sys/netinet/sctputil.c

   1 /*-
   2  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions are met:
   6  *
   7  * a) Redistributions of source code must retain the above copyright notice,
   8  *   this list of conditions and the following disclaimer.
   9  *
  10  * b) Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in
  12  *   the documentation and/or other materials provided with the distribution.
  13  *
  14  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  15  *    contributors may be used to endorse or promote products derived
  16  *    from this software without specific prior written permission.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  20  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  22  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  28  * THE POSSIBILITY OF SUCH DAMAGE.
  29  */
  30
  31 /* $KAME: sctputil.c,v 1.37 2005/03/07 23:26:09 itojun Exp $     */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_pcb.h>
  38 #include <netinet/sctputil.h>
  39 #include <netinet/sctp_var.h>
  40 #include <netinet/sctp_sysctl.h>
  41 #ifdef INET6
  42 #endif
  43 #include <netinet/sctp_header.h>
  44 #include <netinet/sctp_output.h>
  45 #include <netinet/sctp_uio.h>
  46 #include <netinet/sctp_timer.h>
  47 #include <netinet/sctp_indata.h>/* for sctp_deliver_data() */
  48 #include <netinet/sctp_auth.h>
  49 #include <netinet/sctp_asconf.h>
  50 #include <netinet/sctp_cc_functions.h>
  51 #include <netinet/sctp_bsd_addr.h>
  52
  53 #define NUMBER_OF_MTU_SIZES 18
  54
  55
  56 #ifndef KTR_SCTP
  57 #define KTR_SCTP KTR_SUBSYS
  58 #endif
  59
  60 void
  61 sctp_sblog(struct sockbuf *sb,
  62     struct sctp_tcb *stcb, int from, int incr)
  63 {
  64         struct sctp_cwnd_log sctp_clog;
  65
  66         sctp_clog.x.sb.stcb = stcb;
  67         sctp_clog.x.sb.so_sbcc = sb->sb_cc;
  68         if (stcb)
  69                 sctp_clog.x.sb.stcb_sbcc = stcb->asoc.sb_cc;
  70         else
  71                 sctp_clog.x.sb.stcb_sbcc = 0;
  72         sctp_clog.x.sb.incr = incr;
  73         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
  74             SCTP_LOG_EVENT_SB,
  75             from,
  76             sctp_clog.x.misc.log1,
  77             sctp_clog.x.misc.log2,
  78             sctp_clog.x.misc.log3,
  79             sctp_clog.x.misc.log4);
  80 }
  81
  82 void
  83 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc)
  84 {
  85         struct sctp_cwnd_log sctp_clog;
  86
  87         sctp_clog.x.close.inp = (void *)inp;
  88         sctp_clog.x.close.sctp_flags = inp->sctp_flags;
  89         if (stcb) {
  90                 sctp_clog.x.close.stcb = (void *)stcb;
  91                 sctp_clog.x.close.state = (uint16_t) stcb->asoc.state;
  92         } else {
  93                 sctp_clog.x.close.stcb = 0;
  94                 sctp_clog.x.close.state = 0;
  95         }
  96         sctp_clog.x.close.loc = loc;
  97         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
  98             SCTP_LOG_EVENT_CLOSE,
  99             0,
 100             sctp_clog.x.misc.log1,
 101             sctp_clog.x.misc.log2,
 102             sctp_clog.x.misc.log3,
 103             sctp_clog.x.misc.log4);
 104 }
 105
 106
 107 void
 108 rto_logging(struct sctp_nets *net, int from)
 109 {
 110         struct sctp_cwnd_log sctp_clog;
 111
 112         memset(&sctp_clog, 0, sizeof(sctp_clog));
 113         sctp_clog.x.rto.net = (void *)net;
 114         sctp_clog.x.rto.rtt = net->prev_rtt;
 115         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 116             SCTP_LOG_EVENT_RTT,
 117             from,
 118             sctp_clog.x.misc.log1,
 119             sctp_clog.x.misc.log2,
 120             sctp_clog.x.misc.log3,
 121             sctp_clog.x.misc.log4);
 122
 123 }
 124
 125 void
 126 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from)
 127 {
 128         struct sctp_cwnd_log sctp_clog;
 129
 130         sctp_clog.x.strlog.stcb = stcb;
 131         sctp_clog.x.strlog.n_tsn = tsn;
 132         sctp_clog.x.strlog.n_sseq = sseq;
 133         sctp_clog.x.strlog.e_tsn = 0;
 134         sctp_clog.x.strlog.e_sseq = 0;
 135         sctp_clog.x.strlog.strm = stream;
 136         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 137             SCTP_LOG_EVENT_STRM,
 138             from,
 139             sctp_clog.x.misc.log1,
 140             sctp_clog.x.misc.log2,
 141             sctp_clog.x.misc.log3,
 142             sctp_clog.x.misc.log4);
 143
 144 }
 145
 146 void
 147 sctp_log_nagle_event(struct sctp_tcb *stcb, int action)
 148 {
 149         struct sctp_cwnd_log sctp_clog;
 150
 151         sctp_clog.x.nagle.stcb = (void *)stcb;
 152         sctp_clog.x.nagle.total_flight = stcb->asoc.total_flight;
 153         sctp_clog.x.nagle.total_in_queue = stcb->asoc.total_output_queue_size;
 154         sctp_clog.x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue;
 155         sctp_clog.x.nagle.count_in_flight = stcb->asoc.total_flight_count;
 156         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 157             SCTP_LOG_EVENT_NAGLE,
 158             action,
 159             sctp_clog.x.misc.log1,
 160             sctp_clog.x.misc.log2,
 161             sctp_clog.x.misc.log3,
 162             sctp_clog.x.misc.log4);
 163 }
 164
 165
 166 void
 167 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from)
 168 {
 169         struct sctp_cwnd_log sctp_clog;
 170
 171         sctp_clog.x.sack.cumack = cumack;
 172         sctp_clog.x.sack.oldcumack = old_cumack;
 173         sctp_clog.x.sack.tsn = tsn;
 174         sctp_clog.x.sack.numGaps = gaps;
 175         sctp_clog.x.sack.numDups = dups;
 176         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 177             SCTP_LOG_EVENT_SACK,
 178             from,
 179             sctp_clog.x.misc.log1,
 180             sctp_clog.x.misc.log2,
 181             sctp_clog.x.misc.log3,
 182             sctp_clog.x.misc.log4);
 183 }
 184
 185 void
 186 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from)
 187 {
 188         struct sctp_cwnd_log sctp_clog;
 189
 190         memset(&sctp_clog, 0, sizeof(sctp_clog));
 191         sctp_clog.x.map.base = map;
 192         sctp_clog.x.map.cum = cum;
 193         sctp_clog.x.map.high = high;
 194         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 195             SCTP_LOG_EVENT_MAP,
 196             from,
 197             sctp_clog.x.misc.log1,
 198             sctp_clog.x.misc.log2,
 199             sctp_clog.x.misc.log3,
 200             sctp_clog.x.misc.log4);
 201 }
 202
 203 void
 204 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn,
 205     int from)
 206 {
 207         struct sctp_cwnd_log sctp_clog;
 208
 209         memset(&sctp_clog, 0, sizeof(sctp_clog));
 210         sctp_clog.x.fr.largest_tsn = biggest_tsn;
 211         sctp_clog.x.fr.largest_new_tsn = biggest_new_tsn;
 212         sctp_clog.x.fr.tsn = tsn;
 213         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 214             SCTP_LOG_EVENT_FR,
 215             from,
 216             sctp_clog.x.misc.log1,
 217             sctp_clog.x.misc.log2,
 218             sctp_clog.x.misc.log3,
 219             sctp_clog.x.misc.log4);
 220
 221 }
 222
 223
 224 void
 225 sctp_log_mb(struct mbuf *m, int from)
 226 {
 227         struct sctp_cwnd_log sctp_clog;
 228
 229         sctp_clog.x.mb.mp = m;
 230         sctp_clog.x.mb.mbuf_flags = (uint8_t) (SCTP_BUF_GET_FLAGS(m));
 231         sctp_clog.x.mb.size = (uint16_t) (SCTP_BUF_LEN(m));
 232         sctp_clog.x.mb.data = SCTP_BUF_AT(m, 0);
 233         if (SCTP_BUF_IS_EXTENDED(m)) {
 234                 sctp_clog.x.mb.ext = SCTP_BUF_EXTEND_BASE(m);
 235                 sctp_clog.x.mb.refcnt = (uint8_t) (SCTP_BUF_EXTEND_REFCNT(m));
 236         } else {
 237                 sctp_clog.x.mb.ext = 0;
 238                 sctp_clog.x.mb.refcnt = 0;
 239         }
 240         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 241             SCTP_LOG_EVENT_MBUF,
 242             from,
 243             sctp_clog.x.misc.log1,
 244             sctp_clog.x.misc.log2,
 245             sctp_clog.x.misc.log3,
 246             sctp_clog.x.misc.log4);
 247 }
 248
 249
 250 void
 251 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk,
 252     int from)
 253 {
 254         struct sctp_cwnd_log sctp_clog;
 255
 256         if (control == NULL) {
 257                 SCTP_PRINTF("Gak log of NULL?\n");
 258                 return;
 259         }
 260         sctp_clog.x.strlog.stcb = control->stcb;
 261         sctp_clog.x.strlog.n_tsn = control->sinfo_tsn;
 262         sctp_clog.x.strlog.n_sseq = control->sinfo_ssn;
 263         sctp_clog.x.strlog.strm = control->sinfo_stream;
 264         if (poschk != NULL) {
 265                 sctp_clog.x.strlog.e_tsn = poschk->sinfo_tsn;
 266                 sctp_clog.x.strlog.e_sseq = poschk->sinfo_ssn;
 267         } else {
 268                 sctp_clog.x.strlog.e_tsn = 0;
 269                 sctp_clog.x.strlog.e_sseq = 0;
 270         }
 271         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 272             SCTP_LOG_EVENT_STRM,
 273             from,
 274             sctp_clog.x.misc.log1,
 275             sctp_clog.x.misc.log2,
 276             sctp_clog.x.misc.log3,
 277             sctp_clog.x.misc.log4);
 278
 279 }
 280
 281 void
 282 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from)
 283 {
 284         struct sctp_cwnd_log sctp_clog;
 285
 286         sctp_clog.x.cwnd.net = net;
 287         if (stcb->asoc.send_queue_cnt > 255)
 288                 sctp_clog.x.cwnd.cnt_in_send = 255;
 289         else
 290                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 291         if (stcb->asoc.stream_queue_cnt > 255)
 292                 sctp_clog.x.cwnd.cnt_in_str = 255;
 293         else
 294                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 295
 296         if (net) {
 297                 sctp_clog.x.cwnd.cwnd_new_value = net->cwnd;
 298                 sctp_clog.x.cwnd.inflight = net->flight_size;
 299                 sctp_clog.x.cwnd.pseudo_cumack = net->pseudo_cumack;
 300                 sctp_clog.x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack;
 301                 sctp_clog.x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack;
 302         }
 303         if (SCTP_CWNDLOG_PRESEND == from) {
 304                 sctp_clog.x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd;
 305         }
 306         sctp_clog.x.cwnd.cwnd_augment = augment;
 307         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 308             SCTP_LOG_EVENT_CWND,
 309             from,
 310             sctp_clog.x.misc.log1,
 311             sctp_clog.x.misc.log2,
 312             sctp_clog.x.misc.log3,
 313             sctp_clog.x.misc.log4);
 314
 315 }
 316
 317 void
 318 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from)
 319 {
 320         struct sctp_cwnd_log sctp_clog;
 321
 322         memset(&sctp_clog, 0, sizeof(sctp_clog));
 323         if (inp) {
 324                 sctp_clog.x.lock.sock = (void *)inp->sctp_socket;
 325
 326         } else {
 327                 sctp_clog.x.lock.sock = (void *)NULL;
 328         }
 329         sctp_clog.x.lock.inp = (void *)inp;
 330         if (stcb) {
 331                 sctp_clog.x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx);
 332         } else {
 333                 sctp_clog.x.lock.tcb_lock = SCTP_LOCK_UNKNOWN;
 334         }
 335         if (inp) {
 336                 sctp_clog.x.lock.inp_lock = mtx_owned(&inp->inp_mtx);
 337                 sctp_clog.x.lock.create_lock = mtx_owned(&inp->inp_create_mtx);
 338         } else {
 339                 sctp_clog.x.lock.inp_lock = SCTP_LOCK_UNKNOWN;
 340                 sctp_clog.x.lock.create_lock = SCTP_LOCK_UNKNOWN;
 341         }
 342         sctp_clog.x.lock.info_lock = rw_wowned(&SCTP_BASE_INFO(ipi_ep_mtx));
 343         if (inp && (inp->sctp_socket)) {
 344                 sctp_clog.x.lock.sock_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 345                 sctp_clog.x.lock.sockrcvbuf_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 346                 sctp_clog.x.lock.socksndbuf_lock = mtx_owned(&(inp->sctp_socket->so_snd.sb_mtx));
 347         } else {
 348                 sctp_clog.x.lock.sock_lock = SCTP_LOCK_UNKNOWN;
 349                 sctp_clog.x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN;
 350                 sctp_clog.x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN;
 351         }
 352         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 353             SCTP_LOG_LOCK_EVENT,
 354             from,
 355             sctp_clog.x.misc.log1,
 356             sctp_clog.x.misc.log2,
 357             sctp_clog.x.misc.log3,
 358             sctp_clog.x.misc.log4);
 359
 360 }
 361
 362 void
 363 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from)
 364 {
 365         struct sctp_cwnd_log sctp_clog;
 366
 367         memset(&sctp_clog, 0, sizeof(sctp_clog));
 368         sctp_clog.x.cwnd.net = net;
 369         sctp_clog.x.cwnd.cwnd_new_value = error;
 370         sctp_clog.x.cwnd.inflight = net->flight_size;
 371         sctp_clog.x.cwnd.cwnd_augment = burst;
 372         if (stcb->asoc.send_queue_cnt > 255)
 373                 sctp_clog.x.cwnd.cnt_in_send = 255;
 374         else
 375                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 376         if (stcb->asoc.stream_queue_cnt > 255)
 377                 sctp_clog.x.cwnd.cnt_in_str = 255;
 378         else
 379                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 380         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 381             SCTP_LOG_EVENT_MAXBURST,
 382             from,
 383             sctp_clog.x.misc.log1,
 384             sctp_clog.x.misc.log2,
 385             sctp_clog.x.misc.log3,
 386             sctp_clog.x.misc.log4);
 387
 388 }
 389
 390 void
 391 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead)
 392 {
 393         struct sctp_cwnd_log sctp_clog;
 394
 395         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 396         sctp_clog.x.rwnd.send_size = snd_size;
 397         sctp_clog.x.rwnd.overhead = overhead;
 398         sctp_clog.x.rwnd.new_rwnd = 0;
 399         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 400             SCTP_LOG_EVENT_RWND,
 401             from,
 402             sctp_clog.x.misc.log1,
 403             sctp_clog.x.misc.log2,
 404             sctp_clog.x.misc.log3,
 405             sctp_clog.x.misc.log4);
 406 }
 407
 408 void
 409 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval)
 410 {
 411         struct sctp_cwnd_log sctp_clog;
 412
 413         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 414         sctp_clog.x.rwnd.send_size = flight_size;
 415         sctp_clog.x.rwnd.overhead = overhead;
 416         sctp_clog.x.rwnd.new_rwnd = a_rwndval;
 417         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 418             SCTP_LOG_EVENT_RWND,
 419             from,
 420             sctp_clog.x.misc.log1,
 421             sctp_clog.x.misc.log2,
 422             sctp_clog.x.misc.log3,
 423             sctp_clog.x.misc.log4);
 424 }
 425
 426 void
 427 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt)
 428 {
 429         struct sctp_cwnd_log sctp_clog;
 430
 431         sctp_clog.x.mbcnt.total_queue_size = total_oq;
 432         sctp_clog.x.mbcnt.size_change = book;
 433         sctp_clog.x.mbcnt.total_queue_mb_size = total_mbcnt_q;
 434         sctp_clog.x.mbcnt.mbcnt_change = mbcnt;
 435         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 436             SCTP_LOG_EVENT_MBCNT,
 437             from,
 438             sctp_clog.x.misc.log1,
 439             sctp_clog.x.misc.log2,
 440             sctp_clog.x.misc.log3,
 441             sctp_clog.x.misc.log4);
 442
 443 }
 444
 445 void
 446 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d)
 447 {
 448         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 449             SCTP_LOG_MISC_EVENT,
 450             from,
 451             a, b, c, d);
 452 }
 453
 454 void
 455 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t cumtsn, uint32_t wake_cnt, int from)
 456 {
 457         struct sctp_cwnd_log sctp_clog;
 458
 459         sctp_clog.x.wake.stcb = (void *)stcb;
 460         sctp_clog.x.wake.wake_cnt = wake_cnt;
 461         sctp_clog.x.wake.flight = stcb->asoc.total_flight_count;
 462         sctp_clog.x.wake.send_q = stcb->asoc.send_queue_cnt;
 463         sctp_clog.x.wake.sent_q = stcb->asoc.sent_queue_cnt;
 464
 465         if (stcb->asoc.stream_queue_cnt < 0xff)
 466                 sctp_clog.x.wake.stream_qcnt = (uint8_t) stcb->asoc.stream_queue_cnt;
 467         else
 468                 sctp_clog.x.wake.stream_qcnt = 0xff;
 469
 470         if (stcb->asoc.chunks_on_out_queue < 0xff)
 471                 sctp_clog.x.wake.chunks_on_oque = (uint8_t) stcb->asoc.chunks_on_out_queue;
 472         else
 473                 sctp_clog.x.wake.chunks_on_oque = 0xff;
 474
 475         sctp_clog.x.wake.sctpflags = 0;
 476         /* set in the defered mode stuff */
 477         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE)
 478                 sctp_clog.x.wake.sctpflags |= 1;
 479         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT)
 480                 sctp_clog.x.wake.sctpflags |= 2;
 481         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT)
 482                 sctp_clog.x.wake.sctpflags |= 4;
 483         /* what about the sb */
 484         if (stcb->sctp_socket) {
 485                 struct socket *so = stcb->sctp_socket;
 486
 487                 sctp_clog.x.wake.sbflags = (uint8_t) ((so->so_snd.sb_flags & 0x00ff));
 488         } else {
 489                 sctp_clog.x.wake.sbflags = 0xff;
 490         }
 491         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 492             SCTP_LOG_EVENT_WAKE,
 493             from,
 494             sctp_clog.x.misc.log1,
 495             sctp_clog.x.misc.log2,
 496             sctp_clog.x.misc.log3,
 497             sctp_clog.x.misc.log4);
 498
 499 }
 500
 501 void
 502 sctp_log_block(uint8_t from, struct socket *so, struct sctp_association *asoc, int sendlen)
 503 {
 504         struct sctp_cwnd_log sctp_clog;
 505
 506         sctp_clog.x.blk.onsb = asoc->total_output_queue_size;
 507         sctp_clog.x.blk.send_sent_qcnt = (uint16_t) (asoc->send_queue_cnt + asoc->sent_queue_cnt);
 508         sctp_clog.x.blk.peer_rwnd = asoc->peers_rwnd;
 509         sctp_clog.x.blk.stream_qcnt = (uint16_t) asoc->stream_queue_cnt;
 510         sctp_clog.x.blk.chunks_on_oque = (uint16_t) asoc->chunks_on_out_queue;
 511         sctp_clog.x.blk.flight_size = (uint16_t) (asoc->total_flight / 1024);
 512         sctp_clog.x.blk.sndlen = sendlen;
 513         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 514             SCTP_LOG_EVENT_BLOCK,
 515             from,
 516             sctp_clog.x.misc.log1,
 517             sctp_clog.x.misc.log2,
 518             sctp_clog.x.misc.log3,
 519             sctp_clog.x.misc.log4);
 520
 521 }
 522
 523 int
 524 sctp_fill_stat_log(void *optval, size_t *optsize)
 525 {
 526         /* May need to fix this if ktrdump does not work */
 527         return (0);
 528 }
 529
 530 #ifdef SCTP_AUDITING_ENABLED
 531 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2];
 532 static int sctp_audit_indx = 0;
 533
 534 static
 535 void
 536 sctp_print_audit_report(void)
 537 {
 538         int i;
 539         int cnt;
 540
 541         cnt = 0;
 542         for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) {
 543                 if ((sctp_audit_data[i][0] == 0xe0) &&
 544                     (sctp_audit_data[i][1] == 0x01)) {
 545                         cnt = 0;
 546                         SCTP_PRINTF("\n");
 547                 } else if (sctp_audit_data[i][0] == 0xf0) {
 548                         cnt = 0;
 549                         SCTP_PRINTF("\n");
 550                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 551                     (sctp_audit_data[i][1] == 0x01)) {
 552                         SCTP_PRINTF("\n");
 553                         cnt = 0;
 554                 }
 555                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0],
 556                     (uint32_t) sctp_audit_data[i][1]);
 557                 cnt++;
 558                 if ((cnt % 14) == 0)
 559                         SCTP_PRINTF("\n");
 560         }
 561         for (i = 0; i < sctp_audit_indx; i++) {
 562                 if ((sctp_audit_data[i][0] == 0xe0) &&
 563                     (sctp_audit_data[i][1] == 0x01)) {
 564                         cnt = 0;
 565                         SCTP_PRINTF("\n");
 566                 } else if (sctp_audit_data[i][0] == 0xf0) {
 567                         cnt = 0;
 568                         SCTP_PRINTF("\n");
 569                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 570                     (sctp_audit_data[i][1] == 0x01)) {
 571                         SCTP_PRINTF("\n");
 572                         cnt = 0;
 573                 }
 574                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0],
 575                     (uint32_t) sctp_audit_data[i][1]);
 576                 cnt++;
 577                 if ((cnt % 14) == 0)
 578                         SCTP_PRINTF("\n");
 579         }
 580         SCTP_PRINTF("\n");
 581 }
 582
 583 void
 584 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 585     struct sctp_nets *net)
 586 {
 587         int resend_cnt, tot_out, rep, tot_book_cnt;
 588         struct sctp_nets *lnet;
 589         struct sctp_tmit_chunk *chk;
 590
 591         sctp_audit_data[sctp_audit_indx][0] = 0xAA;
 592         sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from;
 593         sctp_audit_indx++;
 594         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 595                 sctp_audit_indx = 0;
 596         }
 597         if (inp == NULL) {
 598                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 599                 sctp_audit_data[sctp_audit_indx][1] = 0x01;
 600                 sctp_audit_indx++;
 601                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 602                         sctp_audit_indx = 0;
 603                 }
 604                 return;
 605         }
 606         if (stcb == NULL) {
 607                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 608                 sctp_audit_data[sctp_audit_indx][1] = 0x02;
 609                 sctp_audit_indx++;
 610                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 611                         sctp_audit_indx = 0;
 612                 }
 613                 return;
 614         }
 615         sctp_audit_data[sctp_audit_indx][0] = 0xA1;
 616         sctp_audit_data[sctp_audit_indx][1] =
 617             (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 618         sctp_audit_indx++;
 619         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 620                 sctp_audit_indx = 0;
 621         }
 622         rep = 0;
 623         tot_book_cnt = 0;
 624         resend_cnt = tot_out = 0;
 625         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 626                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 627                         resend_cnt++;
 628                 } else if (chk->sent < SCTP_DATAGRAM_RESEND) {
 629                         tot_out += chk->book_size;
 630                         tot_book_cnt++;
 631                 }
 632         }
 633         if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) {
 634                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 635                 sctp_audit_data[sctp_audit_indx][1] = 0xA1;
 636                 sctp_audit_indx++;
 637                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 638                         sctp_audit_indx = 0;
 639                 }
 640                 SCTP_PRINTF("resend_cnt:%d asoc-tot:%d\n",
 641                     resend_cnt, stcb->asoc.sent_queue_retran_cnt);
 642                 rep = 1;
 643                 stcb->asoc.sent_queue_retran_cnt = resend_cnt;
 644                 sctp_audit_data[sctp_audit_indx][0] = 0xA2;
 645                 sctp_audit_data[sctp_audit_indx][1] =
 646                     (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 647                 sctp_audit_indx++;
 648                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 649                         sctp_audit_indx = 0;
 650                 }
 651         }
 652         if (tot_out != stcb->asoc.total_flight) {
 653                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 654                 sctp_audit_data[sctp_audit_indx][1] = 0xA2;
 655                 sctp_audit_indx++;
 656                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 657                         sctp_audit_indx = 0;
 658                 }
 659                 rep = 1;
 660                 SCTP_PRINTF("tot_flt:%d asoc_tot:%d\n", tot_out,
 661                     (int)stcb->asoc.total_flight);
 662                 stcb->asoc.total_flight = tot_out;
 663         }
 664         if (tot_book_cnt != stcb->asoc.total_flight_count) {
 665                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 666                 sctp_audit_data[sctp_audit_indx][1] = 0xA5;
 667                 sctp_audit_indx++;
 668                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 669                         sctp_audit_indx = 0;
 670                 }
 671                 rep = 1;
 672                 SCTP_PRINTF("tot_flt_book:%d\n", tot_book_cnt);
 673
 674                 stcb->asoc.total_flight_count = tot_book_cnt;
 675         }
 676         tot_out = 0;
 677         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 678                 tot_out += lnet->flight_size;
 679         }
 680         if (tot_out != stcb->asoc.total_flight) {
 681                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 682                 sctp_audit_data[sctp_audit_indx][1] = 0xA3;
 683                 sctp_audit_indx++;
 684                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 685                         sctp_audit_indx = 0;
 686                 }
 687                 rep = 1;
 688                 SCTP_PRINTF("real flight:%d net total was %d\n",
 689                     stcb->asoc.total_flight, tot_out);
 690                 /* now corrective action */
 691                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 692
 693                         tot_out = 0;
 694                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 695                                 if ((chk->whoTo == lnet) &&
 696                                     (chk->sent < SCTP_DATAGRAM_RESEND)) {
 697                                         tot_out += chk->book_size;
 698                                 }
 699                         }
 700                         if (lnet->flight_size != tot_out) {
 701                                 SCTP_PRINTF("net:%p flight was %d corrected to %d\n",
 702                                     lnet, lnet->flight_size,
 703                                     tot_out);
 704                                 lnet->flight_size = tot_out;
 705                         }
 706                 }
 707         }
 708         if (rep) {
 709                 sctp_print_audit_report();
 710         }
 711 }
 712
 713 void
 714 sctp_audit_log(uint8_t ev, uint8_t fd)
 715 {
 716
 717         sctp_audit_data[sctp_audit_indx][0] = ev;
 718         sctp_audit_data[sctp_audit_indx][1] = fd;
 719         sctp_audit_indx++;
 720         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 721                 sctp_audit_indx = 0;
 722         }
 723 }
 724
 725 #endif
 726
 727 /*
 728  * a list of sizes based on typical mtu's, used only if next hop size not
 729  * returned.
 730  */
 731 static int sctp_mtu_sizes[] = {
 732         68,
 733         296,
 734         508,
 735         512,
 736         544,
 737         576,
 738         1006,
 739         1492,
 740         1500,
 741         1536,
 742         2002,
 743         2048,
 744         4352,
 745         4464,
 746         8166,
 747         17914,
 748         32000,
 749         65535
 750 };
 751
 752 void
 753 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb)
 754 {
 755         struct sctp_association *asoc;
 756         struct sctp_nets *net;
 757
 758         asoc = &stcb->asoc;
 759
 760         (void)SCTP_OS_TIMER_STOP(&asoc->hb_timer.timer);
 761         (void)SCTP_OS_TIMER_STOP(&asoc->dack_timer.timer);
 762         (void)SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
 763         (void)SCTP_OS_TIMER_STOP(&asoc->asconf_timer.timer);
 764         (void)SCTP_OS_TIMER_STOP(&asoc->autoclose_timer.timer);
 765         (void)SCTP_OS_TIMER_STOP(&asoc->delayed_event_timer.timer);
 766         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
 767                 (void)SCTP_OS_TIMER_STOP(&net->fr_timer.timer);
 768                 (void)SCTP_OS_TIMER_STOP(&net->pmtu_timer.timer);
 769         }
 770 }
 771
 772 int
 773 find_next_best_mtu(int totsz)
 774 {
 775         int i, perfer;
 776
 777         /*
 778          * if we are in here we must find the next best fit based on the
 779          * size of the dg that failed to be sent.
 780          */
 781         perfer = 0;
 782         for (i = 0; i < NUMBER_OF_MTU_SIZES; i++) {
 783                 if (totsz < sctp_mtu_sizes[i]) {
 784                         perfer = i - 1;
 785                         if (perfer < 0)
 786                                 perfer = 0;
 787                         break;
 788                 }
 789         }
 790         return (sctp_mtu_sizes[perfer]);
 791 }
 792
 793 void
 794 sctp_fill_random_store(struct sctp_pcb *m)
 795 {
 796         /*
 797          * Here we use the MD5/SHA-1 to hash with our good randomNumbers and
 798          * our counter. The result becomes our good random numbers and we
 799          * then setup to give these out. Note that we do no locking to
 800          * protect this. This is ok, since if competing folks call this we
 801          * will get more gobbled gook in the random store which is what we
 802          * want. There is a danger that two guys will use the same random
 803          * numbers, but thats ok too since that is random as well :->
 804          */
 805         m->store_at = 0;
 806         (void)sctp_hmac(SCTP_HMAC, (uint8_t *) m->random_numbers,
 807             sizeof(m->random_numbers), (uint8_t *) & m->random_counter,
 808             sizeof(m->random_counter), (uint8_t *) m->random_store);
 809         m->random_counter++;
 810 }
 811
 812 uint32_t
 813 sctp_select_initial_TSN(struct sctp_pcb *inp)
 814 {
 815         /*
 816          * A true implementation should use random selection process to get
 817          * the initial stream sequence number, using RFC1750 as a good
 818          * guideline
 819          */
 820         uint32_t x, *xp;
 821         uint8_t *p;
 822         int store_at, new_store;
 823
 824         if (inp->initial_sequence_debug != 0) {
 825                 uint32_t ret;
 826
 827                 ret = inp->initial_sequence_debug;
 828                 inp->initial_sequence_debug++;
 829                 return (ret);
 830         }
 831 retry:
 832         store_at = inp->store_at;
 833         new_store = store_at + sizeof(uint32_t);
 834         if (new_store >= (SCTP_SIGNATURE_SIZE - 3)) {
 835                 new_store = 0;
 836         }
 837         if (!atomic_cmpset_int(&inp->store_at, store_at, new_store)) {
 838                 goto retry;
 839         }
 840         if (new_store == 0) {
 841                 /* Refill the random store */
 842                 sctp_fill_random_store(inp);
 843         }
 844         p = &inp->random_store[store_at];
 845         xp = (uint32_t *) p;
 846         x = *xp;
 847         return (x);
 848 }
 849
 850 uint32_t
 851 sctp_select_a_tag(struct sctp_inpcb *inp, uint16_t lport, uint16_t rport, int save_in_twait)
 852 {
 853         uint32_t x, not_done;
 854         struct timeval now;
 855
 856         (void)SCTP_GETTIME_TIMEVAL(&now);
 857         not_done = 1;
 858         while (not_done) {
 859                 x = sctp_select_initial_TSN(&inp->sctp_ep);
 860                 if (x == 0) {
 861                         /* we never use 0 */
 862                         continue;
 863                 }
 864                 if (sctp_is_vtag_good(inp, x, lport, rport, &now, save_in_twait)) {
 865                         not_done = 0;
 866                 }
 867         }
 868         return (x);
 869 }
 870
 871 int
 872 sctp_init_asoc(struct sctp_inpcb *m, struct sctp_tcb *stcb,
 873     uint32_t override_tag, uint32_t vrf_id)
 874 {
 875         struct sctp_association *asoc;
 876
 877         /*
 878          * Anything set to zero is taken care of by the allocation routine's
 879          * bzero
 880          */
 881
 882         /*
 883          * Up front select what scoping to apply on addresses I tell my peer
 884          * Not sure what to do with these right now, we will need to come up
 885          * with a way to set them. We may need to pass them through from the
 886          * caller in the sctp_aloc_assoc() function.
 887          */
 888         int i;
 889
 890         asoc = &stcb->asoc;
 891         /* init all variables to a known value. */
 892         SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_INUSE);
 893         asoc->max_burst = m->sctp_ep.max_burst;
 894         asoc->heart_beat_delay = TICKS_TO_MSEC(m->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]);
 895         asoc->cookie_life = m->sctp_ep.def_cookie_life;
 896         asoc->sctp_cmt_on_off = m->sctp_cmt_on_off;
 897         asoc->sctp_nr_sack_on_off = (uint8_t) SCTP_BASE_SYSCTL(sctp_nr_sack_on_off);
 898         asoc->sctp_cmt_pf = (uint8_t) SCTP_BASE_SYSCTL(sctp_cmt_pf);
 899         asoc->sctp_frag_point = m->sctp_frag_point;
 900 #ifdef INET
 901         asoc->default_tos = m->ip_inp.inp.inp_ip_tos;
 902 #else
 903         asoc->default_tos = 0;
 904 #endif
 905
 906 #ifdef INET6
 907         asoc->default_flowlabel = ((struct in6pcb *)m)->in6p_flowinfo;
 908 #else
 909         asoc->default_flowlabel = 0;
 910 #endif
 911         asoc->sb_send_resv = 0;
 912         if (override_tag) {
 913                 asoc->my_vtag = override_tag;
 914         } else {
 915                 asoc->my_vtag = sctp_select_a_tag(m, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
 916         }
 917         /* Get the nonce tags */
 918         asoc->my_vtag_nonce = sctp_select_a_tag(m, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
 919         asoc->peer_vtag_nonce = sctp_select_a_tag(m, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
 920         asoc->vrf_id = vrf_id;
 921
 922         if (sctp_is_feature_on(m, SCTP_PCB_FLAGS_DONOT_HEARTBEAT))
 923                 asoc->hb_is_disabled = 1;
 924         else
 925                 asoc->hb_is_disabled = 0;
 926
 927 #ifdef SCTP_ASOCLOG_OF_TSNS
 928         asoc->tsn_in_at = 0;
 929         asoc->tsn_out_at = 0;
 930         asoc->tsn_in_wrapped = 0;
 931         asoc->tsn_out_wrapped = 0;
 932         asoc->cumack_log_at = 0;
 933         asoc->cumack_log_atsnt = 0;
 934 #endif
 935 #ifdef SCTP_FS_SPEC_LOG
 936         asoc->fs_index = 0;
 937 #endif
 938         asoc->refcnt = 0;
 939         asoc->assoc_up_sent = 0;
 940         asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number = asoc->sending_seq =
 941             sctp_select_initial_TSN(&m->sctp_ep);
 942         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
 943         /* we are optimisitic here */
 944         asoc->peer_supports_pktdrop = 1;
 945         asoc->peer_supports_nat = 0;
 946         asoc->sent_queue_retran_cnt = 0;
 947
 948         /* for CMT */
 949         asoc->last_net_cmt_send_started = NULL;
 950
 951         /* This will need to be adjusted */
 952         asoc->last_cwr_tsn = asoc->init_seq_number - 1;
 953         asoc->last_acked_seq = asoc->init_seq_number - 1;
 954         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
 955         asoc->asconf_seq_in = asoc->last_acked_seq;
 956
 957         /* here we are different, we hold the next one we expect */
 958         asoc->str_reset_seq_in = asoc->last_acked_seq + 1;
 959
 960         asoc->initial_init_rto_max = m->sctp_ep.initial_init_rto_max;
 961         asoc->initial_rto = m->sctp_ep.initial_rto;
 962
 963         asoc->max_init_times = m->sctp_ep.max_init_times;
 964         asoc->max_send_times = m->sctp_ep.max_send_times;
 965         asoc->def_net_failure = m->sctp_ep.def_net_failure;
 966         asoc->free_chunk_cnt = 0;
 967
 968         asoc->iam_blocking = 0;
 969         /* ECN Nonce initialization */
 970         asoc->context = m->sctp_context;
 971         asoc->def_send = m->def_send;
 972         asoc->ecn_nonce_allowed = 0;
 973         asoc->receiver_nonce_sum = 1;
 974         asoc->nonce_sum_expect_base = 1;
 975         asoc->nonce_sum_check = 1;
 976         asoc->nonce_resync_tsn = 0;
 977         asoc->nonce_wait_for_ecne = 0;
 978         asoc->nonce_wait_tsn = 0;
 979         asoc->delayed_ack = TICKS_TO_MSEC(m->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]);
 980         asoc->sack_freq = m->sctp_ep.sctp_sack_freq;
 981         asoc->pr_sctp_cnt = 0;
 982         asoc->total_output_queue_size = 0;
 983
 984         if (m->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
 985                 struct in6pcb *inp6;
 986
 987                 /* Its a V6 socket */
 988                 inp6 = (struct in6pcb *)m;
 989                 asoc->ipv6_addr_legal = 1;
 990                 /* Now look at the binding flag to see if V4 will be legal */
 991                 if (SCTP_IPV6_V6ONLY(inp6) == 0) {
 992                         asoc->ipv4_addr_legal = 1;
 993                 } else {
 994                         /* V4 addresses are NOT legal on the association */
 995                         asoc->ipv4_addr_legal = 0;
 996                 }
 997         } else {
 998                 /* Its a V4 socket, no - V6 */
 999                 asoc->ipv4_addr_legal = 1;
1000                 asoc->ipv6_addr_legal = 0;
1001         }
1002
1003         asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(m->sctp_socket), SCTP_MINIMAL_RWND);
1004         asoc->peers_rwnd = SCTP_SB_LIMIT_RCV(m->sctp_socket);
1005
1006         asoc->smallest_mtu = m->sctp_frag_point;
1007 #ifdef SCTP_PRINT_FOR_B_AND_M
1008         SCTP_PRINTF("smallest_mtu init'd with asoc to :%d\n",
1009             asoc->smallest_mtu);
1010 #endif
1011         asoc->minrto = m->sctp_ep.sctp_minrto;
1012         asoc->maxrto = m->sctp_ep.sctp_maxrto;
1013
1014         asoc->locked_on_sending = NULL;
1015         asoc->stream_locked_on = 0;
1016         asoc->ecn_echo_cnt_onq = 0;
1017         asoc->stream_locked = 0;
1018
1019         asoc->send_sack = 1;
1020
1021         LIST_INIT(&asoc->sctp_restricted_addrs);
1022
1023         TAILQ_INIT(&asoc->nets);
1024         TAILQ_INIT(&asoc->pending_reply_queue);
1025         TAILQ_INIT(&asoc->asconf_ack_sent);
1026         /* Setup to fill the hb random cache at first HB */
1027         asoc->hb_random_idx = 4;
1028
1029         asoc->sctp_autoclose_ticks = m->sctp_ep.auto_close_time;
1030
1031         /*
1032          * JRS - Pick the default congestion control module based on the
1033          * sysctl.
1034          */
1035         switch (m->sctp_ep.sctp_default_cc_module) {
1036                 /* JRS - Standard TCP congestion control */
1037         case SCTP_CC_RFC2581:
1038                 {
1039                         stcb->asoc.congestion_control_module = SCTP_CC_RFC2581;
1040                         stcb->asoc.cc_functions.sctp_set_initial_cc_param = &sctp_set_initial_cc_param;
1041                         stcb->asoc.cc_functions.sctp_cwnd_update_after_sack = &sctp_cwnd_update_after_sack;
1042                         stcb->asoc.cc_functions.sctp_cwnd_update_after_fr = &sctp_cwnd_update_after_fr;
1043                         stcb->asoc.cc_functions.sctp_cwnd_update_after_timeout = &sctp_cwnd_update_after_timeout;
1044                         stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo = &sctp_cwnd_update_after_ecn_echo;
1045                         stcb->asoc.cc_functions.sctp_cwnd_update_after_packet_dropped = &sctp_cwnd_update_after_packet_dropped;
1046                         stcb->asoc.cc_functions.sctp_cwnd_update_after_output = &sctp_cwnd_update_after_output;
1047                         stcb->asoc.cc_functions.sctp_cwnd_update_after_fr_timer = &sctp_cwnd_update_after_fr_timer;
1048                         break;
1049                 }
1050                 /* JRS - High Speed TCP congestion control (Floyd) */
1051         case SCTP_CC_HSTCP:
1052                 {
1053                         stcb->asoc.congestion_control_module = SCTP_CC_HSTCP;
1054                         stcb->asoc.cc_functions.sctp_set_initial_cc_param = &sctp_set_initial_cc_param;
1055                         stcb->asoc.cc_functions.sctp_cwnd_update_after_sack = &sctp_hs_cwnd_update_after_sack;
1056                         stcb->asoc.cc_functions.sctp_cwnd_update_after_fr = &sctp_hs_cwnd_update_after_fr;
1057                         stcb->asoc.cc_functions.sctp_cwnd_update_after_timeout = &sctp_cwnd_update_after_timeout;
1058                         stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo = &sctp_cwnd_update_after_ecn_echo;
1059                         stcb->asoc.cc_functions.sctp_cwnd_update_after_packet_dropped = &sctp_cwnd_update_after_packet_dropped;
1060                         stcb->asoc.cc_functions.sctp_cwnd_update_after_output = &sctp_cwnd_update_after_output;
1061                         stcb->asoc.cc_functions.sctp_cwnd_update_after_fr_timer = &sctp_cwnd_update_after_fr_timer;
1062                         break;
1063                 }
1064                 /* JRS - HTCP congestion control */
1065         case SCTP_CC_HTCP:
1066                 {
1067                         stcb->asoc.congestion_control_module = SCTP_CC_HTCP;
1068                         stcb->asoc.cc_functions.sctp_set_initial_cc_param = &sctp_htcp_set_initial_cc_param;
1069                         stcb->asoc.cc_functions.sctp_cwnd_update_after_sack = &sctp_htcp_cwnd_update_after_sack;
1070                         stcb->asoc.cc_functions.sctp_cwnd_update_after_fr = &sctp_htcp_cwnd_update_after_fr;
1071                         stcb->asoc.cc_functions.sctp_cwnd_update_after_timeout = &sctp_htcp_cwnd_update_after_timeout;
1072                         stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo = &sctp_htcp_cwnd_update_after_ecn_echo;
1073                         stcb->asoc.cc_functions.sctp_cwnd_update_after_packet_dropped = &sctp_cwnd_update_after_packet_dropped;
1074                         stcb->asoc.cc_functions.sctp_cwnd_update_after_output = &sctp_cwnd_update_after_output;
1075                         stcb->asoc.cc_functions.sctp_cwnd_update_after_fr_timer = &sctp_htcp_cwnd_update_after_fr_timer;
1076                         break;
1077                 }
1078                 /* JRS - By default, use RFC2581 */
1079         default:
1080                 {
1081                         stcb->asoc.congestion_control_module = SCTP_CC_RFC2581;
1082                         stcb->asoc.cc_functions.sctp_set_initial_cc_param = &sctp_set_initial_cc_param;
1083                         stcb->asoc.cc_functions.sctp_cwnd_update_after_sack = &sctp_cwnd_update_after_sack;
1084                         stcb->asoc.cc_functions.sctp_cwnd_update_after_fr = &sctp_cwnd_update_after_fr;
1085                         stcb->asoc.cc_functions.sctp_cwnd_update_after_timeout = &sctp_cwnd_update_after_timeout;
1086                         stcb->asoc.cc_functions.sctp_cwnd_update_after_ecn_echo = &sctp_cwnd_update_after_ecn_echo;
1087                         stcb->asoc.cc_functions.sctp_cwnd_update_after_packet_dropped = &sctp_cwnd_update_after_packet_dropped;
1088                         stcb->asoc.cc_functions.sctp_cwnd_update_after_output = &sctp_cwnd_update_after_output;
1089                         stcb->asoc.cc_functions.sctp_cwnd_update_after_fr_timer = &sctp_cwnd_update_after_fr_timer;
1090                         break;
1091                 }
1092         }
1093
1094         /*
1095          * Now the stream parameters, here we allocate space for all streams
1096          * that we request by default.
1097          */
1098         asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams =
1099             m->sctp_ep.pre_open_stream_count;
1100         SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *,
1101             asoc->streamoutcnt * sizeof(struct sctp_stream_out),
1102             SCTP_M_STRMO);
1103         if (asoc->strmout == NULL) {
1104                 /* big trouble no memory */
1105                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1106                 return (ENOMEM);
1107         }
1108         for (i = 0; i < asoc->streamoutcnt; i++) {
1109                 /*
1110                  * inbound side must be set to 0xffff, also NOTE when we get
1111                  * the INIT-ACK back (for INIT sender) we MUST reduce the
1112                  * count (streamoutcnt) but first check if we sent to any of
1113                  * the upper streams that were dropped (if some were). Those
1114                  * that were dropped must be notified to the upper layer as
1115                  * failed to send.
1116                  */
1117                 asoc->strmout[i].next_sequence_sent = 0x0;
1118                 TAILQ_INIT(&asoc->strmout[i].outqueue);
1119                 asoc->strmout[i].stream_no = i;
1120                 asoc->strmout[i].last_msg_incomplete = 0;
1121                 asoc->strmout[i].next_spoke.tqe_next = 0;
1122                 asoc->strmout[i].next_spoke.tqe_prev = 0;
1123         }
1124         /* Now the mapping array */
1125         asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY;
1126         SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size,
1127             SCTP_M_MAP);
1128         if (asoc->mapping_array == NULL) {
1129                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1130                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1131                 return (ENOMEM);
1132         }
1133         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
1134         SCTP_MALLOC(asoc->nr_mapping_array, uint8_t *, asoc->mapping_array_size,
1135             SCTP_M_MAP);
1136         if (asoc->nr_mapping_array == NULL) {
1137                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1138                 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1139                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1140                 return (ENOMEM);
1141         }
1142         memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
1143
1144         /* Now the init of the other outqueues */
1145         TAILQ_INIT(&asoc->free_chunks);
1146         TAILQ_INIT(&asoc->out_wheel);
1147         TAILQ_INIT(&asoc->control_send_queue);
1148         TAILQ_INIT(&asoc->asconf_send_queue);
1149         TAILQ_INIT(&asoc->send_queue);
1150         TAILQ_INIT(&asoc->sent_queue);
1151         TAILQ_INIT(&asoc->reasmqueue);
1152         TAILQ_INIT(&asoc->resetHead);
1153         asoc->max_inbound_streams = m->sctp_ep.max_open_streams_intome;
1154         TAILQ_INIT(&asoc->asconf_queue);
1155         /* authentication fields */
1156         asoc->authinfo.random = NULL;
1157         asoc->authinfo.active_keyid = 0;
1158         asoc->authinfo.assoc_key = NULL;
1159         asoc->authinfo.assoc_keyid = 0;
1160         asoc->authinfo.recv_key = NULL;
1161         asoc->authinfo.recv_keyid = 0;
1162         LIST_INIT(&asoc->shared_keys);
1163         asoc->marked_retrans = 0;
1164         asoc->timoinit = 0;
1165         asoc->timodata = 0;
1166         asoc->timosack = 0;
1167         asoc->timoshutdown = 0;
1168         asoc->timoheartbeat = 0;
1169         asoc->timocookie = 0;
1170         asoc->timoshutdownack = 0;
1171         (void)SCTP_GETTIME_TIMEVAL(&asoc->start_time);
1172         asoc->discontinuity_time = asoc->start_time;
1173         /*
1174          * sa_ignore MEMLEAK {memory is put in the assoc mapping array and
1175          * freed later when the association is freed.
1176          */
1177         return (0);
1178 }
1179
1180 void
1181 sctp_print_mapping_array(struct sctp_association *asoc)
1182 {
1183         unsigned int i, limit;
1184
1185         printf("Mapping array size: %d, baseTSN: %8.8x, cumAck: %8.8x, highestTSN: (%8.8x, %8.8x).\n",
1186             asoc->mapping_array_size,
1187             asoc->mapping_array_base_tsn,
1188             asoc->cumulative_tsn,
1189             asoc->highest_tsn_inside_map,
1190             asoc->highest_tsn_inside_nr_map);
1191         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1192                 if (asoc->mapping_array[limit - 1]) {
1193                         break;
1194                 }
1195         }
1196         printf("Renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1197         for (i = 0; i < limit; i++) {
1198                 printf("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1199                 if (((i + 1) % 16) == 0)
1200                         printf("\n");
1201         }
1202         if (limit % 16)
1203                 printf("\n");
1204         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1205                 if (asoc->nr_mapping_array[limit - 1]) {
1206                         break;
1207                 }
1208         }
1209         printf("Non renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1210         for (i = 0; i < limit; i++) {
1211                 printf("%2.2x%c", asoc->nr_mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1212         }
1213         if (limit % 16)
1214                 printf("\n");
1215 }
1216
1217 int
1218 sctp_expand_mapping_array(struct sctp_association *asoc, uint32_t needed)
1219 {
1220         /* mapping array needs to grow */
1221         uint8_t *new_array1, *new_array2;
1222         uint32_t new_size;
1223
1224         new_size = asoc->mapping_array_size + ((needed + 7) / 8 + SCTP_MAPPING_ARRAY_INCR);
1225         SCTP_MALLOC(new_array1, uint8_t *, new_size, SCTP_M_MAP);
1226         SCTP_MALLOC(new_array2, uint8_t *, new_size, SCTP_M_MAP);
1227         if ((new_array1 == NULL) || (new_array2 == NULL)) {
1228                 /* can't get more, forget it */
1229                 SCTP_PRINTF("No memory for expansion of SCTP mapping array %d\n", new_size);
1230                 if (new_array1) {
1231                         SCTP_FREE(new_array1, SCTP_M_MAP);
1232                 }
1233                 if (new_array2) {
1234                         SCTP_FREE(new_array2, SCTP_M_MAP);
1235                 }
1236                 return (-1);
1237         }
1238         memset(new_array1, 0, new_size);
1239         memset(new_array2, 0, new_size);
1240         memcpy(new_array1, asoc->mapping_array, asoc->mapping_array_size);
1241         memcpy(new_array2, asoc->nr_mapping_array, asoc->mapping_array_size);
1242         SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1243         SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
1244         asoc->mapping_array = new_array1;
1245         asoc->nr_mapping_array = new_array2;
1246         asoc->mapping_array_size = new_size;
1247         return (0);
1248 }
1249
1250
1251 static void
1252 sctp_iterator_work(struct sctp_iterator *it)
1253 {
1254         int iteration_count = 0;
1255         int inp_skip = 0;
1256         int first_in = 1;
1257         struct sctp_inpcb *tinp;
1258
1259         SCTP_INP_INFO_RLOCK();
1260         SCTP_ITERATOR_LOCK();
1261         if (it->inp) {
1262                 SCTP_INP_RLOCK(it->inp);
1263                 SCTP_INP_DECR_REF(it->inp);
1264         }
1265         if (it->inp == NULL) {
1266                 /* iterator is complete */
1267 done_with_iterator:
1268                 SCTP_ITERATOR_UNLOCK();
1269                 SCTP_INP_INFO_RUNLOCK();
1270                 if (it->function_atend != NULL) {
1271                         (*it->function_atend) (it->pointer, it->val);
1272                 }
1273                 SCTP_FREE(it, SCTP_M_ITER);
1274                 return;
1275         }
1276 select_a_new_ep:
1277         if (first_in) {
1278                 first_in = 0;
1279         } else {
1280                 SCTP_INP_RLOCK(it->inp);
1281         }
1282         while (((it->pcb_flags) &&
1283             ((it->inp->sctp_flags & it->pcb_flags) != it->pcb_flags)) ||
1284             ((it->pcb_features) &&
1285             ((it->inp->sctp_features & it->pcb_features) != it->pcb_features))) {
1286                 /* endpoint flags or features don't match, so keep looking */
1287                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1288                         SCTP_INP_RUNLOCK(it->inp);
1289                         goto done_with_iterator;
1290                 }
1291                 tinp = it->inp;
1292                 it->inp = LIST_NEXT(it->inp, sctp_list);
1293                 SCTP_INP_RUNLOCK(tinp);
1294                 if (it->inp == NULL) {
1295                         goto done_with_iterator;
1296                 }
1297                 SCTP_INP_RLOCK(it->inp);
1298         }
1299         /* now go through each assoc which is in the desired state */
1300         if (it->done_current_ep == 0) {
1301                 if (it->function_inp != NULL)
1302                         inp_skip = (*it->function_inp) (it->inp, it->pointer, it->val);
1303                 it->done_current_ep = 1;
1304         }
1305         if (it->stcb == NULL) {
1306                 /* run the per instance function */
1307                 it->stcb = LIST_FIRST(&it->inp->sctp_asoc_list);
1308         }
1309         if ((inp_skip) || it->stcb == NULL) {
1310                 if (it->function_inp_end != NULL) {
1311                         inp_skip = (*it->function_inp_end) (it->inp,
1312                             it->pointer,
1313                             it->val);
1314                 }
1315                 SCTP_INP_RUNLOCK(it->inp);
1316                 goto no_stcb;
1317         }
1318         while (it->stcb) {
1319                 SCTP_TCB_LOCK(it->stcb);
1320                 if (it->asoc_state && ((it->stcb->asoc.state & it->asoc_state) != it->asoc_state)) {
1321                         /* not in the right state... keep looking */
1322                         SCTP_TCB_UNLOCK(it->stcb);
1323                         goto next_assoc;
1324                 }
1325                 /* see if we have limited out the iterator loop */
1326                 iteration_count++;
1327                 if (iteration_count > SCTP_ITERATOR_MAX_AT_ONCE) {
1328                         /* Pause to let others grab the lock */
1329                         atomic_add_int(&it->stcb->asoc.refcnt, 1);
1330                         SCTP_TCB_UNLOCK(it->stcb);
1331                         SCTP_INP_INCR_REF(it->inp);
1332                         SCTP_INP_RUNLOCK(it->inp);
1333                         SCTP_ITERATOR_UNLOCK();
1334                         SCTP_INP_INFO_RUNLOCK();
1335                         SCTP_INP_INFO_RLOCK();
1336                         SCTP_ITERATOR_LOCK();
1337                         if (sctp_it_ctl.iterator_flags) {
1338                                 /* We won't be staying here */
1339                                 SCTP_INP_DECR_REF(it->inp);
1340                                 atomic_add_int(&it->stcb->asoc.refcnt, -1);
1341                                 if (sctp_it_ctl.iterator_flags &
1342                                     SCTP_ITERATOR_MUST_EXIT) {
1343                                         goto done_with_iterator;
1344                                 }
1345                                 if (sctp_it_ctl.iterator_flags &
1346                                     SCTP_ITERATOR_STOP_CUR_IT) {
1347                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_IT;
1348                                         goto done_with_iterator;
1349                                 }
1350                                 if (sctp_it_ctl.iterator_flags &
1351                                     SCTP_ITERATOR_STOP_CUR_INP) {
1352                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_INP;
1353                                         goto no_stcb;
1354                                 }
1355                                 /* If we reach here huh? */
1356                                 printf("Unknown it ctl flag %x\n",
1357                                     sctp_it_ctl.iterator_flags);
1358                                 sctp_it_ctl.iterator_flags = 0;
1359                         }
1360                         SCTP_INP_RLOCK(it->inp);
1361                         SCTP_INP_DECR_REF(it->inp);
1362                         SCTP_TCB_LOCK(it->stcb);
1363                         atomic_add_int(&it->stcb->asoc.refcnt, -1);
1364                         iteration_count = 0;
1365                 }
1366                 /* run function on this one */
1367                 (*it->function_assoc) (it->inp, it->stcb, it->pointer, it->val);
1368
1369                 /*
1370                  * we lie here, it really needs to have its own type but
1371                  * first I must verify that this won't effect things :-0
1372                  */
1373                 if (it->no_chunk_output == 0)
1374                         sctp_chunk_output(it->inp, it->stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1375
1376                 SCTP_TCB_UNLOCK(it->stcb);
1377 next_assoc:
1378                 it->stcb = LIST_NEXT(it->stcb, sctp_tcblist);
1379                 if (it->stcb == NULL) {
1380                         /* Run last function */
1381                         if (it->function_inp_end != NULL) {
1382                                 inp_skip = (*it->function_inp_end) (it->inp,
1383                                     it->pointer,
1384                                     it->val);
1385                         }
1386                 }
1387         }
1388         SCTP_INP_RUNLOCK(it->inp);
1389 no_stcb:
1390         /* done with all assocs on this endpoint, move on to next endpoint */
1391         it->done_current_ep = 0;
1392         if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1393                 it->inp = NULL;
1394         } else {
1395                 it->inp = LIST_NEXT(it->inp, sctp_list);
1396         }
1397         if (it->inp == NULL) {
1398                 goto done_with_iterator;
1399         }
1400         goto select_a_new_ep;
1401 }
1402
1403 void
1404 sctp_iterator_worker(void)
1405 {
1406         struct sctp_iterator *it = NULL;
1407
1408         /* This function is called with the WQ lock in place */
1409
1410         sctp_it_ctl.iterator_running = 1;
1411         sctp_it_ctl.cur_it = it = TAILQ_FIRST(&sctp_it_ctl.iteratorhead);
1412         while (it) {
1413                 /* now lets work on this one */
1414                 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
1415                 SCTP_IPI_ITERATOR_WQ_UNLOCK();
1416                 CURVNET_SET(it->vn);
1417                 sctp_iterator_work(it);
1418
1419                 CURVNET_RESTORE();
1420                 SCTP_IPI_ITERATOR_WQ_LOCK();
1421                 if (sctp_it_ctl.iterator_flags & SCTP_ITERATOR_MUST_EXIT) {
1422                         sctp_it_ctl.cur_it = NULL;
1423                         break;
1424                 }
1425                 /* sa_ignore FREED_MEMORY */
1426                 sctp_it_ctl.cur_it = it = TAILQ_FIRST(&sctp_it_ctl.iteratorhead);
1427         }
1428         sctp_it_ctl.iterator_running = 0;
1429         return;
1430 }
1431
1432
1433 static void
1434 sctp_handle_addr_wq(void)
1435 {
1436         /* deal with the ADDR wq from the rtsock calls */
1437         struct sctp_laddr *wi;
1438         struct sctp_asconf_iterator *asc;
1439
1440         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
1441             sizeof(struct sctp_asconf_iterator), SCTP_M_ASC_IT);
1442         if (asc == NULL) {
1443                 /* Try later, no memory */
1444                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
1445                     (struct sctp_inpcb *)NULL,
1446                     (struct sctp_tcb *)NULL,
1447                     (struct sctp_nets *)NULL);
1448                 return;
1449         }
1450         LIST_INIT(&asc->list_of_work);
1451         asc->cnt = 0;
1452
1453         SCTP_WQ_ADDR_LOCK();
1454         wi = LIST_FIRST(&SCTP_BASE_INFO(addr_wq));
1455         while (wi != NULL) {
1456                 LIST_REMOVE(wi, sctp_nxt_addr);
1457                 LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
1458                 asc->cnt++;
1459                 wi = LIST_FIRST(&SCTP_BASE_INFO(addr_wq));
1460         }
1461         SCTP_WQ_ADDR_UNLOCK();
1462
1463         if (asc->cnt == 0) {
1464                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1465         } else {
1466                 (void)sctp_initiate_iterator(sctp_asconf_iterator_ep,
1467                     sctp_asconf_iterator_stcb,
1468                     NULL,       /* No ep end for boundall */
1469                     SCTP_PCB_FLAGS_BOUNDALL,
1470                     SCTP_PCB_ANY_FEATURES,
1471                     SCTP_ASOC_ANY_STATE,
1472                     (void *)asc, 0,
1473                     sctp_asconf_iterator_end, NULL, 0);
1474         }
1475 }
1476
1477 int retcode = 0;
1478 int cur_oerr = 0;
1479
1480 void
1481 sctp_timeout_handler(void *t)
1482 {
1483         struct sctp_inpcb *inp;
1484         struct sctp_tcb *stcb;
1485         struct sctp_nets *net;
1486         struct sctp_timer *tmr;
1487
1488 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1489         struct socket *so;
1490
1491 #endif
1492         int did_output, type;
1493
1494         tmr = (struct sctp_timer *)t;
1495         inp = (struct sctp_inpcb *)tmr->ep;
1496         stcb = (struct sctp_tcb *)tmr->tcb;
1497         net = (struct sctp_nets *)tmr->net;
1498         CURVNET_SET((struct vnet *)tmr->vnet);
1499         did_output = 1;
1500
1501 #ifdef SCTP_AUDITING_ENABLED
1502         sctp_audit_log(0xF0, (uint8_t) tmr->type);
1503         sctp_auditing(3, inp, stcb, net);
1504 #endif
1505
1506         /* sanity checks... */
1507         if (tmr->self != (void *)tmr) {
1508                 /*
1509                  * SCTP_PRINTF("Stale SCTP timer fired (%p), ignoring...\n",
1510                  * tmr);
1511                  */
1512                 CURVNET_RESTORE();
1513                 return;
1514         }
1515         tmr->stopped_from = 0xa001;
1516         if (!SCTP_IS_TIMER_TYPE_VALID(tmr->type)) {
1517                 /*
1518                  * SCTP_PRINTF("SCTP timer fired with invalid type: 0x%x\n",
1519                  * tmr->type);
1520                  */
1521                 CURVNET_RESTORE();
1522                 return;
1523         }
1524         tmr->stopped_from = 0xa002;
1525         if ((tmr->type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL)) {
1526                 CURVNET_RESTORE();
1527                 return;
1528         }
1529         /* if this is an iterator timeout, get the struct and clear inp */
1530         tmr->stopped_from = 0xa003;
1531         type = tmr->type;
1532         if (inp) {
1533                 SCTP_INP_INCR_REF(inp);
1534                 if ((inp->sctp_socket == 0) &&
1535                     ((tmr->type != SCTP_TIMER_TYPE_INPKILL) &&
1536                     (tmr->type != SCTP_TIMER_TYPE_INIT) &&
1537                     (tmr->type != SCTP_TIMER_TYPE_SEND) &&
1538                     (tmr->type != SCTP_TIMER_TYPE_RECV) &&
1539                     (tmr->type != SCTP_TIMER_TYPE_HEARTBEAT) &&
1540                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWN) &&
1541                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNACK) &&
1542                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNGUARD) &&
1543                     (tmr->type != SCTP_TIMER_TYPE_ASOCKILL))
1544                     ) {
1545                         SCTP_INP_DECR_REF(inp);
1546                         CURVNET_RESTORE();
1547                         return;
1548                 }
1549         }
1550         tmr->stopped_from = 0xa004;
1551         if (stcb) {
1552                 atomic_add_int(&stcb->asoc.refcnt, 1);
1553                 if (stcb->asoc.state == 0) {
1554                         atomic_add_int(&stcb->asoc.refcnt, -1);
1555                         if (inp) {
1556                                 SCTP_INP_DECR_REF(inp);
1557                         }
1558                         CURVNET_RESTORE();
1559                         return;
1560                 }
1561         }
1562         tmr->stopped_from = 0xa005;
1563         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer type %d goes off\n", tmr->type);
1564         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1565                 if (inp) {
1566                         SCTP_INP_DECR_REF(inp);
1567                 }
1568                 if (stcb) {
1569                         atomic_add_int(&stcb->asoc.refcnt, -1);
1570                 }
1571                 CURVNET_RESTORE();
1572                 return;
1573         }
1574         tmr->stopped_from = 0xa006;
1575
1576         if (stcb) {
1577                 SCTP_TCB_LOCK(stcb);
1578                 atomic_add_int(&stcb->asoc.refcnt, -1);
1579                 if ((tmr->type != SCTP_TIMER_TYPE_ASOCKILL) &&
1580                     ((stcb->asoc.state == 0) ||
1581                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED))) {
1582                         SCTP_TCB_UNLOCK(stcb);
1583                         if (inp) {
1584                                 SCTP_INP_DECR_REF(inp);
1585                         }
1586                         CURVNET_RESTORE();
1587                         return;
1588                 }
1589         }
1590         /* record in stopped what t-o occured */
1591         tmr->stopped_from = tmr->type;
1592
1593         /* mark as being serviced now */
1594         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
1595                 /*
1596                  * Callout has been rescheduled.
1597                  */
1598                 goto get_out;
1599         }
1600         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1601                 /*
1602                  * Not active, so no action.
1603                  */
1604                 goto get_out;
1605         }
1606         SCTP_OS_TIMER_DEACTIVATE(&tmr->timer);
1607
1608         /* call the handler for the appropriate timer type */
1609         switch (tmr->type) {
1610         case SCTP_TIMER_TYPE_ZERO_COPY:
1611                 if (inp == NULL) {
1612                         break;
1613                 }
1614                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
1615                         SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket);
1616                 }
1617                 break;
1618         case SCTP_TIMER_TYPE_ZCOPY_SENDQ:
1619                 if (inp == NULL) {
1620                         break;
1621                 }
1622                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
1623                         SCTP_ZERO_COPY_SENDQ_EVENT(inp, inp->sctp_socket);
1624                 }
1625                 break;
1626         case SCTP_TIMER_TYPE_ADDR_WQ:
1627                 sctp_handle_addr_wq();
1628                 break;
1629         case SCTP_TIMER_TYPE_SEND:
1630                 if ((stcb == NULL) || (inp == NULL)) {
1631                         break;
1632                 }
1633                 SCTP_STAT_INCR(sctps_timodata);
1634                 stcb->asoc.timodata++;
1635                 stcb->asoc.num_send_timers_up--;
1636                 if (stcb->asoc.num_send_timers_up < 0) {
1637                         stcb->asoc.num_send_timers_up = 0;
1638                 }
1639                 SCTP_TCB_LOCK_ASSERT(stcb);
1640                 cur_oerr = stcb->asoc.overall_error_count;
1641                 retcode = sctp_t3rxt_timer(inp, stcb, net);
1642                 if (retcode) {
1643                         /* no need to unlock on tcb its gone */
1644
1645                         goto out_decr;
1646                 }
1647                 SCTP_TCB_LOCK_ASSERT(stcb);
1648 #ifdef SCTP_AUDITING_ENABLED
1649                 sctp_auditing(4, inp, stcb, net);
1650 #endif
1651                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1652                 if ((stcb->asoc.num_send_timers_up == 0) &&
1653                     (stcb->asoc.sent_queue_cnt > 0)
1654                     ) {
1655                         struct sctp_tmit_chunk *chk;
1656
1657                         /*
1658                          * safeguard. If there on some on the sent queue
1659                          * somewhere but no timers running something is
1660                          * wrong... so we start a timer on the first chunk
1661                          * on the send queue on whatever net it is sent to.
1662                          */
1663                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1664                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb,
1665                             chk->whoTo);
1666                 }
1667                 break;
1668         case SCTP_TIMER_TYPE_INIT:
1669                 if ((stcb == NULL) || (inp == NULL)) {
1670                         break;
1671                 }
1672                 SCTP_STAT_INCR(sctps_timoinit);
1673                 stcb->asoc.timoinit++;
1674                 if (sctp_t1init_timer(inp, stcb, net)) {
1675                         /* no need to unlock on tcb its gone */
1676                         goto out_decr;
1677                 }
1678                 /* We do output but not here */
1679                 did_output = 0;
1680                 break;
1681         case SCTP_TIMER_TYPE_RECV:
1682                 if ((stcb == NULL) || (inp == NULL)) {
1683                         break;
1684                 } {
1685                         SCTP_STAT_INCR(sctps_timosack);
1686                         stcb->asoc.timosack++;
1687                         sctp_send_sack(stcb);
1688                 }
1689 #ifdef SCTP_AUDITING_ENABLED
1690                 sctp_auditing(4, inp, stcb, net);
1691 #endif
1692                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR, SCTP_SO_NOT_LOCKED);
1693                 break;
1694         case SCTP_TIMER_TYPE_SHUTDOWN:
1695                 if ((stcb == NULL) || (inp == NULL)) {
1696                         break;
1697                 }
1698                 if (sctp_shutdown_timer(inp, stcb, net)) {
1699                         /* no need to unlock on tcb its gone */
1700                         goto out_decr;
1701                 }
1702                 SCTP_STAT_INCR(sctps_timoshutdown);
1703                 stcb->asoc.timoshutdown++;
1704 #ifdef SCTP_AUDITING_ENABLED
1705                 sctp_auditing(4, inp, stcb, net);
1706 #endif
1707                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_NOT_LOCKED);
1708                 break;
1709         case SCTP_TIMER_TYPE_HEARTBEAT:
1710                 {
1711                         struct sctp_nets *lnet;
1712                         int cnt_of_unconf = 0;
1713
1714                         if ((stcb == NULL) || (inp == NULL)) {
1715                                 break;
1716                         }
1717                         SCTP_STAT_INCR(sctps_timoheartbeat);
1718                         stcb->asoc.timoheartbeat++;
1719                         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
1720                                 if ((lnet->dest_state & SCTP_ADDR_UNCONFIRMED) &&
1721                                     (lnet->dest_state & SCTP_ADDR_REACHABLE)) {
1722                                         cnt_of_unconf++;
1723                                 }
1724                         }
1725                         if (cnt_of_unconf == 0) {
1726                                 if (sctp_heartbeat_timer(inp, stcb, lnet,
1727                                     cnt_of_unconf)) {
1728                                         /* no need to unlock on tcb its gone */
1729                                         goto out_decr;
1730                                 }
1731                         }
1732 #ifdef SCTP_AUDITING_ENABLED
1733                         sctp_auditing(4, inp, stcb, lnet);
1734 #endif
1735                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT,
1736                             stcb->sctp_ep, stcb, lnet);
1737                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR, SCTP_SO_NOT_LOCKED);
1738                 }
1739                 break;
1740         case SCTP_TIMER_TYPE_COOKIE:
1741                 if ((stcb == NULL) || (inp == NULL)) {
1742                         break;
1743                 }
1744                 if (sctp_cookie_timer(inp, stcb, net)) {
1745                         /* no need to unlock on tcb its gone */
1746                         goto out_decr;
1747                 }
1748                 SCTP_STAT_INCR(sctps_timocookie);
1749                 stcb->asoc.timocookie++;
1750 #ifdef SCTP_AUDITING_ENABLED
1751                 sctp_auditing(4, inp, stcb, net);
1752 #endif
1753                 /*
1754                  * We consider T3 and Cookie timer pretty much the same with
1755                  * respect to where from in chunk_output.
1756                  */
1757                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1758                 break;
1759         case SCTP_TIMER_TYPE_NEWCOOKIE:
1760                 {
1761                         struct timeval tv;
1762                         int i, secret;
1763
1764                         if (inp == NULL) {
1765                                 break;
1766                         }
1767                         SCTP_STAT_INCR(sctps_timosecret);
1768                         (void)SCTP_GETTIME_TIMEVAL(&tv);
1769                         SCTP_INP_WLOCK(inp);
1770                         inp->sctp_ep.time_of_secret_change = tv.tv_sec;
1771                         inp->sctp_ep.last_secret_number =
1772                             inp->sctp_ep.current_secret_number;
1773                         inp->sctp_ep.current_secret_number++;
1774                         if (inp->sctp_ep.current_secret_number >=
1775                             SCTP_HOW_MANY_SECRETS) {
1776                                 inp->sctp_ep.current_secret_number = 0;
1777                         }
1778                         secret = (int)inp->sctp_ep.current_secret_number;
1779                         for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1780                                 inp->sctp_ep.secret_key[secret][i] =
1781                                     sctp_select_initial_TSN(&inp->sctp_ep);
1782                         }
1783                         SCTP_INP_WUNLOCK(inp);
1784                         sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, stcb, net);
1785                 }
1786                 did_output = 0;
1787                 break;
1788         case SCTP_TIMER_TYPE_PATHMTURAISE:
1789                 if ((stcb == NULL) || (inp == NULL)) {
1790                         break;
1791                 }
1792                 SCTP_STAT_INCR(sctps_timopathmtu);
1793                 sctp_pathmtu_timer(inp, stcb, net);
1794                 did_output = 0;
1795                 break;
1796         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1797                 if ((stcb == NULL) || (inp == NULL)) {
1798                         break;
1799                 }
1800                 if (sctp_shutdownack_timer(inp, stcb, net)) {
1801                         /* no need to unlock on tcb its gone */
1802                         goto out_decr;
1803                 }
1804                 SCTP_STAT_INCR(sctps_timoshutdownack);
1805                 stcb->asoc.timoshutdownack++;
1806 #ifdef SCTP_AUDITING_ENABLED
1807                 sctp_auditing(4, inp, stcb, net);
1808 #endif
1809                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR, SCTP_SO_NOT_LOCKED);
1810                 break;
1811         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1812                 if ((stcb == NULL) || (inp == NULL)) {
1813                         break;
1814                 }
1815                 SCTP_STAT_INCR(sctps_timoshutdownguard);
1816                 sctp_abort_an_association(inp, stcb,
1817                     SCTP_SHUTDOWN_GUARD_EXPIRES, NULL, SCTP_SO_NOT_LOCKED);
1818                 /* no need to unlock on tcb its gone */
1819                 goto out_decr;
1820
1821         case SCTP_TIMER_TYPE_STRRESET:
1822                 if ((stcb == NULL) || (inp == NULL)) {
1823                         break;
1824                 }
1825                 if (sctp_strreset_timer(inp, stcb, net)) {
1826                         /* no need to unlock on tcb its gone */
1827                         goto out_decr;
1828                 }
1829                 SCTP_STAT_INCR(sctps_timostrmrst);
1830                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR, SCTP_SO_NOT_LOCKED);
1831                 break;
1832         case SCTP_TIMER_TYPE_EARLYFR:
1833                 /* Need to do FR of things for net */
1834                 if ((stcb == NULL) || (inp == NULL)) {
1835                         break;
1836                 }
1837                 SCTP_STAT_INCR(sctps_timoearlyfr);
1838                 sctp_early_fr_timer(inp, stcb, net);
1839                 break;
1840         case SCTP_TIMER_TYPE_ASCONF:
1841                 if ((stcb == NULL) || (inp == NULL)) {
1842                         break;
1843                 }
1844                 if (sctp_asconf_timer(inp, stcb, net)) {
1845                         /* no need to unlock on tcb its gone */
1846                         goto out_decr;
1847                 }
1848                 SCTP_STAT_INCR(sctps_timoasconf);
1849 #ifdef SCTP_AUDITING_ENABLED
1850                 sctp_auditing(4, inp, stcb, net);
1851 #endif
1852                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR, SCTP_SO_NOT_LOCKED);
1853                 break;
1854         case SCTP_TIMER_TYPE_PRIM_DELETED:
1855                 if ((stcb == NULL) || (inp == NULL)) {
1856                         break;
1857                 }
1858                 sctp_delete_prim_timer(inp, stcb, net);
1859                 SCTP_STAT_INCR(sctps_timodelprim);
1860                 break;
1861
1862         case SCTP_TIMER_TYPE_AUTOCLOSE:
1863                 if ((stcb == NULL) || (inp == NULL)) {
1864                         break;
1865                 }
1866                 SCTP_STAT_INCR(sctps_timoautoclose);
1867                 sctp_autoclose_timer(inp, stcb, net);
1868                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED);
1869                 did_output = 0;
1870                 break;
1871         case SCTP_TIMER_TYPE_ASOCKILL:
1872                 if ((stcb == NULL) || (inp == NULL)) {
1873                         break;
1874                 }
1875                 SCTP_STAT_INCR(sctps_timoassockill);
1876                 /* Can we free it yet? */
1877                 SCTP_INP_DECR_REF(inp);
1878                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_1);
1879 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1880                 so = SCTP_INP_SO(inp);
1881                 atomic_add_int(&stcb->asoc.refcnt, 1);
1882                 SCTP_TCB_UNLOCK(stcb);
1883                 SCTP_SOCKET_LOCK(so, 1);
1884                 SCTP_TCB_LOCK(stcb);
1885                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1886 #endif
1887                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_2);
1888 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1889                 SCTP_SOCKET_UNLOCK(so, 1);
1890 #endif
1891                 /*
1892                  * free asoc, always unlocks (or destroy's) so prevent
1893                  * duplicate unlock or unlock of a free mtx :-0
1894                  */
1895                 stcb = NULL;
1896                 goto out_no_decr;
1897         case SCTP_TIMER_TYPE_INPKILL:
1898                 SCTP_STAT_INCR(sctps_timoinpkill);
1899                 if (inp == NULL) {
1900                         break;
1901                 }
1902                 /*
1903                  * special case, take away our increment since WE are the
1904                  * killer
1905                  */
1906                 SCTP_INP_DECR_REF(inp);
1907                 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_3);
1908                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
1909                     SCTP_CALLED_FROM_INPKILL_TIMER);
1910                 inp = NULL;
1911                 goto out_no_decr;
1912         default:
1913                 SCTPDBG(SCTP_DEBUG_TIMER1, "sctp_timeout_handler:unknown timer %d\n",
1914                     tmr->type);
1915                 break;
1916         };
1917 #ifdef SCTP_AUDITING_ENABLED
1918         sctp_audit_log(0xF1, (uint8_t) tmr->type);
1919         if (inp)
1920                 sctp_auditing(5, inp, stcb, net);
1921 #endif
1922         if ((did_output) && stcb) {
1923                 /*
1924                  * Now we need to clean up the control chunk chain if an
1925                  * ECNE is on it. It must be marked as UNSENT again so next
1926                  * call will continue to send it until such time that we get
1927                  * a CWR, to remove it. It is, however, less likely that we
1928                  * will find a ecn echo on the chain though.
1929                  */
1930                 sctp_fix_ecn_echo(&stcb->asoc);
1931         }
1932 get_out:
1933         if (stcb) {
1934                 SCTP_TCB_UNLOCK(stcb);
1935         }
1936 out_decr:
1937         if (inp) {
1938                 SCTP_INP_DECR_REF(inp);
1939         }
1940 out_no_decr:
1941         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer now complete (type %d)\n",
1942             type);
1943         CURVNET_RESTORE();
1944 }
1945
1946 void
1947 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1948     struct sctp_nets *net)
1949 {
1950         int to_ticks;
1951         struct sctp_timer *tmr;
1952
1953         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL))
1954                 return;
1955
1956         to_ticks = 0;
1957
1958         tmr = NULL;
1959         if (stcb) {
1960                 SCTP_TCB_LOCK_ASSERT(stcb);
1961         }
1962         switch (t_type) {
1963         case SCTP_TIMER_TYPE_ZERO_COPY:
1964                 tmr = &inp->sctp_ep.zero_copy_timer;
1965                 to_ticks = SCTP_ZERO_COPY_TICK_DELAY;
1966                 break;
1967         case SCTP_TIMER_TYPE_ZCOPY_SENDQ:
1968                 tmr = &inp->sctp_ep.zero_copy_sendq_timer;
1969                 to_ticks = SCTP_ZERO_COPY_SENDQ_TICK_DELAY;
1970                 break;
1971         case SCTP_TIMER_TYPE_ADDR_WQ:
1972                 /* Only 1 tick away :-) */
1973                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
1974                 to_ticks = SCTP_ADDRESS_TICK_DELAY;
1975                 break;
1976         case SCTP_TIMER_TYPE_SEND:
1977                 /* Here we use the RTO timer */
1978                 {
1979                         int rto_val;
1980
1981                         if ((stcb == NULL) || (net == NULL)) {
1982                                 return;
1983                         }
1984                         tmr = &net->rxt_timer;
1985                         if (net->RTO == 0) {
1986                                 rto_val = stcb->asoc.initial_rto;
1987                         } else {
1988                                 rto_val = net->RTO;
1989                         }
1990                         to_ticks = MSEC_TO_TICKS(rto_val);
1991                 }
1992                 break;
1993         case SCTP_TIMER_TYPE_INIT:
1994                 /*
1995                  * Here we use the INIT timer default usually about 1
1996                  * minute.
1997                  */
1998                 if ((stcb == NULL) || (net == NULL)) {
1999                         return;
2000                 }
2001                 tmr = &net->rxt_timer;
2002                 if (net->RTO == 0) {
2003                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2004                 } else {
2005                         to_ticks = MSEC_TO_TICKS(net->RTO);
2006                 }
2007                 break;
2008         case SCTP_TIMER_TYPE_RECV:
2009                 /*
2010                  * Here we use the Delayed-Ack timer value from the inp
2011                  * ususually about 200ms.
2012                  */
2013                 if (stcb == NULL) {
2014                         return;
2015                 }
2016                 tmr = &stcb->asoc.dack_timer;
2017                 to_ticks = MSEC_TO_TICKS(stcb->asoc.delayed_ack);
2018                 break;
2019         case SCTP_TIMER_TYPE_SHUTDOWN:
2020                 /* Here we use the RTO of the destination. */
2021                 if ((stcb == NULL) || (net == NULL)) {
2022                         return;
2023                 }
2024                 if (net->RTO == 0) {
2025                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2026                 } else {
2027                         to_ticks = MSEC_TO_TICKS(net->RTO);
2028                 }
2029                 tmr = &net->rxt_timer;
2030                 break;
2031         case SCTP_TIMER_TYPE_HEARTBEAT:
2032                 /*
2033                  * the net is used here so that we can add in the RTO. Even
2034                  * though we use a different timer. We also add the HB timer
2035                  * PLUS a random jitter.
2036                  */
2037                 if ((inp == NULL) || (stcb == NULL)) {
2038                         return;
2039                 } else {
2040                         uint32_t rndval;
2041                         uint8_t this_random;
2042                         int cnt_of_unconf = 0;
2043                         struct sctp_nets *lnet;
2044
2045                         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
2046                                 if ((lnet->dest_state & SCTP_ADDR_UNCONFIRMED) &&
2047                                     (lnet->dest_state & SCTP_ADDR_REACHABLE)) {
2048                                         cnt_of_unconf++;
2049                                 }
2050                         }
2051                         if (cnt_of_unconf) {
2052                                 net = lnet = NULL;
2053                                 (void)sctp_heartbeat_timer(inp, stcb, lnet, cnt_of_unconf);
2054                         }
2055                         if (stcb->asoc.hb_random_idx > 3) {
2056                                 rndval = sctp_select_initial_TSN(&inp->sctp_ep);
2057                                 memcpy(stcb->asoc.hb_random_values, &rndval,
2058                                     sizeof(stcb->asoc.hb_random_values));
2059                                 stcb->asoc.hb_random_idx = 0;
2060                         }
2061                         this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
2062                         stcb->asoc.hb_random_idx++;
2063                         stcb->asoc.hb_ect_randombit = 0;
2064                         /*
2065                          * this_random will be 0 - 256 ms RTO is in ms.
2066                          */
2067                         if ((stcb->asoc.hb_is_disabled) &&
2068                             (cnt_of_unconf == 0)) {
2069                                 return;
2070                         }
2071                         if (net) {
2072                                 int delay;
2073
2074                                 delay = stcb->asoc.heart_beat_delay;
2075                                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
2076                                         if ((lnet->dest_state & SCTP_ADDR_UNCONFIRMED) &&
2077                                             ((lnet->dest_state & SCTP_ADDR_OUT_OF_SCOPE) == 0) &&
2078                                             (lnet->dest_state & SCTP_ADDR_REACHABLE)) {
2079                                                 delay = 0;
2080                                         }
2081                                 }
2082                                 if (net->RTO == 0) {
2083                                         /* Never been checked */
2084                                         to_ticks = this_random + stcb->asoc.initial_rto + delay;
2085                                 } else {
2086                                         /* set rto_val to the ms */
2087                                         to_ticks = delay + net->RTO + this_random;
2088                                 }
2089                         } else {
2090                                 if (cnt_of_unconf) {
2091                                         to_ticks = this_random + stcb->asoc.initial_rto;
2092                                 } else {
2093                                         to_ticks = stcb->asoc.heart_beat_delay + this_random + stcb->asoc.initial_rto;
2094                                 }
2095                         }
2096                         /*
2097                          * Now we must convert the to_ticks that are now in
2098                          * ms to ticks.
2099                          */
2100                         to_ticks = MSEC_TO_TICKS(to_ticks);
2101                         tmr = &stcb->asoc.hb_timer;
2102                 }
2103                 break;
2104         case SCTP_TIMER_TYPE_COOKIE:
2105                 /*
2106                  * Here we can use the RTO timer from the network since one
2107                  * RTT was compelete. If a retran happened then we will be
2108                  * using the RTO initial value.
2109                  */
2110                 if ((stcb == NULL) || (net == NULL)) {
2111                         return;
2112                 }
2113                 if (net->RTO == 0) {
2114                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2115                 } else {
2116                         to_ticks = MSEC_TO_TICKS(net->RTO);
2117                 }
2118                 tmr = &net->rxt_timer;
2119                 break;
2120         case SCTP_TIMER_TYPE_NEWCOOKIE:
2121                 /*
2122                  * nothing needed but the endpoint here ususually about 60
2123                  * minutes.
2124                  */
2125                 if (inp == NULL) {
2126                         return;
2127                 }
2128                 tmr = &inp->sctp_ep.signature_change;
2129                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE];
2130                 break;
2131         case SCTP_TIMER_TYPE_ASOCKILL:
2132                 if (stcb == NULL) {
2133                         return;
2134                 }
2135                 tmr = &stcb->asoc.strreset_timer;
2136                 to_ticks = MSEC_TO_TICKS(SCTP_ASOC_KILL_TIMEOUT);
2137                 break;
2138         case SCTP_TIMER_TYPE_INPKILL:
2139                 /*
2140                  * The inp is setup to die. We re-use the signature_chage
2141                  * timer since that has stopped and we are in the GONE
2142                  * state.
2143                  */
2144                 if (inp == NULL) {
2145                         return;
2146                 }
2147                 tmr = &inp->sctp_ep.signature_change;
2148                 to_ticks = MSEC_TO_TICKS(SCTP_INP_KILL_TIMEOUT);
2149                 break;
2150         case SCTP_TIMER_TYPE_PATHMTURAISE:
2151                 /*
2152                  * Here we use the value found in the EP for PMTU ususually
2153                  * about 10 minutes.
2154                  */
2155                 if ((stcb == NULL) || (inp == NULL)) {
2156                         return;
2157                 }
2158                 if (net == NULL) {
2159                         return;
2160                 }
2161                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU];
2162                 tmr = &net->pmtu_timer;
2163                 break;
2164         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2165                 /* Here we use the RTO of the destination */
2166                 if ((stcb == NULL) || (net == NULL)) {
2167                         return;
2168                 }
2169                 if (net->RTO == 0) {
2170                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2171                 } else {
2172                         to_ticks = MSEC_TO_TICKS(net->RTO);
2173                 }
2174                 tmr = &net->rxt_timer;
2175                 break;
2176         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2177                 /*
2178                  * Here we use the endpoints shutdown guard timer usually
2179                  * about 3 minutes.
2180                  */
2181                 if ((inp == NULL) || (stcb == NULL)) {
2182                         return;
2183                 }
2184                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN];
2185                 tmr = &stcb->asoc.shut_guard_timer;
2186                 break;
2187         case SCTP_TIMER_TYPE_STRRESET:
2188                 /*
2189                  * Here the timer comes from the stcb but its value is from
2190                  * the net's RTO.
2191                  */
2192                 if ((stcb == NULL) || (net == NULL)) {
2193                         return;
2194                 }
2195                 if (net->RTO == 0) {
2196                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2197                 } else {
2198                         to_ticks = MSEC_TO_TICKS(net->RTO);
2199                 }
2200                 tmr = &stcb->asoc.strreset_timer;
2201                 break;
2202
2203         case SCTP_TIMER_TYPE_EARLYFR:
2204                 {
2205                         unsigned int msec;
2206
2207                         if ((stcb == NULL) || (net == NULL)) {
2208                                 return;
2209                         }
2210                         if (net->flight_size > net->cwnd) {
2211                                 /* no need to start */
2212                                 return;
2213                         }
2214                         SCTP_STAT_INCR(sctps_earlyfrstart);
2215                         if (net->lastsa == 0) {
2216                                 /* Hmm no rtt estimate yet? */
2217                                 msec = stcb->asoc.initial_rto >> 2;
2218                         } else {
2219                                 msec = ((net->lastsa >> 2) + net->lastsv) >> 1;
2220                         }
2221                         if (msec < SCTP_BASE_SYSCTL(sctp_early_fr_msec)) {
2222                                 msec = SCTP_BASE_SYSCTL(sctp_early_fr_msec);
2223                                 if (msec < SCTP_MINFR_MSEC_FLOOR) {
2224                                         msec = SCTP_MINFR_MSEC_FLOOR;
2225                                 }
2226                         }
2227                         to_ticks = MSEC_TO_TICKS(msec);
2228                         tmr = &net->fr_timer;
2229                 }
2230                 break;
2231         case SCTP_TIMER_TYPE_ASCONF:
2232                 /*
2233                  * Here the timer comes from the stcb but its value is from
2234                  * the net's RTO.
2235                  */
2236                 if ((stcb == NULL) || (net == NULL)) {
2237                         return;
2238                 }
2239                 if (net->RTO == 0) {
2240                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2241                 } else {
2242                         to_ticks = MSEC_TO_TICKS(net->RTO);
2243                 }
2244                 tmr = &stcb->asoc.asconf_timer;
2245                 break;
2246         case SCTP_TIMER_TYPE_PRIM_DELETED:
2247                 if ((stcb == NULL) || (net != NULL)) {
2248                         return;
2249                 }
2250                 to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2251                 tmr = &stcb->asoc.delete_prim_timer;
2252                 break;
2253         case SCTP_TIMER_TYPE_AUTOCLOSE:
2254                 if (stcb == NULL) {
2255                         return;
2256                 }
2257                 if (stcb->asoc.sctp_autoclose_ticks == 0) {
2258                         /*
2259                          * Really an error since stcb is NOT set to
2260                          * autoclose
2261                          */
2262                         return;
2263                 }
2264                 to_ticks = stcb->asoc.sctp_autoclose_ticks;
2265                 tmr = &stcb->asoc.autoclose_timer;
2266                 break;
2267         default:
2268                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2269                     __FUNCTION__, t_type);
2270                 return;
2271                 break;
2272         };
2273         if ((to_ticks <= 0) || (tmr == NULL)) {
2274                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: %d:software error to_ticks:%d tmr:%p not set ??\n",
2275                     __FUNCTION__, t_type, to_ticks, tmr);
2276                 return;
2277         }
2278         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
2279                 /*
2280                  * we do NOT allow you to have it already running. if it is
2281                  * we leave the current one up unchanged
2282                  */
2283                 return;
2284         }
2285         /* At this point we can proceed */
2286         if (t_type == SCTP_TIMER_TYPE_SEND) {
2287                 stcb->asoc.num_send_timers_up++;
2288         }
2289         tmr->stopped_from = 0;
2290         tmr->type = t_type;
2291         tmr->ep = (void *)inp;
2292         tmr->tcb = (void *)stcb;
2293         tmr->net = (void *)net;
2294         tmr->self = (void *)tmr;
2295         tmr->vnet = (void *)curvnet;
2296         tmr->ticks = sctp_get_tick_count();
2297         (void)SCTP_OS_TIMER_START(&tmr->timer, to_ticks, sctp_timeout_handler, tmr);
2298         return;
2299 }
2300
2301 void
2302 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2303     struct sctp_nets *net, uint32_t from)
2304 {
2305         struct sctp_timer *tmr;
2306
2307         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) &&
2308             (inp == NULL))
2309                 return;
2310
2311         tmr = NULL;
2312         if (stcb) {
2313                 SCTP_TCB_LOCK_ASSERT(stcb);
2314         }
2315         switch (t_type) {
2316         case SCTP_TIMER_TYPE_ZERO_COPY:
2317                 tmr = &inp->sctp_ep.zero_copy_timer;
2318                 break;
2319         case SCTP_TIMER_TYPE_ZCOPY_SENDQ:
2320                 tmr = &inp->sctp_ep.zero_copy_sendq_timer;
2321                 break;
2322         case SCTP_TIMER_TYPE_ADDR_WQ:
2323                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2324                 break;
2325         case SCTP_TIMER_TYPE_EARLYFR:
2326                 if ((stcb == NULL) || (net == NULL)) {
2327                         return;
2328                 }
2329                 tmr = &net->fr_timer;
2330                 SCTP_STAT_INCR(sctps_earlyfrstop);
2331                 break;
2332         case SCTP_TIMER_TYPE_SEND:
2333                 if ((stcb == NULL) || (net == NULL)) {
2334                         return;
2335                 }
2336                 tmr = &net->rxt_timer;
2337                 break;
2338         case SCTP_TIMER_TYPE_INIT:
2339                 if ((stcb == NULL) || (net == NULL)) {
2340                         return;
2341                 }
2342                 tmr = &net->rxt_timer;
2343                 break;
2344         case SCTP_TIMER_TYPE_RECV:
2345                 if (stcb == NULL) {
2346                         return;
2347                 }
2348                 tmr = &stcb->asoc.dack_timer;
2349                 break;
2350         case SCTP_TIMER_TYPE_SHUTDOWN:
2351                 if ((stcb == NULL) || (net == NULL)) {
2352                         return;
2353                 }
2354                 tmr = &net->rxt_timer;
2355                 break;
2356         case SCTP_TIMER_TYPE_HEARTBEAT:
2357                 if (stcb == NULL) {
2358                         return;
2359                 }
2360                 tmr = &stcb->asoc.hb_timer;
2361                 break;
2362         case SCTP_TIMER_TYPE_COOKIE:
2363                 if ((stcb == NULL) || (net == NULL)) {
2364                         return;
2365                 }
2366                 tmr = &net->rxt_timer;
2367                 break;
2368         case SCTP_TIMER_TYPE_NEWCOOKIE:
2369                 /* nothing needed but the endpoint here */
2370                 tmr = &inp->sctp_ep.signature_change;
2371                 /*
2372                  * We re-use the newcookie timer for the INP kill timer. We
2373                  * must assure that we do not kill it by accident.
2374                  */
2375                 break;
2376         case SCTP_TIMER_TYPE_ASOCKILL:
2377                 /*
2378                  * Stop the asoc kill timer.
2379                  */
2380                 if (stcb == NULL) {
2381                         return;
2382                 }
2383                 tmr = &stcb->asoc.strreset_timer;
2384                 break;
2385
2386         case SCTP_TIMER_TYPE_INPKILL:
2387                 /*
2388                  * The inp is setup to die. We re-use the signature_chage
2389                  * timer since that has stopped and we are in the GONE
2390                  * state.
2391                  */
2392                 tmr = &inp->sctp_ep.signature_change;
2393                 break;
2394         case SCTP_TIMER_TYPE_PATHMTURAISE:
2395                 if ((stcb == NULL) || (net == NULL)) {
2396                         return;
2397                 }
2398                 tmr = &net->pmtu_timer;
2399                 break;
2400         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2401                 if ((stcb == NULL) || (net == NULL)) {
2402                         return;
2403                 }
2404                 tmr = &net->rxt_timer;
2405                 break;
2406         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2407                 if (stcb == NULL) {
2408                         return;
2409                 }
2410                 tmr = &stcb->asoc.shut_guard_timer;
2411                 break;
2412         case SCTP_TIMER_TYPE_STRRESET:
2413                 if (stcb == NULL) {
2414                         return;
2415                 }
2416                 tmr = &stcb->asoc.strreset_timer;
2417                 break;
2418         case SCTP_TIMER_TYPE_ASCONF:
2419                 if (stcb == NULL) {
2420                         return;
2421                 }
2422                 tmr = &stcb->asoc.asconf_timer;
2423                 break;
2424         case SCTP_TIMER_TYPE_PRIM_DELETED:
2425                 if (stcb == NULL) {
2426                         return;
2427                 }
2428                 tmr = &stcb->asoc.delete_prim_timer;
2429                 break;
2430         case SCTP_TIMER_TYPE_AUTOCLOSE:
2431                 if (stcb == NULL) {
2432                         return;
2433                 }
2434                 tmr = &stcb->asoc.autoclose_timer;
2435                 break;
2436         default:
2437                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2438                     __FUNCTION__, t_type);
2439                 break;
2440         };
2441         if (tmr == NULL) {
2442                 return;
2443         }
2444         if ((tmr->type != t_type) && tmr->type) {
2445                 /*
2446                  * Ok we have a timer that is under joint use. Cookie timer
2447                  * per chance with the SEND timer. We therefore are NOT
2448                  * running the timer that the caller wants stopped.  So just
2449                  * return.
2450                  */
2451                 return;
2452         }
2453         if ((t_type == SCTP_TIMER_TYPE_SEND) && (stcb != NULL)) {
2454                 stcb->asoc.num_send_timers_up--;
2455                 if (stcb->asoc.num_send_timers_up < 0) {
2456                         stcb->asoc.num_send_timers_up = 0;
2457                 }
2458         }
2459         tmr->self = NULL;
2460         tmr->stopped_from = from;
2461         (void)SCTP_OS_TIMER_STOP(&tmr->timer);
2462         return;
2463 }
2464
2465 uint32_t
2466 sctp_calculate_len(struct mbuf *m)
2467 {
2468         uint32_t tlen = 0;
2469         struct mbuf *at;
2470
2471         at = m;
2472         while (at) {
2473                 tlen += SCTP_BUF_LEN(at);
2474                 at = SCTP_BUF_NEXT(at);
2475         }
2476         return (tlen);
2477 }
2478
2479 void
2480 sctp_mtu_size_reset(struct sctp_inpcb *inp,
2481     struct sctp_association *asoc, uint32_t mtu)
2482 {
2483         /*
2484          * Reset the P-MTU size on this association, this involves changing
2485          * the asoc MTU, going through ANY chunk+overhead larger than mtu to
2486          * allow the DF flag to be cleared.
2487          */
2488         struct sctp_tmit_chunk *chk;
2489         unsigned int eff_mtu, ovh;
2490
2491 #ifdef SCTP_PRINT_FOR_B_AND_M
2492         SCTP_PRINTF("sctp_mtu_size_reset(%p, asoc:%p mtu:%d\n",
2493             inp, asoc, mtu);
2494 #endif
2495         asoc->smallest_mtu = mtu;
2496         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2497                 ovh = SCTP_MIN_OVERHEAD;
2498         } else {
2499                 ovh = SCTP_MIN_V4_OVERHEAD;
2500         }
2501         eff_mtu = mtu - ovh;
2502         TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
2503                 if (chk->send_size > eff_mtu) {
2504                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2505                 }
2506         }
2507         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
2508                 if (chk->send_size > eff_mtu) {
2509                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2510                 }
2511         }
2512 }
2513
2514
2515 /*
2516  * given an association and starting time of the current RTT period return
2517  * RTO in number of msecs net should point to the current network
2518  */
2519 uint32_t
2520 sctp_calculate_rto(struct sctp_tcb *stcb,
2521     struct sctp_association *asoc,
2522     struct sctp_nets *net,
2523     struct timeval *told,
2524     int safe)
2525 {
2526         /*-
2527          * given an association and the starting time of the current RTT
2528          * period (in value1/value2) return RTO in number of msecs.
2529          */
2530         int calc_time = 0;
2531         int o_calctime;
2532         uint32_t new_rto = 0;
2533         int first_measure = 0;
2534         struct timeval now, then, *old;
2535
2536         /* Copy it out for sparc64 */
2537         if (safe == sctp_align_unsafe_makecopy) {
2538                 old = &then;
2539                 memcpy(&then, told, sizeof(struct timeval));
2540         } else if (safe == sctp_align_safe_nocopy) {
2541                 old = told;
2542         } else {
2543                 /* error */
2544                 SCTP_PRINTF("Huh, bad rto calc call\n");
2545                 return (0);
2546         }
2547         /************************/
2548         /* 1. calculate new RTT */
2549         /************************/
2550         /* get the current time */
2551         (void)SCTP_GETTIME_TIMEVAL(&now);
2552         /* compute the RTT value */
2553         if ((u_long)now.tv_sec > (u_long)old->tv_sec) {
2554                 calc_time = ((u_long)now.tv_sec - (u_long)old->tv_sec) * 1000;
2555                 if ((u_long)now.tv_usec > (u_long)old->tv_usec) {
2556                         calc_time += (((u_long)now.tv_usec -
2557                             (u_long)old->tv_usec) / 1000);
2558                 } else if ((u_long)now.tv_usec < (u_long)old->tv_usec) {
2559                         /* Borrow 1,000ms from current calculation */
2560                         calc_time -= 1000;
2561                         /* Add in the slop over */
2562                         calc_time += ((int)now.tv_usec / 1000);
2563                         /* Add in the pre-second ms's */
2564                         calc_time += (((int)1000000 - (int)old->tv_usec) / 1000);
2565                 }
2566         } else if ((u_long)now.tv_sec == (u_long)old->tv_sec) {
2567                 if ((u_long)now.tv_usec > (u_long)old->tv_usec) {
2568                         calc_time = ((u_long)now.tv_usec -
2569                             (u_long)old->tv_usec) / 1000;
2570                 } else if ((u_long)now.tv_usec < (u_long)old->tv_usec) {
2571                         /* impossible .. garbage in nothing out */
2572                         goto calc_rto;
2573                 } else if ((u_long)now.tv_usec == (u_long)old->tv_usec) {
2574                         /*
2575                          * We have to have 1 usec :-D this must be the
2576                          * loopback.
2577                          */
2578                         calc_time = 1;
2579                 } else {
2580                         /* impossible .. garbage in nothing out */
2581                         goto calc_rto;
2582                 }
2583         } else {
2584                 /* Clock wrapped? */
2585                 goto calc_rto;
2586         }
2587         /***************************/
2588         /* 2. update RTTVAR & SRTT */
2589         /***************************/
2590         net->rtt = o_calctime = calc_time;
2591         /* this is Van Jacobson's integer version */
2592         if (net->RTO_measured) {
2593                 calc_time -= (net->lastsa >> SCTP_RTT_SHIFT);   /* take away 1/8th when
2594                                                                  * shift=3 */
2595                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2596                         rto_logging(net, SCTP_LOG_RTTVAR);
2597                 }
2598                 net->prev_rtt = o_calctime;
2599                 net->lastsa += calc_time;       /* add 7/8th into sa when
2600                                                  * shift=3 */
2601                 if (calc_time < 0) {
2602                         calc_time = -calc_time;
2603                 }
2604                 calc_time -= (net->lastsv >> SCTP_RTT_VAR_SHIFT);       /* take away 1/4 when
2605                                                                          * VAR shift=2 */
2606                 net->lastsv += calc_time;
2607                 if (net->lastsv == 0) {
2608                         net->lastsv = SCTP_CLOCK_GRANULARITY;
2609                 }
2610         } else {
2611                 /* First RTO measurment */
2612                 net->RTO_measured = 1;
2613                 net->lastsa = calc_time << SCTP_RTT_SHIFT;      /* Multiply by 8 when
2614                                                                  * shift=3 */
2615                 net->lastsv = calc_time;
2616                 if (net->lastsv == 0) {
2617                         net->lastsv = SCTP_CLOCK_GRANULARITY;
2618                 }
2619                 first_measure = 1;
2620                 net->prev_rtt = o_calctime;
2621                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2622                         rto_logging(net, SCTP_LOG_INITIAL_RTT);
2623                 }
2624         }
2625 calc_rto:
2626         new_rto = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
2627         if ((new_rto > SCTP_SAT_NETWORK_MIN) &&
2628             (stcb->asoc.sat_network_lockout == 0)) {
2629                 stcb->asoc.sat_network = 1;
2630         } else if ((!first_measure) && stcb->asoc.sat_network) {
2631                 stcb->asoc.sat_network = 0;
2632                 stcb->asoc.sat_network_lockout = 1;
2633         }
2634         /* bound it, per C6/C7 in Section 5.3.1 */
2635         if (new_rto < stcb->asoc.minrto) {
2636                 new_rto = stcb->asoc.minrto;
2637         }
2638         if (new_rto > stcb->asoc.maxrto) {
2639                 new_rto = stcb->asoc.maxrto;
2640         }
2641         /* we are now returning the RTO */
2642         return (new_rto);
2643 }
2644
2645 /*
2646  * return a pointer to a contiguous piece of data from the given mbuf chain
2647  * starting at 'off' for 'len' bytes.  If the desired piece spans more than
2648  * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size
2649  * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain.
2650  */
2651 caddr_t
2652 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t * in_ptr)
2653 {
2654         uint32_t count;
2655         uint8_t *ptr;
2656
2657         ptr = in_ptr;
2658         if ((off < 0) || (len <= 0))
2659                 return (NULL);
2660
2661         /* find the desired start location */
2662         while ((m != NULL) && (off > 0)) {
2663                 if (off < SCTP_BUF_LEN(m))
2664                         break;
2665                 off -= SCTP_BUF_LEN(m);
2666                 m = SCTP_BUF_NEXT(m);
2667         }
2668         if (m == NULL)
2669                 return (NULL);
2670
2671         /* is the current mbuf large enough (eg. contiguous)? */
2672         if ((SCTP_BUF_LEN(m) - off) >= len) {
2673                 return (mtod(m, caddr_t)+off);
2674         } else {
2675                 /* else, it spans more than one mbuf, so save a temp copy... */
2676                 while ((m != NULL) && (len > 0)) {
2677                         count = min(SCTP_BUF_LEN(m) - off, len);
2678                         bcopy(mtod(m, caddr_t)+off, ptr, count);
2679                         len -= count;
2680                         ptr += count;
2681                         off = 0;
2682                         m = SCTP_BUF_NEXT(m);
2683                 }
2684                 if ((m == NULL) && (len > 0))
2685                         return (NULL);
2686                 else
2687                         return ((caddr_t)in_ptr);
2688         }
2689 }
2690
2691
2692
2693 struct sctp_paramhdr *
2694 sctp_get_next_param(struct mbuf *m,
2695     int offset,
2696     struct sctp_paramhdr *pull,
2697     int pull_limit)
2698 {
2699         /* This just provides a typed signature to Peter's Pull routine */
2700         return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit,
2701             (uint8_t *) pull));
2702 }
2703
2704
2705 int
2706 sctp_add_pad_tombuf(struct mbuf *m, int padlen)
2707 {
2708         /*
2709          * add padlen bytes of 0 filled padding to the end of the mbuf. If
2710          * padlen is > 3 this routine will fail.
2711          */
2712         uint8_t *dp;
2713         int i;
2714
2715         if (padlen > 3) {
2716                 SCTP_LTRACE_ERR_RET_PKT(m, NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
2717                 return (ENOBUFS);
2718         }
2719         if (padlen <= M_TRAILINGSPACE(m)) {
2720                 /*
2721                  * The easy way. We hope the majority of the time we hit
2722                  * here :)
2723                  */
2724                 dp = (uint8_t *) (mtod(m, caddr_t)+SCTP_BUF_LEN(m));
2725                 SCTP_BUF_LEN(m) += padlen;
2726         } else {
2727                 /* Hard way we must grow the mbuf */
2728                 struct mbuf *tmp;
2729
2730                 tmp = sctp_get_mbuf_for_msg(padlen, 0, M_DONTWAIT, 1, MT_DATA);
2731                 if (tmp == NULL) {
2732                         /* Out of space GAK! we are in big trouble. */
2733                         SCTP_LTRACE_ERR_RET_PKT(m, NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
2734                         return (ENOSPC);
2735                 }
2736                 /* setup and insert in middle */
2737                 SCTP_BUF_LEN(tmp) = padlen;
2738                 SCTP_BUF_NEXT(tmp) = NULL;
2739                 SCTP_BUF_NEXT(m) = tmp;
2740                 dp = mtod(tmp, uint8_t *);
2741         }
2742         /* zero out the pad */
2743         for (i = 0; i < padlen; i++) {
2744                 *dp = 0;
2745                 dp++;
2746         }
2747         return (0);
2748 }
2749
2750 int
2751 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf)
2752 {
2753         /* find the last mbuf in chain and pad it */
2754         struct mbuf *m_at;
2755
2756         m_at = m;
2757         if (last_mbuf) {
2758                 return (sctp_add_pad_tombuf(last_mbuf, padval));
2759         } else {
2760                 while (m_at) {
2761                         if (SCTP_BUF_NEXT(m_at) == NULL) {
2762                                 return (sctp_add_pad_tombuf(m_at, padval));
2763                         }
2764                         m_at = SCTP_BUF_NEXT(m_at);
2765                 }
2766         }
2767         SCTP_LTRACE_ERR_RET_PKT(m, NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
2768         return (EFAULT);
2769 }
2770
2771 static void
2772 sctp_notify_assoc_change(uint32_t event, struct sctp_tcb *stcb,
2773     uint32_t error, void *data, int so_locked
2774 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2775     SCTP_UNUSED
2776 #endif
2777 )
2778 {
2779         struct mbuf *m_notify;
2780         struct sctp_assoc_change *sac;
2781         struct sctp_queued_to_read *control;
2782
2783 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2784         struct socket *so;
2785
2786 #endif
2787
2788         /*
2789          * For TCP model AND UDP connected sockets we will send an error up
2790          * when an ABORT comes in.
2791          */
2792         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2793             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2794             ((event == SCTP_COMM_LOST) || (event == SCTP_CANT_STR_ASSOC))) {
2795                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) {
2796                         SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNREFUSED);
2797                         stcb->sctp_socket->so_error = ECONNREFUSED;
2798                 } else {
2799                         SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
2800                         stcb->sctp_socket->so_error = ECONNRESET;
2801                 }
2802                 /* Wake ANY sleepers */
2803 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2804                 so = SCTP_INP_SO(stcb->sctp_ep);
2805                 if (!so_locked) {
2806                         atomic_add_int(&stcb->asoc.refcnt, 1);
2807                         SCTP_TCB_UNLOCK(stcb);
2808                         SCTP_SOCKET_LOCK(so, 1);
2809                         SCTP_TCB_LOCK(stcb);
2810                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
2811                         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2812                                 SCTP_SOCKET_UNLOCK(so, 1);
2813                                 return;
2814                         }
2815                 }
2816 #endif
2817                 sorwakeup(stcb->sctp_socket);
2818                 sowwakeup(stcb->sctp_socket);
2819 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2820                 if (!so_locked) {
2821                         SCTP_SOCKET_UNLOCK(so, 1);
2822                 }
2823 #endif
2824         }
2825         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_RECVASSOCEVNT)) {
2826                 /* event not enabled */
2827                 return;
2828         }
2829         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_change), 0, M_DONTWAIT, 1, MT_DATA);
2830         if (m_notify == NULL)
2831                 /* no space left */
2832                 return;
2833         SCTP_BUF_LEN(m_notify) = 0;
2834
2835         sac = mtod(m_notify, struct sctp_assoc_change *);
2836         sac->sac_type = SCTP_ASSOC_CHANGE;
2837         sac->sac_flags = 0;
2838         sac->sac_length = sizeof(struct sctp_assoc_change);
2839         sac->sac_state = event;
2840         sac->sac_error = error;
2841         /* XXX verify these stream counts */
2842         sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
2843         sac->sac_inbound_streams = stcb->asoc.streamincnt;
2844         sac->sac_assoc_id = sctp_get_associd(stcb);
2845         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_change);
2846         SCTP_BUF_NEXT(m_notify) = NULL;
2847         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2848             0, 0, 0, 0, 0, 0,
2849             m_notify);
2850         if (control == NULL) {
2851                 /* no memory */
2852                 sctp_m_freem(m_notify);
2853                 return;
2854         }
2855         control->length = SCTP_BUF_LEN(m_notify);
2856         /* not that we need this */
2857         control->tail_mbuf = m_notify;
2858         control->spec_flags = M_NOTIFICATION;
2859         sctp_add_to_readq(stcb->sctp_ep, stcb,
2860             control,
2861             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD,
2862             so_locked);
2863         if (event == SCTP_COMM_LOST) {
2864                 /* Wake up any sleeper */
2865 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2866                 so = SCTP_INP_SO(stcb->sctp_ep);
2867                 if (!so_locked) {
2868                         atomic_add_int(&stcb->asoc.refcnt, 1);
2869                         SCTP_TCB_UNLOCK(stcb);
2870                         SCTP_SOCKET_LOCK(so, 1);
2871                         SCTP_TCB_LOCK(stcb);
2872                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
2873                         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2874                                 SCTP_SOCKET_UNLOCK(so, 1);
2875                                 return;
2876                         }
2877                 }
2878 #endif
2879                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
2880 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2881                 if (!so_locked) {
2882                         SCTP_SOCKET_UNLOCK(so, 1);
2883                 }
2884 #endif
2885         }
2886 }
2887
2888 static void
2889 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
2890     struct sockaddr *sa, uint32_t error)
2891 {
2892         struct mbuf *m_notify;
2893         struct sctp_paddr_change *spc;
2894         struct sctp_queued_to_read *control;
2895
2896         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_RECVPADDREVNT)) {
2897                 /* event not enabled */
2898                 return;
2899         }
2900         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 0, M_DONTWAIT, 1, MT_DATA);
2901         if (m_notify == NULL)
2902                 return;
2903         SCTP_BUF_LEN(m_notify) = 0;
2904         spc = mtod(m_notify, struct sctp_paddr_change *);
2905         spc->spc_type = SCTP_PEER_ADDR_CHANGE;
2906         spc->spc_flags = 0;
2907         spc->spc_length = sizeof(struct sctp_paddr_change);
2908         switch (sa->sa_family) {
2909         case AF_INET:
2910                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2911                 break;
2912 #ifdef INET6
2913         case AF_INET6:
2914                 {
2915                         struct sockaddr_in6 *sin6;
2916
2917                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6));
2918
2919                         sin6 = (struct sockaddr_in6 *)&spc->spc_aaddr;
2920                         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2921                                 if (sin6->sin6_scope_id == 0) {
2922                                         /* recover scope_id for user */
2923                                         (void)sa6_recoverscope(sin6);
2924                                 } else {
2925                                         /* clear embedded scope_id for user */
2926                                         in6_clearscope(&sin6->sin6_addr);
2927                                 }
2928                         }
2929                         break;
2930                 }
2931 #endif
2932         default:
2933                 /* TSNH */
2934                 break;
2935         }
2936         spc->spc_state = state;
2937         spc->spc_error = error;
2938         spc->spc_assoc_id = sctp_get_associd(stcb);
2939
2940         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_paddr_change);
2941         SCTP_BUF_NEXT(m_notify) = NULL;
2942
2943         /* append to socket */
2944         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2945             0, 0, 0, 0, 0, 0,
2946             m_notify);
2947         if (control == NULL) {
2948                 /* no memory */
2949                 sctp_m_freem(m_notify);
2950                 return;
2951         }
2952         control->length = SCTP_BUF_LEN(m_notify);
2953         control->spec_flags = M_NOTIFICATION;
2954         /* not that we need this */
2955         control->tail_mbuf = m_notify;
2956         sctp_add_to_readq(stcb->sctp_ep, stcb,
2957             control,
2958             &stcb->sctp_socket->so_rcv, 1,
2959             SCTP_READ_LOCK_NOT_HELD,
2960             SCTP_SO_NOT_LOCKED);
2961 }
2962
2963
2964 static void
2965 sctp_notify_send_failed(struct sctp_tcb *stcb, uint32_t error,
2966     struct sctp_tmit_chunk *chk, int so_locked
2967 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2968     SCTP_UNUSED
2969 #endif
2970 )
2971 {
2972         struct mbuf *m_notify;
2973         struct sctp_send_failed *ssf;
2974         struct sctp_queued_to_read *control;
2975         int length;
2976
2977         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_RECVSENDFAILEVNT)) {
2978                 /* event not enabled */
2979                 return;
2980         }
2981         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_send_failed), 0, M_DONTWAIT, 1, MT_DATA);
2982         if (m_notify == NULL)
2983                 /* no space left */
2984                 return;
2985         length = sizeof(struct sctp_send_failed) + chk->send_size;
2986         length -= sizeof(struct sctp_data_chunk);
2987         SCTP_BUF_LEN(m_notify) = 0;
2988         ssf = mtod(m_notify, struct sctp_send_failed *);
2989         ssf->ssf_type = SCTP_SEND_FAILED;
2990         if (error == SCTP_NOTIFY_DATAGRAM_UNSENT)
2991                 ssf->ssf_flags = SCTP_DATA_UNSENT;
2992         else
2993                 ssf->ssf_flags = SCTP_DATA_SENT;
2994         ssf->ssf_length = length;
2995         ssf->ssf_error = error;
2996         /* not exactly what the user sent in, but should be close :) */
2997         bzero(&ssf->ssf_info, sizeof(ssf->ssf_info));
2998         ssf->ssf_info.sinfo_stream = chk->rec.data.stream_number;
2999         ssf->ssf_info.sinfo_ssn = chk->rec.data.stream_seq;
3000         ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags;
3001         ssf->ssf_info.sinfo_ppid = chk->rec.data.payloadtype;
3002         ssf->ssf_info.sinfo_context = chk->rec.data.context;
3003         ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
3004         ssf->ssf_assoc_id = sctp_get_associd(stcb);
3005
3006         if (chk->data) {
3007                 /*
3008                  * trim off the sctp chunk header(it should be there)
3009                  */
3010                 if (chk->send_size >= sizeof(struct sctp_data_chunk)) {
3011                         m_adj(chk->data, sizeof(struct sctp_data_chunk));
3012                         sctp_mbuf_crush(chk->data);
3013                         chk->send_size -= sizeof(struct sctp_data_chunk);
3014                 }
3015         }
3016         SCTP_BUF_NEXT(m_notify) = chk->data;
3017         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed);
3018         /* Steal off the mbuf */
3019         chk->data = NULL;
3020         /*
3021          * For this case, we check the actual socket buffer, since the assoc
3022          * is going away we don't want to overfill the socket buffer for a
3023          * non-reader
3024          */
3025         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3026                 sctp_m_freem(m_notify);
3027                 return;
3028         }
3029         /* append to socket */
3030         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3031             0, 0, 0, 0, 0, 0,
3032             m_notify);
3033         if (control == NULL) {
3034                 /* no memory */
3035                 sctp_m_freem(m_notify);
3036                 return;
3037         }
3038         control->spec_flags = M_NOTIFICATION;
3039         sctp_add_to_readq(stcb->sctp_ep, stcb,
3040             control,
3041             &stcb->sctp_socket->so_rcv, 1,
3042             SCTP_READ_LOCK_NOT_HELD,
3043             so_locked);
3044 }
3045
3046
3047 static void
3048 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
3049     struct sctp_stream_queue_pending *sp, int so_locked
3050 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3051     SCTP_UNUSED
3052 #endif
3053 )
3054 {
3055         struct mbuf *m_notify;
3056         struct sctp_send_failed *ssf;
3057         struct sctp_queued_to_read *control;
3058         int length;
3059
3060         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_RECVSENDFAILEVNT)) {
3061                 /* event not enabled */
3062                 return;
3063         }
3064         length = sizeof(struct sctp_send_failed) + sp->length;
3065         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_send_failed), 0, M_DONTWAIT, 1, MT_DATA);
3066         if (m_notify == NULL)
3067                 /* no space left */
3068                 return;
3069         SCTP_BUF_LEN(m_notify) = 0;
3070         ssf = mtod(m_notify, struct sctp_send_failed *);
3071         ssf->ssf_type = SCTP_SEND_FAILED;
3072         if (error == SCTP_NOTIFY_DATAGRAM_UNSENT)
3073                 ssf->ssf_flags = SCTP_DATA_UNSENT;
3074         else
3075                 ssf->ssf_flags = SCTP_DATA_SENT;
3076         ssf->ssf_length = length;
3077         ssf->ssf_error = error;
3078         /* not exactly what the user sent in, but should be close :) */
3079         bzero(&ssf->ssf_info, sizeof(ssf->ssf_info));
3080         ssf->ssf_info.sinfo_stream = sp->stream;
3081         ssf->ssf_info.sinfo_ssn = sp->strseq;
3082         if (sp->some_taken) {
3083                 ssf->ssf_info.sinfo_flags = SCTP_DATA_LAST_FRAG;
3084         } else {
3085                 ssf->ssf_info.sinfo_flags = SCTP_DATA_NOT_FRAG;
3086         }
3087         ssf->ssf_info.sinfo_ppid = sp->ppid;
3088         ssf->ssf_info.sinfo_context = sp->context;
3089         ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
3090         ssf->ssf_assoc_id = sctp_get_associd(stcb);
3091         SCTP_BUF_NEXT(m_notify) = sp->data;
3092         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed);
3093
3094         /* Steal off the mbuf */
3095         sp->data = NULL;
3096         /*
3097          * For this case, we check the actual socket buffer, since the assoc
3098          * is going away we don't want to overfill the socket buffer for a
3099          * non-reader
3100          */
3101         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3102                 sctp_m_freem(m_notify);
3103                 return;
3104         }
3105         /* append to socket */
3106         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3107             0, 0, 0, 0, 0, 0,
3108             m_notify);
3109         if (control == NULL) {
3110                 /* no memory */
3111                 sctp_m_freem(m_notify);
3112                 return;
3113         }
3114         control->spec_flags = M_NOTIFICATION;
3115         sctp_add_to_readq(stcb->sctp_ep, stcb,
3116             control,
3117             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3118 }
3119
3120
3121
3122 static void
3123 sctp_notify_adaptation_layer(struct sctp_tcb *stcb,
3124     uint32_t error)
3125 {
3126         struct mbuf *m_notify;
3127         struct sctp_adaptation_event *sai;
3128         struct sctp_queued_to_read *control;
3129
3130         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_ADAPTATIONEVNT)) {
3131                 /* event not enabled */
3132                 return;
3133         }
3134         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_DONTWAIT, 1, MT_DATA);
3135         if (m_notify == NULL)
3136                 /* no space left */
3137                 return;
3138         SCTP_BUF_LEN(m_notify) = 0;
3139         sai = mtod(m_notify, struct sctp_adaptation_event *);
3140         sai->sai_type = SCTP_ADAPTATION_INDICATION;
3141         sai->sai_flags = 0;
3142         sai->sai_length = sizeof(struct sctp_adaptation_event);
3143         sai->sai_adaptation_ind = stcb->asoc.peers_adaptation;
3144         sai->sai_assoc_id = sctp_get_associd(stcb);
3145
3146         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_adaptation_event);
3147         SCTP_BUF_NEXT(m_notify) = NULL;
3148
3149         /* append to socket */
3150         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3151             0, 0, 0, 0, 0, 0,
3152             m_notify);
3153         if (control == NULL) {
3154                 /* no memory */
3155                 sctp_m_freem(m_notify);
3156                 return;
3157         }
3158         control->length = SCTP_BUF_LEN(m_notify);
3159         control->spec_flags = M_NOTIFICATION;
3160         /* not that we need this */
3161         control->tail_mbuf = m_notify;
3162         sctp_add_to_readq(stcb->sctp_ep, stcb,
3163             control,
3164             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3165 }
3166
3167 /* This always must be called with the read-queue LOCKED in the INP */
3168 static void
3169 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb, uint32_t error,
3170     uint32_t val, int so_locked
3171 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3172     SCTP_UNUSED
3173 #endif
3174 )
3175 {
3176         struct mbuf *m_notify;
3177         struct sctp_pdapi_event *pdapi;
3178         struct sctp_queued_to_read *control;
3179         struct sockbuf *sb;
3180
3181         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_PDAPIEVNT)) {
3182                 /* event not enabled */
3183                 return;
3184         }
3185         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
3186                 return;
3187         }
3188         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 0, M_DONTWAIT, 1, MT_DATA);
3189         if (m_notify == NULL)
3190                 /* no space left */
3191                 return;
3192         SCTP_BUF_LEN(m_notify) = 0;
3193         pdapi = mtod(m_notify, struct sctp_pdapi_event *);
3194         pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
3195         pdapi->pdapi_flags = 0;
3196         pdapi->pdapi_length = sizeof(struct sctp_pdapi_event);
3197         pdapi->pdapi_indication = error;
3198         pdapi->pdapi_stream = (val >> 16);
3199         pdapi->pdapi_seq = (val & 0x0000ffff);
3200         pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
3201
3202         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_pdapi_event);
3203         SCTP_BUF_NEXT(m_notify) = NULL;
3204         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3205             0, 0, 0, 0, 0, 0,
3206             m_notify);
3207         if (control == NULL) {
3208                 /* no memory */
3209                 sctp_m_freem(m_notify);
3210                 return;
3211         }
3212         control->spec_flags = M_NOTIFICATION;
3213         control->length = SCTP_BUF_LEN(m_notify);
3214         /* not that we need this */
3215         control->tail_mbuf = m_notify;
3216         control->held_length = 0;
3217         control->length = 0;
3218         sb = &stcb->sctp_socket->so_rcv;
3219         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3220                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m_notify));
3221         }
3222         sctp_sballoc(stcb, sb, m_notify);
3223         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3224                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3225         }
3226         atomic_add_int(&control->length, SCTP_BUF_LEN(m_notify));
3227         control->end_added = 1;
3228         if (stcb->asoc.control_pdapi)
3229                 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next);
3230         else {
3231                 /* we really should not see this case */
3232                 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next);
3233         }
3234         if (stcb->sctp_ep && stcb->sctp_socket) {
3235                 /* This should always be the case */
3236 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3237                 struct socket *so;
3238
3239                 so = SCTP_INP_SO(stcb->sctp_ep);
3240                 if (!so_locked) {
3241                         atomic_add_int(&stcb->asoc.refcnt, 1);
3242                         SCTP_TCB_UNLOCK(stcb);
3243                         SCTP_SOCKET_LOCK(so, 1);
3244                         SCTP_TCB_LOCK(stcb);
3245                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
3246                         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3247                                 SCTP_SOCKET_UNLOCK(so, 1);
3248                                 return;
3249                         }
3250                 }
3251 #endif
3252                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
3253 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3254                 if (!so_locked) {
3255                         SCTP_SOCKET_UNLOCK(so, 1);
3256                 }
3257 #endif
3258         }
3259 }
3260
3261 static void
3262 sctp_notify_shutdown_event(struct sctp_tcb *stcb)
3263 {
3264         struct mbuf *m_notify;
3265         struct sctp_shutdown_event *sse;
3266         struct sctp_queued_to_read *control;
3267
3268         /*
3269          * For TCP model AND UDP connected sockets we will send an error up
3270          * when an SHUTDOWN completes
3271          */
3272         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3273             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
3274                 /* mark socket closed for read/write and wakeup! */
3275 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3276                 struct socket *so;
3277
3278                 so = SCTP_INP_SO(stcb->sctp_ep);
3279                 atomic_add_int(&stcb->asoc.refcnt, 1);
3280                 SCTP_TCB_UNLOCK(stcb);
3281                 SCTP_SOCKET_LOCK(so, 1);
3282                 SCTP_TCB_LOCK(stcb);
3283                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3284                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
3285                         SCTP_SOCKET_UNLOCK(so, 1);
3286                         return;
3287                 }
3288 #endif
3289                 socantsendmore(stcb->sctp_socket);
3290 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3291                 SCTP_SOCKET_UNLOCK(so, 1);
3292 #endif
3293         }
3294         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT)) {
3295                 /* event not enabled */
3296                 return;
3297         }
3298         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 0, M_DONTWAIT, 1, MT_DATA);
3299         if (m_notify == NULL)
3300                 /* no space left */
3301                 return;
3302         sse = mtod(m_notify, struct sctp_shutdown_event *);
3303         sse->sse_type = SCTP_SHUTDOWN_EVENT;
3304         sse->sse_flags = 0;
3305         sse->sse_length = sizeof(struct sctp_shutdown_event);
3306         sse->sse_assoc_id = sctp_get_associd(stcb);
3307
3308         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_shutdown_event);
3309         SCTP_BUF_NEXT(m_notify) = NULL;
3310
3311         /* append to socket */
3312         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3313             0, 0, 0, 0, 0, 0,
3314             m_notify);
3315         if (control == NULL) {
3316                 /* no memory */
3317                 sctp_m_freem(m_notify);
3318                 return;
3319         }
3320         control->spec_flags = M_NOTIFICATION;
3321         control->length = SCTP_BUF_LEN(m_notify);
3322         /* not that we need this */
3323         control->tail_mbuf = m_notify;
3324         sctp_add_to_readq(stcb->sctp_ep, stcb,
3325             control,
3326             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3327 }
3328
3329 static void
3330 sctp_notify_sender_dry_event(struct sctp_tcb *stcb,
3331     int so_locked
3332 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3333     SCTP_UNUSED
3334 #endif
3335 )
3336 {
3337         struct mbuf *m_notify;
3338         struct sctp_sender_dry_event *event;
3339         struct sctp_queued_to_read *control;
3340
3341         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_DRYEVNT)) {
3342                 /* event not enabled */
3343                 return;
3344         }
3345         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_sender_dry_event), 0, M_DONTWAIT, 1, MT_DATA);
3346         if (m_notify == NULL) {
3347                 /* no space left */
3348                 return;
3349         }
3350         SCTP_BUF_LEN(m_notify) = 0;
3351         event = mtod(m_notify, struct sctp_sender_dry_event *);
3352         event->sender_dry_type = SCTP_SENDER_DRY_EVENT;
3353         event->sender_dry_flags = 0;
3354         event->sender_dry_length = sizeof(struct sctp_sender_dry_event);
3355         event->sender_dry_assoc_id = sctp_get_associd(stcb);
3356
3357         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_sender_dry_event);
3358         SCTP_BUF_NEXT(m_notify) = NULL;
3359
3360         /* append to socket */
3361         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3362             0, 0, 0, 0, 0, 0, m_notify);
3363         if (control == NULL) {
3364                 /* no memory */
3365                 sctp_m_freem(m_notify);
3366                 return;
3367         }
3368         control->length = SCTP_BUF_LEN(m_notify);
3369         control->spec_flags = M_NOTIFICATION;
3370         /* not that we need this */
3371         control->tail_mbuf = m_notify;
3372         sctp_add_to_readq(stcb->sctp_ep, stcb, control,
3373             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3374 }
3375
3376
3377 static void
3378 sctp_notify_stream_reset_add(struct sctp_tcb *stcb, int number_entries, int flag)
3379 {
3380         struct mbuf *m_notify;
3381         struct sctp_queued_to_read *control;
3382         struct sctp_stream_reset_event *strreset;
3383         int len;
3384
3385         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_STREAM_RESETEVNT)) {
3386                 /* event not enabled */
3387                 return;
3388         }
3389         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
3390         if (m_notify == NULL)
3391                 /* no space left */
3392                 return;
3393         SCTP_BUF_LEN(m_notify) = 0;
3394         len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
3395         if (len > M_TRAILINGSPACE(m_notify)) {
3396                 /* never enough room */
3397                 sctp_m_freem(m_notify);
3398                 return;
3399         }
3400         strreset = mtod(m_notify, struct sctp_stream_reset_event *);
3401         strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
3402         strreset->strreset_flags = SCTP_STRRESET_ADD_STREAM | flag;
3403         strreset->strreset_length = len;
3404         strreset->strreset_assoc_id = sctp_get_associd(stcb);
3405         strreset->strreset_list[0] = number_entries;
3406
3407         SCTP_BUF_LEN(m_notify) = len;
3408         SCTP_BUF_NEXT(m_notify) = NULL;
3409         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3410                 /* no space */
3411                 sctp_m_freem(m_notify);
3412                 return;
3413         }
3414         /* append to socket */
3415         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3416             0, 0, 0, 0, 0, 0,
3417             m_notify);
3418         if (control == NULL) {
3419                 /* no memory */
3420                 sctp_m_freem(m_notify);
3421                 return;
3422         }
3423         control->spec_flags = M_NOTIFICATION;
3424         control->length = SCTP_BUF_LEN(m_notify);
3425         /* not that we need this */
3426         control->tail_mbuf = m_notify;
3427         sctp_add_to_readq(stcb->sctp_ep, stcb,
3428             control,
3429             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3430 }
3431
3432
3433 static void
3434 sctp_notify_stream_reset(struct sctp_tcb *stcb,
3435     int number_entries, uint16_t * list, int flag)
3436 {
3437         struct mbuf *m_notify;
3438         struct sctp_queued_to_read *control;
3439         struct sctp_stream_reset_event *strreset;
3440         int len;
3441
3442         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_STREAM_RESETEVNT)) {
3443                 /* event not enabled */
3444                 return;
3445         }
3446         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
3447         if (m_notify == NULL)
3448                 /* no space left */
3449                 return;
3450         SCTP_BUF_LEN(m_notify) = 0;
3451         len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
3452         if (len > M_TRAILINGSPACE(m_notify)) {
3453                 /* never enough room */
3454                 sctp_m_freem(m_notify);
3455                 return;
3456         }
3457         strreset = mtod(m_notify, struct sctp_stream_reset_event *);
3458         strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
3459         if (number_entries == 0) {
3460                 strreset->strreset_flags = flag | SCTP_STRRESET_ALL_STREAMS;
3461         } else {
3462                 strreset->strreset_flags = flag | SCTP_STRRESET_STREAM_LIST;
3463         }
3464         strreset->strreset_length = len;
3465         strreset->strreset_assoc_id = sctp_get_associd(stcb);
3466         if (number_entries) {
3467                 int i;
3468
3469                 for (i = 0; i < number_entries; i++) {
3470                         strreset->strreset_list[i] = ntohs(list[i]);
3471                 }
3472         }
3473         SCTP_BUF_LEN(m_notify) = len;
3474         SCTP_BUF_NEXT(m_notify) = NULL;
3475         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3476                 /* no space */
3477                 sctp_m_freem(m_notify);
3478                 return;
3479         }
3480         /* append to socket */
3481         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3482             0, 0, 0, 0, 0, 0,
3483             m_notify);
3484         if (control == NULL) {
3485                 /* no memory */
3486                 sctp_m_freem(m_notify);
3487                 return;
3488         }
3489         control->spec_flags = M_NOTIFICATION;
3490         control->length = SCTP_BUF_LEN(m_notify);
3491         /* not that we need this */
3492         control->tail_mbuf = m_notify;
3493         sctp_add_to_readq(stcb->sctp_ep, stcb,
3494             control,
3495             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3496 }
3497
3498
3499 void
3500 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb,
3501     uint32_t error, void *data, int so_locked
3502 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3503     SCTP_UNUSED
3504 #endif
3505 )
3506 {
3507         if ((stcb == NULL) ||
3508             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3509             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3510             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3511                 /* If the socket is gone we are out of here */
3512                 return;
3513         }
3514         if (stcb->sctp_socket->so_rcv.sb_state & SBS_CANTRCVMORE) {
3515                 return;
3516         }
3517         if (stcb && ((stcb->asoc.state & SCTP_STATE_COOKIE_WAIT) ||
3518             (stcb->asoc.state & SCTP_STATE_COOKIE_ECHOED))) {
3519                 if ((notification == SCTP_NOTIFY_INTERFACE_DOWN) ||
3520                     (notification == SCTP_NOTIFY_INTERFACE_UP) ||
3521                     (notification == SCTP_NOTIFY_INTERFACE_CONFIRMED)) {
3522                         /* Don't report these in front states */
3523                         return;
3524                 }
3525         }
3526         switch (notification) {
3527         case SCTP_NOTIFY_ASSOC_UP:
3528                 if (stcb->asoc.assoc_up_sent == 0) {
3529                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, NULL, so_locked);
3530                         stcb->asoc.assoc_up_sent = 1;
3531                 }
3532                 if (stcb->asoc.adaptation_needed && (stcb->asoc.adaptation_sent == 0)) {
3533                         sctp_notify_adaptation_layer(stcb, error);
3534                 }
3535                 if (stcb->asoc.peer_supports_auth == 0) {
3536                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3537                             NULL, so_locked);
3538                 }
3539                 break;
3540         case SCTP_NOTIFY_ASSOC_DOWN:
3541                 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, NULL, so_locked);
3542                 break;
3543         case SCTP_NOTIFY_INTERFACE_DOWN:
3544                 {
3545                         struct sctp_nets *net;
3546
3547                         net = (struct sctp_nets *)data;
3548                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE,
3549                             (struct sockaddr *)&net->ro._l_addr, error);
3550                         break;
3551                 }
3552         case SCTP_NOTIFY_INTERFACE_UP:
3553                 {
3554                         struct sctp_nets *net;
3555
3556                         net = (struct sctp_nets *)data;
3557                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE,
3558                             (struct sockaddr *)&net->ro._l_addr, error);
3559                         break;
3560                 }
3561         case SCTP_NOTIFY_INTERFACE_CONFIRMED:
3562                 {
3563                         struct sctp_nets *net;
3564
3565                         net = (struct sctp_nets *)data;
3566                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED,
3567                             (struct sockaddr *)&net->ro._l_addr, error);
3568                         break;
3569                 }
3570         case SCTP_NOTIFY_SPECIAL_SP_FAIL:
3571                 sctp_notify_send_failed2(stcb, error,
3572                     (struct sctp_stream_queue_pending *)data, so_locked);
3573                 break;
3574         case SCTP_NOTIFY_DG_FAIL:
3575                 sctp_notify_send_failed(stcb, error,
3576                     (struct sctp_tmit_chunk *)data, so_locked);
3577                 break;
3578         case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION:
3579                 {
3580                         uint32_t val;
3581
3582                         val = *((uint32_t *) data);
3583
3584                         sctp_notify_partial_delivery_indication(stcb, error, val, so_locked);
3585                         break;
3586                 }
3587         case SCTP_NOTIFY_STRDATA_ERR:
3588                 break;
3589         case SCTP_NOTIFY_ASSOC_ABORTED:
3590                 if ((stcb) && (((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_WAIT) ||
3591                     ((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_ECHOED))) {
3592                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, NULL, so_locked);
3593                 } else {
3594                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, NULL, so_locked);
3595                 }
3596                 break;
3597         case SCTP_NOTIFY_PEER_OPENED_STREAM:
3598                 break;
3599         case SCTP_NOTIFY_STREAM_OPENED_OK:
3600                 break;
3601         case SCTP_NOTIFY_ASSOC_RESTART:
3602                 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, data, so_locked);
3603                 if (stcb->asoc.peer_supports_auth == 0) {
3604                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3605                             NULL, so_locked);
3606                 }
3607                 break;
3608         case SCTP_NOTIFY_HB_RESP:
3609                 break;
3610         case SCTP_NOTIFY_STR_RESET_INSTREAM_ADD_OK:
3611                 sctp_notify_stream_reset_add(stcb, error, SCTP_STRRESET_INBOUND_STR);
3612                 break;
3613         case SCTP_NOTIFY_STR_RESET_ADD_OK:
3614                 sctp_notify_stream_reset_add(stcb, error, SCTP_STRRESET_OUTBOUND_STR);
3615                 break;
3616         case SCTP_NOTIFY_STR_RESET_ADD_FAIL:
3617                 sctp_notify_stream_reset_add(stcb, error, (SCTP_STRRESET_FAILED | SCTP_STRRESET_OUTBOUND_STR));
3618                 break;
3619
3620         case SCTP_NOTIFY_STR_RESET_SEND:
3621                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STRRESET_OUTBOUND_STR);
3622                 break;
3623         case SCTP_NOTIFY_STR_RESET_RECV:
3624                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STRRESET_INBOUND_STR);
3625                 break;
3626         case SCTP_NOTIFY_STR_RESET_FAILED_OUT:
3627                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), (SCTP_STRRESET_OUTBOUND_STR | SCTP_STRRESET_FAILED));
3628                 break;
3629         case SCTP_NOTIFY_STR_RESET_FAILED_IN:
3630                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), (SCTP_STRRESET_INBOUND_STR | SCTP_STRRESET_FAILED));
3631                 break;
3632         case SCTP_NOTIFY_ASCONF_ADD_IP:
3633                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data,
3634                     error);
3635                 break;
3636         case SCTP_NOTIFY_ASCONF_DELETE_IP:
3637                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data,
3638                     error);
3639                 break;
3640         case SCTP_NOTIFY_ASCONF_SET_PRIMARY:
3641                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data,
3642                     error);
3643                 break;
3644         case SCTP_NOTIFY_ASCONF_SUCCESS:
3645                 break;
3646         case SCTP_NOTIFY_ASCONF_FAILED:
3647                 break;
3648         case SCTP_NOTIFY_PEER_SHUTDOWN:
3649                 sctp_notify_shutdown_event(stcb);
3650                 break;
3651         case SCTP_NOTIFY_AUTH_NEW_KEY:
3652                 sctp_notify_authentication(stcb, SCTP_AUTH_NEWKEY, error,
3653                     (uint16_t) (uintptr_t) data,
3654                     so_locked);
3655                 break;
3656         case SCTP_NOTIFY_AUTH_FREE_KEY:
3657                 sctp_notify_authentication(stcb, SCTP_AUTH_FREE_KEY, error,
3658                     (uint16_t) (uintptr_t) data,
3659                     so_locked);
3660                 break;
3661         case SCTP_NOTIFY_NO_PEER_AUTH:
3662                 sctp_notify_authentication(stcb, SCTP_AUTH_NO_AUTH, error,
3663                     (uint16_t) (uintptr_t) data,
3664                     so_locked);
3665                 break;
3666         case SCTP_NOTIFY_SENDER_DRY:
3667                 sctp_notify_sender_dry_event(stcb, so_locked);
3668                 break;
3669         default:
3670                 SCTPDBG(SCTP_DEBUG_UTIL1, "%s: unknown notification %xh (%u)\n",
3671                     __FUNCTION__, notification, notification);
3672                 break;
3673         }                       /* end switch */
3674 }
3675
3676 void
3677 sctp_report_all_outbound(struct sctp_tcb *stcb, int holds_lock, int so_locked
3678 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3679     SCTP_UNUSED
3680 #endif
3681 )
3682 {
3683         struct sctp_association *asoc;
3684         struct sctp_stream_out *outs;
3685         struct sctp_tmit_chunk *chk;
3686         struct sctp_stream_queue_pending *sp;
3687         int i;
3688
3689         asoc = &stcb->asoc;
3690
3691         if (stcb == NULL) {
3692                 return;
3693         }
3694         if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
3695                 /* already being freed */
3696                 return;
3697         }
3698         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3699             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3700             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3701                 return;
3702         }
3703         /* now through all the gunk freeing chunks */
3704         if (holds_lock == 0) {
3705                 SCTP_TCB_SEND_LOCK(stcb);
3706         }
3707         /* sent queue SHOULD be empty */
3708         if (!TAILQ_EMPTY(&asoc->sent_queue)) {
3709                 chk = TAILQ_FIRST(&asoc->sent_queue);
3710                 while (chk) {
3711                         TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
3712                         asoc->sent_queue_cnt--;
3713                         if (chk->data != NULL) {
3714                                 sctp_free_bufspace(stcb, asoc, chk, 1);
3715                                 sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
3716                                     SCTP_NOTIFY_DATAGRAM_SENT, chk, so_locked);
3717                                 if (chk->data) {
3718                                         sctp_m_freem(chk->data);
3719                                         chk->data = NULL;
3720                                 }
3721                         }
3722                         sctp_free_a_chunk(stcb, chk);
3723                         /* sa_ignore FREED_MEMORY */
3724                         chk = TAILQ_FIRST(&asoc->sent_queue);
3725                 }
3726         }
3727         /* pending send queue SHOULD be empty */
3728         if (!TAILQ_EMPTY(&asoc->send_queue)) {
3729                 chk = TAILQ_FIRST(&asoc->send_queue);
3730                 while (chk) {
3731                         TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
3732                         asoc->send_queue_cnt--;
3733                         if (chk->data != NULL) {
3734                                 sctp_free_bufspace(stcb, asoc, chk, 1);
3735                                 sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
3736                                     SCTP_NOTIFY_DATAGRAM_UNSENT, chk, so_locked);
3737                                 if (chk->data) {
3738                                         sctp_m_freem(chk->data);
3739                                         chk->data = NULL;
3740                                 }
3741                         }
3742                         sctp_free_a_chunk(stcb, chk);
3743                         /* sa_ignore FREED_MEMORY */
3744                         chk = TAILQ_FIRST(&asoc->send_queue);
3745                 }
3746         }
3747         for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
3748                 /* For each stream */
3749                 outs = &stcb->asoc.strmout[i];
3750                 /* clean up any sends there */
3751                 stcb->asoc.locked_on_sending = NULL;
3752                 sp = TAILQ_FIRST(&outs->outqueue);
3753                 while (sp) {
3754                         stcb->asoc.stream_queue_cnt--;
3755                         TAILQ_REMOVE(&outs->outqueue, sp, next);
3756                         sctp_free_spbufspace(stcb, asoc, sp);
3757                         if (sp->data) {
3758                                 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
3759                                     SCTP_NOTIFY_DATAGRAM_UNSENT, (void *)sp, so_locked);
3760                                 if (sp->data) {
3761                                         sctp_m_freem(sp->data);
3762                                         sp->data = NULL;
3763                                 }
3764                         }
3765                         if (sp->net) {
3766                                 sctp_free_remote_addr(sp->net);
3767                                 sp->net = NULL;
3768                         }
3769                         /* Free the chunk */
3770                         sctp_free_a_strmoq(stcb, sp);
3771                         /* sa_ignore FREED_MEMORY */
3772                         sp = TAILQ_FIRST(&outs->outqueue);
3773                 }
3774         }
3775
3776         if (holds_lock == 0) {
3777                 SCTP_TCB_SEND_UNLOCK(stcb);
3778         }
3779 }
3780
3781 void
3782 sctp_abort_notification(struct sctp_tcb *stcb, int error, int so_locked
3783 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3784     SCTP_UNUSED
3785 #endif
3786 )
3787 {
3788
3789         if (stcb == NULL) {
3790                 return;
3791         }
3792         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3793             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3794             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3795                 return;
3796         }
3797         /* Tell them we lost the asoc */
3798         sctp_report_all_outbound(stcb, 1, so_locked);
3799         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
3800             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
3801             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
3802                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED;
3803         }
3804         sctp_ulp_notify(SCTP_NOTIFY_ASSOC_ABORTED, stcb, error, NULL, so_locked);
3805 }
3806
3807 void
3808 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3809     struct mbuf *m, int iphlen, struct sctphdr *sh, struct mbuf *op_err,
3810     uint32_t vrf_id, uint16_t port)
3811 {
3812         uint32_t vtag;
3813
3814 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3815         struct socket *so;
3816
3817 #endif
3818
3819         vtag = 0;
3820         if (stcb != NULL) {
3821                 /* We have a TCB to abort, send notification too */
3822                 vtag = stcb->asoc.peer_vtag;
3823                 sctp_abort_notification(stcb, 0, SCTP_SO_NOT_LOCKED);
3824                 /* get the assoc vrf id and table id */
3825                 vrf_id = stcb->asoc.vrf_id;
3826                 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
3827         }
3828         sctp_send_abort(m, iphlen, sh, vtag, op_err, vrf_id, port);
3829         if (stcb != NULL) {
3830                 /* Ok, now lets free it */
3831 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3832                 so = SCTP_INP_SO(inp);
3833                 atomic_add_int(&stcb->asoc.refcnt, 1);
3834                 SCTP_TCB_UNLOCK(stcb);
3835                 SCTP_SOCKET_LOCK(so, 1);
3836                 SCTP_TCB_LOCK(stcb);
3837                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3838 #endif
3839                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_4);
3840 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3841                 SCTP_SOCKET_UNLOCK(so, 1);
3842 #endif
3843         }
3844 }
3845
3846 #ifdef SCTP_ASOCLOG_OF_TSNS
3847 void
3848 sctp_print_out_track_log(struct sctp_tcb *stcb)
3849 {
3850 #ifdef NOSIY_PRINTS
3851         int i;
3852
3853         SCTP_PRINTF("Last ep reason:%x\n", stcb->sctp_ep->last_abort_code);
3854         SCTP_PRINTF("IN bound TSN log-aaa\n");
3855         if ((stcb->asoc.tsn_in_at == 0) && (stcb->asoc.tsn_in_wrapped == 0)) {
3856                 SCTP_PRINTF("None rcvd\n");
3857                 goto none_in;
3858         }
3859         if (stcb->asoc.tsn_in_wrapped) {
3860                 for (i = stcb->asoc.tsn_in_at; i < SCTP_TSN_LOG_SIZE; i++) {
3861                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3862                             stcb->asoc.in_tsnlog[i].tsn,
3863                             stcb->asoc.in_tsnlog[i].strm,
3864                             stcb->asoc.in_tsnlog[i].seq,
3865                             stcb->asoc.in_tsnlog[i].flgs,
3866                             stcb->asoc.in_tsnlog[i].sz);
3867                 }
3868         }
3869         if (stcb->asoc.tsn_in_at) {
3870                 for (i = 0; i < stcb->asoc.tsn_in_at; i++) {
3871                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3872                             stcb->asoc.in_tsnlog[i].tsn,
3873                             stcb->asoc.in_tsnlog[i].strm,
3874                             stcb->asoc.in_tsnlog[i].seq,
3875                             stcb->asoc.in_tsnlog[i].flgs,
3876                             stcb->asoc.in_tsnlog[i].sz);
3877                 }
3878         }
3879 none_in:
3880         SCTP_PRINTF("OUT bound TSN log-aaa\n");
3881         if ((stcb->asoc.tsn_out_at == 0) &&
3882             (stcb->asoc.tsn_out_wrapped == 0)) {
3883                 SCTP_PRINTF("None sent\n");
3884         }
3885         if (stcb->asoc.tsn_out_wrapped) {
3886                 for (i = stcb->asoc.tsn_out_at; i < SCTP_TSN_LOG_SIZE; i++) {
3887                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3888                             stcb->asoc.out_tsnlog[i].tsn,
3889                             stcb->asoc.out_tsnlog[i].strm,
3890                             stcb->asoc.out_tsnlog[i].seq,
3891                             stcb->asoc.out_tsnlog[i].flgs,
3892                             stcb->asoc.out_tsnlog[i].sz);
3893                 }
3894         }
3895         if (stcb->asoc.tsn_out_at) {
3896                 for (i = 0; i < stcb->asoc.tsn_out_at; i++) {
3897                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3898                             stcb->asoc.out_tsnlog[i].tsn,
3899                             stcb->asoc.out_tsnlog[i].strm,
3900                             stcb->asoc.out_tsnlog[i].seq,
3901                             stcb->asoc.out_tsnlog[i].flgs,
3902                             stcb->asoc.out_tsnlog[i].sz);
3903                 }
3904         }
3905 #endif
3906 }
3907
3908 #endif
3909
3910 void
3911 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3912     int error, struct mbuf *op_err,
3913     int so_locked
3914 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3915     SCTP_UNUSED
3916 #endif
3917 )
3918 {
3919         uint32_t vtag;
3920
3921 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3922         struct socket *so;
3923
3924 #endif
3925
3926 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3927         so = SCTP_INP_SO(inp);
3928 #endif
3929         if (stcb == NULL) {
3930                 /* Got to have a TCB */
3931                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3932                         if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
3933                                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
3934                                     SCTP_CALLED_DIRECTLY_NOCMPSET);
3935                         }
3936                 }
3937                 return;
3938         } else {
3939                 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
3940         }
3941         vtag = stcb->asoc.peer_vtag;
3942         /* notify the ulp */
3943         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0)
3944                 sctp_abort_notification(stcb, error, so_locked);
3945         /* notify the peer */
3946 #if defined(SCTP_PANIC_ON_ABORT)
3947         panic("aborting an association");
3948 #endif
3949         sctp_send_abort_tcb(stcb, op_err, so_locked);
3950         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3951         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
3952             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3953                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3954         }
3955         /* now free the asoc */
3956 #ifdef SCTP_ASOCLOG_OF_TSNS
3957         sctp_print_out_track_log(stcb);
3958 #endif
3959 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3960         if (!so_locked) {
3961                 atomic_add_int(&stcb->asoc.refcnt, 1);
3962                 SCTP_TCB_UNLOCK(stcb);
3963                 SCTP_SOCKET_LOCK(so, 1);
3964                 SCTP_TCB_LOCK(stcb);
3965                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3966         }
3967 #endif
3968         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_5);
3969 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3970         if (!so_locked) {
3971                 SCTP_SOCKET_UNLOCK(so, 1);
3972         }
3973 #endif
3974 }
3975
3976 void
3977 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh,
3978     struct sctp_inpcb *inp, struct mbuf *op_err, uint32_t vrf_id, uint16_t port)
3979 {
3980         struct sctp_chunkhdr *ch, chunk_buf;
3981         unsigned int chk_length;
3982
3983         SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue);
3984         /* Generate a TO address for future reference */
3985         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
3986                 if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
3987                         sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
3988                             SCTP_CALLED_DIRECTLY_NOCMPSET);
3989                 }
3990         }
3991         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
3992             sizeof(*ch), (uint8_t *) & chunk_buf);
3993         while (ch != NULL) {
3994                 chk_length = ntohs(ch->chunk_length);
3995                 if (chk_length < sizeof(*ch)) {
3996                         /* break to abort land */
3997                         break;
3998                 }
3999                 switch (ch->chunk_type) {
4000                 case SCTP_COOKIE_ECHO:
4001                         /* We hit here only if the assoc is being freed */
4002                         return;
4003                 case SCTP_PACKET_DROPPED:
4004                         /* we don't respond to pkt-dropped */
4005                         return;
4006                 case SCTP_ABORT_ASSOCIATION:
4007                         /* we don't respond with an ABORT to an ABORT */
4008                         return;
4009                 case SCTP_SHUTDOWN_COMPLETE:
4010                         /*
4011                          * we ignore it since we are not waiting for it and
4012                          * peer is gone
4013                          */
4014                         return;
4015                 case SCTP_SHUTDOWN_ACK:
4016                         sctp_send_shutdown_complete2(m, iphlen, sh, vrf_id, port);
4017                         return;
4018                 default:
4019                         break;
4020                 }
4021                 offset += SCTP_SIZE32(chk_length);
4022                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4023                     sizeof(*ch), (uint8_t *) & chunk_buf);
4024         }
4025         sctp_send_abort(m, iphlen, sh, 0, op_err, vrf_id, port);
4026 }
4027
4028 /*
4029  * check the inbound datagram to make sure there is not an abort inside it,
4030  * if there is return 1, else return 0.
4031  */
4032 int
4033 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t * vtagfill)
4034 {
4035         struct sctp_chunkhdr *ch;
4036         struct sctp_init_chunk *init_chk, chunk_buf;
4037         int offset;
4038         unsigned int chk_length;
4039
4040         offset = iphlen + sizeof(struct sctphdr);
4041         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch),
4042             (uint8_t *) & chunk_buf);
4043         while (ch != NULL) {
4044                 chk_length = ntohs(ch->chunk_length);
4045                 if (chk_length < sizeof(*ch)) {
4046                         /* packet is probably corrupt */
4047                         break;
4048                 }
4049                 /* we seem to be ok, is it an abort? */
4050                 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) {
4051                         /* yep, tell them */
4052                         return (1);
4053                 }
4054                 if (ch->chunk_type == SCTP_INITIATION) {
4055                         /* need to update the Vtag */
4056                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
4057                             offset, sizeof(*init_chk), (uint8_t *) & chunk_buf);
4058                         if (init_chk != NULL) {
4059                                 *vtagfill = ntohl(init_chk->init.initiate_tag);
4060                         }
4061                 }
4062                 /* Nope, move to the next chunk */
4063                 offset += SCTP_SIZE32(chk_length);
4064                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4065                     sizeof(*ch), (uint8_t *) & chunk_buf);
4066         }
4067         return (0);
4068 }
4069
4070 /*
4071  * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id
4072  * set (i.e. it's 0) so, create this function to compare link local scopes
4073  */
4074 #ifdef INET6
4075 uint32_t
4076 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2)
4077 {
4078         struct sockaddr_in6 a, b;
4079
4080         /* save copies */
4081         a = *addr1;
4082         b = *addr2;
4083
4084         if (a.sin6_scope_id == 0)
4085                 if (sa6_recoverscope(&a)) {
4086                         /* can't get scope, so can't match */
4087                         return (0);
4088                 }
4089         if (b.sin6_scope_id == 0)
4090                 if (sa6_recoverscope(&b)) {
4091                         /* can't get scope, so can't match */
4092                         return (0);
4093                 }
4094         if (a.sin6_scope_id != b.sin6_scope_id)
4095                 return (0);
4096
4097         return (1);
4098 }
4099
4100 /*
4101  * returns a sockaddr_in6 with embedded scope recovered and removed
4102  */
4103 struct sockaddr_in6 *
4104 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store)
4105 {
4106         /* check and strip embedded scope junk */
4107         if (addr->sin6_family == AF_INET6) {
4108                 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) {
4109                         if (addr->sin6_scope_id == 0) {
4110                                 *store = *addr;
4111                                 if (!sa6_recoverscope(store)) {
4112                                         /* use the recovered scope */
4113                                         addr = store;
4114                                 }
4115                         } else {
4116                                 /* else, return the original "to" addr */
4117                                 in6_clearscope(&addr->sin6_addr);
4118                         }
4119                 }
4120         }
4121         return (addr);
4122 }
4123
4124 #endif
4125
4126 /*
4127  * are the two addresses the same?  currently a "scopeless" check returns: 1
4128  * if same, 0 if not
4129  */
4130 int
4131 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2)
4132 {
4133
4134         /* must be valid */
4135         if (sa1 == NULL || sa2 == NULL)
4136                 return (0);
4137
4138         /* must be the same family */
4139         if (sa1->sa_family != sa2->sa_family)
4140                 return (0);
4141
4142         switch (sa1->sa_family) {
4143 #ifdef INET6
4144         case AF_INET6:
4145                 {
4146                         /* IPv6 addresses */
4147                         struct sockaddr_in6 *sin6_1, *sin6_2;
4148
4149                         sin6_1 = (struct sockaddr_in6 *)sa1;
4150                         sin6_2 = (struct sockaddr_in6 *)sa2;
4151                         return (SCTP6_ARE_ADDR_EQUAL(sin6_1,
4152                             sin6_2));
4153                 }
4154 #endif
4155         case AF_INET:
4156                 {
4157                         /* IPv4 addresses */
4158                         struct sockaddr_in *sin_1, *sin_2;
4159
4160                         sin_1 = (struct sockaddr_in *)sa1;
4161                         sin_2 = (struct sockaddr_in *)sa2;
4162                         return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr);
4163                 }
4164         default:
4165                 /* we don't do these... */
4166                 return (0);
4167         }
4168 }
4169
4170 void
4171 sctp_print_address(struct sockaddr *sa)
4172 {
4173 #ifdef INET6
4174         char ip6buf[INET6_ADDRSTRLEN];
4175
4176         ip6buf[0] = 0;
4177 #endif
4178
4179         switch (sa->sa_family) {
4180 #ifdef INET6
4181         case AF_INET6:
4182                 {
4183                         struct sockaddr_in6 *sin6;
4184
4185                         sin6 = (struct sockaddr_in6 *)sa;
4186                         SCTP_PRINTF("IPv6 address: %s:port:%d scope:%u\n",
4187                             ip6_sprintf(ip6buf, &sin6->sin6_addr),
4188                             ntohs(sin6->sin6_port),
4189                             sin6->sin6_scope_id);
4190                         break;
4191                 }
4192 #endif
4193         case AF_INET:
4194                 {
4195                         struct sockaddr_in *sin;
4196                         unsigned char *p;
4197
4198                         sin = (struct sockaddr_in *)sa;
4199                         p = (unsigned char *)&sin->sin_addr;
4200                         SCTP_PRINTF("IPv4 address: %u.%u.%u.%u:%d\n",
4201                             p[0], p[1], p[2], p[3], ntohs(sin->sin_port));
4202                         break;
4203                 }
4204         default:
4205                 SCTP_PRINTF("?\n");
4206                 break;
4207         }
4208 }
4209
4210 void
4211 sctp_print_address_pkt(struct ip *iph, struct sctphdr *sh)
4212 {
4213         switch (iph->ip_v) {
4214         case IPVERSION:
4215                 {
4216                         struct sockaddr_in lsa, fsa;
4217
4218                         bzero(&lsa, sizeof(lsa));
4219                         lsa.sin_len = sizeof(lsa);
4220                         lsa.sin_family = AF_INET;
4221                         lsa.sin_addr = iph->ip_src;
4222                         lsa.sin_port = sh->src_port;
4223                         bzero(&fsa, sizeof(fsa));
4224                         fsa.sin_len = sizeof(fsa);
4225                         fsa.sin_family = AF_INET;
4226                         fsa.sin_addr = iph->ip_dst;
4227                         fsa.sin_port = sh->dest_port;
4228                         SCTP_PRINTF("src: ");
4229                         sctp_print_address((struct sockaddr *)&lsa);
4230                         SCTP_PRINTF("dest: ");
4231                         sctp_print_address((struct sockaddr *)&fsa);
4232                         break;
4233                 }
4234 #ifdef INET6
4235         case IPV6_VERSION >> 4:
4236                 {
4237                         struct ip6_hdr *ip6;
4238                         struct sockaddr_in6 lsa6, fsa6;
4239
4240                         ip6 = (struct ip6_hdr *)iph;
4241                         bzero(&lsa6, sizeof(lsa6));
4242                         lsa6.sin6_len = sizeof(lsa6);
4243                         lsa6.sin6_family = AF_INET6;
4244                         lsa6.sin6_addr = ip6->ip6_src;
4245                         lsa6.sin6_port = sh->src_port;
4246                         bzero(&fsa6, sizeof(fsa6));
4247                         fsa6.sin6_len = sizeof(fsa6);
4248                         fsa6.sin6_family = AF_INET6;
4249                         fsa6.sin6_addr = ip6->ip6_dst;
4250                         fsa6.sin6_port = sh->dest_port;
4251                         SCTP_PRINTF("src: ");
4252                         sctp_print_address((struct sockaddr *)&lsa6);
4253                         SCTP_PRINTF("dest: ");
4254                         sctp_print_address((struct sockaddr *)&fsa6);
4255                         break;
4256                 }
4257 #endif
4258         default:
4259                 /* TSNH */
4260                 break;
4261         }
4262 }
4263
4264 void
4265 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
4266     struct sctp_inpcb *new_inp,
4267     struct sctp_tcb *stcb,
4268     int waitflags)
4269 {
4270         /*
4271          * go through our old INP and pull off any control structures that
4272          * belong to stcb and move then to the new inp.
4273          */
4274         struct socket *old_so, *new_so;
4275         struct sctp_queued_to_read *control, *nctl;
4276         struct sctp_readhead tmp_queue;
4277         struct mbuf *m;
4278         int error = 0;
4279
4280         old_so = old_inp->sctp_socket;
4281         new_so = new_inp->sctp_socket;
4282         TAILQ_INIT(&tmp_queue);
4283         error = sblock(&old_so->so_rcv, waitflags);
4284         if (error) {
4285                 /*
4286                  * Gak, can't get sblock, we have a problem. data will be
4287                  * left stranded.. and we don't dare look at it since the
4288                  * other thread may be reading something. Oh well, its a
4289                  * screwed up app that does a peeloff OR a accept while
4290                  * reading from the main socket... actually its only the
4291                  * peeloff() case, since I think read will fail on a
4292                  * listening socket..
4293                  */
4294                 return;
4295         }
4296         /* lock the socket buffers */
4297         SCTP_INP_READ_LOCK(old_inp);
4298         control = TAILQ_FIRST(&old_inp->read_queue);
4299         /* Pull off all for out target stcb */
4300         while (control) {
4301                 nctl = TAILQ_NEXT(control, next);
4302                 if (control->stcb == stcb) {
4303                         /* remove it we want it */
4304                         TAILQ_REMOVE(&old_inp->read_queue, control, next);
4305                         TAILQ_INSERT_TAIL(&tmp_queue, control, next);
4306                         m = control->data;
4307                         while (m) {
4308                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4309                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
4310                                 }
4311                                 sctp_sbfree(control, stcb, &old_so->so_rcv, m);
4312                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4313                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4314                                 }
4315                                 m = SCTP_BUF_NEXT(m);
4316                         }
4317                 }
4318                 control = nctl;
4319         }
4320         SCTP_INP_READ_UNLOCK(old_inp);
4321         /* Remove the sb-lock on the old socket */
4322
4323         sbunlock(&old_so->so_rcv);
4324         /* Now we move them over to the new socket buffer */
4325         control = TAILQ_FIRST(&tmp_queue);
4326         SCTP_INP_READ_LOCK(new_inp);
4327         while (control) {
4328                 nctl = TAILQ_NEXT(control, next);
4329                 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next);
4330                 m = control->data;
4331                 while (m) {
4332                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4333                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4334                         }
4335                         sctp_sballoc(stcb, &new_so->so_rcv, m);
4336                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4337                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4338                         }
4339                         m = SCTP_BUF_NEXT(m);
4340                 }
4341                 control = nctl;
4342         }
4343         SCTP_INP_READ_UNLOCK(new_inp);
4344 }
4345
4346 void
4347 sctp_add_to_readq(struct sctp_inpcb *inp,
4348     struct sctp_tcb *stcb,
4349     struct sctp_queued_to_read *control,
4350     struct sockbuf *sb,
4351     int end,
4352     int inp_read_lock_held,
4353     int so_locked
4354 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4355     SCTP_UNUSED
4356 #endif
4357 )
4358 {
4359         /*
4360          * Here we must place the control on the end of the socket read
4361          * queue AND increment sb_cc so that select will work properly on
4362          * read.
4363          */
4364         struct mbuf *m, *prev = NULL;
4365
4366         if (inp == NULL) {
4367                 /* Gak, TSNH!! */
4368 #ifdef INVARIANTS
4369                 panic("Gak, inp NULL on add_to_readq");
4370 #endif
4371                 return;
4372         }
4373         if (inp_read_lock_held == 0)
4374                 SCTP_INP_READ_LOCK(inp);
4375         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
4376                 sctp_free_remote_addr(control->whoFrom);
4377                 if (control->data) {
4378                         sctp_m_freem(control->data);
4379                         control->data = NULL;
4380                 }
4381                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_readq), control);
4382                 if (inp_read_lock_held == 0)
4383                         SCTP_INP_READ_UNLOCK(inp);
4384                 return;
4385         }
4386         if (!(control->spec_flags & M_NOTIFICATION)) {
4387                 atomic_add_int(&inp->total_recvs, 1);
4388                 if (!control->do_not_ref_stcb) {
4389                         atomic_add_int(&stcb->total_recvs, 1);
4390                 }
4391         }
4392         m = control->data;
4393         control->held_length = 0;
4394         control->length = 0;
4395         while (m) {
4396                 if (SCTP_BUF_LEN(m) == 0) {
4397                         /* Skip mbufs with NO length */
4398                         if (prev == NULL) {
4399                                 /* First one */
4400                                 control->data = sctp_m_free(m);
4401                                 m = control->data;
4402                         } else {
4403                                 SCTP_BUF_NEXT(prev) = sctp_m_free(m);
4404                                 m = SCTP_BUF_NEXT(prev);
4405                         }
4406                         if (m == NULL) {
4407                                 control->tail_mbuf = prev;
4408                         }
4409                         continue;
4410                 }
4411                 prev = m;
4412                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4413                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4414                 }
4415                 sctp_sballoc(stcb, sb, m);
4416                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4417                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4418                 }
4419                 atomic_add_int(&control->length, SCTP_BUF_LEN(m));
4420                 m = SCTP_BUF_NEXT(m);
4421         }
4422         if (prev != NULL) {
4423                 control->tail_mbuf = prev;
4424         } else {
4425                 /* Everything got collapsed out?? */
4426                 sctp_free_remote_addr(control->whoFrom);
4427                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_readq), control);
4428                 if (inp_read_lock_held == 0)
4429                         SCTP_INP_READ_UNLOCK(inp);
4430                 return;
4431         }
4432         if (end) {
4433                 control->end_added = 1;
4434         }
4435         TAILQ_INSERT_TAIL(&inp->read_queue, control, next);
4436         if (inp_read_lock_held == 0)
4437                 SCTP_INP_READ_UNLOCK(inp);
4438         if (inp && inp->sctp_socket) {
4439                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
4440                         SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket);
4441                 } else {
4442 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4443                         struct socket *so;
4444
4445                         so = SCTP_INP_SO(inp);
4446                         if (!so_locked) {
4447                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4448                                 SCTP_TCB_UNLOCK(stcb);
4449                                 SCTP_SOCKET_LOCK(so, 1);
4450                                 SCTP_TCB_LOCK(stcb);
4451                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4452                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4453                                         SCTP_SOCKET_UNLOCK(so, 1);
4454                                         return;
4455                                 }
4456                         }
4457 #endif
4458                         sctp_sorwakeup(inp, inp->sctp_socket);
4459 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4460                         if (!so_locked) {
4461                                 SCTP_SOCKET_UNLOCK(so, 1);
4462                         }
4463 #endif
4464                 }
4465         }
4466 }
4467
4468
4469 int
4470 sctp_append_to_readq(struct sctp_inpcb *inp,
4471     struct sctp_tcb *stcb,
4472     struct sctp_queued_to_read *control,
4473     struct mbuf *m,
4474     int end,
4475     int ctls_cumack,
4476     struct sockbuf *sb)
4477 {
4478         /*
4479          * A partial delivery API event is underway. OR we are appending on
4480          * the reassembly queue.
4481          *
4482          * If PDAPI this means we need to add m to the end of the data.
4483          * Increase the length in the control AND increment the sb_cc.
4484          * Otherwise sb is NULL and all we need to do is put it at the end
4485          * of the mbuf chain.
4486          */
4487         int len = 0;
4488         struct mbuf *mm, *tail = NULL, *prev = NULL;
4489
4490         if (inp) {
4491                 SCTP_INP_READ_LOCK(inp);
4492         }
4493         if (control == NULL) {
4494 get_out:
4495                 if (inp) {
4496                         SCTP_INP_READ_UNLOCK(inp);
4497                 }
4498                 return (-1);
4499         }
4500         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ)) {
4501                 SCTP_INP_READ_UNLOCK(inp);
4502                 return 0;
4503         }
4504         if (control->end_added) {
4505                 /* huh this one is complete? */
4506                 goto get_out;
4507         }
4508         mm = m;
4509         if (mm == NULL) {
4510                 goto get_out;
4511         }
4512         while (mm) {
4513                 if (SCTP_BUF_LEN(mm) == 0) {
4514                         /* Skip mbufs with NO lenght */
4515                         if (prev == NULL) {
4516                                 /* First one */
4517                                 m = sctp_m_free(mm);
4518                                 mm = m;
4519                         } else {
4520                                 SCTP_BUF_NEXT(prev) = sctp_m_free(mm);
4521                                 mm = SCTP_BUF_NEXT(prev);
4522                         }
4523                         continue;
4524                 }
4525                 prev = mm;
4526                 len += SCTP_BUF_LEN(mm);
4527                 if (sb) {
4528                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4529                                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(mm));
4530                         }
4531                         sctp_sballoc(stcb, sb, mm);
4532                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4533                                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4534                         }
4535                 }
4536                 mm = SCTP_BUF_NEXT(mm);
4537         }
4538         if (prev) {
4539                 tail = prev;
4540         } else {
4541                 /* Really there should always be a prev */
4542                 if (m == NULL) {
4543                         /* Huh nothing left? */
4544 #ifdef INVARIANTS
4545                         panic("Nothing left to add?");
4546 #else
4547                         goto get_out;
4548 #endif
4549                 }
4550                 tail = m;
4551         }
4552         if (control->tail_mbuf) {
4553                 /* append */
4554                 SCTP_BUF_NEXT(control->tail_mbuf) = m;
4555                 control->tail_mbuf = tail;
4556         } else {
4557                 /* nothing there */
4558 #ifdef INVARIANTS
4559                 if (control->data != NULL) {
4560                         panic("This should NOT happen");
4561                 }
4562 #endif
4563                 control->data = m;
4564                 control->tail_mbuf = tail;
4565         }
4566         atomic_add_int(&control->length, len);
4567         if (end) {
4568                 /* message is complete */
4569                 if (stcb && (control == stcb->asoc.control_pdapi)) {
4570                         stcb->asoc.control_pdapi = NULL;
4571                 }
4572                 control->held_length = 0;
4573                 control->end_added = 1;
4574         }
4575         if (stcb == NULL) {
4576                 control->do_not_ref_stcb = 1;
4577         }
4578         /*
4579          * When we are appending in partial delivery, the cum-ack is used
4580          * for the actual pd-api highest tsn on this mbuf. The true cum-ack
4581          * is populated in the outbound sinfo structure from the true cumack
4582          * if the association exists...
4583          */
4584         control->sinfo_tsn = control->sinfo_cumtsn = ctls_cumack;
4585         if (inp) {
4586                 SCTP_INP_READ_UNLOCK(inp);
4587         }
4588         if (inp && inp->sctp_socket) {
4589                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
4590                         SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket);
4591                 } else {
4592 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4593                         struct socket *so;
4594
4595                         so = SCTP_INP_SO(inp);
4596                         atomic_add_int(&stcb->asoc.refcnt, 1);
4597                         SCTP_TCB_UNLOCK(stcb);
4598                         SCTP_SOCKET_LOCK(so, 1);
4599                         SCTP_TCB_LOCK(stcb);
4600                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
4601                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4602                                 SCTP_SOCKET_UNLOCK(so, 1);
4603                                 return (0);
4604                         }
4605 #endif
4606                         sctp_sorwakeup(inp, inp->sctp_socket);
4607 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4608                         SCTP_SOCKET_UNLOCK(so, 1);
4609 #endif
4610                 }
4611         }
4612         return (0);
4613 }
4614
4615
4616
4617 /*************HOLD THIS COMMENT FOR PATCH FILE OF
4618  *************ALTERNATE ROUTING CODE
4619  */
4620
4621 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF
4622  *************ALTERNATE ROUTING CODE
4623  */
4624
4625 struct mbuf *
4626 sctp_generate_invmanparam(int err)
4627 {
4628         /* Return a MBUF with a invalid mandatory parameter */
4629         struct mbuf *m;
4630
4631         m = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_DONTWAIT, 1, MT_DATA);
4632         if (m) {
4633                 struct sctp_paramhdr *ph;
4634
4635                 SCTP_BUF_LEN(m) = sizeof(struct sctp_paramhdr);
4636                 ph = mtod(m, struct sctp_paramhdr *);
4637                 ph->param_length = htons(sizeof(struct sctp_paramhdr));
4638                 ph->param_type = htons(err);
4639         }
4640         return (m);
4641 }
4642
4643 #ifdef SCTP_MBCNT_LOGGING
4644 void
4645 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc,
4646     struct sctp_tmit_chunk *tp1, int chk_cnt)
4647 {
4648         if (tp1->data == NULL) {
4649                 return;
4650         }
4651         asoc->chunks_on_out_queue -= chk_cnt;
4652         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBCNT_LOGGING_ENABLE) {
4653                 sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE,
4654                     asoc->total_output_queue_size,
4655                     tp1->book_size,
4656                     0,
4657                     tp1->mbcnt);
4658         }
4659         if (asoc->total_output_queue_size >= tp1->book_size) {
4660                 atomic_add_int(&asoc->total_output_queue_size, -tp1->book_size);
4661         } else {
4662                 asoc->total_output_queue_size = 0;
4663         }
4664
4665         if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) ||
4666             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) {
4667                 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) {
4668                         stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size;
4669                 } else {
4670                         stcb->sctp_socket->so_snd.sb_cc = 0;
4671
4672                 }
4673         }
4674 }
4675
4676 #endif
4677
4678 int
4679 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1,
4680     int reason, int so_locked
4681 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4682     SCTP_UNUSED
4683 #endif
4684 )
4685 {
4686         struct sctp_stream_out *strq;
4687         struct sctp_tmit_chunk *chk = NULL;
4688         struct sctp_stream_queue_pending *sp;
4689         uint16_t stream = 0, seq = 0;
4690         uint8_t foundeom = 0;
4691         int ret_sz = 0;
4692         int notdone;
4693         int do_wakeup_routine = 0;
4694
4695         stream = tp1->rec.data.stream_number;
4696         seq = tp1->rec.data.stream_seq;
4697         do {
4698                 ret_sz += tp1->book_size;
4699                 if (tp1->data != NULL) {
4700                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4701                                 sctp_flight_size_decrease(tp1);
4702                                 sctp_total_flight_decrease(stcb, tp1);
4703                         }
4704                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4705                         stcb->asoc.peers_rwnd += tp1->send_size;
4706                         stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh);
4707                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, reason, tp1, so_locked);
4708                         if (tp1->data) {
4709                                 sctp_m_freem(tp1->data);
4710                                 tp1->data = NULL;
4711                         }
4712                         do_wakeup_routine = 1;
4713                         if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
4714                                 stcb->asoc.sent_queue_cnt_removeable--;
4715                         }
4716                 }
4717                 tp1->sent = SCTP_FORWARD_TSN_SKIP;
4718                 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
4719                     SCTP_DATA_NOT_FRAG) {
4720                         /* not frag'ed we ae done   */
4721                         notdone = 0;
4722                         foundeom = 1;
4723                 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4724                         /* end of frag, we are done */
4725                         notdone = 0;
4726                         foundeom = 1;
4727                 } else {
4728                         /*
4729                          * Its a begin or middle piece, we must mark all of
4730                          * it
4731                          */
4732                         notdone = 1;
4733                         tp1 = TAILQ_NEXT(tp1, sctp_next);
4734                 }
4735         } while (tp1 && notdone);
4736         if (foundeom == 0) {
4737                 /*
4738                  * The multi-part message was scattered across the send and
4739                  * sent queue.
4740                  */
4741 next_on_sent:
4742                 tp1 = TAILQ_FIRST(&stcb->asoc.send_queue);
4743                 /*
4744                  * recurse throught the send_queue too, starting at the
4745                  * beginning.
4746                  */
4747                 if ((tp1) &&
4748                     (tp1->rec.data.stream_number == stream) &&
4749                     (tp1->rec.data.stream_seq == seq)) {
4750                         /*
4751                          * save to chk in case we have some on stream out
4752                          * queue. If so and we have an un-transmitted one we
4753                          * don't have to fudge the TSN.
4754                          */
4755                         chk = tp1;
4756                         ret_sz += tp1->book_size;
4757                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4758                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, reason, tp1, so_locked);
4759                         if (tp1->data) {
4760                                 sctp_m_freem(tp1->data);
4761                                 tp1->data = NULL;
4762                         }
4763                         /* No flight involved here book the size to 0 */
4764                         tp1->book_size = 0;
4765                         if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4766                                 foundeom = 1;
4767                         }
4768                         do_wakeup_routine = 1;
4769                         tp1->sent = SCTP_FORWARD_TSN_SKIP;
4770                         TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next);
4771                         /*
4772                          * on to the sent queue so we can wait for it to be
4773                          * passed by.
4774                          */
4775                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1,
4776                             sctp_next);
4777                         stcb->asoc.send_queue_cnt--;
4778                         stcb->asoc.sent_queue_cnt++;
4779                         goto next_on_sent;
4780                 }
4781         }
4782         if (foundeom == 0) {
4783                 /*
4784                  * Still no eom found. That means there is stuff left on the
4785                  * stream out queue.. yuck.
4786                  */
4787                 strq = &stcb->asoc.strmout[stream];
4788                 SCTP_TCB_SEND_LOCK(stcb);
4789                 sp = TAILQ_FIRST(&strq->outqueue);
4790                 while (sp->strseq <= seq) {
4791                         /* Check if its our SEQ */
4792                         if (sp->strseq == seq) {
4793                                 sp->discard_rest = 1;
4794                                 /*
4795                                  * We may need to put a chunk on the queue
4796                                  * that holds the TSN that would have been
4797                                  * sent with the LAST bit.
4798                                  */
4799                                 if (chk == NULL) {
4800                                         /* Yep, we have to */
4801                                         sctp_alloc_a_chunk(stcb, chk);
4802                                         if (chk == NULL) {
4803                                                 /*
4804                                                  * we are hosed. All we can
4805                                                  * do is nothing.. which
4806                                                  * will cause an abort if
4807                                                  * the peer is paying
4808                                                  * attention.
4809                                                  */
4810                                                 goto oh_well;
4811                                         }
4812                                         memset(chk, 0, sizeof(*chk));
4813                                         chk->rec.data.rcv_flags = SCTP_DATA_LAST_FRAG;
4814                                         chk->sent = SCTP_FORWARD_TSN_SKIP;
4815                                         chk->asoc = &stcb->asoc;
4816                                         chk->rec.data.stream_seq = sp->strseq;
4817                                         chk->rec.data.stream_number = sp->stream;
4818                                         chk->rec.data.payloadtype = sp->ppid;
4819                                         chk->rec.data.context = sp->context;
4820                                         chk->flags = sp->act_flags;
4821                                         if (sp->net)
4822                                                 chk->whoTo = sp->net;
4823                                         else
4824                                                 chk->whoTo = stcb->asoc.primary_destination;
4825                                         atomic_add_int(&chk->whoTo->ref_count, 1);
4826                                         chk->rec.data.TSN_seq = atomic_fetchadd_int(&stcb->asoc.sending_seq, 1);
4827                                         stcb->asoc.pr_sctp_cnt++;
4828                                         chk->pr_sctp_on = 1;
4829                                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, chk, sctp_next);
4830                                         stcb->asoc.sent_queue_cnt++;
4831                                         stcb->asoc.pr_sctp_cnt++;
4832                                 } else {
4833                                         chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
4834                                 }
4835                 oh_well:
4836                                 if (sp->data) {
4837                                         /*
4838                                          * Pull any data to free up the SB
4839                                          * and allow sender to "add more"
4840                                          * whilc we will throw away :-)
4841                                          */
4842                                         sctp_free_spbufspace(stcb, &stcb->asoc,
4843                                             sp);
4844                                         ret_sz += sp->length;
4845                                         do_wakeup_routine = 1;
4846                                         sp->some_taken = 1;
4847                                         sctp_m_freem(sp->data);
4848                                         sp->length = 0;
4849                                         sp->data = NULL;
4850                                         sp->tail_mbuf = NULL;
4851                                 }
4852                                 break;
4853                         } else {
4854                                 /* Next one please */
4855                                 sp = TAILQ_NEXT(sp, next);
4856                         }
4857                 }               /* End while */
4858                 SCTP_TCB_SEND_UNLOCK(stcb);
4859         }
4860         if (do_wakeup_routine) {
4861 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4862                 struct socket *so;
4863
4864                 so = SCTP_INP_SO(stcb->sctp_ep);
4865                 if (!so_locked) {
4866                         atomic_add_int(&stcb->asoc.refcnt, 1);
4867                         SCTP_TCB_UNLOCK(stcb);
4868                         SCTP_SOCKET_LOCK(so, 1);
4869                         SCTP_TCB_LOCK(stcb);
4870                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
4871                         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
4872                                 /* assoc was freed while we were unlocked */
4873                                 SCTP_SOCKET_UNLOCK(so, 1);
4874                                 return (ret_sz);
4875                         }
4876                 }
4877 #endif
4878                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
4879 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4880                 if (!so_locked) {
4881                         SCTP_SOCKET_UNLOCK(so, 1);
4882                 }
4883 #endif
4884         }
4885         return (ret_sz);
4886 }
4887
4888 /*
4889  * checks to see if the given address, sa, is one that is currently known by
4890  * the kernel note: can't distinguish the same address on multiple interfaces
4891  * and doesn't handle multiple addresses with different zone/scope id's note:
4892  * ifa_ifwithaddr() compares the entire sockaddr struct
4893  */
4894 struct sctp_ifa *
4895 sctp_find_ifa_in_ep(struct sctp_inpcb *inp, struct sockaddr *addr,
4896     int holds_lock)
4897 {
4898         struct sctp_laddr *laddr;
4899
4900         if (holds_lock == 0) {
4901                 SCTP_INP_RLOCK(inp);
4902         }
4903         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
4904                 if (laddr->ifa == NULL)
4905                         continue;
4906                 if (addr->sa_family != laddr->ifa->address.sa.sa_family)
4907                         continue;
4908                 if (addr->sa_family == AF_INET) {
4909                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
4910                             laddr->ifa->address.sin.sin_addr.s_addr) {
4911                                 /* found him. */
4912                                 if (holds_lock == 0) {
4913                                         SCTP_INP_RUNLOCK(inp);
4914                                 }
4915                                 return (laddr->ifa);
4916                                 break;
4917                         }
4918                 }
4919 #ifdef INET6
4920                 if (addr->sa_family == AF_INET6) {
4921                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
4922                             &laddr->ifa->address.sin6)) {
4923                                 /* found him. */
4924                                 if (holds_lock == 0) {
4925                                         SCTP_INP_RUNLOCK(inp);
4926                                 }
4927                                 return (laddr->ifa);
4928                                 break;
4929                         }
4930                 }
4931 #endif
4932         }
4933         if (holds_lock == 0) {
4934                 SCTP_INP_RUNLOCK(inp);
4935         }
4936         return (NULL);
4937 }
4938
4939 uint32_t
4940 sctp_get_ifa_hash_val(struct sockaddr *addr)
4941 {
4942         if (addr->sa_family == AF_INET) {
4943                 struct sockaddr_in *sin;
4944
4945                 sin = (struct sockaddr_in *)addr;
4946                 return (sin->sin_addr.s_addr ^ (sin->sin_addr.s_addr >> 16));
4947         } else if (addr->sa_family == AF_INET6) {
4948                 struct sockaddr_in6 *sin6;
4949                 uint32_t hash_of_addr;
4950
4951                 sin6 = (struct sockaddr_in6 *)addr;
4952                 hash_of_addr = (sin6->sin6_addr.s6_addr32[0] +
4953                     sin6->sin6_addr.s6_addr32[1] +
4954                     sin6->sin6_addr.s6_addr32[2] +
4955                     sin6->sin6_addr.s6_addr32[3]);
4956                 hash_of_addr = (hash_of_addr ^ (hash_of_addr >> 16));
4957                 return (hash_of_addr);
4958         }
4959         return (0);
4960 }
4961
4962 struct sctp_ifa *
4963 sctp_find_ifa_by_addr(struct sockaddr *addr, uint32_t vrf_id, int holds_lock)
4964 {
4965         struct sctp_ifa *sctp_ifap;
4966         struct sctp_vrf *vrf;
4967         struct sctp_ifalist *hash_head;
4968         uint32_t hash_of_addr;
4969
4970         if (holds_lock == 0)
4971                 SCTP_IPI_ADDR_RLOCK();
4972
4973         vrf = sctp_find_vrf(vrf_id);
4974         if (vrf == NULL) {
4975 stage_right:
4976                 if (holds_lock == 0)
4977                         SCTP_IPI_ADDR_RUNLOCK();
4978                 return (NULL);
4979         }
4980         hash_of_addr = sctp_get_ifa_hash_val(addr);
4981
4982         hash_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)];
4983         if (hash_head == NULL) {
4984                 SCTP_PRINTF("hash_of_addr:%x mask:%x table:%x - ",
4985                     hash_of_addr, (uint32_t) vrf->vrf_addr_hashmark,
4986                     (uint32_t) (hash_of_addr & vrf->vrf_addr_hashmark));
4987                 sctp_print_address(addr);
4988                 SCTP_PRINTF("No such bucket for address\n");
4989                 if (holds_lock == 0)
4990                         SCTP_IPI_ADDR_RUNLOCK();
4991
4992                 return (NULL);
4993         }
4994         LIST_FOREACH(sctp_ifap, hash_head, next_bucket) {
4995                 if (sctp_ifap == NULL) {
4996 #ifdef INVARIANTS
4997                         panic("Huh LIST_FOREACH corrupt");
4998                         goto stage_right;
4999 #else
5000                         SCTP_PRINTF("LIST corrupt of sctp_ifap's?\n");
5001                         goto stage_right;
5002 #endif
5003                 }
5004                 if (addr->sa_family != sctp_ifap->address.sa.sa_family)
5005                         continue;
5006                 if (addr->sa_family == AF_INET) {
5007                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
5008                             sctp_ifap->address.sin.sin_addr.s_addr) {
5009                                 /* found him. */
5010                                 if (holds_lock == 0)
5011                                         SCTP_IPI_ADDR_RUNLOCK();
5012                                 return (sctp_ifap);
5013                                 break;
5014                         }
5015                 }
5016 #ifdef INET6
5017                 if (addr->sa_family == AF_INET6) {
5018                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5019                             &sctp_ifap->address.sin6)) {
5020                                 /* found him. */
5021                                 if (holds_lock == 0)
5022                                         SCTP_IPI_ADDR_RUNLOCK();
5023                                 return (sctp_ifap);
5024                                 break;
5025                         }
5026                 }
5027 #endif
5028         }
5029         if (holds_lock == 0)
5030                 SCTP_IPI_ADDR_RUNLOCK();
5031         return (NULL);
5032 }
5033
5034 static void
5035 sctp_user_rcvd(struct sctp_tcb *stcb, uint32_t * freed_so_far, int hold_rlock,
5036     uint32_t rwnd_req)
5037 {
5038         /* User pulled some data, do we need a rwnd update? */
5039         int r_unlocked = 0;
5040         uint32_t dif, rwnd;
5041         struct socket *so = NULL;
5042
5043         if (stcb == NULL)
5044                 return;
5045
5046         atomic_add_int(&stcb->asoc.refcnt, 1);
5047
5048         if (stcb->asoc.state & (SCTP_STATE_ABOUT_TO_BE_FREED |
5049             SCTP_STATE_SHUTDOWN_RECEIVED |
5050             SCTP_STATE_SHUTDOWN_ACK_SENT)) {
5051                 /* Pre-check If we are freeing no update */
5052                 goto no_lock;
5053         }
5054         SCTP_INP_INCR_REF(stcb->sctp_ep);
5055         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5056             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5057                 goto out;
5058         }
5059         so = stcb->sctp_socket;
5060         if (so == NULL) {
5061                 goto out;
5062         }
5063         atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far);
5064         /* Have you have freed enough to look */
5065         *freed_so_far = 0;
5066         /* Yep, its worth a look and the lock overhead */
5067
5068         /* Figure out what the rwnd would be */
5069         rwnd = sctp_calc_rwnd(stcb, &stcb->asoc);
5070         if (rwnd >= stcb->asoc.my_last_reported_rwnd) {
5071                 dif = rwnd - stcb->asoc.my_last_reported_rwnd;
5072         } else {
5073                 dif = 0;
5074         }
5075         if (dif >= rwnd_req) {
5076                 if (hold_rlock) {
5077                         SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5078                         r_unlocked = 1;
5079                 }
5080                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5081                         /*
5082                          * One last check before we allow the guy possibly
5083                          * to get in. There is a race, where the guy has not
5084                          * reached the gate. In that case
5085                          */
5086                         goto out;
5087                 }
5088                 SCTP_TCB_LOCK(stcb);
5089                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5090                         /* No reports here */
5091                         SCTP_TCB_UNLOCK(stcb);
5092                         goto out;
5093                 }
5094                 SCTP_STAT_INCR(sctps_wu_sacks_sent);
5095                 sctp_send_sack(stcb);
5096
5097                 sctp_chunk_output(stcb->sctp_ep, stcb,
5098                     SCTP_OUTPUT_FROM_USR_RCVD, SCTP_SO_LOCKED);
5099                 /* make sure no timer is running */
5100                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_6);
5101                 SCTP_TCB_UNLOCK(stcb);
5102         } else {
5103                 /* Update how much we have pending */
5104                 stcb->freed_by_sorcv_sincelast = dif;
5105         }
5106 out:
5107         if (so && r_unlocked && hold_rlock) {
5108                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
5109         }
5110         SCTP_INP_DECR_REF(stcb->sctp_ep);
5111 no_lock:
5112         atomic_add_int(&stcb->asoc.refcnt, -1);
5113         return;
5114 }
5115
5116 int
5117 sctp_sorecvmsg(struct socket *so,
5118     struct uio *uio,
5119     struct mbuf **mp,
5120     struct sockaddr *from,
5121     int fromlen,
5122     int *msg_flags,
5123     struct sctp_sndrcvinfo *sinfo,
5124     int filling_sinfo)
5125 {
5126         /*
5127          * MSG flags we will look at MSG_DONTWAIT - non-blocking IO.
5128          * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy
5129          * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ??
5130          * On the way out we may send out any combination of:
5131          * MSG_NOTIFICATION MSG_EOR
5132          *
5133          */
5134         struct sctp_inpcb *inp = NULL;
5135         int my_len = 0;
5136         int cp_len = 0, error = 0;
5137         struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
5138         struct mbuf *m = NULL, *embuf = NULL;
5139         struct sctp_tcb *stcb = NULL;
5140         int wakeup_read_socket = 0;
5141         int freecnt_applied = 0;
5142         int out_flags = 0, in_flags = 0;
5143         int block_allowed = 1;
5144         uint32_t freed_so_far = 0;
5145         uint32_t copied_so_far = 0;
5146         int in_eeor_mode = 0;
5147         int no_rcv_needed = 0;
5148         uint32_t rwnd_req = 0;
5149         int hold_sblock = 0;
5150         int hold_rlock = 0;
5151         int slen = 0;
5152         uint32_t held_length = 0;
5153         int sockbuf_lock = 0;
5154
5155         if (uio == NULL) {
5156                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5157                 return (EINVAL);
5158         }
5159         if (msg_flags) {
5160                 in_flags = *msg_flags;
5161                 if (in_flags & MSG_PEEK)
5162                         SCTP_STAT_INCR(sctps_read_peeks);
5163         } else {
5164                 in_flags = 0;
5165         }
5166         slen = uio->uio_resid;
5167
5168         /* Pull in and set up our int flags */
5169         if (in_flags & MSG_OOB) {
5170                 /* Out of band's NOT supported */
5171                 return (EOPNOTSUPP);
5172         }
5173         if ((in_flags & MSG_PEEK) && (mp != NULL)) {
5174                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5175                 return (EINVAL);
5176         }
5177         if ((in_flags & (MSG_DONTWAIT
5178             | MSG_NBIO
5179             )) ||
5180             SCTP_SO_IS_NBIO(so)) {
5181                 block_allowed = 0;
5182         }
5183         /* setup the endpoint */
5184         inp = (struct sctp_inpcb *)so->so_pcb;
5185         if (inp == NULL) {
5186                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
5187                 return (EFAULT);
5188         }
5189         rwnd_req = (SCTP_SB_LIMIT_RCV(so) >> SCTP_RWND_HIWAT_SHIFT);
5190         /* Must be at least a MTU's worth */
5191         if (rwnd_req < SCTP_MIN_RWND)
5192                 rwnd_req = SCTP_MIN_RWND;
5193         in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
5194         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5195                 sctp_misc_ints(SCTP_SORECV_ENTER,
5196                     rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, uio->uio_resid);
5197         }
5198         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5199                 sctp_misc_ints(SCTP_SORECV_ENTERPL,
5200                     rwnd_req, block_allowed, so->so_rcv.sb_cc, uio->uio_resid);
5201         }
5202         error = sblock(&so->so_rcv, (block_allowed ? SBL_WAIT : 0));
5203         sockbuf_lock = 1;
5204         if (error) {
5205                 goto release_unlocked;
5206         }
5207 restart:
5208
5209
5210 restart_nosblocks:
5211         if (hold_sblock == 0) {
5212                 SOCKBUF_LOCK(&so->so_rcv);
5213                 hold_sblock = 1;
5214         }
5215         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5216             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5217                 goto out;
5218         }
5219         if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
5220                 if (so->so_error) {
5221                         error = so->so_error;
5222                         if ((in_flags & MSG_PEEK) == 0)
5223                                 so->so_error = 0;
5224                         goto out;
5225                 } else {
5226                         if (so->so_rcv.sb_cc == 0) {
5227                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5228                                 /* indicate EOF */
5229                                 error = 0;
5230                                 goto out;
5231                         }
5232                 }
5233         }
5234         if ((so->so_rcv.sb_cc <= held_length) && block_allowed) {
5235                 /* we need to wait for data */
5236                 if ((so->so_rcv.sb_cc == 0) &&
5237                     ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5238                     (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) {
5239                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5240                                 /*
5241                                  * For active open side clear flags for
5242                                  * re-use passive open is blocked by
5243                                  * connect.
5244                                  */
5245                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5246                                         /*
5247                                          * You were aborted, passive side
5248                                          * always hits here
5249                                          */
5250                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5251                                         error = ECONNRESET;
5252                                         /*
5253                                          * You get this once if you are
5254                                          * active open side
5255                                          */
5256                                         if (!(inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
5257                                                 /*
5258                                                  * Remove flag if on the
5259                                                  * active open side
5260                                                  */
5261                                                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_WAS_ABORTED;
5262                                         }
5263                                 }
5264                                 so->so_state &= ~(SS_ISCONNECTING |
5265                                     SS_ISDISCONNECTING |
5266                                     SS_ISCONFIRMING |
5267                                     SS_ISCONNECTED);
5268                                 if (error == 0) {
5269                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5270                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5271                                                 error = ENOTCONN;
5272                                         } else {
5273                                                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_WAS_CONNECTED;
5274                                         }
5275                                 }
5276                                 goto out;
5277                         }
5278                 }
5279                 error = sbwait(&so->so_rcv);
5280                 if (error) {
5281                         goto out;
5282                 }
5283                 held_length = 0;
5284                 goto restart_nosblocks;
5285         } else if (so->so_rcv.sb_cc == 0) {
5286                 if (so->so_error) {
5287                         error = so->so_error;
5288                         if ((in_flags & MSG_PEEK) == 0)
5289                                 so->so_error = 0;
5290                 } else {
5291                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5292                             (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
5293                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5294                                         /*
5295                                          * For active open side clear flags
5296                                          * for re-use passive open is
5297                                          * blocked by connect.
5298                                          */
5299                                         if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5300                                                 /*
5301                                                  * You were aborted, passive
5302                                                  * side always hits here
5303                                                  */
5304                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5305                                                 error = ECONNRESET;
5306                                                 /*
5307                                                  * You get this once if you
5308                                                  * are active open side
5309                                                  */
5310                                                 if (!(inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
5311                                                         /*
5312                                                          * Remove flag if on
5313                                                          * the active open
5314                                                          * side
5315                                                          */
5316                                                         inp->sctp_flags &= ~SCTP_PCB_FLAGS_WAS_ABORTED;
5317                                                 }
5318                                         }
5319                                         so->so_state &= ~(SS_ISCONNECTING |
5320                                             SS_ISDISCONNECTING |
5321                                             SS_ISCONFIRMING |
5322                                             SS_ISCONNECTED);
5323                                         if (error == 0) {
5324                                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5325                                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5326                                                         error = ENOTCONN;
5327                                                 } else {
5328                                                         inp->sctp_flags &= ~SCTP_PCB_FLAGS_WAS_CONNECTED;
5329                                                 }
5330                                         }
5331                                         goto out;
5332                                 }
5333                         }
5334                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EWOULDBLOCK);
5335                         error = EWOULDBLOCK;
5336                 }
5337                 goto out;
5338         }
5339         if (hold_sblock == 1) {
5340                 SOCKBUF_UNLOCK(&so->so_rcv);
5341                 hold_sblock = 0;
5342         }
5343         /* we possibly have data we can read */
5344         /* sa_ignore FREED_MEMORY */
5345         control = TAILQ_FIRST(&inp->read_queue);
5346         if (control == NULL) {
5347                 /*
5348                  * This could be happening since the appender did the
5349                  * increment but as not yet did the tailq insert onto the
5350                  * read_queue
5351                  */
5352                 if (hold_rlock == 0) {
5353                         SCTP_INP_READ_LOCK(inp);
5354                         hold_rlock = 1;
5355                 }
5356                 control = TAILQ_FIRST(&inp->read_queue);
5357                 if ((control == NULL) && (so->so_rcv.sb_cc != 0)) {
5358 #ifdef INVARIANTS
5359                         panic("Huh, its non zero and nothing on control?");
5360 #endif
5361                         so->so_rcv.sb_cc = 0;
5362                 }
5363                 SCTP_INP_READ_UNLOCK(inp);
5364                 hold_rlock = 0;
5365                 goto restart;
5366         }
5367         if ((control->length == 0) &&
5368             (control->do_not_ref_stcb)) {
5369                 /*
5370                  * Clean up code for freeing assoc that left behind a
5371                  * pdapi.. maybe a peer in EEOR that just closed after
5372                  * sending and never indicated a EOR.
5373                  */
5374                 if (hold_rlock == 0) {
5375                         hold_rlock = 1;
5376                         SCTP_INP_READ_LOCK(inp);
5377                 }
5378                 control->held_length = 0;
5379                 if (control->data) {
5380                         /* Hmm there is data here .. fix */
5381                         struct mbuf *m_tmp;
5382                         int cnt = 0;
5383
5384                         m_tmp = control->data;
5385                         while (m_tmp) {
5386                                 cnt += SCTP_BUF_LEN(m_tmp);
5387                                 if (SCTP_BUF_NEXT(m_tmp) == NULL) {
5388                                         control->tail_mbuf = m_tmp;
5389                                         control->end_added = 1;
5390                                 }
5391                                 m_tmp = SCTP_BUF_NEXT(m_tmp);
5392                         }
5393                         control->length = cnt;
5394                 } else {
5395                         /* remove it */
5396                         TAILQ_REMOVE(&inp->read_queue, control, next);
5397                         /* Add back any hiddend data */
5398                         sctp_free_remote_addr(control->whoFrom);
5399                         sctp_free_a_readq(stcb, control);
5400                 }
5401                 if (hold_rlock) {
5402                         hold_rlock = 0;
5403                         SCTP_INP_READ_UNLOCK(inp);
5404                 }
5405                 goto restart;
5406         }
5407         if ((control->length == 0) &&
5408             (control->end_added == 1)) {
5409                 /*
5410                  * Do we also need to check for (control->pdapi_aborted ==
5411                  * 1)?
5412                  */
5413                 if (hold_rlock == 0) {
5414                         hold_rlock = 1;
5415                         SCTP_INP_READ_LOCK(inp);
5416                 }
5417                 TAILQ_REMOVE(&inp->read_queue, control, next);
5418                 if (control->data) {
5419 #ifdef INVARIANTS
5420                         panic("control->data not null but control->length == 0");
5421 #else
5422                         SCTP_PRINTF("Strange, data left in the control buffer. Cleaning up.\n");
5423                         sctp_m_freem(control->data);
5424                         control->data = NULL;
5425 #endif
5426                 }
5427                 if (control->aux_data) {
5428                         sctp_m_free(control->aux_data);
5429                         control->aux_data = NULL;
5430                 }
5431                 sctp_free_remote_addr(control->whoFrom);
5432                 sctp_free_a_readq(stcb, control);
5433                 if (hold_rlock) {
5434                         hold_rlock = 0;
5435                         SCTP_INP_READ_UNLOCK(inp);
5436                 }
5437                 goto restart;
5438         }
5439         if (control->length == 0) {
5440                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) &&
5441                     (filling_sinfo)) {
5442                         /* find a more suitable one then this */
5443                         ctl = TAILQ_NEXT(control, next);
5444                         while (ctl) {
5445                                 if ((ctl->stcb != control->stcb) && (ctl->length) &&
5446                                     (ctl->some_taken ||
5447                                     (ctl->spec_flags & M_NOTIFICATION) ||
5448                                     ((ctl->do_not_ref_stcb == 0) &&
5449                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))
5450                                     ) {
5451                                         /*-
5452                                          * If we have a different TCB next, and there is data
5453                                          * present. If we have already taken some (pdapi), OR we can
5454                                          * ref the tcb and no delivery as started on this stream, we
5455                                          * take it. Note we allow a notification on a different
5456                                          * assoc to be delivered..
5457                                          */
5458                                         control = ctl;
5459                                         goto found_one;
5460                                 } else if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS)) &&
5461                                             (ctl->length) &&
5462                                             ((ctl->some_taken) ||
5463                                             ((ctl->do_not_ref_stcb == 0) &&
5464                                             ((ctl->spec_flags & M_NOTIFICATION) == 0) &&
5465                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))) {
5466                                         /*-
5467                                          * If we have the same tcb, and there is data present, and we
5468                                          * have the strm interleave feature present. Then if we have
5469                                          * taken some (pdapi) or we can refer to tht tcb AND we have
5470                                          * not started a delivery for this stream, we can take it.
5471                                          * Note we do NOT allow a notificaiton on the same assoc to
5472                                          * be delivered.
5473                                          */
5474                                         control = ctl;
5475                                         goto found_one;
5476                                 }
5477                                 ctl = TAILQ_NEXT(ctl, next);
5478                         }
5479                 }
5480                 /*
5481                  * if we reach here, not suitable replacement is available
5482                  * <or> fragment interleave is NOT on. So stuff the sb_cc
5483                  * into the our held count, and its time to sleep again.
5484                  */
5485                 held_length = so->so_rcv.sb_cc;
5486                 control->held_length = so->so_rcv.sb_cc;
5487                 goto restart;
5488         }
5489         /* Clear the held length since there is something to read */
5490         control->held_length = 0;
5491         if (hold_rlock) {
5492                 SCTP_INP_READ_UNLOCK(inp);
5493                 hold_rlock = 0;
5494         }
5495 found_one:
5496         /*
5497          * If we reach here, control has a some data for us to read off.
5498          * Note that stcb COULD be NULL.
5499          */
5500         control->some_taken++;
5501         if (hold_sblock) {
5502                 SOCKBUF_UNLOCK(&so->so_rcv);
5503                 hold_sblock = 0;
5504         }
5505         stcb = control->stcb;
5506         if (stcb) {
5507                 if ((control->do_not_ref_stcb == 0) &&
5508                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5509                         if (freecnt_applied == 0)
5510                                 stcb = NULL;
5511                 } else if (control->do_not_ref_stcb == 0) {
5512                         /* you can't free it on me please */
5513                         /*
5514                          * The lock on the socket buffer protects us so the
5515                          * free code will stop. But since we used the
5516                          * socketbuf lock and the sender uses the tcb_lock
5517                          * to increment, we need to use the atomic add to
5518                          * the refcnt
5519                          */
5520                         if (freecnt_applied) {
5521 #ifdef INVARIANTS
5522                                 panic("refcnt already incremented");
5523 #else
5524                                 printf("refcnt already incremented?\n");
5525 #endif
5526                         } else {
5527                                 atomic_add_int(&stcb->asoc.refcnt, 1);
5528                                 freecnt_applied = 1;
5529                         }
5530                         /*
5531                          * Setup to remember how much we have not yet told
5532                          * the peer our rwnd has opened up. Note we grab the
5533                          * value from the tcb from last time. Note too that
5534                          * sack sending clears this when a sack is sent,
5535                          * which is fine. Once we hit the rwnd_req, we then
5536                          * will go to the sctp_user_rcvd() that will not
5537                          * lock until it KNOWs it MUST send a WUP-SACK.
5538                          */
5539                         freed_so_far = stcb->freed_by_sorcv_sincelast;
5540                         stcb->freed_by_sorcv_sincelast = 0;
5541                 }
5542         }
5543         if (stcb &&
5544             ((control->spec_flags & M_NOTIFICATION) == 0) &&
5545             control->do_not_ref_stcb == 0) {
5546                 stcb->asoc.strmin[control->sinfo_stream].delivery_started = 1;
5547         }
5548         /* First lets get off the sinfo and sockaddr info */
5549         if ((sinfo) && filling_sinfo) {
5550                 memcpy(sinfo, control, sizeof(struct sctp_nonpad_sndrcvinfo));
5551                 nxt = TAILQ_NEXT(control, next);
5552                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO)) {
5553                         struct sctp_extrcvinfo *s_extra;
5554
5555                         s_extra = (struct sctp_extrcvinfo *)sinfo;
5556                         if ((nxt) &&
5557                             (nxt->length)) {
5558                                 s_extra->sreinfo_next_flags = SCTP_NEXT_MSG_AVAIL;
5559                                 if (nxt->sinfo_flags & SCTP_UNORDERED) {
5560                                         s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_IS_UNORDERED;
5561                                 }
5562                                 if (nxt->spec_flags & M_NOTIFICATION) {
5563                                         s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_IS_NOTIFICATION;
5564                                 }
5565                                 s_extra->sreinfo_next_aid = nxt->sinfo_assoc_id;
5566                                 s_extra->sreinfo_next_length = nxt->length;
5567                                 s_extra->sreinfo_next_ppid = nxt->sinfo_ppid;
5568                                 s_extra->sreinfo_next_stream = nxt->sinfo_stream;
5569                                 if (nxt->tail_mbuf != NULL) {
5570                                         if (nxt->end_added) {
5571                                                 s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_ISCOMPLETE;
5572                                         }
5573                                 }
5574                         } else {
5575                                 /*
5576                                  * we explicitly 0 this, since the memcpy
5577                                  * got some other things beyond the older
5578                                  * sinfo_ that is on the control's structure
5579                                  * :-D
5580                                  */
5581                                 nxt = NULL;
5582                                 s_extra->sreinfo_next_flags = SCTP_NO_NEXT_MSG;
5583                                 s_extra->sreinfo_next_aid = 0;
5584                                 s_extra->sreinfo_next_length = 0;
5585                                 s_extra->sreinfo_next_ppid = 0;
5586                                 s_extra->sreinfo_next_stream = 0;
5587                         }
5588                 }
5589                 /*
5590                  * update off the real current cum-ack, if we have an stcb.
5591                  */
5592                 if ((control->do_not_ref_stcb == 0) && stcb)
5593                         sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
5594                 /*
5595                  * mask off the high bits, we keep the actual chunk bits in
5596                  * there.
5597                  */
5598                 sinfo->sinfo_flags &= 0x00ff;
5599                 if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) {
5600                         sinfo->sinfo_flags |= SCTP_UNORDERED;
5601                 }
5602         }
5603 #ifdef SCTP_ASOCLOG_OF_TSNS
5604         {
5605                 int index, newindex;
5606                 struct sctp_pcbtsn_rlog *entry;
5607
5608                 do {
5609                         index = inp->readlog_index;
5610                         newindex = index + 1;
5611                         if (newindex >= SCTP_READ_LOG_SIZE) {
5612                                 newindex = 0;
5613                         }
5614                 } while (atomic_cmpset_int(&inp->readlog_index, index, newindex) == 0);
5615                 entry = &inp->readlog[index];
5616                 entry->vtag = control->sinfo_assoc_id;
5617                 entry->strm = control->sinfo_stream;
5618                 entry->seq = control->sinfo_ssn;
5619                 entry->sz = control->length;
5620                 entry->flgs = control->sinfo_flags;
5621         }
5622 #endif
5623         if (fromlen && from) {
5624                 struct sockaddr *to;
5625
5626 #ifdef INET
5627                 cp_len = min((size_t)fromlen, (size_t)control->whoFrom->ro._l_addr.sin.sin_len);
5628                 memcpy(from, &control->whoFrom->ro._l_addr, cp_len);
5629                 ((struct sockaddr_in *)from)->sin_port = control->port_from;
5630 #else
5631                 /* No AF_INET use AF_INET6 */
5632                 cp_len = min((size_t)fromlen, (size_t)control->whoFrom->ro._l_addr.sin6.sin6_len);
5633                 memcpy(from, &control->whoFrom->ro._l_addr, cp_len);
5634                 ((struct sockaddr_in6 *)from)->sin6_port = control->port_from;
5635 #endif
5636
5637                 to = from;
5638 #if defined(INET) && defined(INET6)
5639                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) &&
5640                     (to->sa_family == AF_INET) &&
5641                     ((size_t)fromlen >= sizeof(struct sockaddr_in6))) {
5642                         struct sockaddr_in *sin;
5643                         struct sockaddr_in6 sin6;
5644
5645                         sin = (struct sockaddr_in *)to;
5646                         bzero(&sin6, sizeof(sin6));
5647                         sin6.sin6_family = AF_INET6;
5648                         sin6.sin6_len = sizeof(struct sockaddr_in6);
5649                         sin6.sin6_addr.s6_addr32[2] = htonl(0xffff);
5650                         bcopy(&sin->sin_addr,
5651                             &sin6.sin6_addr.s6_addr32[3],
5652                             sizeof(sin6.sin6_addr.s6_addr32[3]));
5653                         sin6.sin6_port = sin->sin_port;
5654                         memcpy(from, (caddr_t)&sin6, sizeof(sin6));
5655                 }
5656 #endif
5657 #if defined(INET6)
5658                 {
5659                         struct sockaddr_in6 lsa6, *to6;
5660
5661                         to6 = (struct sockaddr_in6 *)to;
5662                         sctp_recover_scope_mac(to6, (&lsa6));
5663                 }
5664 #endif
5665         }
5666         /* now copy out what data we can */
5667         if (mp == NULL) {
5668                 /* copy out each mbuf in the chain up to length */
5669 get_more_data:
5670                 m = control->data;
5671                 while (m) {
5672                         /* Move out all we can */
5673                         cp_len = (int)uio->uio_resid;
5674                         my_len = (int)SCTP_BUF_LEN(m);
5675                         if (cp_len > my_len) {
5676                                 /* not enough in this buf */
5677                                 cp_len = my_len;
5678                         }
5679                         if (hold_rlock) {
5680                                 SCTP_INP_READ_UNLOCK(inp);
5681                                 hold_rlock = 0;
5682                         }
5683                         if (cp_len > 0)
5684                                 error = uiomove(mtod(m, char *), cp_len, uio);
5685                         /* re-read */
5686                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5687                                 goto release;
5688                         }
5689                         if ((control->do_not_ref_stcb == 0) && stcb &&
5690                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5691                                 no_rcv_needed = 1;
5692                         }
5693                         if (error) {
5694                                 /* error we are out of here */
5695                                 goto release;
5696                         }
5697                         if ((SCTP_BUF_NEXT(m) == NULL) &&
5698                             (cp_len >= SCTP_BUF_LEN(m)) &&
5699                             ((control->end_added == 0) ||
5700                             (control->end_added &&
5701                             (TAILQ_NEXT(control, next) == NULL)))
5702                             ) {
5703                                 SCTP_INP_READ_LOCK(inp);
5704                                 hold_rlock = 1;
5705                         }
5706                         if (cp_len == SCTP_BUF_LEN(m)) {
5707                                 if ((SCTP_BUF_NEXT(m) == NULL) &&
5708                                     (control->end_added)) {
5709                                         out_flags |= MSG_EOR;
5710                                         if ((control->do_not_ref_stcb == 0) &&
5711                                             (control->stcb != NULL) &&
5712                                             ((control->spec_flags & M_NOTIFICATION) == 0))
5713                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5714                                 }
5715                                 if (control->spec_flags & M_NOTIFICATION) {
5716                                         out_flags |= MSG_NOTIFICATION;
5717                                 }
5718                                 /* we ate up the mbuf */
5719                                 if (in_flags & MSG_PEEK) {
5720                                         /* just looking */
5721                                         m = SCTP_BUF_NEXT(m);
5722                                         copied_so_far += cp_len;
5723                                 } else {
5724                                         /* dispose of the mbuf */
5725                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5726                                                 sctp_sblog(&so->so_rcv,
5727                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
5728                                         }
5729                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
5730                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5731                                                 sctp_sblog(&so->so_rcv,
5732                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5733                                         }
5734                                         embuf = m;
5735                                         copied_so_far += cp_len;
5736                                         freed_so_far += cp_len;
5737                                         freed_so_far += MSIZE;
5738                                         atomic_subtract_int(&control->length, cp_len);
5739                                         control->data = sctp_m_free(m);
5740                                         m = control->data;
5741                                         /*
5742                                          * been through it all, must hold sb
5743                                          * lock ok to null tail
5744                                          */
5745                                         if (control->data == NULL) {
5746 #ifdef INVARIANTS
5747                                                 if ((control->end_added == 0) ||
5748                                                     (TAILQ_NEXT(control, next) == NULL)) {
5749                                                         /*
5750                                                          * If the end is not
5751                                                          * added, OR the
5752                                                          * next is NOT null
5753                                                          * we MUST have the
5754                                                          * lock.
5755                                                          */
5756                                                         if (mtx_owned(&inp->inp_rdata_mtx) == 0) {
5757                                                                 panic("Hmm we don't own the lock?");
5758                                                         }
5759                                                 }
5760 #endif
5761                                                 control->tail_mbuf = NULL;
5762 #ifdef INVARIANTS
5763                                                 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) {
5764                                                         panic("end_added, nothing left and no MSG_EOR");
5765                                                 }
5766 #endif
5767                                         }
5768                                 }
5769                         } else {
5770                                 /* Do we need to trim the mbuf? */
5771                                 if (control->spec_flags & M_NOTIFICATION) {
5772                                         out_flags |= MSG_NOTIFICATION;
5773                                 }
5774                                 if ((in_flags & MSG_PEEK) == 0) {
5775                                         SCTP_BUF_RESV_UF(m, cp_len);
5776                                         SCTP_BUF_LEN(m) -= cp_len;
5777                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5778                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, cp_len);
5779                                         }
5780                                         atomic_subtract_int(&so->so_rcv.sb_cc, cp_len);
5781                                         if ((control->do_not_ref_stcb == 0) &&
5782                                             stcb) {
5783                                                 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len);
5784                                         }
5785                                         copied_so_far += cp_len;
5786                                         embuf = m;
5787                                         freed_so_far += cp_len;
5788                                         freed_so_far += MSIZE;
5789                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5790                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
5791                                                     SCTP_LOG_SBRESULT, 0);
5792                                         }
5793                                         atomic_subtract_int(&control->length, cp_len);
5794                                 } else {
5795                                         copied_so_far += cp_len;
5796                                 }
5797                         }
5798                         if ((out_flags & MSG_EOR) || (uio->uio_resid == 0)) {
5799                                 break;
5800                         }
5801                         if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5802                             (control->do_not_ref_stcb == 0) &&
5803                             (freed_so_far >= rwnd_req)) {
5804                                 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5805                         }
5806                 }               /* end while(m) */
5807                 /*
5808                  * At this point we have looked at it all and we either have
5809                  * a MSG_EOR/or read all the user wants... <OR>
5810                  * control->length == 0.
5811                  */
5812                 if ((out_flags & MSG_EOR) && ((in_flags & MSG_PEEK) == 0)) {
5813                         /* we are done with this control */
5814                         if (control->length == 0) {
5815                                 if (control->data) {
5816 #ifdef INVARIANTS
5817                                         panic("control->data not null at read eor?");
5818 #else
5819                                         SCTP_PRINTF("Strange, data left in the control buffer .. invarients would panic?\n");
5820                                         sctp_m_freem(control->data);
5821                                         control->data = NULL;
5822 #endif
5823                                 }
5824                 done_with_control:
5825                                 if (TAILQ_NEXT(control, next) == NULL) {
5826                                         /*
5827                                          * If we don't have a next we need a
5828                                          * lock, if there is a next
5829                                          * interrupt is filling ahead of us
5830                                          * and we don't need a lock to
5831                                          * remove this guy (which is the
5832                                          * head of the queue).
5833                                          */
5834                                         if (hold_rlock == 0) {
5835                                                 SCTP_INP_READ_LOCK(inp);
5836                                                 hold_rlock = 1;
5837                                         }
5838                                 }
5839                                 TAILQ_REMOVE(&inp->read_queue, control, next);
5840                                 /* Add back any hiddend data */
5841                                 if (control->held_length) {
5842                                         held_length = 0;
5843                                         control->held_length = 0;
5844                                         wakeup_read_socket = 1;
5845                                 }
5846                                 if (control->aux_data) {
5847                                         sctp_m_free(control->aux_data);
5848                                         control->aux_data = NULL;
5849                                 }
5850                                 no_rcv_needed = control->do_not_ref_stcb;
5851                                 sctp_free_remote_addr(control->whoFrom);
5852                                 control->data = NULL;
5853                                 sctp_free_a_readq(stcb, control);
5854                                 control = NULL;
5855                                 if ((freed_so_far >= rwnd_req) &&
5856                                     (no_rcv_needed == 0))
5857                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5858
5859                         } else {
5860                                 /*
5861                                  * The user did not read all of this
5862                                  * message, turn off the returned MSG_EOR
5863                                  * since we are leaving more behind on the
5864                                  * control to read.
5865                                  */
5866 #ifdef INVARIANTS
5867                                 if (control->end_added &&
5868                                     (control->data == NULL) &&
5869                                     (control->tail_mbuf == NULL)) {
5870                                         panic("Gak, control->length is corrupt?");
5871                                 }
5872 #endif
5873                                 no_rcv_needed = control->do_not_ref_stcb;
5874                                 out_flags &= ~MSG_EOR;
5875                         }
5876                 }
5877                 if (out_flags & MSG_EOR) {
5878                         goto release;
5879                 }
5880                 if ((uio->uio_resid == 0) ||
5881                     ((in_eeor_mode) && (copied_so_far >= max(so->so_rcv.sb_lowat, 1)))
5882                     ) {
5883                         goto release;
5884                 }
5885                 /*
5886                  * If I hit here the receiver wants more and this message is
5887                  * NOT done (pd-api). So two questions. Can we block? if not
5888                  * we are done. Did the user NOT set MSG_WAITALL?
5889                  */
5890                 if (block_allowed == 0) {
5891                         goto release;
5892                 }
5893                 /*
5894                  * We need to wait for more data a few things: - We don't
5895                  * sbunlock() so we don't get someone else reading. - We
5896                  * must be sure to account for the case where what is added
5897                  * is NOT to our control when we wakeup.
5898                  */
5899
5900                 /*
5901                  * Do we need to tell the transport a rwnd update might be
5902                  * needed before we go to sleep?
5903                  */
5904                 if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5905                     ((freed_so_far >= rwnd_req) &&
5906                     (control->do_not_ref_stcb == 0) &&
5907                     (no_rcv_needed == 0))) {
5908                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5909                 }
5910 wait_some_more:
5911                 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
5912                         goto release;
5913                 }
5914                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
5915                         goto release;
5916
5917                 if (hold_rlock == 1) {
5918                         SCTP_INP_READ_UNLOCK(inp);
5919                         hold_rlock = 0;
5920                 }
5921                 if (hold_sblock == 0) {
5922                         SOCKBUF_LOCK(&so->so_rcv);
5923                         hold_sblock = 1;
5924                 }
5925                 if ((copied_so_far) && (control->length == 0) &&
5926                     (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE))) {
5927                         goto release;
5928                 }
5929                 if (so->so_rcv.sb_cc <= control->held_length) {
5930                         error = sbwait(&so->so_rcv);
5931                         if (error) {
5932                                 goto release;
5933                         }
5934                         control->held_length = 0;
5935                 }
5936                 if (hold_sblock) {
5937                         SOCKBUF_UNLOCK(&so->so_rcv);
5938                         hold_sblock = 0;
5939                 }
5940                 if (control->length == 0) {
5941                         /* still nothing here */
5942                         if (control->end_added == 1) {
5943                                 /* he aborted, or is done i.e.did a shutdown */
5944                                 out_flags |= MSG_EOR;
5945                                 if (control->pdapi_aborted) {
5946                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5947                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5948
5949                                         out_flags |= MSG_TRUNC;
5950                                 } else {
5951                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5952                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5953                                 }
5954                                 goto done_with_control;
5955                         }
5956                         if (so->so_rcv.sb_cc > held_length) {
5957                                 control->held_length = so->so_rcv.sb_cc;
5958                                 held_length = 0;
5959                         }
5960                         goto wait_some_more;
5961                 } else if (control->data == NULL) {
5962                         /*
5963                          * we must re-sync since data is probably being
5964                          * added
5965                          */
5966                         SCTP_INP_READ_LOCK(inp);
5967                         if ((control->length > 0) && (control->data == NULL)) {
5968                                 /*
5969                                  * big trouble.. we have the lock and its
5970                                  * corrupt?
5971                                  */
5972 #ifdef INVARIANTS
5973                                 panic("Impossible data==NULL length !=0");
5974 #endif
5975                                 out_flags |= MSG_EOR;
5976                                 out_flags |= MSG_TRUNC;
5977                                 control->length = 0;
5978                                 SCTP_INP_READ_UNLOCK(inp);
5979                                 goto done_with_control;
5980                         }
5981                         SCTP_INP_READ_UNLOCK(inp);
5982                         /* We will fall around to get more data */
5983                 }
5984                 goto get_more_data;
5985         } else {
5986                 /*-
5987                  * Give caller back the mbuf chain,
5988                  * store in uio_resid the length
5989                  */
5990                 wakeup_read_socket = 0;
5991                 if ((control->end_added == 0) ||
5992                     (TAILQ_NEXT(control, next) == NULL)) {
5993                         /* Need to get rlock */
5994                         if (hold_rlock == 0) {
5995                                 SCTP_INP_READ_LOCK(inp);
5996                                 hold_rlock = 1;
5997                         }
5998                 }
5999                 if (control->end_added) {
6000                         out_flags |= MSG_EOR;
6001                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
6002                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6003                 }
6004                 if (control->spec_flags & M_NOTIFICATION) {
6005                         out_flags |= MSG_NOTIFICATION;
6006                 }
6007                 uio->uio_resid = control->length;
6008                 *mp = control->data;
6009                 m = control->data;
6010                 while (m) {
6011                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6012                                 sctp_sblog(&so->so_rcv,
6013                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
6014                         }
6015                         sctp_sbfree(control, stcb, &so->so_rcv, m);
6016                         freed_so_far += SCTP_BUF_LEN(m);
6017                         freed_so_far += MSIZE;
6018                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6019                                 sctp_sblog(&so->so_rcv,
6020                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
6021                         }
6022                         m = SCTP_BUF_NEXT(m);
6023                 }
6024                 control->data = control->tail_mbuf = NULL;
6025                 control->length = 0;
6026                 if (out_flags & MSG_EOR) {
6027                         /* Done with this control */
6028                         goto done_with_control;
6029                 }
6030         }
6031 release:
6032         if (hold_rlock == 1) {
6033                 SCTP_INP_READ_UNLOCK(inp);
6034                 hold_rlock = 0;
6035         }
6036         if (hold_sblock == 1) {
6037                 SOCKBUF_UNLOCK(&so->so_rcv);
6038                 hold_sblock = 0;
6039         }
6040         sbunlock(&so->so_rcv);
6041         sockbuf_lock = 0;
6042
6043 release_unlocked:
6044         if (hold_sblock) {
6045                 SOCKBUF_UNLOCK(&so->so_rcv);
6046                 hold_sblock = 0;
6047         }
6048         if ((stcb) && (in_flags & MSG_PEEK) == 0) {
6049                 if ((freed_so_far >= rwnd_req) &&
6050                     (control && (control->do_not_ref_stcb == 0)) &&
6051                     (no_rcv_needed == 0))
6052                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6053         }
6054 out:
6055         if (msg_flags) {
6056                 *msg_flags = out_flags;
6057         }
6058         if (((out_flags & MSG_EOR) == 0) &&
6059             ((in_flags & MSG_PEEK) == 0) &&
6060             (sinfo) &&
6061             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO))) {
6062                 struct sctp_extrcvinfo *s_extra;
6063
6064                 s_extra = (struct sctp_extrcvinfo *)sinfo;
6065                 s_extra->sreinfo_next_flags = SCTP_NO_NEXT_MSG;
6066         }
6067         if (hold_rlock == 1) {
6068                 SCTP_INP_READ_UNLOCK(inp);
6069                 hold_rlock = 0;
6070         }
6071         if (hold_sblock) {
6072                 SOCKBUF_UNLOCK(&so->so_rcv);
6073                 hold_sblock = 0;
6074         }
6075         if (sockbuf_lock) {
6076                 sbunlock(&so->so_rcv);
6077         }
6078         if (freecnt_applied) {
6079                 /*
6080                  * The lock on the socket buffer protects us so the free
6081                  * code will stop. But since we used the socketbuf lock and
6082                  * the sender uses the tcb_lock to increment, we need to use
6083                  * the atomic add to the refcnt.
6084                  */
6085                 if (stcb == NULL) {
6086 #ifdef INVARIANTS
6087                         panic("stcb for refcnt has gone NULL?");
6088                         goto stage_left;
6089 #else
6090                         goto stage_left;
6091 #endif
6092                 }
6093                 atomic_add_int(&stcb->asoc.refcnt, -1);
6094                 freecnt_applied = 0;
6095                 /* Save the value back for next time */
6096                 stcb->freed_by_sorcv_sincelast = freed_so_far;
6097         }
6098         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
6099                 if (stcb) {
6100                         sctp_misc_ints(SCTP_SORECV_DONE,
6101                             freed_so_far,
6102                             ((uio) ? (slen - uio->uio_resid) : slen),
6103                             stcb->asoc.my_rwnd,
6104                             so->so_rcv.sb_cc);
6105                 } else {
6106                         sctp_misc_ints(SCTP_SORECV_DONE,
6107                             freed_so_far,
6108                             ((uio) ? (slen - uio->uio_resid) : slen),
6109                             0,
6110                             so->so_rcv.sb_cc);
6111                 }
6112         }
6113 stage_left:
6114         if (wakeup_read_socket) {
6115                 sctp_sorwakeup(inp, so);
6116         }
6117         return (error);
6118 }
6119
6120
6121 #ifdef SCTP_MBUF_LOGGING
6122 struct mbuf *
6123 sctp_m_free(struct mbuf *m)
6124 {
6125         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
6126                 if (SCTP_BUF_IS_EXTENDED(m)) {
6127                         sctp_log_mb(m, SCTP_MBUF_IFREE);
6128                 }
6129         }
6130         return (m_free(m));
6131 }
6132
6133 void
6134 sctp_m_freem(struct mbuf *mb)
6135 {
6136         while (mb != NULL)
6137                 mb = sctp_m_free(mb);
6138 }
6139
6140 #endif
6141
6142 int
6143 sctp_dynamic_set_primary(struct sockaddr *sa, uint32_t vrf_id)
6144 {
6145         /*
6146          * Given a local address. For all associations that holds the
6147          * address, request a peer-set-primary.
6148          */
6149         struct sctp_ifa *ifa;
6150         struct sctp_laddr *wi;
6151
6152         ifa = sctp_find_ifa_by_addr(sa, vrf_id, 0);
6153         if (ifa == NULL) {
6154                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EADDRNOTAVAIL);
6155                 return (EADDRNOTAVAIL);
6156         }
6157         /*
6158          * Now that we have the ifa we must awaken the iterator with this
6159          * message.
6160          */
6161         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
6162         if (wi == NULL) {
6163                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
6164                 return (ENOMEM);
6165         }
6166         /* Now incr the count and int wi structure */
6167         SCTP_INCR_LADDR_COUNT();
6168         bzero(wi, sizeof(*wi));
6169         (void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
6170         wi->ifa = ifa;
6171         wi->action = SCTP_SET_PRIM_ADDR;
6172         atomic_add_int(&ifa->refcount, 1);
6173
6174         /* Now add it to the work queue */
6175         SCTP_WQ_ADDR_LOCK();
6176         /*
6177          * Should this really be a tailq? As it is we will process the
6178          * newest first :-0
6179          */
6180         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
6181         SCTP_WQ_ADDR_UNLOCK();
6182         sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
6183             (struct sctp_inpcb *)NULL,
6184             (struct sctp_tcb *)NULL,
6185             (struct sctp_nets *)NULL);
6186         return (0);
6187 }
6188
6189
6190 int
6191 sctp_soreceive(struct socket *so,
6192     struct sockaddr **psa,
6193     struct uio *uio,
6194     struct mbuf **mp0,
6195     struct mbuf **controlp,
6196     int *flagsp)
6197 {
6198         int error, fromlen;
6199         uint8_t sockbuf[256];
6200         struct sockaddr *from;
6201         struct sctp_extrcvinfo sinfo;
6202         int filling_sinfo = 1;
6203         struct sctp_inpcb *inp;
6204
6205         inp = (struct sctp_inpcb *)so->so_pcb;
6206         /* pickup the assoc we are reading from */
6207         if (inp == NULL) {
6208                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6209                 return (EINVAL);
6210         }
6211         if ((sctp_is_feature_off(inp,
6212             SCTP_PCB_FLAGS_RECVDATAIOEVNT)) ||
6213             (controlp == NULL)) {
6214                 /* user does not want the sndrcv ctl */
6215                 filling_sinfo = 0;
6216         }
6217         if (psa) {
6218                 from = (struct sockaddr *)sockbuf;
6219                 fromlen = sizeof(sockbuf);
6220                 from->sa_len = 0;
6221         } else {
6222                 from = NULL;
6223                 fromlen = 0;
6224         }
6225
6226         error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, flagsp,
6227             (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo);
6228         if ((controlp) && (filling_sinfo)) {
6229                 /* copy back the sinfo in a CMSG format */
6230                 if (filling_sinfo)
6231                         *controlp = sctp_build_ctl_nchunk(inp,
6232                             (struct sctp_sndrcvinfo *)&sinfo);
6233                 else
6234                         *controlp = NULL;
6235         }
6236         if (psa) {
6237                 /* copy back the address info */
6238                 if (from && from->sa_len) {
6239                         *psa = sodupsockaddr(from, M_NOWAIT);
6240                 } else {
6241                         *psa = NULL;
6242                 }
6243         }
6244         return (error);
6245 }
6246
6247
6248 int
6249 sctp_l_soreceive(struct socket *so,
6250     struct sockaddr **name,
6251     struct uio *uio,
6252     char **controlp,
6253     int *controllen,
6254     int *flag)
6255 {
6256         int error, fromlen;
6257         uint8_t sockbuf[256];
6258         struct sockaddr *from;
6259         struct sctp_extrcvinfo sinfo;
6260         int filling_sinfo = 1;
6261         struct sctp_inpcb *inp;
6262
6263         inp = (struct sctp_inpcb *)so->so_pcb;
6264         /* pickup the assoc we are reading from */
6265         if (inp == NULL) {
6266                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6267                 return (EINVAL);
6268         }
6269         if ((sctp_is_feature_off(inp,
6270             SCTP_PCB_FLAGS_RECVDATAIOEVNT)) ||
6271             (controlp == NULL)) {
6272                 /* user does not want the sndrcv ctl */
6273                 filling_sinfo = 0;
6274         }
6275         if (name) {
6276                 from = (struct sockaddr *)sockbuf;
6277                 fromlen = sizeof(sockbuf);
6278                 from->sa_len = 0;
6279         } else {
6280                 from = NULL;
6281                 fromlen = 0;
6282         }
6283
6284         error = sctp_sorecvmsg(so, uio,
6285             (struct mbuf **)NULL,
6286             from, fromlen, flag,
6287             (struct sctp_sndrcvinfo *)&sinfo,
6288             filling_sinfo);
6289         if ((controlp) && (filling_sinfo)) {
6290                 /*
6291                  * copy back the sinfo in a CMSG format note that the caller
6292                  * has reponsibility for freeing the memory.
6293                  */
6294                 if (filling_sinfo)
6295                         *controlp = sctp_build_ctl_cchunk(inp,
6296                             controllen,
6297                             (struct sctp_sndrcvinfo *)&sinfo);
6298         }
6299         if (name) {
6300                 /* copy back the address info */
6301                 if (from && from->sa_len) {
6302                         *name = sodupsockaddr(from, M_WAIT);
6303                 } else {
6304                         *name = NULL;
6305                 }
6306         }
6307         return (error);
6308 }
6309
6310
6311
6312
6313
6314
6315
6316 int
6317 sctp_connectx_helper_add(struct sctp_tcb *stcb, struct sockaddr *addr,
6318     int totaddr, int *error)
6319 {
6320         int added = 0;
6321         int i;
6322         struct sctp_inpcb *inp;
6323         struct sockaddr *sa;
6324         size_t incr = 0;
6325
6326         sa = addr;
6327         inp = stcb->sctp_ep;
6328         *error = 0;
6329         for (i = 0; i < totaddr; i++) {
6330                 if (sa->sa_family == AF_INET) {
6331                         incr = sizeof(struct sockaddr_in);
6332                         if (sctp_add_remote_addr(stcb, sa, SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) {
6333                                 /* assoc gone no un-lock */
6334                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6335                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_7);
6336                                 *error = ENOBUFS;
6337                                 goto out_now;
6338                         }
6339                         added++;
6340                 } else if (sa->sa_family == AF_INET6) {
6341                         incr = sizeof(struct sockaddr_in6);
6342                         if (sctp_add_remote_addr(stcb, sa, SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) {
6343                                 /* assoc gone no un-lock */
6344                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6345                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_8);
6346                                 *error = ENOBUFS;
6347                                 goto out_now;
6348                         }
6349                         added++;
6350                 }
6351                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6352         }
6353 out_now:
6354         return (added);
6355 }
6356
6357 struct sctp_tcb *
6358 sctp_connectx_helper_find(struct sctp_inpcb *inp, struct sockaddr *addr,
6359     int *totaddr, int *num_v4, int *num_v6, int *error,
6360     int limit, int *bad_addr)
6361 {
6362         struct sockaddr *sa;
6363         struct sctp_tcb *stcb = NULL;
6364         size_t incr, at, i;
6365
6366         at = incr = 0;
6367         sa = addr;
6368         *error = *num_v6 = *num_v4 = 0;
6369         /* account and validate addresses */
6370         for (i = 0; i < (size_t)*totaddr; i++) {
6371                 if (sa->sa_family == AF_INET) {
6372                         (*num_v4) += 1;
6373                         incr = sizeof(struct sockaddr_in);
6374                         if (sa->sa_len != incr) {
6375                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6376                                 *error = EINVAL;
6377                                 *bad_addr = 1;
6378                                 return (NULL);
6379                         }
6380                 } else if (sa->sa_family == AF_INET6) {
6381                         struct sockaddr_in6 *sin6;
6382
6383                         sin6 = (struct sockaddr_in6 *)sa;
6384                         if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6385                                 /* Must be non-mapped for connectx */
6386                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6387                                 *error = EINVAL;
6388                                 *bad_addr = 1;
6389                                 return (NULL);
6390                         }
6391                         (*num_v6) += 1;
6392                         incr = sizeof(struct sockaddr_in6);
6393                         if (sa->sa_len != incr) {
6394                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6395                                 *error = EINVAL;
6396                                 *bad_addr = 1;
6397                                 return (NULL);
6398                         }
6399                 } else {
6400                         *totaddr = i;
6401                         /* we are done */
6402                         break;
6403                 }
6404                 SCTP_INP_INCR_REF(inp);
6405                 stcb = sctp_findassociation_ep_addr(&inp, sa, NULL, NULL, NULL);
6406                 if (stcb != NULL) {
6407                         /* Already have or am bring up an association */
6408                         return (stcb);
6409                 } else {
6410                         SCTP_INP_DECR_REF(inp);
6411                 }
6412                 if ((at + incr) > (size_t)limit) {
6413                         *totaddr = i;
6414                         break;
6415                 }
6416                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6417         }
6418         return ((struct sctp_tcb *)NULL);
6419 }
6420
6421 /*
6422  * sctp_bindx(ADD) for one address.
6423  * assumes all arguments are valid/checked by caller.
6424  */
6425 void
6426 sctp_bindx_add_address(struct socket *so, struct sctp_inpcb *inp,
6427     struct sockaddr *sa, sctp_assoc_t assoc_id,
6428     uint32_t vrf_id, int *error, void *p)
6429 {
6430         struct sockaddr *addr_touse;
6431
6432 #ifdef INET6
6433         struct sockaddr_in sin;
6434
6435 #endif
6436
6437         /* see if we're bound all already! */
6438         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6439                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6440                 *error = EINVAL;
6441                 return;
6442         }
6443         addr_touse = sa;
6444 #if defined(INET6) && !defined(__Userspace__)   /* TODO port in6_sin6_2_sin */
6445         if (sa->sa_family == AF_INET6) {
6446                 struct sockaddr_in6 *sin6;
6447
6448                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6449                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6450                         *error = EINVAL;
6451                         return;
6452                 }
6453                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6454                         /* can only bind v6 on PF_INET6 sockets */
6455                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6456                         *error = EINVAL;
6457                         return;
6458                 }
6459                 sin6 = (struct sockaddr_in6 *)addr_touse;
6460                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6461                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6462                             SCTP_IPV6_V6ONLY(inp)) {
6463                                 /* can't bind v4-mapped on PF_INET sockets */
6464                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6465                                 *error = EINVAL;
6466                                 return;
6467                         }
6468                         in6_sin6_2_sin(&sin, sin6);
6469                         addr_touse = (struct sockaddr *)&sin;
6470                 }
6471         }
6472 #endif
6473         if (sa->sa_family == AF_INET) {
6474                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6475                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6476                         *error = EINVAL;
6477                         return;
6478                 }
6479                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6480                     SCTP_IPV6_V6ONLY(inp)) {
6481                         /* can't bind v4 on PF_INET sockets */
6482                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6483                         *error = EINVAL;
6484                         return;
6485                 }
6486         }
6487         if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
6488                 if (p == NULL) {
6489                         /* Can't get proc for Net/Open BSD */
6490                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6491                         *error = EINVAL;
6492                         return;
6493                 }
6494                 *error = sctp_inpcb_bind(so, addr_touse, NULL, p);
6495                 return;
6496         }
6497         /*
6498          * No locks required here since bind and mgmt_ep_sa all do their own
6499          * locking. If we do something for the FIX: below we may need to
6500          * lock in that case.
6501          */
6502         if (assoc_id == 0) {
6503                 /* add the address */
6504                 struct sctp_inpcb *lep;
6505                 struct sockaddr_in *lsin = (struct sockaddr_in *)addr_touse;
6506
6507                 /* validate the incoming port */
6508                 if ((lsin->sin_port != 0) &&
6509                     (lsin->sin_port != inp->sctp_lport)) {
6510                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6511                         *error = EINVAL;
6512                         return;
6513                 } else {
6514                         /* user specified 0 port, set it to existing port */
6515                         lsin->sin_port = inp->sctp_lport;
6516                 }
6517
6518                 lep = sctp_pcb_findep(addr_touse, 1, 0, vrf_id);
6519                 if (lep != NULL) {
6520                         /*
6521                          * We must decrement the refcount since we have the
6522                          * ep already and are binding. No remove going on
6523                          * here.
6524                          */
6525                         SCTP_INP_DECR_REF(lep);
6526                 }
6527                 if (lep == inp) {
6528                         /* already bound to it.. ok */
6529                         return;
6530                 } else if (lep == NULL) {
6531                         ((struct sockaddr_in *)addr_touse)->sin_port = 0;
6532                         *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6533                             SCTP_ADD_IP_ADDRESS,
6534                             vrf_id, NULL);
6535                 } else {
6536                         *error = EADDRINUSE;
6537                 }
6538                 if (*error)
6539                         return;
6540         } else {
6541                 /*
6542                  * FIX: decide whether we allow assoc based bindx
6543                  */
6544         }
6545 }
6546
6547 /*
6548  * sctp_bindx(DELETE) for one address.
6549  * assumes all arguments are valid/checked by caller.
6550  */
6551 void
6552 sctp_bindx_delete_address(struct socket *so, struct sctp_inpcb *inp,
6553     struct sockaddr *sa, sctp_assoc_t assoc_id,
6554     uint32_t vrf_id, int *error)
6555 {
6556         struct sockaddr *addr_touse;
6557
6558 #ifdef INET6
6559         struct sockaddr_in sin;
6560
6561 #endif
6562
6563         /* see if we're bound all already! */
6564         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6565                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6566                 *error = EINVAL;
6567                 return;
6568         }
6569         addr_touse = sa;
6570 #if defined(INET6) && !defined(__Userspace__)   /* TODO port in6_sin6_2_sin */
6571         if (sa->sa_family == AF_INET6) {
6572                 struct sockaddr_in6 *sin6;
6573
6574                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6575                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6576                         *error = EINVAL;
6577                         return;
6578                 }
6579                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6580                         /* can only bind v6 on PF_INET6 sockets */
6581                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6582                         *error = EINVAL;
6583                         return;
6584                 }
6585                 sin6 = (struct sockaddr_in6 *)addr_touse;
6586                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6587                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6588                             SCTP_IPV6_V6ONLY(inp)) {
6589                                 /* can't bind mapped-v4 on PF_INET sockets */
6590                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6591                                 *error = EINVAL;
6592                                 return;
6593                         }
6594                         in6_sin6_2_sin(&sin, sin6);
6595                         addr_touse = (struct sockaddr *)&sin;
6596                 }
6597         }
6598 #endif
6599         if (sa->sa_family == AF_INET) {
6600                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6601                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6602                         *error = EINVAL;
6603                         return;
6604                 }
6605                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6606                     SCTP_IPV6_V6ONLY(inp)) {
6607                         /* can't bind v4 on PF_INET sockets */
6608                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6609                         *error = EINVAL;
6610                         return;
6611                 }
6612         }
6613         /*
6614          * No lock required mgmt_ep_sa does its own locking. If the FIX:
6615          * below is ever changed we may need to lock before calling
6616          * association level binding.
6617          */
6618         if (assoc_id == 0) {
6619                 /* delete the address */
6620                 *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6621                     SCTP_DEL_IP_ADDRESS,
6622                     vrf_id, NULL);
6623         } else {
6624                 /*
6625                  * FIX: decide whether we allow assoc based bindx
6626                  */
6627         }
6628 }
6629
6630 /*
6631  * returns the valid local address count for an assoc, taking into account
6632  * all scoping rules
6633  */
6634 int
6635 sctp_local_addr_count(struct sctp_tcb *stcb)
6636 {
6637         int loopback_scope, ipv4_local_scope, local_scope, site_scope;
6638         int ipv4_addr_legal, ipv6_addr_legal;
6639         struct sctp_vrf *vrf;
6640         struct sctp_ifn *sctp_ifn;
6641         struct sctp_ifa *sctp_ifa;
6642         int count = 0;
6643
6644         /* Turn on all the appropriate scopes */
6645         loopback_scope = stcb->asoc.loopback_scope;
6646         ipv4_local_scope = stcb->asoc.ipv4_local_scope;
6647         local_scope = stcb->asoc.local_scope;
6648         site_scope = stcb->asoc.site_scope;
6649         ipv4_addr_legal = ipv6_addr_legal = 0;
6650         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
6651                 ipv6_addr_legal = 1;
6652                 if (SCTP_IPV6_V6ONLY(stcb->sctp_ep) == 0) {
6653                         ipv4_addr_legal = 1;
6654                 }
6655         } else {
6656                 ipv4_addr_legal = 1;
6657         }
6658
6659         SCTP_IPI_ADDR_RLOCK();
6660         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
6661         if (vrf == NULL) {
6662                 /* no vrf, no addresses */
6663                 SCTP_IPI_ADDR_RUNLOCK();
6664                 return (0);
6665         }
6666         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6667                 /*
6668                  * bound all case: go through all ifns on the vrf
6669                  */
6670                 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
6671                         if ((loopback_scope == 0) &&
6672                             SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
6673                                 continue;
6674                         }
6675                         LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
6676                                 if (sctp_is_addr_restricted(stcb, sctp_ifa))
6677                                         continue;
6678                                 switch (sctp_ifa->address.sa.sa_family) {
6679                                 case AF_INET:
6680                                         if (ipv4_addr_legal) {
6681                                                 struct sockaddr_in *sin;
6682
6683                                                 sin = (struct sockaddr_in *)&sctp_ifa->address.sa;
6684                                                 if (sin->sin_addr.s_addr == 0) {
6685                                                         /*
6686                                                          * skip unspecified
6687                                                          * addrs
6688                                                          */
6689                                                         continue;
6690                                                 }
6691                                                 if ((ipv4_local_scope == 0) &&
6692                                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
6693                                                         continue;
6694                                                 }
6695                                                 /* count this one */
6696                                                 count++;
6697                                         } else {
6698                                                 continue;
6699                                         }
6700                                         break;
6701 #ifdef INET6
6702                                 case AF_INET6:
6703                                         if (ipv6_addr_legal) {
6704                                                 struct sockaddr_in6 *sin6;
6705
6706                                                 sin6 = (struct sockaddr_in6 *)&sctp_ifa->address.sa;
6707                                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
6708                                                         continue;
6709                                                 }
6710                                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
6711                                                         if (local_scope == 0)
6712                                                                 continue;
6713                                                         if (sin6->sin6_scope_id == 0) {
6714                                                                 if (sa6_recoverscope(sin6) != 0)
6715                                                                         /*
6716                                                                          *
6717                                                                          * bad
6718                                                                          *
6719                                                                          * li
6720                                                                          * nk
6721                                                                          *
6722                                                                          * loc
6723                                                                          * al
6724                                                                          *
6725                                                                          * add
6726                                                                          * re
6727                                                                          * ss
6728                                                                          * */
6729                                                                         continue;
6730                                                         }
6731                                                 }
6732                                                 if ((site_scope == 0) &&
6733                                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
6734                                                         continue;
6735                                                 }
6736                                                 /* count this one */
6737                                                 count++;
6738                                         }
6739                                         break;
6740 #endif
6741                                 default:
6742                                         /* TSNH */
6743                                         break;
6744                                 }
6745                         }
6746                 }
6747         } else {
6748                 /*
6749                  * subset bound case
6750                  */
6751                 struct sctp_laddr *laddr;
6752
6753                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list,
6754                     sctp_nxt_addr) {
6755                         if (sctp_is_addr_restricted(stcb, laddr->ifa)) {
6756                                 continue;
6757                         }
6758                         /* count this one */
6759                         count++;
6760                 }
6761         }
6762         SCTP_IPI_ADDR_RUNLOCK();
6763         return (count);
6764 }
6765
6766 #if defined(SCTP_LOCAL_TRACE_BUF)
6767
6768 void
6769 sctp_log_trace(uint32_t subsys, const char *str SCTP_UNUSED, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f)
6770 {
6771         uint32_t saveindex, newindex;
6772
6773         do {
6774                 saveindex = SCTP_BASE_SYSCTL(sctp_log).index;
6775                 if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6776                         newindex = 1;
6777                 } else {
6778                         newindex = saveindex + 1;
6779                 }
6780         } while (atomic_cmpset_int(&SCTP_BASE_SYSCTL(sctp_log).index, saveindex, newindex) == 0);
6781         if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6782                 saveindex = 0;
6783         }
6784         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].timestamp = SCTP_GET_CYCLECOUNT;
6785         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].subsys = subsys;
6786         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[0] = a;
6787         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[1] = b;
6788         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[2] = c;
6789         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[3] = d;
6790         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[4] = e;
6791         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[5] = f;
6792 }
6793
6794 #endif
6795 /* We will need to add support
6796  * to bind the ports and such here
6797  * so we can do UDP tunneling. In
6798  * the mean-time, we return error
6799  */
6800 #include <netinet/udp.h>
6801 #include <netinet/udp_var.h>
6802 #include <sys/proc.h>
6803 #ifdef INET6
6804 #include <netinet6/sctp6_var.h>
6805 #endif
6806
6807 static void
6808 sctp_recv_udp_tunneled_packet(struct mbuf *m, int off, struct inpcb *ignored)
6809 {
6810         struct ip *iph;
6811         struct mbuf *sp, *last;
6812         struct udphdr *uhdr;
6813         uint16_t port = 0, len;
6814         int header_size = sizeof(struct udphdr) + sizeof(struct sctphdr);
6815
6816         /*
6817          * Split out the mbuf chain. Leave the IP header in m, place the
6818          * rest in the sp.
6819          */
6820         if ((m->m_flags & M_PKTHDR) == 0) {
6821                 /* Can't handle one that is not a pkt hdr */
6822                 goto out;
6823         }
6824         /* pull the src port */
6825         iph = mtod(m, struct ip *);
6826         uhdr = (struct udphdr *)((caddr_t)iph + off);
6827
6828         port = uhdr->uh_sport;
6829         sp = m_split(m, off, M_DONTWAIT);
6830         if (sp == NULL) {
6831                 /* Gak, drop packet, we can't do a split */
6832                 goto out;
6833         }
6834         if (sp->m_pkthdr.len < header_size) {
6835                 /* Gak, packet can't have an SCTP header in it - to small */
6836                 m_freem(sp);
6837                 goto out;
6838         }
6839         /* ok now pull up the UDP header and SCTP header together */
6840         sp = m_pullup(sp, header_size);
6841         if (sp == NULL) {
6842                 /* Gak pullup failed */
6843                 goto out;
6844         }
6845         /* trim out the UDP header */
6846         m_adj(sp, sizeof(struct udphdr));
6847
6848         /* Now reconstruct the mbuf chain */
6849         /* 1) find last one */
6850         last = m;
6851         while (last->m_next != NULL) {
6852                 last = last->m_next;
6853         }
6854         last->m_next = sp;
6855         m->m_pkthdr.len += sp->m_pkthdr.len;
6856         last = m;
6857         while (last != NULL) {
6858                 last = last->m_next;
6859         }
6860         /* Now its ready for sctp_input or sctp6_input */
6861         iph = mtod(m, struct ip *);
6862         switch (iph->ip_v) {
6863         case IPVERSION:
6864                 {
6865                         /* its IPv4 */
6866                         len = SCTP_GET_IPV4_LENGTH(iph);
6867                         len -= sizeof(struct udphdr);
6868                         SCTP_GET_IPV4_LENGTH(iph) = len;
6869                         sctp_input_with_port(m, off, port);
6870                         break;
6871                 }
6872 #ifdef INET6
6873         case IPV6_VERSION >> 4:
6874                 {
6875                         /* its IPv6 - NOT supported */
6876                         goto out;
6877                         break;
6878
6879                 }
6880 #endif
6881         default:
6882                 {
6883                         m_freem(m);
6884                         break;
6885                 }
6886         }
6887         return;
6888 out:
6889         m_freem(m);
6890 }
6891
6892 void
6893 sctp_over_udp_stop(void)
6894 {
6895         struct socket *sop;
6896
6897         /*
6898          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
6899          * for writting!
6900          */
6901         if (SCTP_BASE_INFO(udp_tun_socket) == NULL) {
6902                 /* Nothing to do */
6903                 return;
6904         }
6905         sop = SCTP_BASE_INFO(udp_tun_socket);
6906         soclose(sop);
6907         SCTP_BASE_INFO(udp_tun_socket) = NULL;
6908 }
6909 int
6910 sctp_over_udp_start(void)
6911 {
6912         uint16_t port;
6913         int ret;
6914         struct sockaddr_in sin;
6915         struct socket *sop = NULL;
6916         struct thread *th;
6917         struct ucred *cred;
6918
6919         /*
6920          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
6921          * for writting!
6922          */
6923         port = SCTP_BASE_SYSCTL(sctp_udp_tunneling_port);
6924         if (port == 0) {
6925                 /* Must have a port set */
6926                 return (EINVAL);
6927         }
6928         if (SCTP_BASE_INFO(udp_tun_socket) != NULL) {
6929                 /* Already running -- must stop first */
6930                 return (EALREADY);
6931         }
6932         th = curthread;
6933         cred = th->td_ucred;
6934         if ((ret = socreate(PF_INET, &sop,
6935             SOCK_DGRAM, IPPROTO_UDP, cred, th))) {
6936                 return (ret);
6937         }
6938         SCTP_BASE_INFO(udp_tun_socket) = sop;
6939         /* call the special UDP hook */
6940         ret = udp_set_kernel_tunneling(sop, sctp_recv_udp_tunneled_packet);
6941         if (ret) {
6942                 goto exit_stage_left;
6943         }
6944         /* Ok we have a socket, bind it to the port */
6945         memset(&sin, 0, sizeof(sin));
6946         sin.sin_len = sizeof(sin);
6947         sin.sin_family = AF_INET;
6948         sin.sin_port = htons(port);
6949         ret = sobind(sop, (struct sockaddr *)&sin, th);
6950         if (ret) {
6951                 /* Close up we cant get the port */
6952 exit_stage_left:
6953                 sctp_over_udp_stop();
6954                 return (ret);
6955         }
6956         /*
6957          * Ok we should now get UDP packets directly to our input routine
6958          * sctp_recv_upd_tunneled_packet().
6959          */
6960         return (0);
6961 }