sys/netinet/sctputil.c

   1 /*-
   2  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_pcb.h>
  38 #include <netinet/sctputil.h>
  39 #include <netinet/sctp_var.h>
  40 #include <netinet/sctp_sysctl.h>
  41 #ifdef INET6
  42 #include <netinet6/sctp6_var.h>
  43 #endif
  44 #include <netinet/sctp_header.h>
  45 #include <netinet/sctp_output.h>
  46 #include <netinet/sctp_uio.h>
  47 #include <netinet/sctp_timer.h>
  48 #include <netinet/sctp_indata.h>
  49 #include <netinet/sctp_auth.h>
  50 #include <netinet/sctp_asconf.h>
  51 #include <netinet/sctp_bsd_addr.h>
  52 #if defined(INET6) || defined(INET)
  53 #include <netinet/tcp_var.h>
  54 #endif
  55 #include <netinet/udp.h>
  56 #include <netinet/udp_var.h>
  57 #include <sys/proc.h>
  58 #ifdef INET6
  59 #include <netinet/icmp6.h>
  60 #endif
  61
  62
  63 #ifndef KTR_SCTP
  64 #define KTR_SCTP KTR_SUBSYS
  65 #endif
  66
  67 extern const struct sctp_cc_functions sctp_cc_functions[];
  68 extern const struct sctp_ss_functions sctp_ss_functions[];
  69
  70 void
  71 sctp_sblog(struct sockbuf *sb, struct sctp_tcb *stcb, int from, int incr)
  72 {
  73         struct sctp_cwnd_log sctp_clog;
  74
  75         sctp_clog.x.sb.stcb = stcb;
  76         sctp_clog.x.sb.so_sbcc = sb->sb_cc;
  77         if (stcb)
  78                 sctp_clog.x.sb.stcb_sbcc = stcb->asoc.sb_cc;
  79         else
  80                 sctp_clog.x.sb.stcb_sbcc = 0;
  81         sctp_clog.x.sb.incr = incr;
  82         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
  83             SCTP_LOG_EVENT_SB,
  84             from,
  85             sctp_clog.x.misc.log1,
  86             sctp_clog.x.misc.log2,
  87             sctp_clog.x.misc.log3,
  88             sctp_clog.x.misc.log4);
  89 }
  90
  91 void
  92 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc)
  93 {
  94         struct sctp_cwnd_log sctp_clog;
  95
  96         sctp_clog.x.close.inp = (void *)inp;
  97         sctp_clog.x.close.sctp_flags = inp->sctp_flags;
  98         if (stcb) {
  99                 sctp_clog.x.close.stcb = (void *)stcb;
 100                 sctp_clog.x.close.state = (uint16_t)stcb->asoc.state;
 101         } else {
 102                 sctp_clog.x.close.stcb = 0;
 103                 sctp_clog.x.close.state = 0;
 104         }
 105         sctp_clog.x.close.loc = loc;
 106         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 107             SCTP_LOG_EVENT_CLOSE,
 108             0,
 109             sctp_clog.x.misc.log1,
 110             sctp_clog.x.misc.log2,
 111             sctp_clog.x.misc.log3,
 112             sctp_clog.x.misc.log4);
 113 }
 114
 115 void
 116 rto_logging(struct sctp_nets *net, int from)
 117 {
 118         struct sctp_cwnd_log sctp_clog;
 119
 120         memset(&sctp_clog, 0, sizeof(sctp_clog));
 121         sctp_clog.x.rto.net = (void *)net;
 122         sctp_clog.x.rto.rtt = net->rtt / 1000;
 123         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 124             SCTP_LOG_EVENT_RTT,
 125             from,
 126             sctp_clog.x.misc.log1,
 127             sctp_clog.x.misc.log2,
 128             sctp_clog.x.misc.log3,
 129             sctp_clog.x.misc.log4);
 130 }
 131
 132 void
 133 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from)
 134 {
 135         struct sctp_cwnd_log sctp_clog;
 136
 137         sctp_clog.x.strlog.stcb = stcb;
 138         sctp_clog.x.strlog.n_tsn = tsn;
 139         sctp_clog.x.strlog.n_sseq = sseq;
 140         sctp_clog.x.strlog.e_tsn = 0;
 141         sctp_clog.x.strlog.e_sseq = 0;
 142         sctp_clog.x.strlog.strm = stream;
 143         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 144             SCTP_LOG_EVENT_STRM,
 145             from,
 146             sctp_clog.x.misc.log1,
 147             sctp_clog.x.misc.log2,
 148             sctp_clog.x.misc.log3,
 149             sctp_clog.x.misc.log4);
 150 }
 151
 152 void
 153 sctp_log_nagle_event(struct sctp_tcb *stcb, int action)
 154 {
 155         struct sctp_cwnd_log sctp_clog;
 156
 157         sctp_clog.x.nagle.stcb = (void *)stcb;
 158         sctp_clog.x.nagle.total_flight = stcb->asoc.total_flight;
 159         sctp_clog.x.nagle.total_in_queue = stcb->asoc.total_output_queue_size;
 160         sctp_clog.x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue;
 161         sctp_clog.x.nagle.count_in_flight = stcb->asoc.total_flight_count;
 162         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 163             SCTP_LOG_EVENT_NAGLE,
 164             action,
 165             sctp_clog.x.misc.log1,
 166             sctp_clog.x.misc.log2,
 167             sctp_clog.x.misc.log3,
 168             sctp_clog.x.misc.log4);
 169 }
 170
 171 void
 172 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from)
 173 {
 174         struct sctp_cwnd_log sctp_clog;
 175
 176         sctp_clog.x.sack.cumack = cumack;
 177         sctp_clog.x.sack.oldcumack = old_cumack;
 178         sctp_clog.x.sack.tsn = tsn;
 179         sctp_clog.x.sack.numGaps = gaps;
 180         sctp_clog.x.sack.numDups = dups;
 181         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 182             SCTP_LOG_EVENT_SACK,
 183             from,
 184             sctp_clog.x.misc.log1,
 185             sctp_clog.x.misc.log2,
 186             sctp_clog.x.misc.log3,
 187             sctp_clog.x.misc.log4);
 188 }
 189
 190 void
 191 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from)
 192 {
 193         struct sctp_cwnd_log sctp_clog;
 194
 195         memset(&sctp_clog, 0, sizeof(sctp_clog));
 196         sctp_clog.x.map.base = map;
 197         sctp_clog.x.map.cum = cum;
 198         sctp_clog.x.map.high = high;
 199         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 200             SCTP_LOG_EVENT_MAP,
 201             from,
 202             sctp_clog.x.misc.log1,
 203             sctp_clog.x.misc.log2,
 204             sctp_clog.x.misc.log3,
 205             sctp_clog.x.misc.log4);
 206 }
 207
 208 void
 209 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn, int from)
 210 {
 211         struct sctp_cwnd_log sctp_clog;
 212
 213         memset(&sctp_clog, 0, sizeof(sctp_clog));
 214         sctp_clog.x.fr.largest_tsn = biggest_tsn;
 215         sctp_clog.x.fr.largest_new_tsn = biggest_new_tsn;
 216         sctp_clog.x.fr.tsn = tsn;
 217         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 218             SCTP_LOG_EVENT_FR,
 219             from,
 220             sctp_clog.x.misc.log1,
 221             sctp_clog.x.misc.log2,
 222             sctp_clog.x.misc.log3,
 223             sctp_clog.x.misc.log4);
 224 }
 225
 226 #ifdef SCTP_MBUF_LOGGING
 227 void
 228 sctp_log_mb(struct mbuf *m, int from)
 229 {
 230         struct sctp_cwnd_log sctp_clog;
 231
 232         sctp_clog.x.mb.mp = m;
 233         sctp_clog.x.mb.mbuf_flags = (uint8_t)(SCTP_BUF_GET_FLAGS(m));
 234         sctp_clog.x.mb.size = (uint16_t)(SCTP_BUF_LEN(m));
 235         sctp_clog.x.mb.data = SCTP_BUF_AT(m, 0);
 236         if (SCTP_BUF_IS_EXTENDED(m)) {
 237                 sctp_clog.x.mb.ext = SCTP_BUF_EXTEND_BASE(m);
 238                 sctp_clog.x.mb.refcnt = (uint8_t)(SCTP_BUF_EXTEND_REFCNT(m));
 239         } else {
 240                 sctp_clog.x.mb.ext = 0;
 241                 sctp_clog.x.mb.refcnt = 0;
 242         }
 243         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 244             SCTP_LOG_EVENT_MBUF,
 245             from,
 246             sctp_clog.x.misc.log1,
 247             sctp_clog.x.misc.log2,
 248             sctp_clog.x.misc.log3,
 249             sctp_clog.x.misc.log4);
 250 }
 251
 252 void
 253 sctp_log_mbc(struct mbuf *m, int from)
 254 {
 255         struct mbuf *mat;
 256
 257         for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) {
 258                 sctp_log_mb(mat, from);
 259         }
 260 }
 261 #endif
 262
 263 void
 264 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk, int from)
 265 {
 266         struct sctp_cwnd_log sctp_clog;
 267
 268         if (control == NULL) {
 269                 SCTP_PRINTF("Gak log of NULL?\n");
 270                 return;
 271         }
 272         sctp_clog.x.strlog.stcb = control->stcb;
 273         sctp_clog.x.strlog.n_tsn = control->sinfo_tsn;
 274         sctp_clog.x.strlog.n_sseq = (uint16_t)control->mid;
 275         sctp_clog.x.strlog.strm = control->sinfo_stream;
 276         if (poschk != NULL) {
 277                 sctp_clog.x.strlog.e_tsn = poschk->sinfo_tsn;
 278                 sctp_clog.x.strlog.e_sseq = (uint16_t)poschk->mid;
 279         } else {
 280                 sctp_clog.x.strlog.e_tsn = 0;
 281                 sctp_clog.x.strlog.e_sseq = 0;
 282         }
 283         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 284             SCTP_LOG_EVENT_STRM,
 285             from,
 286             sctp_clog.x.misc.log1,
 287             sctp_clog.x.misc.log2,
 288             sctp_clog.x.misc.log3,
 289             sctp_clog.x.misc.log4);
 290 }
 291
 292 void
 293 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from)
 294 {
 295         struct sctp_cwnd_log sctp_clog;
 296
 297         sctp_clog.x.cwnd.net = net;
 298         if (stcb->asoc.send_queue_cnt > 255)
 299                 sctp_clog.x.cwnd.cnt_in_send = 255;
 300         else
 301                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 302         if (stcb->asoc.stream_queue_cnt > 255)
 303                 sctp_clog.x.cwnd.cnt_in_str = 255;
 304         else
 305                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 306
 307         if (net) {
 308                 sctp_clog.x.cwnd.cwnd_new_value = net->cwnd;
 309                 sctp_clog.x.cwnd.inflight = net->flight_size;
 310                 sctp_clog.x.cwnd.pseudo_cumack = net->pseudo_cumack;
 311                 sctp_clog.x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack;
 312                 sctp_clog.x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack;
 313         }
 314         if (SCTP_CWNDLOG_PRESEND == from) {
 315                 sctp_clog.x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd;
 316         }
 317         sctp_clog.x.cwnd.cwnd_augment = augment;
 318         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 319             SCTP_LOG_EVENT_CWND,
 320             from,
 321             sctp_clog.x.misc.log1,
 322             sctp_clog.x.misc.log2,
 323             sctp_clog.x.misc.log3,
 324             sctp_clog.x.misc.log4);
 325 }
 326
 327 void
 328 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from)
 329 {
 330         struct sctp_cwnd_log sctp_clog;
 331
 332         memset(&sctp_clog, 0, sizeof(sctp_clog));
 333         if (inp) {
 334                 sctp_clog.x.lock.sock = (void *)inp->sctp_socket;
 335
 336         } else {
 337                 sctp_clog.x.lock.sock = (void *)NULL;
 338         }
 339         sctp_clog.x.lock.inp = (void *)inp;
 340         if (stcb) {
 341                 sctp_clog.x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx);
 342         } else {
 343                 sctp_clog.x.lock.tcb_lock = SCTP_LOCK_UNKNOWN;
 344         }
 345         if (inp) {
 346                 sctp_clog.x.lock.inp_lock = mtx_owned(&inp->inp_mtx);
 347                 sctp_clog.x.lock.create_lock = mtx_owned(&inp->inp_create_mtx);
 348         } else {
 349                 sctp_clog.x.lock.inp_lock = SCTP_LOCK_UNKNOWN;
 350                 sctp_clog.x.lock.create_lock = SCTP_LOCK_UNKNOWN;
 351         }
 352         sctp_clog.x.lock.info_lock = rw_wowned(&SCTP_BASE_INFO(ipi_ep_mtx));
 353         if (inp && (inp->sctp_socket)) {
 354                 sctp_clog.x.lock.sock_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 355                 sctp_clog.x.lock.sockrcvbuf_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 356                 sctp_clog.x.lock.socksndbuf_lock = mtx_owned(&(inp->sctp_socket->so_snd.sb_mtx));
 357         } else {
 358                 sctp_clog.x.lock.sock_lock = SCTP_LOCK_UNKNOWN;
 359                 sctp_clog.x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN;
 360                 sctp_clog.x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN;
 361         }
 362         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 363             SCTP_LOG_LOCK_EVENT,
 364             from,
 365             sctp_clog.x.misc.log1,
 366             sctp_clog.x.misc.log2,
 367             sctp_clog.x.misc.log3,
 368             sctp_clog.x.misc.log4);
 369 }
 370
 371 void
 372 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from)
 373 {
 374         struct sctp_cwnd_log sctp_clog;
 375
 376         memset(&sctp_clog, 0, sizeof(sctp_clog));
 377         sctp_clog.x.cwnd.net = net;
 378         sctp_clog.x.cwnd.cwnd_new_value = error;
 379         sctp_clog.x.cwnd.inflight = net->flight_size;
 380         sctp_clog.x.cwnd.cwnd_augment = burst;
 381         if (stcb->asoc.send_queue_cnt > 255)
 382                 sctp_clog.x.cwnd.cnt_in_send = 255;
 383         else
 384                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 385         if (stcb->asoc.stream_queue_cnt > 255)
 386                 sctp_clog.x.cwnd.cnt_in_str = 255;
 387         else
 388                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 389         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 390             SCTP_LOG_EVENT_MAXBURST,
 391             from,
 392             sctp_clog.x.misc.log1,
 393             sctp_clog.x.misc.log2,
 394             sctp_clog.x.misc.log3,
 395             sctp_clog.x.misc.log4);
 396 }
 397
 398 void
 399 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead)
 400 {
 401         struct sctp_cwnd_log sctp_clog;
 402
 403         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 404         sctp_clog.x.rwnd.send_size = snd_size;
 405         sctp_clog.x.rwnd.overhead = overhead;
 406         sctp_clog.x.rwnd.new_rwnd = 0;
 407         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 408             SCTP_LOG_EVENT_RWND,
 409             from,
 410             sctp_clog.x.misc.log1,
 411             sctp_clog.x.misc.log2,
 412             sctp_clog.x.misc.log3,
 413             sctp_clog.x.misc.log4);
 414 }
 415
 416 void
 417 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval)
 418 {
 419         struct sctp_cwnd_log sctp_clog;
 420
 421         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 422         sctp_clog.x.rwnd.send_size = flight_size;
 423         sctp_clog.x.rwnd.overhead = overhead;
 424         sctp_clog.x.rwnd.new_rwnd = a_rwndval;
 425         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 426             SCTP_LOG_EVENT_RWND,
 427             from,
 428             sctp_clog.x.misc.log1,
 429             sctp_clog.x.misc.log2,
 430             sctp_clog.x.misc.log3,
 431             sctp_clog.x.misc.log4);
 432 }
 433
 434 #ifdef SCTP_MBCNT_LOGGING
 435 static void
 436 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt)
 437 {
 438         struct sctp_cwnd_log sctp_clog;
 439
 440         sctp_clog.x.mbcnt.total_queue_size = total_oq;
 441         sctp_clog.x.mbcnt.size_change = book;
 442         sctp_clog.x.mbcnt.total_queue_mb_size = total_mbcnt_q;
 443         sctp_clog.x.mbcnt.mbcnt_change = mbcnt;
 444         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 445             SCTP_LOG_EVENT_MBCNT,
 446             from,
 447             sctp_clog.x.misc.log1,
 448             sctp_clog.x.misc.log2,
 449             sctp_clog.x.misc.log3,
 450             sctp_clog.x.misc.log4);
 451 }
 452 #endif
 453
 454 void
 455 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d)
 456 {
 457         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 458             SCTP_LOG_MISC_EVENT,
 459             from,
 460             a, b, c, d);
 461 }
 462
 463 void
 464 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t wake_cnt, int from)
 465 {
 466         struct sctp_cwnd_log sctp_clog;
 467
 468         sctp_clog.x.wake.stcb = (void *)stcb;
 469         sctp_clog.x.wake.wake_cnt = wake_cnt;
 470         sctp_clog.x.wake.flight = stcb->asoc.total_flight_count;
 471         sctp_clog.x.wake.send_q = stcb->asoc.send_queue_cnt;
 472         sctp_clog.x.wake.sent_q = stcb->asoc.sent_queue_cnt;
 473
 474         if (stcb->asoc.stream_queue_cnt < 0xff)
 475                 sctp_clog.x.wake.stream_qcnt = (uint8_t)stcb->asoc.stream_queue_cnt;
 476         else
 477                 sctp_clog.x.wake.stream_qcnt = 0xff;
 478
 479         if (stcb->asoc.chunks_on_out_queue < 0xff)
 480                 sctp_clog.x.wake.chunks_on_oque = (uint8_t)stcb->asoc.chunks_on_out_queue;
 481         else
 482                 sctp_clog.x.wake.chunks_on_oque = 0xff;
 483
 484         sctp_clog.x.wake.sctpflags = 0;
 485         /* set in the defered mode stuff */
 486         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE)
 487                 sctp_clog.x.wake.sctpflags |= 1;
 488         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT)
 489                 sctp_clog.x.wake.sctpflags |= 2;
 490         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT)
 491                 sctp_clog.x.wake.sctpflags |= 4;
 492         /* what about the sb */
 493         if (stcb->sctp_socket) {
 494                 struct socket *so = stcb->sctp_socket;
 495
 496                 sctp_clog.x.wake.sbflags = (uint8_t)((so->so_snd.sb_flags & 0x00ff));
 497         } else {
 498                 sctp_clog.x.wake.sbflags = 0xff;
 499         }
 500         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 501             SCTP_LOG_EVENT_WAKE,
 502             from,
 503             sctp_clog.x.misc.log1,
 504             sctp_clog.x.misc.log2,
 505             sctp_clog.x.misc.log3,
 506             sctp_clog.x.misc.log4);
 507 }
 508
 509 void
 510 sctp_log_block(uint8_t from, struct sctp_association *asoc, size_t sendlen)
 511 {
 512         struct sctp_cwnd_log sctp_clog;
 513
 514         sctp_clog.x.blk.onsb = asoc->total_output_queue_size;
 515         sctp_clog.x.blk.send_sent_qcnt = (uint16_t)(asoc->send_queue_cnt + asoc->sent_queue_cnt);
 516         sctp_clog.x.blk.peer_rwnd = asoc->peers_rwnd;
 517         sctp_clog.x.blk.stream_qcnt = (uint16_t)asoc->stream_queue_cnt;
 518         sctp_clog.x.blk.chunks_on_oque = (uint16_t)asoc->chunks_on_out_queue;
 519         sctp_clog.x.blk.flight_size = (uint16_t)(asoc->total_flight / 1024);
 520         sctp_clog.x.blk.sndlen = (uint32_t)sendlen;
 521         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 522             SCTP_LOG_EVENT_BLOCK,
 523             from,
 524             sctp_clog.x.misc.log1,
 525             sctp_clog.x.misc.log2,
 526             sctp_clog.x.misc.log3,
 527             sctp_clog.x.misc.log4);
 528 }
 529
 530 int
 531 sctp_fill_stat_log(void *optval SCTP_UNUSED, size_t *optsize SCTP_UNUSED)
 532 {
 533         /* May need to fix this if ktrdump does not work */
 534         return (0);
 535 }
 536
 537 #ifdef SCTP_AUDITING_ENABLED
 538 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2];
 539 static int sctp_audit_indx = 0;
 540
 541 static
 542 void
 543 sctp_print_audit_report(void)
 544 {
 545         int i;
 546         int cnt;
 547
 548         cnt = 0;
 549         for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) {
 550                 if ((sctp_audit_data[i][0] == 0xe0) &&
 551                     (sctp_audit_data[i][1] == 0x01)) {
 552                         cnt = 0;
 553                         SCTP_PRINTF("\n");
 554                 } else if (sctp_audit_data[i][0] == 0xf0) {
 555                         cnt = 0;
 556                         SCTP_PRINTF("\n");
 557                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 558                     (sctp_audit_data[i][1] == 0x01)) {
 559                         SCTP_PRINTF("\n");
 560                         cnt = 0;
 561                 }
 562                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0],
 563                     (uint32_t)sctp_audit_data[i][1]);
 564                 cnt++;
 565                 if ((cnt % 14) == 0)
 566                         SCTP_PRINTF("\n");
 567         }
 568         for (i = 0; i < sctp_audit_indx; i++) {
 569                 if ((sctp_audit_data[i][0] == 0xe0) &&
 570                     (sctp_audit_data[i][1] == 0x01)) {
 571                         cnt = 0;
 572                         SCTP_PRINTF("\n");
 573                 } else if (sctp_audit_data[i][0] == 0xf0) {
 574                         cnt = 0;
 575                         SCTP_PRINTF("\n");
 576                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 577                     (sctp_audit_data[i][1] == 0x01)) {
 578                         SCTP_PRINTF("\n");
 579                         cnt = 0;
 580                 }
 581                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0],
 582                     (uint32_t)sctp_audit_data[i][1]);
 583                 cnt++;
 584                 if ((cnt % 14) == 0)
 585                         SCTP_PRINTF("\n");
 586         }
 587         SCTP_PRINTF("\n");
 588 }
 589
 590 void
 591 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 592     struct sctp_nets *net)
 593 {
 594         int resend_cnt, tot_out, rep, tot_book_cnt;
 595         struct sctp_nets *lnet;
 596         struct sctp_tmit_chunk *chk;
 597
 598         sctp_audit_data[sctp_audit_indx][0] = 0xAA;
 599         sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from;
 600         sctp_audit_indx++;
 601         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 602                 sctp_audit_indx = 0;
 603         }
 604         if (inp == NULL) {
 605                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 606                 sctp_audit_data[sctp_audit_indx][1] = 0x01;
 607                 sctp_audit_indx++;
 608                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 609                         sctp_audit_indx = 0;
 610                 }
 611                 return;
 612         }
 613         if (stcb == NULL) {
 614                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 615                 sctp_audit_data[sctp_audit_indx][1] = 0x02;
 616                 sctp_audit_indx++;
 617                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 618                         sctp_audit_indx = 0;
 619                 }
 620                 return;
 621         }
 622         sctp_audit_data[sctp_audit_indx][0] = 0xA1;
 623         sctp_audit_data[sctp_audit_indx][1] =
 624             (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 625         sctp_audit_indx++;
 626         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 627                 sctp_audit_indx = 0;
 628         }
 629         rep = 0;
 630         tot_book_cnt = 0;
 631         resend_cnt = tot_out = 0;
 632         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 633                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 634                         resend_cnt++;
 635                 } else if (chk->sent < SCTP_DATAGRAM_RESEND) {
 636                         tot_out += chk->book_size;
 637                         tot_book_cnt++;
 638                 }
 639         }
 640         if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) {
 641                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 642                 sctp_audit_data[sctp_audit_indx][1] = 0xA1;
 643                 sctp_audit_indx++;
 644                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 645                         sctp_audit_indx = 0;
 646                 }
 647                 SCTP_PRINTF("resend_cnt:%d asoc-tot:%d\n",
 648                     resend_cnt, stcb->asoc.sent_queue_retran_cnt);
 649                 rep = 1;
 650                 stcb->asoc.sent_queue_retran_cnt = resend_cnt;
 651                 sctp_audit_data[sctp_audit_indx][0] = 0xA2;
 652                 sctp_audit_data[sctp_audit_indx][1] =
 653                     (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 654                 sctp_audit_indx++;
 655                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 656                         sctp_audit_indx = 0;
 657                 }
 658         }
 659         if (tot_out != stcb->asoc.total_flight) {
 660                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 661                 sctp_audit_data[sctp_audit_indx][1] = 0xA2;
 662                 sctp_audit_indx++;
 663                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 664                         sctp_audit_indx = 0;
 665                 }
 666                 rep = 1;
 667                 SCTP_PRINTF("tot_flt:%d asoc_tot:%d\n", tot_out,
 668                     (int)stcb->asoc.total_flight);
 669                 stcb->asoc.total_flight = tot_out;
 670         }
 671         if (tot_book_cnt != stcb->asoc.total_flight_count) {
 672                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 673                 sctp_audit_data[sctp_audit_indx][1] = 0xA5;
 674                 sctp_audit_indx++;
 675                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 676                         sctp_audit_indx = 0;
 677                 }
 678                 rep = 1;
 679                 SCTP_PRINTF("tot_flt_book:%d\n", tot_book_cnt);
 680
 681                 stcb->asoc.total_flight_count = tot_book_cnt;
 682         }
 683         tot_out = 0;
 684         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 685                 tot_out += lnet->flight_size;
 686         }
 687         if (tot_out != stcb->asoc.total_flight) {
 688                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 689                 sctp_audit_data[sctp_audit_indx][1] = 0xA3;
 690                 sctp_audit_indx++;
 691                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 692                         sctp_audit_indx = 0;
 693                 }
 694                 rep = 1;
 695                 SCTP_PRINTF("real flight:%d net total was %d\n",
 696                     stcb->asoc.total_flight, tot_out);
 697                 /* now corrective action */
 698                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 699
 700                         tot_out = 0;
 701                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 702                                 if ((chk->whoTo == lnet) &&
 703                                     (chk->sent < SCTP_DATAGRAM_RESEND)) {
 704                                         tot_out += chk->book_size;
 705                                 }
 706                         }
 707                         if (lnet->flight_size != tot_out) {
 708                                 SCTP_PRINTF("net:%p flight was %d corrected to %d\n",
 709                                     (void *)lnet, lnet->flight_size,
 710                                     tot_out);
 711                                 lnet->flight_size = tot_out;
 712                         }
 713                 }
 714         }
 715         if (rep) {
 716                 sctp_print_audit_report();
 717         }
 718 }
 719
 720 void
 721 sctp_audit_log(uint8_t ev, uint8_t fd)
 722 {
 723
 724         sctp_audit_data[sctp_audit_indx][0] = ev;
 725         sctp_audit_data[sctp_audit_indx][1] = fd;
 726         sctp_audit_indx++;
 727         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 728                 sctp_audit_indx = 0;
 729         }
 730 }
 731
 732 #endif
 733
 734 /*
 735  * sctp_stop_timers_for_shutdown() should be called
 736  * when entering the SHUTDOWN_SENT or SHUTDOWN_ACK_SENT
 737  * state to make sure that all timers are stopped.
 738  */
 739 void
 740 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb)
 741 {
 742         struct sctp_association *asoc;
 743         struct sctp_nets *net;
 744
 745         asoc = &stcb->asoc;
 746
 747         (void)SCTP_OS_TIMER_STOP(&asoc->dack_timer.timer);
 748         (void)SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
 749         (void)SCTP_OS_TIMER_STOP(&asoc->asconf_timer.timer);
 750         (void)SCTP_OS_TIMER_STOP(&asoc->autoclose_timer.timer);
 751         (void)SCTP_OS_TIMER_STOP(&asoc->delayed_event_timer.timer);
 752         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
 753                 (void)SCTP_OS_TIMER_STOP(&net->pmtu_timer.timer);
 754                 (void)SCTP_OS_TIMER_STOP(&net->hb_timer.timer);
 755         }
 756 }
 757
 758 /*
 759  * A list of sizes based on typical mtu's, used only if next hop size not
 760  * returned. These values MUST be multiples of 4 and MUST be ordered.
 761  */
 762 static uint32_t sctp_mtu_sizes[] = {
 763         68,
 764         296,
 765         508,
 766         512,
 767         544,
 768         576,
 769         1004,
 770         1492,
 771         1500,
 772         1536,
 773         2000,
 774         2048,
 775         4352,
 776         4464,
 777         8166,
 778         17912,
 779         32000,
 780         65532
 781 };
 782
 783 /*
 784  * Return the largest MTU in sctp_mtu_sizes smaller than val.
 785  * If val is smaller than the minimum, just return the largest
 786  * multiple of 4 smaller or equal to val.
 787  * Ensure that the result is a multiple of 4.
 788  */
 789 uint32_t
 790 sctp_get_prev_mtu(uint32_t val)
 791 {
 792         uint32_t i;
 793
 794         val &= 0xfffffffc;
 795         if (val <= sctp_mtu_sizes[0]) {
 796                 return (val);
 797         }
 798         for (i = 1; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 799                 if (val <= sctp_mtu_sizes[i]) {
 800                         break;
 801                 }
 802         }
 803         KASSERT((sctp_mtu_sizes[i - 1] & 0x00000003) == 0,
 804             ("sctp_mtu_sizes[%u] not a multiple of 4", i - 1));
 805         return (sctp_mtu_sizes[i - 1]);
 806 }
 807
 808 /*
 809  * Return the smallest MTU in sctp_mtu_sizes larger than val.
 810  * If val is larger than the maximum, just return the largest multiple of 4 smaller
 811  * or equal to val.
 812  * Ensure that the result is a multiple of 4.
 813  */
 814 uint32_t
 815 sctp_get_next_mtu(uint32_t val)
 816 {
 817         /* select another MTU that is just bigger than this one */
 818         uint32_t i;
 819
 820         val &= 0xfffffffc;
 821         for (i = 0; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 822                 if (val < sctp_mtu_sizes[i]) {
 823                         KASSERT((sctp_mtu_sizes[i] & 0x00000003) == 0,
 824                             ("sctp_mtu_sizes[%u] not a multiple of 4", i));
 825                         return (sctp_mtu_sizes[i]);
 826                 }
 827         }
 828         return (val);
 829 }
 830
 831 void
 832 sctp_fill_random_store(struct sctp_pcb *m)
 833 {
 834         /*
 835          * Here we use the MD5/SHA-1 to hash with our good randomNumbers and
 836          * our counter. The result becomes our good random numbers and we
 837          * then setup to give these out. Note that we do no locking to
 838          * protect this. This is ok, since if competing folks call this we
 839          * will get more gobbled gook in the random store which is what we
 840          * want. There is a danger that two guys will use the same random
 841          * numbers, but thats ok too since that is random as well :->
 842          */
 843         m->store_at = 0;
 844         (void)sctp_hmac(SCTP_HMAC, (uint8_t *)m->random_numbers,
 845             sizeof(m->random_numbers), (uint8_t *)&m->random_counter,
 846             sizeof(m->random_counter), (uint8_t *)m->random_store);
 847         m->random_counter++;
 848 }
 849
 850 uint32_t
 851 sctp_select_initial_TSN(struct sctp_pcb *inp)
 852 {
 853         /*
 854          * A true implementation should use random selection process to get
 855          * the initial stream sequence number, using RFC1750 as a good
 856          * guideline
 857          */
 858         uint32_t x, *xp;
 859         uint8_t *p;
 860         int store_at, new_store;
 861
 862         if (inp->initial_sequence_debug != 0) {
 863                 uint32_t ret;
 864
 865                 ret = inp->initial_sequence_debug;
 866                 inp->initial_sequence_debug++;
 867                 return (ret);
 868         }
 869 retry:
 870         store_at = inp->store_at;
 871         new_store = store_at + sizeof(uint32_t);
 872         if (new_store >= (SCTP_SIGNATURE_SIZE - 3)) {
 873                 new_store = 0;
 874         }
 875         if (!atomic_cmpset_int(&inp->store_at, store_at, new_store)) {
 876                 goto retry;
 877         }
 878         if (new_store == 0) {
 879                 /* Refill the random store */
 880                 sctp_fill_random_store(inp);
 881         }
 882         p = &inp->random_store[store_at];
 883         xp = (uint32_t *)p;
 884         x = *xp;
 885         return (x);
 886 }
 887
 888 uint32_t
 889 sctp_select_a_tag(struct sctp_inpcb *inp, uint16_t lport, uint16_t rport, int check)
 890 {
 891         uint32_t x;
 892         struct timeval now;
 893
 894         if (check) {
 895                 (void)SCTP_GETTIME_TIMEVAL(&now);
 896         }
 897         for (;;) {
 898                 x = sctp_select_initial_TSN(&inp->sctp_ep);
 899                 if (x == 0) {
 900                         /* we never use 0 */
 901                         continue;
 902                 }
 903                 if (!check || sctp_is_vtag_good(x, lport, rport, &now)) {
 904                         break;
 905                 }
 906         }
 907         return (x);
 908 }
 909
 910 int32_t
 911 sctp_map_assoc_state(int kernel_state)
 912 {
 913         int32_t user_state;
 914
 915         if (kernel_state & SCTP_STATE_WAS_ABORTED) {
 916                 user_state = SCTP_CLOSED;
 917         } else if (kernel_state & SCTP_STATE_SHUTDOWN_PENDING) {
 918                 user_state = SCTP_SHUTDOWN_PENDING;
 919         } else {
 920                 switch (kernel_state & SCTP_STATE_MASK) {
 921                 case SCTP_STATE_EMPTY:
 922                         user_state = SCTP_CLOSED;
 923                         break;
 924                 case SCTP_STATE_INUSE:
 925                         user_state = SCTP_CLOSED;
 926                         break;
 927                 case SCTP_STATE_COOKIE_WAIT:
 928                         user_state = SCTP_COOKIE_WAIT;
 929                         break;
 930                 case SCTP_STATE_COOKIE_ECHOED:
 931                         user_state = SCTP_COOKIE_ECHOED;
 932                         break;
 933                 case SCTP_STATE_OPEN:
 934                         user_state = SCTP_ESTABLISHED;
 935                         break;
 936                 case SCTP_STATE_SHUTDOWN_SENT:
 937                         user_state = SCTP_SHUTDOWN_SENT;
 938                         break;
 939                 case SCTP_STATE_SHUTDOWN_RECEIVED:
 940                         user_state = SCTP_SHUTDOWN_RECEIVED;
 941                         break;
 942                 case SCTP_STATE_SHUTDOWN_ACK_SENT:
 943                         user_state = SCTP_SHUTDOWN_ACK_SENT;
 944                         break;
 945                 default:
 946                         user_state = SCTP_CLOSED;
 947                         break;
 948                 }
 949         }
 950         return (user_state);
 951 }
 952
 953 int
 954 sctp_init_asoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 955     uint32_t override_tag, uint32_t vrf_id, uint16_t o_strms)
 956 {
 957         struct sctp_association *asoc;
 958
 959         /*
 960          * Anything set to zero is taken care of by the allocation routine's
 961          * bzero
 962          */
 963
 964         /*
 965          * Up front select what scoping to apply on addresses I tell my peer
 966          * Not sure what to do with these right now, we will need to come up
 967          * with a way to set them. We may need to pass them through from the
 968          * caller in the sctp_aloc_assoc() function.
 969          */
 970         int i;
 971 #if defined(SCTP_DETAILED_STR_STATS)
 972         int j;
 973 #endif
 974
 975         asoc = &stcb->asoc;
 976         /* init all variables to a known value. */
 977         SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_INUSE);
 978         asoc->max_burst = inp->sctp_ep.max_burst;
 979         asoc->fr_max_burst = inp->sctp_ep.fr_max_burst;
 980         asoc->heart_beat_delay = TICKS_TO_MSEC(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]);
 981         asoc->cookie_life = inp->sctp_ep.def_cookie_life;
 982         asoc->sctp_cmt_on_off = inp->sctp_cmt_on_off;
 983         asoc->ecn_supported = inp->ecn_supported;
 984         asoc->prsctp_supported = inp->prsctp_supported;
 985         asoc->idata_supported = inp->idata_supported;
 986         asoc->auth_supported = inp->auth_supported;
 987         asoc->asconf_supported = inp->asconf_supported;
 988         asoc->reconfig_supported = inp->reconfig_supported;
 989         asoc->nrsack_supported = inp->nrsack_supported;
 990         asoc->pktdrop_supported = inp->pktdrop_supported;
 991         asoc->idata_supported = inp->idata_supported;
 992         asoc->sctp_cmt_pf = (uint8_t)0;
 993         asoc->sctp_frag_point = inp->sctp_frag_point;
 994         asoc->sctp_features = inp->sctp_features;
 995         asoc->default_dscp = inp->sctp_ep.default_dscp;
 996         asoc->max_cwnd = inp->max_cwnd;
 997 #ifdef INET6
 998         if (inp->sctp_ep.default_flowlabel) {
 999                 asoc->default_flowlabel = inp->sctp_ep.default_flowlabel;
1000         } else {
1001                 if (inp->ip_inp.inp.inp_flags & IN6P_AUTOFLOWLABEL) {
1002                         asoc->default_flowlabel = sctp_select_initial_TSN(&inp->sctp_ep);
1003                         asoc->default_flowlabel &= 0x000fffff;
1004                         asoc->default_flowlabel |= 0x80000000;
1005                 } else {
1006                         asoc->default_flowlabel = 0;
1007                 }
1008         }
1009 #endif
1010         asoc->sb_send_resv = 0;
1011         if (override_tag) {
1012                 asoc->my_vtag = override_tag;
1013         } else {
1014                 asoc->my_vtag = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
1015         }
1016         /* Get the nonce tags */
1017         asoc->my_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
1018         asoc->peer_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
1019         asoc->vrf_id = vrf_id;
1020
1021 #ifdef SCTP_ASOCLOG_OF_TSNS
1022         asoc->tsn_in_at = 0;
1023         asoc->tsn_out_at = 0;
1024         asoc->tsn_in_wrapped = 0;
1025         asoc->tsn_out_wrapped = 0;
1026         asoc->cumack_log_at = 0;
1027         asoc->cumack_log_atsnt = 0;
1028 #endif
1029 #ifdef SCTP_FS_SPEC_LOG
1030         asoc->fs_index = 0;
1031 #endif
1032         asoc->refcnt = 0;
1033         asoc->assoc_up_sent = 0;
1034         asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number = asoc->sending_seq =
1035             sctp_select_initial_TSN(&inp->sctp_ep);
1036         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
1037         /* we are optimisitic here */
1038         asoc->peer_supports_nat = 0;
1039         asoc->sent_queue_retran_cnt = 0;
1040
1041         /* for CMT */
1042         asoc->last_net_cmt_send_started = NULL;
1043
1044         /* This will need to be adjusted */
1045         asoc->last_acked_seq = asoc->init_seq_number - 1;
1046         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1047         asoc->asconf_seq_in = asoc->last_acked_seq;
1048
1049         /* here we are different, we hold the next one we expect */
1050         asoc->str_reset_seq_in = asoc->last_acked_seq + 1;
1051
1052         asoc->initial_init_rto_max = inp->sctp_ep.initial_init_rto_max;
1053         asoc->initial_rto = inp->sctp_ep.initial_rto;
1054
1055         asoc->default_mtu = inp->sctp_ep.default_mtu;
1056         asoc->max_init_times = inp->sctp_ep.max_init_times;
1057         asoc->max_send_times = inp->sctp_ep.max_send_times;
1058         asoc->def_net_failure = inp->sctp_ep.def_net_failure;
1059         asoc->def_net_pf_threshold = inp->sctp_ep.def_net_pf_threshold;
1060         asoc->free_chunk_cnt = 0;
1061
1062         asoc->iam_blocking = 0;
1063         asoc->context = inp->sctp_context;
1064         asoc->local_strreset_support = inp->local_strreset_support;
1065         asoc->def_send = inp->def_send;
1066         asoc->delayed_ack = TICKS_TO_MSEC(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]);
1067         asoc->sack_freq = inp->sctp_ep.sctp_sack_freq;
1068         asoc->pr_sctp_cnt = 0;
1069         asoc->total_output_queue_size = 0;
1070
1071         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1072                 asoc->scope.ipv6_addr_legal = 1;
1073                 if (SCTP_IPV6_V6ONLY(inp) == 0) {
1074                         asoc->scope.ipv4_addr_legal = 1;
1075                 } else {
1076                         asoc->scope.ipv4_addr_legal = 0;
1077                 }
1078         } else {
1079                 asoc->scope.ipv6_addr_legal = 0;
1080                 asoc->scope.ipv4_addr_legal = 1;
1081         }
1082
1083         asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(inp->sctp_socket), SCTP_MINIMAL_RWND);
1084         asoc->peers_rwnd = SCTP_SB_LIMIT_RCV(inp->sctp_socket);
1085
1086         asoc->smallest_mtu = inp->sctp_frag_point;
1087         asoc->minrto = inp->sctp_ep.sctp_minrto;
1088         asoc->maxrto = inp->sctp_ep.sctp_maxrto;
1089
1090         asoc->stream_locked_on = 0;
1091         asoc->ecn_echo_cnt_onq = 0;
1092         asoc->stream_locked = 0;
1093
1094         asoc->send_sack = 1;
1095
1096         LIST_INIT(&asoc->sctp_restricted_addrs);
1097
1098         TAILQ_INIT(&asoc->nets);
1099         TAILQ_INIT(&asoc->pending_reply_queue);
1100         TAILQ_INIT(&asoc->asconf_ack_sent);
1101         /* Setup to fill the hb random cache at first HB */
1102         asoc->hb_random_idx = 4;
1103
1104         asoc->sctp_autoclose_ticks = inp->sctp_ep.auto_close_time;
1105
1106         stcb->asoc.congestion_control_module = inp->sctp_ep.sctp_default_cc_module;
1107         stcb->asoc.cc_functions = sctp_cc_functions[inp->sctp_ep.sctp_default_cc_module];
1108
1109         stcb->asoc.stream_scheduling_module = inp->sctp_ep.sctp_default_ss_module;
1110         stcb->asoc.ss_functions = sctp_ss_functions[inp->sctp_ep.sctp_default_ss_module];
1111
1112         /*
1113          * Now the stream parameters, here we allocate space for all streams
1114          * that we request by default.
1115          */
1116         asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams =
1117             o_strms;
1118         SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *,
1119             asoc->streamoutcnt * sizeof(struct sctp_stream_out),
1120             SCTP_M_STRMO);
1121         if (asoc->strmout == NULL) {
1122                 /* big trouble no memory */
1123                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1124                 return (ENOMEM);
1125         }
1126         for (i = 0; i < asoc->streamoutcnt; i++) {
1127                 /*
1128                  * inbound side must be set to 0xffff, also NOTE when we get
1129                  * the INIT-ACK back (for INIT sender) we MUST reduce the
1130                  * count (streamoutcnt) but first check if we sent to any of
1131                  * the upper streams that were dropped (if some were). Those
1132                  * that were dropped must be notified to the upper layer as
1133                  * failed to send.
1134                  */
1135                 asoc->strmout[i].next_mid_ordered = 0;
1136                 asoc->strmout[i].next_mid_unordered = 0;
1137                 TAILQ_INIT(&asoc->strmout[i].outqueue);
1138                 asoc->strmout[i].chunks_on_queues = 0;
1139 #if defined(SCTP_DETAILED_STR_STATS)
1140                 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) {
1141                         asoc->strmout[i].abandoned_sent[j] = 0;
1142                         asoc->strmout[i].abandoned_unsent[j] = 0;
1143                 }
1144 #else
1145                 asoc->strmout[i].abandoned_sent[0] = 0;
1146                 asoc->strmout[i].abandoned_unsent[0] = 0;
1147 #endif
1148                 asoc->strmout[i].sid = i;
1149                 asoc->strmout[i].last_msg_incomplete = 0;
1150                 asoc->strmout[i].state = SCTP_STREAM_OPENING;
1151                 asoc->ss_functions.sctp_ss_init_stream(stcb, &asoc->strmout[i], NULL);
1152         }
1153         asoc->ss_functions.sctp_ss_init(stcb, asoc, 0);
1154
1155         /* Now the mapping array */
1156         asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY;
1157         SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size,
1158             SCTP_M_MAP);
1159         if (asoc->mapping_array == NULL) {
1160                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1161                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1162                 return (ENOMEM);
1163         }
1164         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
1165         SCTP_MALLOC(asoc->nr_mapping_array, uint8_t *, asoc->mapping_array_size,
1166             SCTP_M_MAP);
1167         if (asoc->nr_mapping_array == NULL) {
1168                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1169                 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1170                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1171                 return (ENOMEM);
1172         }
1173         memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
1174
1175         /* Now the init of the other outqueues */
1176         TAILQ_INIT(&asoc->free_chunks);
1177         TAILQ_INIT(&asoc->control_send_queue);
1178         TAILQ_INIT(&asoc->asconf_send_queue);
1179         TAILQ_INIT(&asoc->send_queue);
1180         TAILQ_INIT(&asoc->sent_queue);
1181         TAILQ_INIT(&asoc->resetHead);
1182         asoc->max_inbound_streams = inp->sctp_ep.max_open_streams_intome;
1183         TAILQ_INIT(&asoc->asconf_queue);
1184         /* authentication fields */
1185         asoc->authinfo.random = NULL;
1186         asoc->authinfo.active_keyid = 0;
1187         asoc->authinfo.assoc_key = NULL;
1188         asoc->authinfo.assoc_keyid = 0;
1189         asoc->authinfo.recv_key = NULL;
1190         asoc->authinfo.recv_keyid = 0;
1191         LIST_INIT(&asoc->shared_keys);
1192         asoc->marked_retrans = 0;
1193         asoc->port = inp->sctp_ep.port;
1194         asoc->timoinit = 0;
1195         asoc->timodata = 0;
1196         asoc->timosack = 0;
1197         asoc->timoshutdown = 0;
1198         asoc->timoheartbeat = 0;
1199         asoc->timocookie = 0;
1200         asoc->timoshutdownack = 0;
1201         (void)SCTP_GETTIME_TIMEVAL(&asoc->start_time);
1202         asoc->discontinuity_time = asoc->start_time;
1203         for (i = 0; i < SCTP_PR_SCTP_MAX + 1; i++) {
1204                 asoc->abandoned_unsent[i] = 0;
1205                 asoc->abandoned_sent[i] = 0;
1206         }
1207         /*
1208          * sa_ignore MEMLEAK {memory is put in the assoc mapping array and
1209          * freed later when the association is freed.
1210          */
1211         return (0);
1212 }
1213
1214 void
1215 sctp_print_mapping_array(struct sctp_association *asoc)
1216 {
1217         unsigned int i, limit;
1218
1219         SCTP_PRINTF("Mapping array size: %d, baseTSN: %8.8x, cumAck: %8.8x, highestTSN: (%8.8x, %8.8x).\n",
1220             asoc->mapping_array_size,
1221             asoc->mapping_array_base_tsn,
1222             asoc->cumulative_tsn,
1223             asoc->highest_tsn_inside_map,
1224             asoc->highest_tsn_inside_nr_map);
1225         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1226                 if (asoc->mapping_array[limit - 1] != 0) {
1227                         break;
1228                 }
1229         }
1230         SCTP_PRINTF("Renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1231         for (i = 0; i < limit; i++) {
1232                 SCTP_PRINTF("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1233         }
1234         if (limit % 16)
1235                 SCTP_PRINTF("\n");
1236         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1237                 if (asoc->nr_mapping_array[limit - 1]) {
1238                         break;
1239                 }
1240         }
1241         SCTP_PRINTF("Non renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1242         for (i = 0; i < limit; i++) {
1243                 SCTP_PRINTF("%2.2x%c", asoc->nr_mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1244         }
1245         if (limit % 16)
1246                 SCTP_PRINTF("\n");
1247 }
1248
1249 int
1250 sctp_expand_mapping_array(struct sctp_association *asoc, uint32_t needed)
1251 {
1252         /* mapping array needs to grow */
1253         uint8_t *new_array1, *new_array2;
1254         uint32_t new_size;
1255
1256         new_size = asoc->mapping_array_size + ((needed + 7) / 8 + SCTP_MAPPING_ARRAY_INCR);
1257         SCTP_MALLOC(new_array1, uint8_t *, new_size, SCTP_M_MAP);
1258         SCTP_MALLOC(new_array2, uint8_t *, new_size, SCTP_M_MAP);
1259         if ((new_array1 == NULL) || (new_array2 == NULL)) {
1260                 /* can't get more, forget it */
1261                 SCTP_PRINTF("No memory for expansion of SCTP mapping array %d\n", new_size);
1262                 if (new_array1) {
1263                         SCTP_FREE(new_array1, SCTP_M_MAP);
1264                 }
1265                 if (new_array2) {
1266                         SCTP_FREE(new_array2, SCTP_M_MAP);
1267                 }
1268                 return (-1);
1269         }
1270         memset(new_array1, 0, new_size);
1271         memset(new_array2, 0, new_size);
1272         memcpy(new_array1, asoc->mapping_array, asoc->mapping_array_size);
1273         memcpy(new_array2, asoc->nr_mapping_array, asoc->mapping_array_size);
1274         SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1275         SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
1276         asoc->mapping_array = new_array1;
1277         asoc->nr_mapping_array = new_array2;
1278         asoc->mapping_array_size = new_size;
1279         return (0);
1280 }
1281
1282
1283 static void
1284 sctp_iterator_work(struct sctp_iterator *it)
1285 {
1286         int iteration_count = 0;
1287         int inp_skip = 0;
1288         int first_in = 1;
1289         struct sctp_inpcb *tinp;
1290
1291         SCTP_INP_INFO_RLOCK();
1292         SCTP_ITERATOR_LOCK();
1293         sctp_it_ctl.cur_it = it;
1294         if (it->inp) {
1295                 SCTP_INP_RLOCK(it->inp);
1296                 SCTP_INP_DECR_REF(it->inp);
1297         }
1298         if (it->inp == NULL) {
1299                 /* iterator is complete */
1300 done_with_iterator:
1301                 sctp_it_ctl.cur_it = NULL;
1302                 SCTP_ITERATOR_UNLOCK();
1303                 SCTP_INP_INFO_RUNLOCK();
1304                 if (it->function_atend != NULL) {
1305                         (*it->function_atend) (it->pointer, it->val);
1306                 }
1307                 SCTP_FREE(it, SCTP_M_ITER);
1308                 return;
1309         }
1310 select_a_new_ep:
1311         if (first_in) {
1312                 first_in = 0;
1313         } else {
1314                 SCTP_INP_RLOCK(it->inp);
1315         }
1316         while (((it->pcb_flags) &&
1317             ((it->inp->sctp_flags & it->pcb_flags) != it->pcb_flags)) ||
1318             ((it->pcb_features) &&
1319             ((it->inp->sctp_features & it->pcb_features) != it->pcb_features))) {
1320                 /* endpoint flags or features don't match, so keep looking */
1321                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1322                         SCTP_INP_RUNLOCK(it->inp);
1323                         goto done_with_iterator;
1324                 }
1325                 tinp = it->inp;
1326                 it->inp = LIST_NEXT(it->inp, sctp_list);
1327                 SCTP_INP_RUNLOCK(tinp);
1328                 if (it->inp == NULL) {
1329                         goto done_with_iterator;
1330                 }
1331                 SCTP_INP_RLOCK(it->inp);
1332         }
1333         /* now go through each assoc which is in the desired state */
1334         if (it->done_current_ep == 0) {
1335                 if (it->function_inp != NULL)
1336                         inp_skip = (*it->function_inp) (it->inp, it->pointer, it->val);
1337                 it->done_current_ep = 1;
1338         }
1339         if (it->stcb == NULL) {
1340                 /* run the per instance function */
1341                 it->stcb = LIST_FIRST(&it->inp->sctp_asoc_list);
1342         }
1343         if ((inp_skip) || it->stcb == NULL) {
1344                 if (it->function_inp_end != NULL) {
1345                         inp_skip = (*it->function_inp_end) (it->inp,
1346                             it->pointer,
1347                             it->val);
1348                 }
1349                 SCTP_INP_RUNLOCK(it->inp);
1350                 goto no_stcb;
1351         }
1352         while (it->stcb) {
1353                 SCTP_TCB_LOCK(it->stcb);
1354                 if (it->asoc_state && ((it->stcb->asoc.state & it->asoc_state) != it->asoc_state)) {
1355                         /* not in the right state... keep looking */
1356                         SCTP_TCB_UNLOCK(it->stcb);
1357                         goto next_assoc;
1358                 }
1359                 /* see if we have limited out the iterator loop */
1360                 iteration_count++;
1361                 if (iteration_count > SCTP_ITERATOR_MAX_AT_ONCE) {
1362                         /* Pause to let others grab the lock */
1363                         atomic_add_int(&it->stcb->asoc.refcnt, 1);
1364                         SCTP_TCB_UNLOCK(it->stcb);
1365                         SCTP_INP_INCR_REF(it->inp);
1366                         SCTP_INP_RUNLOCK(it->inp);
1367                         SCTP_ITERATOR_UNLOCK();
1368                         SCTP_INP_INFO_RUNLOCK();
1369                         SCTP_INP_INFO_RLOCK();
1370                         SCTP_ITERATOR_LOCK();
1371                         if (sctp_it_ctl.iterator_flags) {
1372                                 /* We won't be staying here */
1373                                 SCTP_INP_DECR_REF(it->inp);
1374                                 atomic_add_int(&it->stcb->asoc.refcnt, -1);
1375                                 if (sctp_it_ctl.iterator_flags &
1376                                     SCTP_ITERATOR_STOP_CUR_IT) {
1377                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_IT;
1378                                         goto done_with_iterator;
1379                                 }
1380                                 if (sctp_it_ctl.iterator_flags &
1381                                     SCTP_ITERATOR_STOP_CUR_INP) {
1382                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_INP;
1383                                         goto no_stcb;
1384                                 }
1385                                 /* If we reach here huh? */
1386                                 SCTP_PRINTF("Unknown it ctl flag %x\n",
1387                                     sctp_it_ctl.iterator_flags);
1388                                 sctp_it_ctl.iterator_flags = 0;
1389                         }
1390                         SCTP_INP_RLOCK(it->inp);
1391                         SCTP_INP_DECR_REF(it->inp);
1392                         SCTP_TCB_LOCK(it->stcb);
1393                         atomic_add_int(&it->stcb->asoc.refcnt, -1);
1394                         iteration_count = 0;
1395                 }
1396                 /* run function on this one */
1397                 (*it->function_assoc) (it->inp, it->stcb, it->pointer, it->val);
1398
1399                 /*
1400                  * we lie here, it really needs to have its own type but
1401                  * first I must verify that this won't effect things :-0
1402                  */
1403                 if (it->no_chunk_output == 0)
1404                         sctp_chunk_output(it->inp, it->stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1405
1406                 SCTP_TCB_UNLOCK(it->stcb);
1407 next_assoc:
1408                 it->stcb = LIST_NEXT(it->stcb, sctp_tcblist);
1409                 if (it->stcb == NULL) {
1410                         /* Run last function */
1411                         if (it->function_inp_end != NULL) {
1412                                 inp_skip = (*it->function_inp_end) (it->inp,
1413                                     it->pointer,
1414                                     it->val);
1415                         }
1416                 }
1417         }
1418         SCTP_INP_RUNLOCK(it->inp);
1419 no_stcb:
1420         /* done with all assocs on this endpoint, move on to next endpoint */
1421         it->done_current_ep = 0;
1422         if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1423                 it->inp = NULL;
1424         } else {
1425                 it->inp = LIST_NEXT(it->inp, sctp_list);
1426         }
1427         if (it->inp == NULL) {
1428                 goto done_with_iterator;
1429         }
1430         goto select_a_new_ep;
1431 }
1432
1433 void
1434 sctp_iterator_worker(void)
1435 {
1436         struct sctp_iterator *it, *nit;
1437
1438         /* This function is called with the WQ lock in place */
1439
1440         sctp_it_ctl.iterator_running = 1;
1441         TAILQ_FOREACH_SAFE(it, &sctp_it_ctl.iteratorhead, sctp_nxt_itr, nit) {
1442                 /* now lets work on this one */
1443                 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
1444                 SCTP_IPI_ITERATOR_WQ_UNLOCK();
1445                 CURVNET_SET(it->vn);
1446                 sctp_iterator_work(it);
1447                 CURVNET_RESTORE();
1448                 SCTP_IPI_ITERATOR_WQ_LOCK();
1449                 /* sa_ignore FREED_MEMORY */
1450         }
1451         sctp_it_ctl.iterator_running = 0;
1452         return;
1453 }
1454
1455
1456 static void
1457 sctp_handle_addr_wq(void)
1458 {
1459         /* deal with the ADDR wq from the rtsock calls */
1460         struct sctp_laddr *wi, *nwi;
1461         struct sctp_asconf_iterator *asc;
1462
1463         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
1464             sizeof(struct sctp_asconf_iterator), SCTP_M_ASC_IT);
1465         if (asc == NULL) {
1466                 /* Try later, no memory */
1467                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
1468                     (struct sctp_inpcb *)NULL,
1469                     (struct sctp_tcb *)NULL,
1470                     (struct sctp_nets *)NULL);
1471                 return;
1472         }
1473         LIST_INIT(&asc->list_of_work);
1474         asc->cnt = 0;
1475
1476         LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) {
1477                 LIST_REMOVE(wi, sctp_nxt_addr);
1478                 LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
1479                 asc->cnt++;
1480         }
1481
1482         if (asc->cnt == 0) {
1483                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1484         } else {
1485                 int ret;
1486
1487                 ret = sctp_initiate_iterator(sctp_asconf_iterator_ep,
1488                     sctp_asconf_iterator_stcb,
1489                     NULL,       /* No ep end for boundall */
1490                     SCTP_PCB_FLAGS_BOUNDALL,
1491                     SCTP_PCB_ANY_FEATURES,
1492                     SCTP_ASOC_ANY_STATE,
1493                     (void *)asc, 0,
1494                     sctp_asconf_iterator_end, NULL, 0);
1495                 if (ret) {
1496                         SCTP_PRINTF("Failed to initiate iterator for handle_addr_wq\n");
1497                         /*
1498                          * Freeing if we are stopping or put back on the
1499                          * addr_wq.
1500                          */
1501                         if (SCTP_BASE_VAR(sctp_pcb_initialized) == 0) {
1502                                 sctp_asconf_iterator_end(asc, 0);
1503                         } else {
1504                                 LIST_FOREACH(wi, &asc->list_of_work, sctp_nxt_addr) {
1505                                         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
1506                                 }
1507                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1508                         }
1509                 }
1510         }
1511 }
1512
1513 void
1514 sctp_timeout_handler(void *t)
1515 {
1516         struct sctp_inpcb *inp;
1517         struct sctp_tcb *stcb;
1518         struct sctp_nets *net;
1519         struct sctp_timer *tmr;
1520         struct mbuf *op_err;
1521 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1522         struct socket *so;
1523 #endif
1524         int did_output;
1525         int type;
1526
1527         tmr = (struct sctp_timer *)t;
1528         inp = (struct sctp_inpcb *)tmr->ep;
1529         stcb = (struct sctp_tcb *)tmr->tcb;
1530         net = (struct sctp_nets *)tmr->net;
1531         CURVNET_SET((struct vnet *)tmr->vnet);
1532         did_output = 1;
1533
1534 #ifdef SCTP_AUDITING_ENABLED
1535         sctp_audit_log(0xF0, (uint8_t)tmr->type);
1536         sctp_auditing(3, inp, stcb, net);
1537 #endif
1538
1539         /* sanity checks... */
1540         if (tmr->self != (void *)tmr) {
1541                 /*
1542                  * SCTP_PRINTF("Stale SCTP timer fired (%p), ignoring...\n",
1543                  * (void *)tmr);
1544                  */
1545                 CURVNET_RESTORE();
1546                 return;
1547         }
1548         tmr->stopped_from = 0xa001;
1549         if (!SCTP_IS_TIMER_TYPE_VALID(tmr->type)) {
1550                 /*
1551                  * SCTP_PRINTF("SCTP timer fired with invalid type: 0x%x\n",
1552                  * tmr->type);
1553                  */
1554                 CURVNET_RESTORE();
1555                 return;
1556         }
1557         tmr->stopped_from = 0xa002;
1558         if ((tmr->type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL)) {
1559                 CURVNET_RESTORE();
1560                 return;
1561         }
1562         /* if this is an iterator timeout, get the struct and clear inp */
1563         tmr->stopped_from = 0xa003;
1564         if (inp) {
1565                 SCTP_INP_INCR_REF(inp);
1566                 if ((inp->sctp_socket == NULL) &&
1567                     ((tmr->type != SCTP_TIMER_TYPE_INPKILL) &&
1568                     (tmr->type != SCTP_TIMER_TYPE_INIT) &&
1569                     (tmr->type != SCTP_TIMER_TYPE_SEND) &&
1570                     (tmr->type != SCTP_TIMER_TYPE_RECV) &&
1571                     (tmr->type != SCTP_TIMER_TYPE_HEARTBEAT) &&
1572                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWN) &&
1573                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNACK) &&
1574                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNGUARD) &&
1575                     (tmr->type != SCTP_TIMER_TYPE_ASOCKILL))) {
1576                         SCTP_INP_DECR_REF(inp);
1577                         CURVNET_RESTORE();
1578                         return;
1579                 }
1580         }
1581         tmr->stopped_from = 0xa004;
1582         if (stcb) {
1583                 atomic_add_int(&stcb->asoc.refcnt, 1);
1584                 if (stcb->asoc.state == 0) {
1585                         atomic_add_int(&stcb->asoc.refcnt, -1);
1586                         if (inp) {
1587                                 SCTP_INP_DECR_REF(inp);
1588                         }
1589                         CURVNET_RESTORE();
1590                         return;
1591                 }
1592         }
1593         type = tmr->type;
1594         tmr->stopped_from = 0xa005;
1595         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer type %d goes off\n", type);
1596         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1597                 if (inp) {
1598                         SCTP_INP_DECR_REF(inp);
1599                 }
1600                 if (stcb) {
1601                         atomic_add_int(&stcb->asoc.refcnt, -1);
1602                 }
1603                 CURVNET_RESTORE();
1604                 return;
1605         }
1606         tmr->stopped_from = 0xa006;
1607
1608         if (stcb) {
1609                 SCTP_TCB_LOCK(stcb);
1610                 atomic_add_int(&stcb->asoc.refcnt, -1);
1611                 if ((type != SCTP_TIMER_TYPE_ASOCKILL) &&
1612                     ((stcb->asoc.state == 0) ||
1613                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED))) {
1614                         SCTP_TCB_UNLOCK(stcb);
1615                         if (inp) {
1616                                 SCTP_INP_DECR_REF(inp);
1617                         }
1618                         CURVNET_RESTORE();
1619                         return;
1620                 }
1621         } else if (inp != NULL) {
1622                 if (type != SCTP_TIMER_TYPE_INPKILL) {
1623                         SCTP_INP_WLOCK(inp);
1624                 }
1625         } else {
1626                 SCTP_WQ_ADDR_LOCK();
1627         }
1628         /* record in stopped what t-o occurred */
1629         tmr->stopped_from = type;
1630
1631         /* mark as being serviced now */
1632         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
1633                 /*
1634                  * Callout has been rescheduled.
1635                  */
1636                 goto get_out;
1637         }
1638         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1639                 /*
1640                  * Not active, so no action.
1641                  */
1642                 goto get_out;
1643         }
1644         SCTP_OS_TIMER_DEACTIVATE(&tmr->timer);
1645
1646         /* call the handler for the appropriate timer type */
1647         switch (type) {
1648         case SCTP_TIMER_TYPE_ADDR_WQ:
1649                 sctp_handle_addr_wq();
1650                 break;
1651         case SCTP_TIMER_TYPE_SEND:
1652                 if ((stcb == NULL) || (inp == NULL)) {
1653                         break;
1654                 }
1655                 SCTP_STAT_INCR(sctps_timodata);
1656                 stcb->asoc.timodata++;
1657                 stcb->asoc.num_send_timers_up--;
1658                 if (stcb->asoc.num_send_timers_up < 0) {
1659                         stcb->asoc.num_send_timers_up = 0;
1660                 }
1661                 SCTP_TCB_LOCK_ASSERT(stcb);
1662                 if (sctp_t3rxt_timer(inp, stcb, net)) {
1663                         /* no need to unlock on tcb its gone */
1664
1665                         goto out_decr;
1666                 }
1667                 SCTP_TCB_LOCK_ASSERT(stcb);
1668 #ifdef SCTP_AUDITING_ENABLED
1669                 sctp_auditing(4, inp, stcb, net);
1670 #endif
1671                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1672                 if ((stcb->asoc.num_send_timers_up == 0) &&
1673                     (stcb->asoc.sent_queue_cnt > 0)) {
1674                         struct sctp_tmit_chunk *chk;
1675
1676                         /*
1677                          * safeguard. If there on some on the sent queue
1678                          * somewhere but no timers running something is
1679                          * wrong... so we start a timer on the first chunk
1680                          * on the send queue on whatever net it is sent to.
1681                          */
1682                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1683                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb,
1684                             chk->whoTo);
1685                 }
1686                 break;
1687         case SCTP_TIMER_TYPE_INIT:
1688                 if ((stcb == NULL) || (inp == NULL)) {
1689                         break;
1690                 }
1691                 SCTP_STAT_INCR(sctps_timoinit);
1692                 stcb->asoc.timoinit++;
1693                 if (sctp_t1init_timer(inp, stcb, net)) {
1694                         /* no need to unlock on tcb its gone */
1695                         goto out_decr;
1696                 }
1697                 /* We do output but not here */
1698                 did_output = 0;
1699                 break;
1700         case SCTP_TIMER_TYPE_RECV:
1701                 if ((stcb == NULL) || (inp == NULL)) {
1702                         break;
1703                 }
1704                 SCTP_STAT_INCR(sctps_timosack);
1705                 stcb->asoc.timosack++;
1706                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
1707 #ifdef SCTP_AUDITING_ENABLED
1708                 sctp_auditing(4, inp, stcb, net);
1709 #endif
1710                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR, SCTP_SO_NOT_LOCKED);
1711                 break;
1712         case SCTP_TIMER_TYPE_SHUTDOWN:
1713                 if ((stcb == NULL) || (inp == NULL)) {
1714                         break;
1715                 }
1716                 if (sctp_shutdown_timer(inp, stcb, net)) {
1717                         /* no need to unlock on tcb its gone */
1718                         goto out_decr;
1719                 }
1720                 SCTP_STAT_INCR(sctps_timoshutdown);
1721                 stcb->asoc.timoshutdown++;
1722 #ifdef SCTP_AUDITING_ENABLED
1723                 sctp_auditing(4, inp, stcb, net);
1724 #endif
1725                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_NOT_LOCKED);
1726                 break;
1727         case SCTP_TIMER_TYPE_HEARTBEAT:
1728                 if ((stcb == NULL) || (inp == NULL) || (net == NULL)) {
1729                         break;
1730                 }
1731                 SCTP_STAT_INCR(sctps_timoheartbeat);
1732                 stcb->asoc.timoheartbeat++;
1733                 if (sctp_heartbeat_timer(inp, stcb, net)) {
1734                         /* no need to unlock on tcb its gone */
1735                         goto out_decr;
1736                 }
1737 #ifdef SCTP_AUDITING_ENABLED
1738                 sctp_auditing(4, inp, stcb, net);
1739 #endif
1740                 if (!(net->dest_state & SCTP_ADDR_NOHB)) {
1741                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net);
1742                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR, SCTP_SO_NOT_LOCKED);
1743                 }
1744                 break;
1745         case SCTP_TIMER_TYPE_COOKIE:
1746                 if ((stcb == NULL) || (inp == NULL)) {
1747                         break;
1748                 }
1749                 if (sctp_cookie_timer(inp, stcb, net)) {
1750                         /* no need to unlock on tcb its gone */
1751                         goto out_decr;
1752                 }
1753                 SCTP_STAT_INCR(sctps_timocookie);
1754                 stcb->asoc.timocookie++;
1755 #ifdef SCTP_AUDITING_ENABLED
1756                 sctp_auditing(4, inp, stcb, net);
1757 #endif
1758                 /*
1759                  * We consider T3 and Cookie timer pretty much the same with
1760                  * respect to where from in chunk_output.
1761                  */
1762                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1763                 break;
1764         case SCTP_TIMER_TYPE_NEWCOOKIE:
1765                 {
1766                         struct timeval tv;
1767                         int i, secret;
1768
1769                         if (inp == NULL) {
1770                                 break;
1771                         }
1772                         SCTP_STAT_INCR(sctps_timosecret);
1773                         (void)SCTP_GETTIME_TIMEVAL(&tv);
1774                         inp->sctp_ep.time_of_secret_change = tv.tv_sec;
1775                         inp->sctp_ep.last_secret_number =
1776                             inp->sctp_ep.current_secret_number;
1777                         inp->sctp_ep.current_secret_number++;
1778                         if (inp->sctp_ep.current_secret_number >=
1779                             SCTP_HOW_MANY_SECRETS) {
1780                                 inp->sctp_ep.current_secret_number = 0;
1781                         }
1782                         secret = (int)inp->sctp_ep.current_secret_number;
1783                         for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1784                                 inp->sctp_ep.secret_key[secret][i] =
1785                                     sctp_select_initial_TSN(&inp->sctp_ep);
1786                         }
1787                         sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, stcb, net);
1788                 }
1789                 did_output = 0;
1790                 break;
1791         case SCTP_TIMER_TYPE_PATHMTURAISE:
1792                 if ((stcb == NULL) || (inp == NULL)) {
1793                         break;
1794                 }
1795                 SCTP_STAT_INCR(sctps_timopathmtu);
1796                 sctp_pathmtu_timer(inp, stcb, net);
1797                 did_output = 0;
1798                 break;
1799         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1800                 if ((stcb == NULL) || (inp == NULL)) {
1801                         break;
1802                 }
1803                 if (sctp_shutdownack_timer(inp, stcb, net)) {
1804                         /* no need to unlock on tcb its gone */
1805                         goto out_decr;
1806                 }
1807                 SCTP_STAT_INCR(sctps_timoshutdownack);
1808                 stcb->asoc.timoshutdownack++;
1809 #ifdef SCTP_AUDITING_ENABLED
1810                 sctp_auditing(4, inp, stcb, net);
1811 #endif
1812                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR, SCTP_SO_NOT_LOCKED);
1813                 break;
1814         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1815                 if ((stcb == NULL) || (inp == NULL)) {
1816                         break;
1817                 }
1818                 SCTP_STAT_INCR(sctps_timoshutdownguard);
1819                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
1820                     "Shutdown guard timer expired");
1821                 sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
1822                 /* no need to unlock on tcb its gone */
1823                 goto out_decr;
1824
1825         case SCTP_TIMER_TYPE_STRRESET:
1826                 if ((stcb == NULL) || (inp == NULL)) {
1827                         break;
1828                 }
1829                 if (sctp_strreset_timer(inp, stcb, net)) {
1830                         /* no need to unlock on tcb its gone */
1831                         goto out_decr;
1832                 }
1833                 SCTP_STAT_INCR(sctps_timostrmrst);
1834                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR, SCTP_SO_NOT_LOCKED);
1835                 break;
1836         case SCTP_TIMER_TYPE_ASCONF:
1837                 if ((stcb == NULL) || (inp == NULL)) {
1838                         break;
1839                 }
1840                 if (sctp_asconf_timer(inp, stcb, net)) {
1841                         /* no need to unlock on tcb its gone */
1842                         goto out_decr;
1843                 }
1844                 SCTP_STAT_INCR(sctps_timoasconf);
1845 #ifdef SCTP_AUDITING_ENABLED
1846                 sctp_auditing(4, inp, stcb, net);
1847 #endif
1848                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR, SCTP_SO_NOT_LOCKED);
1849                 break;
1850         case SCTP_TIMER_TYPE_PRIM_DELETED:
1851                 if ((stcb == NULL) || (inp == NULL)) {
1852                         break;
1853                 }
1854                 sctp_delete_prim_timer(inp, stcb, net);
1855                 SCTP_STAT_INCR(sctps_timodelprim);
1856                 break;
1857
1858         case SCTP_TIMER_TYPE_AUTOCLOSE:
1859                 if ((stcb == NULL) || (inp == NULL)) {
1860                         break;
1861                 }
1862                 SCTP_STAT_INCR(sctps_timoautoclose);
1863                 sctp_autoclose_timer(inp, stcb, net);
1864                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED);
1865                 did_output = 0;
1866                 break;
1867         case SCTP_TIMER_TYPE_ASOCKILL:
1868                 if ((stcb == NULL) || (inp == NULL)) {
1869                         break;
1870                 }
1871                 SCTP_STAT_INCR(sctps_timoassockill);
1872                 /* Can we free it yet? */
1873                 SCTP_INP_DECR_REF(inp);
1874                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL,
1875                     SCTP_FROM_SCTPUTIL + SCTP_LOC_1);
1876 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1877                 so = SCTP_INP_SO(inp);
1878                 atomic_add_int(&stcb->asoc.refcnt, 1);
1879                 SCTP_TCB_UNLOCK(stcb);
1880                 SCTP_SOCKET_LOCK(so, 1);
1881                 SCTP_TCB_LOCK(stcb);
1882                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1883 #endif
1884                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
1885                     SCTP_FROM_SCTPUTIL + SCTP_LOC_2);
1886 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1887                 SCTP_SOCKET_UNLOCK(so, 1);
1888 #endif
1889                 /*
1890                  * free asoc, always unlocks (or destroy's) so prevent
1891                  * duplicate unlock or unlock of a free mtx :-0
1892                  */
1893                 stcb = NULL;
1894                 goto out_no_decr;
1895         case SCTP_TIMER_TYPE_INPKILL:
1896                 SCTP_STAT_INCR(sctps_timoinpkill);
1897                 if (inp == NULL) {
1898                         break;
1899                 }
1900                 /*
1901                  * special case, take away our increment since WE are the
1902                  * killer
1903                  */
1904                 SCTP_INP_DECR_REF(inp);
1905                 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL,
1906                     SCTP_FROM_SCTPUTIL + SCTP_LOC_3);
1907                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
1908                     SCTP_CALLED_FROM_INPKILL_TIMER);
1909                 inp = NULL;
1910                 goto out_no_decr;
1911         default:
1912                 SCTPDBG(SCTP_DEBUG_TIMER1, "sctp_timeout_handler:unknown timer %d\n",
1913                     type);
1914                 break;
1915         }
1916 #ifdef SCTP_AUDITING_ENABLED
1917         sctp_audit_log(0xF1, (uint8_t)type);
1918         if (inp)
1919                 sctp_auditing(5, inp, stcb, net);
1920 #endif
1921         if ((did_output) && stcb) {
1922                 /*
1923                  * Now we need to clean up the control chunk chain if an
1924                  * ECNE is on it. It must be marked as UNSENT again so next
1925                  * call will continue to send it until such time that we get
1926                  * a CWR, to remove it. It is, however, less likely that we
1927                  * will find a ecn echo on the chain though.
1928                  */
1929                 sctp_fix_ecn_echo(&stcb->asoc);
1930         }
1931 get_out:
1932         if (stcb) {
1933                 SCTP_TCB_UNLOCK(stcb);
1934         } else if (inp != NULL) {
1935                 SCTP_INP_WUNLOCK(inp);
1936         } else {
1937                 SCTP_WQ_ADDR_UNLOCK();
1938         }
1939
1940 out_decr:
1941         if (inp) {
1942                 SCTP_INP_DECR_REF(inp);
1943         }
1944 out_no_decr:
1945         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer now complete (type = %d)\n", type);
1946         CURVNET_RESTORE();
1947 }
1948
1949 void
1950 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1951     struct sctp_nets *net)
1952 {
1953         uint32_t to_ticks;
1954         struct sctp_timer *tmr;
1955
1956         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL))
1957                 return;
1958
1959         tmr = NULL;
1960         if (stcb) {
1961                 SCTP_TCB_LOCK_ASSERT(stcb);
1962         }
1963         switch (t_type) {
1964         case SCTP_TIMER_TYPE_ADDR_WQ:
1965                 /* Only 1 tick away :-) */
1966                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
1967                 to_ticks = SCTP_ADDRESS_TICK_DELAY;
1968                 break;
1969         case SCTP_TIMER_TYPE_SEND:
1970                 /* Here we use the RTO timer */
1971                 {
1972                         int rto_val;
1973
1974                         if ((stcb == NULL) || (net == NULL)) {
1975                                 return;
1976                         }
1977                         tmr = &net->rxt_timer;
1978                         if (net->RTO == 0) {
1979                                 rto_val = stcb->asoc.initial_rto;
1980                         } else {
1981                                 rto_val = net->RTO;
1982                         }
1983                         to_ticks = MSEC_TO_TICKS(rto_val);
1984                 }
1985                 break;
1986         case SCTP_TIMER_TYPE_INIT:
1987                 /*
1988                  * Here we use the INIT timer default usually about 1
1989                  * minute.
1990                  */
1991                 if ((stcb == NULL) || (net == NULL)) {
1992                         return;
1993                 }
1994                 tmr = &net->rxt_timer;
1995                 if (net->RTO == 0) {
1996                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1997                 } else {
1998                         to_ticks = MSEC_TO_TICKS(net->RTO);
1999                 }
2000                 break;
2001         case SCTP_TIMER_TYPE_RECV:
2002                 /*
2003                  * Here we use the Delayed-Ack timer value from the inp
2004                  * ususually about 200ms.
2005                  */
2006                 if (stcb == NULL) {
2007                         return;
2008                 }
2009                 tmr = &stcb->asoc.dack_timer;
2010                 to_ticks = MSEC_TO_TICKS(stcb->asoc.delayed_ack);
2011                 break;
2012         case SCTP_TIMER_TYPE_SHUTDOWN:
2013                 /* Here we use the RTO of the destination. */
2014                 if ((stcb == NULL) || (net == NULL)) {
2015                         return;
2016                 }
2017                 if (net->RTO == 0) {
2018                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2019                 } else {
2020                         to_ticks = MSEC_TO_TICKS(net->RTO);
2021                 }
2022                 tmr = &net->rxt_timer;
2023                 break;
2024         case SCTP_TIMER_TYPE_HEARTBEAT:
2025                 /*
2026                  * the net is used here so that we can add in the RTO. Even
2027                  * though we use a different timer. We also add the HB timer
2028                  * PLUS a random jitter.
2029                  */
2030                 if ((stcb == NULL) || (net == NULL)) {
2031                         return;
2032                 } else {
2033                         uint32_t rndval;
2034                         uint32_t jitter;
2035
2036                         if ((net->dest_state & SCTP_ADDR_NOHB) &&
2037                             !(net->dest_state & SCTP_ADDR_UNCONFIRMED)) {
2038                                 return;
2039                         }
2040                         if (net->RTO == 0) {
2041                                 to_ticks = stcb->asoc.initial_rto;
2042                         } else {
2043                                 to_ticks = net->RTO;
2044                         }
2045                         rndval = sctp_select_initial_TSN(&inp->sctp_ep);
2046                         jitter = rndval % to_ticks;
2047                         if (jitter >= (to_ticks >> 1)) {
2048                                 to_ticks = to_ticks + (jitter - (to_ticks >> 1));
2049                         } else {
2050                                 to_ticks = to_ticks - jitter;
2051                         }
2052                         if (!(net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
2053                             !(net->dest_state & SCTP_ADDR_PF)) {
2054                                 to_ticks += net->heart_beat_delay;
2055                         }
2056                         /*
2057                          * Now we must convert the to_ticks that are now in
2058                          * ms to ticks.
2059                          */
2060                         to_ticks = MSEC_TO_TICKS(to_ticks);
2061                         tmr = &net->hb_timer;
2062                 }
2063                 break;
2064         case SCTP_TIMER_TYPE_COOKIE:
2065                 /*
2066                  * Here we can use the RTO timer from the network since one
2067                  * RTT was compelete. If a retran happened then we will be
2068                  * using the RTO initial value.
2069                  */
2070                 if ((stcb == NULL) || (net == NULL)) {
2071                         return;
2072                 }
2073                 if (net->RTO == 0) {
2074                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2075                 } else {
2076                         to_ticks = MSEC_TO_TICKS(net->RTO);
2077                 }
2078                 tmr = &net->rxt_timer;
2079                 break;
2080         case SCTP_TIMER_TYPE_NEWCOOKIE:
2081                 /*
2082                  * nothing needed but the endpoint here ususually about 60
2083                  * minutes.
2084                  */
2085                 tmr = &inp->sctp_ep.signature_change;
2086                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE];
2087                 break;
2088         case SCTP_TIMER_TYPE_ASOCKILL:
2089                 if (stcb == NULL) {
2090                         return;
2091                 }
2092                 tmr = &stcb->asoc.strreset_timer;
2093                 to_ticks = MSEC_TO_TICKS(SCTP_ASOC_KILL_TIMEOUT);
2094                 break;
2095         case SCTP_TIMER_TYPE_INPKILL:
2096                 /*
2097                  * The inp is setup to die. We re-use the signature_chage
2098                  * timer since that has stopped and we are in the GONE
2099                  * state.
2100                  */
2101                 tmr = &inp->sctp_ep.signature_change;
2102                 to_ticks = MSEC_TO_TICKS(SCTP_INP_KILL_TIMEOUT);
2103                 break;
2104         case SCTP_TIMER_TYPE_PATHMTURAISE:
2105                 /*
2106                  * Here we use the value found in the EP for PMTU ususually
2107                  * about 10 minutes.
2108                  */
2109                 if ((stcb == NULL) || (net == NULL)) {
2110                         return;
2111                 }
2112                 if (net->dest_state & SCTP_ADDR_NO_PMTUD) {
2113                         return;
2114                 }
2115                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU];
2116                 tmr = &net->pmtu_timer;
2117                 break;
2118         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2119                 /* Here we use the RTO of the destination */
2120                 if ((stcb == NULL) || (net == NULL)) {
2121                         return;
2122                 }
2123                 if (net->RTO == 0) {
2124                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2125                 } else {
2126                         to_ticks = MSEC_TO_TICKS(net->RTO);
2127                 }
2128                 tmr = &net->rxt_timer;
2129                 break;
2130         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2131                 /*
2132                  * Here we use the endpoints shutdown guard timer usually
2133                  * about 3 minutes.
2134                  */
2135                 if (stcb == NULL) {
2136                         return;
2137                 }
2138                 if (inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] == 0) {
2139                         to_ticks = 5 * MSEC_TO_TICKS(stcb->asoc.maxrto);
2140                 } else {
2141                         to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN];
2142                 }
2143                 tmr = &stcb->asoc.shut_guard_timer;
2144                 break;
2145         case SCTP_TIMER_TYPE_STRRESET:
2146                 /*
2147                  * Here the timer comes from the stcb but its value is from
2148                  * the net's RTO.
2149                  */
2150                 if ((stcb == NULL) || (net == NULL)) {
2151                         return;
2152                 }
2153                 if (net->RTO == 0) {
2154                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2155                 } else {
2156                         to_ticks = MSEC_TO_TICKS(net->RTO);
2157                 }
2158                 tmr = &stcb->asoc.strreset_timer;
2159                 break;
2160         case SCTP_TIMER_TYPE_ASCONF:
2161                 /*
2162                  * Here the timer comes from the stcb but its value is from
2163                  * the net's RTO.
2164                  */
2165                 if ((stcb == NULL) || (net == NULL)) {
2166                         return;
2167                 }
2168                 if (net->RTO == 0) {
2169                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2170                 } else {
2171                         to_ticks = MSEC_TO_TICKS(net->RTO);
2172                 }
2173                 tmr = &stcb->asoc.asconf_timer;
2174                 break;
2175         case SCTP_TIMER_TYPE_PRIM_DELETED:
2176                 if ((stcb == NULL) || (net != NULL)) {
2177                         return;
2178                 }
2179                 to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2180                 tmr = &stcb->asoc.delete_prim_timer;
2181                 break;
2182         case SCTP_TIMER_TYPE_AUTOCLOSE:
2183                 if (stcb == NULL) {
2184                         return;
2185                 }
2186                 if (stcb->asoc.sctp_autoclose_ticks == 0) {
2187                         /*
2188                          * Really an error since stcb is NOT set to
2189                          * autoclose
2190                          */
2191                         return;
2192                 }
2193                 to_ticks = stcb->asoc.sctp_autoclose_ticks;
2194                 tmr = &stcb->asoc.autoclose_timer;
2195                 break;
2196         default:
2197                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2198                     __func__, t_type);
2199                 return;
2200                 break;
2201         }
2202         if ((to_ticks <= 0) || (tmr == NULL)) {
2203                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: %d:software error to_ticks:%d tmr:%p not set ??\n",
2204                     __func__, t_type, to_ticks, (void *)tmr);
2205                 return;
2206         }
2207         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
2208                 /*
2209                  * we do NOT allow you to have it already running. if it is
2210                  * we leave the current one up unchanged
2211                  */
2212                 return;
2213         }
2214         /* At this point we can proceed */
2215         if (t_type == SCTP_TIMER_TYPE_SEND) {
2216                 stcb->asoc.num_send_timers_up++;
2217         }
2218         tmr->stopped_from = 0;
2219         tmr->type = t_type;
2220         tmr->ep = (void *)inp;
2221         tmr->tcb = (void *)stcb;
2222         tmr->net = (void *)net;
2223         tmr->self = (void *)tmr;
2224         tmr->vnet = (void *)curvnet;
2225         tmr->ticks = sctp_get_tick_count();
2226         (void)SCTP_OS_TIMER_START(&tmr->timer, to_ticks, sctp_timeout_handler, tmr);
2227         return;
2228 }
2229
2230 void
2231 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2232     struct sctp_nets *net, uint32_t from)
2233 {
2234         struct sctp_timer *tmr;
2235
2236         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) &&
2237             (inp == NULL))
2238                 return;
2239
2240         tmr = NULL;
2241         if (stcb) {
2242                 SCTP_TCB_LOCK_ASSERT(stcb);
2243         }
2244         switch (t_type) {
2245         case SCTP_TIMER_TYPE_ADDR_WQ:
2246                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2247                 break;
2248         case SCTP_TIMER_TYPE_SEND:
2249                 if ((stcb == NULL) || (net == NULL)) {
2250                         return;
2251                 }
2252                 tmr = &net->rxt_timer;
2253                 break;
2254         case SCTP_TIMER_TYPE_INIT:
2255                 if ((stcb == NULL) || (net == NULL)) {
2256                         return;
2257                 }
2258                 tmr = &net->rxt_timer;
2259                 break;
2260         case SCTP_TIMER_TYPE_RECV:
2261                 if (stcb == NULL) {
2262                         return;
2263                 }
2264                 tmr = &stcb->asoc.dack_timer;
2265                 break;
2266         case SCTP_TIMER_TYPE_SHUTDOWN:
2267                 if ((stcb == NULL) || (net == NULL)) {
2268                         return;
2269                 }
2270                 tmr = &net->rxt_timer;
2271                 break;
2272         case SCTP_TIMER_TYPE_HEARTBEAT:
2273                 if ((stcb == NULL) || (net == NULL)) {
2274                         return;
2275                 }
2276                 tmr = &net->hb_timer;
2277                 break;
2278         case SCTP_TIMER_TYPE_COOKIE:
2279                 if ((stcb == NULL) || (net == NULL)) {
2280                         return;
2281                 }
2282                 tmr = &net->rxt_timer;
2283                 break;
2284         case SCTP_TIMER_TYPE_NEWCOOKIE:
2285                 /* nothing needed but the endpoint here */
2286                 tmr = &inp->sctp_ep.signature_change;
2287                 /*
2288                  * We re-use the newcookie timer for the INP kill timer. We
2289                  * must assure that we do not kill it by accident.
2290                  */
2291                 break;
2292         case SCTP_TIMER_TYPE_ASOCKILL:
2293                 /*
2294                  * Stop the asoc kill timer.
2295                  */
2296                 if (stcb == NULL) {
2297                         return;
2298                 }
2299                 tmr = &stcb->asoc.strreset_timer;
2300                 break;
2301
2302         case SCTP_TIMER_TYPE_INPKILL:
2303                 /*
2304                  * The inp is setup to die. We re-use the signature_chage
2305                  * timer since that has stopped and we are in the GONE
2306                  * state.
2307                  */
2308                 tmr = &inp->sctp_ep.signature_change;
2309                 break;
2310         case SCTP_TIMER_TYPE_PATHMTURAISE:
2311                 if ((stcb == NULL) || (net == NULL)) {
2312                         return;
2313                 }
2314                 tmr = &net->pmtu_timer;
2315                 break;
2316         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2317                 if ((stcb == NULL) || (net == NULL)) {
2318                         return;
2319                 }
2320                 tmr = &net->rxt_timer;
2321                 break;
2322         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2323                 if (stcb == NULL) {
2324                         return;
2325                 }
2326                 tmr = &stcb->asoc.shut_guard_timer;
2327                 break;
2328         case SCTP_TIMER_TYPE_STRRESET:
2329                 if (stcb == NULL) {
2330                         return;
2331                 }
2332                 tmr = &stcb->asoc.strreset_timer;
2333                 break;
2334         case SCTP_TIMER_TYPE_ASCONF:
2335                 if (stcb == NULL) {
2336                         return;
2337                 }
2338                 tmr = &stcb->asoc.asconf_timer;
2339                 break;
2340         case SCTP_TIMER_TYPE_PRIM_DELETED:
2341                 if (stcb == NULL) {
2342                         return;
2343                 }
2344                 tmr = &stcb->asoc.delete_prim_timer;
2345                 break;
2346         case SCTP_TIMER_TYPE_AUTOCLOSE:
2347                 if (stcb == NULL) {
2348                         return;
2349                 }
2350                 tmr = &stcb->asoc.autoclose_timer;
2351                 break;
2352         default:
2353                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2354                     __func__, t_type);
2355                 break;
2356         }
2357         if (tmr == NULL) {
2358                 return;
2359         }
2360         if ((tmr->type != t_type) && tmr->type) {
2361                 /*
2362                  * Ok we have a timer that is under joint use. Cookie timer
2363                  * per chance with the SEND timer. We therefore are NOT
2364                  * running the timer that the caller wants stopped.  So just
2365                  * return.
2366                  */
2367                 return;
2368         }
2369         if ((t_type == SCTP_TIMER_TYPE_SEND) && (stcb != NULL)) {
2370                 stcb->asoc.num_send_timers_up--;
2371                 if (stcb->asoc.num_send_timers_up < 0) {
2372                         stcb->asoc.num_send_timers_up = 0;
2373                 }
2374         }
2375         tmr->self = NULL;
2376         tmr->stopped_from = from;
2377         (void)SCTP_OS_TIMER_STOP(&tmr->timer);
2378         return;
2379 }
2380
2381 uint32_t
2382 sctp_calculate_len(struct mbuf *m)
2383 {
2384         uint32_t tlen = 0;
2385         struct mbuf *at;
2386
2387         at = m;
2388         while (at) {
2389                 tlen += SCTP_BUF_LEN(at);
2390                 at = SCTP_BUF_NEXT(at);
2391         }
2392         return (tlen);
2393 }
2394
2395 void
2396 sctp_mtu_size_reset(struct sctp_inpcb *inp,
2397     struct sctp_association *asoc, uint32_t mtu)
2398 {
2399         /*
2400          * Reset the P-MTU size on this association, this involves changing
2401          * the asoc MTU, going through ANY chunk+overhead larger than mtu to
2402          * allow the DF flag to be cleared.
2403          */
2404         struct sctp_tmit_chunk *chk;
2405         unsigned int eff_mtu, ovh;
2406
2407         asoc->smallest_mtu = mtu;
2408         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2409                 ovh = SCTP_MIN_OVERHEAD;
2410         } else {
2411                 ovh = SCTP_MIN_V4_OVERHEAD;
2412         }
2413         eff_mtu = mtu - ovh;
2414         TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
2415                 if (chk->send_size > eff_mtu) {
2416                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2417                 }
2418         }
2419         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
2420                 if (chk->send_size > eff_mtu) {
2421                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2422                 }
2423         }
2424 }
2425
2426
2427 /*
2428  * given an association and starting time of the current RTT period return
2429  * RTO in number of msecs net should point to the current network
2430  */
2431
2432 uint32_t
2433 sctp_calculate_rto(struct sctp_tcb *stcb,
2434     struct sctp_association *asoc,
2435     struct sctp_nets *net,
2436     struct timeval *old,
2437     int rtt_from_sack)
2438 {
2439         /*-
2440          * given an association and the starting time of the current RTT
2441          * period (in value1/value2) return RTO in number of msecs.
2442          */
2443         int32_t rtt;            /* RTT in ms */
2444         uint32_t new_rto;
2445         int first_measure = 0;
2446         struct timeval now;
2447
2448         /************************/
2449         /* 1. calculate new RTT */
2450         /************************/
2451         /* get the current time */
2452         if (stcb->asoc.use_precise_time) {
2453                 (void)SCTP_GETPTIME_TIMEVAL(&now);
2454         } else {
2455                 (void)SCTP_GETTIME_TIMEVAL(&now);
2456         }
2457         timevalsub(&now, old);
2458         /* store the current RTT in us */
2459         net->rtt = (uint64_t)1000000 *(uint64_t)now.tv_sec +
2460                 (uint64_t)now.tv_usec;
2461
2462         /* compute rtt in ms */
2463         rtt = (int32_t)(net->rtt / 1000);
2464         if ((asoc->cc_functions.sctp_rtt_calculated) && (rtt_from_sack == SCTP_RTT_FROM_DATA)) {
2465                 /*
2466                  * Tell the CC module that a new update has just occurred
2467                  * from a sack
2468                  */
2469                 (*asoc->cc_functions.sctp_rtt_calculated) (stcb, net, &now);
2470         }
2471         /*
2472          * Do we need to determine the lan? We do this only on sacks i.e.
2473          * RTT being determined from data not non-data (HB/INIT->INITACK).
2474          */
2475         if ((rtt_from_sack == SCTP_RTT_FROM_DATA) &&
2476             (net->lan_type == SCTP_LAN_UNKNOWN)) {
2477                 if (net->rtt > SCTP_LOCAL_LAN_RTT) {
2478                         net->lan_type = SCTP_LAN_INTERNET;
2479                 } else {
2480                         net->lan_type = SCTP_LAN_LOCAL;
2481                 }
2482         }
2483         /***************************/
2484         /* 2. update RTTVAR & SRTT */
2485         /***************************/
2486         /*-
2487          * Compute the scaled average lastsa and the
2488          * scaled variance lastsv as described in van Jacobson
2489          * Paper "Congestion Avoidance and Control", Annex A.
2490          *
2491          * (net->lastsa >> SCTP_RTT_SHIFT) is the srtt
2492          * (net->lastsa >> SCTP_RTT_VAR_SHIFT) is the rttvar
2493          */
2494         if (net->RTO_measured) {
2495                 rtt -= (net->lastsa >> SCTP_RTT_SHIFT);
2496                 net->lastsa += rtt;
2497                 if (rtt < 0) {
2498                         rtt = -rtt;
2499                 }
2500                 rtt -= (net->lastsv >> SCTP_RTT_VAR_SHIFT);
2501                 net->lastsv += rtt;
2502                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2503                         rto_logging(net, SCTP_LOG_RTTVAR);
2504                 }
2505         } else {
2506                 /* First RTO measurment */
2507                 net->RTO_measured = 1;
2508                 first_measure = 1;
2509                 net->lastsa = rtt << SCTP_RTT_SHIFT;
2510                 net->lastsv = (rtt / 2) << SCTP_RTT_VAR_SHIFT;
2511                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2512                         rto_logging(net, SCTP_LOG_INITIAL_RTT);
2513                 }
2514         }
2515         if (net->lastsv == 0) {
2516                 net->lastsv = SCTP_CLOCK_GRANULARITY;
2517         }
2518         new_rto = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
2519         if ((new_rto > SCTP_SAT_NETWORK_MIN) &&
2520             (stcb->asoc.sat_network_lockout == 0)) {
2521                 stcb->asoc.sat_network = 1;
2522         } else if ((!first_measure) && stcb->asoc.sat_network) {
2523                 stcb->asoc.sat_network = 0;
2524                 stcb->asoc.sat_network_lockout = 1;
2525         }
2526         /* bound it, per C6/C7 in Section 5.3.1 */
2527         if (new_rto < stcb->asoc.minrto) {
2528                 new_rto = stcb->asoc.minrto;
2529         }
2530         if (new_rto > stcb->asoc.maxrto) {
2531                 new_rto = stcb->asoc.maxrto;
2532         }
2533         /* we are now returning the RTO */
2534         return (new_rto);
2535 }
2536
2537 /*
2538  * return a pointer to a contiguous piece of data from the given mbuf chain
2539  * starting at 'off' for 'len' bytes.  If the desired piece spans more than
2540  * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size
2541  * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain.
2542  */
2543 caddr_t
2544 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t *in_ptr)
2545 {
2546         uint32_t count;
2547         uint8_t *ptr;
2548
2549         ptr = in_ptr;
2550         if ((off < 0) || (len <= 0))
2551                 return (NULL);
2552
2553         /* find the desired start location */
2554         while ((m != NULL) && (off > 0)) {
2555                 if (off < SCTP_BUF_LEN(m))
2556                         break;
2557                 off -= SCTP_BUF_LEN(m);
2558                 m = SCTP_BUF_NEXT(m);
2559         }
2560         if (m == NULL)
2561                 return (NULL);
2562
2563         /* is the current mbuf large enough (eg. contiguous)? */
2564         if ((SCTP_BUF_LEN(m) - off) >= len) {
2565                 return (mtod(m, caddr_t)+off);
2566         } else {
2567                 /* else, it spans more than one mbuf, so save a temp copy... */
2568                 while ((m != NULL) && (len > 0)) {
2569                         count = min(SCTP_BUF_LEN(m) - off, len);
2570                         memcpy(ptr, mtod(m, caddr_t)+off, count);
2571                         len -= count;
2572                         ptr += count;
2573                         off = 0;
2574                         m = SCTP_BUF_NEXT(m);
2575                 }
2576                 if ((m == NULL) && (len > 0))
2577                         return (NULL);
2578                 else
2579                         return ((caddr_t)in_ptr);
2580         }
2581 }
2582
2583
2584
2585 struct sctp_paramhdr *
2586 sctp_get_next_param(struct mbuf *m,
2587     int offset,
2588     struct sctp_paramhdr *pull,
2589     int pull_limit)
2590 {
2591         /* This just provides a typed signature to Peter's Pull routine */
2592         return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit,
2593             (uint8_t *)pull));
2594 }
2595
2596
2597 struct mbuf *
2598 sctp_add_pad_tombuf(struct mbuf *m, int padlen)
2599 {
2600         struct mbuf *m_last;
2601         caddr_t dp;
2602
2603         if (padlen > 3) {
2604                 return (NULL);
2605         }
2606         if (padlen <= M_TRAILINGSPACE(m)) {
2607                 /*
2608                  * The easy way. We hope the majority of the time we hit
2609                  * here :)
2610                  */
2611                 m_last = m;
2612         } else {
2613                 /* Hard way we must grow the mbuf chain */
2614                 m_last = sctp_get_mbuf_for_msg(padlen, 0, M_NOWAIT, 1, MT_DATA);
2615                 if (m_last == NULL) {
2616                         return (NULL);
2617                 }
2618                 SCTP_BUF_LEN(m_last) = 0;
2619                 SCTP_BUF_NEXT(m_last) = NULL;
2620                 SCTP_BUF_NEXT(m) = m_last;
2621         }
2622         dp = mtod(m_last, caddr_t)+SCTP_BUF_LEN(m_last);
2623         SCTP_BUF_LEN(m_last) += padlen;
2624         memset(dp, 0, padlen);
2625         return (m_last);
2626 }
2627
2628 struct mbuf *
2629 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf)
2630 {
2631         /* find the last mbuf in chain and pad it */
2632         struct mbuf *m_at;
2633
2634         if (last_mbuf != NULL) {
2635                 return (sctp_add_pad_tombuf(last_mbuf, padval));
2636         } else {
2637                 for (m_at = m; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
2638                         if (SCTP_BUF_NEXT(m_at) == NULL) {
2639                                 return (sctp_add_pad_tombuf(m_at, padval));
2640                         }
2641                 }
2642         }
2643         return (NULL);
2644 }
2645
2646 static void
2647 sctp_notify_assoc_change(uint16_t state, struct sctp_tcb *stcb,
2648     uint16_t error, struct sctp_abort_chunk *abort, uint8_t from_peer, int so_locked
2649 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2650     SCTP_UNUSED
2651 #endif
2652 )
2653 {
2654         struct mbuf *m_notify;
2655         struct sctp_assoc_change *sac;
2656         struct sctp_queued_to_read *control;
2657         unsigned int notif_len;
2658         uint16_t abort_len;
2659         unsigned int i;
2660 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2661         struct socket *so;
2662 #endif
2663
2664         if (stcb == NULL) {
2665                 return;
2666         }
2667         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVASSOCEVNT)) {
2668                 notif_len = (unsigned int)sizeof(struct sctp_assoc_change);
2669                 if (abort != NULL) {
2670                         abort_len = ntohs(abort->ch.chunk_length);
2671                         /*
2672                          * Only SCTP_CHUNK_BUFFER_SIZE are guaranteed to be
2673                          * contiguous.
2674                          */
2675                         if (abort_len > SCTP_CHUNK_BUFFER_SIZE) {
2676                                 abort_len = SCTP_CHUNK_BUFFER_SIZE;
2677                         }
2678                 } else {
2679                         abort_len = 0;
2680                 }
2681                 if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
2682                         notif_len += SCTP_ASSOC_SUPPORTS_MAX;
2683                 } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
2684                         notif_len += abort_len;
2685                 }
2686                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
2687                 if (m_notify == NULL) {
2688                         /* Retry with smaller value. */
2689                         notif_len = (unsigned int)sizeof(struct sctp_assoc_change);
2690                         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
2691                         if (m_notify == NULL) {
2692                                 goto set_error;
2693                         }
2694                 }
2695                 SCTP_BUF_NEXT(m_notify) = NULL;
2696                 sac = mtod(m_notify, struct sctp_assoc_change *);
2697                 memset(sac, 0, notif_len);
2698                 sac->sac_type = SCTP_ASSOC_CHANGE;
2699                 sac->sac_flags = 0;
2700                 sac->sac_length = sizeof(struct sctp_assoc_change);
2701                 sac->sac_state = state;
2702                 sac->sac_error = error;
2703                 /* XXX verify these stream counts */
2704                 sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
2705                 sac->sac_inbound_streams = stcb->asoc.streamincnt;
2706                 sac->sac_assoc_id = sctp_get_associd(stcb);
2707                 if (notif_len > sizeof(struct sctp_assoc_change)) {
2708                         if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
2709                                 i = 0;
2710                                 if (stcb->asoc.prsctp_supported == 1) {
2711                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_PR;
2712                                 }
2713                                 if (stcb->asoc.auth_supported == 1) {
2714                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_AUTH;
2715                                 }
2716                                 if (stcb->asoc.asconf_supported == 1) {
2717                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_ASCONF;
2718                                 }
2719                                 if (stcb->asoc.idata_supported == 1) {
2720                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_INTERLEAVING;
2721                                 }
2722                                 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_MULTIBUF;
2723                                 if (stcb->asoc.reconfig_supported == 1) {
2724                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_RE_CONFIG;
2725                                 }
2726                                 sac->sac_length += i;
2727                         } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
2728                                 memcpy(sac->sac_info, abort, abort_len);
2729                                 sac->sac_length += abort_len;
2730                         }
2731                 }
2732                 SCTP_BUF_LEN(m_notify) = sac->sac_length;
2733                 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2734                     0, 0, stcb->asoc.context, 0, 0, 0,
2735                     m_notify);
2736                 if (control != NULL) {
2737                         control->length = SCTP_BUF_LEN(m_notify);
2738                         control->spec_flags = M_NOTIFICATION;
2739                         /* not that we need this */
2740                         control->tail_mbuf = m_notify;
2741                         sctp_add_to_readq(stcb->sctp_ep, stcb,
2742                             control,
2743                             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD,
2744                             so_locked);
2745                 } else {
2746                         sctp_m_freem(m_notify);
2747                 }
2748         }
2749         /*
2750          * For 1-to-1 style sockets, we send up and error when an ABORT
2751          * comes in.
2752          */
2753 set_error:
2754         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2755             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2756             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
2757                 SOCK_LOCK(stcb->sctp_socket);
2758                 if (from_peer) {
2759                         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) {
2760                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNREFUSED);
2761                                 stcb->sctp_socket->so_error = ECONNREFUSED;
2762                         } else {
2763                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
2764                                 stcb->sctp_socket->so_error = ECONNRESET;
2765                         }
2766                 } else {
2767                         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) ||
2768                             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) {
2769                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ETIMEDOUT);
2770                                 stcb->sctp_socket->so_error = ETIMEDOUT;
2771                         } else {
2772                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNABORTED);
2773                                 stcb->sctp_socket->so_error = ECONNABORTED;
2774                         }
2775                 }
2776         }
2777         /* Wake ANY sleepers */
2778 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2779         so = SCTP_INP_SO(stcb->sctp_ep);
2780         if (!so_locked) {
2781                 atomic_add_int(&stcb->asoc.refcnt, 1);
2782                 SCTP_TCB_UNLOCK(stcb);
2783                 SCTP_SOCKET_LOCK(so, 1);
2784                 SCTP_TCB_LOCK(stcb);
2785                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2786                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2787                         SCTP_SOCKET_UNLOCK(so, 1);
2788                         return;
2789                 }
2790         }
2791 #endif
2792         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2793             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2794             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
2795                 socantrcvmore_locked(stcb->sctp_socket);
2796         }
2797         sorwakeup(stcb->sctp_socket);
2798         sowwakeup(stcb->sctp_socket);
2799 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2800         if (!so_locked) {
2801                 SCTP_SOCKET_UNLOCK(so, 1);
2802         }
2803 #endif
2804 }
2805
2806 static void
2807 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
2808     struct sockaddr *sa, uint32_t error, int so_locked
2809 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2810     SCTP_UNUSED
2811 #endif
2812 )
2813 {
2814         struct mbuf *m_notify;
2815         struct sctp_paddr_change *spc;
2816         struct sctp_queued_to_read *control;
2817
2818         if ((stcb == NULL) ||
2819             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPADDREVNT)) {
2820                 /* event not enabled */
2821                 return;
2822         }
2823         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 0, M_NOWAIT, 1, MT_DATA);
2824         if (m_notify == NULL)
2825                 return;
2826         SCTP_BUF_LEN(m_notify) = 0;
2827         spc = mtod(m_notify, struct sctp_paddr_change *);
2828         memset(spc, 0, sizeof(struct sctp_paddr_change));
2829         spc->spc_type = SCTP_PEER_ADDR_CHANGE;
2830         spc->spc_flags = 0;
2831         spc->spc_length = sizeof(struct sctp_paddr_change);
2832         switch (sa->sa_family) {
2833 #ifdef INET
2834         case AF_INET:
2835 #ifdef INET6
2836                 if (sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
2837                         in6_sin_2_v4mapsin6((struct sockaddr_in *)sa,
2838                             (struct sockaddr_in6 *)&spc->spc_aaddr);
2839                 } else {
2840                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2841                 }
2842 #else
2843                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2844 #endif
2845                 break;
2846 #endif
2847 #ifdef INET6
2848         case AF_INET6:
2849                 {
2850                         struct sockaddr_in6 *sin6;
2851
2852                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6));
2853
2854                         sin6 = (struct sockaddr_in6 *)&spc->spc_aaddr;
2855                         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2856                                 if (sin6->sin6_scope_id == 0) {
2857                                         /* recover scope_id for user */
2858                                         (void)sa6_recoverscope(sin6);
2859                                 } else {
2860                                         /* clear embedded scope_id for user */
2861                                         in6_clearscope(&sin6->sin6_addr);
2862                                 }
2863                         }
2864                         break;
2865                 }
2866 #endif
2867         default:
2868                 /* TSNH */
2869                 break;
2870         }
2871         spc->spc_state = state;
2872         spc->spc_error = error;
2873         spc->spc_assoc_id = sctp_get_associd(stcb);
2874
2875         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_paddr_change);
2876         SCTP_BUF_NEXT(m_notify) = NULL;
2877
2878         /* append to socket */
2879         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2880             0, 0, stcb->asoc.context, 0, 0, 0,
2881             m_notify);
2882         if (control == NULL) {
2883                 /* no memory */
2884                 sctp_m_freem(m_notify);
2885                 return;
2886         }
2887         control->length = SCTP_BUF_LEN(m_notify);
2888         control->spec_flags = M_NOTIFICATION;
2889         /* not that we need this */
2890         control->tail_mbuf = m_notify;
2891         sctp_add_to_readq(stcb->sctp_ep, stcb,
2892             control,
2893             &stcb->sctp_socket->so_rcv, 1,
2894             SCTP_READ_LOCK_NOT_HELD,
2895             so_locked);
2896 }
2897
2898
2899 static void
2900 sctp_notify_send_failed(struct sctp_tcb *stcb, uint8_t sent, uint32_t error,
2901     struct sctp_tmit_chunk *chk, int so_locked
2902 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2903     SCTP_UNUSED
2904 #endif
2905 )
2906 {
2907         struct mbuf *m_notify;
2908         struct sctp_send_failed *ssf;
2909         struct sctp_send_failed_event *ssfe;
2910         struct sctp_queued_to_read *control;
2911         struct sctp_chunkhdr *chkhdr;
2912         int notifhdr_len, chk_len, chkhdr_len, padding_len, payload_len;
2913
2914         if ((stcb == NULL) ||
2915             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
2916             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
2917                 /* event not enabled */
2918                 return;
2919         }
2920         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2921                 notifhdr_len = sizeof(struct sctp_send_failed_event);
2922         } else {
2923                 notifhdr_len = sizeof(struct sctp_send_failed);
2924         }
2925         m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA);
2926         if (m_notify == NULL)
2927                 /* no space left */
2928                 return;
2929         SCTP_BUF_LEN(m_notify) = notifhdr_len;
2930         if (stcb->asoc.idata_supported) {
2931                 chkhdr_len = sizeof(struct sctp_idata_chunk);
2932         } else {
2933                 chkhdr_len = sizeof(struct sctp_data_chunk);
2934         }
2935         /* Use some defaults in case we can't access the chunk header */
2936         if (chk->send_size >= chkhdr_len) {
2937                 payload_len = chk->send_size - chkhdr_len;
2938         } else {
2939                 payload_len = 0;
2940         }
2941         padding_len = 0;
2942         if (chk->data != NULL) {
2943                 chkhdr = mtod(chk->data, struct sctp_chunkhdr *);
2944                 if (chkhdr != NULL) {
2945                         chk_len = ntohs(chkhdr->chunk_length);
2946                         if ((chk_len >= chkhdr_len) &&
2947                             (chk->send_size >= chk_len) &&
2948                             (chk->send_size - chk_len < 4)) {
2949                                 padding_len = chk->send_size - chk_len;
2950                                 payload_len = chk->send_size - chkhdr_len - padding_len;
2951                         }
2952                 }
2953         }
2954         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2955                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
2956                 memset(ssfe, 0, notifhdr_len);
2957                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
2958                 if (sent) {
2959                         ssfe->ssfe_flags = SCTP_DATA_SENT;
2960                 } else {
2961                         ssfe->ssfe_flags = SCTP_DATA_UNSENT;
2962                 }
2963                 ssfe->ssfe_length = (uint32_t)(notifhdr_len + payload_len);
2964                 ssfe->ssfe_error = error;
2965                 /* not exactly what the user sent in, but should be close :) */
2966                 ssfe->ssfe_info.snd_sid = chk->rec.data.sid;
2967                 ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags;
2968                 ssfe->ssfe_info.snd_ppid = chk->rec.data.ppid;
2969                 ssfe->ssfe_info.snd_context = chk->rec.data.context;
2970                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
2971                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
2972         } else {
2973                 ssf = mtod(m_notify, struct sctp_send_failed *);
2974                 memset(ssf, 0, notifhdr_len);
2975                 ssf->ssf_type = SCTP_SEND_FAILED;
2976                 if (sent) {
2977                         ssf->ssf_flags = SCTP_DATA_SENT;
2978                 } else {
2979                         ssf->ssf_flags = SCTP_DATA_UNSENT;
2980                 }
2981                 ssf->ssf_length = (uint32_t)(notifhdr_len + payload_len);
2982                 ssf->ssf_error = error;
2983                 /* not exactly what the user sent in, but should be close :) */
2984                 ssf->ssf_info.sinfo_stream = chk->rec.data.sid;
2985                 ssf->ssf_info.sinfo_ssn = (uint16_t)chk->rec.data.mid;
2986                 ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags;
2987                 ssf->ssf_info.sinfo_ppid = chk->rec.data.ppid;
2988                 ssf->ssf_info.sinfo_context = chk->rec.data.context;
2989                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
2990                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
2991         }
2992         if (chk->data != NULL) {
2993                 /* Trim off the sctp chunk header (it should be there) */
2994                 if (chk->send_size == chkhdr_len + payload_len + padding_len) {
2995                         m_adj(chk->data, chkhdr_len);
2996                         m_adj(chk->data, -padding_len);
2997                         sctp_mbuf_crush(chk->data);
2998                         chk->send_size -= (chkhdr_len + padding_len);
2999                 }
3000         }
3001         SCTP_BUF_NEXT(m_notify) = chk->data;
3002         /* Steal off the mbuf */
3003         chk->data = NULL;
3004         /*
3005          * For this case, we check the actual socket buffer, since the assoc
3006          * is going away we don't want to overfill the socket buffer for a
3007          * non-reader
3008          */
3009         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3010                 sctp_m_freem(m_notify);
3011                 return;
3012         }
3013         /* append to socket */
3014         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3015             0, 0, stcb->asoc.context, 0, 0, 0,
3016             m_notify);
3017         if (control == NULL) {
3018                 /* no memory */
3019                 sctp_m_freem(m_notify);
3020                 return;
3021         }
3022         control->length = SCTP_BUF_LEN(m_notify);
3023         control->spec_flags = M_NOTIFICATION;
3024         /* not that we need this */
3025         control->tail_mbuf = m_notify;
3026         sctp_add_to_readq(stcb->sctp_ep, stcb,
3027             control,
3028             &stcb->sctp_socket->so_rcv, 1,
3029             SCTP_READ_LOCK_NOT_HELD,
3030             so_locked);
3031 }
3032
3033
3034 static void
3035 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
3036     struct sctp_stream_queue_pending *sp, int so_locked
3037 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3038     SCTP_UNUSED
3039 #endif
3040 )
3041 {
3042         struct mbuf *m_notify;
3043         struct sctp_send_failed *ssf;
3044         struct sctp_send_failed_event *ssfe;
3045         struct sctp_queued_to_read *control;
3046         int notifhdr_len;
3047
3048         if ((stcb == NULL) ||
3049             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
3050             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
3051                 /* event not enabled */
3052                 return;
3053         }
3054         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3055                 notifhdr_len = sizeof(struct sctp_send_failed_event);
3056         } else {
3057                 notifhdr_len = sizeof(struct sctp_send_failed);
3058         }
3059         m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA);
3060         if (m_notify == NULL) {
3061                 /* no space left */
3062                 return;
3063         }
3064         SCTP_BUF_LEN(m_notify) = notifhdr_len;
3065         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3066                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
3067                 memset(ssfe, 0, notifhdr_len);
3068                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
3069                 ssfe->ssfe_flags = SCTP_DATA_UNSENT;
3070                 ssfe->ssfe_length = (uint32_t)(notifhdr_len + sp->length);
3071                 ssfe->ssfe_error = error;
3072                 /* not exactly what the user sent in, but should be close :) */
3073                 ssfe->ssfe_info.snd_sid = sp->sid;
3074                 if (sp->some_taken) {
3075                         ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG;
3076                 } else {
3077                         ssfe->ssfe_info.snd_flags = SCTP_DATA_NOT_FRAG;
3078                 }
3079                 ssfe->ssfe_info.snd_ppid = sp->ppid;
3080                 ssfe->ssfe_info.snd_context = sp->context;
3081                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
3082                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
3083         } else {
3084                 ssf = mtod(m_notify, struct sctp_send_failed *);
3085                 memset(ssf, 0, notifhdr_len);
3086                 ssf->ssf_type = SCTP_SEND_FAILED;
3087                 ssf->ssf_flags = SCTP_DATA_UNSENT;
3088                 ssf->ssf_length = (uint32_t)(notifhdr_len + sp->length);
3089                 ssf->ssf_error = error;
3090                 /* not exactly what the user sent in, but should be close :) */
3091                 ssf->ssf_info.sinfo_stream = sp->sid;
3092                 ssf->ssf_info.sinfo_ssn = 0;
3093                 if (sp->some_taken) {
3094                         ssf->ssf_info.sinfo_flags = SCTP_DATA_LAST_FRAG;
3095                 } else {
3096                         ssf->ssf_info.sinfo_flags = SCTP_DATA_NOT_FRAG;
3097                 }
3098                 ssf->ssf_info.sinfo_ppid = sp->ppid;
3099                 ssf->ssf_info.sinfo_context = sp->context;
3100                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
3101                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
3102         }
3103         SCTP_BUF_NEXT(m_notify) = sp->data;
3104
3105         /* Steal off the mbuf */
3106         sp->data = NULL;
3107         /*
3108          * For this case, we check the actual socket buffer, since the assoc
3109          * is going away we don't want to overfill the socket buffer for a
3110          * non-reader
3111          */
3112         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3113                 sctp_m_freem(m_notify);
3114                 return;
3115         }
3116         /* append to socket */
3117         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3118             0, 0, stcb->asoc.context, 0, 0, 0,
3119             m_notify);
3120         if (control == NULL) {
3121                 /* no memory */
3122                 sctp_m_freem(m_notify);
3123                 return;
3124         }
3125         control->length = SCTP_BUF_LEN(m_notify);
3126         control->spec_flags = M_NOTIFICATION;
3127         /* not that we need this */
3128         control->tail_mbuf = m_notify;
3129         sctp_add_to_readq(stcb->sctp_ep, stcb,
3130             control,
3131             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3132 }
3133
3134
3135
3136 static void
3137 sctp_notify_adaptation_layer(struct sctp_tcb *stcb)
3138 {
3139         struct mbuf *m_notify;
3140         struct sctp_adaptation_event *sai;
3141         struct sctp_queued_to_read *control;
3142
3143         if ((stcb == NULL) ||
3144             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ADAPTATIONEVNT)) {
3145                 /* event not enabled */
3146                 return;
3147         }
3148         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_NOWAIT, 1, MT_DATA);
3149         if (m_notify == NULL)
3150                 /* no space left */
3151                 return;
3152         SCTP_BUF_LEN(m_notify) = 0;
3153         sai = mtod(m_notify, struct sctp_adaptation_event *);
3154         memset(sai, 0, sizeof(struct sctp_adaptation_event));
3155         sai->sai_type = SCTP_ADAPTATION_INDICATION;
3156         sai->sai_flags = 0;
3157         sai->sai_length = sizeof(struct sctp_adaptation_event);
3158         sai->sai_adaptation_ind = stcb->asoc.peers_adaptation;
3159         sai->sai_assoc_id = sctp_get_associd(stcb);
3160
3161         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_adaptation_event);
3162         SCTP_BUF_NEXT(m_notify) = NULL;
3163
3164         /* append to socket */
3165         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3166             0, 0, stcb->asoc.context, 0, 0, 0,
3167             m_notify);
3168         if (control == NULL) {
3169                 /* no memory */
3170                 sctp_m_freem(m_notify);
3171                 return;
3172         }
3173         control->length = SCTP_BUF_LEN(m_notify);
3174         control->spec_flags = M_NOTIFICATION;
3175         /* not that we need this */
3176         control->tail_mbuf = m_notify;
3177         sctp_add_to_readq(stcb->sctp_ep, stcb,
3178             control,
3179             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3180 }
3181
3182 /* This always must be called with the read-queue LOCKED in the INP */
3183 static void
3184 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb, uint32_t error,
3185     uint32_t val, int so_locked
3186 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3187     SCTP_UNUSED
3188 #endif
3189 )
3190 {
3191         struct mbuf *m_notify;
3192         struct sctp_pdapi_event *pdapi;
3193         struct sctp_queued_to_read *control;
3194         struct sockbuf *sb;
3195
3196         if ((stcb == NULL) ||
3197             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_PDAPIEVNT)) {
3198                 /* event not enabled */
3199                 return;
3200         }
3201         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
3202                 return;
3203         }
3204         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 0, M_NOWAIT, 1, MT_DATA);
3205         if (m_notify == NULL)
3206                 /* no space left */
3207                 return;
3208         SCTP_BUF_LEN(m_notify) = 0;
3209         pdapi = mtod(m_notify, struct sctp_pdapi_event *);
3210         memset(pdapi, 0, sizeof(struct sctp_pdapi_event));
3211         pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
3212         pdapi->pdapi_flags = 0;
3213         pdapi->pdapi_length = sizeof(struct sctp_pdapi_event);
3214         pdapi->pdapi_indication = error;
3215         pdapi->pdapi_stream = (val >> 16);
3216         pdapi->pdapi_seq = (val & 0x0000ffff);
3217         pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
3218
3219         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_pdapi_event);
3220         SCTP_BUF_NEXT(m_notify) = NULL;
3221         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3222             0, 0, stcb->asoc.context, 0, 0, 0,
3223             m_notify);
3224         if (control == NULL) {
3225                 /* no memory */
3226                 sctp_m_freem(m_notify);
3227                 return;
3228         }
3229         control->length = SCTP_BUF_LEN(m_notify);
3230         control->spec_flags = M_NOTIFICATION;
3231         /* not that we need this */
3232         control->tail_mbuf = m_notify;
3233         sb = &stcb->sctp_socket->so_rcv;
3234         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3235                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m_notify));
3236         }
3237         sctp_sballoc(stcb, sb, m_notify);
3238         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3239                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3240         }
3241         control->end_added = 1;
3242         if (stcb->asoc.control_pdapi)
3243                 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next);
3244         else {
3245                 /* we really should not see this case */
3246                 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next);
3247         }
3248         if (stcb->sctp_ep && stcb->sctp_socket) {
3249                 /* This should always be the case */
3250 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3251                 struct socket *so;
3252
3253                 so = SCTP_INP_SO(stcb->sctp_ep);
3254                 if (!so_locked) {
3255                         atomic_add_int(&stcb->asoc.refcnt, 1);
3256                         SCTP_TCB_UNLOCK(stcb);
3257                         SCTP_SOCKET_LOCK(so, 1);
3258                         SCTP_TCB_LOCK(stcb);
3259                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
3260                         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3261                                 SCTP_SOCKET_UNLOCK(so, 1);
3262                                 return;
3263                         }
3264                 }
3265 #endif
3266                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
3267 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3268                 if (!so_locked) {
3269                         SCTP_SOCKET_UNLOCK(so, 1);
3270                 }
3271 #endif
3272         }
3273 }
3274
3275 static void
3276 sctp_notify_shutdown_event(struct sctp_tcb *stcb)
3277 {
3278         struct mbuf *m_notify;
3279         struct sctp_shutdown_event *sse;
3280         struct sctp_queued_to_read *control;
3281
3282         /*
3283          * For TCP model AND UDP connected sockets we will send an error up
3284          * when an SHUTDOWN completes
3285          */
3286         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3287             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
3288                 /* mark socket closed for read/write and wakeup! */
3289 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3290                 struct socket *so;
3291
3292                 so = SCTP_INP_SO(stcb->sctp_ep);
3293                 atomic_add_int(&stcb->asoc.refcnt, 1);
3294                 SCTP_TCB_UNLOCK(stcb);
3295                 SCTP_SOCKET_LOCK(so, 1);
3296                 SCTP_TCB_LOCK(stcb);
3297                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3298                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
3299                         SCTP_SOCKET_UNLOCK(so, 1);
3300                         return;
3301                 }
3302 #endif
3303                 socantsendmore(stcb->sctp_socket);
3304 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3305                 SCTP_SOCKET_UNLOCK(so, 1);
3306 #endif
3307         }
3308         if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT)) {
3309                 /* event not enabled */
3310                 return;
3311         }
3312         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 0, M_NOWAIT, 1, MT_DATA);
3313         if (m_notify == NULL)
3314                 /* no space left */
3315                 return;
3316         sse = mtod(m_notify, struct sctp_shutdown_event *);
3317         memset(sse, 0, sizeof(struct sctp_shutdown_event));
3318         sse->sse_type = SCTP_SHUTDOWN_EVENT;
3319         sse->sse_flags = 0;
3320         sse->sse_length = sizeof(struct sctp_shutdown_event);
3321         sse->sse_assoc_id = sctp_get_associd(stcb);
3322
3323         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_shutdown_event);
3324         SCTP_BUF_NEXT(m_notify) = NULL;
3325
3326         /* append to socket */
3327         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3328             0, 0, stcb->asoc.context, 0, 0, 0,
3329             m_notify);
3330         if (control == NULL) {
3331                 /* no memory */
3332                 sctp_m_freem(m_notify);
3333                 return;
3334         }
3335         control->length = SCTP_BUF_LEN(m_notify);
3336         control->spec_flags = M_NOTIFICATION;
3337         /* not that we need this */
3338         control->tail_mbuf = m_notify;
3339         sctp_add_to_readq(stcb->sctp_ep, stcb,
3340             control,
3341             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3342 }
3343
3344 static void
3345 sctp_notify_sender_dry_event(struct sctp_tcb *stcb,
3346     int so_locked
3347 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3348     SCTP_UNUSED
3349 #endif
3350 )
3351 {
3352         struct mbuf *m_notify;
3353         struct sctp_sender_dry_event *event;
3354         struct sctp_queued_to_read *control;
3355
3356         if ((stcb == NULL) ||
3357             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DRYEVNT)) {
3358                 /* event not enabled */
3359                 return;
3360         }
3361         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_sender_dry_event), 0, M_NOWAIT, 1, MT_DATA);
3362         if (m_notify == NULL) {
3363                 /* no space left */
3364                 return;
3365         }
3366         SCTP_BUF_LEN(m_notify) = 0;
3367         event = mtod(m_notify, struct sctp_sender_dry_event *);
3368         memset(event, 0, sizeof(struct sctp_sender_dry_event));
3369         event->sender_dry_type = SCTP_SENDER_DRY_EVENT;
3370         event->sender_dry_flags = 0;
3371         event->sender_dry_length = sizeof(struct sctp_sender_dry_event);
3372         event->sender_dry_assoc_id = sctp_get_associd(stcb);
3373
3374         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_sender_dry_event);
3375         SCTP_BUF_NEXT(m_notify) = NULL;
3376
3377         /* append to socket */
3378         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3379             0, 0, stcb->asoc.context, 0, 0, 0,
3380             m_notify);
3381         if (control == NULL) {
3382                 /* no memory */
3383                 sctp_m_freem(m_notify);
3384                 return;
3385         }
3386         control->length = SCTP_BUF_LEN(m_notify);
3387         control->spec_flags = M_NOTIFICATION;
3388         /* not that we need this */
3389         control->tail_mbuf = m_notify;
3390         sctp_add_to_readq(stcb->sctp_ep, stcb, control,
3391             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3392 }
3393
3394
3395 void
3396 sctp_notify_stream_reset_add(struct sctp_tcb *stcb, uint16_t numberin, uint16_t numberout, int flag)
3397 {
3398         struct mbuf *m_notify;
3399         struct sctp_queued_to_read *control;
3400         struct sctp_stream_change_event *stradd;
3401
3402         if ((stcb == NULL) ||
3403             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT))) {
3404                 /* event not enabled */
3405                 return;
3406         }
3407         if ((stcb->asoc.peer_req_out) && flag) {
3408                 /* Peer made the request, don't tell the local user */
3409                 stcb->asoc.peer_req_out = 0;
3410                 return;
3411         }
3412         stcb->asoc.peer_req_out = 0;
3413         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_stream_change_event), 0, M_NOWAIT, 1, MT_DATA);
3414         if (m_notify == NULL)
3415                 /* no space left */
3416                 return;
3417         SCTP_BUF_LEN(m_notify) = 0;
3418         stradd = mtod(m_notify, struct sctp_stream_change_event *);
3419         memset(stradd, 0, sizeof(struct sctp_stream_change_event));
3420         stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT;
3421         stradd->strchange_flags = flag;
3422         stradd->strchange_length = sizeof(struct sctp_stream_change_event);
3423         stradd->strchange_assoc_id = sctp_get_associd(stcb);
3424         stradd->strchange_instrms = numberin;
3425         stradd->strchange_outstrms = numberout;
3426         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_stream_change_event);
3427         SCTP_BUF_NEXT(m_notify) = NULL;
3428         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3429                 /* no space */
3430                 sctp_m_freem(m_notify);
3431                 return;
3432         }
3433         /* append to socket */
3434         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3435             0, 0, stcb->asoc.context, 0, 0, 0,
3436             m_notify);
3437         if (control == NULL) {
3438                 /* no memory */
3439                 sctp_m_freem(m_notify);
3440                 return;
3441         }
3442         control->length = SCTP_BUF_LEN(m_notify);
3443         control->spec_flags = M_NOTIFICATION;
3444         /* not that we need this */
3445         control->tail_mbuf = m_notify;
3446         sctp_add_to_readq(stcb->sctp_ep, stcb,
3447             control,
3448             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3449 }
3450
3451 void
3452 sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb, uint32_t sending_tsn, uint32_t recv_tsn, int flag)
3453 {
3454         struct mbuf *m_notify;
3455         struct sctp_queued_to_read *control;
3456         struct sctp_assoc_reset_event *strasoc;
3457
3458         if ((stcb == NULL) ||
3459             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT))) {
3460                 /* event not enabled */
3461                 return;
3462         }
3463         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_reset_event), 0, M_NOWAIT, 1, MT_DATA);
3464         if (m_notify == NULL)
3465                 /* no space left */
3466                 return;
3467         SCTP_BUF_LEN(m_notify) = 0;
3468         strasoc = mtod(m_notify, struct sctp_assoc_reset_event *);
3469         memset(strasoc, 0, sizeof(struct sctp_assoc_reset_event));
3470         strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT;
3471         strasoc->assocreset_flags = flag;
3472         strasoc->assocreset_length = sizeof(struct sctp_assoc_reset_event);
3473         strasoc->assocreset_assoc_id = sctp_get_associd(stcb);
3474         strasoc->assocreset_local_tsn = sending_tsn;
3475         strasoc->assocreset_remote_tsn = recv_tsn;
3476         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_reset_event);
3477         SCTP_BUF_NEXT(m_notify) = NULL;
3478         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3479                 /* no space */
3480                 sctp_m_freem(m_notify);
3481                 return;
3482         }
3483         /* append to socket */
3484         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3485             0, 0, stcb->asoc.context, 0, 0, 0,
3486             m_notify);
3487         if (control == NULL) {
3488                 /* no memory */
3489                 sctp_m_freem(m_notify);
3490                 return;
3491         }
3492         control->length = SCTP_BUF_LEN(m_notify);
3493         control->spec_flags = M_NOTIFICATION;
3494         /* not that we need this */
3495         control->tail_mbuf = m_notify;
3496         sctp_add_to_readq(stcb->sctp_ep, stcb,
3497             control,
3498             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3499 }
3500
3501
3502
3503 static void
3504 sctp_notify_stream_reset(struct sctp_tcb *stcb,
3505     int number_entries, uint16_t *list, int flag)
3506 {
3507         struct mbuf *m_notify;
3508         struct sctp_queued_to_read *control;
3509         struct sctp_stream_reset_event *strreset;
3510         int len;
3511
3512         if ((stcb == NULL) ||
3513             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_RESETEVNT))) {
3514                 /* event not enabled */
3515                 return;
3516         }
3517         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
3518         if (m_notify == NULL)
3519                 /* no space left */
3520                 return;
3521         SCTP_BUF_LEN(m_notify) = 0;
3522         len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
3523         if (len > M_TRAILINGSPACE(m_notify)) {
3524                 /* never enough room */
3525                 sctp_m_freem(m_notify);
3526                 return;
3527         }
3528         strreset = mtod(m_notify, struct sctp_stream_reset_event *);
3529         memset(strreset, 0, len);
3530         strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
3531         strreset->strreset_flags = flag;
3532         strreset->strreset_length = len;
3533         strreset->strreset_assoc_id = sctp_get_associd(stcb);
3534         if (number_entries) {
3535                 int i;
3536
3537                 for (i = 0; i < number_entries; i++) {
3538                         strreset->strreset_stream_list[i] = ntohs(list[i]);
3539                 }
3540         }
3541         SCTP_BUF_LEN(m_notify) = len;
3542         SCTP_BUF_NEXT(m_notify) = NULL;
3543         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3544                 /* no space */
3545                 sctp_m_freem(m_notify);
3546                 return;
3547         }
3548         /* append to socket */
3549         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3550             0, 0, stcb->asoc.context, 0, 0, 0,
3551             m_notify);
3552         if (control == NULL) {
3553                 /* no memory */
3554                 sctp_m_freem(m_notify);
3555                 return;
3556         }
3557         control->length = SCTP_BUF_LEN(m_notify);
3558         control->spec_flags = M_NOTIFICATION;
3559         /* not that we need this */
3560         control->tail_mbuf = m_notify;
3561         sctp_add_to_readq(stcb->sctp_ep, stcb,
3562             control,
3563             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3564 }
3565
3566
3567 static void
3568 sctp_notify_remote_error(struct sctp_tcb *stcb, uint16_t error, struct sctp_error_chunk *chunk)
3569 {
3570         struct mbuf *m_notify;
3571         struct sctp_remote_error *sre;
3572         struct sctp_queued_to_read *control;
3573         unsigned int notif_len;
3574         uint16_t chunk_len;
3575
3576         if ((stcb == NULL) ||
3577             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPEERERR)) {
3578                 return;
3579         }
3580         if (chunk != NULL) {
3581                 chunk_len = ntohs(chunk->ch.chunk_length);
3582                 /*
3583                  * Only SCTP_CHUNK_BUFFER_SIZE are guaranteed to be
3584                  * contiguous.
3585                  */
3586                 if (chunk_len > SCTP_CHUNK_BUFFER_SIZE) {
3587                         chunk_len = SCTP_CHUNK_BUFFER_SIZE;
3588                 }
3589         } else {
3590                 chunk_len = 0;
3591         }
3592         notif_len = (unsigned int)(sizeof(struct sctp_remote_error) + chunk_len);
3593         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3594         if (m_notify == NULL) {
3595                 /* Retry with smaller value. */
3596                 notif_len = (unsigned int)sizeof(struct sctp_remote_error);
3597                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3598                 if (m_notify == NULL) {
3599                         return;
3600                 }
3601         }
3602         SCTP_BUF_NEXT(m_notify) = NULL;
3603         sre = mtod(m_notify, struct sctp_remote_error *);
3604         memset(sre, 0, notif_len);
3605         sre->sre_type = SCTP_REMOTE_ERROR;
3606         sre->sre_flags = 0;
3607         sre->sre_length = sizeof(struct sctp_remote_error);
3608         sre->sre_error = error;
3609         sre->sre_assoc_id = sctp_get_associd(stcb);
3610         if (notif_len > sizeof(struct sctp_remote_error)) {
3611                 memcpy(sre->sre_data, chunk, chunk_len);
3612                 sre->sre_length += chunk_len;
3613         }
3614         SCTP_BUF_LEN(m_notify) = sre->sre_length;
3615         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3616             0, 0, stcb->asoc.context, 0, 0, 0,
3617             m_notify);
3618         if (control != NULL) {
3619                 control->length = SCTP_BUF_LEN(m_notify);
3620                 control->spec_flags = M_NOTIFICATION;
3621                 /* not that we need this */
3622                 control->tail_mbuf = m_notify;
3623                 sctp_add_to_readq(stcb->sctp_ep, stcb,
3624                     control,
3625                     &stcb->sctp_socket->so_rcv, 1,
3626                     SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3627         } else {
3628                 sctp_m_freem(m_notify);
3629         }
3630 }
3631
3632
3633 void
3634 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb,
3635     uint32_t error, void *data, int so_locked
3636 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3637     SCTP_UNUSED
3638 #endif
3639 )
3640 {
3641         if ((stcb == NULL) ||
3642             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3643             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3644             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3645                 /* If the socket is gone we are out of here */
3646                 return;
3647         }
3648         if (stcb->sctp_socket->so_rcv.sb_state & SBS_CANTRCVMORE) {
3649                 return;
3650         }
3651         if ((stcb->asoc.state & SCTP_STATE_COOKIE_WAIT) ||
3652             (stcb->asoc.state & SCTP_STATE_COOKIE_ECHOED)) {
3653                 if ((notification == SCTP_NOTIFY_INTERFACE_DOWN) ||
3654                     (notification == SCTP_NOTIFY_INTERFACE_UP) ||
3655                     (notification == SCTP_NOTIFY_INTERFACE_CONFIRMED)) {
3656                         /* Don't report these in front states */
3657                         return;
3658                 }
3659         }
3660         switch (notification) {
3661         case SCTP_NOTIFY_ASSOC_UP:
3662                 if (stcb->asoc.assoc_up_sent == 0) {
3663                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, NULL, 0, so_locked);
3664                         stcb->asoc.assoc_up_sent = 1;
3665                 }
3666                 if (stcb->asoc.adaptation_needed && (stcb->asoc.adaptation_sent == 0)) {
3667                         sctp_notify_adaptation_layer(stcb);
3668                 }
3669                 if (stcb->asoc.auth_supported == 0) {
3670                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3671                             NULL, so_locked);
3672                 }
3673                 break;
3674         case SCTP_NOTIFY_ASSOC_DOWN:
3675                 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, NULL, 0, so_locked);
3676                 break;
3677         case SCTP_NOTIFY_INTERFACE_DOWN:
3678                 {
3679                         struct sctp_nets *net;
3680
3681                         net = (struct sctp_nets *)data;
3682                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE,
3683                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
3684                         break;
3685                 }
3686         case SCTP_NOTIFY_INTERFACE_UP:
3687                 {
3688                         struct sctp_nets *net;
3689
3690                         net = (struct sctp_nets *)data;
3691                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE,
3692                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
3693                         break;
3694                 }
3695         case SCTP_NOTIFY_INTERFACE_CONFIRMED:
3696                 {
3697                         struct sctp_nets *net;
3698
3699                         net = (struct sctp_nets *)data;
3700                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED,
3701                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
3702                         break;
3703                 }
3704         case SCTP_NOTIFY_SPECIAL_SP_FAIL:
3705                 sctp_notify_send_failed2(stcb, error,
3706                     (struct sctp_stream_queue_pending *)data, so_locked);
3707                 break;
3708         case SCTP_NOTIFY_SENT_DG_FAIL:
3709                 sctp_notify_send_failed(stcb, 1, error,
3710                     (struct sctp_tmit_chunk *)data, so_locked);
3711                 break;
3712         case SCTP_NOTIFY_UNSENT_DG_FAIL:
3713                 sctp_notify_send_failed(stcb, 0, error,
3714                     (struct sctp_tmit_chunk *)data, so_locked);
3715                 break;
3716         case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION:
3717                 {
3718                         uint32_t val;
3719
3720                         val = *((uint32_t *)data);
3721
3722                         sctp_notify_partial_delivery_indication(stcb, error, val, so_locked);
3723                         break;
3724                 }
3725         case SCTP_NOTIFY_ASSOC_LOC_ABORTED:
3726                 if (((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_WAIT) ||
3727                     ((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_ECHOED)) {
3728                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 0, so_locked);
3729                 } else {
3730                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 0, so_locked);
3731                 }
3732                 break;
3733         case SCTP_NOTIFY_ASSOC_REM_ABORTED:
3734                 if (((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_WAIT) ||
3735                     ((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_ECHOED)) {
3736                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 1, so_locked);
3737                 } else {
3738                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 1, so_locked);
3739                 }
3740                 break;
3741         case SCTP_NOTIFY_ASSOC_RESTART:
3742                 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, NULL, 0, so_locked);
3743                 if (stcb->asoc.auth_supported == 0) {
3744                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3745                             NULL, so_locked);
3746                 }
3747                 break;
3748         case SCTP_NOTIFY_STR_RESET_SEND:
3749                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_OUTGOING_SSN);
3750                 break;
3751         case SCTP_NOTIFY_STR_RESET_RECV:
3752                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_INCOMING);
3753                 break;
3754         case SCTP_NOTIFY_STR_RESET_FAILED_OUT:
3755                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
3756                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_FAILED));
3757                 break;
3758         case SCTP_NOTIFY_STR_RESET_DENIED_OUT:
3759                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
3760                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_DENIED));
3761                 break;
3762         case SCTP_NOTIFY_STR_RESET_FAILED_IN:
3763                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
3764                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_FAILED));
3765                 break;
3766         case SCTP_NOTIFY_STR_RESET_DENIED_IN:
3767                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
3768                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_DENIED));
3769                 break;
3770         case SCTP_NOTIFY_ASCONF_ADD_IP:
3771                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data,
3772                     error, so_locked);
3773                 break;
3774         case SCTP_NOTIFY_ASCONF_DELETE_IP:
3775                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data,
3776                     error, so_locked);
3777                 break;
3778         case SCTP_NOTIFY_ASCONF_SET_PRIMARY:
3779                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data,
3780                     error, so_locked);
3781                 break;
3782         case SCTP_NOTIFY_PEER_SHUTDOWN:
3783                 sctp_notify_shutdown_event(stcb);
3784                 break;
3785         case SCTP_NOTIFY_AUTH_NEW_KEY:
3786                 sctp_notify_authentication(stcb, SCTP_AUTH_NEW_KEY, error,
3787                     (uint16_t)(uintptr_t)data,
3788                     so_locked);
3789                 break;
3790         case SCTP_NOTIFY_AUTH_FREE_KEY:
3791                 sctp_notify_authentication(stcb, SCTP_AUTH_FREE_KEY, error,
3792                     (uint16_t)(uintptr_t)data,
3793                     so_locked);
3794                 break;
3795         case SCTP_NOTIFY_NO_PEER_AUTH:
3796                 sctp_notify_authentication(stcb, SCTP_AUTH_NO_AUTH, error,
3797                     (uint16_t)(uintptr_t)data,
3798                     so_locked);
3799                 break;
3800         case SCTP_NOTIFY_SENDER_DRY:
3801                 sctp_notify_sender_dry_event(stcb, so_locked);
3802                 break;
3803         case SCTP_NOTIFY_REMOTE_ERROR:
3804                 sctp_notify_remote_error(stcb, error, data);
3805                 break;
3806         default:
3807                 SCTPDBG(SCTP_DEBUG_UTIL1, "%s: unknown notification %xh (%u)\n",
3808                     __func__, notification, notification);
3809                 break;
3810         }                       /* end switch */
3811 }
3812
3813 void
3814 sctp_report_all_outbound(struct sctp_tcb *stcb, uint16_t error, int holds_lock, int so_locked
3815 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3816     SCTP_UNUSED
3817 #endif
3818 )
3819 {
3820         struct sctp_association *asoc;
3821         struct sctp_stream_out *outs;
3822         struct sctp_tmit_chunk *chk, *nchk;
3823         struct sctp_stream_queue_pending *sp, *nsp;
3824         int i;
3825
3826         if (stcb == NULL) {
3827                 return;
3828         }
3829         asoc = &stcb->asoc;
3830         if (asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) {
3831                 /* already being freed */
3832                 return;
3833         }
3834         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3835             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3836             (asoc->state & SCTP_STATE_CLOSED_SOCKET)) {
3837                 return;
3838         }
3839         /* now through all the gunk freeing chunks */
3840         if (holds_lock == 0) {
3841                 SCTP_TCB_SEND_LOCK(stcb);
3842         }
3843         /* sent queue SHOULD be empty */
3844         TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) {
3845                 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
3846                 asoc->sent_queue_cnt--;
3847                 if (chk->sent != SCTP_DATAGRAM_NR_ACKED) {
3848                         if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
3849                                 asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
3850 #ifdef INVARIANTS
3851                         } else {
3852                                 panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
3853 #endif
3854                         }
3855                 }
3856                 if (chk->data != NULL) {
3857                         sctp_free_bufspace(stcb, asoc, chk, 1);
3858                         sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb,
3859                             error, chk, so_locked);
3860                         if (chk->data) {
3861                                 sctp_m_freem(chk->data);
3862                                 chk->data = NULL;
3863                         }
3864                 }
3865                 sctp_free_a_chunk(stcb, chk, so_locked);
3866                 /* sa_ignore FREED_MEMORY */
3867         }
3868         /* pending send queue SHOULD be empty */
3869         TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
3870                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
3871                 asoc->send_queue_cnt--;
3872                 if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
3873                         asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
3874 #ifdef INVARIANTS
3875                 } else {
3876                         panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
3877 #endif
3878                 }
3879                 if (chk->data != NULL) {
3880                         sctp_free_bufspace(stcb, asoc, chk, 1);
3881                         sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
3882                             error, chk, so_locked);
3883                         if (chk->data) {
3884                                 sctp_m_freem(chk->data);
3885                                 chk->data = NULL;
3886                         }
3887                 }
3888                 sctp_free_a_chunk(stcb, chk, so_locked);
3889                 /* sa_ignore FREED_MEMORY */
3890         }
3891         for (i = 0; i < asoc->streamoutcnt; i++) {
3892                 /* For each stream */
3893                 outs = &asoc->strmout[i];
3894                 /* clean up any sends there */
3895                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
3896                         atomic_subtract_int(&asoc->stream_queue_cnt, 1);
3897                         TAILQ_REMOVE(&outs->outqueue, sp, next);
3898                         stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, holds_lock);
3899                         sctp_free_spbufspace(stcb, asoc, sp);
3900                         if (sp->data) {
3901                                 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
3902                                     error, (void *)sp, so_locked);
3903                                 if (sp->data) {
3904                                         sctp_m_freem(sp->data);
3905                                         sp->data = NULL;
3906                                         sp->tail_mbuf = NULL;
3907                                         sp->length = 0;
3908                                 }
3909                         }
3910                         if (sp->net) {
3911                                 sctp_free_remote_addr(sp->net);
3912                                 sp->net = NULL;
3913                         }
3914                         /* Free the chunk */
3915                         sctp_free_a_strmoq(stcb, sp, so_locked);
3916                         /* sa_ignore FREED_MEMORY */
3917                 }
3918         }
3919
3920         if (holds_lock == 0) {
3921                 SCTP_TCB_SEND_UNLOCK(stcb);
3922         }
3923 }
3924
3925 void
3926 sctp_abort_notification(struct sctp_tcb *stcb, uint8_t from_peer, uint16_t error,
3927     struct sctp_abort_chunk *abort, int so_locked
3928 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3929     SCTP_UNUSED
3930 #endif
3931 )
3932 {
3933         if (stcb == NULL) {
3934                 return;
3935         }
3936         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
3937             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
3938             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
3939                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED;
3940         }
3941         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3942             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3943             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3944                 return;
3945         }
3946         /* Tell them we lost the asoc */
3947         sctp_report_all_outbound(stcb, error, 1, so_locked);
3948         if (from_peer) {
3949                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_REM_ABORTED, stcb, error, abort, so_locked);
3950         } else {
3951                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_LOC_ABORTED, stcb, error, abort, so_locked);
3952         }
3953 }
3954
3955 void
3956 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3957     struct mbuf *m, int iphlen,
3958     struct sockaddr *src, struct sockaddr *dst,
3959     struct sctphdr *sh, struct mbuf *op_err,
3960     uint8_t mflowtype, uint32_t mflowid,
3961     uint32_t vrf_id, uint16_t port)
3962 {
3963         uint32_t vtag;
3964 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3965         struct socket *so;
3966 #endif
3967
3968         vtag = 0;
3969         if (stcb != NULL) {
3970                 vtag = stcb->asoc.peer_vtag;
3971                 vrf_id = stcb->asoc.vrf_id;
3972         }
3973         sctp_send_abort(m, iphlen, src, dst, sh, vtag, op_err,
3974             mflowtype, mflowid, inp->fibnum,
3975             vrf_id, port);
3976         if (stcb != NULL) {
3977                 /* We have a TCB to abort, send notification too */
3978                 sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED);
3979                 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
3980                 /* Ok, now lets free it */
3981 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3982                 so = SCTP_INP_SO(inp);
3983                 atomic_add_int(&stcb->asoc.refcnt, 1);
3984                 SCTP_TCB_UNLOCK(stcb);
3985                 SCTP_SOCKET_LOCK(so, 1);
3986                 SCTP_TCB_LOCK(stcb);
3987                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3988 #endif
3989                 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3990                 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
3991                     (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3992                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3993                 }
3994                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
3995                     SCTP_FROM_SCTPUTIL + SCTP_LOC_4);
3996 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3997                 SCTP_SOCKET_UNLOCK(so, 1);
3998 #endif
3999         }
4000 }
4001 #ifdef SCTP_ASOCLOG_OF_TSNS
4002 void
4003 sctp_print_out_track_log(struct sctp_tcb *stcb)
4004 {
4005 #ifdef NOSIY_PRINTS
4006         int i;
4007
4008         SCTP_PRINTF("Last ep reason:%x\n", stcb->sctp_ep->last_abort_code);
4009         SCTP_PRINTF("IN bound TSN log-aaa\n");
4010         if ((stcb->asoc.tsn_in_at == 0) && (stcb->asoc.tsn_in_wrapped == 0)) {
4011                 SCTP_PRINTF("None rcvd\n");
4012                 goto none_in;
4013         }
4014         if (stcb->asoc.tsn_in_wrapped) {
4015                 for (i = stcb->asoc.tsn_in_at; i < SCTP_TSN_LOG_SIZE; i++) {
4016                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4017                             stcb->asoc.in_tsnlog[i].tsn,
4018                             stcb->asoc.in_tsnlog[i].strm,
4019                             stcb->asoc.in_tsnlog[i].seq,
4020                             stcb->asoc.in_tsnlog[i].flgs,
4021                             stcb->asoc.in_tsnlog[i].sz);
4022                 }
4023         }
4024         if (stcb->asoc.tsn_in_at) {
4025                 for (i = 0; i < stcb->asoc.tsn_in_at; i++) {
4026                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4027                             stcb->asoc.in_tsnlog[i].tsn,
4028                             stcb->asoc.in_tsnlog[i].strm,
4029                             stcb->asoc.in_tsnlog[i].seq,
4030                             stcb->asoc.in_tsnlog[i].flgs,
4031                             stcb->asoc.in_tsnlog[i].sz);
4032                 }
4033         }
4034 none_in:
4035         SCTP_PRINTF("OUT bound TSN log-aaa\n");
4036         if ((stcb->asoc.tsn_out_at == 0) &&
4037             (stcb->asoc.tsn_out_wrapped == 0)) {
4038                 SCTP_PRINTF("None sent\n");
4039         }
4040         if (stcb->asoc.tsn_out_wrapped) {
4041                 for (i = stcb->asoc.tsn_out_at; i < SCTP_TSN_LOG_SIZE; i++) {
4042                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4043                             stcb->asoc.out_tsnlog[i].tsn,
4044                             stcb->asoc.out_tsnlog[i].strm,
4045                             stcb->asoc.out_tsnlog[i].seq,
4046                             stcb->asoc.out_tsnlog[i].flgs,
4047                             stcb->asoc.out_tsnlog[i].sz);
4048                 }
4049         }
4050         if (stcb->asoc.tsn_out_at) {
4051                 for (i = 0; i < stcb->asoc.tsn_out_at; i++) {
4052                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4053                             stcb->asoc.out_tsnlog[i].tsn,
4054                             stcb->asoc.out_tsnlog[i].strm,
4055                             stcb->asoc.out_tsnlog[i].seq,
4056                             stcb->asoc.out_tsnlog[i].flgs,
4057                             stcb->asoc.out_tsnlog[i].sz);
4058                 }
4059         }
4060 #endif
4061 }
4062 #endif
4063
4064 void
4065 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
4066     struct mbuf *op_err,
4067     int so_locked
4068 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4069     SCTP_UNUSED
4070 #endif
4071 )
4072 {
4073 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4074         struct socket *so;
4075 #endif
4076
4077 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4078         so = SCTP_INP_SO(inp);
4079 #endif
4080         if (stcb == NULL) {
4081                 /* Got to have a TCB */
4082                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4083                         if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4084                                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4085                                     SCTP_CALLED_DIRECTLY_NOCMPSET);
4086                         }
4087                 }
4088                 return;
4089         } else {
4090                 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
4091         }
4092         /* notify the peer */
4093         sctp_send_abort_tcb(stcb, op_err, so_locked);
4094         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4095         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
4096             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4097                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4098         }
4099         /* notify the ulp */
4100         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) {
4101                 sctp_abort_notification(stcb, 0, 0, NULL, so_locked);
4102         }
4103         /* now free the asoc */
4104 #ifdef SCTP_ASOCLOG_OF_TSNS
4105         sctp_print_out_track_log(stcb);
4106 #endif
4107 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4108         if (!so_locked) {
4109                 atomic_add_int(&stcb->asoc.refcnt, 1);
4110                 SCTP_TCB_UNLOCK(stcb);
4111                 SCTP_SOCKET_LOCK(so, 1);
4112                 SCTP_TCB_LOCK(stcb);
4113                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4114         }
4115 #endif
4116         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4117             SCTP_FROM_SCTPUTIL + SCTP_LOC_5);
4118 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4119         if (!so_locked) {
4120                 SCTP_SOCKET_UNLOCK(so, 1);
4121         }
4122 #endif
4123 }
4124
4125 void
4126 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset,
4127     struct sockaddr *src, struct sockaddr *dst,
4128     struct sctphdr *sh, struct sctp_inpcb *inp,
4129     struct mbuf *cause,
4130     uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
4131     uint32_t vrf_id, uint16_t port)
4132 {
4133         struct sctp_chunkhdr *ch, chunk_buf;
4134         unsigned int chk_length;
4135         int contains_init_chunk;
4136
4137         SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue);
4138         /* Generate a TO address for future reference */
4139         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
4140                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4141                         sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4142                             SCTP_CALLED_DIRECTLY_NOCMPSET);
4143                 }
4144         }
4145         contains_init_chunk = 0;
4146         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4147             sizeof(*ch), (uint8_t *)&chunk_buf);
4148         while (ch != NULL) {
4149                 chk_length = ntohs(ch->chunk_length);
4150                 if (chk_length < sizeof(*ch)) {
4151                         /* break to abort land */
4152                         break;
4153                 }
4154                 switch (ch->chunk_type) {
4155                 case SCTP_INIT:
4156                         contains_init_chunk = 1;
4157                         break;
4158                 case SCTP_PACKET_DROPPED:
4159                         /* we don't respond to pkt-dropped */
4160                         return;
4161                 case SCTP_ABORT_ASSOCIATION:
4162                         /* we don't respond with an ABORT to an ABORT */
4163                         return;
4164                 case SCTP_SHUTDOWN_COMPLETE:
4165                         /*
4166                          * we ignore it since we are not waiting for it and
4167                          * peer is gone
4168                          */
4169                         return;
4170                 case SCTP_SHUTDOWN_ACK:
4171                         sctp_send_shutdown_complete2(src, dst, sh,
4172                             mflowtype, mflowid, fibnum,
4173                             vrf_id, port);
4174                         return;
4175                 default:
4176                         break;
4177                 }
4178                 offset += SCTP_SIZE32(chk_length);
4179                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4180                     sizeof(*ch), (uint8_t *)&chunk_buf);
4181         }
4182         if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
4183             ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
4184             (contains_init_chunk == 0))) {
4185                 sctp_send_abort(m, iphlen, src, dst, sh, 0, cause,
4186                     mflowtype, mflowid, fibnum,
4187                     vrf_id, port);
4188         }
4189 }
4190
4191 /*
4192  * check the inbound datagram to make sure there is not an abort inside it,
4193  * if there is return 1, else return 0.
4194  */
4195 int
4196 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t *vtagfill)
4197 {
4198         struct sctp_chunkhdr *ch;
4199         struct sctp_init_chunk *init_chk, chunk_buf;
4200         int offset;
4201         unsigned int chk_length;
4202
4203         offset = iphlen + sizeof(struct sctphdr);
4204         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch),
4205             (uint8_t *)&chunk_buf);
4206         while (ch != NULL) {
4207                 chk_length = ntohs(ch->chunk_length);
4208                 if (chk_length < sizeof(*ch)) {
4209                         /* packet is probably corrupt */
4210                         break;
4211                 }
4212                 /* we seem to be ok, is it an abort? */
4213                 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) {
4214                         /* yep, tell them */
4215                         return (1);
4216                 }
4217                 if (ch->chunk_type == SCTP_INITIATION) {
4218                         /* need to update the Vtag */
4219                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
4220                             offset, sizeof(*init_chk), (uint8_t *)&chunk_buf);
4221                         if (init_chk != NULL) {
4222                                 *vtagfill = ntohl(init_chk->init.initiate_tag);
4223                         }
4224                 }
4225                 /* Nope, move to the next chunk */
4226                 offset += SCTP_SIZE32(chk_length);
4227                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4228                     sizeof(*ch), (uint8_t *)&chunk_buf);
4229         }
4230         return (0);
4231 }
4232
4233 /*
4234  * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id
4235  * set (i.e. it's 0) so, create this function to compare link local scopes
4236  */
4237 #ifdef INET6
4238 uint32_t
4239 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2)
4240 {
4241         struct sockaddr_in6 a, b;
4242
4243         /* save copies */
4244         a = *addr1;
4245         b = *addr2;
4246
4247         if (a.sin6_scope_id == 0)
4248                 if (sa6_recoverscope(&a)) {
4249                         /* can't get scope, so can't match */
4250                         return (0);
4251                 }
4252         if (b.sin6_scope_id == 0)
4253                 if (sa6_recoverscope(&b)) {
4254                         /* can't get scope, so can't match */
4255                         return (0);
4256                 }
4257         if (a.sin6_scope_id != b.sin6_scope_id)
4258                 return (0);
4259
4260         return (1);
4261 }
4262
4263 /*
4264  * returns a sockaddr_in6 with embedded scope recovered and removed
4265  */
4266 struct sockaddr_in6 *
4267 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store)
4268 {
4269         /* check and strip embedded scope junk */
4270         if (addr->sin6_family == AF_INET6) {
4271                 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) {
4272                         if (addr->sin6_scope_id == 0) {
4273                                 *store = *addr;
4274                                 if (!sa6_recoverscope(store)) {
4275                                         /* use the recovered scope */
4276                                         addr = store;
4277                                 }
4278                         } else {
4279                                 /* else, return the original "to" addr */
4280                                 in6_clearscope(&addr->sin6_addr);
4281                         }
4282                 }
4283         }
4284         return (addr);
4285 }
4286 #endif
4287
4288 /*
4289  * are the two addresses the same?  currently a "scopeless" check returns: 1
4290  * if same, 0 if not
4291  */
4292 int
4293 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2)
4294 {
4295
4296         /* must be valid */
4297         if (sa1 == NULL || sa2 == NULL)
4298                 return (0);
4299
4300         /* must be the same family */
4301         if (sa1->sa_family != sa2->sa_family)
4302                 return (0);
4303
4304         switch (sa1->sa_family) {
4305 #ifdef INET6
4306         case AF_INET6:
4307                 {
4308                         /* IPv6 addresses */
4309                         struct sockaddr_in6 *sin6_1, *sin6_2;
4310
4311                         sin6_1 = (struct sockaddr_in6 *)sa1;
4312                         sin6_2 = (struct sockaddr_in6 *)sa2;
4313                         return (SCTP6_ARE_ADDR_EQUAL(sin6_1,
4314                             sin6_2));
4315                 }
4316 #endif
4317 #ifdef INET
4318         case AF_INET:
4319                 {
4320                         /* IPv4 addresses */
4321                         struct sockaddr_in *sin_1, *sin_2;
4322
4323                         sin_1 = (struct sockaddr_in *)sa1;
4324                         sin_2 = (struct sockaddr_in *)sa2;
4325                         return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr);
4326                 }
4327 #endif
4328         default:
4329                 /* we don't do these... */
4330                 return (0);
4331         }
4332 }
4333
4334 void
4335 sctp_print_address(struct sockaddr *sa)
4336 {
4337 #ifdef INET6
4338         char ip6buf[INET6_ADDRSTRLEN];
4339 #endif
4340
4341         switch (sa->sa_family) {
4342 #ifdef INET6
4343         case AF_INET6:
4344                 {
4345                         struct sockaddr_in6 *sin6;
4346
4347                         sin6 = (struct sockaddr_in6 *)sa;
4348                         SCTP_PRINTF("IPv6 address: %s:port:%d scope:%u\n",
4349                             ip6_sprintf(ip6buf, &sin6->sin6_addr),
4350                             ntohs(sin6->sin6_port),
4351                             sin6->sin6_scope_id);
4352                         break;
4353                 }
4354 #endif
4355 #ifdef INET
4356         case AF_INET:
4357                 {
4358                         struct sockaddr_in *sin;
4359                         unsigned char *p;
4360
4361                         sin = (struct sockaddr_in *)sa;
4362                         p = (unsigned char *)&sin->sin_addr;
4363                         SCTP_PRINTF("IPv4 address: %u.%u.%u.%u:%d\n",
4364                             p[0], p[1], p[2], p[3], ntohs(sin->sin_port));
4365                         break;
4366                 }
4367 #endif
4368         default:
4369                 SCTP_PRINTF("?\n");
4370                 break;
4371         }
4372 }
4373
4374 void
4375 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
4376     struct sctp_inpcb *new_inp,
4377     struct sctp_tcb *stcb,
4378     int waitflags)
4379 {
4380         /*
4381          * go through our old INP and pull off any control structures that
4382          * belong to stcb and move then to the new inp.
4383          */
4384         struct socket *old_so, *new_so;
4385         struct sctp_queued_to_read *control, *nctl;
4386         struct sctp_readhead tmp_queue;
4387         struct mbuf *m;
4388         int error = 0;
4389
4390         old_so = old_inp->sctp_socket;
4391         new_so = new_inp->sctp_socket;
4392         TAILQ_INIT(&tmp_queue);
4393         error = sblock(&old_so->so_rcv, waitflags);
4394         if (error) {
4395                 /*
4396                  * Gak, can't get sblock, we have a problem. data will be
4397                  * left stranded.. and we don't dare look at it since the
4398                  * other thread may be reading something. Oh well, its a
4399                  * screwed up app that does a peeloff OR a accept while
4400                  * reading from the main socket... actually its only the
4401                  * peeloff() case, since I think read will fail on a
4402                  * listening socket..
4403                  */
4404                 return;
4405         }
4406         /* lock the socket buffers */
4407         SCTP_INP_READ_LOCK(old_inp);
4408         TAILQ_FOREACH_SAFE(control, &old_inp->read_queue, next, nctl) {
4409                 /* Pull off all for out target stcb */
4410                 if (control->stcb == stcb) {
4411                         /* remove it we want it */
4412                         TAILQ_REMOVE(&old_inp->read_queue, control, next);
4413                         TAILQ_INSERT_TAIL(&tmp_queue, control, next);
4414                         m = control->data;
4415                         while (m) {
4416                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4417                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
4418                                 }
4419                                 sctp_sbfree(control, stcb, &old_so->so_rcv, m);
4420                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4421                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4422                                 }
4423                                 m = SCTP_BUF_NEXT(m);
4424                         }
4425                 }
4426         }
4427         SCTP_INP_READ_UNLOCK(old_inp);
4428         /* Remove the sb-lock on the old socket */
4429
4430         sbunlock(&old_so->so_rcv);
4431         /* Now we move them over to the new socket buffer */
4432         SCTP_INP_READ_LOCK(new_inp);
4433         TAILQ_FOREACH_SAFE(control, &tmp_queue, next, nctl) {
4434                 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next);
4435                 m = control->data;
4436                 while (m) {
4437                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4438                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4439                         }
4440                         sctp_sballoc(stcb, &new_so->so_rcv, m);
4441                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4442                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4443                         }
4444                         m = SCTP_BUF_NEXT(m);
4445                 }
4446         }
4447         SCTP_INP_READ_UNLOCK(new_inp);
4448 }
4449
4450 void
4451 sctp_wakeup_the_read_socket(struct sctp_inpcb *inp,
4452     struct sctp_tcb *stcb,
4453     int so_locked
4454 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4455     SCTP_UNUSED
4456 #endif
4457 )
4458 {
4459         if ((inp != NULL) && (inp->sctp_socket != NULL)) {
4460 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4461                 struct socket *so;
4462
4463                 so = SCTP_INP_SO(inp);
4464                 if (!so_locked) {
4465                         if (stcb) {
4466                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4467                                 SCTP_TCB_UNLOCK(stcb);
4468                         }
4469                         SCTP_SOCKET_LOCK(so, 1);
4470                         if (stcb) {
4471                                 SCTP_TCB_LOCK(stcb);
4472                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4473                         }
4474                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4475                                 SCTP_SOCKET_UNLOCK(so, 1);
4476                                 return;
4477                         }
4478                 }
4479 #endif
4480                 sctp_sorwakeup(inp, inp->sctp_socket);
4481 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4482                 if (!so_locked) {
4483                         SCTP_SOCKET_UNLOCK(so, 1);
4484                 }
4485 #endif
4486         }
4487 }
4488
4489 void
4490 sctp_add_to_readq(struct sctp_inpcb *inp,
4491     struct sctp_tcb *stcb,
4492     struct sctp_queued_to_read *control,
4493     struct sockbuf *sb,
4494     int end,
4495     int inp_read_lock_held,
4496     int so_locked
4497 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4498     SCTP_UNUSED
4499 #endif
4500 )
4501 {
4502         /*
4503          * Here we must place the control on the end of the socket read
4504          * queue AND increment sb_cc so that select will work properly on
4505          * read.
4506          */
4507         struct mbuf *m, *prev = NULL;
4508
4509         if (inp == NULL) {
4510                 /* Gak, TSNH!! */
4511 #ifdef INVARIANTS
4512                 panic("Gak, inp NULL on add_to_readq");
4513 #endif
4514                 return;
4515         }
4516         if (inp_read_lock_held == 0)
4517                 SCTP_INP_READ_LOCK(inp);
4518         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
4519                 sctp_free_remote_addr(control->whoFrom);
4520                 if (control->data) {
4521                         sctp_m_freem(control->data);
4522                         control->data = NULL;
4523                 }
4524                 sctp_free_a_readq(stcb, control);
4525                 if (inp_read_lock_held == 0)
4526                         SCTP_INP_READ_UNLOCK(inp);
4527                 return;
4528         }
4529         if (!(control->spec_flags & M_NOTIFICATION)) {
4530                 atomic_add_int(&inp->total_recvs, 1);
4531                 if (!control->do_not_ref_stcb) {
4532                         atomic_add_int(&stcb->total_recvs, 1);
4533                 }
4534         }
4535         m = control->data;
4536         control->held_length = 0;
4537         control->length = 0;
4538         while (m) {
4539                 if (SCTP_BUF_LEN(m) == 0) {
4540                         /* Skip mbufs with NO length */
4541                         if (prev == NULL) {
4542                                 /* First one */
4543                                 control->data = sctp_m_free(m);
4544                                 m = control->data;
4545                         } else {
4546                                 SCTP_BUF_NEXT(prev) = sctp_m_free(m);
4547                                 m = SCTP_BUF_NEXT(prev);
4548                         }
4549                         if (m == NULL) {
4550                                 control->tail_mbuf = prev;
4551                         }
4552                         continue;
4553                 }
4554                 prev = m;
4555                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4556                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4557                 }
4558                 sctp_sballoc(stcb, sb, m);
4559                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4560                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4561                 }
4562                 atomic_add_int(&control->length, SCTP_BUF_LEN(m));
4563                 m = SCTP_BUF_NEXT(m);
4564         }
4565         if (prev != NULL) {
4566                 control->tail_mbuf = prev;
4567         } else {
4568                 /* Everything got collapsed out?? */
4569                 sctp_free_remote_addr(control->whoFrom);
4570                 sctp_free_a_readq(stcb, control);
4571                 if (inp_read_lock_held == 0)
4572                         SCTP_INP_READ_UNLOCK(inp);
4573                 return;
4574         }
4575         if (end) {
4576                 control->end_added = 1;
4577         }
4578         TAILQ_INSERT_TAIL(&inp->read_queue, control, next);
4579         control->on_read_q = 1;
4580         if (inp_read_lock_held == 0)
4581                 SCTP_INP_READ_UNLOCK(inp);
4582         if (inp && inp->sctp_socket) {
4583                 sctp_wakeup_the_read_socket(inp, stcb, so_locked);
4584         }
4585 }
4586
4587 /*************HOLD THIS COMMENT FOR PATCH FILE OF
4588  *************ALTERNATE ROUTING CODE
4589  */
4590
4591 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF
4592  *************ALTERNATE ROUTING CODE
4593  */
4594
4595 struct mbuf *
4596 sctp_generate_cause(uint16_t code, char *info)
4597 {
4598         struct mbuf *m;
4599         struct sctp_gen_error_cause *cause;
4600         size_t info_len;
4601         uint16_t len;
4602
4603         if ((code == 0) || (info == NULL)) {
4604                 return (NULL);
4605         }
4606         info_len = strlen(info);
4607         if (info_len > (SCTP_MAX_CAUSE_LENGTH - sizeof(struct sctp_paramhdr))) {
4608                 return (NULL);
4609         }
4610         len = (uint16_t)(sizeof(struct sctp_paramhdr) + info_len);
4611         m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
4612         if (m != NULL) {
4613                 SCTP_BUF_LEN(m) = len;
4614                 cause = mtod(m, struct sctp_gen_error_cause *);
4615                 cause->code = htons(code);
4616                 cause->length = htons(len);
4617                 memcpy(cause->info, info, info_len);
4618         }
4619         return (m);
4620 }
4621
4622 struct mbuf *
4623 sctp_generate_no_user_data_cause(uint32_t tsn)
4624 {
4625         struct mbuf *m;
4626         struct sctp_error_no_user_data *no_user_data_cause;
4627         uint16_t len;
4628
4629         len = (uint16_t)sizeof(struct sctp_error_no_user_data);
4630         m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
4631         if (m != NULL) {
4632                 SCTP_BUF_LEN(m) = len;
4633                 no_user_data_cause = mtod(m, struct sctp_error_no_user_data *);
4634                 no_user_data_cause->cause.code = htons(SCTP_CAUSE_NO_USER_DATA);
4635                 no_user_data_cause->cause.length = htons(len);
4636                 no_user_data_cause->tsn = htonl(tsn);
4637         }
4638         return (m);
4639 }
4640
4641 #ifdef SCTP_MBCNT_LOGGING
4642 void
4643 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc,
4644     struct sctp_tmit_chunk *tp1, int chk_cnt)
4645 {
4646         if (tp1->data == NULL) {
4647                 return;
4648         }
4649         asoc->chunks_on_out_queue -= chk_cnt;
4650         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBCNT_LOGGING_ENABLE) {
4651                 sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE,
4652                     asoc->total_output_queue_size,
4653                     tp1->book_size,
4654                     0,
4655                     tp1->mbcnt);
4656         }
4657         if (asoc->total_output_queue_size >= tp1->book_size) {
4658                 atomic_add_int(&asoc->total_output_queue_size, -tp1->book_size);
4659         } else {
4660                 asoc->total_output_queue_size = 0;
4661         }
4662
4663         if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) ||
4664             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) {
4665                 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) {
4666                         stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size;
4667                 } else {
4668                         stcb->sctp_socket->so_snd.sb_cc = 0;
4669
4670                 }
4671         }
4672 }
4673
4674 #endif
4675
4676 int
4677 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1,
4678     uint8_t sent, int so_locked
4679 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4680     SCTP_UNUSED
4681 #endif
4682 )
4683 {
4684         struct sctp_stream_out *strq;
4685         struct sctp_tmit_chunk *chk = NULL, *tp2;
4686         struct sctp_stream_queue_pending *sp;
4687         uint32_t mid;
4688         uint16_t sid;
4689         uint8_t foundeom = 0;
4690         int ret_sz = 0;
4691         int notdone;
4692         int do_wakeup_routine = 0;
4693
4694         sid = tp1->rec.data.sid;
4695         mid = tp1->rec.data.mid;
4696         if (sent || !(tp1->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG)) {
4697                 stcb->asoc.abandoned_sent[0]++;
4698                 stcb->asoc.abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
4699                 stcb->asoc.strmout[sid].abandoned_sent[0]++;
4700 #if defined(SCTP_DETAILED_STR_STATS)
4701                 stcb->asoc.strmout[stream].abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
4702 #endif
4703         } else {
4704                 stcb->asoc.abandoned_unsent[0]++;
4705                 stcb->asoc.abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
4706                 stcb->asoc.strmout[sid].abandoned_unsent[0]++;
4707 #if defined(SCTP_DETAILED_STR_STATS)
4708                 stcb->asoc.strmout[stream].abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
4709 #endif
4710         }
4711         do {
4712                 ret_sz += tp1->book_size;
4713                 if (tp1->data != NULL) {
4714                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4715                                 sctp_flight_size_decrease(tp1);
4716                                 sctp_total_flight_decrease(stcb, tp1);
4717                         }
4718                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4719                         stcb->asoc.peers_rwnd += tp1->send_size;
4720                         stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh);
4721                         if (sent) {
4722                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
4723                         } else {
4724                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
4725                         }
4726                         if (tp1->data) {
4727                                 sctp_m_freem(tp1->data);
4728                                 tp1->data = NULL;
4729                         }
4730                         do_wakeup_routine = 1;
4731                         if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
4732                                 stcb->asoc.sent_queue_cnt_removeable--;
4733                         }
4734                 }
4735                 tp1->sent = SCTP_FORWARD_TSN_SKIP;
4736                 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
4737                     SCTP_DATA_NOT_FRAG) {
4738                         /* not frag'ed we ae done   */
4739                         notdone = 0;
4740                         foundeom = 1;
4741                 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4742                         /* end of frag, we are done */
4743                         notdone = 0;
4744                         foundeom = 1;
4745                 } else {
4746                         /*
4747                          * Its a begin or middle piece, we must mark all of
4748                          * it
4749                          */
4750                         notdone = 1;
4751                         tp1 = TAILQ_NEXT(tp1, sctp_next);
4752                 }
4753         } while (tp1 && notdone);
4754         if (foundeom == 0) {
4755                 /*
4756                  * The multi-part message was scattered across the send and
4757                  * sent queue.
4758                  */
4759                 TAILQ_FOREACH_SAFE(tp1, &stcb->asoc.send_queue, sctp_next, tp2) {
4760                         if ((tp1->rec.data.sid != sid) ||
4761                             (!SCTP_MID_EQ(stcb->asoc.idata_supported, tp1->rec.data.mid, mid))) {
4762                                 break;
4763                         }
4764                         /*
4765                          * save to chk in case we have some on stream out
4766                          * queue. If so and we have an un-transmitted one we
4767                          * don't have to fudge the TSN.
4768                          */
4769                         chk = tp1;
4770                         ret_sz += tp1->book_size;
4771                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4772                         if (sent) {
4773                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
4774                         } else {
4775                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
4776                         }
4777                         if (tp1->data) {
4778                                 sctp_m_freem(tp1->data);
4779                                 tp1->data = NULL;
4780                         }
4781                         /* No flight involved here book the size to 0 */
4782                         tp1->book_size = 0;
4783                         if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4784                                 foundeom = 1;
4785                         }
4786                         do_wakeup_routine = 1;
4787                         tp1->sent = SCTP_FORWARD_TSN_SKIP;
4788                         TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next);
4789                         /*
4790                          * on to the sent queue so we can wait for it to be
4791                          * passed by.
4792                          */
4793                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1,
4794                             sctp_next);
4795                         stcb->asoc.send_queue_cnt--;
4796                         stcb->asoc.sent_queue_cnt++;
4797                 }
4798         }
4799         if (foundeom == 0) {
4800                 /*
4801                  * Still no eom found. That means there is stuff left on the
4802                  * stream out queue.. yuck.
4803                  */
4804                 SCTP_TCB_SEND_LOCK(stcb);
4805                 strq = &stcb->asoc.strmout[sid];
4806                 sp = TAILQ_FIRST(&strq->outqueue);
4807                 if (sp != NULL) {
4808                         sp->discard_rest = 1;
4809                         /*
4810                          * We may need to put a chunk on the queue that
4811                          * holds the TSN that would have been sent with the
4812                          * LAST bit.
4813                          */
4814                         if (chk == NULL) {
4815                                 /* Yep, we have to */
4816                                 sctp_alloc_a_chunk(stcb, chk);
4817                                 if (chk == NULL) {
4818                                         /*
4819                                          * we are hosed. All we can do is
4820                                          * nothing.. which will cause an
4821                                          * abort if the peer is paying
4822                                          * attention.
4823                                          */
4824                                         goto oh_well;
4825                                 }
4826                                 memset(chk, 0, sizeof(*chk));
4827                                 chk->rec.data.rcv_flags = 0;
4828                                 chk->sent = SCTP_FORWARD_TSN_SKIP;
4829                                 chk->asoc = &stcb->asoc;
4830                                 if (stcb->asoc.idata_supported == 0) {
4831                                         if (sp->sinfo_flags & SCTP_UNORDERED) {
4832                                                 chk->rec.data.mid = 0;
4833                                         } else {
4834                                                 chk->rec.data.mid = strq->next_mid_ordered;
4835                                         }
4836                                 } else {
4837                                         if (sp->sinfo_flags & SCTP_UNORDERED) {
4838                                                 chk->rec.data.mid = strq->next_mid_unordered;
4839                                         } else {
4840                                                 chk->rec.data.mid = strq->next_mid_ordered;
4841                                         }
4842                                 }
4843                                 chk->rec.data.sid = sp->sid;
4844                                 chk->rec.data.ppid = sp->ppid;
4845                                 chk->rec.data.context = sp->context;
4846                                 chk->flags = sp->act_flags;
4847                                 chk->whoTo = NULL;
4848                                 chk->rec.data.tsn = atomic_fetchadd_int(&stcb->asoc.sending_seq, 1);
4849                                 strq->chunks_on_queues++;
4850                                 TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, chk, sctp_next);
4851                                 stcb->asoc.sent_queue_cnt++;
4852                                 stcb->asoc.pr_sctp_cnt++;
4853                         }
4854                         chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
4855                         if (sp->sinfo_flags & SCTP_UNORDERED) {
4856                                 chk->rec.data.rcv_flags |= SCTP_DATA_UNORDERED;
4857                         }
4858                         if (stcb->asoc.idata_supported == 0) {
4859                                 if ((sp->sinfo_flags & SCTP_UNORDERED) == 0) {
4860                                         strq->next_mid_ordered++;
4861                                 }
4862                         } else {
4863                                 if (sp->sinfo_flags & SCTP_UNORDERED) {
4864                                         strq->next_mid_unordered++;
4865                                 } else {
4866                                         strq->next_mid_ordered++;
4867                                 }
4868                         }
4869         oh_well:
4870                         if (sp->data) {
4871                                 /*
4872                                  * Pull any data to free up the SB and allow
4873                                  * sender to "add more" while we will throw
4874                                  * away :-)
4875                                  */
4876                                 sctp_free_spbufspace(stcb, &stcb->asoc, sp);
4877                                 ret_sz += sp->length;
4878                                 do_wakeup_routine = 1;
4879                                 sp->some_taken = 1;
4880                                 sctp_m_freem(sp->data);
4881                                 sp->data = NULL;
4882                                 sp->tail_mbuf = NULL;
4883                                 sp->length = 0;
4884                         }
4885                 }
4886                 SCTP_TCB_SEND_UNLOCK(stcb);
4887         }
4888         if (do_wakeup_routine) {
4889 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4890                 struct socket *so;
4891
4892                 so = SCTP_INP_SO(stcb->sctp_ep);
4893                 if (!so_locked) {
4894                         atomic_add_int(&stcb->asoc.refcnt, 1);
4895                         SCTP_TCB_UNLOCK(stcb);
4896                         SCTP_SOCKET_LOCK(so, 1);
4897                         SCTP_TCB_LOCK(stcb);
4898                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
4899                         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
4900                                 /* assoc was freed while we were unlocked */
4901                                 SCTP_SOCKET_UNLOCK(so, 1);
4902                                 return (ret_sz);
4903                         }
4904                 }
4905 #endif
4906                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
4907 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4908                 if (!so_locked) {
4909                         SCTP_SOCKET_UNLOCK(so, 1);
4910                 }
4911 #endif
4912         }
4913         return (ret_sz);
4914 }
4915
4916 /*
4917  * checks to see if the given address, sa, is one that is currently known by
4918  * the kernel note: can't distinguish the same address on multiple interfaces
4919  * and doesn't handle multiple addresses with different zone/scope id's note:
4920  * ifa_ifwithaddr() compares the entire sockaddr struct
4921  */
4922 struct sctp_ifa *
4923 sctp_find_ifa_in_ep(struct sctp_inpcb *inp, struct sockaddr *addr,
4924     int holds_lock)
4925 {
4926         struct sctp_laddr *laddr;
4927
4928         if (holds_lock == 0) {
4929                 SCTP_INP_RLOCK(inp);
4930         }
4931         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
4932                 if (laddr->ifa == NULL)
4933                         continue;
4934                 if (addr->sa_family != laddr->ifa->address.sa.sa_family)
4935                         continue;
4936 #ifdef INET
4937                 if (addr->sa_family == AF_INET) {
4938                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
4939                             laddr->ifa->address.sin.sin_addr.s_addr) {
4940                                 /* found him. */
4941                                 if (holds_lock == 0) {
4942                                         SCTP_INP_RUNLOCK(inp);
4943                                 }
4944                                 return (laddr->ifa);
4945                                 break;
4946                         }
4947                 }
4948 #endif
4949 #ifdef INET6
4950                 if (addr->sa_family == AF_INET6) {
4951                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
4952                             &laddr->ifa->address.sin6)) {
4953                                 /* found him. */
4954                                 if (holds_lock == 0) {
4955                                         SCTP_INP_RUNLOCK(inp);
4956                                 }
4957                                 return (laddr->ifa);
4958                                 break;
4959                         }
4960                 }
4961 #endif
4962         }
4963         if (holds_lock == 0) {
4964                 SCTP_INP_RUNLOCK(inp);
4965         }
4966         return (NULL);
4967 }
4968
4969 uint32_t
4970 sctp_get_ifa_hash_val(struct sockaddr *addr)
4971 {
4972         switch (addr->sa_family) {
4973 #ifdef INET
4974         case AF_INET:
4975                 {
4976                         struct sockaddr_in *sin;
4977
4978                         sin = (struct sockaddr_in *)addr;
4979                         return (sin->sin_addr.s_addr ^ (sin->sin_addr.s_addr >> 16));
4980                 }
4981 #endif
4982 #ifdef INET6
4983         case AF_INET6:
4984                 {
4985                         struct sockaddr_in6 *sin6;
4986                         uint32_t hash_of_addr;
4987
4988                         sin6 = (struct sockaddr_in6 *)addr;
4989                         hash_of_addr = (sin6->sin6_addr.s6_addr32[0] +
4990                             sin6->sin6_addr.s6_addr32[1] +
4991                             sin6->sin6_addr.s6_addr32[2] +
4992                             sin6->sin6_addr.s6_addr32[3]);
4993                         hash_of_addr = (hash_of_addr ^ (hash_of_addr >> 16));
4994                         return (hash_of_addr);
4995                 }
4996 #endif
4997         default:
4998                 break;
4999         }
5000         return (0);
5001 }
5002
5003 struct sctp_ifa *
5004 sctp_find_ifa_by_addr(struct sockaddr *addr, uint32_t vrf_id, int holds_lock)
5005 {
5006         struct sctp_ifa *sctp_ifap;
5007         struct sctp_vrf *vrf;
5008         struct sctp_ifalist *hash_head;
5009         uint32_t hash_of_addr;
5010
5011         if (holds_lock == 0)
5012                 SCTP_IPI_ADDR_RLOCK();
5013
5014         vrf = sctp_find_vrf(vrf_id);
5015         if (vrf == NULL) {
5016                 if (holds_lock == 0)
5017                         SCTP_IPI_ADDR_RUNLOCK();
5018                 return (NULL);
5019         }
5020         hash_of_addr = sctp_get_ifa_hash_val(addr);
5021
5022         hash_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)];
5023         if (hash_head == NULL) {
5024                 SCTP_PRINTF("hash_of_addr:%x mask:%x table:%x - ",
5025                     hash_of_addr, (uint32_t)vrf->vrf_addr_hashmark,
5026                     (uint32_t)(hash_of_addr & vrf->vrf_addr_hashmark));
5027                 sctp_print_address(addr);
5028                 SCTP_PRINTF("No such bucket for address\n");
5029                 if (holds_lock == 0)
5030                         SCTP_IPI_ADDR_RUNLOCK();
5031
5032                 return (NULL);
5033         }
5034         LIST_FOREACH(sctp_ifap, hash_head, next_bucket) {
5035                 if (addr->sa_family != sctp_ifap->address.sa.sa_family)
5036                         continue;
5037 #ifdef INET
5038                 if (addr->sa_family == AF_INET) {
5039                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
5040                             sctp_ifap->address.sin.sin_addr.s_addr) {
5041                                 /* found him. */
5042                                 if (holds_lock == 0)
5043                                         SCTP_IPI_ADDR_RUNLOCK();
5044                                 return (sctp_ifap);
5045                                 break;
5046                         }
5047                 }
5048 #endif
5049 #ifdef INET6
5050                 if (addr->sa_family == AF_INET6) {
5051                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5052                             &sctp_ifap->address.sin6)) {
5053                                 /* found him. */
5054                                 if (holds_lock == 0)
5055                                         SCTP_IPI_ADDR_RUNLOCK();
5056                                 return (sctp_ifap);
5057                                 break;
5058                         }
5059                 }
5060 #endif
5061         }
5062         if (holds_lock == 0)
5063                 SCTP_IPI_ADDR_RUNLOCK();
5064         return (NULL);
5065 }
5066
5067 static void
5068 sctp_user_rcvd(struct sctp_tcb *stcb, uint32_t *freed_so_far, int hold_rlock,
5069     uint32_t rwnd_req)
5070 {
5071         /* User pulled some data, do we need a rwnd update? */
5072         int r_unlocked = 0;
5073         uint32_t dif, rwnd;
5074         struct socket *so = NULL;
5075
5076         if (stcb == NULL)
5077                 return;
5078
5079         atomic_add_int(&stcb->asoc.refcnt, 1);
5080
5081         if (stcb->asoc.state & (SCTP_STATE_ABOUT_TO_BE_FREED |
5082             SCTP_STATE_SHUTDOWN_RECEIVED |
5083             SCTP_STATE_SHUTDOWN_ACK_SENT)) {
5084                 /* Pre-check If we are freeing no update */
5085                 goto no_lock;
5086         }
5087         SCTP_INP_INCR_REF(stcb->sctp_ep);
5088         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5089             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5090                 goto out;
5091         }
5092         so = stcb->sctp_socket;
5093         if (so == NULL) {
5094                 goto out;
5095         }
5096         atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far);
5097         /* Have you have freed enough to look */
5098         *freed_so_far = 0;
5099         /* Yep, its worth a look and the lock overhead */
5100
5101         /* Figure out what the rwnd would be */
5102         rwnd = sctp_calc_rwnd(stcb, &stcb->asoc);
5103         if (rwnd >= stcb->asoc.my_last_reported_rwnd) {
5104                 dif = rwnd - stcb->asoc.my_last_reported_rwnd;
5105         } else {
5106                 dif = 0;
5107         }
5108         if (dif >= rwnd_req) {
5109                 if (hold_rlock) {
5110                         SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5111                         r_unlocked = 1;
5112                 }
5113                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5114                         /*
5115                          * One last check before we allow the guy possibly
5116                          * to get in. There is a race, where the guy has not
5117                          * reached the gate. In that case
5118                          */
5119                         goto out;
5120                 }
5121                 SCTP_TCB_LOCK(stcb);
5122                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5123                         /* No reports here */
5124                         SCTP_TCB_UNLOCK(stcb);
5125                         goto out;
5126                 }
5127                 SCTP_STAT_INCR(sctps_wu_sacks_sent);
5128                 sctp_send_sack(stcb, SCTP_SO_LOCKED);
5129
5130                 sctp_chunk_output(stcb->sctp_ep, stcb,
5131                     SCTP_OUTPUT_FROM_USR_RCVD, SCTP_SO_LOCKED);
5132                 /* make sure no timer is running */
5133                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL,
5134                     SCTP_FROM_SCTPUTIL + SCTP_LOC_6);
5135                 SCTP_TCB_UNLOCK(stcb);
5136         } else {
5137                 /* Update how much we have pending */
5138                 stcb->freed_by_sorcv_sincelast = dif;
5139         }
5140 out:
5141         if (so && r_unlocked && hold_rlock) {
5142                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
5143         }
5144         SCTP_INP_DECR_REF(stcb->sctp_ep);
5145 no_lock:
5146         atomic_add_int(&stcb->asoc.refcnt, -1);
5147         return;
5148 }
5149
5150 int
5151 sctp_sorecvmsg(struct socket *so,
5152     struct uio *uio,
5153     struct mbuf **mp,
5154     struct sockaddr *from,
5155     int fromlen,
5156     int *msg_flags,
5157     struct sctp_sndrcvinfo *sinfo,
5158     int filling_sinfo)
5159 {
5160         /*
5161          * MSG flags we will look at MSG_DONTWAIT - non-blocking IO.
5162          * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy
5163          * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ??
5164          * On the way out we may send out any combination of:
5165          * MSG_NOTIFICATION MSG_EOR
5166          *
5167          */
5168         struct sctp_inpcb *inp = NULL;
5169         int my_len = 0;
5170         int cp_len = 0, error = 0;
5171         struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
5172         struct mbuf *m = NULL;
5173         struct sctp_tcb *stcb = NULL;
5174         int wakeup_read_socket = 0;
5175         int freecnt_applied = 0;
5176         int out_flags = 0, in_flags = 0;
5177         int block_allowed = 1;
5178         uint32_t freed_so_far = 0;
5179         uint32_t copied_so_far = 0;
5180         int in_eeor_mode = 0;
5181         int no_rcv_needed = 0;
5182         uint32_t rwnd_req = 0;
5183         int hold_sblock = 0;
5184         int hold_rlock = 0;
5185         ssize_t slen = 0;
5186         uint32_t held_length = 0;
5187         int sockbuf_lock = 0;
5188
5189         if (uio == NULL) {
5190                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5191                 return (EINVAL);
5192         }
5193         if (msg_flags) {
5194                 in_flags = *msg_flags;
5195                 if (in_flags & MSG_PEEK)
5196                         SCTP_STAT_INCR(sctps_read_peeks);
5197         } else {
5198                 in_flags = 0;
5199         }
5200         slen = uio->uio_resid;
5201
5202         /* Pull in and set up our int flags */
5203         if (in_flags & MSG_OOB) {
5204                 /* Out of band's NOT supported */
5205                 return (EOPNOTSUPP);
5206         }
5207         if ((in_flags & MSG_PEEK) && (mp != NULL)) {
5208                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5209                 return (EINVAL);
5210         }
5211         if ((in_flags & (MSG_DONTWAIT
5212             | MSG_NBIO
5213             )) ||
5214             SCTP_SO_IS_NBIO(so)) {
5215                 block_allowed = 0;
5216         }
5217         /* setup the endpoint */
5218         inp = (struct sctp_inpcb *)so->so_pcb;
5219         if (inp == NULL) {
5220                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
5221                 return (EFAULT);
5222         }
5223         rwnd_req = (SCTP_SB_LIMIT_RCV(so) >> SCTP_RWND_HIWAT_SHIFT);
5224         /* Must be at least a MTU's worth */
5225         if (rwnd_req < SCTP_MIN_RWND)
5226                 rwnd_req = SCTP_MIN_RWND;
5227         in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
5228         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5229                 sctp_misc_ints(SCTP_SORECV_ENTER,
5230                     rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, (uint32_t)uio->uio_resid);
5231         }
5232         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5233                 sctp_misc_ints(SCTP_SORECV_ENTERPL,
5234                     rwnd_req, block_allowed, so->so_rcv.sb_cc, (uint32_t)uio->uio_resid);
5235         }
5236         error = sblock(&so->so_rcv, (block_allowed ? SBL_WAIT : 0));
5237         if (error) {
5238                 goto release_unlocked;
5239         }
5240         sockbuf_lock = 1;
5241 restart:
5242
5243
5244 restart_nosblocks:
5245         if (hold_sblock == 0) {
5246                 SOCKBUF_LOCK(&so->so_rcv);
5247                 hold_sblock = 1;
5248         }
5249         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5250             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5251                 goto out;
5252         }
5253         if ((so->so_rcv.sb_state & SBS_CANTRCVMORE) && (so->so_rcv.sb_cc == 0)) {
5254                 if (so->so_error) {
5255                         error = so->so_error;
5256                         if ((in_flags & MSG_PEEK) == 0)
5257                                 so->so_error = 0;
5258                         goto out;
5259                 } else {
5260                         if (so->so_rcv.sb_cc == 0) {
5261                                 /* indicate EOF */
5262                                 error = 0;
5263                                 goto out;
5264                         }
5265                 }
5266         }
5267         if (so->so_rcv.sb_cc <= held_length) {
5268                 if (so->so_error) {
5269                         error = so->so_error;
5270                         if ((in_flags & MSG_PEEK) == 0) {
5271                                 so->so_error = 0;
5272                         }
5273                         goto out;
5274                 }
5275                 if ((so->so_rcv.sb_cc == 0) &&
5276                     ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5277                     (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) {
5278                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5279                                 /*
5280                                  * For active open side clear flags for
5281                                  * re-use passive open is blocked by
5282                                  * connect.
5283                                  */
5284                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5285                                         /*
5286                                          * You were aborted, passive side
5287                                          * always hits here
5288                                          */
5289                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5290                                         error = ECONNRESET;
5291                                 }
5292                                 so->so_state &= ~(SS_ISCONNECTING |
5293                                     SS_ISDISCONNECTING |
5294                                     SS_ISCONFIRMING |
5295                                     SS_ISCONNECTED);
5296                                 if (error == 0) {
5297                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5298                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5299                                                 error = ENOTCONN;
5300                                         }
5301                                 }
5302                                 goto out;
5303                         }
5304                 }
5305                 if (block_allowed) {
5306                         error = sbwait(&so->so_rcv);
5307                         if (error) {
5308                                 goto out;
5309                         }
5310                         held_length = 0;
5311                         goto restart_nosblocks;
5312                 } else {
5313                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EWOULDBLOCK);
5314                         error = EWOULDBLOCK;
5315                         goto out;
5316                 }
5317         }
5318         if (hold_sblock == 1) {
5319                 SOCKBUF_UNLOCK(&so->so_rcv);
5320                 hold_sblock = 0;
5321         }
5322         /* we possibly have data we can read */
5323         /* sa_ignore FREED_MEMORY */
5324         control = TAILQ_FIRST(&inp->read_queue);
5325         if (control == NULL) {
5326                 /*
5327                  * This could be happening since the appender did the
5328                  * increment but as not yet did the tailq insert onto the
5329                  * read_queue
5330                  */
5331                 if (hold_rlock == 0) {
5332                         SCTP_INP_READ_LOCK(inp);
5333                 }
5334                 control = TAILQ_FIRST(&inp->read_queue);
5335                 if ((control == NULL) && (so->so_rcv.sb_cc != 0)) {
5336 #ifdef INVARIANTS
5337                         panic("Huh, its non zero and nothing on control?");
5338 #endif
5339                         so->so_rcv.sb_cc = 0;
5340                 }
5341                 SCTP_INP_READ_UNLOCK(inp);
5342                 hold_rlock = 0;
5343                 goto restart;
5344         }
5345         if ((control->length == 0) &&
5346             (control->do_not_ref_stcb)) {
5347                 /*
5348                  * Clean up code for freeing assoc that left behind a
5349                  * pdapi.. maybe a peer in EEOR that just closed after
5350                  * sending and never indicated a EOR.
5351                  */
5352                 if (hold_rlock == 0) {
5353                         hold_rlock = 1;
5354                         SCTP_INP_READ_LOCK(inp);
5355                 }
5356                 control->held_length = 0;
5357                 if (control->data) {
5358                         /* Hmm there is data here .. fix */
5359                         struct mbuf *m_tmp;
5360                         int cnt = 0;
5361
5362                         m_tmp = control->data;
5363                         while (m_tmp) {
5364                                 cnt += SCTP_BUF_LEN(m_tmp);
5365                                 if (SCTP_BUF_NEXT(m_tmp) == NULL) {
5366                                         control->tail_mbuf = m_tmp;
5367                                         control->end_added = 1;
5368                                 }
5369                                 m_tmp = SCTP_BUF_NEXT(m_tmp);
5370                         }
5371                         control->length = cnt;
5372                 } else {
5373                         /* remove it */
5374                         TAILQ_REMOVE(&inp->read_queue, control, next);
5375                         /* Add back any hiddend data */
5376                         sctp_free_remote_addr(control->whoFrom);
5377                         sctp_free_a_readq(stcb, control);
5378                 }
5379                 if (hold_rlock) {
5380                         hold_rlock = 0;
5381                         SCTP_INP_READ_UNLOCK(inp);
5382                 }
5383                 goto restart;
5384         }
5385         if ((control->length == 0) &&
5386             (control->end_added == 1)) {
5387                 /*
5388                  * Do we also need to check for (control->pdapi_aborted ==
5389                  * 1)?
5390                  */
5391                 if (hold_rlock == 0) {
5392                         hold_rlock = 1;
5393                         SCTP_INP_READ_LOCK(inp);
5394                 }
5395                 TAILQ_REMOVE(&inp->read_queue, control, next);
5396                 if (control->data) {
5397 #ifdef INVARIANTS
5398                         panic("control->data not null but control->length == 0");
5399 #else
5400                         SCTP_PRINTF("Strange, data left in the control buffer. Cleaning up.\n");
5401                         sctp_m_freem(control->data);
5402                         control->data = NULL;
5403 #endif
5404                 }
5405                 if (control->aux_data) {
5406                         sctp_m_free(control->aux_data);
5407                         control->aux_data = NULL;
5408                 }
5409 #ifdef INVARIANTS
5410                 if (control->on_strm_q) {
5411                         panic("About to free ctl:%p so:%p and its in %d",
5412                             control, so, control->on_strm_q);
5413                 }
5414 #endif
5415                 sctp_free_remote_addr(control->whoFrom);
5416                 sctp_free_a_readq(stcb, control);
5417                 if (hold_rlock) {
5418                         hold_rlock = 0;
5419                         SCTP_INP_READ_UNLOCK(inp);
5420                 }
5421                 goto restart;
5422         }
5423         if (control->length == 0) {
5424                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) &&
5425                     (filling_sinfo)) {
5426                         /* find a more suitable one then this */
5427                         ctl = TAILQ_NEXT(control, next);
5428                         while (ctl) {
5429                                 if ((ctl->stcb != control->stcb) && (ctl->length) &&
5430                                     (ctl->some_taken ||
5431                                     (ctl->spec_flags & M_NOTIFICATION) ||
5432                                     ((ctl->do_not_ref_stcb == 0) &&
5433                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))
5434                                     ) {
5435                                         /*-
5436                                          * If we have a different TCB next, and there is data
5437                                          * present. If we have already taken some (pdapi), OR we can
5438                                          * ref the tcb and no delivery as started on this stream, we
5439                                          * take it. Note we allow a notification on a different
5440                                          * assoc to be delivered..
5441                                          */
5442                                         control = ctl;
5443                                         goto found_one;
5444                                 } else if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS)) &&
5445                                             (ctl->length) &&
5446                                             ((ctl->some_taken) ||
5447                                             ((ctl->do_not_ref_stcb == 0) &&
5448                                             ((ctl->spec_flags & M_NOTIFICATION) == 0) &&
5449                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))) {
5450                                         /*-
5451                                          * If we have the same tcb, and there is data present, and we
5452                                          * have the strm interleave feature present. Then if we have
5453                                          * taken some (pdapi) or we can refer to tht tcb AND we have
5454                                          * not started a delivery for this stream, we can take it.
5455                                          * Note we do NOT allow a notificaiton on the same assoc to
5456                                          * be delivered.
5457                                          */
5458                                         control = ctl;
5459                                         goto found_one;
5460                                 }
5461                                 ctl = TAILQ_NEXT(ctl, next);
5462                         }
5463                 }
5464                 /*
5465                  * if we reach here, not suitable replacement is available
5466                  * <or> fragment interleave is NOT on. So stuff the sb_cc
5467                  * into the our held count, and its time to sleep again.
5468                  */
5469                 held_length = so->so_rcv.sb_cc;
5470                 control->held_length = so->so_rcv.sb_cc;
5471                 goto restart;
5472         }
5473         /* Clear the held length since there is something to read */
5474         control->held_length = 0;
5475 found_one:
5476         /*
5477          * If we reach here, control has a some data for us to read off.
5478          * Note that stcb COULD be NULL.
5479          */
5480         if (hold_rlock == 0) {
5481                 hold_rlock = 1;
5482                 SCTP_INP_READ_LOCK(inp);
5483         }
5484         control->some_taken++;
5485         stcb = control->stcb;
5486         if (stcb) {
5487                 if ((control->do_not_ref_stcb == 0) &&
5488                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5489                         if (freecnt_applied == 0)
5490                                 stcb = NULL;
5491                 } else if (control->do_not_ref_stcb == 0) {
5492                         /* you can't free it on me please */
5493                         /*
5494                          * The lock on the socket buffer protects us so the
5495                          * free code will stop. But since we used the
5496                          * socketbuf lock and the sender uses the tcb_lock
5497                          * to increment, we need to use the atomic add to
5498                          * the refcnt
5499                          */
5500                         if (freecnt_applied) {
5501 #ifdef INVARIANTS
5502                                 panic("refcnt already incremented");
5503 #else
5504                                 SCTP_PRINTF("refcnt already incremented?\n");
5505 #endif
5506                         } else {
5507                                 atomic_add_int(&stcb->asoc.refcnt, 1);
5508                                 freecnt_applied = 1;
5509                         }
5510                         /*
5511                          * Setup to remember how much we have not yet told
5512                          * the peer our rwnd has opened up. Note we grab the
5513                          * value from the tcb from last time. Note too that
5514                          * sack sending clears this when a sack is sent,
5515                          * which is fine. Once we hit the rwnd_req, we then
5516                          * will go to the sctp_user_rcvd() that will not
5517                          * lock until it KNOWs it MUST send a WUP-SACK.
5518                          */
5519                         freed_so_far = stcb->freed_by_sorcv_sincelast;
5520                         stcb->freed_by_sorcv_sincelast = 0;
5521                 }
5522         }
5523         if (stcb &&
5524             ((control->spec_flags & M_NOTIFICATION) == 0) &&
5525             control->do_not_ref_stcb == 0) {
5526                 stcb->asoc.strmin[control->sinfo_stream].delivery_started = 1;
5527         }
5528         /* First lets get off the sinfo and sockaddr info */
5529         if ((sinfo != NULL) && (filling_sinfo != 0)) {
5530                 sinfo->sinfo_stream = control->sinfo_stream;
5531                 sinfo->sinfo_ssn = (uint16_t)control->mid;
5532                 sinfo->sinfo_flags = control->sinfo_flags;
5533                 sinfo->sinfo_ppid = control->sinfo_ppid;
5534                 sinfo->sinfo_context = control->sinfo_context;
5535                 sinfo->sinfo_timetolive = control->sinfo_timetolive;
5536                 sinfo->sinfo_tsn = control->sinfo_tsn;
5537                 sinfo->sinfo_cumtsn = control->sinfo_cumtsn;
5538                 sinfo->sinfo_assoc_id = control->sinfo_assoc_id;
5539                 nxt = TAILQ_NEXT(control, next);
5540                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
5541                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) {
5542                         struct sctp_extrcvinfo *s_extra;
5543
5544                         s_extra = (struct sctp_extrcvinfo *)sinfo;
5545                         if ((nxt) &&
5546                             (nxt->length)) {
5547                                 s_extra->serinfo_next_flags = SCTP_NEXT_MSG_AVAIL;
5548                                 if (nxt->sinfo_flags & SCTP_UNORDERED) {
5549                                         s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_UNORDERED;
5550                                 }
5551                                 if (nxt->spec_flags & M_NOTIFICATION) {
5552                                         s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_NOTIFICATION;
5553                                 }
5554                                 s_extra->serinfo_next_aid = nxt->sinfo_assoc_id;
5555                                 s_extra->serinfo_next_length = nxt->length;
5556                                 s_extra->serinfo_next_ppid = nxt->sinfo_ppid;
5557                                 s_extra->serinfo_next_stream = nxt->sinfo_stream;
5558                                 if (nxt->tail_mbuf != NULL) {
5559                                         if (nxt->end_added) {
5560                                                 s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_ISCOMPLETE;
5561                                         }
5562                                 }
5563                         } else {
5564                                 /*
5565                                  * we explicitly 0 this, since the memcpy
5566                                  * got some other things beyond the older
5567                                  * sinfo_ that is on the control's structure
5568                                  * :-D
5569                                  */
5570                                 nxt = NULL;
5571                                 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG;
5572                                 s_extra->serinfo_next_aid = 0;
5573                                 s_extra->serinfo_next_length = 0;
5574                                 s_extra->serinfo_next_ppid = 0;
5575                                 s_extra->serinfo_next_stream = 0;
5576                         }
5577                 }
5578                 /*
5579                  * update off the real current cum-ack, if we have an stcb.
5580                  */
5581                 if ((control->do_not_ref_stcb == 0) && stcb)
5582                         sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
5583                 /*
5584                  * mask off the high bits, we keep the actual chunk bits in
5585                  * there.
5586                  */
5587                 sinfo->sinfo_flags &= 0x00ff;
5588                 if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) {
5589                         sinfo->sinfo_flags |= SCTP_UNORDERED;
5590                 }
5591         }
5592 #ifdef SCTP_ASOCLOG_OF_TSNS
5593         {
5594                 int index, newindex;
5595                 struct sctp_pcbtsn_rlog *entry;
5596
5597                 do {
5598                         index = inp->readlog_index;
5599                         newindex = index + 1;
5600                         if (newindex >= SCTP_READ_LOG_SIZE) {
5601                                 newindex = 0;
5602                         }
5603                 } while (atomic_cmpset_int(&inp->readlog_index, index, newindex) == 0);
5604                 entry = &inp->readlog[index];
5605                 entry->vtag = control->sinfo_assoc_id;
5606                 entry->strm = control->sinfo_stream;
5607                 entry->seq = (uint16_t)control->mid;
5608                 entry->sz = control->length;
5609                 entry->flgs = control->sinfo_flags;
5610         }
5611 #endif
5612         if ((fromlen > 0) && (from != NULL)) {
5613                 union sctp_sockstore store;
5614                 size_t len;
5615
5616                 switch (control->whoFrom->ro._l_addr.sa.sa_family) {
5617 #ifdef INET6
5618                 case AF_INET6:
5619                         len = sizeof(struct sockaddr_in6);
5620                         store.sin6 = control->whoFrom->ro._l_addr.sin6;
5621                         store.sin6.sin6_port = control->port_from;
5622                         break;
5623 #endif
5624 #ifdef INET
5625                 case AF_INET:
5626 #ifdef INET6
5627                         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
5628                                 len = sizeof(struct sockaddr_in6);
5629                                 in6_sin_2_v4mapsin6(&control->whoFrom->ro._l_addr.sin,
5630                                     &store.sin6);
5631                                 store.sin6.sin6_port = control->port_from;
5632                         } else {
5633                                 len = sizeof(struct sockaddr_in);
5634                                 store.sin = control->whoFrom->ro._l_addr.sin;
5635                                 store.sin.sin_port = control->port_from;
5636                         }
5637 #else
5638                         len = sizeof(struct sockaddr_in);
5639                         store.sin = control->whoFrom->ro._l_addr.sin;
5640                         store.sin.sin_port = control->port_from;
5641 #endif
5642                         break;
5643 #endif
5644                 default:
5645                         len = 0;
5646                         break;
5647                 }
5648                 memcpy(from, &store, min((size_t)fromlen, len));
5649 #ifdef INET6
5650                 {
5651                         struct sockaddr_in6 lsa6, *from6;
5652
5653                         from6 = (struct sockaddr_in6 *)from;
5654                         sctp_recover_scope_mac(from6, (&lsa6));
5655                 }
5656 #endif
5657         }
5658         if (hold_rlock) {
5659                 SCTP_INP_READ_UNLOCK(inp);
5660                 hold_rlock = 0;
5661         }
5662         if (hold_sblock) {
5663                 SOCKBUF_UNLOCK(&so->so_rcv);
5664                 hold_sblock = 0;
5665         }
5666         /* now copy out what data we can */
5667         if (mp == NULL) {
5668                 /* copy out each mbuf in the chain up to length */
5669 get_more_data:
5670                 m = control->data;
5671                 while (m) {
5672                         /* Move out all we can */
5673                         cp_len = (int)uio->uio_resid;
5674                         my_len = (int)SCTP_BUF_LEN(m);
5675                         if (cp_len > my_len) {
5676                                 /* not enough in this buf */
5677                                 cp_len = my_len;
5678                         }
5679                         if (hold_rlock) {
5680                                 SCTP_INP_READ_UNLOCK(inp);
5681                                 hold_rlock = 0;
5682                         }
5683                         if (cp_len > 0)
5684                                 error = uiomove(mtod(m, char *), cp_len, uio);
5685                         /* re-read */
5686                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5687                                 goto release;
5688                         }
5689                         if ((control->do_not_ref_stcb == 0) && stcb &&
5690                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5691                                 no_rcv_needed = 1;
5692                         }
5693                         if (error) {
5694                                 /* error we are out of here */
5695                                 goto release;
5696                         }
5697                         SCTP_INP_READ_LOCK(inp);
5698                         hold_rlock = 1;
5699                         if (cp_len == SCTP_BUF_LEN(m)) {
5700                                 if ((SCTP_BUF_NEXT(m) == NULL) &&
5701                                     (control->end_added)) {
5702                                         out_flags |= MSG_EOR;
5703                                         if ((control->do_not_ref_stcb == 0) &&
5704                                             (control->stcb != NULL) &&
5705                                             ((control->spec_flags & M_NOTIFICATION) == 0))
5706                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5707                                 }
5708                                 if (control->spec_flags & M_NOTIFICATION) {
5709                                         out_flags |= MSG_NOTIFICATION;
5710                                 }
5711                                 /* we ate up the mbuf */
5712                                 if (in_flags & MSG_PEEK) {
5713                                         /* just looking */
5714                                         m = SCTP_BUF_NEXT(m);
5715                                         copied_so_far += cp_len;
5716                                 } else {
5717                                         /* dispose of the mbuf */
5718                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5719                                                 sctp_sblog(&so->so_rcv,
5720                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
5721                                         }
5722                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
5723                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5724                                                 sctp_sblog(&so->so_rcv,
5725                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5726                                         }
5727                                         copied_so_far += cp_len;
5728                                         freed_so_far += cp_len;
5729                                         freed_so_far += MSIZE;
5730                                         atomic_subtract_int(&control->length, cp_len);
5731                                         control->data = sctp_m_free(m);
5732                                         m = control->data;
5733                                         /*
5734                                          * been through it all, must hold sb
5735                                          * lock ok to null tail
5736                                          */
5737                                         if (control->data == NULL) {
5738 #ifdef INVARIANTS
5739                                                 if ((control->end_added == 0) ||
5740                                                     (TAILQ_NEXT(control, next) == NULL)) {
5741                                                         /*
5742                                                          * If the end is not
5743                                                          * added, OR the
5744                                                          * next is NOT null
5745                                                          * we MUST have the
5746                                                          * lock.
5747                                                          */
5748                                                         if (mtx_owned(&inp->inp_rdata_mtx) == 0) {
5749                                                                 panic("Hmm we don't own the lock?");
5750                                                         }
5751                                                 }
5752 #endif
5753                                                 control->tail_mbuf = NULL;
5754 #ifdef INVARIANTS
5755                                                 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) {
5756                                                         panic("end_added, nothing left and no MSG_EOR");
5757                                                 }
5758 #endif
5759                                         }
5760                                 }
5761                         } else {
5762                                 /* Do we need to trim the mbuf? */
5763                                 if (control->spec_flags & M_NOTIFICATION) {
5764                                         out_flags |= MSG_NOTIFICATION;
5765                                 }
5766                                 if ((in_flags & MSG_PEEK) == 0) {
5767                                         SCTP_BUF_RESV_UF(m, cp_len);
5768                                         SCTP_BUF_LEN(m) -= cp_len;
5769                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5770                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, cp_len);
5771                                         }
5772                                         atomic_subtract_int(&so->so_rcv.sb_cc, cp_len);
5773                                         if ((control->do_not_ref_stcb == 0) &&
5774                                             stcb) {
5775                                                 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len);
5776                                         }
5777                                         copied_so_far += cp_len;
5778                                         freed_so_far += cp_len;
5779                                         freed_so_far += MSIZE;
5780                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5781                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
5782                                                     SCTP_LOG_SBRESULT, 0);
5783                                         }
5784                                         atomic_subtract_int(&control->length, cp_len);
5785                                 } else {
5786                                         copied_so_far += cp_len;
5787                                 }
5788                         }
5789                         if ((out_flags & MSG_EOR) || (uio->uio_resid == 0)) {
5790                                 break;
5791                         }
5792                         if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5793                             (control->do_not_ref_stcb == 0) &&
5794                             (freed_so_far >= rwnd_req)) {
5795                                 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5796                         }
5797                 }               /* end while(m) */
5798                 /*
5799                  * At this point we have looked at it all and we either have
5800                  * a MSG_EOR/or read all the user wants... <OR>
5801                  * control->length == 0.
5802                  */
5803                 if ((out_flags & MSG_EOR) && ((in_flags & MSG_PEEK) == 0)) {
5804                         /* we are done with this control */
5805                         if (control->length == 0) {
5806                                 if (control->data) {
5807 #ifdef INVARIANTS
5808                                         panic("control->data not null at read eor?");
5809 #else
5810                                         SCTP_PRINTF("Strange, data left in the control buffer .. invarients would panic?\n");
5811                                         sctp_m_freem(control->data);
5812                                         control->data = NULL;
5813 #endif
5814                                 }
5815                 done_with_control:
5816                                 if (hold_rlock == 0) {
5817                                         SCTP_INP_READ_LOCK(inp);
5818                                         hold_rlock = 1;
5819                                 }
5820                                 TAILQ_REMOVE(&inp->read_queue, control, next);
5821                                 /* Add back any hiddend data */
5822                                 if (control->held_length) {
5823                                         held_length = 0;
5824                                         control->held_length = 0;
5825                                         wakeup_read_socket = 1;
5826                                 }
5827                                 if (control->aux_data) {
5828                                         sctp_m_free(control->aux_data);
5829                                         control->aux_data = NULL;
5830                                 }
5831                                 no_rcv_needed = control->do_not_ref_stcb;
5832                                 sctp_free_remote_addr(control->whoFrom);
5833                                 control->data = NULL;
5834 #ifdef INVARIANTS
5835                                 if (control->on_strm_q) {
5836                                         panic("About to free ctl:%p so:%p and its in %d",
5837                                             control, so, control->on_strm_q);
5838                                 }
5839 #endif
5840                                 sctp_free_a_readq(stcb, control);
5841                                 control = NULL;
5842                                 if ((freed_so_far >= rwnd_req) &&
5843                                     (no_rcv_needed == 0))
5844                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5845
5846                         } else {
5847                                 /*
5848                                  * The user did not read all of this
5849                                  * message, turn off the returned MSG_EOR
5850                                  * since we are leaving more behind on the
5851                                  * control to read.
5852                                  */
5853 #ifdef INVARIANTS
5854                                 if (control->end_added &&
5855                                     (control->data == NULL) &&
5856                                     (control->tail_mbuf == NULL)) {
5857                                         panic("Gak, control->length is corrupt?");
5858                                 }
5859 #endif
5860                                 no_rcv_needed = control->do_not_ref_stcb;
5861                                 out_flags &= ~MSG_EOR;
5862                         }
5863                 }
5864                 if (out_flags & MSG_EOR) {
5865                         goto release;
5866                 }
5867                 if ((uio->uio_resid == 0) ||
5868                     ((in_eeor_mode) &&
5869                     (copied_so_far >= (uint32_t)max(so->so_rcv.sb_lowat, 1)))) {
5870                         goto release;
5871                 }
5872                 /*
5873                  * If I hit here the receiver wants more and this message is
5874                  * NOT done (pd-api). So two questions. Can we block? if not
5875                  * we are done. Did the user NOT set MSG_WAITALL?
5876                  */
5877                 if (block_allowed == 0) {
5878                         goto release;
5879                 }
5880                 /*
5881                  * We need to wait for more data a few things: - We don't
5882                  * sbunlock() so we don't get someone else reading. - We
5883                  * must be sure to account for the case where what is added
5884                  * is NOT to our control when we wakeup.
5885                  */
5886
5887                 /*
5888                  * Do we need to tell the transport a rwnd update might be
5889                  * needed before we go to sleep?
5890                  */
5891                 if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5892                     ((freed_so_far >= rwnd_req) &&
5893                     (control->do_not_ref_stcb == 0) &&
5894                     (no_rcv_needed == 0))) {
5895                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5896                 }
5897 wait_some_more:
5898                 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
5899                         goto release;
5900                 }
5901                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
5902                         goto release;
5903
5904                 if (hold_rlock == 1) {
5905                         SCTP_INP_READ_UNLOCK(inp);
5906                         hold_rlock = 0;
5907                 }
5908                 if (hold_sblock == 0) {
5909                         SOCKBUF_LOCK(&so->so_rcv);
5910                         hold_sblock = 1;
5911                 }
5912                 if ((copied_so_far) && (control->length == 0) &&
5913                     (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE))) {
5914                         goto release;
5915                 }
5916                 if (so->so_rcv.sb_cc <= control->held_length) {
5917                         error = sbwait(&so->so_rcv);
5918                         if (error) {
5919                                 goto release;
5920                         }
5921                         control->held_length = 0;
5922                 }
5923                 if (hold_sblock) {
5924                         SOCKBUF_UNLOCK(&so->so_rcv);
5925                         hold_sblock = 0;
5926                 }
5927                 if (control->length == 0) {
5928                         /* still nothing here */
5929                         if (control->end_added == 1) {
5930                                 /* he aborted, or is done i.e.did a shutdown */
5931                                 out_flags |= MSG_EOR;
5932                                 if (control->pdapi_aborted) {
5933                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5934                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5935
5936                                         out_flags |= MSG_TRUNC;
5937                                 } else {
5938                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5939                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5940                                 }
5941                                 goto done_with_control;
5942                         }
5943                         if (so->so_rcv.sb_cc > held_length) {
5944                                 control->held_length = so->so_rcv.sb_cc;
5945                                 held_length = 0;
5946                         }
5947                         goto wait_some_more;
5948                 } else if (control->data == NULL) {
5949                         /*
5950                          * we must re-sync since data is probably being
5951                          * added
5952                          */
5953                         SCTP_INP_READ_LOCK(inp);
5954                         if ((control->length > 0) && (control->data == NULL)) {
5955                                 /*
5956                                  * big trouble.. we have the lock and its
5957                                  * corrupt?
5958                                  */
5959 #ifdef INVARIANTS
5960                                 panic("Impossible data==NULL length !=0");
5961 #endif
5962                                 out_flags |= MSG_EOR;
5963                                 out_flags |= MSG_TRUNC;
5964                                 control->length = 0;
5965                                 SCTP_INP_READ_UNLOCK(inp);
5966                                 goto done_with_control;
5967                         }
5968                         SCTP_INP_READ_UNLOCK(inp);
5969                         /* We will fall around to get more data */
5970                 }
5971                 goto get_more_data;
5972         } else {
5973                 /*-
5974                  * Give caller back the mbuf chain,
5975                  * store in uio_resid the length
5976                  */
5977                 wakeup_read_socket = 0;
5978                 if ((control->end_added == 0) ||
5979                     (TAILQ_NEXT(control, next) == NULL)) {
5980                         /* Need to get rlock */
5981                         if (hold_rlock == 0) {
5982                                 SCTP_INP_READ_LOCK(inp);
5983                                 hold_rlock = 1;
5984                         }
5985                 }
5986                 if (control->end_added) {
5987                         out_flags |= MSG_EOR;
5988                         if ((control->do_not_ref_stcb == 0) &&
5989                             (control->stcb != NULL) &&
5990                             ((control->spec_flags & M_NOTIFICATION) == 0))
5991                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5992                 }
5993                 if (control->spec_flags & M_NOTIFICATION) {
5994                         out_flags |= MSG_NOTIFICATION;
5995                 }
5996                 uio->uio_resid = control->length;
5997                 *mp = control->data;
5998                 m = control->data;
5999                 while (m) {
6000                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6001                                 sctp_sblog(&so->so_rcv,
6002                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
6003                         }
6004                         sctp_sbfree(control, stcb, &so->so_rcv, m);
6005                         freed_so_far += SCTP_BUF_LEN(m);
6006                         freed_so_far += MSIZE;
6007                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6008                                 sctp_sblog(&so->so_rcv,
6009                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
6010                         }
6011                         m = SCTP_BUF_NEXT(m);
6012                 }
6013                 control->data = control->tail_mbuf = NULL;
6014                 control->length = 0;
6015                 if (out_flags & MSG_EOR) {
6016                         /* Done with this control */
6017                         goto done_with_control;
6018                 }
6019         }
6020 release:
6021         if (hold_rlock == 1) {
6022                 SCTP_INP_READ_UNLOCK(inp);
6023                 hold_rlock = 0;
6024         }
6025         if (hold_sblock == 1) {
6026                 SOCKBUF_UNLOCK(&so->so_rcv);
6027                 hold_sblock = 0;
6028         }
6029         sbunlock(&so->so_rcv);
6030         sockbuf_lock = 0;
6031
6032 release_unlocked:
6033         if (hold_sblock) {
6034                 SOCKBUF_UNLOCK(&so->so_rcv);
6035                 hold_sblock = 0;
6036         }
6037         if ((stcb) && (in_flags & MSG_PEEK) == 0) {
6038                 if ((freed_so_far >= rwnd_req) &&
6039                     (control && (control->do_not_ref_stcb == 0)) &&
6040                     (no_rcv_needed == 0))
6041                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6042         }
6043 out:
6044         if (msg_flags) {
6045                 *msg_flags = out_flags;
6046         }
6047         if (((out_flags & MSG_EOR) == 0) &&
6048             ((in_flags & MSG_PEEK) == 0) &&
6049             (sinfo) &&
6050             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
6051             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO))) {
6052                 struct sctp_extrcvinfo *s_extra;
6053
6054                 s_extra = (struct sctp_extrcvinfo *)sinfo;
6055                 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG;
6056         }
6057         if (hold_rlock == 1) {
6058                 SCTP_INP_READ_UNLOCK(inp);
6059         }
6060         if (hold_sblock) {
6061                 SOCKBUF_UNLOCK(&so->so_rcv);
6062         }
6063         if (sockbuf_lock) {
6064                 sbunlock(&so->so_rcv);
6065         }
6066         if (freecnt_applied) {
6067                 /*
6068                  * The lock on the socket buffer protects us so the free
6069                  * code will stop. But since we used the socketbuf lock and
6070                  * the sender uses the tcb_lock to increment, we need to use
6071                  * the atomic add to the refcnt.
6072                  */
6073                 if (stcb == NULL) {
6074 #ifdef INVARIANTS
6075                         panic("stcb for refcnt has gone NULL?");
6076                         goto stage_left;
6077 #else
6078                         goto stage_left;
6079 #endif
6080                 }
6081                 /* Save the value back for next time */
6082                 stcb->freed_by_sorcv_sincelast = freed_so_far;
6083                 atomic_add_int(&stcb->asoc.refcnt, -1);
6084         }
6085         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
6086                 if (stcb) {
6087                         sctp_misc_ints(SCTP_SORECV_DONE,
6088                             freed_so_far,
6089                             (uint32_t)((uio) ? (slen - uio->uio_resid) : slen),
6090                             stcb->asoc.my_rwnd,
6091                             so->so_rcv.sb_cc);
6092                 } else {
6093                         sctp_misc_ints(SCTP_SORECV_DONE,
6094                             freed_so_far,
6095                             (uint32_t)((uio) ? (slen - uio->uio_resid) : slen),
6096                             0,
6097                             so->so_rcv.sb_cc);
6098                 }
6099         }
6100 stage_left:
6101         if (wakeup_read_socket) {
6102                 sctp_sorwakeup(inp, so);
6103         }
6104         return (error);
6105 }
6106
6107
6108 #ifdef SCTP_MBUF_LOGGING
6109 struct mbuf *
6110 sctp_m_free(struct mbuf *m)
6111 {
6112         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
6113                 sctp_log_mb(m, SCTP_MBUF_IFREE);
6114         }
6115         return (m_free(m));
6116 }
6117
6118 void
6119 sctp_m_freem(struct mbuf *mb)
6120 {
6121         while (mb != NULL)
6122                 mb = sctp_m_free(mb);
6123 }
6124
6125 #endif
6126
6127 int
6128 sctp_dynamic_set_primary(struct sockaddr *sa, uint32_t vrf_id)
6129 {
6130         /*
6131          * Given a local address. For all associations that holds the
6132          * address, request a peer-set-primary.
6133          */
6134         struct sctp_ifa *ifa;
6135         struct sctp_laddr *wi;
6136
6137         ifa = sctp_find_ifa_by_addr(sa, vrf_id, 0);
6138         if (ifa == NULL) {
6139                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EADDRNOTAVAIL);
6140                 return (EADDRNOTAVAIL);
6141         }
6142         /*
6143          * Now that we have the ifa we must awaken the iterator with this
6144          * message.
6145          */
6146         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
6147         if (wi == NULL) {
6148                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
6149                 return (ENOMEM);
6150         }
6151         /* Now incr the count and int wi structure */
6152         SCTP_INCR_LADDR_COUNT();
6153         memset(wi, 0, sizeof(*wi));
6154         (void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
6155         wi->ifa = ifa;
6156         wi->action = SCTP_SET_PRIM_ADDR;
6157         atomic_add_int(&ifa->refcount, 1);
6158
6159         /* Now add it to the work queue */
6160         SCTP_WQ_ADDR_LOCK();
6161         /*
6162          * Should this really be a tailq? As it is we will process the
6163          * newest first :-0
6164          */
6165         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
6166         sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
6167             (struct sctp_inpcb *)NULL,
6168             (struct sctp_tcb *)NULL,
6169             (struct sctp_nets *)NULL);
6170         SCTP_WQ_ADDR_UNLOCK();
6171         return (0);
6172 }
6173
6174
6175 int
6176 sctp_soreceive(struct socket *so,
6177     struct sockaddr **psa,
6178     struct uio *uio,
6179     struct mbuf **mp0,
6180     struct mbuf **controlp,
6181     int *flagsp)
6182 {
6183         int error, fromlen;
6184         uint8_t sockbuf[256];
6185         struct sockaddr *from;
6186         struct sctp_extrcvinfo sinfo;
6187         int filling_sinfo = 1;
6188         int flags;
6189         struct sctp_inpcb *inp;
6190
6191         inp = (struct sctp_inpcb *)so->so_pcb;
6192         /* pickup the assoc we are reading from */
6193         if (inp == NULL) {
6194                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6195                 return (EINVAL);
6196         }
6197         if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) &&
6198             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) &&
6199             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) ||
6200             (controlp == NULL)) {
6201                 /* user does not want the sndrcv ctl */
6202                 filling_sinfo = 0;
6203         }
6204         if (psa) {
6205                 from = (struct sockaddr *)sockbuf;
6206                 fromlen = sizeof(sockbuf);
6207                 from->sa_len = 0;
6208         } else {
6209                 from = NULL;
6210                 fromlen = 0;
6211         }
6212
6213         if (filling_sinfo) {
6214                 memset(&sinfo, 0, sizeof(struct sctp_extrcvinfo));
6215         }
6216         if (flagsp != NULL) {
6217                 flags = *flagsp;
6218         } else {
6219                 flags = 0;
6220         }
6221         error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, &flags,
6222             (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo);
6223         if (flagsp != NULL) {
6224                 *flagsp = flags;
6225         }
6226         if (controlp != NULL) {
6227                 /* copy back the sinfo in a CMSG format */
6228                 if (filling_sinfo && ((flags & MSG_NOTIFICATION) == 0)) {
6229                         *controlp = sctp_build_ctl_nchunk(inp,
6230                             (struct sctp_sndrcvinfo *)&sinfo);
6231                 } else {
6232                         *controlp = NULL;
6233                 }
6234         }
6235         if (psa) {
6236                 /* copy back the address info */
6237                 if (from && from->sa_len) {
6238                         *psa = sodupsockaddr(from, M_NOWAIT);
6239                 } else {
6240                         *psa = NULL;
6241                 }
6242         }
6243         return (error);
6244 }
6245
6246
6247
6248
6249
6250 int
6251 sctp_connectx_helper_add(struct sctp_tcb *stcb, struct sockaddr *addr,
6252     int totaddr, int *error)
6253 {
6254         int added = 0;
6255         int i;
6256         struct sctp_inpcb *inp;
6257         struct sockaddr *sa;
6258         size_t incr = 0;
6259 #ifdef INET
6260         struct sockaddr_in *sin;
6261 #endif
6262 #ifdef INET6
6263         struct sockaddr_in6 *sin6;
6264 #endif
6265
6266         sa = addr;
6267         inp = stcb->sctp_ep;
6268         *error = 0;
6269         for (i = 0; i < totaddr; i++) {
6270                 switch (sa->sa_family) {
6271 #ifdef INET
6272                 case AF_INET:
6273                         incr = sizeof(struct sockaddr_in);
6274                         sin = (struct sockaddr_in *)sa;
6275                         if ((sin->sin_addr.s_addr == INADDR_ANY) ||
6276                             (sin->sin_addr.s_addr == INADDR_BROADCAST) ||
6277                             IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
6278                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6279                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6280                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_7);
6281                                 *error = EINVAL;
6282                                 goto out_now;
6283                         }
6284                         if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port,
6285                             SCTP_DONOT_SETSCOPE,
6286                             SCTP_ADDR_IS_CONFIRMED)) {
6287                                 /* assoc gone no un-lock */
6288                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6289                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6290                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_8);
6291                                 *error = ENOBUFS;
6292                                 goto out_now;
6293                         }
6294                         added++;
6295                         break;
6296 #endif
6297 #ifdef INET6
6298                 case AF_INET6:
6299                         incr = sizeof(struct sockaddr_in6);
6300                         sin6 = (struct sockaddr_in6 *)sa;
6301                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
6302                             IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
6303                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6304                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6305                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_9);
6306                                 *error = EINVAL;
6307                                 goto out_now;
6308                         }
6309                         if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port,
6310                             SCTP_DONOT_SETSCOPE,
6311                             SCTP_ADDR_IS_CONFIRMED)) {
6312                                 /* assoc gone no un-lock */
6313                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6314                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6315                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_10);
6316                                 *error = ENOBUFS;
6317                                 goto out_now;
6318                         }
6319                         added++;
6320                         break;
6321 #endif
6322                 default:
6323                         break;
6324                 }
6325                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6326         }
6327 out_now:
6328         return (added);
6329 }
6330
6331 struct sctp_tcb *
6332 sctp_connectx_helper_find(struct sctp_inpcb *inp, struct sockaddr *addr,
6333     unsigned int *totaddr,
6334     unsigned int *num_v4, unsigned int *num_v6, int *error,
6335     unsigned int limit, int *bad_addr)
6336 {
6337         struct sockaddr *sa;
6338         struct sctp_tcb *stcb = NULL;
6339         unsigned int incr, at, i;
6340
6341         at = 0;
6342         sa = addr;
6343         *error = *num_v6 = *num_v4 = 0;
6344         /* account and validate addresses */
6345         for (i = 0; i < *totaddr; i++) {
6346                 switch (sa->sa_family) {
6347 #ifdef INET
6348                 case AF_INET:
6349                         incr = (unsigned int)sizeof(struct sockaddr_in);
6350                         if (sa->sa_len != incr) {
6351                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6352                                 *error = EINVAL;
6353                                 *bad_addr = 1;
6354                                 return (NULL);
6355                         }
6356                         (*num_v4) += 1;
6357                         break;
6358 #endif
6359 #ifdef INET6
6360                 case AF_INET6:
6361                         {
6362                                 struct sockaddr_in6 *sin6;
6363
6364                                 sin6 = (struct sockaddr_in6 *)sa;
6365                                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6366                                         /* Must be non-mapped for connectx */
6367                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6368                                         *error = EINVAL;
6369                                         *bad_addr = 1;
6370                                         return (NULL);
6371                                 }
6372                                 incr = (unsigned int)sizeof(struct sockaddr_in6);
6373                                 if (sa->sa_len != incr) {
6374                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6375                                         *error = EINVAL;
6376                                         *bad_addr = 1;
6377                                         return (NULL);
6378                                 }
6379                                 (*num_v6) += 1;
6380                                 break;
6381                         }
6382 #endif
6383                 default:
6384                         *totaddr = i;
6385                         incr = 0;
6386                         /* we are done */
6387                         break;
6388                 }
6389                 if (i == *totaddr) {
6390                         break;
6391                 }
6392                 SCTP_INP_INCR_REF(inp);
6393                 stcb = sctp_findassociation_ep_addr(&inp, sa, NULL, NULL, NULL);
6394                 if (stcb != NULL) {
6395                         /* Already have or am bring up an association */
6396                         return (stcb);
6397                 } else {
6398                         SCTP_INP_DECR_REF(inp);
6399                 }
6400                 if ((at + incr) > limit) {
6401                         *totaddr = i;
6402                         break;
6403                 }
6404                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6405         }
6406         return ((struct sctp_tcb *)NULL);
6407 }
6408
6409 /*
6410  * sctp_bindx(ADD) for one address.
6411  * assumes all arguments are valid/checked by caller.
6412  */
6413 void
6414 sctp_bindx_add_address(struct socket *so, struct sctp_inpcb *inp,
6415     struct sockaddr *sa, sctp_assoc_t assoc_id,
6416     uint32_t vrf_id, int *error, void *p)
6417 {
6418         struct sockaddr *addr_touse;
6419 #if defined(INET) && defined(INET6)
6420         struct sockaddr_in sin;
6421 #endif
6422
6423         /* see if we're bound all already! */
6424         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6425                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6426                 *error = EINVAL;
6427                 return;
6428         }
6429         addr_touse = sa;
6430 #ifdef INET6
6431         if (sa->sa_family == AF_INET6) {
6432 #ifdef INET
6433                 struct sockaddr_in6 *sin6;
6434
6435 #endif
6436                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6437                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6438                         *error = EINVAL;
6439                         return;
6440                 }
6441                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6442                         /* can only bind v6 on PF_INET6 sockets */
6443                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6444                         *error = EINVAL;
6445                         return;
6446                 }
6447 #ifdef INET
6448                 sin6 = (struct sockaddr_in6 *)addr_touse;
6449                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6450                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6451                             SCTP_IPV6_V6ONLY(inp)) {
6452                                 /* can't bind v4-mapped on PF_INET sockets */
6453                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6454                                 *error = EINVAL;
6455                                 return;
6456                         }
6457                         in6_sin6_2_sin(&sin, sin6);
6458                         addr_touse = (struct sockaddr *)&sin;
6459                 }
6460 #endif
6461         }
6462 #endif
6463 #ifdef INET
6464         if (sa->sa_family == AF_INET) {
6465                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6466                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6467                         *error = EINVAL;
6468                         return;
6469                 }
6470                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6471                     SCTP_IPV6_V6ONLY(inp)) {
6472                         /* can't bind v4 on PF_INET sockets */
6473                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6474                         *error = EINVAL;
6475                         return;
6476                 }
6477         }
6478 #endif
6479         if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
6480                 if (p == NULL) {
6481                         /* Can't get proc for Net/Open BSD */
6482                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6483                         *error = EINVAL;
6484                         return;
6485                 }
6486                 *error = sctp_inpcb_bind(so, addr_touse, NULL, p);
6487                 return;
6488         }
6489         /*
6490          * No locks required here since bind and mgmt_ep_sa all do their own
6491          * locking. If we do something for the FIX: below we may need to
6492          * lock in that case.
6493          */
6494         if (assoc_id == 0) {
6495                 /* add the address */
6496                 struct sctp_inpcb *lep;
6497                 struct sockaddr_in *lsin = (struct sockaddr_in *)addr_touse;
6498
6499                 /* validate the incoming port */
6500                 if ((lsin->sin_port != 0) &&
6501                     (lsin->sin_port != inp->sctp_lport)) {
6502                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6503                         *error = EINVAL;
6504                         return;
6505                 } else {
6506                         /* user specified 0 port, set it to existing port */
6507                         lsin->sin_port = inp->sctp_lport;
6508                 }
6509
6510                 lep = sctp_pcb_findep(addr_touse, 1, 0, vrf_id);
6511                 if (lep != NULL) {
6512                         /*
6513                          * We must decrement the refcount since we have the
6514                          * ep already and are binding. No remove going on
6515                          * here.
6516                          */
6517                         SCTP_INP_DECR_REF(lep);
6518                 }
6519                 if (lep == inp) {
6520                         /* already bound to it.. ok */
6521                         return;
6522                 } else if (lep == NULL) {
6523                         ((struct sockaddr_in *)addr_touse)->sin_port = 0;
6524                         *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6525                             SCTP_ADD_IP_ADDRESS,
6526                             vrf_id, NULL);
6527                 } else {
6528                         *error = EADDRINUSE;
6529                 }
6530                 if (*error)
6531                         return;
6532         } else {
6533                 /*
6534                  * FIX: decide whether we allow assoc based bindx
6535                  */
6536         }
6537 }
6538
6539 /*
6540  * sctp_bindx(DELETE) for one address.
6541  * assumes all arguments are valid/checked by caller.
6542  */
6543 void
6544 sctp_bindx_delete_address(struct sctp_inpcb *inp,
6545     struct sockaddr *sa, sctp_assoc_t assoc_id,
6546     uint32_t vrf_id, int *error)
6547 {
6548         struct sockaddr *addr_touse;
6549 #if defined(INET) && defined(INET6)
6550         struct sockaddr_in sin;
6551 #endif
6552
6553         /* see if we're bound all already! */
6554         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6555                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6556                 *error = EINVAL;
6557                 return;
6558         }
6559         addr_touse = sa;
6560 #ifdef INET6
6561         if (sa->sa_family == AF_INET6) {
6562 #ifdef INET
6563                 struct sockaddr_in6 *sin6;
6564 #endif
6565
6566                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6567                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6568                         *error = EINVAL;
6569                         return;
6570                 }
6571                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6572                         /* can only bind v6 on PF_INET6 sockets */
6573                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6574                         *error = EINVAL;
6575                         return;
6576                 }
6577 #ifdef INET
6578                 sin6 = (struct sockaddr_in6 *)addr_touse;
6579                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6580                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6581                             SCTP_IPV6_V6ONLY(inp)) {
6582                                 /* can't bind mapped-v4 on PF_INET sockets */
6583                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6584                                 *error = EINVAL;
6585                                 return;
6586                         }
6587                         in6_sin6_2_sin(&sin, sin6);
6588                         addr_touse = (struct sockaddr *)&sin;
6589                 }
6590 #endif
6591         }
6592 #endif
6593 #ifdef INET
6594         if (sa->sa_family == AF_INET) {
6595                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6596                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6597                         *error = EINVAL;
6598                         return;
6599                 }
6600                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6601                     SCTP_IPV6_V6ONLY(inp)) {
6602                         /* can't bind v4 on PF_INET sockets */
6603                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6604                         *error = EINVAL;
6605                         return;
6606                 }
6607         }
6608 #endif
6609         /*
6610          * No lock required mgmt_ep_sa does its own locking. If the FIX:
6611          * below is ever changed we may need to lock before calling
6612          * association level binding.
6613          */
6614         if (assoc_id == 0) {
6615                 /* delete the address */
6616                 *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6617                     SCTP_DEL_IP_ADDRESS,
6618                     vrf_id, NULL);
6619         } else {
6620                 /*
6621                  * FIX: decide whether we allow assoc based bindx
6622                  */
6623         }
6624 }
6625
6626 /*
6627  * returns the valid local address count for an assoc, taking into account
6628  * all scoping rules
6629  */
6630 int
6631 sctp_local_addr_count(struct sctp_tcb *stcb)
6632 {
6633         int loopback_scope;
6634 #if defined(INET)
6635         int ipv4_local_scope, ipv4_addr_legal;
6636 #endif
6637 #if defined (INET6)
6638         int local_scope, site_scope, ipv6_addr_legal;
6639 #endif
6640         struct sctp_vrf *vrf;
6641         struct sctp_ifn *sctp_ifn;
6642         struct sctp_ifa *sctp_ifa;
6643         int count = 0;
6644
6645         /* Turn on all the appropriate scopes */
6646         loopback_scope = stcb->asoc.scope.loopback_scope;
6647 #if defined(INET)
6648         ipv4_local_scope = stcb->asoc.scope.ipv4_local_scope;
6649         ipv4_addr_legal = stcb->asoc.scope.ipv4_addr_legal;
6650 #endif
6651 #if defined(INET6)
6652         local_scope = stcb->asoc.scope.local_scope;
6653         site_scope = stcb->asoc.scope.site_scope;
6654         ipv6_addr_legal = stcb->asoc.scope.ipv6_addr_legal;
6655 #endif
6656         SCTP_IPI_ADDR_RLOCK();
6657         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
6658         if (vrf == NULL) {
6659                 /* no vrf, no addresses */
6660                 SCTP_IPI_ADDR_RUNLOCK();
6661                 return (0);
6662         }
6663         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6664                 /*
6665                  * bound all case: go through all ifns on the vrf
6666                  */
6667                 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
6668                         if ((loopback_scope == 0) &&
6669                             SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
6670                                 continue;
6671                         }
6672                         LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
6673                                 if (sctp_is_addr_restricted(stcb, sctp_ifa))
6674                                         continue;
6675                                 switch (sctp_ifa->address.sa.sa_family) {
6676 #ifdef INET
6677                                 case AF_INET:
6678                                         if (ipv4_addr_legal) {
6679                                                 struct sockaddr_in *sin;
6680
6681                                                 sin = &sctp_ifa->address.sin;
6682                                                 if (sin->sin_addr.s_addr == 0) {
6683                                                         /*
6684                                                          * skip unspecified
6685                                                          * addrs
6686                                                          */
6687                                                         continue;
6688                                                 }
6689                                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
6690                                                     &sin->sin_addr) != 0) {
6691                                                         continue;
6692                                                 }
6693                                                 if ((ipv4_local_scope == 0) &&
6694                                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
6695                                                         continue;
6696                                                 }
6697                                                 /* count this one */
6698                                                 count++;
6699                                         } else {
6700                                                 continue;
6701                                         }
6702                                         break;
6703 #endif
6704 #ifdef INET6
6705                                 case AF_INET6:
6706                                         if (ipv6_addr_legal) {
6707                                                 struct sockaddr_in6 *sin6;
6708
6709                                                 sin6 = &sctp_ifa->address.sin6;
6710                                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
6711                                                         continue;
6712                                                 }
6713                                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
6714                                                     &sin6->sin6_addr) != 0) {
6715                                                         continue;
6716                                                 }
6717                                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
6718                                                         if (local_scope == 0)
6719                                                                 continue;
6720                                                         if (sin6->sin6_scope_id == 0) {
6721                                                                 if (sa6_recoverscope(sin6) != 0)
6722                                                                         /*
6723                                                                          *
6724                                                                          * bad
6725                                                                          * link
6726                                                                          *
6727                                                                          * local
6728                                                                          *
6729                                                                          * address
6730                                                                          */
6731                                                                         continue;
6732                                                         }
6733                                                 }
6734                                                 if ((site_scope == 0) &&
6735                                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
6736                                                         continue;
6737                                                 }
6738                                                 /* count this one */
6739                                                 count++;
6740                                         }
6741                                         break;
6742 #endif
6743                                 default:
6744                                         /* TSNH */
6745                                         break;
6746                                 }
6747                         }
6748                 }
6749         } else {
6750                 /*
6751                  * subset bound case
6752                  */
6753                 struct sctp_laddr *laddr;
6754
6755                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list,
6756                     sctp_nxt_addr) {
6757                         if (sctp_is_addr_restricted(stcb, laddr->ifa)) {
6758                                 continue;
6759                         }
6760                         /* count this one */
6761                         count++;
6762                 }
6763         }
6764         SCTP_IPI_ADDR_RUNLOCK();
6765         return (count);
6766 }
6767
6768 #if defined(SCTP_LOCAL_TRACE_BUF)
6769
6770 void
6771 sctp_log_trace(uint32_t subsys, const char *str SCTP_UNUSED, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f)
6772 {
6773         uint32_t saveindex, newindex;
6774
6775         do {
6776                 saveindex = SCTP_BASE_SYSCTL(sctp_log).index;
6777                 if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6778                         newindex = 1;
6779                 } else {
6780                         newindex = saveindex + 1;
6781                 }
6782         } while (atomic_cmpset_int(&SCTP_BASE_SYSCTL(sctp_log).index, saveindex, newindex) == 0);
6783         if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6784                 saveindex = 0;
6785         }
6786         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].timestamp = SCTP_GET_CYCLECOUNT;
6787         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].subsys = subsys;
6788         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[0] = a;
6789         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[1] = b;
6790         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[2] = c;
6791         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[3] = d;
6792         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[4] = e;
6793         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[5] = f;
6794 }
6795
6796 #endif
6797 static void
6798 sctp_recv_udp_tunneled_packet(struct mbuf *m, int off, struct inpcb *inp,
6799     const struct sockaddr *sa SCTP_UNUSED, void *ctx SCTP_UNUSED)
6800 {
6801         struct ip *iph;
6802 #ifdef INET6
6803         struct ip6_hdr *ip6;
6804 #endif
6805         struct mbuf *sp, *last;
6806         struct udphdr *uhdr;
6807         uint16_t port;
6808
6809         if ((m->m_flags & M_PKTHDR) == 0) {
6810                 /* Can't handle one that is not a pkt hdr */
6811                 goto out;
6812         }
6813         /* Pull the src port */
6814         iph = mtod(m, struct ip *);
6815         uhdr = (struct udphdr *)((caddr_t)iph + off);
6816         port = uhdr->uh_sport;
6817         /*
6818          * Split out the mbuf chain. Leave the IP header in m, place the
6819          * rest in the sp.
6820          */
6821         sp = m_split(m, off, M_NOWAIT);
6822         if (sp == NULL) {
6823                 /* Gak, drop packet, we can't do a split */
6824                 goto out;
6825         }
6826         if (sp->m_pkthdr.len < sizeof(struct udphdr) + sizeof(struct sctphdr)) {
6827                 /* Gak, packet can't have an SCTP header in it - too small */
6828                 m_freem(sp);
6829                 goto out;
6830         }
6831         /* Now pull up the UDP header and SCTP header together */
6832         sp = m_pullup(sp, sizeof(struct udphdr) + sizeof(struct sctphdr));
6833         if (sp == NULL) {
6834                 /* Gak pullup failed */
6835                 goto out;
6836         }
6837         /* Trim out the UDP header */
6838         m_adj(sp, sizeof(struct udphdr));
6839
6840         /* Now reconstruct the mbuf chain */
6841         for (last = m; last->m_next; last = last->m_next);
6842         last->m_next = sp;
6843         m->m_pkthdr.len += sp->m_pkthdr.len;
6844         /*
6845          * The CSUM_DATA_VALID flags indicates that the HW checked the UDP
6846          * checksum and it was valid. Since CSUM_DATA_VALID ==
6847          * CSUM_SCTP_VALID this would imply that the HW also verified the
6848          * SCTP checksum. Therefore, clear the bit.
6849          */
6850         SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
6851             "sctp_recv_udp_tunneled_packet(): Packet of length %d received on %s with csum_flags 0x%b.\n",
6852             m->m_pkthdr.len,
6853             if_name(m->m_pkthdr.rcvif),
6854             (int)m->m_pkthdr.csum_flags, CSUM_BITS);
6855         m->m_pkthdr.csum_flags &= ~CSUM_DATA_VALID;
6856         iph = mtod(m, struct ip *);
6857         switch (iph->ip_v) {
6858 #ifdef INET
6859         case IPVERSION:
6860                 iph->ip_len = htons(ntohs(iph->ip_len) - sizeof(struct udphdr));
6861                 sctp_input_with_port(m, off, port);
6862                 break;
6863 #endif
6864 #ifdef INET6
6865         case IPV6_VERSION >> 4:
6866                 ip6 = mtod(m, struct ip6_hdr *);
6867                 ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - sizeof(struct udphdr));
6868                 sctp6_input_with_port(&m, &off, port);
6869                 break;
6870 #endif
6871         default:
6872                 goto out;
6873                 break;
6874         }
6875         return;
6876 out:
6877         m_freem(m);
6878 }
6879
6880 #ifdef INET
6881 static void
6882 sctp_recv_icmp_tunneled_packet(int cmd, struct sockaddr *sa, void *vip, void *ctx SCTP_UNUSED)
6883 {
6884         struct ip *outer_ip, *inner_ip;
6885         struct sctphdr *sh;
6886         struct icmp *icmp;
6887         struct udphdr *udp;
6888         struct sctp_inpcb *inp;
6889         struct sctp_tcb *stcb;
6890         struct sctp_nets *net;
6891         struct sctp_init_chunk *ch;
6892         struct sockaddr_in src, dst;
6893         uint8_t type, code;
6894
6895         inner_ip = (struct ip *)vip;
6896         icmp = (struct icmp *)((caddr_t)inner_ip -
6897             (sizeof(struct icmp) - sizeof(struct ip)));
6898         outer_ip = (struct ip *)((caddr_t)icmp - sizeof(struct ip));
6899         if (ntohs(outer_ip->ip_len) <
6900             sizeof(struct ip) + 8 + (inner_ip->ip_hl << 2) + sizeof(struct udphdr) + 8) {
6901                 return;
6902         }
6903         udp = (struct udphdr *)((caddr_t)inner_ip + (inner_ip->ip_hl << 2));
6904         sh = (struct sctphdr *)(udp + 1);
6905         memset(&src, 0, sizeof(struct sockaddr_in));
6906         src.sin_family = AF_INET;
6907         src.sin_len = sizeof(struct sockaddr_in);
6908         src.sin_port = sh->src_port;
6909         src.sin_addr = inner_ip->ip_src;
6910         memset(&dst, 0, sizeof(struct sockaddr_in));
6911         dst.sin_family = AF_INET;
6912         dst.sin_len = sizeof(struct sockaddr_in);
6913         dst.sin_port = sh->dest_port;
6914         dst.sin_addr = inner_ip->ip_dst;
6915         /*
6916          * 'dst' holds the dest of the packet that failed to be sent. 'src'
6917          * holds our local endpoint address. Thus we reverse the dst and the
6918          * src in the lookup.
6919          */
6920         inp = NULL;
6921         net = NULL;
6922         stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst,
6923             (struct sockaddr *)&src,
6924             &inp, &net, 1,
6925             SCTP_DEFAULT_VRFID);
6926         if ((stcb != NULL) &&
6927             (net != NULL) &&
6928             (inp != NULL)) {
6929                 /* Check the UDP port numbers */
6930                 if ((udp->uh_dport != net->port) ||
6931                     (udp->uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) {
6932                         SCTP_TCB_UNLOCK(stcb);
6933                         return;
6934                 }
6935                 /* Check the verification tag */
6936                 if (ntohl(sh->v_tag) != 0) {
6937                         /*
6938                          * This must be the verification tag used for
6939                          * sending out packets. We don't consider packets
6940                          * reflecting the verification tag.
6941                          */
6942                         if (ntohl(sh->v_tag) != stcb->asoc.peer_vtag) {
6943                                 SCTP_TCB_UNLOCK(stcb);
6944                                 return;
6945                         }
6946                 } else {
6947                         if (ntohs(outer_ip->ip_len) >=
6948                             sizeof(struct ip) +
6949                             8 + (inner_ip->ip_hl << 2) + 8 + 20) {
6950                                 /*
6951                                  * In this case we can check if we got an
6952                                  * INIT chunk and if the initiate tag
6953                                  * matches.
6954                                  */
6955                                 ch = (struct sctp_init_chunk *)(sh + 1);
6956                                 if ((ch->ch.chunk_type != SCTP_INITIATION) ||
6957                                     (ntohl(ch->init.initiate_tag) != stcb->asoc.my_vtag)) {
6958                                         SCTP_TCB_UNLOCK(stcb);
6959                                         return;
6960                                 }
6961                         } else {
6962                                 SCTP_TCB_UNLOCK(stcb);
6963                                 return;
6964                         }
6965                 }
6966                 type = icmp->icmp_type;
6967                 code = icmp->icmp_code;
6968                 if ((type == ICMP_UNREACH) &&
6969                     (code == ICMP_UNREACH_PORT)) {
6970                         code = ICMP_UNREACH_PROTOCOL;
6971                 }
6972                 sctp_notify(inp, stcb, net, type, code,
6973                     ntohs(inner_ip->ip_len),
6974                     (uint32_t)ntohs(icmp->icmp_nextmtu));
6975         } else {
6976                 if ((stcb == NULL) && (inp != NULL)) {
6977                         /* reduce ref-count */
6978                         SCTP_INP_WLOCK(inp);
6979                         SCTP_INP_DECR_REF(inp);
6980                         SCTP_INP_WUNLOCK(inp);
6981                 }
6982                 if (stcb) {
6983                         SCTP_TCB_UNLOCK(stcb);
6984                 }
6985         }
6986         return;
6987 }
6988 #endif
6989
6990 #ifdef INET6
6991 static void
6992 sctp_recv_icmp6_tunneled_packet(int cmd, struct sockaddr *sa, void *d, void *ctx SCTP_UNUSED)
6993 {
6994         struct ip6ctlparam *ip6cp;
6995         struct sctp_inpcb *inp;
6996         struct sctp_tcb *stcb;
6997         struct sctp_nets *net;
6998         struct sctphdr sh;
6999         struct udphdr udp;
7000         struct sockaddr_in6 src, dst;
7001         uint8_t type, code;
7002
7003         ip6cp = (struct ip6ctlparam *)d;
7004         /*
7005          * XXX: We assume that when IPV6 is non NULL, M and OFF are valid.
7006          */
7007         if (ip6cp->ip6c_m == NULL) {
7008                 return;
7009         }
7010         /*
7011          * Check if we can safely examine the ports and the verification tag
7012          * of the SCTP common header.
7013          */
7014         if (ip6cp->ip6c_m->m_pkthdr.len <
7015             ip6cp->ip6c_off + sizeof(struct udphdr) + offsetof(struct sctphdr, checksum)) {
7016                 return;
7017         }
7018         /* Copy out the UDP header. */
7019         memset(&udp, 0, sizeof(struct udphdr));
7020         m_copydata(ip6cp->ip6c_m,
7021             ip6cp->ip6c_off,
7022             sizeof(struct udphdr),
7023             (caddr_t)&udp);
7024         /* Copy out the port numbers and the verification tag. */
7025         memset(&sh, 0, sizeof(struct sctphdr));
7026         m_copydata(ip6cp->ip6c_m,
7027             ip6cp->ip6c_off + sizeof(struct udphdr),
7028             sizeof(uint16_t) + sizeof(uint16_t) + sizeof(uint32_t),
7029             (caddr_t)&sh);
7030         memset(&src, 0, sizeof(struct sockaddr_in6));
7031         src.sin6_family = AF_INET6;
7032         src.sin6_len = sizeof(struct sockaddr_in6);
7033         src.sin6_port = sh.src_port;
7034         src.sin6_addr = ip6cp->ip6c_ip6->ip6_src;
7035         if (in6_setscope(&src.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) {
7036                 return;
7037         }
7038         memset(&dst, 0, sizeof(struct sockaddr_in6));
7039         dst.sin6_family = AF_INET6;
7040         dst.sin6_len = sizeof(struct sockaddr_in6);
7041         dst.sin6_port = sh.dest_port;
7042         dst.sin6_addr = ip6cp->ip6c_ip6->ip6_dst;
7043         if (in6_setscope(&dst.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) {
7044                 return;
7045         }
7046         inp = NULL;
7047         net = NULL;
7048         stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst,
7049             (struct sockaddr *)&src,
7050             &inp, &net, 1, SCTP_DEFAULT_VRFID);
7051         if ((stcb != NULL) &&
7052             (net != NULL) &&
7053             (inp != NULL)) {
7054                 /* Check the UDP port numbers */
7055                 if ((udp.uh_dport != net->port) ||
7056                     (udp.uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) {
7057                         SCTP_TCB_UNLOCK(stcb);
7058                         return;
7059                 }
7060                 /* Check the verification tag */
7061                 if (ntohl(sh.v_tag) != 0) {
7062                         /*
7063                          * This must be the verification tag used for
7064                          * sending out packets. We don't consider packets
7065                          * reflecting the verification tag.
7066                          */
7067                         if (ntohl(sh.v_tag) != stcb->asoc.peer_vtag) {
7068                                 SCTP_TCB_UNLOCK(stcb);
7069                                 return;
7070                         }
7071                 } else {
7072                         if (ip6cp->ip6c_m->m_pkthdr.len >=
7073                             ip6cp->ip6c_off + sizeof(struct udphdr) +
7074                             sizeof(struct sctphdr) +
7075                             sizeof(struct sctp_chunkhdr) +
7076                             offsetof(struct sctp_init, a_rwnd)) {
7077                                 /*
7078                                  * In this case we can check if we got an
7079                                  * INIT chunk and if the initiate tag
7080                                  * matches.
7081                                  */
7082                                 uint32_t initiate_tag;
7083                                 uint8_t chunk_type;
7084
7085                                 m_copydata(ip6cp->ip6c_m,
7086                                     ip6cp->ip6c_off +
7087                                     sizeof(struct udphdr) +
7088                                     sizeof(struct sctphdr),
7089                                     sizeof(uint8_t),
7090                                     (caddr_t)&chunk_type);
7091                                 m_copydata(ip6cp->ip6c_m,
7092                                     ip6cp->ip6c_off +
7093                                     sizeof(struct udphdr) +
7094                                     sizeof(struct sctphdr) +
7095                                     sizeof(struct sctp_chunkhdr),
7096                                     sizeof(uint32_t),
7097                                     (caddr_t)&initiate_tag);
7098                                 if ((chunk_type != SCTP_INITIATION) ||
7099                                     (ntohl(initiate_tag) != stcb->asoc.my_vtag)) {
7100                                         SCTP_TCB_UNLOCK(stcb);
7101                                         return;
7102                                 }
7103                         } else {
7104                                 SCTP_TCB_UNLOCK(stcb);
7105                                 return;
7106                         }
7107                 }
7108                 type = ip6cp->ip6c_icmp6->icmp6_type;
7109                 code = ip6cp->ip6c_icmp6->icmp6_code;
7110                 if ((type == ICMP6_DST_UNREACH) &&
7111                     (code == ICMP6_DST_UNREACH_NOPORT)) {
7112                         type = ICMP6_PARAM_PROB;
7113                         code = ICMP6_PARAMPROB_NEXTHEADER;
7114                 }
7115                 sctp6_notify(inp, stcb, net, type, code,
7116                     ntohl(ip6cp->ip6c_icmp6->icmp6_mtu));
7117         } else {
7118                 if ((stcb == NULL) && (inp != NULL)) {
7119                         /* reduce inp's ref-count */
7120                         SCTP_INP_WLOCK(inp);
7121                         SCTP_INP_DECR_REF(inp);
7122                         SCTP_INP_WUNLOCK(inp);
7123                 }
7124                 if (stcb) {
7125                         SCTP_TCB_UNLOCK(stcb);
7126                 }
7127         }
7128 }
7129 #endif
7130
7131 void
7132 sctp_over_udp_stop(void)
7133 {
7134         /*
7135          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
7136          * for writting!
7137          */
7138 #ifdef INET
7139         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
7140                 soclose(SCTP_BASE_INFO(udp4_tun_socket));
7141                 SCTP_BASE_INFO(udp4_tun_socket) = NULL;
7142         }
7143 #endif
7144 #ifdef INET6
7145         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
7146                 soclose(SCTP_BASE_INFO(udp6_tun_socket));
7147                 SCTP_BASE_INFO(udp6_tun_socket) = NULL;
7148         }
7149 #endif
7150 }
7151
7152 int
7153 sctp_over_udp_start(void)
7154 {
7155         uint16_t port;
7156         int ret;
7157 #ifdef INET
7158         struct sockaddr_in sin;
7159 #endif
7160 #ifdef INET6
7161         struct sockaddr_in6 sin6;
7162 #endif
7163         /*
7164          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
7165          * for writting!
7166          */
7167         port = SCTP_BASE_SYSCTL(sctp_udp_tunneling_port);
7168         if (ntohs(port) == 0) {
7169                 /* Must have a port set */
7170                 return (EINVAL);
7171         }
7172 #ifdef INET
7173         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
7174                 /* Already running -- must stop first */
7175                 return (EALREADY);
7176         }
7177 #endif
7178 #ifdef INET6
7179         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
7180                 /* Already running -- must stop first */
7181                 return (EALREADY);
7182         }
7183 #endif
7184 #ifdef INET
7185         if ((ret = socreate(PF_INET, &SCTP_BASE_INFO(udp4_tun_socket),
7186             SOCK_DGRAM, IPPROTO_UDP,
7187             curthread->td_ucred, curthread))) {
7188                 sctp_over_udp_stop();
7189                 return (ret);
7190         }
7191         /* Call the special UDP hook. */
7192         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp4_tun_socket),
7193             sctp_recv_udp_tunneled_packet,
7194             sctp_recv_icmp_tunneled_packet,
7195             NULL))) {
7196                 sctp_over_udp_stop();
7197                 return (ret);
7198         }
7199         /* Ok, we have a socket, bind it to the port. */
7200         memset(&sin, 0, sizeof(struct sockaddr_in));
7201         sin.sin_len = sizeof(struct sockaddr_in);
7202         sin.sin_family = AF_INET;
7203         sin.sin_port = htons(port);
7204         if ((ret = sobind(SCTP_BASE_INFO(udp4_tun_socket),
7205             (struct sockaddr *)&sin, curthread))) {
7206                 sctp_over_udp_stop();
7207                 return (ret);
7208         }
7209 #endif
7210 #ifdef INET6
7211         if ((ret = socreate(PF_INET6, &SCTP_BASE_INFO(udp6_tun_socket),
7212             SOCK_DGRAM, IPPROTO_UDP,
7213             curthread->td_ucred, curthread))) {
7214                 sctp_over_udp_stop();
7215                 return (ret);
7216         }
7217         /* Call the special UDP hook. */
7218         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp6_tun_socket),
7219             sctp_recv_udp_tunneled_packet,
7220             sctp_recv_icmp6_tunneled_packet,
7221             NULL))) {
7222                 sctp_over_udp_stop();
7223                 return (ret);
7224         }
7225         /* Ok, we have a socket, bind it to the port. */
7226         memset(&sin6, 0, sizeof(struct sockaddr_in6));
7227         sin6.sin6_len = sizeof(struct sockaddr_in6);
7228         sin6.sin6_family = AF_INET6;
7229         sin6.sin6_port = htons(port);
7230         if ((ret = sobind(SCTP_BASE_INFO(udp6_tun_socket),
7231             (struct sockaddr *)&sin6, curthread))) {
7232                 sctp_over_udp_stop();
7233                 return (ret);
7234         }
7235 #endif
7236         return (0);
7237 }
7238
7239 #if defined(INET6) || defined(INET)
7240
7241 /*
7242  * sctp_min_mtu ()returns the minimum of all non-zero arguments.
7243  * If all arguments are zero, zero is returned.
7244  */
7245 uint32_t
7246 sctp_min_mtu(uint32_t mtu1, uint32_t mtu2, uint32_t mtu3)
7247 {
7248         if (mtu1 > 0) {
7249                 if (mtu2 > 0) {
7250                         if (mtu3 > 0) {
7251                                 return (min(mtu1, min(mtu2, mtu3)));
7252                         } else {
7253                                 return (min(mtu1, mtu2));
7254                         }
7255                 } else {
7256                         if (mtu3 > 0) {
7257                                 return (min(mtu1, mtu3));
7258                         } else {
7259                                 return (mtu1);
7260                         }
7261                 }
7262         } else {
7263                 if (mtu2 > 0) {
7264                         if (mtu3 > 0) {
7265                                 return (min(mtu2, mtu3));
7266                         } else {
7267                                 return (mtu2);
7268                         }
7269                 } else {
7270                         return (mtu3);
7271                 }
7272         }
7273 }
7274
7275 void
7276 sctp_hc_set_mtu(union sctp_sockstore *addr, uint16_t fibnum, uint32_t mtu)
7277 {
7278         struct in_conninfo inc;
7279
7280         memset(&inc, 0, sizeof(struct in_conninfo));
7281         inc.inc_fibnum = fibnum;
7282         switch (addr->sa.sa_family) {
7283 #ifdef INET
7284         case AF_INET:
7285                 inc.inc_faddr = addr->sin.sin_addr;
7286                 break;
7287 #endif
7288 #ifdef INET6
7289         case AF_INET6:
7290                 inc.inc_flags |= INC_ISIPV6;
7291                 inc.inc6_faddr = addr->sin6.sin6_addr;
7292                 break;
7293 #endif
7294         default:
7295                 return;
7296         }
7297         tcp_hc_updatemtu(&inc, (u_long)mtu);
7298 }
7299
7300 uint32_t
7301 sctp_hc_get_mtu(union sctp_sockstore *addr, uint16_t fibnum)
7302 {
7303         struct in_conninfo inc;
7304
7305         memset(&inc, 0, sizeof(struct in_conninfo));
7306         inc.inc_fibnum = fibnum;
7307         switch (addr->sa.sa_family) {
7308 #ifdef INET
7309         case AF_INET:
7310                 inc.inc_faddr = addr->sin.sin_addr;
7311                 break;
7312 #endif
7313 #ifdef INET6
7314         case AF_INET6:
7315                 inc.inc_flags |= INC_ISIPV6;
7316                 inc.inc6_faddr = addr->sin6.sin6_addr;
7317                 break;
7318 #endif
7319         default:
7320                 return (0);
7321         }
7322         return ((uint32_t)tcp_hc_getmtu(&inc));
7323 }
7324 #endif