREED_MEMORY */
3903                 }
3904         }
3905
3906         if (holds_lock == 0) {
3907                 SCTP_TCB_SEND_UNLOCK(stcb);
3908         }
3909 }
3910
3911 void
3912 sctp_abort_notification(struct sctp_tcb *stcb, uint8_t from_peer, uint16_t error,
3913     struct sctp_abort_chunk *abort, int so_locked
3914 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3915     SCTP_UNUSED
3916 #endif
3917 )
3918 {
3919         if (stcb == NULL) {
3920                 return;
3921         }
3922         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
3923             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
3924             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
3925                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED;
3926         }
3927         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3928             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3929             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3930                 return;
3931         }
3932         /* Tell them we lost the asoc */
3933         sctp_report_all_outbound(stcb, error, 1, so_locked);
3934         if (from_peer) {
3935                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_REM_ABORTED, stcb, error, abort, so_locked);
3936         } else {
3937                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_LOC_ABORTED, stcb, error, abort, so_locked);
3938         }
3939 }
3940
3941 void
3942 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3943     struct mbuf *m, int iphlen,
3944     struct sockaddr *src, struct sockaddr *dst,
3945     struct sctphdr *sh, struct mbuf *op_err,
3946     uint8_t mflowtype, uint32_t mflowid,
3947     uint32_t vrf_id, uint16_t port)
3948 {
3949         uint32_t vtag;
3950 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3951         struct socket *so;
3952 #endif
3953
3954         vtag = 0;
3955         if (stcb != NULL) {
3956                 vtag = stcb->asoc.peer_vtag;
3957                 vrf_id = stcb->asoc.vrf_id;
3958         }
3959         sctp_send_abort(m, iphlen, src, dst, sh, vtag, op_err,
3960             mflowtype, mflowid, inp->fibnum,
3961             vrf_id, port);
3962         if (stcb != NULL) {
3963                 /* We have a TCB to abort, send notification too */
3964                 sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED);
3965                 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
3966                 /* Ok, now lets free it */
3967 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3968                 so = SCTP_INP_SO(inp);
3969                 atomic_add_int(&stcb->asoc.refcnt, 1);
3970                 SCTP_TCB_UNLOCK(stcb);
3971                 SCTP_SOCKET_LOCK(so, 1);
3972                 SCTP_TCB_LOCK(stcb);
3973                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3974 #endif
3975                 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3976                 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
3977                     (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3978                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3979                 }
3980                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
3981                     SCTP_FROM_SCTPUTIL + SCTP_LOC_4);
3982 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3983                 SCTP_SOCKET_UNLOCK(so, 1);
3984 #endif
3985         }
3986 }
3987 #ifdef SCTP_ASOCLOG_OF_TSNS
3988 void
3989 sctp_print_out_track_log(struct sctp_tcb *stcb)
3990 {
3991 #ifdef NOSIY_PRINTS
3992         int i;
3993
3994         SCTP_PRINTF("Last ep reason:%x\n", stcb->sctp_ep->last_abort_code);
3995         SCTP_PRINTF("IN bound TSN log-aaa\n");
3996         if ((stcb->asoc.tsn_in_at == 0) && (stcb->asoc.tsn_in_wrapped == 0)) {
3997                 SCTP_PRINTF("None rcvd\n");
3998                 goto none_in;
3999         }
4000         if (stcb->asoc.tsn_in_wrapped) {
4001                 for (i = stcb->asoc.tsn_in_at; i < SCTP_TSN_LOG_SIZE; i++) {
4002                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4003                             stcb->asoc.in_tsnlog[i].tsn,
4004                             stcb->asoc.in_tsnlog[i].strm,
4005                             stcb->asoc.in_tsnlog[i].seq,
4006                             stcb->asoc.in_tsnlog[i].flgs,
4007                             stcb->asoc.in_tsnlog[i].sz);
4008                 }
4009         }
4010         if (stcb->asoc.tsn_in_at) {
4011                 for (i = 0; i < stcb->asoc.tsn_in_at; i++) {
4012                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4013                             stcb->asoc.in_tsnlog[i].tsn,
4014                             stcb->asoc.in_tsnlog[i].strm,
4015                             stcb->asoc.in_tsnlog[i].seq,
4016                             stcb->asoc.in_tsnlog[i].flgs,
4017                             stcb->asoc.in_tsnlog[i].sz);
4018                 }
4019         }
4020 none_in:
4021         SCTP_PRINTF("OUT bound TSN log-aaa\n");
4022         if ((stcb->asoc.tsn_out_at == 0) &&
4023             (stcb->asoc.tsn_out_wrapped == 0)) {
4024                 SCTP_PRINTF("None sent\n");
4025         }
4026         if (stcb->asoc.tsn_out_wrapped) {
4027                 for (i = stcb->asoc.tsn_out_at; i < SCTP_TSN_LOG_SIZE; i++) {
4028                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4029                             stcb->asoc.out_tsnlog[i].tsn,
4030                             stcb->asoc.out_tsnlog[i].strm,
4031                             stcb->asoc.out_tsnlog[i].seq,
4032                             stcb->asoc.out_tsnlog[i].flgs,
4033                             stcb->asoc.out_tsnlog[i].sz);
4034                 }
4035         }
4036         if (stcb->asoc.tsn_out_at) {
4037                 for (i = 0; i < stcb->asoc.tsn_out_at; i++) {
4038                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4039                             stcb->asoc.out_tsnlog[i].tsn,
4040                             stcb->asoc.out_tsnlog[i].strm,
4041                             stcb->asoc.out_tsnlog[i].seq,
4042                             stcb->asoc.out_tsnlog[i].flgs,
4043                             stcb->asoc.out_tsnlog[i].sz);
4044                 }
4045         }
4046 #endif
4047 }
4048 #endif
4049
4050 void
4051 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
4052     struct mbuf *op_err,
4053     int so_locked
4054 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4055     SCTP_UNUSED
4056 #endif
4057 )
4058 {
4059 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4060         struct socket *so;
4061 #endif
4062
4063 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4064         so = SCTP_INP_SO(inp);
4065 #endif
4066         if (stcb == NULL) {
4067                 /* Got to have a TCB */
4068                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4069                         if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4070                                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4071                                     SCTP_CALLED_DIRECTLY_NOCMPSET);
4072                         }
4073                 }
4074                 return;
4075         } else {
4076                 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
4077         }
4078         /* notify the peer */
4079         sctp_send_abort_tcb(stcb, op_err, so_locked);
4080         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4081         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
4082             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4083                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4084         }
4085         /* notify the ulp */
4086         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) {
4087                 sctp_abort_notification(stcb, 0, 0, NULL, so_locked);
4088         }
4089         /* now free the asoc */
4090 #ifdef SCTP_ASOCLOG_OF_TSNS
4091         sctp_print_out_track_log(stcb);
4092 #endif
4093 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4094         if (!so_locked) {
4095                 atomic_add_int(&stcb->asoc.refcnt, 1);
4096                 SCTP_TCB_UNLOCK(stcb);
4097                 SCTP_SOCKET_LOCK(so, 1);
4098                 SCTP_TCB_LOCK(stcb);
4099                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4100         }
4101 #endif
4102         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4103             SCTP_FROM_SCTPUTIL + SCTP_LOC_5);
4104 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4105         if (!so_locked) {
4106                 SCTP_SOCKET_UNLOCK(so, 1);
4107         }
4108 #endif
4109 }
4110
4111 void
4112 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset,
4113     struct sockaddr *src, struct sockaddr *dst,
4114     struct sctphdr *sh, struct sctp_inpcb *inp,
4115     struct mbuf *cause,
4116     uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
4117     uint32_t vrf_id, uint16_t port)
4118 {
4119         struct sctp_chunkhdr *ch, chunk_buf;
4120         unsigned int chk_length;
4121         int contains_init_chunk;
4122
4123         SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue);
4124         /* Generate a TO address for future reference */
4125         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
4126                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4127                         sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4128                             SCTP_CALLED_DIRECTLY_NOCMPSET);
4129                 }
4130         }
4131         contains_init_chunk = 0;
4132         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4133             sizeof(*ch), (uint8_t *)&chunk_buf);
4134         while (ch != NULL) {
4135                 chk_length = ntohs(ch->chunk_length);
4136                 if (chk_length < sizeof(*ch)) {
4137                         /* break to abort land */
4138                         break;
4139                 }
4140                 switch (ch->chunk_type) {
4141                 case SCTP_INIT:
4142                         contains_init_chunk = 1;
4143                         break;
4144                 case SCTP_PACKET_DROPPED:
4145                         /* we don't respond to pkt-dropped */
4146                         return;
4147                 case SCTP_ABORT_ASSOCIATION:
4148                         /* we don't respond with an ABORT to an ABORT */
4149                         return;
4150                 case SCTP_SHUTDOWN_COMPLETE:
4151                         /*
4152                          * we ignore it since we are not waiting for it and
4153                          * peer is gone
4154                          */
4155                         return;
4156                 case SCTP_SHUTDOWN_ACK:
4157                         sctp_send_shutdown_complete2(src, dst, sh,
4158                             mflowtype, mflowid, fibnum,
4159                             vrf_id, port);
4160                         return;
4161                 default:
4162                         break;
4163                 }
4164                 offset += SCTP_SIZE32(chk_length);
4165                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4166                     sizeof(*ch), (uint8_t *)&chunk_buf);
4167         }
4168         if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
4169             ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
4170             (contains_init_chunk == 0))) {
4171                 sctp_send_abort(m, iphlen, src, dst, sh, 0, cause,
4172                     mflowtype, mflowid, fibnum,
4173                     vrf_id, port);
4174         }
4175 }
4176
4177 /*
4178  * check the inbound datagram to make sure there is not an abort inside it,
4179  * if there is return 1, else return 0.
4180  */
4181 int
4182 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t *vtagfill)
4183 {
4184         struct sctp_chunkhdr *ch;
4185         struct sctp_init_chunk *init_chk, chunk_buf;
4186         int offset;
4187         unsigned int chk_length;
4188
4189         offset = iphlen + sizeof(struct sctphdr);
4190         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch),
4191             (uint8_t *)&chunk_buf);
4192         while (ch != NULL) {
4193                 chk_length = ntohs(ch->chunk_length);
4194                 if (chk_length < sizeof(*ch)) {
4195                         /* packet is probably corrupt */
4196                         break;
4197                 }
4198                 /* we seem to be ok, is it an abort? */
4199                 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) {
4200                         /* yep, tell them */
4201                         return (1);
4202                 }
4203                 if (ch->chunk_type == SCTP_INITIATION) {
4204                         /* need to update the Vtag */
4205                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
4206                             offset, sizeof(*init_chk), (uint8_t *)&chunk_buf);
4207                         if (init_chk != NULL) {
4208                                 *vtagfill = ntohl(init_chk->init.initiate_tag);
4209                         }
4210                 }
4211                 /* Nope, move to the next chunk */
4212                 offset += SCTP_SIZE32(chk_length);
4213                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4214                     sizeof(*ch), (uint8_t *)&chunk_buf);
4215         }
4216         return (0);
4217 }
4218
4219 /*
4220  * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id
4221  * set (i.e. it's 0) so, create this function to compare link local scopes
4222  */
4223 #ifdef INET6
4224 uint32_t
4225 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2)
4226 {
4227         struct sockaddr_in6 a, b;
4228
4229         /* save copies */
4230         a = *addr1;
4231         b = *addr2;
4232
4233         if (a.sin6_scope_id == 0)
4234                 if (sa6_recoverscope(&a)) {
4235                         /* can't get scope, so can't match */
4236                         return (0);
4237                 }
4238         if (b.sin6_scope_id == 0)
4239                 if (sa6_recoverscope(&b)) {
4240                         /* can't get scope, so can't match */
4241                         return (0);
4242                 }
4243         if (a.sin6_scope_id != b.sin6_scope_id)
4244                 return (0);
4245
4246         return (1);
4247 }
4248
4249 /*
4250  * returns a sockaddr_in6 with embedded scope recovered and removed
4251  */
4252 struct sockaddr_in6 *
4253 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store)
4254 {
4255         /* check and strip embedded scope junk */
4256         if (addr->sin6_family == AF_INET6) {
4257                 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) {
4258                         if (addr->sin6_scope_id == 0) {
4259                                 *store = *addr;
4260                                 if (!sa6_recoverscope(store)) {
4261                                         /* use the recovered scope */
4262                                         addr = store;
4263                                 }
4264                         } else {
4265                                 /* else, return the original "to" addr */
4266                                 in6_clearscope(&addr->sin6_addr);
4267                         }
4268                 }
4269         }
4270         return (addr);
4271 }
4272 #endif
4273
4274 /*
4275  * are the two addresses the same?  currently a "scopeless" check returns: 1
4276  * if same, 0 if not
4277  */
4278 int
4279 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2)
4280 {
4281
4282         /* must be valid */
4283         if (sa1 == NULL || sa2 == NULL)
4284                 return (0);
4285
4286         /* must be the same family */
4287         if (sa1->sa_family != sa2->sa_family)
4288                 return (0);
4289
4290         switch (sa1->sa_family) {
4291 #ifdef INET6
4292         case AF_INET6:
4293                 {
4294                         /* IPv6 addresses */
4295                         struct sockaddr_in6 *sin6_1, *sin6_2;
4296
4297                         sin6_1 = (struct sockaddr_in6 *)sa1;
4298                         sin6_2 = (struct sockaddr_in6 *)sa2;
4299                         return (SCTP6_ARE_ADDR_EQUAL(sin6_1,
4300                             sin6_2));
4301                 }
4302 #endif
4303 #ifdef INET
4304         case AF_INET:
4305                 {
4306                         /* IPv4 addresses */
4307                         struct sockaddr_in *sin_1, *sin_2;
4308
4309                         sin_1 = (struct sockaddr_in *)sa1;
4310                         sin_2 = (struct sockaddr_in *)sa2;
4311                         return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr);
4312                 }
4313 #endif
4314         default:
4315                 /* we don't do these... */
4316                 return (0);
4317         }
4318 }
4319
4320 void
4321 sctp_print_address(struct sockaddr *sa)
4322 {
4323 #ifdef INET6
4324         char ip6buf[INET6_ADDRSTRLEN];
4325 #endif
4326
4327         switch (sa->sa_family) {
4328 #ifdef INET6
4329         case AF_INET6:
4330                 {
4331                         struct sockaddr_in6 *sin6;
4332
4333                         sin6 = (struct sockaddr_in6 *)sa;
4334                         SCTP_PRINTF("IPv6 address: %s:port:%d scope:%u\n",
4335                             ip6_sprintf(ip6buf, &sin6->sin6_addr),
4336                             ntohs(sin6->sin6_port),
4337                             sin6->sin6_scope_id);
4338                         break;
4339                 }
4340 #endif
4341 #ifdef INET
4342         case AF_INET:
4343                 {
4344                         struct sockaddr_in *sin;
4345                         unsigned char *p;
4346
4347                         sin = (struct sockaddr_in *)sa;
4348                         p = (unsigned char *)&sin->sin_addr;
4349                         SCTP_PRINTF("IPv4 address: %u.%u.%u.%u:%d\n",
4350                             p[0], p[1], p[2], p[3], ntohs(sin->sin_port));
4351                         break;
4352                 }
4353 #endif
4354         default:
4355                 SCTP_PRINTF("?\n");
4356                 break;
4357         }
4358 }
4359
4360 void
4361 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
4362     struct sctp_inpcb *new_inp,
4363     struct sctp_tcb *stcb,
4364     int waitflags)
4365 {
4366         /*
4367          * go through our old INP and pull off any control structures that
4368          * belong to stcb and move then to the new inp.
4369          */
4370         struct socket *old_so, *new_so;
4371         struct sctp_queued_to_read *control, *nctl;
4372         struct sctp_readhead tmp_queue;
4373         struct mbuf *m;
4374         int error = 0;
4375
4376         old_so = old_inp->sctp_socket;
4377         new_so = new_inp->sctp_socket;
4378         TAILQ_INIT(&tmp_queue);
4379         error = sblock(&old_so->so_rcv, waitflags);
4380         if (error) {
4381                 /*
4382                  * Gak, can't get sblock, we have a problem. data will be
4383                  * left stranded.. and we don't dare look at it since the
4384                  * other thread may be reading something. Oh well, its a
4385                  * screwed up app that does a peeloff OR a accept while
4386                  * reading from the main socket... actually its only the
4387                  * peeloff() case, since I think read will fail on a
4388                  * listening socket..
4389                  */
4390                 return;
4391         }
4392         /* lock the socket buffers */
4393         SCTP_INP_READ_LOCK(old_inp);
4394         TAILQ_FOREACH_SAFE(control, &old_inp->read_queue, next, nctl) {
4395                 /* Pull off all for out target stcb */
4396                 if (control->stcb == stcb) {
4397                         /* remove it we want it */
4398                         TAILQ_REMOVE(&old_inp->read_queue, control, next);
4399                         TAILQ_INSERT_TAIL(&tmp_queue, control, next);
4400                         m = control->data;
4401                         while (m) {
4402                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4403                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
4404                                 }
4405                                 sctp_sbfree(control, stcb, &old_so->so_rcv, m);
4406                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4407                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4408                                 }
4409                                 m = SCTP_BUF_NEXT(m);
4410                         }
4411                 }
4412         }
4413         SCTP_INP_READ_UNLOCK(old_inp);
4414         /* Remove the sb-lock on the old socket */
4415
4416         sbunlock(&old_so->so_rcv);
4417         /* Now we move them over to the new socket buffer */
4418         SCTP_INP_READ_LOCK(new_inp);
4419         TAILQ_FOREACH_SAFE(control, &tmp_queue, next, nctl) {
4420                 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next);
4421                 m = control->data;
4422                 while (m) {
4423                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4424                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4425                         }
4426                         sctp_sballoc(stcb, &new_so->so_rcv, m);
4427                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4428                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4429                         }
4430                         m = SCTP_BUF_NEXT(m);
4431                 }
4432         }
4433         SCTP_INP_READ_UNLOCK(new_inp);
4434 }
4435
4436 void
4437 sctp_wakeup_the_read_socket(struct sctp_inpcb *inp,
4438     struct sctp_tcb *stcb,
4439     int so_locked
4440 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4441     SCTP_UNUSED
4442 #endif
4443 )
4444 {
4445         if ((inp != NULL) && (inp->sctp_socket != NULL)) {
4446 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4447                 struct socket *so;
4448
4449                 so = SCTP_INP_SO(inp);
4450                 if (!so_locked) {
4451                         if (stcb) {
4452                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4453                                 SCTP_TCB_UNLOCK(stcb);
4454                         }
4455                         SCTP_SOCKET_LOCK(so, 1);
4456                         if (stcb) {
4457                                 SCTP_TCB_LOCK(stcb);
4458                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4459                         }
4460                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4461                                 SCTP_SOCKET_UNLOCK(so, 1);
4462                                 return;
4463                         }
4464                 }
4465 #endif
4466                 sctp_sorwakeup(inp, inp->sctp_socket);
4467 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4468                 if (!so_locked) {
4469                         SCTP_SOCKET_UNLOCK(so, 1);
4470                 }
4471 #endif
4472         }
4473 }
4474
4475 void
4476 sctp_add_to_readq(struct sctp_inpcb *inp,
4477     struct sctp_tcb *stcb,
4478     struct sctp_queued_to_read *control,
4479     struct sockbuf *sb,
4480     int end,
4481     int inp_read_lock_held,
4482     int so_locked
4483 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4484     SCTP_UNUSED
4485 #endif
4486 )
4487 {
4488         /*
4489          * Here we must place the control on the end of the socket read
4490          * queue AND increment sb_cc so that select will work properly on
4491          * read.
4492          */
4493         struct mbuf *m, *prev = NULL;
4494
4495         if (inp == NULL) {
4496                 /* Gak, TSNH!! */
4497 #ifdef INVARIANTS
4498                 panic("Gak, inp NULL on add_to_readq");
4499 #endif
4500                 return;
4501         }
4502         if (inp_read_lock_held == 0)
4503                 SCTP_INP_READ_LOCK(inp);
4504         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
4505                 sctp_free_remote_addr(control->whoFrom);
4506                 if (control->data) {
4507                         sctp_m_freem(control->data);
4508                         control->data = NULL;
4509                 }
4510                 sctp_free_a_readq(stcb, control);
4511                 if (inp_read_lock_held == 0)
4512                         SCTP_INP_READ_UNLOCK(inp);
4513                 return;
4514         }
4515         if (!(control->spec_flags & M_NOTIFICATION)) {
4516                 atomic_add_int(&inp->total_recvs, 1);
4517                 if (!control->do_not_ref_stcb) {
4518                         atomic_add_int(&stcb->total_recvs, 1);
4519                 }
4520         }
4521         m = control->data;
4522         control->held_length = 0;
4523         control->length = 0;
4524         while (m) {
4525                 if (SCTP_BUF_LEN(m) == 0) {
4526                         /* Skip mbufs with NO length */
4527                         if (prev == NULL) {
4528                                 /* First one */
4529                                 control->data = sctp_m_free(m);
4530                                 m = control->data;
4531                         } else {
4532                                 SCTP_BUF_NEXT(prev) = sctp_m_free(m);
4533                                 m = SCTP_BUF_NEXT(prev);
4534                         }
4535                         if (m == NULL) {
4536                                 control->tail_mbuf = prev;
4537                         }
4538                         continue;
4539                 }
4540                 prev = m;
4541                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4542                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4543                 }
4544                 sctp_sballoc(stcb, sb, m);
4545                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4546                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4547                 }
4548                 atomic_add_int(&control->length, SCTP_BUF_LEN(m));
4549                 m = SCTP_BUF_NEXT(m);
4550         }
4551         if (prev != NULL) {
4552                 control->tail_mbuf = prev;
4553         } else {
4554                 /* Everything got collapsed out?? */
4555                 sctp_free_remote_addr(control->whoFrom);
4556                 sctp_free_a_readq(stcb, control);
4557                 if (inp_read_lock_held == 0)
4558                         SCTP_INP_READ_UNLOCK(inp);
4559                 return;
4560         }
4561         if (end) {
4562                 control->end_added = 1;
4563         }
4564         TAILQ_INSERT_TAIL(&inp->read_queue, control, next);
4565         control->on_read_q = 1;
4566         if (inp_read_lock_held == 0)
4567                 SCTP_INP_READ_UNLOCK(inp);
4568         if (inp && inp->sctp_socket) {
4569                 sctp_wakeup_the_read_socket(inp, stcb, so_locked);
4570         }
4571 }
4572
4573 /*************HOLD THIS COMMENT FOR PATCH FILE OF
4574  *************ALTERNATE ROUTING CODE
4575  */
4576
4577 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF
4578  *************ALTERNATE ROUTING CODE
4579  */
4580
4581 struct mbuf *
4582 sctp_generate_cause(uint16_t code, char *info)
4583 {
4584         struct mbuf *m;
4585         struct sctp_gen_error_cause *cause;
4586         size_t info_len;
4587         uint16_t len;
4588
4589         if ((code == 0) || (info == NULL)) {
4590                 return (NULL);
4591         }
4592         info_len = strlen(info);
4593         if (info_len > (SCTP_MAX_CAUSE_LENGTH - sizeof(struct sctp_paramhdr))) {
4594                 return (NULL);
4595         }
4596         len = (uint16_t)(sizeof(struct sctp_paramhdr) + info_len);
4597         m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
4598         if (m != NULL) {
4599                 SCTP_BUF_LEN(m) = len;
4600                 cause = mtod(m, struct sctp_gen_error_cause *);
4601                 cause->code = htons(code);
4602                 cause->length = htons(len);
4603                 memcpy(cause->info, info, info_len);
4604         }
4605         return (m);
4606 }
4607
4608 struct mbuf *
4609 sctp_generate_no_user_data_cause(uint32_t tsn)
4610 {
4611         struct mbuf *m;
4612         struct sctp_error_no_user_data *no_user_data_cause;
4613         uint16_t len;
4614
4615         len = (uint16_t)sizeof(struct sctp_error_no_user_data);
4616         m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
4617         if (m != NULL) {
4618                 SCTP_BUF_LEN(m) = len;
4619                 no_user_data_cause = mtod(m, struct sctp_error_no_user_data *);
4620                 no_user_data_cause->cause.code = htons(SCTP_CAUSE_NO_USER_DATA);
4621                 no_user_data_cause->cause.length = htons(len);
4622                 no_user_data_cause->tsn = htonl(tsn);
4623         }
4624         return (m);
4625 }
4626
4627 #ifdef SCTP_MBCNT_LOGGING
4628 void
4629 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc,
4630     struct sctp_tmit_chunk *tp1, int chk_cnt)
4631 {
4632         if (tp1->data == NULL) {
4633                 return;
4634         }
4635         asoc->chunks_on_out_queue -= chk_cnt;
4636         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBCNT_LOGGING_ENABLE) {
4637                 sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE,
4638                     asoc->total_output_queue_size,
4639                     tp1->book_size,
4640                     0,
4641                     tp1->mbcnt);
4642         }
4643         if (asoc->total_output_queue_size >= tp1->book_size) {
4644                 atomic_add_int(&asoc->total_output_queue_size, -tp1->book_size);
4645         } else {
4646                 asoc->total_output_queue_size = 0;
4647         }
4648
4649         if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) ||
4650             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) {
4651                 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) {
4652                         stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size;
4653                 } else {
4654                         stcb->sctp_socket->so_snd.sb_cc = 0;
4655
4656                 }
4657         }
4658 }
4659
4660 #endif
4661
4662 int
4663 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1,
4664     uint8_t sent, int so_locked
4665 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4666     SCTP_UNUSED
4667 #endif
4668 )
4669 {
4670         struct sctp_stream_out *strq;
4671         struct sctp_tmit_chunk *chk = NULL, *tp2;
4672         struct sctp_stream_queue_pending *sp;
4673         uint32_t mid;
4674         uint16_t sid;
4675         uint8_t foundeom = 0;
4676         int ret_sz = 0;
4677         int notdone;
4678         int do_wakeup_routine = 0;
4679
4680         sid = tp1->rec.data.sid;
4681         mid = tp1->rec.data.mid;
4682         if (sent || !(tp1->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG)) {
4683                 stcb->asoc.abandoned_sent[0]++;
4684                 stcb->asoc.abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
4685                 stcb->asoc.strmout[sid].abandoned_sent[0]++;
4686 #if defined(SCTP_DETAILED_STR_STATS)
4687                 stcb->asoc.strmout[stream].abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
4688 #endif
4689         } else {
4690                 stcb->asoc.abandoned_unsent[0]++;
4691                 stcb->asoc.abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
4692                 stcb->asoc.strmout[sid].abandoned_unsent[0]++;
4693 #if defined(SCTP_DETAILED_STR_STATS)
4694                 stcb->asoc.strmout[stream].abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
4695 #endif
4696         }
4697         do {
4698                 ret_sz += tp1->book_size;
4699                 if (tp1->data != NULL) {
4700                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4701                                 sctp_flight_size_decrease(tp1);
4702                                 sctp_total_flight_decrease(stcb, tp1);
4703                         }
4704                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4705                         stcb->asoc.peers_rwnd += tp1->send_size;
4706                         stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh);
4707                         if (sent) {
4708                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
4709                         } else {
4710                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
4711                         }
4712                         if (tp1->data) {
4713                                 sctp_m_freem(tp1->data);
4714                                 tp1->data = NULL;
4715                         }
4716                         do_wakeup_routine = 1;
4717                         if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
4718                                 stcb->asoc.sent_queue_cnt_removeable--;
4719                         }
4720                 }
4721                 tp1->sent = SCTP_FORWARD_TSN_SKIP;
4722                 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
4723                     SCTP_DATA_NOT_FRAG) {
4724                         /* not frag'ed we ae done   */
4725                         notdone = 0;
4726                         foundeom = 1;
4727                 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4728                         /* end of frag, we are done */
4729                         notdone = 0;
4730                         foundeom = 1;
4731                 } else {
4732                         /*
4733                          * Its a begin or middle piece, we must mark all of
4734                          * it
4735                          */
4736                         notdone = 1;
4737                         tp1 = TAILQ_NEXT(tp1, sctp_next);
4738                 }
4739         } while (tp1 && notdone);
4740         if (foundeom == 0) {
4741                 /*
4742                  * The multi-part message was scattered across the send and
4743                  * sent queue.
4744                  */
4745                 TAILQ_FOREACH_SAFE(tp1, &stcb->asoc.send_queue, sctp_next, tp2) {
4746                         if ((tp1->rec.data.sid != sid) ||
4747                             (!SCTP_MID_EQ(stcb->asoc.idata_supported, tp1->rec.data.mid, mid))) {
4748                                 break;
4749                         }
4750                         /*
4751                          * save to chk in case we have some on stream out
4752                          * queue. If so and we have an un-transmitted one we
4753                          * don't have to fudge the TSN.
4754                          */
4755                         chk = tp1;
4756                         ret_sz += tp1->book_size;
4757                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4758                         if (sent) {
4759                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
4760                         } else {
4761                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
4762                         }
4763                         if (tp1->data) {
4764                                 sctp_m_freem(tp1->data);
4765                                 tp1->data = NULL;
4766                         }
4767                         /* No flight involved here book the size to 0 */
4768                         tp1->book_size = 0;
4769                         if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4770                                 foundeom = 1;
4771                         }
4772                         do_wakeup_routine = 1;
4773                         tp1->sent = SCTP_FORWARD_TSN_SKIP;
4774                         TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next);
4775                         /*
4776                          * on to the sent queue so we can wait for it to be
4777                          * passed by.
4778                          */
4779                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1,
4780                             sctp_next);
4781                         stcb->asoc.send_queue_cnt--;
4782                         stcb->asoc.sent_queue_cnt++;
4783                 }
4784         }
4785         if (foundeom == 0) {
4786                 /*
4787                  * Still no eom found. That means there is stuff left on the
4788                  * stream out queue.. yuck.
4789                  */
4790                 SCTP_TCB_SEND_LOCK(stcb);
4791                 strq = &stcb->asoc.strmout[sid];
4792                 sp = TAILQ_FIRST(&strq->outqueue);
4793                 if (sp != NULL) {
4794                         sp->discard_rest = 1;
4795                         /*
4796                          * We may need to put a chunk on the queue that
4797                          * holds the TSN that would have been sent with the
4798                          * LAST bit.
4799                          */
4800                         if (chk == NULL) {
4801                                 /* Yep, we have to */
4802                                 sctp_alloc_a_chunk(stcb, chk);
4803                                 if (chk == NULL) {
4804                                         /*
4805                                          * we are hosed. All we can do is
4806                                          * nothing.. which will cause an
4807                                          * abort if the peer is paying
4808                                          * attention.
4809                                          */
4810                                         goto oh_well;
4811                                 }
4812                                 memset(chk, 0, sizeof(*chk));
4813                                 chk->rec.data.rcv_flags = 0;
4814                                 chk->sent = SCTP_FORWARD_TSN_SKIP;
4815                                 chk->asoc = &stcb->asoc;
4816                                 if (stcb->asoc.idata_supported == 0) {
4817                                         if (sp->sinfo_flags & SCTP_UNORDERED) {
4818                                                 chk->rec.data.mid = 0;
4819                                         } else {
4820                                                 chk->rec.data.mid = strq->next_mid_ordered;
4821                                         }
4822                                 } else {
4823                                         if (sp->sinfo_flags & SCTP_UNORDERED) {
4824                                                 chk->rec.data.mid = strq->next_mid_unordered;
4825                                         } else {
4826                                                 chk->rec.data.mid = strq->next_mid_ordered;
4827                                         }
4828                                 }
4829                                 chk->rec.data.sid = sp->sid;
4830                                 chk->rec.data.ppid = sp->ppid;
4831                                 chk->rec.data.context = sp->context;
4832                                 chk->flags = sp->act_flags;
4833                                 chk->whoTo = NULL;
4834                                 chk->rec.data.tsn = atomic_fetchadd_int(&stcb->asoc.sending_seq, 1);
4835                                 strq->chunks_on_queues++;
4836                                 TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, chk, sctp_next);
4837                                 stcb->asoc.sent_queue_cnt++;
4838                                 stcb->asoc.pr_sctp_cnt++;
4839                         }
4840                         chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
4841                         if (sp->sinfo_flags & SCTP_UNORDERED) {
4842                                 chk->rec.data.rcv_flags |= SCTP_DATA_UNORDERED;
4843                         }
4844                         if (stcb->asoc.idata_supported == 0) {
4845                                 if ((sp->sinfo_flags & SCTP_UNORDERED) == 0) {
4846                                         strq->next_mid_ordered++;
4847                                 }
4848                         } else {
4849                                 if (sp->sinfo_flags & SCTP_UNORDERED) {
4850                                         strq->next_mid_unordered++;
4851                                 } else {
4852                                         strq->next_mid_ordered++;
4853                                 }
4854                         }
4855         oh_well:
4856                         if (sp->data) {
4857                                 /*
4858                                  * Pull any data to free up the SB and allow
4859                                  * sender to "add more" while we will throw
4860                                  * away :-)
4861                                  */
4862                                 sctp_free_spbufspace(stcb, &stcb->asoc, sp);
4863                                 ret_sz += sp->length;
4864                                 do_wakeup_routine = 1;
4865                                 sp->some_taken = 1;
4866                                 sctp_m_freem(sp->data);
4867                                 sp->data = NULL;
4868                                 sp->tail_mbuf = NULL;
4869                                 sp->length = 0;
4870                         }
4871                 }
4872                 SCTP_TCB_SEND_UNLOCK(stcb);
4873         }
4874         if (do_wakeup_routine) {
4875 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4876                 struct socket *so;
4877
4878                 so = SCTP_INP_SO(stcb->sctp_ep);
4879                 if (!so_locked) {
4880                         atomic_add_int(&stcb->asoc.refcnt, 1);
4881                         SCTP_TCB_UNLOCK(stcb);
4882                         SCTP_SOCKET_LOCK(so, 1);
4883                         SCTP_TCB_LOCK(stcb);
4884                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
4885                         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
4886                                 /* assoc was freed while we were unlocked */
4887                                 SCTP_SOCKET_UNLOCK(so, 1);
4888                                 return (ret_sz);
4889                         }
4890                 }
4891 #endif
4892                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
4893 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4894                 if (!so_locked) {
4895                         SCTP_SOCKET_UNLOCK(so, 1);
4896                 }
4897 #endif
4898         }
4899         return (ret_sz);
4900 }
4901
4902 /*
4903  * checks to see if the given address, sa, is one that is currently known by
4904  * the kernel note: can't distinguish the same address on multiple interfaces
4905  * and doesn't handle multiple addresses with different zone/scope id's note:
4906  * ifa_ifwithaddr() compares the entire sockaddr struct
4907  */
4908 struct sctp_ifa *
4909 sctp_find_ifa_in_ep(struct sctp_inpcb *inp, struct sockaddr *addr,
4910     int holds_lock)
4911 {
4912         struct sctp_laddr *laddr;
4913
4914         if (holds_lock == 0) {
4915                 SCTP_INP_RLOCK(inp);
4916         }
4917         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
4918                 if (laddr->ifa == NULL)
4919                         continue;
4920                 if (addr->sa_family != laddr->ifa->address.sa.sa_family)
4921                         continue;
4922 #ifdef INET
4923                 if (addr->sa_family == AF_INET) {
4924                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
4925                             laddr->ifa->address.sin.sin_addr.s_addr) {
4926                                 /* found him. */
4927                                 if (holds_lock == 0) {
4928                                         SCTP_INP_RUNLOCK(inp);
4929                                 }
4930                                 return (laddr->ifa);
4931                                 break;
4932                         }
4933                 }
4934 #endif
4935 #ifdef INET6
4936                 if (addr->sa_family == AF_INET6) {
4937                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
4938                             &laddr->ifa->address.sin6)) {
4939                                 /* found him. */
4940                                 if (holds_lock == 0) {
4941                                         SCTP_INP_RUNLOCK(inp);
4942                                 }
4943                                 return (laddr->ifa);
4944                                 break;
4945                         }
4946                 }
4947 #endif
4948         }
4949         if (holds_lock == 0) {
4950                 SCTP_INP_RUNLOCK(inp);
4951         }
4952         return (NULL);
4953 }
4954
4955 uint32_t
4956 sctp_get_ifa_hash_val(struct sockaddr *addr)
4957 {
4958         switch (addr->sa_family) {
4959 #ifdef INET
4960         case AF_INET:
4961                 {
4962                         struct sockaddr_in *sin;
4963
4964                         sin = (struct sockaddr_in *)addr;
4965                         return (sin->sin_addr.s_addr ^ (sin->sin_addr.s_addr >> 16));
4966                 }
4967 #endif
4968 #ifdef INET6
4969         case AF_INET6:
4970                 {
4971                         struct sockaddr_in6 *sin6;
4972                         uint32_t hash_of_addr;
4973
4974                         sin6 = (struct sockaddr_in6 *)addr;
4975                         hash_of_addr = (sin6->sin6_addr.s6_addr32[0] +
4976                             sin6->sin6_addr.s6_addr32[1] +
4977                             sin6->sin6_addr.s6_addr32[2] +
4978                             sin6->sin6_addr.s6_addr32[3]);
4979                         hash_of_addr = (hash_of_addr ^ (hash_of_addr >> 16));
4980                         return (hash_of_addr);
4981                 }
4982 #endif
4983         default:
4984                 break;
4985         }
4986         return (0);
4987 }
4988
4989 struct sctp_ifa *
4990 sctp_find_ifa_by_addr(struct sockaddr *addr, uint32_t vrf_id, int holds_lock)
4991 {
4992         struct sctp_ifa *sctp_ifap;
4993         struct sctp_vrf *vrf;
4994         struct sctp_ifalist *hash_head;
4995         uint32_t hash_of_addr;
4996
4997         if (holds_lock == 0)
4998                 SCTP_IPI_ADDR_RLOCK();
4999
5000         vrf = sctp_find_vrf(vrf_id);
5001         if (vrf == NULL) {
5002                 if (holds_lock == 0)
5003                         SCTP_IPI_ADDR_RUNLOCK();
5004                 return (NULL);
5005         }
5006         hash_of_addr = sctp_get_ifa_hash_val(addr);
5007
5008         hash_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)];
5009         if (hash_head == NULL) {
5010                 SCTP_PRINTF("hash_of_addr:%x mask:%x table:%x - ",
5011                     hash_of_addr, (uint32_t)vrf->vrf_addr_hashmark,
5012                     (uint32_t)(hash_of_addr & vrf->vrf_addr_hashmark));
5013                 sctp_print_address(addr);
5014                 SCTP_PRINTF("No such bucket for address\n");
5015                 if (holds_lock == 0)
5016                         SCTP_IPI_ADDR_RUNLOCK();
5017
5018                 return (NULL);
5019         }
5020         LIST_FOREACH(sctp_ifap, hash_head, next_bucket) {
5021                 if (addr->sa_family != sctp_ifap->address.sa.sa_family)
5022                         continue;
5023 #ifdef INET
5024                 if (addr->sa_family == AF_INET) {
5025                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
5026                             sctp_ifap->address.sin.sin_addr.s_addr) {
5027                                 /* found him. */
5028                                 if (holds_lock == 0)
5029                                         SCTP_IPI_ADDR_RUNLOCK();
5030                                 return (sctp_ifap);
5031                                 break;
5032                         }
5033                 }
5034 #endif
5035 #ifdef INET6
5036                 if (addr->sa_family == AF_INET6) {
5037                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5038                             &sctp_ifap->address.sin6)) {
5039                                 /* found him. */
5040                                 if (holds_lock == 0)
5041                                         SCTP_IPI_ADDR_RUNLOCK();
5042                                 return (sctp_ifap);
5043                                 break;
5044                         }
5045                 }
5046 #endif
5047         }
5048         if (holds_lock == 0)
5049                 SCTP_IPI_ADDR_RUNLOCK();
5050         return (NULL);
5051 }
5052
5053 static void
5054 sctp_user_rcvd(struct sctp_tcb *stcb, uint32_t *freed_so_far, int hold_rlock,
5055     uint32_t rwnd_req)
5056 {
5057         /* User pulled some data, do we need a rwnd update? */
5058         int r_unlocked = 0;
5059         uint32_t dif, rwnd;
5060         struct socket *so = NULL;
5061
5062         if (stcb == NULL)
5063                 return;
5064
5065         atomic_add_int(&stcb->asoc.refcnt, 1);
5066
5067         if (stcb->asoc.state & (SCTP_STATE_ABOUT_TO_BE_FREED |
5068             SCTP_STATE_SHUTDOWN_RECEIVED |
5069             SCTP_STATE_SHUTDOWN_ACK_SENT)) {
5070                 /* Pre-check If we are freeing no update */
5071                 goto no_lock;
5072         }
5073         SCTP_INP_INCR_REF(stcb->sctp_ep);
5074         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5075             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5076                 goto out;
5077         }
5078         so = stcb->sctp_socket;
5079         if (so == NULL) {
5080                 goto out;
5081         }
5082         atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far);
5083         /* Have you have freed enough to look */
5084         *freed_so_far = 0;
5085         /* Yep, its worth a look and the lock overhead */
5086
5087         /* Figure out what the rwnd would be */
5088         rwnd = sctp_calc_rwnd(stcb, &stcb->asoc);
5089         if (rwnd >= stcb->asoc.my_last_reported_rwnd) {
5090                 dif = rwnd - stcb->asoc.my_last_reported_rwnd;
5091         } else {
5092                 dif = 0;
5093         }
5094         if (dif >= rwnd_req) {
5095                 if (hold_rlock) {
5096                         SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5097                         r_unlocked = 1;
5098                 }
5099                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5100                         /*
5101                          * One last check before we allow the guy possibly
5102                          * to get in. There is a race, where the guy has not
5103                          * reached the gate. In that case
5104                          */
5105                         goto out;
5106                 }
5107                 SCTP_TCB_LOCK(stcb);
5108                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5109                         /* No reports here */
5110                         SCTP_TCB_UNLOCK(stcb);
5111                         goto out;
5112                 }
5113                 SCTP_STAT_INCR(sctps_wu_sacks_sent);
5114                 sctp_send_sack(stcb, SCTP_SO_LOCKED);
5115
5116                 sctp_chunk_output(stcb->sctp_ep, stcb,
5117                     SCTP_OUTPUT_FROM_USR_RCVD, SCTP_SO_LOCKED);
5118                 /* make sure no timer is running */
5119                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL,
5120                     SCTP_FROM_SCTPUTIL + SCTP_LOC_6);
5121                 SCTP_TCB_UNLOCK(stcb);
5122         } else {
5123                 /* Update how much we have pending */
5124                 stcb->freed_by_sorcv_sincelast = dif;
5125         }
5126 out:
5127         if (so && r_unlocked && hold_rlock) {
5128                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
5129         }
5130         SCTP_INP_DECR_REF(stcb->sctp_ep);
5131 no_lock:
5132         atomic_add_int(&stcb->asoc.refcnt, -1);
5133         return;
5134 }
5135
5136 int
5137 sctp_sorecvmsg(struct socket *so,
5138     struct uio *uio,
5139     struct mbuf **mp,
5140     struct sockaddr *from,
5141     int fromlen,
5142     int *msg_flags,
5143     struct sctp_sndrcvinfo *sinfo,
5144     int filling_sinfo)
5145 {
5146         /*
5147          * MSG flags we will look at MSG_DONTWAIT - non-blocking IO.
5148          * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy
5149          * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ??
5150          * On the way out we may send out any combination of:
5151          * MSG_NOTIFICATION MSG_EOR
5152          *
5153          */
5154         struct sctp_inpcb *inp = NULL;
5155         int my_len = 0;
5156         int cp_len = 0, error = 0;
5157         struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
5158         struct mbuf *m = NULL;
5159         struct sctp_tcb *stcb = NULL;
5160         int wakeup_read_socket = 0;
5161         int freecnt_applied = 0;
5162         int out_flags = 0, in_flags = 0;
5163         int block_allowed = 1;
5164         uint32_t freed_so_far = 0;
5165         uint32_t copied_so_far = 0;
5166         int in_eeor_mode = 0;
5167         int no_rcv_needed = 0;
5168         uint32_t rwnd_req = 0;
5169         int hold_sblock = 0;
5170         int hold_rlock = 0;
5171         ssize_t slen = 0;
5172         uint32_t held_length = 0;
5173         int sockbuf_lock = 0;
5174
5175         if (uio == NULL) {
5176                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5177                 return (EINVAL);
5178         }
5179         if (msg_flags) {
5180                 in_flags = *msg_flags;
5181                 if (in_flags & MSG_PEEK)
5182                         SCTP_STAT_INCR(sctps_read_peeks);
5183         } else {
5184                 in_flags = 0;
5185         }
5186         slen = uio->uio_resid;
5187
5188         /* Pull in and set up our int flags */
5189         if (in_flags & MSG_OOB) {
5190                 /* Out of band's NOT supported */
5191                 return (EOPNOTSUPP);
5192         }
5193         if ((in_flags & MSG_PEEK) && (mp != NULL)) {
5194                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5195                 return (EINVAL);
5196         }
5197         if ((in_flags & (MSG_DONTWAIT
5198             | MSG_NBIO
5199             )) ||
5200             SCTP_SO_IS_NBIO(so)) {
5201                 block_allowed = 0;
5202         }
5203         /* setup the endpoint */
5204         inp = (struct sctp_inpcb *)so->so_pcb;
5205         if (inp == NULL) {
5206                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
5207                 return (EFAULT);
5208         }
5209         rwnd_req = (SCTP_SB_LIMIT_RCV(so) >> SCTP_RWND_HIWAT_SHIFT);
5210         /* Must be at least a MTU's worth */
5211         if (rwnd_req < SCTP_MIN_RWND)
5212                 rwnd_req = SCTP_MIN_RWND;
5213         in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
5214         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5215                 sctp_misc_ints(SCTP_SORECV_ENTER,
5216                     rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, (uint32_t)uio->uio_resid);
5217         }
5218         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5219                 sctp_misc_ints(SCTP_SORECV_ENTERPL,
5220                     rwnd_req, block_allowed, so->so_rcv.sb_cc, (uint32_t)uio->uio_resid);
5221         }
5222         error = sblock(&so->so_rcv, (block_allowed ? SBL_WAIT : 0));
5223         if (error) {
5224                 goto release_unlocked;
5225         }
5226         sockbuf_lock = 1;
5227 restart:
5228
5229
5230 restart_nosblocks:
5231         if (hold_sblock == 0) {
5232                 SOCKBUF_LOCK(&so->so_rcv);
5233                 hold_sblock = 1;
5234         }
5235         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5236             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5237                 goto out;
5238         }
5239         if ((so->so_rcv.sb_state & SBS_CANTRCVMORE) && (so->so_rcv.sb_cc == 0)) {
5240                 if (so->so_error) {
5241                         error = so->so_error;
5242                         if ((in_flags & MSG_PEEK) == 0)
5243                                 so->so_error = 0;
5244                         goto out;
5245                 } else {
5246                         if (so->so_rcv.sb_cc == 0) {
5247                                 /* indicate EOF */
5248                                 error = 0;
5249                                 goto out;
5250                         }
5251                 }
5252         }
5253         if (so->so_rcv.sb_cc <= held_length) {
5254                 if (so->so_error) {
5255                         error = so->so_error;
5256                         if ((in_flags & MSG_PEEK) == 0) {
5257                                 so->so_error = 0;
5258                         }
5259                         goto out;
5260                 }
5261                 if ((so->so_rcv.sb_cc == 0) &&
5262                     ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5263                     (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) {
5264                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5265                                 /*
5266                                  * For active open side clear flags for
5267                                  * re-use passive open is blocked by
5268                                  * connect.
5269                                  */
5270                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5271                                         /*
5272                                          * You were aborted, passive side
5273                                          * always hits here
5274                                          */
5275                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5276                                         error = ECONNRESET;
5277                                 }
5278                                 so->so_state &= ~(SS_ISCONNECTING |
5279                                     SS_ISDISCONNECTING |
5280                                     SS_ISCONFIRMING |
5281                                     SS_ISCONNECTED);
5282                                 if (error == 0) {
5283                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5284                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5285                                                 error = ENOTCONN;
5286                                         }
5287                                 }
5288                                 goto out;
5289                         }
5290                 }
5291                 if (block_allowed) {
5292                         error = sbwait(&so->so_rcv);
5293                         if (error) {
5294                                 goto out;
5295                         }
5296                         held_length = 0;
5297                         goto restart_nosblocks;
5298                 } else {
5299                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EWOULDBLOCK);
5300                         error = EWOULDBLOCK;
5301                         goto out;
5302                 }
5303         }
5304         if (hold_sblock == 1) {
5305                 SOCKBUF_UNLOCK(&so->so_rcv);
5306                 hold_sblock = 0;
5307         }
5308         /* we possibly have data we can read */
5309         /* sa_ignore FREED_MEMORY */
5310         control = TAILQ_FIRST(&inp->read_queue);
5311         if (control == NULL) {
5312                 /*
5313                  * This could be happening since the appender did the
5314                  * increment but as not yet did the tailq insert onto the
5315                  * read_queue
5316                  */
5317                 if (hold_rlock == 0) {
5318                         SCTP_INP_READ_LOCK(inp);
5319                 }
5320                 control = TAILQ_FIRST(&inp->read_queue);
5321                 if ((control == NULL) && (so->so_rcv.sb_cc != 0)) {
5322 #ifdef INVARIANTS
5323                         panic("Huh, its non zero and nothing on control?");
5324 #endif
5325                         so->so_rcv.sb_cc = 0;
5326                 }
5327                 SCTP_INP_READ_UNLOCK(inp);
5328                 hold_rlock = 0;
5329                 goto restart;
5330         }
5331         if ((control->length == 0) &&
5332             (control->do_not_ref_stcb)) {
5333                 /*
5334                  * Clean up code for freeing assoc that left behind a
5335                  * pdapi.. maybe a peer in EEOR that just closed after
5336                  * sending and never indicated a EOR.
5337                  */
5338                 if (hold_rlock == 0) {
5339                         hold_rlock = 1;
5340                         SCTP_INP_READ_LOCK(inp);
5341                 }
5342                 control->held_length = 0;
5343                 if (control->data) {
5344                         /* Hmm there is data here .. fix */
5345                         struct mbuf *m_tmp;
5346                         int cnt = 0;
5347
5348                         m_tmp = control->data;
5349                         while (m_tmp) {
5350                                 cnt += SCTP_BUF_LEN(m_tmp);
5351                                 if (SCTP_BUF_NEXT(m_tmp) == NULL) {
5352                                         control->tail_mbuf = m_tmp;
5353                                         control->end_added = 1;
5354                                 }
5355                                 m_tmp = SCTP_BUF_NEXT(m_tmp);
5356                         }
5357                         control->length = cnt;
5358                 } else {
5359                         /* remove it */
5360                         TAILQ_REMOVE(&inp->read_queue, control, next);
5361                         /* Add back any hiddend data */
5362                         sctp_free_remote_addr(control->whoFrom);
5363                         sctp_free_a_readq(stcb, control);
5364                 }
5365                 if (hold_rlock) {
5366                         hold_rlock = 0;
5367                         SCTP_INP_READ_UNLOCK(inp);
5368                 }
5369                 goto restart;
5370         }
5371         if ((control->length == 0) &&
5372             (control->end_added == 1)) {
5373                 /*
5374                  * Do we also need to check for (control->pdapi_aborted ==
5375                  * 1)?
5376                  */
5377                 if (hold_rlock == 0) {
5378                         hold_rlock = 1;
5379                         SCTP_INP_READ_LOCK(inp);
5380                 }
5381                 TAILQ_REMOVE(&inp->read_queue, control, next);
5382                 if (control->data) {
5383 #ifdef INVARIANTS
5384                         panic("control->data not null but control->length == 0");
5385 #else
5386                         SCTP_PRINTF("Strange, data left in the control buffer. Cleaning up.\n");
5387                         sctp_m_freem(control->data);
5388                         control->data = NULL;
5389 #endif
5390                 }
5391                 if (control->aux_data) {
5392                         sctp_m_free(control->aux_data);
5393                         control->aux_data = NULL;
5394                 }
5395 #ifdef INVARIANTS
5396                 if (control->on_strm_q) {
5397                         panic("About to free ctl:%p so:%p and its in %d",
5398                             control, so, control->on_strm_q);
5399                 }
5400 #endif
5401                 sctp_free_remote_addr(control->whoFrom);
5402                 sctp_free_a_readq(stcb, control);
5403                 if (hold_rlock) {
5404                         hold_rlock = 0;
5405                         SCTP_INP_READ_UNLOCK(inp);
5406                 }
5407                 goto restart;
5408         }
5409         if (control->length == 0) {
5410                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) &&
5411                     (filling_sinfo)) {
5412                         /* find a more suitable one then this */
5413                         ctl = TAILQ_NEXT(control, next);
5414                         while (ctl) {
5415                                 if ((ctl->stcb != control->stcb) && (ctl->length) &&
5416                                     (ctl->some_taken ||
5417                                     (ctl->spec_flags & M_NOTIFICATION) ||
5418                                     ((ctl->do_not_ref_stcb == 0) &&
5419                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))
5420                                     ) {
5421                                         /*-
5422                                          * If we have a different TCB next, and there is data
5423                                          * present. If we have already taken some (pdapi), OR we can
5424                                          * ref the tcb and no delivery as started on this stream, we
5425                                          * take it. Note we allow a notification on a different
5426                                          * assoc to be delivered..
5427                                          */
5428                                         control = ctl;
5429                                         goto found_one;
5430                                 } else if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS)) &&
5431                                             (ctl->length) &&
5432                                             ((ctl->some_taken) ||
5433                                             ((ctl->do_not_ref_stcb == 0) &&
5434                                             ((ctl->spec_flags & M_NOTIFICATION) == 0) &&
5435                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))) {
5436                                         /*-
5437                                          * If we have the same tcb, and there is data present, and we
5438                                          * have the strm interleave feature present. Then if we have
5439                                          * taken some (pdapi) or we can refer to tht tcb AND we have
5440                                          * not started a delivery for this stream, we can take it.
5441                                          * Note we do NOT allow a notificaiton on the same assoc to
5442                                          * be delivered.
5443                                          */
5444                                         control = ctl;
5445                                         goto found_one;
5446                                 }
5447                                 ctl = TAILQ_NEXT(ctl, next);
5448                         }
5449                 }
5450                 /*
5451                  * if we reach here, not suitable replacement is available
5452                  * <or> fragment interleave is NOT on. So stuff the sb_cc
5453                  * into the our held count, and its time to sleep again.
5454                  */
5455                 held_length = so->so_rcv.sb_cc;
5456                 control->held_length = so->so_rcv.sb_cc;
5457                 goto restart;
5458         }
5459         /* Clear the held length since there is something to read */
5460         control->held_length = 0;
5461 found_one:
5462         /*
5463          * If we reach here, control has a some data for us to read off.
5464          * Note that stcb COULD be NULL.
5465          */
5466         if (hold_rlock == 0) {
5467                 hold_rlock = 1;
5468                 SCTP_INP_READ_LOCK(inp);
5469         }
5470         control->some_taken++;
5471         stcb = control->stcb;
5472         if (stcb) {
5473                 if ((control->do_not_ref_stcb == 0) &&
5474                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5475                         if (freecnt_applied == 0)
5476                                 stcb = NULL;
5477                 } else if (control->do_not_ref_stcb == 0) {
5478                         /* you can't free it on me please */
5479                         /*
5480                          * The lock on the socket buffer protects us so the
5481                          * free code will stop. But since we used the
5482                          * socketbuf lock and the sender uses the tcb_lock
5483                          * to increment, we need to use the atomic add to
5484                          * the refcnt
5485                          */
5486                         if (freecnt_applied) {
5487 #ifdef INVARIANTS
5488                                 panic("refcnt already incremented");
5489 #else
5490                                 SCTP_PRINTF("refcnt already incremented?\n");
5491 #endif
5492                         } else {
5493                                 atomic_add_int(&stcb->asoc.refcnt, 1);
5494                                 freecnt_applied = 1;
5495                         }
5496                         /*
5497                          * Setup to remember how much we have not yet told
5498                          * the peer our rwnd has opened up. Note we grab the
5499                          * value from the tcb from last time. Note too that
5500                          * sack sending clears this when a sack is sent,
5501                          * which is fine. Once we hit the rwnd_req, we then
5502                          * will go to the sctp_user_rcvd() that will not
5503                          * lock until it KNOWs it MUST send a WUP-SACK.
5504                          */
5505                         freed_so_far = stcb->freed_by_sorcv_sincelast;
5506                         stcb->freed_by_sorcv_sincelast = 0;
5507                 }
5508         }
5509         if (stcb &&
5510             ((control->spec_flags & M_NOTIFICATION) == 0) &&
5511             control->do_not_ref_stcb == 0) {
5512                 stcb->asoc.strmin[control->sinfo_stream].delivery_started = 1;
5513         }
5514         /* First lets get off the sinfo and sockaddr info */
5515         if ((sinfo != NULL) && (filling_sinfo != 0)) {
5516                 sinfo->sinfo_stream = control->sinfo_stream;
5517                 sinfo->sinfo_ssn = (uint16_t)control->mid;
5518                 sinfo->sinfo_flags = control->sinfo_flags;
5519                 sinfo->sinfo_ppid = control->sinfo_ppid;
5520                 sinfo->sinfo_context = control->sinfo_context;
5521                 sinfo->sinfo_timetolive = control->sinfo_timetolive;
5522                 sinfo->sinfo_tsn = control->sinfo_tsn;
5523                 sinfo->sinfo_cumtsn = control->sinfo_cumtsn;
5524                 sinfo->sinfo_assoc_id = control->sinfo_assoc_id;
5525                 nxt = TAILQ_NEXT(control, next);
5526                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
5527                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) {
5528                         struct sctp_extrcvinfo *s_extra;
5529
5530                         s_extra = (struct sctp_extrcvinfo *)sinfo;
5531                         if ((nxt) &&
5532                             (nxt->length)) {
5533                                 s_extra->serinfo_next_flags = SCTP_NEXT_MSG_AVAIL;
5534                                 if (nxt->sinfo_flags & SCTP_UNORDERED) {
5535                                         s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_UNORDERED;
5536                                 }
5537                                 if (nxt->spec_flags & M_NOTIFICATION) {
5538                                         s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_NOTIFICATION;
5539                                 }
5540                                 s_extra->serinfo_next_aid = nxt->sinfo_assoc_id;
5541                                 s_extra->serinfo_next_length = nxt->length;
5542                                 s_extra->serinfo_next_ppid = nxt->sinfo_ppid;
5543                                 s_extra->serinfo_next_stream = nxt->sinfo_stream;
5544                                 if (nxt->tail_mbuf != NULL) {
5545                                         if (nxt->end_added) {
5546                                                 s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_ISCOMPLETE;
5547                                         }
5548                                 }
5549                         } else {
5550                                 /*
5551                                  * we explicitly 0 this, since the memcpy
5552                                  * got some other things beyond the older
5553                                  * sinfo_ that is on the control's structure
5554                                  * :-D
5555                                  */
5556                                 nxt = NULL;
5557                                 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG;
5558                                 s_extra->serinfo_next_aid = 0;
5559                                 s_extra->serinfo_next_length = 0;
5560                                 s_extra->serinfo_next_ppid = 0;
5561                                 s_extra->serinfo_next_stream = 0;
5562                         }
5563                 }
5564                 /*
5565                  * update off the real current cum-ack, if we have an stcb.
5566                  */
5567                 if ((control->do_not_ref_stcb == 0) && stcb)
5568                         sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
5569                 /*
5570                  * mask off the high bits, we keep the actual chunk bits in
5571                  * there.
5572                  */
5573                 sinfo->sinfo_flags &= 0x00ff;
5574                 if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) {
5575                         sinfo->sinfo_flags |= SCTP_UNORDERED;
5576                 }
5577         }
5578 #ifdef SCTP_ASOCLOG_OF_TSNS
5579         {
5580                 int index, newindex;
5581                 struct sctp_pcbtsn_rlog *entry;
5582
5583                 do {
5584                         index = inp->readlog_index;
5585                         newindex = index + 1;
5586                         if (newindex >= SCTP_READ_LOG_SIZE) {
5587                                 newindex = 0;
5588                         }
5589                 } while (atomic_cmpset_int(&inp->readlog_index, index, newindex) == 0);
5590                 entry = &inp->readlog[index];
5591                 entry->vtag = control->sinfo_assoc_id;
5592                 entry->strm = control->sinfo_stream;
5593                 entry->seq = (uint16_t)control->mid;
5594                 entry->sz = control->length;
5595                 entry->flgs = control->sinfo_flags;
5596         }
5597 #endif
5598         if ((fromlen > 0) && (from != NULL)) {
5599                 union sctp_sockstore store;
5600                 size_t len;
5601
5602                 switch (control->whoFrom->ro._l_addr.sa.sa_family) {
5603 #ifdef INET6
5604                 case AF_INET6:
5605                         len = sizeof(struct sockaddr_in6);
5606                         store.sin6 = control->whoFrom->ro._l_addr.sin6;
5607                         store.sin6.sin6_port = control->port_from;
5608                         break;
5609 #endif
5610 #ifdef INET
5611                 case AF_INET:
5612 #ifdef INET6
5613                         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
5614                                 len = sizeof(struct sockaddr_in6);
5615                                 in6_sin_2_v4mapsin6(&control->whoFrom->ro._l_addr.sin,
5616                                     &store.sin6);
5617                                 store.sin6.sin6_port = control->port_from;
5618                         } else {
5619                                 len = sizeof(struct sockaddr_in);
5620                                 store.sin = control->whoFrom->ro._l_addr.sin;
5621                                 store.sin.sin_port = control->port_from;
5622                         }
5623 #else
5624                         len = sizeof(struct sockaddr_in);
5625                         store.sin = control->whoFrom->ro._l_addr.sin;
5626                         store.sin.sin_port = control->port_from;
5627 #endif
5628                         break;
5629 #endif
5630                 default:
5631                         len = 0;
5632                         break;
5633                 }
5634                 memcpy(from, &store, min((size_t)fromlen, len));
5635 #ifdef INET6
5636                 {
5637                         struct sockaddr_in6 lsa6, *from6;
5638
5639                         from6 = (struct sockaddr_in6 *)from;
5640                         sctp_recover_scope_mac(from6, (&lsa6));
5641                 }
5642 #endif
5643         }
5644         if (hold_rlock) {
5645                 SCTP_INP_READ_UNLOCK(inp);
5646                 hold_rlock = 0;
5647         }
5648         if (hold_sblock) {
5649                 SOCKBUF_UNLOCK(&so->so_rcv);
5650                 hold_sblock = 0;
5651         }
5652         /* now copy out what data we can */
5653         if (mp == NULL) {
5654                 /* copy out each mbuf in the chain up to length */
5655 get_more_data:
5656                 m = control->data;
5657                 while (m) {
5658                         /* Move out all we can */
5659                         cp_len = (int)uio->uio_resid;
5660                         my_len = (int)SCTP_BUF_LEN(m);
5661                         if (cp_len > my_len) {
5662                                 /* not enough in this buf */
5663                                 cp_len = my_len;
5664                         }
5665                         if (hold_rlock) {
5666                                 SCTP_INP_READ_UNLOCK(inp);
5667                                 hold_rlock = 0;
5668                         }
5669                         if (cp_len > 0)
5670                                 error = uiomove(mtod(m, char *), cp_len, uio);
5671                         /* re-read */
5672                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5673                                 goto release;
5674                         }
5675                         if ((control->do_not_ref_stcb == 0) && stcb &&
5676                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5677                                 no_rcv_needed = 1;
5678                         }
5679                         if (error) {
5680                                 /* error we are out of here */
5681                                 goto release;
5682                         }
5683                         SCTP_INP_READ_LOCK(inp);
5684                         hold_rlock = 1;
5685                         if (cp_len == SCTP_BUF_LEN(m)) {
5686                                 if ((SCTP_BUF_NEXT(m) == NULL) &&
5687                                     (control->end_added)) {
5688                                         out_flags |= MSG_EOR;
5689                                         if ((control->do_not_ref_stcb == 0) &&
5690                                             (control->stcb != NULL) &&
5691                                             ((control->spec_flags & M_NOTIFICATION) == 0))
5692                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5693                                 }
5694                                 if (control->spec_flags & M_NOTIFICATION) {
5695                                         out_flags |= MSG_NOTIFICATION;
5696                                 }
5697                                 /* we ate up the mbuf */
5698                                 if (in_flags & MSG_PEEK) {
5699                                         /* just looking */
5700                                         m = SCTP_BUF_NEXT(m);
5701                                         copied_so_far += cp_len;
5702                                 } else {
5703                                         /* dispose of the mbuf */
5704                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5705                                                 sctp_sblog(&so->so_rcv,
5706                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
5707                                         }
5708                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
5709                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5710                                                 sctp_sblog(&so->so_rcv,
5711                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5712                                         }
5713                                         copied_so_far += cp_len;
5714                                         freed_so_far += cp_len;
5715                                         freed_so_far += MSIZE;
5716                                         atomic_subtract_int(&control->length, cp_len);
5717                                         control->data = sctp_m_free(m);
5718                                         m = control->data;
5719                                         /*
5720                                          * been through it all, must hold sb
5721                                          * lock ok to null tail
5722                                          */
5723                                         if (control->data == NULL) {
5724 #ifdef INVARIANTS
5725                                                 if ((control->end_added == 0) ||
5726                                                     (TAILQ_NEXT(control, next) == NULL)) {
5727                                                         /*
5728                                                          * If the end is not
5729                                                          * added, OR the
5730                                                          * next is NOT null
5731                                                          * we MUST have the
5732                                                          * lock.
5733                                                          */
5734                                                         if (mtx_owned(&inp->inp_rdata_mtx) == 0) {
5735                                                                 panic("Hmm we don't own the lock?");
5736                                                         }
5737                                                 }
5738 #endif
5739                                                 control->tail_mbuf = NULL;
5740 #ifdef INVARIANTS
5741                                                 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) {
5742                                                         panic("end_added, nothing left and no MSG_EOR");
5743                                                 }
5744 #endif
5745                                         }
5746                                 }
5747                         } else {
5748                                 /* Do we need to trim the mbuf? */
5749                                 if (control->spec_flags & M_NOTIFICATION) {
5750                                         out_flags |= MSG_NOTIFICATION;
5751                                 }
5752                                 if ((in_flags & MSG_PEEK) == 0) {
5753                                         SCTP_BUF_RESV_UF(m, cp_len);
5754                                         SCTP_BUF_LEN(m) -= cp_len;
5755                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5756                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, cp_len);
5757                                         }
5758                                         atomic_subtract_int(&so->so_rcv.sb_cc, cp_len);
5759                                         if ((control->do_not_ref_stcb == 0) &&
5760                                             stcb) {
5761                                                 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len);
5762                                         }
5763                                         copied_so_far += cp_len;
5764                                         freed_so_far += cp_len;
5765                                         freed_so_far += MSIZE;
5766                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5767                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
5768                                                     SCTP_LOG_SBRESULT, 0);
5769                                         }
5770                                         atomic_subtract_int(&control->length, cp_len);
5771                                 } else {
5772                                         copied_so_far += cp_len;
5773                                 }
5774                         }
5775                         if ((out_flags & MSG_EOR) || (uio->uio_resid == 0)) {
5776                                 break;
5777                         }
5778                         if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5779                             (control->do_not_ref_stcb == 0) &&
5780                             (freed_so_far >= rwnd_req)) {
5781                                 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5782                         }
5783                 }               /* end while(m) */
5784                 /*
5785                  * At this point we have looked at it all and we either have
5786                  * a MSG_EOR/or read all the user wants... <OR>
5787                  * control->length == 0.
5788                  */
5789                 if ((out_flags & MSG_EOR) && ((in_flags & MSG_PEEK) == 0)) {
5790                         /* we are done with this control */
5791                         if (control->length == 0) {
5792                                 if (control->data) {
5793 #ifdef INVARIANTS
5794                                         panic("control->data not null at read eor?");
5795 #else
5796                                         SCTP_PRINTF("Strange, data left in the control buffer .. invarients would panic?\n");
5797                                         sctp_m_freem(control->data);
5798                                         control->data = NULL;
5799 #endif
5800                                 }
5801                 done_with_control:
5802                                 if (hold_rlock == 0) {
5803                                         SCTP_INP_READ_LOCK(inp);
5804                                         hold_rlock = 1;
5805                                 }
5806                                 TAILQ_REMOVE(&inp->read_queue, control, next);
5807                                 /* Add back any hiddend data */
5808                                 if (control->held_length) {
5809                                         held_length = 0;
5810                                         control->held_length = 0;
5811                                         wakeup_read_socket = 1;
5812                                 }
5813                                 if (control->aux_data) {
5814                                         sctp_m_free(control->aux_data);
5815                                         control->aux_data = NULL;
5816                                 }
5817                                 no_rcv_needed = control->do_not_ref_stcb;
5818                                 sctp_free_remote_addr(control->whoFrom);
5819                                 control->data = NULL;
5820 #ifdef INVARIANTS
5821                                 if (control->on_strm_q) {
5822                                         panic("About to free ctl:%p so:%p and its in %d",
5823                                             control, so, control->on_strm_q);
5824                                 }
5825 #endif
5826                                 sctp_free_a_readq(stcb, control);
5827                                 control = NULL;
5828                                 if ((freed_so_far >= rwnd_req) &&
5829                                     (no_rcv_needed == 0))
5830                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5831
5832                         } else {
5833                                 /*
5834                                  * The user did not read all of this
5835                                  * message, turn off the returned MSG_EOR
5836                                  * since we are leaving more behind on the
5837                                  * control to read.
5838                                  */
5839 #ifdef INVARIANTS
5840                                 if (control->end_added &&
5841                                     (control->data == NULL) &&
5842                                     (control->tail_mbuf == NULL)) {
5843                                         panic("Gak, control->length is corrupt?");
5844                                 }
5845 #endif
5846                                 no_rcv_needed = control->do_not_ref_stcb;
5847                                 out_flags &= ~MSG_EOR;
5848                         }
5849                 }
5850                 if (out_flags & MSG_EOR) {
5851                         goto release;
5852                 }
5853                 if ((uio->uio_resid == 0) ||
5854                     ((in_eeor_mode) &&
5855                     (copied_so_far >= (uint32_t)max(so->so_rcv.sb_lowat, 1)))) {
5856                         goto release;
5857                 }
5858                 /*
5859                  * If I hit here the receiver wants more and this message is
5860                  * NOT done (pd-api). So two questions. Can we block? if not
5861                  * we are done. Did the user NOT set MSG_WAITALL?
5862                  */
5863                 if (block_allowed == 0) {
5864                         goto release;
5865                 }
5866                 /*
5867                  * We need to wait for more data a few things: - We don't
5868                  * sbunlock() so we don't get someone else reading. - We
5869                  * must be sure to account for the case where what is added
5870                  * is NOT to our control when we wakeup.
5871                  */
5872
5873                 /*
5874                  * Do we need to tell the transport a rwnd update might be
5875                  * needed before we go to sleep?
5876                  */
5877                 if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5878                     ((freed_so_far >= rwnd_req) &&
5879                     (control->do_not_ref_stcb == 0) &&
5880                     (no_rcv_needed == 0))) {
5881                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5882                 }
5883 wait_some_more:
5884                 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
5885                         goto release;
5886                 }
5887                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
5888                         goto release;
5889
5890                 if (hold_rlock == 1) {
5891                         SCTP_INP_READ_UNLOCK(inp);
5892                         hold_rlock = 0;
5893                 }
5894                 if (hold_sblock == 0) {
5895                         SOCKBUF_LOCK(&so->so_rcv);
5896                         hold_sblock = 1;
5897                 }
5898                 if ((copied_so_far) && (control->length == 0) &&
5899                     (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE))) {
5900                         goto release;
5901                 }
5902                 if (so->so_rcv.sb_cc <= control->held_length) {
5903                         error = sbwait(&so->so_rcv);
5904                         if (error) {
5905                                 goto release;
5906                         }
5907                         control->held_length = 0;
5908                 }
5909                 if (hold_sblock) {
5910                         SOCKBUF_UNLOCK(&so->so_rcv);
5911                         hold_sblock = 0;
5912                 }
5913                 if (control->length == 0) {
5914                         /* still nothing here */
5915                         if (control->end_added == 1) {
5916                                 /* he aborted, or is done i.e.did a shutdown */
5917                                 out_flags |= MSG_EOR;
5918                                 if (control->pdapi_aborted) {
5919                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5920                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5921
5922                                         out_flags |= MSG_TRUNC;
5923                                 } else {
5924                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5925                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5926                                 }
5927                                 goto done_with_control;
5928                         }
5929                         if (so->so_rcv.sb_cc > held_length) {
5930                                 control->held_length = so->so_rcv.sb_cc;
5931                                 held_length = 0;
5932                         }
5933                         goto wait_some_more;
5934                 } else if (control->data == NULL) {
5935                         /*
5936                          * we must re-sync since data is probably being
5937                          * added
5938                          */
5939                         SCTP_INP_READ_LOCK(inp);
5940                         if ((control->length > 0) && (control->data == NULL)) {
5941                                 /*
5942                                  * big trouble.. we have the lock and its
5943                                  * corrupt?
5944                                  */
5945 #ifdef INVARIANTS
5946                                 panic("Impossible data==NULL length !=0");
5947 #endif
5948                                 out_flags |= MSG_EOR;
5949                                 out_flags |= MSG_TRUNC;
5950                                 control->length = 0;
5951                                 SCTP_INP_READ_UNLOCK(inp);
5952                                 goto done_with_control;
5953                         }
5954                         SCTP_INP_READ_UNLOCK(inp);
5955                         /* We will fall around to get more data */
5956                 }
5957                 goto get_more_data;
5958         } else {
5959                 /*-
5960                  * Give caller back the mbuf chain,
5961                  * store in uio_resid the length
5962                  */
5963                 wakeup_read_socket = 0;
5964                 if ((control->end_added == 0) ||
5965                     (TAILQ_NEXT(control, next) == NULL)) {
5966                         /* Need to get rlock */
5967                         if (hold_rlock == 0) {
5968                                 SCTP_INP_READ_LOCK(inp);
5969                                 hold_rlock = 1;
5970                         }
5971                 }
5972                 if (control->end_added) {
5973                         out_flags |= MSG_EOR;
5974                         if ((control->do_not_ref_stcb == 0) &&
5975                             (control->stcb != NULL) &&
5976                             ((control->spec_flags & M_NOTIFICATION) == 0))
5977                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5978                 }
5979                 if (control->spec_flags & M_NOTIFICATION) {
5980                         out_flags |= MSG_NOTIFICATION;
5981                 }
5982                 uio->uio_resid = control->length;
5983                 *mp = control->data;
5984                 m = control->data;
5985                 while (m) {
5986                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5987                                 sctp_sblog(&so->so_rcv,
5988                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
5989                         }
5990                         sctp_sbfree(control, stcb, &so->so_rcv, m);
5991                         freed_so_far += SCTP_BUF_LEN(m);
5992                         freed_so_far += MSIZE;
5993                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5994                                 sctp_sblog(&so->so_rcv,
5995                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5996                         }
5997                         m = SCTP_BUF_NEXT(m);
5998                 }
5999                 control->data = control->tail_mbuf = NULL;
6000                 control->length = 0;
6001                 if (out_flags & MSG_EOR) {
6002                         /* Done with this control */
6003                         goto done_with_control;
6004                 }
6005         }
6006 release:
6007         if (hold_rlock == 1) {
6008                 SCTP_INP_READ_UNLOCK(inp);
6009                 hold_rlock = 0;
6010         }
6011         if (hold_sblock == 1) {
6012                 SOCKBUF_UNLOCK(&so->so_rcv);
6013                 hold_sblock = 0;
6014         }
6015         sbunlock(&so->so_rcv);
6016         sockbuf_lock = 0;
6017
6018 release_unlocked:
6019         if (hold_sblock) {
6020                 SOCKBUF_UNLOCK(&so->so_rcv);
6021                 hold_sblock = 0;
6022         }
6023         if ((stcb) && (in_flags & MSG_PEEK) == 0) {
6024                 if ((freed_so_far >= rwnd_req) &&
6025                     (control && (control->do_not_ref_stcb == 0)) &&
6026                     (no_rcv_needed == 0))
6027                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6028         }
6029 out:
6030         if (msg_flags) {
6031                 *msg_flags = out_flags;
6032         }
6033         if (((out_flags & MSG_EOR) == 0) &&
6034             ((in_flags & MSG_PEEK) == 0) &&
6035             (sinfo) &&
6036             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
6037             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO))) {
6038                 struct sctp_extrcvinfo *s_extra;
6039
6040                 s_extra = (struct sctp_extrcvinfo *)sinfo;
6041                 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG;
6042         }
6043         if (hold_rlock == 1) {
6044                 SCTP_INP_READ_UNLOCK(inp);
6045         }
6046         if (hold_sblock) {
6047                 SOCKBUF_UNLOCK(&so->so_rcv);
6048         }
6049         if (sockbuf_lock) {
6050                 sbunlock(&so->so_rcv);
6051         }
6052         if (freecnt_applied) {
6053                 /*
6054                  * The lock on the socket buffer protects us so the free
6055                  * code will stop. But since we used the socketbuf lock and
6056                  * the sender uses the tcb_lock to increment, we need to use
6057                  * the atomic add to the refcnt.
6058                  */
6059                 if (stcb == NULL) {
6060 #ifdef INVARIANTS
6061                         panic("stcb for refcnt has gone NULL?");
6062                         goto stage_left;
6063 #else
6064                         goto stage_left;
6065 #endif
6066                 }
6067                 /* Save the value back for next time */
6068                 stcb->freed_by_sorcv_sincelast = freed_so_far;
6069                 atomic_add_int(&stcb->asoc.refcnt, -1);
6070         }
6071         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
6072                 if (stcb) {
6073                         sctp_misc_ints(SCTP_SORECV_DONE,
6074                             freed_so_far,
6075                             (uint32_t)((uio) ? (slen - uio->uio_resid) : slen),
6076                             stcb->asoc.my_rwnd,
6077                             so->so_rcv.sb_cc);
6078                 } else {
6079                         sctp_misc_ints(SCTP_SORECV_DONE,
6080                             freed_so_far,
6081                             (uint32_t)((uio) ? (slen - uio->uio_resid) : slen),
6082                             0,
6083                             so->so_rcv.sb_cc);
6084                 }
6085         }
6086 stage_left:
6087         if (wakeup_read_socket) {
6088                 sctp_sorwakeup(inp, so);
6089         }
6090         return (error);
6091 }
6092
6093
6094 #ifdef SCTP_MBUF_LOGGING
6095 struct mbuf *
6096 sctp_m_free(struct mbuf *m)
6097 {
6098         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
6099                 sctp_log_mb(m, SCTP_MBUF_IFREE);
6100         }
6101         return (m_free(m));
6102 }
6103
6104 void
6105 sctp_m_freem(struct mbuf *mb)
6106 {
6107         while (mb != NULL)
6108                 mb = sctp_m_free(mb);
6109 }
6110
6111 #endif
6112
6113 int
6114 sctp_dynamic_set_primary(struct sockaddr *sa, uint32_t vrf_id)
6115 {
6116         /*
6117          * Given a local address. For all associations that holds the
6118          * address, request a peer-set-primary.
6119          */
6120         struct sctp_ifa *ifa;
6121         struct sctp_laddr *wi;
6122
6123         ifa = sctp_find_ifa_by_addr(sa, vrf_id, 0);
6124         if (ifa == NULL) {
6125                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EADDRNOTAVAIL);
6126                 return (EADDRNOTAVAIL);
6127         }
6128         /*
6129          * Now that we have the ifa we must awaken the iterator with this
6130          * message.
6131          */
6132         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
6133         if (wi == NULL) {
6134                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
6135                 return (ENOMEM);
6136         }
6137         /* Now incr the count and int wi structure */
6138         SCTP_INCR_LADDR_COUNT();
6139         memset(wi, 0, sizeof(*wi));
6140         (void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
6141         wi->ifa = ifa;
6142         wi->action = SCTP_SET_PRIM_ADDR;
6143         atomic_add_int(&ifa->refcount, 1);
6144
6145         /* Now add it to the work queue */
6146         SCTP_WQ_ADDR_LOCK();
6147         /*
6148          * Should this really be a tailq? As it is we will process the
6149          * newest first :-0
6150          */
6151         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
6152         sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
6153             (struct sctp_inpcb *)NULL,
6154             (struct sctp_tcb *)NULL,
6155             (struct sctp_nets *)NULL);
6156         SCTP_WQ_ADDR_UNLOCK();
6157         return (0);
6158 }
6159
6160
6161 int
6162 sctp_soreceive(struct socket *so,
6163     struct sockaddr **psa,
6164     struct uio *uio,
6165     struct mbuf **mp0,
6166     struct mbuf **controlp,
6167     int *flagsp)
6168 {
6169         int error, fromlen;
6170         uint8_t sockbuf[256];
6171         struct sockaddr *from;
6172         struct sctp_extrcvinfo sinfo;
6173         int filling_sinfo = 1;
6174         struct sctp_inpcb *inp;
6175
6176         inp = (struct sctp_inpcb *)so->so_pcb;
6177         /* pickup the assoc we are reading from */
6178         if (inp == NULL) {
6179                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6180                 return (EINVAL);
6181         }
6182         if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) &&
6183             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) &&
6184             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) ||
6185             (controlp == NULL)) {
6186                 /* user does not want the sndrcv ctl */
6187                 filling_sinfo = 0;
6188         }
6189         if (psa) {
6190                 from = (struct sockaddr *)sockbuf;
6191                 fromlen = sizeof(sockbuf);
6192                 from->sa_len = 0;
6193         } else {
6194                 from = NULL;
6195                 fromlen = 0;
6196         }
6197
6198         if (filling_sinfo) {
6199                 memset(&sinfo, 0, sizeof(struct sctp_extrcvinfo));
6200         }
6201         error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, flagsp,
6202             (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo);
6203         if (controlp != NULL) {
6204                 /* copy back the sinfo in a CMSG format */
6205                 if (filling_sinfo)
6206                         *controlp = sctp_build_ctl_nchunk(inp,
6207                             (struct sctp_sndrcvinfo *)&sinfo);
6208                 else
6209                         *controlp = NULL;
6210         }
6211         if (psa) {
6212                 /* copy back the address info */
6213                 if (from && from->sa_len) {
6214                         *psa = sodupsockaddr(from, M_NOWAIT);
6215                 } else {
6216                         *psa = NULL;
6217                 }
6218         }
6219         return (error);
6220 }
6221
6222
6223
6224
6225
6226 int
6227 sctp_connectx_helper_add(struct sctp_tcb *stcb, struct sockaddr *addr,
6228     int totaddr, int *error)
6229 {
6230         int added = 0;
6231         int i;
6232         struct sctp_inpcb *inp;
6233         struct sockaddr *sa;
6234         size_t incr = 0;
6235 #ifdef INET
6236         struct sockaddr_in *sin;
6237 #endif
6238 #ifdef INET6
6239         struct sockaddr_in6 *sin6;
6240 #endif
6241
6242         sa = addr;
6243         inp = stcb->sctp_ep;
6244         *error = 0;
6245         for (i = 0; i < totaddr; i++) {
6246                 switch (sa->sa_family) {
6247 #ifdef INET
6248                 case AF_INET:
6249                         incr = sizeof(struct sockaddr_in);
6250                         sin = (struct sockaddr_in *)sa;
6251                         if ((sin->sin_addr.s_addr == INADDR_ANY) ||
6252                             (sin->sin_addr.s_addr == INADDR_BROADCAST) ||
6253                             IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
6254                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6255                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6256                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_7);
6257                                 *error = EINVAL;
6258                                 goto out_now;
6259                         }
6260                         if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port,
6261                             SCTP_DONOT_SETSCOPE,
6262                             SCTP_ADDR_IS_CONFIRMED)) {
6263                                 /* assoc gone no un-lock */
6264                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6265                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6266                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_8);
6267                                 *error = ENOBUFS;
6268                                 goto out_now;
6269                         }
6270                         added++;
6271                         break;
6272 #endif
6273 #ifdef INET6
6274                 case AF_INET6:
6275                         incr = sizeof(struct sockaddr_in6);
6276                         sin6 = (struct sockaddr_in6 *)sa;
6277                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
6278                             IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
6279                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6280                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6281                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_9);
6282                                 *error = EINVAL;
6283                                 goto out_now;
6284                         }
6285                         if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port,
6286                             SCTP_DONOT_SETSCOPE,
6287                             SCTP_ADDR_IS_CONFIRMED)) {
6288                                 /* assoc gone no un-lock */
6289                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6290                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6291                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_10);
6292                                 *error = ENOBUFS;
6293                                 goto out_now;
6294                         }
6295                         added++;
6296                         break;
6297 #endif
6298                 default:
6299                         break;
6300                 }
6301                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6302         }
6303 out_now:
6304         return (added);
6305 }
6306
6307 struct sctp_tcb *
6308 sctp_connectx_helper_find(struct sctp_inpcb *inp, struct sockaddr *addr,
6309     unsigned int *totaddr,
6310     unsigned int *num_v4, unsigned int *num_v6, int *error,
6311     unsigned int limit, int *bad_addr)
6312 {
6313         struct sockaddr *sa;
6314         struct sctp_tcb *stcb = NULL;
6315         unsigned int incr, at, i;
6316
6317         at = 0;
6318         sa = addr;
6319         *error = *num_v6 = *num_v4 = 0;
6320         /* account and validate addresses */
6321         for (i = 0; i < *totaddr; i++) {
6322                 switch (sa->sa_family) {
6323 #ifdef INET
6324                 case AF_INET:
6325                         incr = (unsigned int)sizeof(struct sockaddr_in);
6326                         if (sa->sa_len != incr) {
6327                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6328                                 *error = EINVAL;
6329                                 *bad_addr = 1;
6330                                 return (NULL);
6331                         }
6332                         (*num_v4) += 1;
6333                         break;
6334 #endif
6335 #ifdef INET6
6336                 case AF_INET6:
6337                         {
6338                                 struct sockaddr_in6 *sin6;
6339
6340                                 sin6 = (struct sockaddr_in6 *)sa;
6341                                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6342                                         /* Must be non-mapped for connectx */
6343                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6344                                         *error = EINVAL;
6345                                         *bad_addr = 1;
6346                                         return (NULL);
6347                                 }
6348                                 incr = (unsigned int)sizeof(struct sockaddr_in6);
6349                                 if (sa->sa_len != incr) {
6350                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6351                                         *error = EINVAL;
6352                                         *bad_addr = 1;
6353                                         return (NULL);
6354                                 }
6355                                 (*num_v6) += 1;
6356                                 break;
6357                         }
6358 #endif
6359                 default:
6360                         *totaddr = i;
6361                         incr = 0;
6362                         /* we are done */
6363                         break;
6364                 }
6365                 if (i == *totaddr) {
6366                         break;
6367                 }
6368                 SCTP_INP_INCR_REF(inp);
6369                 stcb = sctp_findassociation_ep_addr(&inp, sa, NULL, NULL, NULL);
6370                 if (stcb != NULL) {
6371                         /* Already have or am bring up an association */
6372                         return (stcb);
6373                 } else {
6374                         SCTP_INP_DECR_REF(inp);
6375                 }
6376                 if ((at + incr) > limit) {
6377                         *totaddr = i;
6378                         break;
6379                 }
6380                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6381         }
6382         return ((struct sctp_tcb *)NULL);
6383 }
6384
6385 /*
6386  * sctp_bindx(ADD) for one address.
6387  * assumes all arguments are valid/checked by caller.
6388  */
6389 void
6390 sctp_bindx_add_address(struct socket *so, struct sctp_inpcb *inp,
6391     struct sockaddr *sa, sctp_assoc_t assoc_id,
6392     uint32_t vrf_id, int *error, void *p)
6393 {
6394         struct sockaddr *addr_touse;
6395 #if defined(INET) && defined(INET6)
6396         struct sockaddr_in sin;
6397 #endif
6398
6399         /* see if we're bound all already! */
6400         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6401                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6402                 *error = EINVAL;
6403                 return;
6404         }
6405         addr_touse = sa;
6406 #ifdef INET6
6407         if (sa->sa_family == AF_INET6) {
6408 #ifdef INET
6409                 struct sockaddr_in6 *sin6;
6410
6411 #endif
6412                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6413                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6414                         *error = EINVAL;
6415                         return;
6416                 }
6417                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6418                         /* can only bind v6 on PF_INET6 sockets */
6419                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6420                         *error = EINVAL;
6421                         return;
6422                 }
6423 #ifdef INET
6424                 sin6 = (struct sockaddr_in6 *)addr_touse;
6425                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6426                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6427                             SCTP_IPV6_V6ONLY(inp)) {
6428                                 /* can't bind v4-mapped on PF_INET sockets */
6429                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6430                                 *error = EINVAL;
6431                                 return;
6432                         }
6433                         in6_sin6_2_sin(&sin, sin6);
6434                         addr_touse = (struct sockaddr *)&sin;
6435                 }
6436 #endif
6437         }
6438 #endif
6439 #ifdef INET
6440         if (sa->sa_family == AF_INET) {
6441                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6442                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6443                         *error = EINVAL;
6444                         return;
6445                 }
6446                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6447                     SCTP_IPV6_V6ONLY(inp)) {
6448                         /* can't bind v4 on PF_INET sockets */
6449                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6450                         *error = EINVAL;
6451                         return;
6452                 }
6453         }
6454 #endif
6455         if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
6456                 if (p == NULL) {
6457                         /* Can't get proc for Net/Open BSD */
6458                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6459                         *error = EINVAL;
6460                         return;
6461                 }
6462                 *error = sctp_inpcb_bind(so, addr_touse, NULL, p);
6463                 return;
6464         }
6465         /*
6466          * No locks required here since bind and mgmt_ep_sa all do their own
6467          * locking. If we do something for the FIX: below we may need to
6468          * lock in that case.
6469          */
6470         if (assoc_id == 0) {
6471                 /* add the address */
6472                 struct sctp_inpcb *lep;
6473                 struct sockaddr_in *lsin = (struct sockaddr_in *)addr_touse;
6474
6475                 /* validate the incoming port */
6476                 if ((lsin->sin_port != 0) &&
6477                     (lsin->sin_port != inp->sctp_lport)) {
6478                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6479                         *error = EINVAL;
6480                         return;
6481                 } else {
6482                         /* user specified 0 port, set it to existing port */
6483                         lsin->sin_port = inp->sctp_lport;
6484                 }
6485
6486                 lep = sctp_pcb_findep(addr_touse, 1, 0, vrf_id);
6487                 if (lep != NULL) {
6488                         /*
6489                          * We must decrement the refcount since we have the
6490                          * ep already and are binding. No remove going on
6491                          * here.
6492                          */
6493                         SCTP_INP_DECR_REF(lep);
6494                 }
6495                 if (lep == inp) {
6496                         /* already bound to it.. ok */
6497                         return;
6498                 } else if (lep == NULL) {
6499                         ((struct sockaddr_in *)addr_touse)->sin_port = 0;
6500                         *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6501                             SCTP_ADD_IP_ADDRESS,
6502                             vrf_id, NULL);
6503                 } else {
6504                         *error = EADDRINUSE;
6505                 }
6506                 if (*error)
6507                         return;
6508         } else {
6509                 /*
6510                  * FIX: decide whether we allow assoc based bindx
6511                  */
6512         }
6513 }
6514
6515 /*
6516  * sctp_bindx(DELETE) for one address.
6517  * assumes all arguments are valid/checked by caller.
6518  */
6519 void
6520 sctp_bindx_delete_address(struct sctp_inpcb *inp,
6521     struct sockaddr *sa, sctp_assoc_t assoc_id,
6522     uint32_t vrf_id, int *error)
6523 {
6524         struct sockaddr *addr_touse;
6525 #if defined(INET) && defined(INET6)
6526         struct sockaddr_in sin;
6527 #endif
6528
6529         /* see if we're bound all already! */
6530         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6531                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6532                 *error = EINVAL;
6533                 return;
6534         }
6535         addr_touse = sa;
6536 #ifdef INET6
6537         if (sa->sa_family == AF_INET6) {
6538 #ifdef INET
6539                 struct sockaddr_in6 *sin6;
6540 #endif
6541
6542                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6543                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6544                         *error = EINVAL;
6545                         return;
6546                 }
6547                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6548                         /* can only bind v6 on PF_INET6 sockets */
6549                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6550                         *error = EINVAL;
6551                         return;
6552                 }
6553 #ifdef INET
6554                 sin6 = (struct sockaddr_in6 *)addr_touse;
6555                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6556                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6557                             SCTP_IPV6_V6ONLY(inp)) {
6558                                 /* can't bind mapped-v4 on PF_INET sockets */
6559                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6560                                 *error = EINVAL;
6561                                 return;
6562                         }
6563                         in6_sin6_2_sin(&sin, sin6);
6564                         addr_touse = (struct sockaddr *)&sin;
6565                 }
6566 #endif
6567         }
6568 #endif
6569 #ifdef INET
6570         if (sa->sa_family == AF_INET) {
6571                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6572                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6573                         *error = EINVAL;
6574                         return;
6575                 }
6576                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6577                     SCTP_IPV6_V6ONLY(inp)) {
6578                         /* can't bind v4 on PF_INET sockets */
6579                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6580                         *error = EINVAL;
6581                         return;
6582                 }
6583         }
6584 #endif
6585         /*
6586          * No lock required mgmt_ep_sa does its own locking. If the FIX:
6587          * below is ever changed we may need to lock before calling
6588          * association level binding.
6589          */
6590         if (assoc_id == 0) {
6591                 /* delete the address */
6592                 *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6593                     SCTP_DEL_IP_ADDRESS,
6594                     vrf_id, NULL);
6595         } else {
6596                 /*
6597                  * FIX: decide whether we allow assoc based bindx
6598                  */
6599         }
6600 }
6601
6602 /*
6603  * returns the valid local address count for an assoc, taking into account
6604  * all scoping rules
6605  */
6606 int
6607 sctp_local_addr_count(struct sctp_tcb *stcb)
6608 {
6609         int loopback_scope;
6610 #if defined(INET)
6611         int ipv4_local_scope, ipv4_addr_legal;
6612 #endif
6613 #if defined (INET6)
6614         int local_scope, site_scope, ipv6_addr_legal;
6615 #endif
6616         struct sctp_vrf *vrf;
6617         struct sctp_ifn *sctp_ifn;
6618         struct sctp_ifa *sctp_ifa;
6619         int count = 0;
6620
6621         /* Turn on all the appropriate scopes */
6622         loopback_scope = stcb->asoc.scope.loopback_scope;
6623 #if defined(INET)
6624         ipv4_local_scope = stcb->asoc.scope.ipv4_local_scope;
6625         ipv4_addr_legal = stcb->asoc.scope.ipv4_addr_legal;
6626 #endif
6627 #if defined(INET6)
6628         local_scope = stcb->asoc.scope.local_scope;
6629         site_scope = stcb->asoc.scope.site_scope;
6630         ipv6_addr_legal = stcb->asoc.scope.ipv6_addr_legal;
6631 #endif
6632         SCTP_IPI_ADDR_RLOCK();
6633         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
6634         if (vrf == NULL) {
6635                 /* no vrf, no addresses */
6636                 SCTP_IPI_ADDR_RUNLOCK();
6637                 return (0);
6638         }
6639         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6640                 /*
6641                  * bound all case: go through all ifns on the vrf
6642                  */
6643                 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
6644                         if ((loopback_scope == 0) &&
6645                             SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
6646                                 continue;
6647                         }
6648                         LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
6649                                 if (sctp_is_addr_restricted(stcb, sctp_ifa))
6650                                         continue;
6651                                 switch (sctp_ifa->address.sa.sa_family) {
6652 #ifdef INET
6653                                 case AF_INET:
6654                                         if (ipv4_addr_legal) {
6655                                                 struct sockaddr_in *sin;
6656
6657                                                 sin = &sctp_ifa->address.sin;
6658                                                 if (sin->sin_addr.s_addr == 0) {
6659                                                         /*
6660                                                          * skip unspecified
6661                                                          * addrs
6662                                                          */
6663                                                         continue;
6664                                                 }
6665                                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
6666                                                     &sin->sin_addr) != 0) {
6667                                                         continue;
6668                                                 }
6669                                                 if ((ipv4_local_scope == 0) &&
6670                                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
6671                                                         continue;
6672                                                 }
6673                                                 /* count this one */
6674                                                 count++;
6675                                         } else {
6676                                                 continue;
6677                                         }
6678                                         break;
6679 #endif
6680 #ifdef INET6
6681                                 case AF_INET6:
6682                                         if (ipv6_addr_legal) {
6683                                                 struct sockaddr_in6 *sin6;
6684
6685                                                 sin6 = &sctp_ifa->address.sin6;
6686                                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
6687                                                         continue;
6688                                                 }
6689                                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
6690                                                     &sin6->sin6_addr) != 0) {
6691                                                         continue;
6692                                                 }
6693                                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
6694                                                         if (local_scope == 0)
6695                                                                 continue;
6696                                                         if (sin6->sin6_scope_id == 0) {
6697                                                                 if (sa6_recoverscope(sin6) != 0)
6698                                                                         /*
6699                                                                          *
6700                                                                          * bad
6701                                                                          * link
6702                                                                          *
6703                                                                          * local
6704                                                                          *
6705                                                                          * address
6706                                                                          */
6707                                                                         continue;
6708                                                         }
6709                                                 }
6710                                                 if ((site_scope == 0) &&
6711                                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
6712                                                         continue;
6713                                                 }
6714                                                 /* count this one */
6715                                                 count++;
6716                                         }
6717                                         break;
6718 #endif
6719                                 default:
6720                                         /* TSNH */
6721                                         break;
6722                                 }
6723                         }
6724                 }
6725         } else {
6726                 /*
6727                  * subset bound case
6728                  */
6729                 struct sctp_laddr *laddr;
6730
6731                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list,
6732                     sctp_nxt_addr) {
6733                         if (sctp_is_addr_restricted(stcb, laddr->ifa)) {
6734                                 continue;
6735                         }
6736                         /* count this one */
6737                         count++;
6738                 }
6739         }
6740         SCTP_IPI_ADDR_RUNLOCK();
6741         return (count);
6742 }
6743
6744 #if defined(SCTP_LOCAL_TRACE_BUF)
6745
6746 void
6747 sctp_log_trace(uint32_t subsys, const char *str SCTP_UNUSED, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f)
6748 {
6749         uint32_t saveindex, newindex;
6750
6751         do {
6752                 saveindex = SCTP_BASE_SYSCTL(sctp_log).index;
6753                 if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6754                         newindex = 1;
6755                 } else {
6756                         newindex = saveindex + 1;
6757                 }
6758         } while (atomic_cmpset_int(&SCTP_BASE_SYSCTL(sctp_log).index, saveindex, newindex) == 0);
6759         if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6760                 saveindex = 0;
6761         }
6762         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].timestamp = SCTP_GET_CYCLECOUNT;
6763         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].subsys = subsys;
6764         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[0] = a;
6765         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[1] = b;
6766         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[2] = c;
6767         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[3] = d;
6768         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[4] = e;
6769         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[5] = f;
6770 }
6771
6772 #endif
6773 static void
6774 sctp_recv_udp_tunneled_packet(struct mbuf *m, int off, struct inpcb *inp,
6775     const struct sockaddr *sa SCTP_UNUSED, void *ctx SCTP_UNUSED)
6776 {
6777         struct ip *iph;
6778 #ifdef INET6
6779         struct ip6_hdr *ip6;
6780 #endif
6781         struct mbuf *sp, *last;
6782         struct udphdr *uhdr;
6783         uint16_t port;
6784
6785         if ((m->m_flags & M_PKTHDR) == 0) {
6786                 /* Can't handle one that is not a pkt hdr */
6787                 goto out;
6788         }
6789         /* Pull the src port */
6790         iph = mtod(m, struct ip *);
6791         uhdr = (struct udphdr *)((caddr_t)iph + off);
6792         port = uhdr->uh_sport;
6793         /*
6794          * Split out the mbuf chain. Leave the IP header in m, place the
6795          * rest in the sp.
6796          */
6797         sp = m_split(m, off, M_NOWAIT);
6798         if (sp == NULL) {
6799                 /* Gak, drop packet, we can't do a split */
6800                 goto out;
6801         }
6802         if (sp->m_pkthdr.len < sizeof(struct udphdr) + sizeof(struct sctphdr)) {
6803                 /* Gak, packet can't have an SCTP header in it - too small */
6804                 m_freem(sp);
6805                 goto out;
6806         }
6807         /* Now pull up the UDP header and SCTP header together */
6808         sp = m_pullup(sp, sizeof(struct udphdr) + sizeof(struct sctphdr));
6809         if (sp == NULL) {
6810                 /* Gak pullup failed */
6811                 goto out;
6812         }
6813         /* Trim out the UDP header */
6814         m_adj(sp, sizeof(struct udphdr));
6815
6816         /* Now reconstruct the mbuf chain */
6817         for (last = m; last->m_next; last = last->m_next);
6818         last->m_next = sp;
6819         m->m_pkthdr.len += sp->m_pkthdr.len;
6820         /*
6821          * The CSUM_DATA_VALID flags indicates that the HW checked the UDP
6822          * checksum and it was valid. Since CSUM_DATA_VALID ==
6823          * CSUM_SCTP_VALID this would imply that the HW also verified the
6824          * SCTP checksum. Therefore, clear the bit.
6825          */
6826         SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
6827             "sctp_recv_udp_tunneled_packet(): Packet of length %d received on %s with csum_flags 0x%b.\n",
6828             m->m_pkthdr.len,
6829             if_name(m->m_pkthdr.rcvif),
6830             (int)m->m_pkthdr.csum_flags, CSUM_BITS);
6831         m->m_pkthdr.csum_flags &= ~CSUM_DATA_VALID;
6832         iph = mtod(m, struct ip *);
6833         switch (iph->ip_v) {
6834 #ifdef INET
6835         case IPVERSION:
6836                 iph->ip_len = htons(ntohs(iph->ip_len) - sizeof(struct udphdr));
6837                 sctp_input_with_port(m, off, port);
6838                 break;
6839 #endif
6840 #ifdef INET6
6841         case IPV6_VERSION >> 4:
6842                 ip6 = mtod(m, struct ip6_hdr *);
6843                 ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - sizeof(struct udphdr));
6844                 sctp6_input_with_port(&m, &off, port);
6845                 break;
6846 #endif
6847         default:
6848                 goto out;
6849                 break;
6850         }
6851         return;
6852 out:
6853         m_freem(m);
6854 }
6855
6856 #ifdef INET
6857 static void
6858 sctp_recv_icmp_tunneled_packet(int cmd, struct sockaddr *sa, void *vip, void *ctx SCTP_UNUSED)
6859 {
6860         struct ip *outer_ip, *inner_ip;
6861         struct sctphdr *sh;
6862         struct icmp *icmp;
6863         struct udphdr *udp;
6864         struct sctp_inpcb *inp;
6865         struct sctp_tcb *stcb;
6866         struct sctp_nets *net;
6867         struct sctp_init_chunk *ch;
6868         struct sockaddr_in src, dst;
6869         uint8_t type, code;
6870
6871         inner_ip = (struct ip *)vip;
6872         icmp = (struct icmp *)((caddr_t)inner_ip -
6873             (sizeof(struct icmp) - sizeof(struct ip)));
6874         outer_ip = (struct ip *)((caddr_t)icmp - sizeof(struct ip));
6875         if (ntohs(outer_ip->ip_len) <
6876             sizeof(struct ip) + 8 + (inner_ip->ip_hl << 2) + sizeof(struct udphdr) + 8) {
6877                 return;
6878         }
6879         udp = (struct udphdr *)((caddr_t)inner_ip + (inner_ip->ip_hl << 2));
6880         sh = (struct sctphdr *)(udp + 1);
6881         memset(&src, 0, sizeof(struct sockaddr_in));
6882         src.sin_family = AF_INET;
6883         src.sin_len = sizeof(struct sockaddr_in);
6884         src.sin_port = sh->src_port;
6885         src.sin_addr = inner_ip->ip_src;
6886         memset(&dst, 0, sizeof(struct sockaddr_in));
6887         dst.sin_family = AF_INET;
6888         dst.sin_len = sizeof(struct sockaddr_in);
6889         dst.sin_port = sh->dest_port;
6890         dst.sin_addr = inner_ip->ip_dst;
6891         /*
6892          * 'dst' holds the dest of the packet that failed to be sent. 'src'
6893          * holds our local endpoint address. Thus we reverse the dst and the
6894          * src in the lookup.
6895          */
6896         inp = NULL;
6897         net = NULL;
6898         stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst,
6899             (struct sockaddr *)&src,
6900             &inp, &net, 1,
6901             SCTP_DEFAULT_VRFID);
6902         if ((stcb != NULL) &&
6903             (net != NULL) &&
6904             (inp != NULL)) {
6905                 /* Check the UDP port numbers */
6906                 if ((udp->uh_dport != net->port) ||
6907                     (udp->uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) {
6908                         SCTP_TCB_UNLOCK(stcb);
6909                         return;
6910                 }
6911                 /* Check the verification tag */
6912                 if (ntohl(sh->v_tag) != 0) {
6913                         /*
6914                          * This must be the verification tag used for
6915                          * sending out packets. We don't consider packets
6916                          * reflecting the verification tag.
6917                          */
6918                         if (ntohl(sh->v_tag) != stcb->asoc.peer_vtag) {
6919                                 SCTP_TCB_UNLOCK(stcb);
6920                                 return;
6921                         }
6922                 } else {
6923                         if (ntohs(outer_ip->ip_len) >=
6924                             sizeof(struct ip) +
6925                             8 + (inner_ip->ip_hl << 2) + 8 + 20) {
6926                                 /*
6927                                  * In this case we can check if we got an
6928                                  * INIT chunk and if the initiate tag
6929                                  * matches.
6930                                  */
6931                                 ch = (struct sctp_init_chunk *)(sh + 1);
6932                                 if ((ch->ch.chunk_type != SCTP_INITIATION) ||
6933                                     (ntohl(ch->init.initiate_tag) != stcb->asoc.my_vtag)) {
6934                                         SCTP_TCB_UNLOCK(stcb);
6935                                         return;
6936                                 }
6937                         } else {
6938                                 SCTP_TCB_UNLOCK(stcb);
6939                                 return;
6940                         }
6941                 }
6942                 type = icmp->icmp_type;
6943                 code = icmp->icmp_code;
6944                 if ((type == ICMP_UNREACH) &&
6945                     (code == ICMP_UNREACH_PORT)) {
6946                         code = ICMP_UNREACH_PROTOCOL;
6947                 }
6948                 sctp_notify(inp, stcb, net, type, code,
6949                     ntohs(inner_ip->ip_len),
6950                     (uint32_t)ntohs(icmp->icmp_nextmtu));
6951         } else {
6952                 if ((stcb == NULL) && (inp != NULL)) {
6953                         /* reduce ref-count */
6954                         SCTP_INP_WLOCK(inp);
6955                         SCTP_INP_DECR_REF(inp);
6956                         SCTP_INP_WUNLOCK(inp);
6957                 }
6958                 if (stcb) {
6959                         SCTP_TCB_UNLOCK(stcb);
6960                 }
6961         }
6962         return;
6963 }
6964 #endif
6965
6966 #ifdef INET6
6967 static void
6968 sctp_recv_icmp6_tunneled_packet(int cmd, struct sockaddr *sa, void *d, void *ctx SCTP_UNUSED)
6969 {
6970         struct ip6ctlparam *ip6cp;
6971         struct sctp_inpcb *inp;
6972         struct sctp_tcb *stcb;
6973         struct sctp_nets *net;
6974         struct sctphdr sh;
6975         struct udphdr udp;
6976         struct sockaddr_in6 src, dst;
6977         uint8_t type, code;
6978
6979         ip6cp = (struct ip6ctlparam *)d;
6980         /*
6981          * XXX: We assume that when IPV6 is non NULL, M and OFF are valid.
6982          */
6983         if (ip6cp->ip6c_m == NULL) {
6984                 return;
6985         }
6986         /*
6987          * Check if we can safely examine the ports and the verification tag
6988          * of the SCTP common header.
6989          */
6990         if (ip6cp->ip6c_m->m_pkthdr.len <
6991             ip6cp->ip6c_off + sizeof(struct udphdr) + offsetof(struct sctphdr, checksum)) {
6992                 return;
6993         }
6994         /* Copy out the UDP header. */
6995         memset(&udp, 0, sizeof(struct udphdr));
6996         m_copydata(ip6cp->ip6c_m,
6997             ip6cp->ip6c_off,
6998             sizeof(struct udphdr),
6999             (caddr_t)&udp);
7000         /* Copy out the port numbers and the verification tag. */
7001         memset(&sh, 0, sizeof(struct sctphdr));
7002         m_copydata(ip6cp->ip6c_m,
7003             ip6cp->ip6c_off + sizeof(struct udphdr),
7004             sizeof(uint16_t) + sizeof(uint16_t) + sizeof(uint32_t),
7005             (caddr_t)&sh);
7006         memset(&src, 0, sizeof(struct sockaddr_in6));
7007         src.sin6_family = AF_INET6;
7008         src.sin6_len = sizeof(struct sockaddr_in6);
7009         src.sin6_port = sh.src_port;
7010         src.sin6_addr = ip6cp->ip6c_ip6->ip6_src;
7011         if (in6_setscope(&src.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) {
7012                 return;
7013         }
7014         memset(&dst, 0, sizeof(struct sockaddr_in6));
7015         dst.sin6_family = AF_INET6;
7016         dst.sin6_len = sizeof(struct sockaddr_in6);
7017         dst.sin6_port = sh.dest_port;
7018         dst.sin6_addr = ip6cp->ip6c_ip6->ip6_dst;
7019         if (in6_setscope(&dst.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) {
7020                 return;
7021         }
7022         inp = NULL;
7023         net = NULL;
7024         stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst,
7025             (struct sockaddr *)&src,
7026             &inp, &net, 1, SCTP_DEFAULT_VRFID);
7027         if ((stcb != NULL) &&
7028             (net != NULL) &&
7029             (inp != NULL)) {
7030                 /* Check the UDP port numbers */
7031                 if ((udp.uh_dport != net->port) ||
7032                     (udp.uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) {
7033                         SCTP_TCB_UNLOCK(stcb);
7034                         return;
7035                 }
7036                 /* Check the verification tag */
7037                 if (ntohl(sh.v_tag) != 0) {
7038                         /*
7039                          * This must be the verification tag used for
7040                          * sending out packets. We don't consider packets
7041                          * reflecting the verification tag.
7042                          */
7043                         if (ntohl(sh.v_tag) != stcb->asoc.peer_vtag) {
7044                                 SCTP_TCB_UNLOCK(stcb);
7045                                 return;
7046                         }
7047                 } else {
7048                         if (ip6cp->ip6c_m->m_pkthdr.len >=
7049                             ip6cp->ip6c_off + sizeof(struct udphdr) +
7050                             sizeof(struct sctphdr) +
7051                             sizeof(struct sctp_chunkhdr) +
7052                             offsetof(struct sctp_init, a_rwnd)) {
7053                                 /*
7054                                  * In this case we can check if we got an
7055                                  * INIT chunk and if the initiate tag
7056                                  * matches.
7057                                  */
7058                                 uint32_t initiate_tag;
7059                                 uint8_t chunk_type;
7060
7061                                 m_copydata(ip6cp->ip6c_m,
7062                                     ip6cp->ip6c_off +
7063                                     sizeof(struct udphdr) +
7064                                     sizeof(struct sctphdr),
7065                                     sizeof(uint8_t),
7066                                     (caddr_t)&chunk_type);
7067                                 m_copydata(ip6cp->ip6c_m,
7068                                     ip6cp->ip6c_off +
7069                                     sizeof(struct udphdr) +
7070                                     sizeof(struct sctphdr) +
7071                                     sizeof(struct sctp_chunkhdr),
7072                                     sizeof(uint32_t),
7073                                     (caddr_t)&initiate_tag);
7074                                 if ((chunk_type != SCTP_INITIATION) ||
7075                                     (ntohl(initiate_tag) != stcb->asoc.my_vtag)) {
7076                                         SCTP_TCB_UNLOCK(stcb);
7077                                         return;
7078                                 }
7079                         } else {
7080                                 SCTP_TCB_UNLOCK(stcb);
7081                                 return;
7082                         }
7083                 }
7084                 type = ip6cp->ip6c_icmp6->icmp6_type;
7085                 code = ip6cp->ip6c_icmp6->icmp6_code;
7086                 if ((type == ICMP6_DST_UNREACH) &&
7087                     (code == ICMP6_DST_UNREACH_NOPORT)) {
7088                         type = ICMP6_PARAM_PROB;
7089                         code = ICMP6_PARAMPROB_NEXTHEADER;
7090                 }
7091                 sctp6_notify(inp, stcb, net, type, code,
7092                     ntohl(ip6cp->ip6c_icmp6->icmp6_mtu));
7093         } else {
7094                 if ((stcb == NULL) && (inp != NULL)) {
7095                         /* reduce inp's ref-count */
7096                         SCTP_INP_WLOCK(inp);
7097                         SCTP_INP_DECR_REF(inp);
7098                         SCTP_INP_WUNLOCK(inp);
7099                 }
7100                 if (stcb) {
7101                         SCTP_TCB_UNLOCK(stcb);
7102                 }
7103         }
7104 }
7105 #endif
7106
7107 void
7108 sctp_over_udp_stop(void)
7109 {
7110         /*
7111          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
7112          * for writting!
7113          */
7114 #ifdef INET
7115         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
7116                 soclose(SCTP_BASE_INFO(udp4_tun_socket));
7117                 SCTP_BASE_INFO(udp4_tun_socket) = NULL;
7118         }
7119 #endif
7120 #ifdef INET6
7121         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
7122                 soclose(SCTP_BASE_INFO(udp6_tun_socket));
7123                 SCTP_BASE_INFO(udp6_tun_socket) = NULL;
7124         }
7125 #endif
7126 }
7127
7128 int
7129 sctp_over_udp_start(void)
7130 {
7131         uint16_t port;
7132         int ret;
7133 #ifdef INET
7134         struct sockaddr_in sin;
7135 #endif
7136 #ifdef INET6
7137         struct sockaddr_in6 sin6;
7138 #endif
7139         /*
7140          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
7141          * for writting!
7142          */
7143         port = SCTP_BASE_SYSCTL(sctp_udp_tunneling_port);
7144         if (ntohs(port) == 0) {
7145                 /* Must have a port set */
7146                 return (EINVAL);
7147         }
7148 #ifdef INET
7149         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
7150                 /* Already running -- must stop first */
7151                 return (EALREADY);
7152         }
7153 #endif
7154 #ifdef INET6
7155         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
7156                 /* Already running -- must stop first */
7157                 return (EALREADY);
7158         }
7159 #endif
7160 #ifdef INET
7161         if ((ret = socreate(PF_INET, &SCTP_BASE_INFO(udp4_tun_socket),
7162             SOCK_DGRAM, IPPROTO_UDP,
7163             curthread->td_ucred, curthread))) {
7164                 sctp_over_udp_stop();
7165                 return (ret);
7166         }
7167         /* Call the special UDP hook. */
7168         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp4_tun_socket),
7169             sctp_recv_udp_tunneled_packet,
7170             sctp_recv_icmp_tunneled_packet,
7171             NULL))) {
7172                 sctp_over_udp_stop();
7173                 return (ret);
7174         }
7175         /* Ok, we have a socket, bind it to the port. */
7176         memset(&sin, 0, sizeof(struct sockaddr_in));
7177         sin.sin_len = sizeof(struct sockaddr_in);
7178         sin.sin_family = AF_INET;
7179         sin.sin_port = htons(port);
7180         if ((ret = sobind(SCTP_BASE_INFO(udp4_tun_socket),
7181             (struct sockaddr *)&sin, curthread))) {
7182                 sctp_over_udp_stop();
7183                 return (ret);
7184         }
7185 #endif
7186 #ifdef INET6
7187         if ((ret = socreate(PF_INET6, &SCTP_BASE_INFO(udp6_tun_socket),
7188             SOCK_DGRAM, IPPROTO_UDP,
7189             curthread->td_ucred, curthread))) {
7190                 sctp_over_udp_stop();
7191                 return (ret);
7192         }
7193         /* Call the special UDP hook. */
7194         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp6_tun_socket),
7195             sctp_recv_udp_tunneled_packet,
7196             sctp_recv_icmp6_tunneled_packet,
7197             NULL))) {
7198                 sctp_over_udp_stop();
7199                 return (ret);
7200         }
7201         /* Ok, we have a socket, bind it to the port. */
7202         memset(&sin6, 0, sizeof(struct sockaddr_in6));
7203         sin6.sin6_len = sizeof(struct sockaddr_in6);
7204         sin6.sin6_family = AF_INET6;
7205         sin6.sin6_port = htons(port);
7206         if ((ret = sobind(SCTP_BASE_INFO(udp6_tun_socket),
7207             (struct sockaddr *)&sin6, curthread))) {
7208                 sctp_over_udp_stop();
7209                 return (ret);
7210         }
7211 #endif
7212         return (0);
7213 }
7214
7215 #if defined(INET6) || defined(INET)
7216
7217 /*
7218  * sctp_min_mtu ()returns the minimum of all non-zero arguments.
7219  * If all arguments are zero, zero is returned.
7220  */
7221 uint32_t
7222 sctp_min_mtu(uint32_t mtu1, uint32_t mtu2, uint32_t mtu3)
7223 {
7224         if (mtu1 > 0) {
7225                 if (mtu2 > 0) {
7226                         if (mtu3 > 0) {
7227                                 return (min(mtu1, min(mtu2, mtu3)));
7228                         } else {
7229                                 return (min(mtu1, mtu2));
7230                         }
7231                 } else {
7232                         if (mtu3 > 0) {
7233                                 return (min(mtu1, mtu3));
7234                         } else {
7235                                 return (mtu1);
7236                         }
7237                 }
7238         } else {
7239                 if (mtu2 > 0) {
7240                         if (mtu3 > 0) {
7241                                 return (min(mtu2, mtu3));
7242                         } else {
7243                                 return (mtu2);
7244                         }
7245                 } else {
7246                         return (mtu3);
7247                 }
7248         }
7249 }
7250
7251 void
7252 sctp_hc_set_mtu(union sctp_sockstore *addr, uint16_t fibnum, uint32_t mtu)
7253 {
7254         struct in_conninfo inc;
7255
7256         memset(&inc, 0, sizeof(struct in_conninfo));
7257         inc.inc_fibnum = fibnum;
7258         switch (addr->sa.sa_family) {
7259 #ifdef INET
7260         case AF_INET:
7261                 inc.inc_faddr = addr->sin.sin_addr;
7262                 break;
7263 #endif
7264 #ifdef INET6
7265         case AF_INET6:
7266                 inc.inc_flags |= INC_ISIPV6;
7267                 inc.inc6_faddr = addr->sin6.sin6_addr;
7268                 break;
7269 #endif
7270         default:
7271                 return;
7272         }
7273         tcp_hc_updatemtu(&inc, (u_long)mtu);
7274 }
7275
7276 uint32_t
7277 sctp_hc_get_mtu(union sctp_sockstore *addr, uint16_t fibnum)
7278 {
7279         struct in_conninfo inc;
7280
7281         memset(&inc, 0, sizeof(struct in_conninfo));
7282         inc.inc_fibnum = fibnum;
7283         switch (addr->sa.sa_family) {
7284 #ifdef INET
7285         case AF_INET:
7286                 inc.inc_faddr = addr->sin.sin_addr;
7287                 break;
7288 #endif
7289 #ifdef INET6
7290         case AF_INET6:
7291                 inc.inc_flags |= INC_ISIPV6;
7292                 inc.inc6_faddr = addr->sin6.sin6_addr;
7293                 break;
7294 #endif
7295         default:
7296                 return (0);
7297         }
7298         return ((uint32_t)tcp_hc_getmtu(&inc));
7299 }
7300 #endif