sys/netinet/sctputil.c

   1 /*-
   2  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2011, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2011, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 /* $KAME: sctputil.c,v 1.37 2005/03/07 23:26:09 itojun Exp $     */
  34
  35 #include <sys/cdefs.h>
  36 __FBSDID("$FreeBSD$");
  37
  38 #include <netinet/sctp_os.h>
  39 #include <netinet/sctp_pcb.h>
  40 #include <netinet/sctputil.h>
  41 #include <netinet/sctp_var.h>
  42 #include <netinet/sctp_sysctl.h>
  43 #ifdef INET6
  44 #endif
  45 #include <netinet/sctp_header.h>
  46 #include <netinet/sctp_output.h>
  47 #include <netinet/sctp_uio.h>
  48 #include <netinet/sctp_timer.h>
  49 #include <netinet/sctp_indata.h>/* for sctp_deliver_data() */
  50 #include <netinet/sctp_auth.h>
  51 #include <netinet/sctp_asconf.h>
  52 #include <netinet/sctp_bsd_addr.h>
  53
  54
  55 #ifndef KTR_SCTP
  56 #define KTR_SCTP KTR_SUBSYS
  57 #endif
  58
  59 extern struct sctp_cc_functions sctp_cc_functions[];
  60 extern struct sctp_ss_functions sctp_ss_functions[];
  61
  62 void
  63 sctp_sblog(struct sockbuf *sb,
  64     struct sctp_tcb *stcb, int from, int incr)
  65 {
  66         struct sctp_cwnd_log sctp_clog;
  67
  68         sctp_clog.x.sb.stcb = stcb;
  69         sctp_clog.x.sb.so_sbcc = sb->sb_cc;
  70         if (stcb)
  71                 sctp_clog.x.sb.stcb_sbcc = stcb->asoc.sb_cc;
  72         else
  73                 sctp_clog.x.sb.stcb_sbcc = 0;
  74         sctp_clog.x.sb.incr = incr;
  75         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
  76             SCTP_LOG_EVENT_SB,
  77             from,
  78             sctp_clog.x.misc.log1,
  79             sctp_clog.x.misc.log2,
  80             sctp_clog.x.misc.log3,
  81             sctp_clog.x.misc.log4);
  82 }
  83
  84 void
  85 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc)
  86 {
  87         struct sctp_cwnd_log sctp_clog;
  88
  89         sctp_clog.x.close.inp = (void *)inp;
  90         sctp_clog.x.close.sctp_flags = inp->sctp_flags;
  91         if (stcb) {
  92                 sctp_clog.x.close.stcb = (void *)stcb;
  93                 sctp_clog.x.close.state = (uint16_t) stcb->asoc.state;
  94         } else {
  95                 sctp_clog.x.close.stcb = 0;
  96                 sctp_clog.x.close.state = 0;
  97         }
  98         sctp_clog.x.close.loc = loc;
  99         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 100             SCTP_LOG_EVENT_CLOSE,
 101             0,
 102             sctp_clog.x.misc.log1,
 103             sctp_clog.x.misc.log2,
 104             sctp_clog.x.misc.log3,
 105             sctp_clog.x.misc.log4);
 106 }
 107
 108
 109 void
 110 rto_logging(struct sctp_nets *net, int from)
 111 {
 112         struct sctp_cwnd_log sctp_clog;
 113
 114         memset(&sctp_clog, 0, sizeof(sctp_clog));
 115         sctp_clog.x.rto.net = (void *)net;
 116         sctp_clog.x.rto.rtt = net->rtt / 1000;
 117         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 118             SCTP_LOG_EVENT_RTT,
 119             from,
 120             sctp_clog.x.misc.log1,
 121             sctp_clog.x.misc.log2,
 122             sctp_clog.x.misc.log3,
 123             sctp_clog.x.misc.log4);
 124 }
 125
 126 void
 127 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from)
 128 {
 129         struct sctp_cwnd_log sctp_clog;
 130
 131         sctp_clog.x.strlog.stcb = stcb;
 132         sctp_clog.x.strlog.n_tsn = tsn;
 133         sctp_clog.x.strlog.n_sseq = sseq;
 134         sctp_clog.x.strlog.e_tsn = 0;
 135         sctp_clog.x.strlog.e_sseq = 0;
 136         sctp_clog.x.strlog.strm = stream;
 137         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 138             SCTP_LOG_EVENT_STRM,
 139             from,
 140             sctp_clog.x.misc.log1,
 141             sctp_clog.x.misc.log2,
 142             sctp_clog.x.misc.log3,
 143             sctp_clog.x.misc.log4);
 144 }
 145
 146 void
 147 sctp_log_nagle_event(struct sctp_tcb *stcb, int action)
 148 {
 149         struct sctp_cwnd_log sctp_clog;
 150
 151         sctp_clog.x.nagle.stcb = (void *)stcb;
 152         sctp_clog.x.nagle.total_flight = stcb->asoc.total_flight;
 153         sctp_clog.x.nagle.total_in_queue = stcb->asoc.total_output_queue_size;
 154         sctp_clog.x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue;
 155         sctp_clog.x.nagle.count_in_flight = stcb->asoc.total_flight_count;
 156         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 157             SCTP_LOG_EVENT_NAGLE,
 158             action,
 159             sctp_clog.x.misc.log1,
 160             sctp_clog.x.misc.log2,
 161             sctp_clog.x.misc.log3,
 162             sctp_clog.x.misc.log4);
 163 }
 164
 165 void
 166 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from)
 167 {
 168         struct sctp_cwnd_log sctp_clog;
 169
 170         sctp_clog.x.sack.cumack = cumack;
 171         sctp_clog.x.sack.oldcumack = old_cumack;
 172         sctp_clog.x.sack.tsn = tsn;
 173         sctp_clog.x.sack.numGaps = gaps;
 174         sctp_clog.x.sack.numDups = dups;
 175         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 176             SCTP_LOG_EVENT_SACK,
 177             from,
 178             sctp_clog.x.misc.log1,
 179             sctp_clog.x.misc.log2,
 180             sctp_clog.x.misc.log3,
 181             sctp_clog.x.misc.log4);
 182 }
 183
 184 void
 185 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from)
 186 {
 187         struct sctp_cwnd_log sctp_clog;
 188
 189         memset(&sctp_clog, 0, sizeof(sctp_clog));
 190         sctp_clog.x.map.base = map;
 191         sctp_clog.x.map.cum = cum;
 192         sctp_clog.x.map.high = high;
 193         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 194             SCTP_LOG_EVENT_MAP,
 195             from,
 196             sctp_clog.x.misc.log1,
 197             sctp_clog.x.misc.log2,
 198             sctp_clog.x.misc.log3,
 199             sctp_clog.x.misc.log4);
 200 }
 201
 202 void
 203 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn,
 204     int from)
 205 {
 206         struct sctp_cwnd_log sctp_clog;
 207
 208         memset(&sctp_clog, 0, sizeof(sctp_clog));
 209         sctp_clog.x.fr.largest_tsn = biggest_tsn;
 210         sctp_clog.x.fr.largest_new_tsn = biggest_new_tsn;
 211         sctp_clog.x.fr.tsn = tsn;
 212         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 213             SCTP_LOG_EVENT_FR,
 214             from,
 215             sctp_clog.x.misc.log1,
 216             sctp_clog.x.misc.log2,
 217             sctp_clog.x.misc.log3,
 218             sctp_clog.x.misc.log4);
 219 }
 220
 221 void
 222 sctp_log_mb(struct mbuf *m, int from)
 223 {
 224         struct sctp_cwnd_log sctp_clog;
 225
 226         sctp_clog.x.mb.mp = m;
 227         sctp_clog.x.mb.mbuf_flags = (uint8_t) (SCTP_BUF_GET_FLAGS(m));
 228         sctp_clog.x.mb.size = (uint16_t) (SCTP_BUF_LEN(m));
 229         sctp_clog.x.mb.data = SCTP_BUF_AT(m, 0);
 230         if (SCTP_BUF_IS_EXTENDED(m)) {
 231                 sctp_clog.x.mb.ext = SCTP_BUF_EXTEND_BASE(m);
 232                 sctp_clog.x.mb.refcnt = (uint8_t) (SCTP_BUF_EXTEND_REFCNT(m));
 233         } else {
 234                 sctp_clog.x.mb.ext = 0;
 235                 sctp_clog.x.mb.refcnt = 0;
 236         }
 237         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 238             SCTP_LOG_EVENT_MBUF,
 239             from,
 240             sctp_clog.x.misc.log1,
 241             sctp_clog.x.misc.log2,
 242             sctp_clog.x.misc.log3,
 243             sctp_clog.x.misc.log4);
 244 }
 245
 246 void
 247 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk,
 248     int from)
 249 {
 250         struct sctp_cwnd_log sctp_clog;
 251
 252         if (control == NULL) {
 253                 SCTP_PRINTF("Gak log of NULL?\n");
 254                 return;
 255         }
 256         sctp_clog.x.strlog.stcb = control->stcb;
 257         sctp_clog.x.strlog.n_tsn = control->sinfo_tsn;
 258         sctp_clog.x.strlog.n_sseq = control->sinfo_ssn;
 259         sctp_clog.x.strlog.strm = control->sinfo_stream;
 260         if (poschk != NULL) {
 261                 sctp_clog.x.strlog.e_tsn = poschk->sinfo_tsn;
 262                 sctp_clog.x.strlog.e_sseq = poschk->sinfo_ssn;
 263         } else {
 264                 sctp_clog.x.strlog.e_tsn = 0;
 265                 sctp_clog.x.strlog.e_sseq = 0;
 266         }
 267         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 268             SCTP_LOG_EVENT_STRM,
 269             from,
 270             sctp_clog.x.misc.log1,
 271             sctp_clog.x.misc.log2,
 272             sctp_clog.x.misc.log3,
 273             sctp_clog.x.misc.log4);
 274 }
 275
 276 void
 277 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from)
 278 {
 279         struct sctp_cwnd_log sctp_clog;
 280
 281         sctp_clog.x.cwnd.net = net;
 282         if (stcb->asoc.send_queue_cnt > 255)
 283                 sctp_clog.x.cwnd.cnt_in_send = 255;
 284         else
 285                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 286         if (stcb->asoc.stream_queue_cnt > 255)
 287                 sctp_clog.x.cwnd.cnt_in_str = 255;
 288         else
 289                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 290
 291         if (net) {
 292                 sctp_clog.x.cwnd.cwnd_new_value = net->cwnd;
 293                 sctp_clog.x.cwnd.inflight = net->flight_size;
 294                 sctp_clog.x.cwnd.pseudo_cumack = net->pseudo_cumack;
 295                 sctp_clog.x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack;
 296                 sctp_clog.x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack;
 297         }
 298         if (SCTP_CWNDLOG_PRESEND == from) {
 299                 sctp_clog.x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd;
 300         }
 301         sctp_clog.x.cwnd.cwnd_augment = augment;
 302         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 303             SCTP_LOG_EVENT_CWND,
 304             from,
 305             sctp_clog.x.misc.log1,
 306             sctp_clog.x.misc.log2,
 307             sctp_clog.x.misc.log3,
 308             sctp_clog.x.misc.log4);
 309 }
 310
 311 void
 312 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from)
 313 {
 314         struct sctp_cwnd_log sctp_clog;
 315
 316         memset(&sctp_clog, 0, sizeof(sctp_clog));
 317         if (inp) {
 318                 sctp_clog.x.lock.sock = (void *)inp->sctp_socket;
 319
 320         } else {
 321                 sctp_clog.x.lock.sock = (void *)NULL;
 322         }
 323         sctp_clog.x.lock.inp = (void *)inp;
 324         if (stcb) {
 325                 sctp_clog.x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx);
 326         } else {
 327                 sctp_clog.x.lock.tcb_lock = SCTP_LOCK_UNKNOWN;
 328         }
 329         if (inp) {
 330                 sctp_clog.x.lock.inp_lock = mtx_owned(&inp->inp_mtx);
 331                 sctp_clog.x.lock.create_lock = mtx_owned(&inp->inp_create_mtx);
 332         } else {
 333                 sctp_clog.x.lock.inp_lock = SCTP_LOCK_UNKNOWN;
 334                 sctp_clog.x.lock.create_lock = SCTP_LOCK_UNKNOWN;
 335         }
 336         sctp_clog.x.lock.info_lock = rw_wowned(&SCTP_BASE_INFO(ipi_ep_mtx));
 337         if (inp && (inp->sctp_socket)) {
 338                 sctp_clog.x.lock.sock_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 339                 sctp_clog.x.lock.sockrcvbuf_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 340                 sctp_clog.x.lock.socksndbuf_lock = mtx_owned(&(inp->sctp_socket->so_snd.sb_mtx));
 341         } else {
 342                 sctp_clog.x.lock.sock_lock = SCTP_LOCK_UNKNOWN;
 343                 sctp_clog.x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN;
 344                 sctp_clog.x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN;
 345         }
 346         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 347             SCTP_LOG_LOCK_EVENT,
 348             from,
 349             sctp_clog.x.misc.log1,
 350             sctp_clog.x.misc.log2,
 351             sctp_clog.x.misc.log3,
 352             sctp_clog.x.misc.log4);
 353 }
 354
 355 void
 356 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from)
 357 {
 358         struct sctp_cwnd_log sctp_clog;
 359
 360         memset(&sctp_clog, 0, sizeof(sctp_clog));
 361         sctp_clog.x.cwnd.net = net;
 362         sctp_clog.x.cwnd.cwnd_new_value = error;
 363         sctp_clog.x.cwnd.inflight = net->flight_size;
 364         sctp_clog.x.cwnd.cwnd_augment = burst;
 365         if (stcb->asoc.send_queue_cnt > 255)
 366                 sctp_clog.x.cwnd.cnt_in_send = 255;
 367         else
 368                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 369         if (stcb->asoc.stream_queue_cnt > 255)
 370                 sctp_clog.x.cwnd.cnt_in_str = 255;
 371         else
 372                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 373         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 374             SCTP_LOG_EVENT_MAXBURST,
 375             from,
 376             sctp_clog.x.misc.log1,
 377             sctp_clog.x.misc.log2,
 378             sctp_clog.x.misc.log3,
 379             sctp_clog.x.misc.log4);
 380 }
 381
 382 void
 383 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead)
 384 {
 385         struct sctp_cwnd_log sctp_clog;
 386
 387         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 388         sctp_clog.x.rwnd.send_size = snd_size;
 389         sctp_clog.x.rwnd.overhead = overhead;
 390         sctp_clog.x.rwnd.new_rwnd = 0;
 391         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 392             SCTP_LOG_EVENT_RWND,
 393             from,
 394             sctp_clog.x.misc.log1,
 395             sctp_clog.x.misc.log2,
 396             sctp_clog.x.misc.log3,
 397             sctp_clog.x.misc.log4);
 398 }
 399
 400 void
 401 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval)
 402 {
 403         struct sctp_cwnd_log sctp_clog;
 404
 405         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 406         sctp_clog.x.rwnd.send_size = flight_size;
 407         sctp_clog.x.rwnd.overhead = overhead;
 408         sctp_clog.x.rwnd.new_rwnd = a_rwndval;
 409         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 410             SCTP_LOG_EVENT_RWND,
 411             from,
 412             sctp_clog.x.misc.log1,
 413             sctp_clog.x.misc.log2,
 414             sctp_clog.x.misc.log3,
 415             sctp_clog.x.misc.log4);
 416 }
 417
 418 void
 419 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt)
 420 {
 421         struct sctp_cwnd_log sctp_clog;
 422
 423         sctp_clog.x.mbcnt.total_queue_size = total_oq;
 424         sctp_clog.x.mbcnt.size_change = book;
 425         sctp_clog.x.mbcnt.total_queue_mb_size = total_mbcnt_q;
 426         sctp_clog.x.mbcnt.mbcnt_change = mbcnt;
 427         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 428             SCTP_LOG_EVENT_MBCNT,
 429             from,
 430             sctp_clog.x.misc.log1,
 431             sctp_clog.x.misc.log2,
 432             sctp_clog.x.misc.log3,
 433             sctp_clog.x.misc.log4);
 434 }
 435
 436 void
 437 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d)
 438 {
 439         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 440             SCTP_LOG_MISC_EVENT,
 441             from,
 442             a, b, c, d);
 443 }
 444
 445 void
 446 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t wake_cnt, int from)
 447 {
 448         struct sctp_cwnd_log sctp_clog;
 449
 450         sctp_clog.x.wake.stcb = (void *)stcb;
 451         sctp_clog.x.wake.wake_cnt = wake_cnt;
 452         sctp_clog.x.wake.flight = stcb->asoc.total_flight_count;
 453         sctp_clog.x.wake.send_q = stcb->asoc.send_queue_cnt;
 454         sctp_clog.x.wake.sent_q = stcb->asoc.sent_queue_cnt;
 455
 456         if (stcb->asoc.stream_queue_cnt < 0xff)
 457                 sctp_clog.x.wake.stream_qcnt = (uint8_t) stcb->asoc.stream_queue_cnt;
 458         else
 459                 sctp_clog.x.wake.stream_qcnt = 0xff;
 460
 461         if (stcb->asoc.chunks_on_out_queue < 0xff)
 462                 sctp_clog.x.wake.chunks_on_oque = (uint8_t) stcb->asoc.chunks_on_out_queue;
 463         else
 464                 sctp_clog.x.wake.chunks_on_oque = 0xff;
 465
 466         sctp_clog.x.wake.sctpflags = 0;
 467         /* set in the defered mode stuff */
 468         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE)
 469                 sctp_clog.x.wake.sctpflags |= 1;
 470         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT)
 471                 sctp_clog.x.wake.sctpflags |= 2;
 472         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT)
 473                 sctp_clog.x.wake.sctpflags |= 4;
 474         /* what about the sb */
 475         if (stcb->sctp_socket) {
 476                 struct socket *so = stcb->sctp_socket;
 477
 478                 sctp_clog.x.wake.sbflags = (uint8_t) ((so->so_snd.sb_flags & 0x00ff));
 479         } else {
 480                 sctp_clog.x.wake.sbflags = 0xff;
 481         }
 482         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 483             SCTP_LOG_EVENT_WAKE,
 484             from,
 485             sctp_clog.x.misc.log1,
 486             sctp_clog.x.misc.log2,
 487             sctp_clog.x.misc.log3,
 488             sctp_clog.x.misc.log4);
 489 }
 490
 491 void
 492 sctp_log_block(uint8_t from, struct sctp_association *asoc, int sendlen)
 493 {
 494         struct sctp_cwnd_log sctp_clog;
 495
 496         sctp_clog.x.blk.onsb = asoc->total_output_queue_size;
 497         sctp_clog.x.blk.send_sent_qcnt = (uint16_t) (asoc->send_queue_cnt + asoc->sent_queue_cnt);
 498         sctp_clog.x.blk.peer_rwnd = asoc->peers_rwnd;
 499         sctp_clog.x.blk.stream_qcnt = (uint16_t) asoc->stream_queue_cnt;
 500         sctp_clog.x.blk.chunks_on_oque = (uint16_t) asoc->chunks_on_out_queue;
 501         sctp_clog.x.blk.flight_size = (uint16_t) (asoc->total_flight / 1024);
 502         sctp_clog.x.blk.sndlen = sendlen;
 503         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 504             SCTP_LOG_EVENT_BLOCK,
 505             from,
 506             sctp_clog.x.misc.log1,
 507             sctp_clog.x.misc.log2,
 508             sctp_clog.x.misc.log3,
 509             sctp_clog.x.misc.log4);
 510 }
 511
 512 int
 513 sctp_fill_stat_log(void *optval SCTP_UNUSED, size_t *optsize SCTP_UNUSED)
 514 {
 515         /* May need to fix this if ktrdump does not work */
 516         return (0);
 517 }
 518
 519 #ifdef SCTP_AUDITING_ENABLED
 520 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2];
 521 static int sctp_audit_indx = 0;
 522
 523 static
 524 void
 525 sctp_print_audit_report(void)
 526 {
 527         int i;
 528         int cnt;
 529
 530         cnt = 0;
 531         for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) {
 532                 if ((sctp_audit_data[i][0] == 0xe0) &&
 533                     (sctp_audit_data[i][1] == 0x01)) {
 534                         cnt = 0;
 535                         SCTP_PRINTF("\n");
 536                 } else if (sctp_audit_data[i][0] == 0xf0) {
 537                         cnt = 0;
 538                         SCTP_PRINTF("\n");
 539                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 540                     (sctp_audit_data[i][1] == 0x01)) {
 541                         SCTP_PRINTF("\n");
 542                         cnt = 0;
 543                 }
 544                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0],
 545                     (uint32_t) sctp_audit_data[i][1]);
 546                 cnt++;
 547                 if ((cnt % 14) == 0)
 548                         SCTP_PRINTF("\n");
 549         }
 550         for (i = 0; i < sctp_audit_indx; i++) {
 551                 if ((sctp_audit_data[i][0] == 0xe0) &&
 552                     (sctp_audit_data[i][1] == 0x01)) {
 553                         cnt = 0;
 554                         SCTP_PRINTF("\n");
 555                 } else if (sctp_audit_data[i][0] == 0xf0) {
 556                         cnt = 0;
 557                         SCTP_PRINTF("\n");
 558                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 559                     (sctp_audit_data[i][1] == 0x01)) {
 560                         SCTP_PRINTF("\n");
 561                         cnt = 0;
 562                 }
 563                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0],
 564                     (uint32_t) sctp_audit_data[i][1]);
 565                 cnt++;
 566                 if ((cnt % 14) == 0)
 567                         SCTP_PRINTF("\n");
 568         }
 569         SCTP_PRINTF("\n");
 570 }
 571
 572 void
 573 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 574     struct sctp_nets *net)
 575 {
 576         int resend_cnt, tot_out, rep, tot_book_cnt;
 577         struct sctp_nets *lnet;
 578         struct sctp_tmit_chunk *chk;
 579
 580         sctp_audit_data[sctp_audit_indx][0] = 0xAA;
 581         sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from;
 582         sctp_audit_indx++;
 583         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 584                 sctp_audit_indx = 0;
 585         }
 586         if (inp == NULL) {
 587                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 588                 sctp_audit_data[sctp_audit_indx][1] = 0x01;
 589                 sctp_audit_indx++;
 590                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 591                         sctp_audit_indx = 0;
 592                 }
 593                 return;
 594         }
 595         if (stcb == NULL) {
 596                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 597                 sctp_audit_data[sctp_audit_indx][1] = 0x02;
 598                 sctp_audit_indx++;
 599                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 600                         sctp_audit_indx = 0;
 601                 }
 602                 return;
 603         }
 604         sctp_audit_data[sctp_audit_indx][0] = 0xA1;
 605         sctp_audit_data[sctp_audit_indx][1] =
 606             (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 607         sctp_audit_indx++;
 608         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 609                 sctp_audit_indx = 0;
 610         }
 611         rep = 0;
 612         tot_book_cnt = 0;
 613         resend_cnt = tot_out = 0;
 614         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 615                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 616                         resend_cnt++;
 617                 } else if (chk->sent < SCTP_DATAGRAM_RESEND) {
 618                         tot_out += chk->book_size;
 619                         tot_book_cnt++;
 620                 }
 621         }
 622         if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) {
 623                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 624                 sctp_audit_data[sctp_audit_indx][1] = 0xA1;
 625                 sctp_audit_indx++;
 626                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 627                         sctp_audit_indx = 0;
 628                 }
 629                 SCTP_PRINTF("resend_cnt:%d asoc-tot:%d\n",
 630                     resend_cnt, stcb->asoc.sent_queue_retran_cnt);
 631                 rep = 1;
 632                 stcb->asoc.sent_queue_retran_cnt = resend_cnt;
 633                 sctp_audit_data[sctp_audit_indx][0] = 0xA2;
 634                 sctp_audit_data[sctp_audit_indx][1] =
 635                     (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 636                 sctp_audit_indx++;
 637                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 638                         sctp_audit_indx = 0;
 639                 }
 640         }
 641         if (tot_out != stcb->asoc.total_flight) {
 642                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 643                 sctp_audit_data[sctp_audit_indx][1] = 0xA2;
 644                 sctp_audit_indx++;
 645                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 646                         sctp_audit_indx = 0;
 647                 }
 648                 rep = 1;
 649                 SCTP_PRINTF("tot_flt:%d asoc_tot:%d\n", tot_out,
 650                     (int)stcb->asoc.total_flight);
 651                 stcb->asoc.total_flight = tot_out;
 652         }
 653         if (tot_book_cnt != stcb->asoc.total_flight_count) {
 654                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 655                 sctp_audit_data[sctp_audit_indx][1] = 0xA5;
 656                 sctp_audit_indx++;
 657                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 658                         sctp_audit_indx = 0;
 659                 }
 660                 rep = 1;
 661                 SCTP_PRINTF("tot_flt_book:%d\n", tot_book_cnt);
 662
 663                 stcb->asoc.total_flight_count = tot_book_cnt;
 664         }
 665         tot_out = 0;
 666         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 667                 tot_out += lnet->flight_size;
 668         }
 669         if (tot_out != stcb->asoc.total_flight) {
 670                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 671                 sctp_audit_data[sctp_audit_indx][1] = 0xA3;
 672                 sctp_audit_indx++;
 673                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 674                         sctp_audit_indx = 0;
 675                 }
 676                 rep = 1;
 677                 SCTP_PRINTF("real flight:%d net total was %d\n",
 678                     stcb->asoc.total_flight, tot_out);
 679                 /* now corrective action */
 680                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 681
 682                         tot_out = 0;
 683                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 684                                 if ((chk->whoTo == lnet) &&
 685                                     (chk->sent < SCTP_DATAGRAM_RESEND)) {
 686                                         tot_out += chk->book_size;
 687                                 }
 688                         }
 689                         if (lnet->flight_size != tot_out) {
 690                                 SCTP_PRINTF("net:%p flight was %d corrected to %d\n",
 691                                     lnet, lnet->flight_size,
 692                                     tot_out);
 693                                 lnet->flight_size = tot_out;
 694                         }
 695                 }
 696         }
 697         if (rep) {
 698                 sctp_print_audit_report();
 699         }
 700 }
 701
 702 void
 703 sctp_audit_log(uint8_t ev, uint8_t fd)
 704 {
 705
 706         sctp_audit_data[sctp_audit_indx][0] = ev;
 707         sctp_audit_data[sctp_audit_indx][1] = fd;
 708         sctp_audit_indx++;
 709         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 710                 sctp_audit_indx = 0;
 711         }
 712 }
 713
 714 #endif
 715
 716 /*
 717  * sctp_stop_timers_for_shutdown() should be called
 718  * when entering the SHUTDOWN_SENT or SHUTDOWN_ACK_SENT
 719  * state to make sure that all timers are stopped.
 720  */
 721 void
 722 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb)
 723 {
 724         struct sctp_association *asoc;
 725         struct sctp_nets *net;
 726
 727         asoc = &stcb->asoc;
 728
 729         (void)SCTP_OS_TIMER_STOP(&asoc->dack_timer.timer);
 730         (void)SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
 731         (void)SCTP_OS_TIMER_STOP(&asoc->asconf_timer.timer);
 732         (void)SCTP_OS_TIMER_STOP(&asoc->autoclose_timer.timer);
 733         (void)SCTP_OS_TIMER_STOP(&asoc->delayed_event_timer.timer);
 734         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
 735                 (void)SCTP_OS_TIMER_STOP(&net->pmtu_timer.timer);
 736                 (void)SCTP_OS_TIMER_STOP(&net->hb_timer.timer);
 737         }
 738 }
 739
 740 /*
 741  * a list of sizes based on typical mtu's, used only if next hop size not
 742  * returned.
 743  */
 744 static uint32_t sctp_mtu_sizes[] = {
 745         68,
 746         296,
 747         508,
 748         512,
 749         544,
 750         576,
 751         1006,
 752         1492,
 753         1500,
 754         1536,
 755         2002,
 756         2048,
 757         4352,
 758         4464,
 759         8166,
 760         17914,
 761         32000,
 762         65535
 763 };
 764
 765 /*
 766  * Return the largest MTU smaller than val. If there is no
 767  * entry, just return val.
 768  */
 769 uint32_t
 770 sctp_get_prev_mtu(uint32_t val)
 771 {
 772         uint32_t i;
 773
 774         if (val <= sctp_mtu_sizes[0]) {
 775                 return (val);
 776         }
 777         for (i = 1; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 778                 if (val <= sctp_mtu_sizes[i]) {
 779                         break;
 780                 }
 781         }
 782         return (sctp_mtu_sizes[i - 1]);
 783 }
 784
 785 /*
 786  * Return the smallest MTU larger than val. If there is no
 787  * entry, just return val.
 788  */
 789 uint32_t
 790 sctp_get_next_mtu(uint32_t val)
 791 {
 792         /* select another MTU that is just bigger than this one */
 793         uint32_t i;
 794
 795         for (i = 0; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 796                 if (val < sctp_mtu_sizes[i]) {
 797                         return (sctp_mtu_sizes[i]);
 798                 }
 799         }
 800         return (val);
 801 }
 802
 803 void
 804 sctp_fill_random_store(struct sctp_pcb *m)
 805 {
 806         /*
 807          * Here we use the MD5/SHA-1 to hash with our good randomNumbers and
 808          * our counter. The result becomes our good random numbers and we
 809          * then setup to give these out. Note that we do no locking to
 810          * protect this. This is ok, since if competing folks call this we
 811          * will get more gobbled gook in the random store which is what we
 812          * want. There is a danger that two guys will use the same random
 813          * numbers, but thats ok too since that is random as well :->
 814          */
 815         m->store_at = 0;
 816         (void)sctp_hmac(SCTP_HMAC, (uint8_t *) m->random_numbers,
 817             sizeof(m->random_numbers), (uint8_t *) & m->random_counter,
 818             sizeof(m->random_counter), (uint8_t *) m->random_store);
 819         m->random_counter++;
 820 }
 821
 822 uint32_t
 823 sctp_select_initial_TSN(struct sctp_pcb *inp)
 824 {
 825         /*
 826          * A true implementation should use random selection process to get
 827          * the initial stream sequence number, using RFC1750 as a good
 828          * guideline
 829          */
 830         uint32_t x, *xp;
 831         uint8_t *p;
 832         int store_at, new_store;
 833
 834         if (inp->initial_sequence_debug != 0) {
 835                 uint32_t ret;
 836
 837                 ret = inp->initial_sequence_debug;
 838                 inp->initial_sequence_debug++;
 839                 return (ret);
 840         }
 841 retry:
 842         store_at = inp->store_at;
 843         new_store = store_at + sizeof(uint32_t);
 844         if (new_store >= (SCTP_SIGNATURE_SIZE - 3)) {
 845                 new_store = 0;
 846         }
 847         if (!atomic_cmpset_int(&inp->store_at, store_at, new_store)) {
 848                 goto retry;
 849         }
 850         if (new_store == 0) {
 851                 /* Refill the random store */
 852                 sctp_fill_random_store(inp);
 853         }
 854         p = &inp->random_store[store_at];
 855         xp = (uint32_t *) p;
 856         x = *xp;
 857         return (x);
 858 }
 859
 860 uint32_t
 861 sctp_select_a_tag(struct sctp_inpcb *inp, uint16_t lport, uint16_t rport, int check)
 862 {
 863         uint32_t x;
 864         struct timeval now;
 865
 866         if (check) {
 867                 (void)SCTP_GETTIME_TIMEVAL(&now);
 868         }
 869         for (;;) {
 870                 x = sctp_select_initial_TSN(&inp->sctp_ep);
 871                 if (x == 0) {
 872                         /* we never use 0 */
 873                         continue;
 874                 }
 875                 if (!check || sctp_is_vtag_good(x, lport, rport, &now)) {
 876                         break;
 877                 }
 878         }
 879         return (x);
 880 }
 881
 882 int
 883 sctp_init_asoc(struct sctp_inpcb *m, struct sctp_tcb *stcb,
 884     uint32_t override_tag, uint32_t vrf_id)
 885 {
 886         struct sctp_association *asoc;
 887
 888         /*
 889          * Anything set to zero is taken care of by the allocation routine's
 890          * bzero
 891          */
 892
 893         /*
 894          * Up front select what scoping to apply on addresses I tell my peer
 895          * Not sure what to do with these right now, we will need to come up
 896          * with a way to set them. We may need to pass them through from the
 897          * caller in the sctp_aloc_assoc() function.
 898          */
 899         int i;
 900
 901         asoc = &stcb->asoc;
 902         /* init all variables to a known value. */
 903         SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_INUSE);
 904         asoc->max_burst = m->sctp_ep.max_burst;
 905         asoc->fr_max_burst = m->sctp_ep.fr_max_burst;
 906         asoc->heart_beat_delay = TICKS_TO_MSEC(m->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]);
 907         asoc->cookie_life = m->sctp_ep.def_cookie_life;
 908         asoc->sctp_cmt_on_off = m->sctp_cmt_on_off;
 909         asoc->ecn_allowed = m->sctp_ecn_enable;
 910         asoc->sctp_nr_sack_on_off = (uint8_t) SCTP_BASE_SYSCTL(sctp_nr_sack_on_off);
 911         asoc->sctp_cmt_pf = (uint8_t) 0;
 912         asoc->sctp_frag_point = m->sctp_frag_point;
 913         asoc->sctp_features = m->sctp_features;
 914         asoc->default_dscp = m->sctp_ep.default_dscp;
 915 #ifdef INET6
 916         if (m->sctp_ep.default_flowlabel) {
 917                 asoc->default_flowlabel = m->sctp_ep.default_flowlabel;
 918         } else {
 919                 if (m->ip_inp.inp.inp_flags & IN6P_AUTOFLOWLABEL) {
 920                         asoc->default_flowlabel = sctp_select_initial_TSN(&m->sctp_ep);
 921                         asoc->default_flowlabel &= 0x000fffff;
 922                         asoc->default_flowlabel |= 0x80000000;
 923                 } else {
 924                         asoc->default_flowlabel = 0;
 925                 }
 926         }
 927 #endif
 928         asoc->sb_send_resv = 0;
 929         if (override_tag) {
 930                 asoc->my_vtag = override_tag;
 931         } else {
 932                 asoc->my_vtag = sctp_select_a_tag(m, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
 933         }
 934         /* Get the nonce tags */
 935         asoc->my_vtag_nonce = sctp_select_a_tag(m, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
 936         asoc->peer_vtag_nonce = sctp_select_a_tag(m, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
 937         asoc->vrf_id = vrf_id;
 938
 939 #ifdef SCTP_ASOCLOG_OF_TSNS
 940         asoc->tsn_in_at = 0;
 941         asoc->tsn_out_at = 0;
 942         asoc->tsn_in_wrapped = 0;
 943         asoc->tsn_out_wrapped = 0;
 944         asoc->cumack_log_at = 0;
 945         asoc->cumack_log_atsnt = 0;
 946 #endif
 947 #ifdef SCTP_FS_SPEC_LOG
 948         asoc->fs_index = 0;
 949 #endif
 950         asoc->refcnt = 0;
 951         asoc->assoc_up_sent = 0;
 952         asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number = asoc->sending_seq =
 953             sctp_select_initial_TSN(&m->sctp_ep);
 954         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
 955         /* we are optimisitic here */
 956         asoc->peer_supports_pktdrop = 1;
 957         asoc->peer_supports_nat = 0;
 958         asoc->sent_queue_retran_cnt = 0;
 959
 960         /* for CMT */
 961         asoc->last_net_cmt_send_started = NULL;
 962
 963         /* This will need to be adjusted */
 964         asoc->last_acked_seq = asoc->init_seq_number - 1;
 965         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
 966         asoc->asconf_seq_in = asoc->last_acked_seq;
 967
 968         /* here we are different, we hold the next one we expect */
 969         asoc->str_reset_seq_in = asoc->last_acked_seq + 1;
 970
 971         asoc->initial_init_rto_max = m->sctp_ep.initial_init_rto_max;
 972         asoc->initial_rto = m->sctp_ep.initial_rto;
 973
 974         asoc->max_init_times = m->sctp_ep.max_init_times;
 975         asoc->max_send_times = m->sctp_ep.max_send_times;
 976         asoc->def_net_failure = m->sctp_ep.def_net_failure;
 977         asoc->def_net_pf_threshold = m->sctp_ep.def_net_pf_threshold;
 978         asoc->free_chunk_cnt = 0;
 979
 980         asoc->iam_blocking = 0;
 981         asoc->context = m->sctp_context;
 982         asoc->local_strreset_support = m->local_strreset_support;
 983         asoc->def_send = m->def_send;
 984         asoc->delayed_ack = TICKS_TO_MSEC(m->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]);
 985         asoc->sack_freq = m->sctp_ep.sctp_sack_freq;
 986         asoc->pr_sctp_cnt = 0;
 987         asoc->total_output_queue_size = 0;
 988
 989         if (m->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
 990                 struct in6pcb *inp6;
 991
 992                 /* Its a V6 socket */
 993                 inp6 = (struct in6pcb *)m;
 994                 asoc->ipv6_addr_legal = 1;
 995                 /* Now look at the binding flag to see if V4 will be legal */
 996                 if (SCTP_IPV6_V6ONLY(inp6) == 0) {
 997                         asoc->ipv4_addr_legal = 1;
 998                 } else {
 999                         /* V4 addresses are NOT legal on the association */
1000                         asoc->ipv4_addr_legal = 0;
1001                 }
1002         } else {
1003                 /* Its a V4 socket, no - V6 */
1004                 asoc->ipv4_addr_legal = 1;
1005                 asoc->ipv6_addr_legal = 0;
1006         }
1007
1008         asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(m->sctp_socket), SCTP_MINIMAL_RWND);
1009         asoc->peers_rwnd = SCTP_SB_LIMIT_RCV(m->sctp_socket);
1010
1011         asoc->smallest_mtu = m->sctp_frag_point;
1012         asoc->minrto = m->sctp_ep.sctp_minrto;
1013         asoc->maxrto = m->sctp_ep.sctp_maxrto;
1014
1015         asoc->locked_on_sending = NULL;
1016         asoc->stream_locked_on = 0;
1017         asoc->ecn_echo_cnt_onq = 0;
1018         asoc->stream_locked = 0;
1019
1020         asoc->send_sack = 1;
1021
1022         LIST_INIT(&asoc->sctp_restricted_addrs);
1023
1024         TAILQ_INIT(&asoc->nets);
1025         TAILQ_INIT(&asoc->pending_reply_queue);
1026         TAILQ_INIT(&asoc->asconf_ack_sent);
1027         /* Setup to fill the hb random cache at first HB */
1028         asoc->hb_random_idx = 4;
1029
1030         asoc->sctp_autoclose_ticks = m->sctp_ep.auto_close_time;
1031
1032         stcb->asoc.congestion_control_module = m->sctp_ep.sctp_default_cc_module;
1033         stcb->asoc.cc_functions = sctp_cc_functions[m->sctp_ep.sctp_default_cc_module];
1034
1035         stcb->asoc.stream_scheduling_module = m->sctp_ep.sctp_default_ss_module;
1036         stcb->asoc.ss_functions = sctp_ss_functions[m->sctp_ep.sctp_default_ss_module];
1037
1038         /*
1039          * Now the stream parameters, here we allocate space for all streams
1040          * that we request by default.
1041          */
1042         asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams =
1043             m->sctp_ep.pre_open_stream_count;
1044         SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *,
1045             asoc->streamoutcnt * sizeof(struct sctp_stream_out),
1046             SCTP_M_STRMO);
1047         if (asoc->strmout == NULL) {
1048                 /* big trouble no memory */
1049                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1050                 return (ENOMEM);
1051         }
1052         for (i = 0; i < asoc->streamoutcnt; i++) {
1053                 /*
1054                  * inbound side must be set to 0xffff, also NOTE when we get
1055                  * the INIT-ACK back (for INIT sender) we MUST reduce the
1056                  * count (streamoutcnt) but first check if we sent to any of
1057                  * the upper streams that were dropped (if some were). Those
1058                  * that were dropped must be notified to the upper layer as
1059                  * failed to send.
1060                  */
1061                 asoc->strmout[i].next_sequence_sent = 0x0;
1062                 TAILQ_INIT(&asoc->strmout[i].outqueue);
1063                 asoc->strmout[i].stream_no = i;
1064                 asoc->strmout[i].last_msg_incomplete = 0;
1065                 asoc->ss_functions.sctp_ss_init_stream(&asoc->strmout[i], NULL);
1066         }
1067         asoc->ss_functions.sctp_ss_init(stcb, asoc, 0);
1068
1069         /* Now the mapping array */
1070         asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY;
1071         SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size,
1072             SCTP_M_MAP);
1073         if (asoc->mapping_array == NULL) {
1074                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1075                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1076                 return (ENOMEM);
1077         }
1078         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
1079         SCTP_MALLOC(asoc->nr_mapping_array, uint8_t *, asoc->mapping_array_size,
1080             SCTP_M_MAP);
1081         if (asoc->nr_mapping_array == NULL) {
1082                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1083                 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1084                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1085                 return (ENOMEM);
1086         }
1087         memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
1088
1089         /* Now the init of the other outqueues */
1090         TAILQ_INIT(&asoc->free_chunks);
1091         TAILQ_INIT(&asoc->control_send_queue);
1092         TAILQ_INIT(&asoc->asconf_send_queue);
1093         TAILQ_INIT(&asoc->send_queue);
1094         TAILQ_INIT(&asoc->sent_queue);
1095         TAILQ_INIT(&asoc->reasmqueue);
1096         TAILQ_INIT(&asoc->resetHead);
1097         asoc->max_inbound_streams = m->sctp_ep.max_open_streams_intome;
1098         TAILQ_INIT(&asoc->asconf_queue);
1099         /* authentication fields */
1100         asoc->authinfo.random = NULL;
1101         asoc->authinfo.active_keyid = 0;
1102         asoc->authinfo.assoc_key = NULL;
1103         asoc->authinfo.assoc_keyid = 0;
1104         asoc->authinfo.recv_key = NULL;
1105         asoc->authinfo.recv_keyid = 0;
1106         LIST_INIT(&asoc->shared_keys);
1107         asoc->marked_retrans = 0;
1108         asoc->port = m->sctp_ep.port;
1109         asoc->timoinit = 0;
1110         asoc->timodata = 0;
1111         asoc->timosack = 0;
1112         asoc->timoshutdown = 0;
1113         asoc->timoheartbeat = 0;
1114         asoc->timocookie = 0;
1115         asoc->timoshutdownack = 0;
1116         (void)SCTP_GETTIME_TIMEVAL(&asoc->start_time);
1117         asoc->discontinuity_time = asoc->start_time;
1118         /*
1119          * sa_ignore MEMLEAK {memory is put in the assoc mapping array and
1120          * freed later when the association is freed.
1121          */
1122         return (0);
1123 }
1124
1125 void
1126 sctp_print_mapping_array(struct sctp_association *asoc)
1127 {
1128         unsigned int i, limit;
1129
1130         SCTP_PRINTF("Mapping array size: %d, baseTSN: %8.8x, cumAck: %8.8x, highestTSN: (%8.8x, %8.8x).\n",
1131             asoc->mapping_array_size,
1132             asoc->mapping_array_base_tsn,
1133             asoc->cumulative_tsn,
1134             asoc->highest_tsn_inside_map,
1135             asoc->highest_tsn_inside_nr_map);
1136         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1137                 if (asoc->mapping_array[limit - 1] != 0) {
1138                         break;
1139                 }
1140         }
1141         SCTP_PRINTF("Renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1142         for (i = 0; i < limit; i++) {
1143                 SCTP_PRINTF("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1144         }
1145         if (limit % 16)
1146                 SCTP_PRINTF("\n");
1147         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1148                 if (asoc->nr_mapping_array[limit - 1]) {
1149                         break;
1150                 }
1151         }
1152         SCTP_PRINTF("Non renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1153         for (i = 0; i < limit; i++) {
1154                 SCTP_PRINTF("%2.2x%c", asoc->nr_mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1155         }
1156         if (limit % 16)
1157                 SCTP_PRINTF("\n");
1158 }
1159
1160 int
1161 sctp_expand_mapping_array(struct sctp_association *asoc, uint32_t needed)
1162 {
1163         /* mapping array needs to grow */
1164         uint8_t *new_array1, *new_array2;
1165         uint32_t new_size;
1166
1167         new_size = asoc->mapping_array_size + ((needed + 7) / 8 + SCTP_MAPPING_ARRAY_INCR);
1168         SCTP_MALLOC(new_array1, uint8_t *, new_size, SCTP_M_MAP);
1169         SCTP_MALLOC(new_array2, uint8_t *, new_size, SCTP_M_MAP);
1170         if ((new_array1 == NULL) || (new_array2 == NULL)) {
1171                 /* can't get more, forget it */
1172                 SCTP_PRINTF("No memory for expansion of SCTP mapping array %d\n", new_size);
1173                 if (new_array1) {
1174                         SCTP_FREE(new_array1, SCTP_M_MAP);
1175                 }
1176                 if (new_array2) {
1177                         SCTP_FREE(new_array2, SCTP_M_MAP);
1178                 }
1179                 return (-1);
1180         }
1181         memset(new_array1, 0, new_size);
1182         memset(new_array2, 0, new_size);
1183         memcpy(new_array1, asoc->mapping_array, asoc->mapping_array_size);
1184         memcpy(new_array2, asoc->nr_mapping_array, asoc->mapping_array_size);
1185         SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1186         SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
1187         asoc->mapping_array = new_array1;
1188         asoc->nr_mapping_array = new_array2;
1189         asoc->mapping_array_size = new_size;
1190         return (0);
1191 }
1192
1193
1194 static void
1195 sctp_iterator_work(struct sctp_iterator *it)
1196 {
1197         int iteration_count = 0;
1198         int inp_skip = 0;
1199         int first_in = 1;
1200         struct sctp_inpcb *tinp;
1201
1202         SCTP_INP_INFO_RLOCK();
1203         SCTP_ITERATOR_LOCK();
1204         if (it->inp) {
1205                 SCTP_INP_RLOCK(it->inp);
1206                 SCTP_INP_DECR_REF(it->inp);
1207         }
1208         if (it->inp == NULL) {
1209                 /* iterator is complete */
1210 done_with_iterator:
1211                 SCTP_ITERATOR_UNLOCK();
1212                 SCTP_INP_INFO_RUNLOCK();
1213                 if (it->function_atend != NULL) {
1214                         (*it->function_atend) (it->pointer, it->val);
1215                 }
1216                 SCTP_FREE(it, SCTP_M_ITER);
1217                 return;
1218         }
1219 select_a_new_ep:
1220         if (first_in) {
1221                 first_in = 0;
1222         } else {
1223                 SCTP_INP_RLOCK(it->inp);
1224         }
1225         while (((it->pcb_flags) &&
1226             ((it->inp->sctp_flags & it->pcb_flags) != it->pcb_flags)) ||
1227             ((it->pcb_features) &&
1228             ((it->inp->sctp_features & it->pcb_features) != it->pcb_features))) {
1229                 /* endpoint flags or features don't match, so keep looking */
1230                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1231                         SCTP_INP_RUNLOCK(it->inp);
1232                         goto done_with_iterator;
1233                 }
1234                 tinp = it->inp;
1235                 it->inp = LIST_NEXT(it->inp, sctp_list);
1236                 SCTP_INP_RUNLOCK(tinp);
1237                 if (it->inp == NULL) {
1238                         goto done_with_iterator;
1239                 }
1240                 SCTP_INP_RLOCK(it->inp);
1241         }
1242         /* now go through each assoc which is in the desired state */
1243         if (it->done_current_ep == 0) {
1244                 if (it->function_inp != NULL)
1245                         inp_skip = (*it->function_inp) (it->inp, it->pointer, it->val);
1246                 it->done_current_ep = 1;
1247         }
1248         if (it->stcb == NULL) {
1249                 /* run the per instance function */
1250                 it->stcb = LIST_FIRST(&it->inp->sctp_asoc_list);
1251         }
1252         if ((inp_skip) || it->stcb == NULL) {
1253                 if (it->function_inp_end != NULL) {
1254                         inp_skip = (*it->function_inp_end) (it->inp,
1255                             it->pointer,
1256                             it->val);
1257                 }
1258                 SCTP_INP_RUNLOCK(it->inp);
1259                 goto no_stcb;
1260         }
1261         while (it->stcb) {
1262                 SCTP_TCB_LOCK(it->stcb);
1263                 if (it->asoc_state && ((it->stcb->asoc.state & it->asoc_state) != it->asoc_state)) {
1264                         /* not in the right state... keep looking */
1265                         SCTP_TCB_UNLOCK(it->stcb);
1266                         goto next_assoc;
1267                 }
1268                 /* see if we have limited out the iterator loop */
1269                 iteration_count++;
1270                 if (iteration_count > SCTP_ITERATOR_MAX_AT_ONCE) {
1271                         /* Pause to let others grab the lock */
1272                         atomic_add_int(&it->stcb->asoc.refcnt, 1);
1273                         SCTP_TCB_UNLOCK(it->stcb);
1274                         SCTP_INP_INCR_REF(it->inp);
1275                         SCTP_INP_RUNLOCK(it->inp);
1276                         SCTP_ITERATOR_UNLOCK();
1277                         SCTP_INP_INFO_RUNLOCK();
1278                         SCTP_INP_INFO_RLOCK();
1279                         SCTP_ITERATOR_LOCK();
1280                         if (sctp_it_ctl.iterator_flags) {
1281                                 /* We won't be staying here */
1282                                 SCTP_INP_DECR_REF(it->inp);
1283                                 atomic_add_int(&it->stcb->asoc.refcnt, -1);
1284                                 if (sctp_it_ctl.iterator_flags &
1285                                     SCTP_ITERATOR_STOP_CUR_IT) {
1286                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_IT;
1287                                         goto done_with_iterator;
1288                                 }
1289                                 if (sctp_it_ctl.iterator_flags &
1290                                     SCTP_ITERATOR_STOP_CUR_INP) {
1291                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_INP;
1292                                         goto no_stcb;
1293                                 }
1294                                 /* If we reach here huh? */
1295                                 SCTP_PRINTF("Unknown it ctl flag %x\n",
1296                                     sctp_it_ctl.iterator_flags);
1297                                 sctp_it_ctl.iterator_flags = 0;
1298                         }
1299                         SCTP_INP_RLOCK(it->inp);
1300                         SCTP_INP_DECR_REF(it->inp);
1301                         SCTP_TCB_LOCK(it->stcb);
1302                         atomic_add_int(&it->stcb->asoc.refcnt, -1);
1303                         iteration_count = 0;
1304                 }
1305                 /* run function on this one */
1306                 (*it->function_assoc) (it->inp, it->stcb, it->pointer, it->val);
1307
1308                 /*
1309                  * we lie here, it really needs to have its own type but
1310                  * first I must verify that this won't effect things :-0
1311                  */
1312                 if (it->no_chunk_output == 0)
1313                         sctp_chunk_output(it->inp, it->stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1314
1315                 SCTP_TCB_UNLOCK(it->stcb);
1316 next_assoc:
1317                 it->stcb = LIST_NEXT(it->stcb, sctp_tcblist);
1318                 if (it->stcb == NULL) {
1319                         /* Run last function */
1320                         if (it->function_inp_end != NULL) {
1321                                 inp_skip = (*it->function_inp_end) (it->inp,
1322                                     it->pointer,
1323                                     it->val);
1324                         }
1325                 }
1326         }
1327         SCTP_INP_RUNLOCK(it->inp);
1328 no_stcb:
1329         /* done with all assocs on this endpoint, move on to next endpoint */
1330         it->done_current_ep = 0;
1331         if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1332                 it->inp = NULL;
1333         } else {
1334                 it->inp = LIST_NEXT(it->inp, sctp_list);
1335         }
1336         if (it->inp == NULL) {
1337                 goto done_with_iterator;
1338         }
1339         goto select_a_new_ep;
1340 }
1341
1342 void
1343 sctp_iterator_worker(void)
1344 {
1345         struct sctp_iterator *it, *nit;
1346
1347         /* This function is called with the WQ lock in place */
1348
1349         sctp_it_ctl.iterator_running = 1;
1350         TAILQ_FOREACH_SAFE(it, &sctp_it_ctl.iteratorhead, sctp_nxt_itr, nit) {
1351                 sctp_it_ctl.cur_it = it;
1352                 /* now lets work on this one */
1353                 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
1354                 SCTP_IPI_ITERATOR_WQ_UNLOCK();
1355                 CURVNET_SET(it->vn);
1356                 sctp_iterator_work(it);
1357                 sctp_it_ctl.cur_it = NULL;
1358                 CURVNET_RESTORE();
1359                 SCTP_IPI_ITERATOR_WQ_LOCK();
1360                 /* sa_ignore FREED_MEMORY */
1361         }
1362         sctp_it_ctl.iterator_running = 0;
1363         return;
1364 }
1365
1366
1367 static void
1368 sctp_handle_addr_wq(void)
1369 {
1370         /* deal with the ADDR wq from the rtsock calls */
1371         struct sctp_laddr *wi, *nwi;
1372         struct sctp_asconf_iterator *asc;
1373
1374         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
1375             sizeof(struct sctp_asconf_iterator), SCTP_M_ASC_IT);
1376         if (asc == NULL) {
1377                 /* Try later, no memory */
1378                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
1379                     (struct sctp_inpcb *)NULL,
1380                     (struct sctp_tcb *)NULL,
1381                     (struct sctp_nets *)NULL);
1382                 return;
1383         }
1384         LIST_INIT(&asc->list_of_work);
1385         asc->cnt = 0;
1386
1387         SCTP_WQ_ADDR_LOCK();
1388         LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) {
1389                 LIST_REMOVE(wi, sctp_nxt_addr);
1390                 LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
1391                 asc->cnt++;
1392         }
1393         SCTP_WQ_ADDR_UNLOCK();
1394
1395         if (asc->cnt == 0) {
1396                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1397         } else {
1398                 (void)sctp_initiate_iterator(sctp_asconf_iterator_ep,
1399                     sctp_asconf_iterator_stcb,
1400                     NULL,       /* No ep end for boundall */
1401                     SCTP_PCB_FLAGS_BOUNDALL,
1402                     SCTP_PCB_ANY_FEATURES,
1403                     SCTP_ASOC_ANY_STATE,
1404                     (void *)asc, 0,
1405                     sctp_asconf_iterator_end, NULL, 0);
1406         }
1407 }
1408
1409 void
1410 sctp_timeout_handler(void *t)
1411 {
1412         struct sctp_inpcb *inp;
1413         struct sctp_tcb *stcb;
1414         struct sctp_nets *net;
1415         struct sctp_timer *tmr;
1416
1417 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1418         struct socket *so;
1419
1420 #endif
1421         int did_output, type;
1422
1423         tmr = (struct sctp_timer *)t;
1424         inp = (struct sctp_inpcb *)tmr->ep;
1425         stcb = (struct sctp_tcb *)tmr->tcb;
1426         net = (struct sctp_nets *)tmr->net;
1427         CURVNET_SET((struct vnet *)tmr->vnet);
1428         did_output = 1;
1429
1430 #ifdef SCTP_AUDITING_ENABLED
1431         sctp_audit_log(0xF0, (uint8_t) tmr->type);
1432         sctp_auditing(3, inp, stcb, net);
1433 #endif
1434
1435         /* sanity checks... */
1436         if (tmr->self != (void *)tmr) {
1437                 /*
1438                  * SCTP_PRINTF("Stale SCTP timer fired (%p), ignoring...\n",
1439                  * tmr);
1440                  */
1441                 CURVNET_RESTORE();
1442                 return;
1443         }
1444         tmr->stopped_from = 0xa001;
1445         if (!SCTP_IS_TIMER_TYPE_VALID(tmr->type)) {
1446                 /*
1447                  * SCTP_PRINTF("SCTP timer fired with invalid type: 0x%x\n",
1448                  * tmr->type);
1449                  */
1450                 CURVNET_RESTORE();
1451                 return;
1452         }
1453         tmr->stopped_from = 0xa002;
1454         if ((tmr->type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL)) {
1455                 CURVNET_RESTORE();
1456                 return;
1457         }
1458         /* if this is an iterator timeout, get the struct and clear inp */
1459         tmr->stopped_from = 0xa003;
1460         type = tmr->type;
1461         if (inp) {
1462                 SCTP_INP_INCR_REF(inp);
1463                 if ((inp->sctp_socket == NULL) &&
1464                     ((tmr->type != SCTP_TIMER_TYPE_INPKILL) &&
1465                     (tmr->type != SCTP_TIMER_TYPE_INIT) &&
1466                     (tmr->type != SCTP_TIMER_TYPE_SEND) &&
1467                     (tmr->type != SCTP_TIMER_TYPE_RECV) &&
1468                     (tmr->type != SCTP_TIMER_TYPE_HEARTBEAT) &&
1469                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWN) &&
1470                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNACK) &&
1471                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNGUARD) &&
1472                     (tmr->type != SCTP_TIMER_TYPE_ASOCKILL))
1473                     ) {
1474                         SCTP_INP_DECR_REF(inp);
1475                         CURVNET_RESTORE();
1476                         return;
1477                 }
1478         }
1479         tmr->stopped_from = 0xa004;
1480         if (stcb) {
1481                 atomic_add_int(&stcb->asoc.refcnt, 1);
1482                 if (stcb->asoc.state == 0) {
1483                         atomic_add_int(&stcb->asoc.refcnt, -1);
1484                         if (inp) {
1485                                 SCTP_INP_DECR_REF(inp);
1486                         }
1487                         CURVNET_RESTORE();
1488                         return;
1489                 }
1490         }
1491         tmr->stopped_from = 0xa005;
1492         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer type %d goes off\n", tmr->type);
1493         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1494                 if (inp) {
1495                         SCTP_INP_DECR_REF(inp);
1496                 }
1497                 if (stcb) {
1498                         atomic_add_int(&stcb->asoc.refcnt, -1);
1499                 }
1500                 CURVNET_RESTORE();
1501                 return;
1502         }
1503         tmr->stopped_from = 0xa006;
1504
1505         if (stcb) {
1506                 SCTP_TCB_LOCK(stcb);
1507                 atomic_add_int(&stcb->asoc.refcnt, -1);
1508                 if ((tmr->type != SCTP_TIMER_TYPE_ASOCKILL) &&
1509                     ((stcb->asoc.state == 0) ||
1510                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED))) {
1511                         SCTP_TCB_UNLOCK(stcb);
1512                         if (inp) {
1513                                 SCTP_INP_DECR_REF(inp);
1514                         }
1515                         CURVNET_RESTORE();
1516                         return;
1517                 }
1518         }
1519         /* record in stopped what t-o occured */
1520         tmr->stopped_from = tmr->type;
1521
1522         /* mark as being serviced now */
1523         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
1524                 /*
1525                  * Callout has been rescheduled.
1526                  */
1527                 goto get_out;
1528         }
1529         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1530                 /*
1531                  * Not active, so no action.
1532                  */
1533                 goto get_out;
1534         }
1535         SCTP_OS_TIMER_DEACTIVATE(&tmr->timer);
1536
1537         /* call the handler for the appropriate timer type */
1538         switch (tmr->type) {
1539         case SCTP_TIMER_TYPE_ZERO_COPY:
1540                 if (inp == NULL) {
1541                         break;
1542                 }
1543                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
1544                         SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket);
1545                 }
1546                 break;
1547         case SCTP_TIMER_TYPE_ZCOPY_SENDQ:
1548                 if (inp == NULL) {
1549                         break;
1550                 }
1551                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
1552                         SCTP_ZERO_COPY_SENDQ_EVENT(inp, inp->sctp_socket);
1553                 }
1554                 break;
1555         case SCTP_TIMER_TYPE_ADDR_WQ:
1556                 sctp_handle_addr_wq();
1557                 break;
1558         case SCTP_TIMER_TYPE_SEND:
1559                 if ((stcb == NULL) || (inp == NULL)) {
1560                         break;
1561                 }
1562                 SCTP_STAT_INCR(sctps_timodata);
1563                 stcb->asoc.timodata++;
1564                 stcb->asoc.num_send_timers_up--;
1565                 if (stcb->asoc.num_send_timers_up < 0) {
1566                         stcb->asoc.num_send_timers_up = 0;
1567                 }
1568                 SCTP_TCB_LOCK_ASSERT(stcb);
1569                 if (sctp_t3rxt_timer(inp, stcb, net)) {
1570                         /* no need to unlock on tcb its gone */
1571
1572                         goto out_decr;
1573                 }
1574                 SCTP_TCB_LOCK_ASSERT(stcb);
1575 #ifdef SCTP_AUDITING_ENABLED
1576                 sctp_auditing(4, inp, stcb, net);
1577 #endif
1578                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1579                 if ((stcb->asoc.num_send_timers_up == 0) &&
1580                     (stcb->asoc.sent_queue_cnt > 0)) {
1581                         struct sctp_tmit_chunk *chk;
1582
1583                         /*
1584                          * safeguard. If there on some on the sent queue
1585                          * somewhere but no timers running something is
1586                          * wrong... so we start a timer on the first chunk
1587                          * on the send queue on whatever net it is sent to.
1588                          */
1589                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1590                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb,
1591                             chk->whoTo);
1592                 }
1593                 break;
1594         case SCTP_TIMER_TYPE_INIT:
1595                 if ((stcb == NULL) || (inp == NULL)) {
1596                         break;
1597                 }
1598                 SCTP_STAT_INCR(sctps_timoinit);
1599                 stcb->asoc.timoinit++;
1600                 if (sctp_t1init_timer(inp, stcb, net)) {
1601                         /* no need to unlock on tcb its gone */
1602                         goto out_decr;
1603                 }
1604                 /* We do output but not here */
1605                 did_output = 0;
1606                 break;
1607         case SCTP_TIMER_TYPE_RECV:
1608                 if ((stcb == NULL) || (inp == NULL)) {
1609                         break;
1610                 }
1611                 SCTP_STAT_INCR(sctps_timosack);
1612                 stcb->asoc.timosack++;
1613                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
1614 #ifdef SCTP_AUDITING_ENABLED
1615                 sctp_auditing(4, inp, stcb, net);
1616 #endif
1617                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR, SCTP_SO_NOT_LOCKED);
1618                 break;
1619         case SCTP_TIMER_TYPE_SHUTDOWN:
1620                 if ((stcb == NULL) || (inp == NULL)) {
1621                         break;
1622                 }
1623                 if (sctp_shutdown_timer(inp, stcb, net)) {
1624                         /* no need to unlock on tcb its gone */
1625                         goto out_decr;
1626                 }
1627                 SCTP_STAT_INCR(sctps_timoshutdown);
1628                 stcb->asoc.timoshutdown++;
1629 #ifdef SCTP_AUDITING_ENABLED
1630                 sctp_auditing(4, inp, stcb, net);
1631 #endif
1632                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_NOT_LOCKED);
1633                 break;
1634         case SCTP_TIMER_TYPE_HEARTBEAT:
1635                 if ((stcb == NULL) || (inp == NULL) || (net == NULL)) {
1636                         break;
1637                 }
1638                 SCTP_STAT_INCR(sctps_timoheartbeat);
1639                 stcb->asoc.timoheartbeat++;
1640                 if (sctp_heartbeat_timer(inp, stcb, net)) {
1641                         /* no need to unlock on tcb its gone */
1642                         goto out_decr;
1643                 }
1644 #ifdef SCTP_AUDITING_ENABLED
1645                 sctp_auditing(4, inp, stcb, net);
1646 #endif
1647                 if (!(net->dest_state & SCTP_ADDR_NOHB)) {
1648                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net);
1649                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR, SCTP_SO_NOT_LOCKED);
1650                 }
1651                 break;
1652         case SCTP_TIMER_TYPE_COOKIE:
1653                 if ((stcb == NULL) || (inp == NULL)) {
1654                         break;
1655                 }
1656                 if (sctp_cookie_timer(inp, stcb, net)) {
1657                         /* no need to unlock on tcb its gone */
1658                         goto out_decr;
1659                 }
1660                 SCTP_STAT_INCR(sctps_timocookie);
1661                 stcb->asoc.timocookie++;
1662 #ifdef SCTP_AUDITING_ENABLED
1663                 sctp_auditing(4, inp, stcb, net);
1664 #endif
1665                 /*
1666                  * We consider T3 and Cookie timer pretty much the same with
1667                  * respect to where from in chunk_output.
1668                  */
1669                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1670                 break;
1671         case SCTP_TIMER_TYPE_NEWCOOKIE:
1672                 {
1673                         struct timeval tv;
1674                         int i, secret;
1675
1676                         if (inp == NULL) {
1677                                 break;
1678                         }
1679                         SCTP_STAT_INCR(sctps_timosecret);
1680                         (void)SCTP_GETTIME_TIMEVAL(&tv);
1681                         SCTP_INP_WLOCK(inp);
1682                         inp->sctp_ep.time_of_secret_change = tv.tv_sec;
1683                         inp->sctp_ep.last_secret_number =
1684                             inp->sctp_ep.current_secret_number;
1685                         inp->sctp_ep.current_secret_number++;
1686                         if (inp->sctp_ep.current_secret_number >=
1687                             SCTP_HOW_MANY_SECRETS) {
1688                                 inp->sctp_ep.current_secret_number = 0;
1689                         }
1690                         secret = (int)inp->sctp_ep.current_secret_number;
1691                         for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1692                                 inp->sctp_ep.secret_key[secret][i] =
1693                                     sctp_select_initial_TSN(&inp->sctp_ep);
1694                         }
1695                         SCTP_INP_WUNLOCK(inp);
1696                         sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, stcb, net);
1697                 }
1698                 did_output = 0;
1699                 break;
1700         case SCTP_TIMER_TYPE_PATHMTURAISE:
1701                 if ((stcb == NULL) || (inp == NULL)) {
1702                         break;
1703                 }
1704                 SCTP_STAT_INCR(sctps_timopathmtu);
1705                 sctp_pathmtu_timer(inp, stcb, net);
1706                 did_output = 0;
1707                 break;
1708         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1709                 if ((stcb == NULL) || (inp == NULL)) {
1710                         break;
1711                 }
1712                 if (sctp_shutdownack_timer(inp, stcb, net)) {
1713                         /* no need to unlock on tcb its gone */
1714                         goto out_decr;
1715                 }
1716                 SCTP_STAT_INCR(sctps_timoshutdownack);
1717                 stcb->asoc.timoshutdownack++;
1718 #ifdef SCTP_AUDITING_ENABLED
1719                 sctp_auditing(4, inp, stcb, net);
1720 #endif
1721                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR, SCTP_SO_NOT_LOCKED);
1722                 break;
1723         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1724                 if ((stcb == NULL) || (inp == NULL)) {
1725                         break;
1726                 }
1727                 SCTP_STAT_INCR(sctps_timoshutdownguard);
1728                 sctp_abort_an_association(inp, stcb, NULL, SCTP_SO_NOT_LOCKED);
1729                 /* no need to unlock on tcb its gone */
1730                 goto out_decr;
1731
1732         case SCTP_TIMER_TYPE_STRRESET:
1733                 if ((stcb == NULL) || (inp == NULL)) {
1734                         break;
1735                 }
1736                 if (sctp_strreset_timer(inp, stcb, net)) {
1737                         /* no need to unlock on tcb its gone */
1738                         goto out_decr;
1739                 }
1740                 SCTP_STAT_INCR(sctps_timostrmrst);
1741                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR, SCTP_SO_NOT_LOCKED);
1742                 break;
1743         case SCTP_TIMER_TYPE_ASCONF:
1744                 if ((stcb == NULL) || (inp == NULL)) {
1745                         break;
1746                 }
1747                 if (sctp_asconf_timer(inp, stcb, net)) {
1748                         /* no need to unlock on tcb its gone */
1749                         goto out_decr;
1750                 }
1751                 SCTP_STAT_INCR(sctps_timoasconf);
1752 #ifdef SCTP_AUDITING_ENABLED
1753                 sctp_auditing(4, inp, stcb, net);
1754 #endif
1755                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR, SCTP_SO_NOT_LOCKED);
1756                 break;
1757         case SCTP_TIMER_TYPE_PRIM_DELETED:
1758                 if ((stcb == NULL) || (inp == NULL)) {
1759                         break;
1760                 }
1761                 sctp_delete_prim_timer(inp, stcb, net);
1762                 SCTP_STAT_INCR(sctps_timodelprim);
1763                 break;
1764
1765         case SCTP_TIMER_TYPE_AUTOCLOSE:
1766                 if ((stcb == NULL) || (inp == NULL)) {
1767                         break;
1768                 }
1769                 SCTP_STAT_INCR(sctps_timoautoclose);
1770                 sctp_autoclose_timer(inp, stcb, net);
1771                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED);
1772                 did_output = 0;
1773                 break;
1774         case SCTP_TIMER_TYPE_ASOCKILL:
1775                 if ((stcb == NULL) || (inp == NULL)) {
1776                         break;
1777                 }
1778                 SCTP_STAT_INCR(sctps_timoassockill);
1779                 /* Can we free it yet? */
1780                 SCTP_INP_DECR_REF(inp);
1781                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_1);
1782 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1783                 so = SCTP_INP_SO(inp);
1784                 atomic_add_int(&stcb->asoc.refcnt, 1);
1785                 SCTP_TCB_UNLOCK(stcb);
1786                 SCTP_SOCKET_LOCK(so, 1);
1787                 SCTP_TCB_LOCK(stcb);
1788                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1789 #endif
1790                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_2);
1791 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1792                 SCTP_SOCKET_UNLOCK(so, 1);
1793 #endif
1794                 /*
1795                  * free asoc, always unlocks (or destroy's) so prevent
1796                  * duplicate unlock or unlock of a free mtx :-0
1797                  */
1798                 stcb = NULL;
1799                 goto out_no_decr;
1800         case SCTP_TIMER_TYPE_INPKILL:
1801                 SCTP_STAT_INCR(sctps_timoinpkill);
1802                 if (inp == NULL) {
1803                         break;
1804                 }
1805                 /*
1806                  * special case, take away our increment since WE are the
1807                  * killer
1808                  */
1809                 SCTP_INP_DECR_REF(inp);
1810                 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_3);
1811                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
1812                     SCTP_CALLED_FROM_INPKILL_TIMER);
1813                 inp = NULL;
1814                 goto out_no_decr;
1815         default:
1816                 SCTPDBG(SCTP_DEBUG_TIMER1, "sctp_timeout_handler:unknown timer %d\n",
1817                     tmr->type);
1818                 break;
1819         }
1820 #ifdef SCTP_AUDITING_ENABLED
1821         sctp_audit_log(0xF1, (uint8_t) tmr->type);
1822         if (inp)
1823                 sctp_auditing(5, inp, stcb, net);
1824 #endif
1825         if ((did_output) && stcb) {
1826                 /*
1827                  * Now we need to clean up the control chunk chain if an
1828                  * ECNE is on it. It must be marked as UNSENT again so next
1829                  * call will continue to send it until such time that we get
1830                  * a CWR, to remove it. It is, however, less likely that we
1831                  * will find a ecn echo on the chain though.
1832                  */
1833                 sctp_fix_ecn_echo(&stcb->asoc);
1834         }
1835 get_out:
1836         if (stcb) {
1837                 SCTP_TCB_UNLOCK(stcb);
1838         }
1839 out_decr:
1840         if (inp) {
1841                 SCTP_INP_DECR_REF(inp);
1842         }
1843 out_no_decr:
1844         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer now complete (type %d)\n",
1845             type);
1846         CURVNET_RESTORE();
1847 }
1848
1849 void
1850 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1851     struct sctp_nets *net)
1852 {
1853         uint32_t to_ticks;
1854         struct sctp_timer *tmr;
1855
1856         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL))
1857                 return;
1858
1859         tmr = NULL;
1860         if (stcb) {
1861                 SCTP_TCB_LOCK_ASSERT(stcb);
1862         }
1863         switch (t_type) {
1864         case SCTP_TIMER_TYPE_ZERO_COPY:
1865                 tmr = &inp->sctp_ep.zero_copy_timer;
1866                 to_ticks = SCTP_ZERO_COPY_TICK_DELAY;
1867                 break;
1868         case SCTP_TIMER_TYPE_ZCOPY_SENDQ:
1869                 tmr = &inp->sctp_ep.zero_copy_sendq_timer;
1870                 to_ticks = SCTP_ZERO_COPY_SENDQ_TICK_DELAY;
1871                 break;
1872         case SCTP_TIMER_TYPE_ADDR_WQ:
1873                 /* Only 1 tick away :-) */
1874                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
1875                 to_ticks = SCTP_ADDRESS_TICK_DELAY;
1876                 break;
1877         case SCTP_TIMER_TYPE_SEND:
1878                 /* Here we use the RTO timer */
1879                 {
1880                         int rto_val;
1881
1882                         if ((stcb == NULL) || (net == NULL)) {
1883                                 return;
1884                         }
1885                         tmr = &net->rxt_timer;
1886                         if (net->RTO == 0) {
1887                                 rto_val = stcb->asoc.initial_rto;
1888                         } else {
1889                                 rto_val = net->RTO;
1890                         }
1891                         to_ticks = MSEC_TO_TICKS(rto_val);
1892                 }
1893                 break;
1894         case SCTP_TIMER_TYPE_INIT:
1895                 /*
1896                  * Here we use the INIT timer default usually about 1
1897                  * minute.
1898                  */
1899                 if ((stcb == NULL) || (net == NULL)) {
1900                         return;
1901                 }
1902                 tmr = &net->rxt_timer;
1903                 if (net->RTO == 0) {
1904                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1905                 } else {
1906                         to_ticks = MSEC_TO_TICKS(net->RTO);
1907                 }
1908                 break;
1909         case SCTP_TIMER_TYPE_RECV:
1910                 /*
1911                  * Here we use the Delayed-Ack timer value from the inp
1912                  * ususually about 200ms.
1913                  */
1914                 if (stcb == NULL) {
1915                         return;
1916                 }
1917                 tmr = &stcb->asoc.dack_timer;
1918                 to_ticks = MSEC_TO_TICKS(stcb->asoc.delayed_ack);
1919                 break;
1920         case SCTP_TIMER_TYPE_SHUTDOWN:
1921                 /* Here we use the RTO of the destination. */
1922                 if ((stcb == NULL) || (net == NULL)) {
1923                         return;
1924                 }
1925                 if (net->RTO == 0) {
1926                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1927                 } else {
1928                         to_ticks = MSEC_TO_TICKS(net->RTO);
1929                 }
1930                 tmr = &net->rxt_timer;
1931                 break;
1932         case SCTP_TIMER_TYPE_HEARTBEAT:
1933                 /*
1934                  * the net is used here so that we can add in the RTO. Even
1935                  * though we use a different timer. We also add the HB timer
1936                  * PLUS a random jitter.
1937                  */
1938                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
1939                         return;
1940                 } else {
1941                         uint32_t rndval;
1942                         uint32_t jitter;
1943
1944                         if ((net->dest_state & SCTP_ADDR_NOHB) &&
1945                             !(net->dest_state & SCTP_ADDR_UNCONFIRMED)) {
1946                                 return;
1947                         }
1948                         if (net->RTO == 0) {
1949                                 to_ticks = stcb->asoc.initial_rto;
1950                         } else {
1951                                 to_ticks = net->RTO;
1952                         }
1953                         rndval = sctp_select_initial_TSN(&inp->sctp_ep);
1954                         jitter = rndval % to_ticks;
1955                         if (jitter >= (to_ticks >> 1)) {
1956                                 to_ticks = to_ticks + (jitter - (to_ticks >> 1));
1957                         } else {
1958                                 to_ticks = to_ticks - jitter;
1959                         }
1960                         if (!(net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
1961                             !(net->dest_state & SCTP_ADDR_PF)) {
1962                                 to_ticks += net->heart_beat_delay;
1963                         }
1964                         /*
1965                          * Now we must convert the to_ticks that are now in
1966                          * ms to ticks.
1967                          */
1968                         to_ticks = MSEC_TO_TICKS(to_ticks);
1969                         tmr = &net->hb_timer;
1970                 }
1971                 break;
1972         case SCTP_TIMER_TYPE_COOKIE:
1973                 /*
1974                  * Here we can use the RTO timer from the network since one
1975                  * RTT was compelete. If a retran happened then we will be
1976                  * using the RTO initial value.
1977                  */
1978                 if ((stcb == NULL) || (net == NULL)) {
1979                         return;
1980                 }
1981                 if (net->RTO == 0) {
1982                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1983                 } else {
1984                         to_ticks = MSEC_TO_TICKS(net->RTO);
1985                 }
1986                 tmr = &net->rxt_timer;
1987                 break;
1988         case SCTP_TIMER_TYPE_NEWCOOKIE:
1989                 /*
1990                  * nothing needed but the endpoint here ususually about 60
1991                  * minutes.
1992                  */
1993                 if (inp == NULL) {
1994                         return;
1995                 }
1996                 tmr = &inp->sctp_ep.signature_change;
1997                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE];
1998                 break;
1999         case SCTP_TIMER_TYPE_ASOCKILL:
2000                 if (stcb == NULL) {
2001                         return;
2002                 }
2003                 tmr = &stcb->asoc.strreset_timer;
2004                 to_ticks = MSEC_TO_TICKS(SCTP_ASOC_KILL_TIMEOUT);
2005                 break;
2006         case SCTP_TIMER_TYPE_INPKILL:
2007                 /*
2008                  * The inp is setup to die. We re-use the signature_chage
2009                  * timer since that has stopped and we are in the GONE
2010                  * state.
2011                  */
2012                 if (inp == NULL) {
2013                         return;
2014                 }
2015                 tmr = &inp->sctp_ep.signature_change;
2016                 to_ticks = MSEC_TO_TICKS(SCTP_INP_KILL_TIMEOUT);
2017                 break;
2018         case SCTP_TIMER_TYPE_PATHMTURAISE:
2019                 /*
2020                  * Here we use the value found in the EP for PMTU ususually
2021                  * about 10 minutes.
2022                  */
2023                 if ((stcb == NULL) || (inp == NULL)) {
2024                         return;
2025                 }
2026                 if (net == NULL) {
2027                         return;
2028                 }
2029                 if (net->dest_state & SCTP_ADDR_NO_PMTUD) {
2030                         return;
2031                 }
2032                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU];
2033                 tmr = &net->pmtu_timer;
2034                 break;
2035         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2036                 /* Here we use the RTO of the destination */
2037                 if ((stcb == NULL) || (net == NULL)) {
2038                         return;
2039                 }
2040                 if (net->RTO == 0) {
2041                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2042                 } else {
2043                         to_ticks = MSEC_TO_TICKS(net->RTO);
2044                 }
2045                 tmr = &net->rxt_timer;
2046                 break;
2047         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2048                 /*
2049                  * Here we use the endpoints shutdown guard timer usually
2050                  * about 3 minutes.
2051                  */
2052                 if ((inp == NULL) || (stcb == NULL)) {
2053                         return;
2054                 }
2055                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN];
2056                 tmr = &stcb->asoc.shut_guard_timer;
2057                 break;
2058         case SCTP_TIMER_TYPE_STRRESET:
2059                 /*
2060                  * Here the timer comes from the stcb but its value is from
2061                  * the net's RTO.
2062                  */
2063                 if ((stcb == NULL) || (net == NULL)) {
2064                         return;
2065                 }
2066                 if (net->RTO == 0) {
2067                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2068                 } else {
2069                         to_ticks = MSEC_TO_TICKS(net->RTO);
2070                 }
2071                 tmr = &stcb->asoc.strreset_timer;
2072                 break;
2073         case SCTP_TIMER_TYPE_ASCONF:
2074                 /*
2075                  * Here the timer comes from the stcb but its value is from
2076                  * the net's RTO.
2077                  */
2078                 if ((stcb == NULL) || (net == NULL)) {
2079                         return;
2080                 }
2081                 if (net->RTO == 0) {
2082                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2083                 } else {
2084                         to_ticks = MSEC_TO_TICKS(net->RTO);
2085                 }
2086                 tmr = &stcb->asoc.asconf_timer;
2087                 break;
2088         case SCTP_TIMER_TYPE_PRIM_DELETED:
2089                 if ((stcb == NULL) || (net != NULL)) {
2090                         return;
2091                 }
2092                 to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2093                 tmr = &stcb->asoc.delete_prim_timer;
2094                 break;
2095         case SCTP_TIMER_TYPE_AUTOCLOSE:
2096                 if (stcb == NULL) {
2097                         return;
2098                 }
2099                 if (stcb->asoc.sctp_autoclose_ticks == 0) {
2100                         /*
2101                          * Really an error since stcb is NOT set to
2102                          * autoclose
2103                          */
2104                         return;
2105                 }
2106                 to_ticks = stcb->asoc.sctp_autoclose_ticks;
2107                 tmr = &stcb->asoc.autoclose_timer;
2108                 break;
2109         default:
2110                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2111                     __FUNCTION__, t_type);
2112                 return;
2113                 break;
2114         }
2115         if ((to_ticks <= 0) || (tmr == NULL)) {
2116                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: %d:software error to_ticks:%d tmr:%p not set ??\n",
2117                     __FUNCTION__, t_type, to_ticks, tmr);
2118                 return;
2119         }
2120         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
2121                 /*
2122                  * we do NOT allow you to have it already running. if it is
2123                  * we leave the current one up unchanged
2124                  */
2125                 return;
2126         }
2127         /* At this point we can proceed */
2128         if (t_type == SCTP_TIMER_TYPE_SEND) {
2129                 stcb->asoc.num_send_timers_up++;
2130         }
2131         tmr->stopped_from = 0;
2132         tmr->type = t_type;
2133         tmr->ep = (void *)inp;
2134         tmr->tcb = (void *)stcb;
2135         tmr->net = (void *)net;
2136         tmr->self = (void *)tmr;
2137         tmr->vnet = (void *)curvnet;
2138         tmr->ticks = sctp_get_tick_count();
2139         (void)SCTP_OS_TIMER_START(&tmr->timer, to_ticks, sctp_timeout_handler, tmr);
2140         return;
2141 }
2142
2143 void
2144 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2145     struct sctp_nets *net, uint32_t from)
2146 {
2147         struct sctp_timer *tmr;
2148
2149         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) &&
2150             (inp == NULL))
2151                 return;
2152
2153         tmr = NULL;
2154         if (stcb) {
2155                 SCTP_TCB_LOCK_ASSERT(stcb);
2156         }
2157         switch (t_type) {
2158         case SCTP_TIMER_TYPE_ZERO_COPY:
2159                 tmr = &inp->sctp_ep.zero_copy_timer;
2160                 break;
2161         case SCTP_TIMER_TYPE_ZCOPY_SENDQ:
2162                 tmr = &inp->sctp_ep.zero_copy_sendq_timer;
2163                 break;
2164         case SCTP_TIMER_TYPE_ADDR_WQ:
2165                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2166                 break;
2167         case SCTP_TIMER_TYPE_SEND:
2168                 if ((stcb == NULL) || (net == NULL)) {
2169                         return;
2170                 }
2171                 tmr = &net->rxt_timer;
2172                 break;
2173         case SCTP_TIMER_TYPE_INIT:
2174                 if ((stcb == NULL) || (net == NULL)) {
2175                         return;
2176                 }
2177                 tmr = &net->rxt_timer;
2178                 break;
2179         case SCTP_TIMER_TYPE_RECV:
2180                 if (stcb == NULL) {
2181                         return;
2182                 }
2183                 tmr = &stcb->asoc.dack_timer;
2184                 break;
2185         case SCTP_TIMER_TYPE_SHUTDOWN:
2186                 if ((stcb == NULL) || (net == NULL)) {
2187                         return;
2188                 }
2189                 tmr = &net->rxt_timer;
2190                 break;
2191         case SCTP_TIMER_TYPE_HEARTBEAT:
2192                 if ((stcb == NULL) || (net == NULL)) {
2193                         return;
2194                 }
2195                 tmr = &net->hb_timer;
2196                 break;
2197         case SCTP_TIMER_TYPE_COOKIE:
2198                 if ((stcb == NULL) || (net == NULL)) {
2199                         return;
2200                 }
2201                 tmr = &net->rxt_timer;
2202                 break;
2203         case SCTP_TIMER_TYPE_NEWCOOKIE:
2204                 /* nothing needed but the endpoint here */
2205                 tmr = &inp->sctp_ep.signature_change;
2206                 /*
2207                  * We re-use the newcookie timer for the INP kill timer. We
2208                  * must assure that we do not kill it by accident.
2209                  */
2210                 break;
2211         case SCTP_TIMER_TYPE_ASOCKILL:
2212                 /*
2213                  * Stop the asoc kill timer.
2214                  */
2215                 if (stcb == NULL) {
2216                         return;
2217                 }
2218                 tmr = &stcb->asoc.strreset_timer;
2219                 break;
2220
2221         case SCTP_TIMER_TYPE_INPKILL:
2222                 /*
2223                  * The inp is setup to die. We re-use the signature_chage
2224                  * timer since that has stopped and we are in the GONE
2225                  * state.
2226                  */
2227                 tmr = &inp->sctp_ep.signature_change;
2228                 break;
2229         case SCTP_TIMER_TYPE_PATHMTURAISE:
2230                 if ((stcb == NULL) || (net == NULL)) {
2231                         return;
2232                 }
2233                 tmr = &net->pmtu_timer;
2234                 break;
2235         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2236                 if ((stcb == NULL) || (net == NULL)) {
2237                         return;
2238                 }
2239                 tmr = &net->rxt_timer;
2240                 break;
2241         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2242                 if (stcb == NULL) {
2243                         return;
2244                 }
2245                 tmr = &stcb->asoc.shut_guard_timer;
2246                 break;
2247         case SCTP_TIMER_TYPE_STRRESET:
2248                 if (stcb == NULL) {
2249                         return;
2250                 }
2251                 tmr = &stcb->asoc.strreset_timer;
2252                 break;
2253         case SCTP_TIMER_TYPE_ASCONF:
2254                 if (stcb == NULL) {
2255                         return;
2256                 }
2257                 tmr = &stcb->asoc.asconf_timer;
2258                 break;
2259         case SCTP_TIMER_TYPE_PRIM_DELETED:
2260                 if (stcb == NULL) {
2261                         return;
2262                 }
2263                 tmr = &stcb->asoc.delete_prim_timer;
2264                 break;
2265         case SCTP_TIMER_TYPE_AUTOCLOSE:
2266                 if (stcb == NULL) {
2267                         return;
2268                 }
2269                 tmr = &stcb->asoc.autoclose_timer;
2270                 break;
2271         default:
2272                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2273                     __FUNCTION__, t_type);
2274                 break;
2275         }
2276         if (tmr == NULL) {
2277                 return;
2278         }
2279         if ((tmr->type != t_type) && tmr->type) {
2280                 /*
2281                  * Ok we have a timer that is under joint use. Cookie timer
2282                  * per chance with the SEND timer. We therefore are NOT
2283                  * running the timer that the caller wants stopped.  So just
2284                  * return.
2285                  */
2286                 return;
2287         }
2288         if ((t_type == SCTP_TIMER_TYPE_SEND) && (stcb != NULL)) {
2289                 stcb->asoc.num_send_timers_up--;
2290                 if (stcb->asoc.num_send_timers_up < 0) {
2291                         stcb->asoc.num_send_timers_up = 0;
2292                 }
2293         }
2294         tmr->self = NULL;
2295         tmr->stopped_from = from;
2296         (void)SCTP_OS_TIMER_STOP(&tmr->timer);
2297         return;
2298 }
2299
2300 uint32_t
2301 sctp_calculate_len(struct mbuf *m)
2302 {
2303         uint32_t tlen = 0;
2304         struct mbuf *at;
2305
2306         at = m;
2307         while (at) {
2308                 tlen += SCTP_BUF_LEN(at);
2309                 at = SCTP_BUF_NEXT(at);
2310         }
2311         return (tlen);
2312 }
2313
2314 void
2315 sctp_mtu_size_reset(struct sctp_inpcb *inp,
2316     struct sctp_association *asoc, uint32_t mtu)
2317 {
2318         /*
2319          * Reset the P-MTU size on this association, this involves changing
2320          * the asoc MTU, going through ANY chunk+overhead larger than mtu to
2321          * allow the DF flag to be cleared.
2322          */
2323         struct sctp_tmit_chunk *chk;
2324         unsigned int eff_mtu, ovh;
2325
2326         asoc->smallest_mtu = mtu;
2327         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2328                 ovh = SCTP_MIN_OVERHEAD;
2329         } else {
2330                 ovh = SCTP_MIN_V4_OVERHEAD;
2331         }
2332         eff_mtu = mtu - ovh;
2333         TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
2334                 if (chk->send_size > eff_mtu) {
2335                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2336                 }
2337         }
2338         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
2339                 if (chk->send_size > eff_mtu) {
2340                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2341                 }
2342         }
2343 }
2344
2345
2346 /*
2347  * given an association and starting time of the current RTT period return
2348  * RTO in number of msecs net should point to the current network
2349  */
2350
2351 uint32_t
2352 sctp_calculate_rto(struct sctp_tcb *stcb,
2353     struct sctp_association *asoc,
2354     struct sctp_nets *net,
2355     struct timeval *told,
2356     int safe, int rtt_from_sack)
2357 {
2358         /*-
2359          * given an association and the starting time of the current RTT
2360          * period (in value1/value2) return RTO in number of msecs.
2361          */
2362         int32_t rtt;            /* RTT in ms */
2363         uint32_t new_rto;
2364         int first_measure = 0;
2365         struct timeval now, then, *old;
2366
2367         /* Copy it out for sparc64 */
2368         if (safe == sctp_align_unsafe_makecopy) {
2369                 old = &then;
2370                 memcpy(&then, told, sizeof(struct timeval));
2371         } else if (safe == sctp_align_safe_nocopy) {
2372                 old = told;
2373         } else {
2374                 /* error */
2375                 SCTP_PRINTF("Huh, bad rto calc call\n");
2376                 return (0);
2377         }
2378         /************************/
2379         /* 1. calculate new RTT */
2380         /************************/
2381         /* get the current time */
2382         if (stcb->asoc.use_precise_time) {
2383                 (void)SCTP_GETPTIME_TIMEVAL(&now);
2384         } else {
2385                 (void)SCTP_GETTIME_TIMEVAL(&now);
2386         }
2387         timevalsub(&now, old);
2388         /* store the current RTT in us */
2389         net->rtt = (uint64_t) 10000000 *(uint64_t) now.tv_sec +
2390                  (uint64_t) now.tv_usec;
2391
2392         /* computer rtt in ms */
2393         rtt = net->rtt / 1000;
2394         if ((asoc->cc_functions.sctp_rtt_calculated) && (rtt_from_sack == SCTP_RTT_FROM_DATA)) {
2395                 /*
2396                  * Tell the CC module that a new update has just occurred
2397                  * from a sack
2398                  */
2399                 (*asoc->cc_functions.sctp_rtt_calculated) (stcb, net, &now);
2400         }
2401         /*
2402          * Do we need to determine the lan? We do this only on sacks i.e.
2403          * RTT being determined from data not non-data (HB/INIT->INITACK).
2404          */
2405         if ((rtt_from_sack == SCTP_RTT_FROM_DATA) &&
2406             (net->lan_type == SCTP_LAN_UNKNOWN)) {
2407                 if (net->rtt > SCTP_LOCAL_LAN_RTT) {
2408                         net->lan_type = SCTP_LAN_INTERNET;
2409                 } else {
2410                         net->lan_type = SCTP_LAN_LOCAL;
2411                 }
2412         }
2413         /***************************/
2414         /* 2. update RTTVAR & SRTT */
2415         /***************************/
2416         /*-
2417          * Compute the scaled average lastsa and the
2418          * scaled variance lastsv as described in van Jacobson
2419          * Paper "Congestion Avoidance and Control", Annex A.
2420          *
2421          * (net->lastsa >> SCTP_RTT_SHIFT) is the srtt
2422          * (net->lastsa >> SCTP_RTT_VAR_SHIFT) is the rttvar
2423          */
2424         if (net->RTO_measured) {
2425                 rtt -= (net->lastsa >> SCTP_RTT_SHIFT);
2426                 net->lastsa += rtt;
2427                 if (rtt < 0) {
2428                         rtt = -rtt;
2429                 }
2430                 rtt -= (net->lastsv >> SCTP_RTT_VAR_SHIFT);
2431                 net->lastsv += rtt;
2432                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2433                         rto_logging(net, SCTP_LOG_RTTVAR);
2434                 }
2435         } else {
2436                 /* First RTO measurment */
2437                 net->RTO_measured = 1;
2438                 first_measure = 1;
2439                 net->lastsa = rtt << SCTP_RTT_SHIFT;
2440                 net->lastsv = (rtt / 2) << SCTP_RTT_VAR_SHIFT;
2441                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2442                         rto_logging(net, SCTP_LOG_INITIAL_RTT);
2443                 }
2444         }
2445         if (net->lastsv == 0) {
2446                 net->lastsv = SCTP_CLOCK_GRANULARITY;
2447         }
2448         new_rto = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
2449         if ((new_rto > SCTP_SAT_NETWORK_MIN) &&
2450             (stcb->asoc.sat_network_lockout == 0)) {
2451                 stcb->asoc.sat_network = 1;
2452         } else if ((!first_measure) && stcb->asoc.sat_network) {
2453                 stcb->asoc.sat_network = 0;
2454                 stcb->asoc.sat_network_lockout = 1;
2455         }
2456         /* bound it, per C6/C7 in Section 5.3.1 */
2457         if (new_rto < stcb->asoc.minrto) {
2458                 new_rto = stcb->asoc.minrto;
2459         }
2460         if (new_rto > stcb->asoc.maxrto) {
2461                 new_rto = stcb->asoc.maxrto;
2462         }
2463         /* we are now returning the RTO */
2464         return (new_rto);
2465 }
2466
2467 /*
2468  * return a pointer to a contiguous piece of data from the given mbuf chain
2469  * starting at 'off' for 'len' bytes.  If the desired piece spans more than
2470  * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size
2471  * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain.
2472  */
2473 caddr_t
2474 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t * in_ptr)
2475 {
2476         uint32_t count;
2477         uint8_t *ptr;
2478
2479         ptr = in_ptr;
2480         if ((off < 0) || (len <= 0))
2481                 return (NULL);
2482
2483         /* find the desired start location */
2484         while ((m != NULL) && (off > 0)) {
2485                 if (off < SCTP_BUF_LEN(m))
2486                         break;
2487                 off -= SCTP_BUF_LEN(m);
2488                 m = SCTP_BUF_NEXT(m);
2489         }
2490         if (m == NULL)
2491                 return (NULL);
2492
2493         /* is the current mbuf large enough (eg. contiguous)? */
2494         if ((SCTP_BUF_LEN(m) - off) >= len) {
2495                 return (mtod(m, caddr_t)+off);
2496         } else {
2497                 /* else, it spans more than one mbuf, so save a temp copy... */
2498                 while ((m != NULL) && (len > 0)) {
2499                         count = min(SCTP_BUF_LEN(m) - off, len);
2500                         bcopy(mtod(m, caddr_t)+off, ptr, count);
2501                         len -= count;
2502                         ptr += count;
2503                         off = 0;
2504                         m = SCTP_BUF_NEXT(m);
2505                 }
2506                 if ((m == NULL) && (len > 0))
2507                         return (NULL);
2508                 else
2509                         return ((caddr_t)in_ptr);
2510         }
2511 }
2512
2513
2514
2515 struct sctp_paramhdr *
2516 sctp_get_next_param(struct mbuf *m,
2517     int offset,
2518     struct sctp_paramhdr *pull,
2519     int pull_limit)
2520 {
2521         /* This just provides a typed signature to Peter's Pull routine */
2522         return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit,
2523             (uint8_t *) pull));
2524 }
2525
2526
2527 int
2528 sctp_add_pad_tombuf(struct mbuf *m, int padlen)
2529 {
2530         /*
2531          * add padlen bytes of 0 filled padding to the end of the mbuf. If
2532          * padlen is > 3 this routine will fail.
2533          */
2534         uint8_t *dp;
2535         int i;
2536
2537         if (padlen > 3) {
2538                 SCTP_LTRACE_ERR_RET_PKT(m, NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
2539                 return (ENOBUFS);
2540         }
2541         if (padlen <= M_TRAILINGSPACE(m)) {
2542                 /*
2543                  * The easy way. We hope the majority of the time we hit
2544                  * here :)
2545                  */
2546                 dp = (uint8_t *) (mtod(m, caddr_t)+SCTP_BUF_LEN(m));
2547                 SCTP_BUF_LEN(m) += padlen;
2548         } else {
2549                 /* Hard way we must grow the mbuf */
2550                 struct mbuf *tmp;
2551
2552                 tmp = sctp_get_mbuf_for_msg(padlen, 0, M_DONTWAIT, 1, MT_DATA);
2553                 if (tmp == NULL) {
2554                         /* Out of space GAK! we are in big trouble. */
2555                         SCTP_LTRACE_ERR_RET_PKT(m, NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
2556                         return (ENOBUFS);
2557                 }
2558                 /* setup and insert in middle */
2559                 SCTP_BUF_LEN(tmp) = padlen;
2560                 SCTP_BUF_NEXT(tmp) = NULL;
2561                 SCTP_BUF_NEXT(m) = tmp;
2562                 dp = mtod(tmp, uint8_t *);
2563         }
2564         /* zero out the pad */
2565         for (i = 0; i < padlen; i++) {
2566                 *dp = 0;
2567                 dp++;
2568         }
2569         return (0);
2570 }
2571
2572 int
2573 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf)
2574 {
2575         /* find the last mbuf in chain and pad it */
2576         struct mbuf *m_at;
2577
2578         m_at = m;
2579         if (last_mbuf) {
2580                 return (sctp_add_pad_tombuf(last_mbuf, padval));
2581         } else {
2582                 while (m_at) {
2583                         if (SCTP_BUF_NEXT(m_at) == NULL) {
2584                                 return (sctp_add_pad_tombuf(m_at, padval));
2585                         }
2586                         m_at = SCTP_BUF_NEXT(m_at);
2587                 }
2588         }
2589         SCTP_LTRACE_ERR_RET_PKT(m, NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
2590         return (EFAULT);
2591 }
2592
2593 static void
2594 sctp_notify_assoc_change(uint16_t state, struct sctp_tcb *stcb,
2595     uint16_t error, struct sctp_abort_chunk *abort, uint8_t from_peer, int so_locked
2596 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2597     SCTP_UNUSED
2598 #endif
2599 )
2600 {
2601         struct mbuf *m_notify;
2602         struct sctp_assoc_change *sac;
2603         struct sctp_queued_to_read *control;
2604         size_t notif_len, abort_len;
2605         unsigned int i;
2606
2607 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2608         struct socket *so;
2609
2610 #endif
2611
2612         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVASSOCEVNT)) {
2613                 notif_len = sizeof(struct sctp_assoc_change);
2614                 if (abort != NULL) {
2615                         abort_len = htons(abort->ch.chunk_length);
2616                 } else {
2617                         abort_len = 0;
2618                 }
2619                 if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
2620                         notif_len += SCTP_ASSOC_SUPPORTS_MAX;
2621                 } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
2622                         notif_len += abort_len;
2623                 }
2624                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_DONTWAIT, 1, MT_DATA);
2625                 if (m_notify == NULL) {
2626                         /* Retry with smaller value. */
2627                         notif_len = sizeof(struct sctp_assoc_change);
2628                         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_DONTWAIT, 1, MT_DATA);
2629                         if (m_notify == NULL) {
2630                                 goto set_error;
2631                         }
2632                 }
2633                 SCTP_BUF_NEXT(m_notify) = NULL;
2634                 sac = mtod(m_notify, struct sctp_assoc_change *);
2635                 sac->sac_type = SCTP_ASSOC_CHANGE;
2636                 sac->sac_flags = 0;
2637                 sac->sac_length = sizeof(struct sctp_assoc_change);
2638                 sac->sac_state = state;
2639                 sac->sac_error = error;
2640                 /* XXX verify these stream counts */
2641                 sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
2642                 sac->sac_inbound_streams = stcb->asoc.streamincnt;
2643                 sac->sac_assoc_id = sctp_get_associd(stcb);
2644                 if (notif_len > sizeof(struct sctp_assoc_change)) {
2645                         if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
2646                                 i = 0;
2647                                 if (stcb->asoc.peer_supports_prsctp) {
2648                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_PR;
2649                                 }
2650                                 if (stcb->asoc.peer_supports_auth) {
2651                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_AUTH;
2652                                 }
2653                                 if (stcb->asoc.peer_supports_asconf) {
2654                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_ASCONF;
2655                                 }
2656                                 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_MULTIBUF;
2657                                 if (stcb->asoc.peer_supports_strreset) {
2658                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_RE_CONFIG;
2659                                 }
2660                                 sac->sac_length += i;
2661                         } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
2662                                 memcpy(sac->sac_info, abort, abort_len);
2663                                 sac->sac_length += abort_len;
2664                         }
2665                 }
2666                 SCTP_BUF_LEN(m_notify) = sac->sac_length;
2667                 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2668                     0, 0, stcb->asoc.context, 0, 0, 0,
2669                     m_notify);
2670                 if (control != NULL) {
2671                         control->length = SCTP_BUF_LEN(m_notify);
2672                         /* not that we need this */
2673                         control->tail_mbuf = m_notify;
2674                         control->spec_flags = M_NOTIFICATION;
2675                         sctp_add_to_readq(stcb->sctp_ep, stcb,
2676                             control,
2677                             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD,
2678                             so_locked);
2679                 } else {
2680                         sctp_m_freem(m_notify);
2681                 }
2682         }
2683         /*
2684          * For 1-to-1 style sockets, we send up and error when an ABORT
2685          * comes in.
2686          */
2687 set_error:
2688         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2689             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2690             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
2691                 if (from_peer) {
2692                         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) {
2693                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNREFUSED);
2694                                 stcb->sctp_socket->so_error = ECONNREFUSED;
2695                         } else {
2696                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
2697                                 stcb->sctp_socket->so_error = ECONNRESET;
2698                         }
2699                 } else {
2700                         SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNABORTED);
2701                         stcb->sctp_socket->so_error = ECONNABORTED;
2702                 }
2703         }
2704         /* Wake ANY sleepers */
2705 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2706         so = SCTP_INP_SO(stcb->sctp_ep);
2707         if (!so_locked) {
2708                 atomic_add_int(&stcb->asoc.refcnt, 1);
2709                 SCTP_TCB_UNLOCK(stcb);
2710                 SCTP_SOCKET_LOCK(so, 1);
2711                 SCTP_TCB_LOCK(stcb);
2712                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2713                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2714                         SCTP_SOCKET_UNLOCK(so, 1);
2715                         return;
2716                 }
2717         }
2718 #endif
2719         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2720             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2721             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
2722                 socantrcvmore(stcb->sctp_socket);
2723         }
2724         sorwakeup(stcb->sctp_socket);
2725         sowwakeup(stcb->sctp_socket);
2726 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2727         if (!so_locked) {
2728                 SCTP_SOCKET_UNLOCK(so, 1);
2729         }
2730 #endif
2731 }
2732
2733 static void
2734 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
2735     struct sockaddr *sa, uint32_t error)
2736 {
2737         struct mbuf *m_notify;
2738         struct sctp_paddr_change *spc;
2739         struct sctp_queued_to_read *control;
2740
2741         if ((stcb == NULL) ||
2742             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPADDREVNT)) {
2743                 /* event not enabled */
2744                 return;
2745         }
2746         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 0, M_DONTWAIT, 1, MT_DATA);
2747         if (m_notify == NULL)
2748                 return;
2749         SCTP_BUF_LEN(m_notify) = 0;
2750         spc = mtod(m_notify, struct sctp_paddr_change *);
2751         spc->spc_type = SCTP_PEER_ADDR_CHANGE;
2752         spc->spc_flags = 0;
2753         spc->spc_length = sizeof(struct sctp_paddr_change);
2754         switch (sa->sa_family) {
2755 #ifdef INET
2756         case AF_INET:
2757                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2758                 break;
2759 #endif
2760 #ifdef INET6
2761         case AF_INET6:
2762                 {
2763                         struct sockaddr_in6 *sin6;
2764
2765                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6));
2766
2767                         sin6 = (struct sockaddr_in6 *)&spc->spc_aaddr;
2768                         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2769                                 if (sin6->sin6_scope_id == 0) {
2770                                         /* recover scope_id for user */
2771                                         (void)sa6_recoverscope(sin6);
2772                                 } else {
2773                                         /* clear embedded scope_id for user */
2774                                         in6_clearscope(&sin6->sin6_addr);
2775                                 }
2776                         }
2777                         break;
2778                 }
2779 #endif
2780         default:
2781                 /* TSNH */
2782                 break;
2783         }
2784         spc->spc_state = state;
2785         spc->spc_error = error;
2786         spc->spc_assoc_id = sctp_get_associd(stcb);
2787
2788         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_paddr_change);
2789         SCTP_BUF_NEXT(m_notify) = NULL;
2790
2791         /* append to socket */
2792         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2793             0, 0, stcb->asoc.context, 0, 0, 0,
2794             m_notify);
2795         if (control == NULL) {
2796                 /* no memory */
2797                 sctp_m_freem(m_notify);
2798                 return;
2799         }
2800         control->length = SCTP_BUF_LEN(m_notify);
2801         control->spec_flags = M_NOTIFICATION;
2802         /* not that we need this */
2803         control->tail_mbuf = m_notify;
2804         sctp_add_to_readq(stcb->sctp_ep, stcb,
2805             control,
2806             &stcb->sctp_socket->so_rcv, 1,
2807             SCTP_READ_LOCK_NOT_HELD,
2808             SCTP_SO_NOT_LOCKED);
2809 }
2810
2811
2812 static void
2813 sctp_notify_send_failed(struct sctp_tcb *stcb, uint32_t error,
2814     struct sctp_tmit_chunk *chk, int so_locked
2815 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2816     SCTP_UNUSED
2817 #endif
2818 )
2819 {
2820         struct mbuf *m_notify;
2821         struct sctp_send_failed *ssf;
2822         struct sctp_send_failed_event *ssfe;
2823         struct sctp_queued_to_read *control;
2824         int length;
2825
2826         if ((stcb == NULL) ||
2827             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
2828             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
2829                 /* event not enabled */
2830                 return;
2831         }
2832         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2833                 length = sizeof(struct sctp_send_failed_event);
2834         } else {
2835                 length = sizeof(struct sctp_send_failed);
2836         }
2837         m_notify = sctp_get_mbuf_for_msg(length, 0, M_DONTWAIT, 1, MT_DATA);
2838         if (m_notify == NULL)
2839                 /* no space left */
2840                 return;
2841         length += chk->send_size;
2842         length -= sizeof(struct sctp_data_chunk);
2843         SCTP_BUF_LEN(m_notify) = 0;
2844         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2845                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
2846                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
2847                 if (error == SCTP_NOTIFY_DATAGRAM_UNSENT)
2848                         ssfe->ssfe_flags = SCTP_DATA_UNSENT;
2849                 else
2850                         ssfe->ssfe_flags = SCTP_DATA_SENT;
2851                 ssfe->ssfe_length = length;
2852                 ssfe->ssfe_error = error;
2853                 /* not exactly what the user sent in, but should be close :) */
2854                 bzero(&ssfe->ssfe_info, sizeof(ssfe->ssfe_info));
2855                 ssfe->ssfe_info.snd_sid = chk->rec.data.stream_number;
2856                 ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags;
2857                 ssfe->ssfe_info.snd_ppid = chk->rec.data.payloadtype;
2858                 ssfe->ssfe_info.snd_context = chk->rec.data.context;
2859                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
2860                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
2861                 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed_event);
2862         } else {
2863                 ssf = mtod(m_notify, struct sctp_send_failed *);
2864                 ssf->ssf_type = SCTP_SEND_FAILED;
2865                 if (error == SCTP_NOTIFY_DATAGRAM_UNSENT)
2866                         ssf->ssf_flags = SCTP_DATA_UNSENT;
2867                 else
2868                         ssf->ssf_flags = SCTP_DATA_SENT;
2869                 ssf->ssf_length = length;
2870                 ssf->ssf_error = error;
2871                 /* not exactly what the user sent in, but should be close :) */
2872                 bzero(&ssf->ssf_info, sizeof(ssf->ssf_info));
2873                 ssf->ssf_info.sinfo_stream = chk->rec.data.stream_number;
2874                 ssf->ssf_info.sinfo_ssn = chk->rec.data.stream_seq;
2875                 ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags;
2876                 ssf->ssf_info.sinfo_ppid = chk->rec.data.payloadtype;
2877                 ssf->ssf_info.sinfo_context = chk->rec.data.context;
2878                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
2879                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
2880                 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed);
2881         }
2882         if (chk->data) {
2883                 /*
2884                  * trim off the sctp chunk header(it should be there)
2885                  */
2886                 if (chk->send_size >= sizeof(struct sctp_data_chunk)) {
2887                         m_adj(chk->data, sizeof(struct sctp_data_chunk));
2888                         sctp_mbuf_crush(chk->data);
2889                         chk->send_size -= sizeof(struct sctp_data_chunk);
2890                 }
2891         }
2892         SCTP_BUF_NEXT(m_notify) = chk->data;
2893         /* Steal off the mbuf */
2894         chk->data = NULL;
2895         /*
2896          * For this case, we check the actual socket buffer, since the assoc
2897          * is going away we don't want to overfill the socket buffer for a
2898          * non-reader
2899          */
2900         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
2901                 sctp_m_freem(m_notify);
2902                 return;
2903         }
2904         /* append to socket */
2905         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2906             0, 0, stcb->asoc.context, 0, 0, 0,
2907             m_notify);
2908         if (control == NULL) {
2909                 /* no memory */
2910                 sctp_m_freem(m_notify);
2911                 return;
2912         }
2913         control->spec_flags = M_NOTIFICATION;
2914         sctp_add_to_readq(stcb->sctp_ep, stcb,
2915             control,
2916             &stcb->sctp_socket->so_rcv, 1,
2917             SCTP_READ_LOCK_NOT_HELD,
2918             so_locked);
2919 }
2920
2921
2922 static void
2923 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
2924     struct sctp_stream_queue_pending *sp, int so_locked
2925 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2926     SCTP_UNUSED
2927 #endif
2928 )
2929 {
2930         struct mbuf *m_notify;
2931         struct sctp_send_failed *ssf;
2932         struct sctp_send_failed_event *ssfe;
2933         struct sctp_queued_to_read *control;
2934         int length;
2935
2936         if ((stcb == NULL) ||
2937             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
2938             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
2939                 /* event not enabled */
2940                 return;
2941         }
2942         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2943                 length = sizeof(struct sctp_send_failed_event);
2944         } else {
2945                 length = sizeof(struct sctp_send_failed);
2946         }
2947         m_notify = sctp_get_mbuf_for_msg(length, 0, M_DONTWAIT, 1, MT_DATA);
2948         if (m_notify == NULL) {
2949                 /* no space left */
2950                 return;
2951         }
2952         length += sp->length;
2953         SCTP_BUF_LEN(m_notify) = 0;
2954         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2955                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
2956                 ssfe->ssfe_type = SCTP_SEND_FAILED;
2957                 if (error == SCTP_NOTIFY_DATAGRAM_UNSENT)
2958                         ssfe->ssfe_flags = SCTP_DATA_UNSENT;
2959                 else
2960                         ssfe->ssfe_flags = SCTP_DATA_SENT;
2961                 ssfe->ssfe_length = length;
2962                 ssfe->ssfe_error = error;
2963                 /* not exactly what the user sent in, but should be close :) */
2964                 bzero(&ssfe->ssfe_info, sizeof(ssfe->ssfe_info));
2965                 ssfe->ssfe_info.snd_sid = sp->stream;
2966                 if (sp->some_taken) {
2967                         ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG;
2968                 } else {
2969                         ssfe->ssfe_info.snd_flags = SCTP_DATA_NOT_FRAG;
2970                 }
2971                 ssfe->ssfe_info.snd_ppid = sp->ppid;
2972                 ssfe->ssfe_info.snd_context = sp->context;
2973                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
2974                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
2975                 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed_event);
2976         } else {
2977                 ssf = mtod(m_notify, struct sctp_send_failed *);
2978                 ssf->ssf_type = SCTP_SEND_FAILED;
2979                 if (error == SCTP_NOTIFY_DATAGRAM_UNSENT)
2980                         ssf->ssf_flags = SCTP_DATA_UNSENT;
2981                 else
2982                         ssf->ssf_flags = SCTP_DATA_SENT;
2983                 ssf->ssf_length = length;
2984                 ssf->ssf_error = error;
2985                 /* not exactly what the user sent in, but should be close :) */
2986                 bzero(&ssf->ssf_info, sizeof(ssf->ssf_info));
2987                 ssf->ssf_info.sinfo_stream = sp->stream;
2988                 ssf->ssf_info.sinfo_ssn = sp->strseq;
2989                 if (sp->some_taken) {
2990                         ssf->ssf_info.sinfo_flags = SCTP_DATA_LAST_FRAG;
2991                 } else {
2992                         ssf->ssf_info.sinfo_flags = SCTP_DATA_NOT_FRAG;
2993                 }
2994                 ssf->ssf_info.sinfo_ppid = sp->ppid;
2995                 ssf->ssf_info.sinfo_context = sp->context;
2996                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
2997                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
2998                 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed);
2999         }
3000         SCTP_BUF_NEXT(m_notify) = sp->data;
3001
3002         /* Steal off the mbuf */
3003         sp->data = NULL;
3004         /*
3005          * For this case, we check the actual socket buffer, since the assoc
3006          * is going away we don't want to overfill the socket buffer for a
3007          * non-reader
3008          */
3009         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3010                 sctp_m_freem(m_notify);
3011                 return;
3012         }
3013         /* append to socket */
3014         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3015             0, 0, stcb->asoc.context, 0, 0, 0,
3016             m_notify);
3017         if (control == NULL) {
3018                 /* no memory */
3019                 sctp_m_freem(m_notify);
3020                 return;
3021         }
3022         control->spec_flags = M_NOTIFICATION;
3023         sctp_add_to_readq(stcb->sctp_ep, stcb,
3024             control,
3025             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3026 }
3027
3028
3029
3030 static void
3031 sctp_notify_adaptation_layer(struct sctp_tcb *stcb)
3032 {
3033         struct mbuf *m_notify;
3034         struct sctp_adaptation_event *sai;
3035         struct sctp_queued_to_read *control;
3036
3037         if ((stcb == NULL) ||
3038             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ADAPTATIONEVNT)) {
3039                 /* event not enabled */
3040                 return;
3041         }
3042         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_DONTWAIT, 1, MT_DATA);
3043         if (m_notify == NULL)
3044                 /* no space left */
3045                 return;
3046         SCTP_BUF_LEN(m_notify) = 0;
3047         sai = mtod(m_notify, struct sctp_adaptation_event *);
3048         sai->sai_type = SCTP_ADAPTATION_INDICATION;
3049         sai->sai_flags = 0;
3050         sai->sai_length = sizeof(struct sctp_adaptation_event);
3051         sai->sai_adaptation_ind = stcb->asoc.peers_adaptation;
3052         sai->sai_assoc_id = sctp_get_associd(stcb);
3053
3054         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_adaptation_event);
3055         SCTP_BUF_NEXT(m_notify) = NULL;
3056
3057         /* append to socket */
3058         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3059             0, 0, stcb->asoc.context, 0, 0, 0,
3060             m_notify);
3061         if (control == NULL) {
3062                 /* no memory */
3063                 sctp_m_freem(m_notify);
3064                 return;
3065         }
3066         control->length = SCTP_BUF_LEN(m_notify);
3067         control->spec_flags = M_NOTIFICATION;
3068         /* not that we need this */
3069         control->tail_mbuf = m_notify;
3070         sctp_add_to_readq(stcb->sctp_ep, stcb,
3071             control,
3072             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3073 }
3074
3075 /* This always must be called with the read-queue LOCKED in the INP */
3076 static void
3077 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb, uint32_t error,
3078     uint32_t val, int so_locked
3079 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3080     SCTP_UNUSED
3081 #endif
3082 )
3083 {
3084         struct mbuf *m_notify;
3085         struct sctp_pdapi_event *pdapi;
3086         struct sctp_queued_to_read *control;
3087         struct sockbuf *sb;
3088
3089         if ((stcb == NULL) ||
3090             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_PDAPIEVNT)) {
3091                 /* event not enabled */
3092                 return;
3093         }
3094         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
3095                 return;
3096         }
3097         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 0, M_DONTWAIT, 1, MT_DATA);
3098         if (m_notify == NULL)
3099                 /* no space left */
3100                 return;
3101         SCTP_BUF_LEN(m_notify) = 0;
3102         pdapi = mtod(m_notify, struct sctp_pdapi_event *);
3103         pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
3104         pdapi->pdapi_flags = 0;
3105         pdapi->pdapi_length = sizeof(struct sctp_pdapi_event);
3106         pdapi->pdapi_indication = error;
3107         pdapi->pdapi_stream = (val >> 16);
3108         pdapi->pdapi_seq = (val & 0x0000ffff);
3109         pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
3110
3111         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_pdapi_event);
3112         SCTP_BUF_NEXT(m_notify) = NULL;
3113         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3114             0, 0, stcb->asoc.context, 0, 0, 0,
3115             m_notify);
3116         if (control == NULL) {
3117                 /* no memory */
3118                 sctp_m_freem(m_notify);
3119                 return;
3120         }
3121         control->spec_flags = M_NOTIFICATION;
3122         control->length = SCTP_BUF_LEN(m_notify);
3123         /* not that we need this */
3124         control->tail_mbuf = m_notify;
3125         control->held_length = 0;
3126         control->length = 0;
3127         sb = &stcb->sctp_socket->so_rcv;
3128         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3129                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m_notify));
3130         }
3131         sctp_sballoc(stcb, sb, m_notify);
3132         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3133                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3134         }
3135         atomic_add_int(&control->length, SCTP_BUF_LEN(m_notify));
3136         control->end_added = 1;
3137         if (stcb->asoc.control_pdapi)
3138                 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next);
3139         else {
3140                 /* we really should not see this case */
3141                 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next);
3142         }
3143         if (stcb->sctp_ep && stcb->sctp_socket) {
3144                 /* This should always be the case */
3145 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3146                 struct socket *so;
3147
3148                 so = SCTP_INP_SO(stcb->sctp_ep);
3149                 if (!so_locked) {
3150                         atomic_add_int(&stcb->asoc.refcnt, 1);
3151                         SCTP_TCB_UNLOCK(stcb);
3152                         SCTP_SOCKET_LOCK(so, 1);
3153                         SCTP_TCB_LOCK(stcb);
3154                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
3155                         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3156                                 SCTP_SOCKET_UNLOCK(so, 1);
3157                                 return;
3158                         }
3159                 }
3160 #endif
3161                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
3162 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3163                 if (!so_locked) {
3164                         SCTP_SOCKET_UNLOCK(so, 1);
3165                 }
3166 #endif
3167         }
3168 }
3169
3170 static void
3171 sctp_notify_shutdown_event(struct sctp_tcb *stcb)
3172 {
3173         struct mbuf *m_notify;
3174         struct sctp_shutdown_event *sse;
3175         struct sctp_queued_to_read *control;
3176
3177         /*
3178          * For TCP model AND UDP connected sockets we will send an error up
3179          * when an SHUTDOWN completes
3180          */
3181         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3182             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
3183                 /* mark socket closed for read/write and wakeup! */
3184 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3185                 struct socket *so;
3186
3187                 so = SCTP_INP_SO(stcb->sctp_ep);
3188                 atomic_add_int(&stcb->asoc.refcnt, 1);
3189                 SCTP_TCB_UNLOCK(stcb);
3190                 SCTP_SOCKET_LOCK(so, 1);
3191                 SCTP_TCB_LOCK(stcb);
3192                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3193                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
3194                         SCTP_SOCKET_UNLOCK(so, 1);
3195                         return;
3196                 }
3197 #endif
3198                 socantsendmore(stcb->sctp_socket);
3199 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3200                 SCTP_SOCKET_UNLOCK(so, 1);
3201 #endif
3202         }
3203         if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT)) {
3204                 /* event not enabled */
3205                 return;
3206         }
3207         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 0, M_DONTWAIT, 1, MT_DATA);
3208         if (m_notify == NULL)
3209                 /* no space left */
3210                 return;
3211         sse = mtod(m_notify, struct sctp_shutdown_event *);
3212         sse->sse_type = SCTP_SHUTDOWN_EVENT;
3213         sse->sse_flags = 0;
3214         sse->sse_length = sizeof(struct sctp_shutdown_event);
3215         sse->sse_assoc_id = sctp_get_associd(stcb);
3216
3217         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_shutdown_event);
3218         SCTP_BUF_NEXT(m_notify) = NULL;
3219
3220         /* append to socket */
3221         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3222             0, 0, stcb->asoc.context, 0, 0, 0,
3223             m_notify);
3224         if (control == NULL) {
3225                 /* no memory */
3226                 sctp_m_freem(m_notify);
3227                 return;
3228         }
3229         control->spec_flags = M_NOTIFICATION;
3230         control->length = SCTP_BUF_LEN(m_notify);
3231         /* not that we need this */
3232         control->tail_mbuf = m_notify;
3233         sctp_add_to_readq(stcb->sctp_ep, stcb,
3234             control,
3235             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3236 }
3237
3238 static void
3239 sctp_notify_sender_dry_event(struct sctp_tcb *stcb,
3240     int so_locked
3241 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3242     SCTP_UNUSED
3243 #endif
3244 )
3245 {
3246         struct mbuf *m_notify;
3247         struct sctp_sender_dry_event *event;
3248         struct sctp_queued_to_read *control;
3249
3250         if ((stcb == NULL) ||
3251             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DRYEVNT)) {
3252                 /* event not enabled */
3253                 return;
3254         }
3255         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_sender_dry_event), 0, M_DONTWAIT, 1, MT_DATA);
3256         if (m_notify == NULL) {
3257                 /* no space left */
3258                 return;
3259         }
3260         SCTP_BUF_LEN(m_notify) = 0;
3261         event = mtod(m_notify, struct sctp_sender_dry_event *);
3262         event->sender_dry_type = SCTP_SENDER_DRY_EVENT;
3263         event->sender_dry_flags = 0;
3264         event->sender_dry_length = sizeof(struct sctp_sender_dry_event);
3265         event->sender_dry_assoc_id = sctp_get_associd(stcb);
3266
3267         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_sender_dry_event);
3268         SCTP_BUF_NEXT(m_notify) = NULL;
3269
3270         /* append to socket */
3271         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3272             0, 0, stcb->asoc.context, 0, 0, 0,
3273             m_notify);
3274         if (control == NULL) {
3275                 /* no memory */
3276                 sctp_m_freem(m_notify);
3277                 return;
3278         }
3279         control->length = SCTP_BUF_LEN(m_notify);
3280         control->spec_flags = M_NOTIFICATION;
3281         /* not that we need this */
3282         control->tail_mbuf = m_notify;
3283         sctp_add_to_readq(stcb->sctp_ep, stcb, control,
3284             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3285 }
3286
3287
3288 void
3289 sctp_notify_stream_reset_add(struct sctp_tcb *stcb, uint16_t numberin, uint16_t numberout, int flag)
3290 {
3291         struct mbuf *m_notify;
3292         struct sctp_queued_to_read *control;
3293         struct sctp_stream_change_event *stradd;
3294         int len;
3295
3296         if ((stcb == NULL) ||
3297             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT))) {
3298                 /* event not enabled */
3299                 return;
3300         }
3301         if ((stcb->asoc.peer_req_out) && flag) {
3302                 /* Peer made the request, don't tell the local user */
3303                 stcb->asoc.peer_req_out = 0;
3304                 return;
3305         }
3306         stcb->asoc.peer_req_out = 0;
3307         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
3308         if (m_notify == NULL)
3309                 /* no space left */
3310                 return;
3311         SCTP_BUF_LEN(m_notify) = 0;
3312         len = sizeof(struct sctp_stream_change_event);
3313         if (len > M_TRAILINGSPACE(m_notify)) {
3314                 /* never enough room */
3315                 sctp_m_freem(m_notify);
3316                 return;
3317         }
3318         stradd = mtod(m_notify, struct sctp_stream_change_event *);
3319         stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT;
3320         stradd->strchange_flags = flag;
3321         stradd->strchange_length = len;
3322         stradd->strchange_assoc_id = sctp_get_associd(stcb);
3323         stradd->strchange_instrms = numberin;
3324         stradd->strchange_outstrms = numberout;
3325         SCTP_BUF_LEN(m_notify) = len;
3326         SCTP_BUF_NEXT(m_notify) = NULL;
3327         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3328                 /* no space */
3329                 sctp_m_freem(m_notify);
3330                 return;
3331         }
3332         /* append to socket */
3333         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3334             0, 0, stcb->asoc.context, 0, 0, 0,
3335             m_notify);
3336         if (control == NULL) {
3337                 /* no memory */
3338                 sctp_m_freem(m_notify);
3339                 return;
3340         }
3341         control->spec_flags = M_NOTIFICATION;
3342         control->length = SCTP_BUF_LEN(m_notify);
3343         /* not that we need this */
3344         control->tail_mbuf = m_notify;
3345         sctp_add_to_readq(stcb->sctp_ep, stcb,
3346             control,
3347             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3348 }
3349
3350 void
3351 sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb, uint32_t sending_tsn, uint32_t recv_tsn, int flag)
3352 {
3353         struct mbuf *m_notify;
3354         struct sctp_queued_to_read *control;
3355         struct sctp_assoc_reset_event *strasoc;
3356         int len;
3357
3358         if ((stcb == NULL) ||
3359             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT))) {
3360                 /* event not enabled */
3361                 return;
3362         }
3363         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
3364         if (m_notify == NULL)
3365                 /* no space left */
3366                 return;
3367         SCTP_BUF_LEN(m_notify) = 0;
3368         len = sizeof(struct sctp_assoc_reset_event);
3369         if (len > M_TRAILINGSPACE(m_notify)) {
3370                 /* never enough room */
3371                 sctp_m_freem(m_notify);
3372                 return;
3373         }
3374         strasoc = mtod(m_notify, struct sctp_assoc_reset_event *);
3375         strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT;
3376         strasoc->assocreset_flags = flag;
3377         strasoc->assocreset_length = len;
3378         strasoc->assocreset_assoc_id = sctp_get_associd(stcb);
3379         strasoc->assocreset_local_tsn = sending_tsn;
3380         strasoc->assocreset_remote_tsn = recv_tsn;
3381         SCTP_BUF_LEN(m_notify) = len;
3382         SCTP_BUF_NEXT(m_notify) = NULL;
3383         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3384                 /* no space */
3385                 sctp_m_freem(m_notify);
3386                 return;
3387         }
3388         /* append to socket */
3389         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3390             0, 0, stcb->asoc.context, 0, 0, 0,
3391             m_notify);
3392         if (control == NULL) {
3393                 /* no memory */
3394                 sctp_m_freem(m_notify);
3395                 return;
3396         }
3397         control->spec_flags = M_NOTIFICATION;
3398         control->length = SCTP_BUF_LEN(m_notify);
3399         /* not that we need this */
3400         control->tail_mbuf = m_notify;
3401         sctp_add_to_readq(stcb->sctp_ep, stcb,
3402             control,
3403             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3404 }
3405
3406
3407
3408 static void
3409 sctp_notify_stream_reset(struct sctp_tcb *stcb,
3410     int number_entries, uint16_t * list, int flag)
3411 {
3412         struct mbuf *m_notify;
3413         struct sctp_queued_to_read *control;
3414         struct sctp_stream_reset_event *strreset;
3415         int len;
3416
3417         if ((stcb == NULL) ||
3418             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_RESETEVNT))) {
3419                 /* event not enabled */
3420                 return;
3421         }
3422         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
3423         if (m_notify == NULL)
3424                 /* no space left */
3425                 return;
3426         SCTP_BUF_LEN(m_notify) = 0;
3427         len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
3428         if (len > M_TRAILINGSPACE(m_notify)) {
3429                 /* never enough room */
3430                 sctp_m_freem(m_notify);
3431                 return;
3432         }
3433         strreset = mtod(m_notify, struct sctp_stream_reset_event *);
3434         strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
3435         strreset->strreset_flags = flag;
3436         strreset->strreset_length = len;
3437         strreset->strreset_assoc_id = sctp_get_associd(stcb);
3438         if (number_entries) {
3439                 int i;
3440
3441                 for (i = 0; i < number_entries; i++) {
3442                         strreset->strreset_stream_list[i] = ntohs(list[i]);
3443                 }
3444         }
3445         SCTP_BUF_LEN(m_notify) = len;
3446         SCTP_BUF_NEXT(m_notify) = NULL;
3447         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3448                 /* no space */
3449                 sctp_m_freem(m_notify);
3450                 return;
3451         }
3452         /* append to socket */
3453         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3454             0, 0, stcb->asoc.context, 0, 0, 0,
3455             m_notify);
3456         if (control == NULL) {
3457                 /* no memory */
3458                 sctp_m_freem(m_notify);
3459                 return;
3460         }
3461         control->spec_flags = M_NOTIFICATION;
3462         control->length = SCTP_BUF_LEN(m_notify);
3463         /* not that we need this */
3464         control->tail_mbuf = m_notify;
3465         sctp_add_to_readq(stcb->sctp_ep, stcb,
3466             control,
3467             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3468 }
3469
3470
3471 void
3472 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb,
3473     uint32_t error, void *data, int so_locked
3474 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3475     SCTP_UNUSED
3476 #endif
3477 )
3478 {
3479         if ((stcb == NULL) ||
3480             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3481             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3482             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3483                 /* If the socket is gone we are out of here */
3484                 return;
3485         }
3486         if (stcb->sctp_socket->so_rcv.sb_state & SBS_CANTRCVMORE) {
3487                 return;
3488         }
3489         if (stcb && ((stcb->asoc.state & SCTP_STATE_COOKIE_WAIT) ||
3490             (stcb->asoc.state & SCTP_STATE_COOKIE_ECHOED))) {
3491                 if ((notification == SCTP_NOTIFY_INTERFACE_DOWN) ||
3492                     (notification == SCTP_NOTIFY_INTERFACE_UP) ||
3493                     (notification == SCTP_NOTIFY_INTERFACE_CONFIRMED)) {
3494                         /* Don't report these in front states */
3495                         return;
3496                 }
3497         }
3498         switch (notification) {
3499         case SCTP_NOTIFY_ASSOC_UP:
3500                 if (stcb->asoc.assoc_up_sent == 0) {
3501                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, NULL, 0, so_locked);
3502                         stcb->asoc.assoc_up_sent = 1;
3503                 }
3504                 if (stcb->asoc.adaptation_needed && (stcb->asoc.adaptation_sent == 0)) {
3505                         sctp_notify_adaptation_layer(stcb);
3506                 }
3507                 if (stcb->asoc.peer_supports_auth == 0) {
3508                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3509                             NULL, so_locked);
3510                 }
3511                 break;
3512         case SCTP_NOTIFY_ASSOC_DOWN:
3513                 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, NULL, 0, so_locked);
3514                 break;
3515         case SCTP_NOTIFY_INTERFACE_DOWN:
3516                 {
3517                         struct sctp_nets *net;
3518
3519                         net = (struct sctp_nets *)data;
3520                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE,
3521                             (struct sockaddr *)&net->ro._l_addr, error);
3522                         break;
3523                 }
3524         case SCTP_NOTIFY_INTERFACE_UP:
3525                 {
3526                         struct sctp_nets *net;
3527
3528                         net = (struct sctp_nets *)data;
3529                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE,
3530                             (struct sockaddr *)&net->ro._l_addr, error);
3531                         break;
3532                 }
3533         case SCTP_NOTIFY_INTERFACE_CONFIRMED:
3534                 {
3535                         struct sctp_nets *net;
3536
3537                         net = (struct sctp_nets *)data;
3538                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED,
3539                             (struct sockaddr *)&net->ro._l_addr, error);
3540                         break;
3541                 }
3542         case SCTP_NOTIFY_SPECIAL_SP_FAIL:
3543                 sctp_notify_send_failed2(stcb, error,
3544                     (struct sctp_stream_queue_pending *)data, so_locked);
3545                 break;
3546         case SCTP_NOTIFY_DG_FAIL:
3547                 sctp_notify_send_failed(stcb, error,
3548                     (struct sctp_tmit_chunk *)data, so_locked);
3549                 break;
3550         case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION:
3551                 {
3552                         uint32_t val;
3553
3554                         val = *((uint32_t *) data);
3555
3556                         sctp_notify_partial_delivery_indication(stcb, error, val, so_locked);
3557                         break;
3558                 }
3559         case SCTP_NOTIFY_STRDATA_ERR:
3560                 break;
3561         case SCTP_NOTIFY_ASSOC_LOC_ABORTED:
3562                 if ((stcb) && (((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_WAIT) ||
3563                     ((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_ECHOED))) {
3564                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 0, so_locked);
3565                 } else {
3566                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 0, so_locked);
3567                 }
3568                 break;
3569         case SCTP_NOTIFY_ASSOC_REM_ABORTED:
3570                 if ((stcb) && (((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_WAIT) ||
3571                     ((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_ECHOED))) {
3572                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 1, so_locked);
3573                 } else {
3574                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 1, so_locked);
3575                 }
3576                 break;
3577         case SCTP_NOTIFY_PEER_OPENED_STREAM:
3578                 break;
3579         case SCTP_NOTIFY_STREAM_OPENED_OK:
3580                 break;
3581         case SCTP_NOTIFY_ASSOC_RESTART:
3582                 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, NULL, 0, so_locked);
3583                 if (stcb->asoc.peer_supports_auth == 0) {
3584                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3585                             NULL, so_locked);
3586                 }
3587                 break;
3588         case SCTP_NOTIFY_HB_RESP:
3589                 break;
3590         case SCTP_NOTIFY_STR_RESET_SEND:
3591                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STREAM_RESET_OUTGOING_SSN);
3592                 break;
3593         case SCTP_NOTIFY_STR_RESET_RECV:
3594                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STREAM_RESET_INCOMING);
3595                 break;
3596         case SCTP_NOTIFY_STR_RESET_FAILED_OUT:
3597                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3598                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_FAILED));
3599                 break;
3600         case SCTP_NOTIFY_STR_RESET_DENIED_OUT:
3601                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3602                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_DENIED));
3603                 break;
3604         case SCTP_NOTIFY_STR_RESET_FAILED_IN:
3605                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3606                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_FAILED));
3607                 break;
3608         case SCTP_NOTIFY_STR_RESET_DENIED_IN:
3609                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3610                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_DENIED));
3611                 break;
3612         case SCTP_NOTIFY_ASCONF_ADD_IP:
3613                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data,
3614                     error);
3615                 break;
3616         case SCTP_NOTIFY_ASCONF_DELETE_IP:
3617                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data,
3618                     error);
3619                 break;
3620         case SCTP_NOTIFY_ASCONF_SET_PRIMARY:
3621                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data,
3622                     error);
3623                 break;
3624         case SCTP_NOTIFY_ASCONF_SUCCESS:
3625                 break;
3626         case SCTP_NOTIFY_ASCONF_FAILED:
3627                 break;
3628         case SCTP_NOTIFY_PEER_SHUTDOWN:
3629                 sctp_notify_shutdown_event(stcb);
3630                 break;
3631         case SCTP_NOTIFY_AUTH_NEW_KEY:
3632                 sctp_notify_authentication(stcb, SCTP_AUTH_NEW_KEY, error,
3633                     (uint16_t) (uintptr_t) data,
3634                     so_locked);
3635                 break;
3636         case SCTP_NOTIFY_AUTH_FREE_KEY:
3637                 sctp_notify_authentication(stcb, SCTP_AUTH_FREE_KEY, error,
3638                     (uint16_t) (uintptr_t) data,
3639                     so_locked);
3640                 break;
3641         case SCTP_NOTIFY_NO_PEER_AUTH:
3642                 sctp_notify_authentication(stcb, SCTP_AUTH_NO_AUTH, error,
3643                     (uint16_t) (uintptr_t) data,
3644                     so_locked);
3645                 break;
3646         case SCTP_NOTIFY_SENDER_DRY:
3647                 sctp_notify_sender_dry_event(stcb, so_locked);
3648                 break;
3649         default:
3650                 SCTPDBG(SCTP_DEBUG_UTIL1, "%s: unknown notification %xh (%u)\n",
3651                     __FUNCTION__, notification, notification);
3652                 break;
3653         }                       /* end switch */
3654 }
3655
3656 void
3657 sctp_report_all_outbound(struct sctp_tcb *stcb, int holds_lock, int so_locked
3658 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3659     SCTP_UNUSED
3660 #endif
3661 )
3662 {
3663         struct sctp_association *asoc;
3664         struct sctp_stream_out *outs;
3665         struct sctp_tmit_chunk *chk, *nchk;
3666         struct sctp_stream_queue_pending *sp, *nsp;
3667         int i;
3668
3669         if (stcb == NULL) {
3670                 return;
3671         }
3672         asoc = &stcb->asoc;
3673         if (asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) {
3674                 /* already being freed */
3675                 return;
3676         }
3677         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3678             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3679             (asoc->state & SCTP_STATE_CLOSED_SOCKET)) {
3680                 return;
3681         }
3682         /* now through all the gunk freeing chunks */
3683         if (holds_lock == 0) {
3684                 SCTP_TCB_SEND_LOCK(stcb);
3685         }
3686         /* sent queue SHOULD be empty */
3687         TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) {
3688                 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
3689                 asoc->sent_queue_cnt--;
3690                 if (chk->data != NULL) {
3691                         sctp_free_bufspace(stcb, asoc, chk, 1);
3692                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
3693                             SCTP_NOTIFY_DATAGRAM_SENT, chk, so_locked);
3694                         if (chk->data) {
3695                                 sctp_m_freem(chk->data);
3696                                 chk->data = NULL;
3697                         }
3698                 }
3699                 sctp_free_a_chunk(stcb, chk, so_locked);
3700                 /* sa_ignore FREED_MEMORY */
3701         }
3702         /* pending send queue SHOULD be empty */
3703         TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
3704                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
3705                 asoc->send_queue_cnt--;
3706                 if (chk->data != NULL) {
3707                         sctp_free_bufspace(stcb, asoc, chk, 1);
3708                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
3709                             SCTP_NOTIFY_DATAGRAM_UNSENT, chk, so_locked);
3710                         if (chk->data) {
3711                                 sctp_m_freem(chk->data);
3712                                 chk->data = NULL;
3713                         }
3714                 }
3715                 sctp_free_a_chunk(stcb, chk, so_locked);
3716                 /* sa_ignore FREED_MEMORY */
3717         }
3718         for (i = 0; i < asoc->streamoutcnt; i++) {
3719                 /* For each stream */
3720                 outs = &asoc->strmout[i];
3721                 /* clean up any sends there */
3722                 asoc->locked_on_sending = NULL;
3723                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
3724                         asoc->stream_queue_cnt--;
3725                         TAILQ_REMOVE(&outs->outqueue, sp, next);
3726                         sctp_free_spbufspace(stcb, asoc, sp);
3727                         if (sp->data) {
3728                                 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
3729                                     SCTP_NOTIFY_DATAGRAM_UNSENT, (void *)sp, so_locked);
3730                                 if (sp->data) {
3731                                         sctp_m_freem(sp->data);
3732                                         sp->data = NULL;
3733                                 }
3734                         }
3735                         if (sp->net) {
3736                                 sctp_free_remote_addr(sp->net);
3737                                 sp->net = NULL;
3738                         }
3739                         /* Free the chunk */
3740                         sctp_free_a_strmoq(stcb, sp, so_locked);
3741                         /* sa_ignore FREED_MEMORY */
3742                 }
3743         }
3744
3745         if (holds_lock == 0) {
3746                 SCTP_TCB_SEND_UNLOCK(stcb);
3747         }
3748 }
3749
3750 void
3751 sctp_abort_notification(struct sctp_tcb *stcb, uint8_t from_peer, uint16_t error,
3752     struct sctp_abort_chunk *abort, int so_locked
3753 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3754     SCTP_UNUSED
3755 #endif
3756 )
3757 {
3758         if (stcb == NULL) {
3759                 return;
3760         }
3761         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
3762             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
3763             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
3764                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED;
3765         }
3766         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3767             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3768             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3769                 return;
3770         }
3771         /* Tell them we lost the asoc */
3772         sctp_report_all_outbound(stcb, 1, so_locked);
3773         if (from_peer) {
3774                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_REM_ABORTED, stcb, error, abort, so_locked);
3775         } else {
3776                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_LOC_ABORTED, stcb, error, abort, so_locked);
3777         }
3778 }
3779
3780 void
3781 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3782     struct mbuf *m, int iphlen, struct sctphdr *sh, struct mbuf *op_err,
3783     uint32_t vrf_id, uint16_t port)
3784 {
3785         uint32_t vtag;
3786
3787 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3788         struct socket *so;
3789
3790 #endif
3791
3792         vtag = 0;
3793         if (stcb != NULL) {
3794                 /* We have a TCB to abort, send notification too */
3795                 vtag = stcb->asoc.peer_vtag;
3796                 sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED);
3797                 /* get the assoc vrf id and table id */
3798                 vrf_id = stcb->asoc.vrf_id;
3799                 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
3800         }
3801         sctp_send_abort(m, iphlen, sh, vtag, op_err, vrf_id, port);
3802         if (stcb != NULL) {
3803                 /* Ok, now lets free it */
3804 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3805                 so = SCTP_INP_SO(inp);
3806                 atomic_add_int(&stcb->asoc.refcnt, 1);
3807                 SCTP_TCB_UNLOCK(stcb);
3808                 SCTP_SOCKET_LOCK(so, 1);
3809                 SCTP_TCB_LOCK(stcb);
3810                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3811 #endif
3812                 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3813                 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
3814                     (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3815                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3816                 }
3817                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_4);
3818 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3819                 SCTP_SOCKET_UNLOCK(so, 1);
3820 #endif
3821         }
3822 }
3823
3824 #ifdef SCTP_ASOCLOG_OF_TSNS
3825 void
3826 sctp_print_out_track_log(struct sctp_tcb *stcb)
3827 {
3828 #ifdef NOSIY_PRINTS
3829         int i;
3830
3831         SCTP_PRINTF("Last ep reason:%x\n", stcb->sctp_ep->last_abort_code);
3832         SCTP_PRINTF("IN bound TSN log-aaa\n");
3833         if ((stcb->asoc.tsn_in_at == 0) && (stcb->asoc.tsn_in_wrapped == 0)) {
3834                 SCTP_PRINTF("None rcvd\n");
3835                 goto none_in;
3836         }
3837         if (stcb->asoc.tsn_in_wrapped) {
3838                 for (i = stcb->asoc.tsn_in_at; i < SCTP_TSN_LOG_SIZE; i++) {
3839                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3840                             stcb->asoc.in_tsnlog[i].tsn,
3841                             stcb->asoc.in_tsnlog[i].strm,
3842                             stcb->asoc.in_tsnlog[i].seq,
3843                             stcb->asoc.in_tsnlog[i].flgs,
3844                             stcb->asoc.in_tsnlog[i].sz);
3845                 }
3846         }
3847         if (stcb->asoc.tsn_in_at) {
3848                 for (i = 0; i < stcb->asoc.tsn_in_at; i++) {
3849                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3850                             stcb->asoc.in_tsnlog[i].tsn,
3851                             stcb->asoc.in_tsnlog[i].strm,
3852                             stcb->asoc.in_tsnlog[i].seq,
3853                             stcb->asoc.in_tsnlog[i].flgs,
3854                             stcb->asoc.in_tsnlog[i].sz);
3855                 }
3856         }
3857 none_in:
3858         SCTP_PRINTF("OUT bound TSN log-aaa\n");
3859         if ((stcb->asoc.tsn_out_at == 0) &&
3860             (stcb->asoc.tsn_out_wrapped == 0)) {
3861                 SCTP_PRINTF("None sent\n");
3862         }
3863         if (stcb->asoc.tsn_out_wrapped) {
3864                 for (i = stcb->asoc.tsn_out_at; i < SCTP_TSN_LOG_SIZE; i++) {
3865                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3866                             stcb->asoc.out_tsnlog[i].tsn,
3867                             stcb->asoc.out_tsnlog[i].strm,
3868                             stcb->asoc.out_tsnlog[i].seq,
3869                             stcb->asoc.out_tsnlog[i].flgs,
3870                             stcb->asoc.out_tsnlog[i].sz);
3871                 }
3872         }
3873         if (stcb->asoc.tsn_out_at) {
3874                 for (i = 0; i < stcb->asoc.tsn_out_at; i++) {
3875                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3876                             stcb->asoc.out_tsnlog[i].tsn,
3877                             stcb->asoc.out_tsnlog[i].strm,
3878                             stcb->asoc.out_tsnlog[i].seq,
3879                             stcb->asoc.out_tsnlog[i].flgs,
3880                             stcb->asoc.out_tsnlog[i].sz);
3881                 }
3882         }
3883 #endif
3884 }
3885
3886 #endif
3887
3888 void
3889 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3890     struct mbuf *op_err,
3891     int so_locked
3892 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3893     SCTP_UNUSED
3894 #endif
3895 )
3896 {
3897 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3898         struct socket *so;
3899
3900 #endif
3901
3902 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3903         so = SCTP_INP_SO(inp);
3904 #endif
3905         if (stcb == NULL) {
3906                 /* Got to have a TCB */
3907                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3908                         if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
3909                                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
3910                                     SCTP_CALLED_DIRECTLY_NOCMPSET);
3911                         }
3912                 }
3913                 return;
3914         } else {
3915                 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
3916         }
3917         /* notify the ulp */
3918         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) {
3919                 sctp_abort_notification(stcb, 0, 0, NULL, so_locked);
3920         }
3921         /* notify the peer */
3922         sctp_send_abort_tcb(stcb, op_err, so_locked);
3923         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3924         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
3925             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3926                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3927         }
3928         /* now free the asoc */
3929 #ifdef SCTP_ASOCLOG_OF_TSNS
3930         sctp_print_out_track_log(stcb);
3931 #endif
3932 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3933         if (!so_locked) {
3934                 atomic_add_int(&stcb->asoc.refcnt, 1);
3935                 SCTP_TCB_UNLOCK(stcb);
3936                 SCTP_SOCKET_LOCK(so, 1);
3937                 SCTP_TCB_LOCK(stcb);
3938                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3939         }
3940 #endif
3941         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_5);
3942 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3943         if (!so_locked) {
3944                 SCTP_SOCKET_UNLOCK(so, 1);
3945         }
3946 #endif
3947 }
3948
3949 void
3950 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh,
3951     struct sctp_inpcb *inp, struct mbuf *op_err, uint32_t vrf_id, uint16_t port)
3952 {
3953         struct sctp_chunkhdr *ch, chunk_buf;
3954         unsigned int chk_length;
3955         int contains_init_chunk;
3956
3957         SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue);
3958         /* Generate a TO address for future reference */
3959         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
3960                 if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
3961                         sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
3962                             SCTP_CALLED_DIRECTLY_NOCMPSET);
3963                 }
3964         }
3965         contains_init_chunk = 0;
3966         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
3967             sizeof(*ch), (uint8_t *) & chunk_buf);
3968         while (ch != NULL) {
3969                 chk_length = ntohs(ch->chunk_length);
3970                 if (chk_length < sizeof(*ch)) {
3971                         /* break to abort land */
3972                         break;
3973                 }
3974                 switch (ch->chunk_type) {
3975                 case SCTP_INIT:
3976                         contains_init_chunk = 1;
3977                         break;
3978                 case SCTP_COOKIE_ECHO:
3979                         /* We hit here only if the assoc is being freed */
3980                         return;
3981                 case SCTP_PACKET_DROPPED:
3982                         /* we don't respond to pkt-dropped */
3983                         return;
3984                 case SCTP_ABORT_ASSOCIATION:
3985                         /* we don't respond with an ABORT to an ABORT */
3986                         return;
3987                 case SCTP_SHUTDOWN_COMPLETE:
3988                         /*
3989                          * we ignore it since we are not waiting for it and
3990                          * peer is gone
3991                          */
3992                         return;
3993                 case SCTP_SHUTDOWN_ACK:
3994                         sctp_send_shutdown_complete2(m, sh, vrf_id, port);
3995                         return;
3996                 default:
3997                         break;
3998                 }
3999                 offset += SCTP_SIZE32(chk_length);
4000                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4001                     sizeof(*ch), (uint8_t *) & chunk_buf);
4002         }
4003         if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
4004             ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
4005             (contains_init_chunk == 0))) {
4006                 sctp_send_abort(m, iphlen, sh, 0, op_err, vrf_id, port);
4007         }
4008 }
4009
4010 /*
4011  * check the inbound datagram to make sure there is not an abort inside it,
4012  * if there is return 1, else return 0.
4013  */
4014 int
4015 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t * vtagfill)
4016 {
4017         struct sctp_chunkhdr *ch;
4018         struct sctp_init_chunk *init_chk, chunk_buf;
4019         int offset;
4020         unsigned int chk_length;
4021
4022         offset = iphlen + sizeof(struct sctphdr);
4023         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch),
4024             (uint8_t *) & chunk_buf);
4025         while (ch != NULL) {
4026                 chk_length = ntohs(ch->chunk_length);
4027                 if (chk_length < sizeof(*ch)) {
4028                         /* packet is probably corrupt */
4029                         break;
4030                 }
4031                 /* we seem to be ok, is it an abort? */
4032                 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) {
4033                         /* yep, tell them */
4034                         return (1);
4035                 }
4036                 if (ch->chunk_type == SCTP_INITIATION) {
4037                         /* need to update the Vtag */
4038                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
4039                             offset, sizeof(*init_chk), (uint8_t *) & chunk_buf);
4040                         if (init_chk != NULL) {
4041                                 *vtagfill = ntohl(init_chk->init.initiate_tag);
4042                         }
4043                 }
4044                 /* Nope, move to the next chunk */
4045                 offset += SCTP_SIZE32(chk_length);
4046                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4047                     sizeof(*ch), (uint8_t *) & chunk_buf);
4048         }
4049         return (0);
4050 }
4051
4052 /*
4053  * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id
4054  * set (i.e. it's 0) so, create this function to compare link local scopes
4055  */
4056 #ifdef INET6
4057 uint32_t
4058 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2)
4059 {
4060         struct sockaddr_in6 a, b;
4061
4062         /* save copies */
4063         a = *addr1;
4064         b = *addr2;
4065
4066         if (a.sin6_scope_id == 0)
4067                 if (sa6_recoverscope(&a)) {
4068                         /* can't get scope, so can't match */
4069                         return (0);
4070                 }
4071         if (b.sin6_scope_id == 0)
4072                 if (sa6_recoverscope(&b)) {
4073                         /* can't get scope, so can't match */
4074                         return (0);
4075                 }
4076         if (a.sin6_scope_id != b.sin6_scope_id)
4077                 return (0);
4078
4079         return (1);
4080 }
4081
4082 /*
4083  * returns a sockaddr_in6 with embedded scope recovered and removed
4084  */
4085 struct sockaddr_in6 *
4086 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store)
4087 {
4088         /* check and strip embedded scope junk */
4089         if (addr->sin6_family == AF_INET6) {
4090                 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) {
4091                         if (addr->sin6_scope_id == 0) {
4092                                 *store = *addr;
4093                                 if (!sa6_recoverscope(store)) {
4094                                         /* use the recovered scope */
4095                                         addr = store;
4096                                 }
4097                         } else {
4098                                 /* else, return the original "to" addr */
4099                                 in6_clearscope(&addr->sin6_addr);
4100                         }
4101                 }
4102         }
4103         return (addr);
4104 }
4105
4106 #endif
4107
4108 /*
4109  * are the two addresses the same?  currently a "scopeless" check returns: 1
4110  * if same, 0 if not
4111  */
4112 int
4113 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2)
4114 {
4115
4116         /* must be valid */
4117         if (sa1 == NULL || sa2 == NULL)
4118                 return (0);
4119
4120         /* must be the same family */
4121         if (sa1->sa_family != sa2->sa_family)
4122                 return (0);
4123
4124         switch (sa1->sa_family) {
4125 #ifdef INET6
4126         case AF_INET6:
4127                 {
4128                         /* IPv6 addresses */
4129                         struct sockaddr_in6 *sin6_1, *sin6_2;
4130
4131                         sin6_1 = (struct sockaddr_in6 *)sa1;
4132                         sin6_2 = (struct sockaddr_in6 *)sa2;
4133                         return (SCTP6_ARE_ADDR_EQUAL(sin6_1,
4134                             sin6_2));
4135                 }
4136 #endif
4137 #ifdef INET
4138         case AF_INET:
4139                 {
4140                         /* IPv4 addresses */
4141                         struct sockaddr_in *sin_1, *sin_2;
4142
4143                         sin_1 = (struct sockaddr_in *)sa1;
4144                         sin_2 = (struct sockaddr_in *)sa2;
4145                         return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr);
4146                 }
4147 #endif
4148         default:
4149                 /* we don't do these... */
4150                 return (0);
4151         }
4152 }
4153
4154 void
4155 sctp_print_address(struct sockaddr *sa)
4156 {
4157 #ifdef INET6
4158         char ip6buf[INET6_ADDRSTRLEN];
4159
4160         ip6buf[0] = 0;
4161 #endif
4162
4163         switch (sa->sa_family) {
4164 #ifdef INET6
4165         case AF_INET6:
4166                 {
4167                         struct sockaddr_in6 *sin6;
4168
4169                         sin6 = (struct sockaddr_in6 *)sa;
4170                         SCTP_PRINTF("IPv6 address: %s:port:%d scope:%u\n",
4171                             ip6_sprintf(ip6buf, &sin6->sin6_addr),
4172                             ntohs(sin6->sin6_port),
4173                             sin6->sin6_scope_id);
4174                         break;
4175                 }
4176 #endif
4177 #ifdef INET
4178         case AF_INET:
4179                 {
4180                         struct sockaddr_in *sin;
4181                         unsigned char *p;
4182
4183                         sin = (struct sockaddr_in *)sa;
4184                         p = (unsigned char *)&sin->sin_addr;
4185                         SCTP_PRINTF("IPv4 address: %u.%u.%u.%u:%d\n",
4186                             p[0], p[1], p[2], p[3], ntohs(sin->sin_port));
4187                         break;
4188                 }
4189 #endif
4190         default:
4191                 SCTP_PRINTF("?\n");
4192                 break;
4193         }
4194 }
4195
4196 void
4197 sctp_print_address_pkt(struct ip *iph, struct sctphdr *sh)
4198 {
4199         switch (iph->ip_v) {
4200 #ifdef INET
4201         case IPVERSION:
4202                 {
4203                         struct sockaddr_in lsa, fsa;
4204
4205                         bzero(&lsa, sizeof(lsa));
4206                         lsa.sin_len = sizeof(lsa);
4207                         lsa.sin_family = AF_INET;
4208                         lsa.sin_addr = iph->ip_src;
4209                         lsa.sin_port = sh->src_port;
4210                         bzero(&fsa, sizeof(fsa));
4211                         fsa.sin_len = sizeof(fsa);
4212                         fsa.sin_family = AF_INET;
4213                         fsa.sin_addr = iph->ip_dst;
4214                         fsa.sin_port = sh->dest_port;
4215                         SCTP_PRINTF("src: ");
4216                         sctp_print_address((struct sockaddr *)&lsa);
4217                         SCTP_PRINTF("dest: ");
4218                         sctp_print_address((struct sockaddr *)&fsa);
4219                         break;
4220                 }
4221 #endif
4222 #ifdef INET6
4223         case IPV6_VERSION >> 4:
4224                 {
4225                         struct ip6_hdr *ip6;
4226                         struct sockaddr_in6 lsa6, fsa6;
4227
4228                         ip6 = (struct ip6_hdr *)iph;
4229                         bzero(&lsa6, sizeof(lsa6));
4230                         lsa6.sin6_len = sizeof(lsa6);
4231                         lsa6.sin6_family = AF_INET6;
4232                         lsa6.sin6_addr = ip6->ip6_src;
4233                         lsa6.sin6_port = sh->src_port;
4234                         bzero(&fsa6, sizeof(fsa6));
4235                         fsa6.sin6_len = sizeof(fsa6);
4236                         fsa6.sin6_family = AF_INET6;
4237                         fsa6.sin6_addr = ip6->ip6_dst;
4238                         fsa6.sin6_port = sh->dest_port;
4239                         SCTP_PRINTF("src: ");
4240                         sctp_print_address((struct sockaddr *)&lsa6);
4241                         SCTP_PRINTF("dest: ");
4242                         sctp_print_address((struct sockaddr *)&fsa6);
4243                         break;
4244                 }
4245 #endif
4246         default:
4247                 /* TSNH */
4248                 break;
4249         }
4250 }
4251
4252 void
4253 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
4254     struct sctp_inpcb *new_inp,
4255     struct sctp_tcb *stcb,
4256     int waitflags)
4257 {
4258         /*
4259          * go through our old INP and pull off any control structures that
4260          * belong to stcb and move then to the new inp.
4261          */
4262         struct socket *old_so, *new_so;
4263         struct sctp_queued_to_read *control, *nctl;
4264         struct sctp_readhead tmp_queue;
4265         struct mbuf *m;
4266         int error = 0;
4267
4268         old_so = old_inp->sctp_socket;
4269         new_so = new_inp->sctp_socket;
4270         TAILQ_INIT(&tmp_queue);
4271         error = sblock(&old_so->so_rcv, waitflags);
4272         if (error) {
4273                 /*
4274                  * Gak, can't get sblock, we have a problem. data will be
4275                  * left stranded.. and we don't dare look at it since the
4276                  * other thread may be reading something. Oh well, its a
4277                  * screwed up app that does a peeloff OR a accept while
4278                  * reading from the main socket... actually its only the
4279                  * peeloff() case, since I think read will fail on a
4280                  * listening socket..
4281                  */
4282                 return;
4283         }
4284         /* lock the socket buffers */
4285         SCTP_INP_READ_LOCK(old_inp);
4286         TAILQ_FOREACH_SAFE(control, &old_inp->read_queue, next, nctl) {
4287                 /* Pull off all for out target stcb */
4288                 if (control->stcb == stcb) {
4289                         /* remove it we want it */
4290                         TAILQ_REMOVE(&old_inp->read_queue, control, next);
4291                         TAILQ_INSERT_TAIL(&tmp_queue, control, next);
4292                         m = control->data;
4293                         while (m) {
4294                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4295                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
4296                                 }
4297                                 sctp_sbfree(control, stcb, &old_so->so_rcv, m);
4298                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4299                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4300                                 }
4301                                 m = SCTP_BUF_NEXT(m);
4302                         }
4303                 }
4304         }
4305         SCTP_INP_READ_UNLOCK(old_inp);
4306         /* Remove the sb-lock on the old socket */
4307
4308         sbunlock(&old_so->so_rcv);
4309         /* Now we move them over to the new socket buffer */
4310         SCTP_INP_READ_LOCK(new_inp);
4311         TAILQ_FOREACH_SAFE(control, &tmp_queue, next, nctl) {
4312                 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next);
4313                 m = control->data;
4314                 while (m) {
4315                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4316                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4317                         }
4318                         sctp_sballoc(stcb, &new_so->so_rcv, m);
4319                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4320                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4321                         }
4322                         m = SCTP_BUF_NEXT(m);
4323                 }
4324         }
4325         SCTP_INP_READ_UNLOCK(new_inp);
4326 }
4327
4328 void
4329 sctp_add_to_readq(struct sctp_inpcb *inp,
4330     struct sctp_tcb *stcb,
4331     struct sctp_queued_to_read *control,
4332     struct sockbuf *sb,
4333     int end,
4334     int inp_read_lock_held,
4335     int so_locked
4336 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4337     SCTP_UNUSED
4338 #endif
4339 )
4340 {
4341         /*
4342          * Here we must place the control on the end of the socket read
4343          * queue AND increment sb_cc so that select will work properly on
4344          * read.
4345          */
4346         struct mbuf *m, *prev = NULL;
4347
4348         if (inp == NULL) {
4349                 /* Gak, TSNH!! */
4350 #ifdef INVARIANTS
4351                 panic("Gak, inp NULL on add_to_readq");
4352 #endif
4353                 return;
4354         }
4355         if (inp_read_lock_held == 0)
4356                 SCTP_INP_READ_LOCK(inp);
4357         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
4358                 sctp_free_remote_addr(control->whoFrom);
4359                 if (control->data) {
4360                         sctp_m_freem(control->data);
4361                         control->data = NULL;
4362                 }
4363                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_readq), control);
4364                 if (inp_read_lock_held == 0)
4365                         SCTP_INP_READ_UNLOCK(inp);
4366                 return;
4367         }
4368         if (!(control->spec_flags & M_NOTIFICATION)) {
4369                 atomic_add_int(&inp->total_recvs, 1);
4370                 if (!control->do_not_ref_stcb) {
4371                         atomic_add_int(&stcb->total_recvs, 1);
4372                 }
4373         }
4374         m = control->data;
4375         control->held_length = 0;
4376         control->length = 0;
4377         while (m) {
4378                 if (SCTP_BUF_LEN(m) == 0) {
4379                         /* Skip mbufs with NO length */
4380                         if (prev == NULL) {
4381                                 /* First one */
4382                                 control->data = sctp_m_free(m);
4383                                 m = control->data;
4384                         } else {
4385                                 SCTP_BUF_NEXT(prev) = sctp_m_free(m);
4386                                 m = SCTP_BUF_NEXT(prev);
4387                         }
4388                         if (m == NULL) {
4389                                 control->tail_mbuf = prev;
4390                         }
4391                         continue;
4392                 }
4393                 prev = m;
4394                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4395                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4396                 }
4397                 sctp_sballoc(stcb, sb, m);
4398                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4399                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4400                 }
4401                 atomic_add_int(&control->length, SCTP_BUF_LEN(m));
4402                 m = SCTP_BUF_NEXT(m);
4403         }
4404         if (prev != NULL) {
4405                 control->tail_mbuf = prev;
4406         } else {
4407                 /* Everything got collapsed out?? */
4408                 sctp_free_remote_addr(control->whoFrom);
4409                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_readq), control);
4410                 if (inp_read_lock_held == 0)
4411                         SCTP_INP_READ_UNLOCK(inp);
4412                 return;
4413         }
4414         if (end) {
4415                 control->end_added = 1;
4416         }
4417         TAILQ_INSERT_TAIL(&inp->read_queue, control, next);
4418         if (inp_read_lock_held == 0)
4419                 SCTP_INP_READ_UNLOCK(inp);
4420         if (inp && inp->sctp_socket) {
4421                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
4422                         SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket);
4423                 } else {
4424 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4425                         struct socket *so;
4426
4427                         so = SCTP_INP_SO(inp);
4428                         if (!so_locked) {
4429                                 if (stcb) {
4430                                         atomic_add_int(&stcb->asoc.refcnt, 1);
4431                                         SCTP_TCB_UNLOCK(stcb);
4432                                 }
4433                                 SCTP_SOCKET_LOCK(so, 1);
4434                                 if (stcb) {
4435                                         SCTP_TCB_LOCK(stcb);
4436                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
4437                                 }
4438                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4439                                         SCTP_SOCKET_UNLOCK(so, 1);
4440                                         return;
4441                                 }
4442                         }
4443 #endif
4444                         sctp_sorwakeup(inp, inp->sctp_socket);
4445 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4446                         if (!so_locked) {
4447                                 SCTP_SOCKET_UNLOCK(so, 1);
4448                         }
4449 #endif
4450                 }
4451         }
4452 }
4453
4454
4455 int
4456 sctp_append_to_readq(struct sctp_inpcb *inp,
4457     struct sctp_tcb *stcb,
4458     struct sctp_queued_to_read *control,
4459     struct mbuf *m,
4460     int end,
4461     int ctls_cumack,
4462     struct sockbuf *sb)
4463 {
4464         /*
4465          * A partial delivery API event is underway. OR we are appending on
4466          * the reassembly queue.
4467          *
4468          * If PDAPI this means we need to add m to the end of the data.
4469          * Increase the length in the control AND increment the sb_cc.
4470          * Otherwise sb is NULL and all we need to do is put it at the end
4471          * of the mbuf chain.
4472          */
4473         int len = 0;
4474         struct mbuf *mm, *tail = NULL, *prev = NULL;
4475
4476         if (inp) {
4477                 SCTP_INP_READ_LOCK(inp);
4478         }
4479         if (control == NULL) {
4480 get_out:
4481                 if (inp) {
4482                         SCTP_INP_READ_UNLOCK(inp);
4483                 }
4484                 return (-1);
4485         }
4486         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ)) {
4487                 SCTP_INP_READ_UNLOCK(inp);
4488                 return (0);
4489         }
4490         if (control->end_added) {
4491                 /* huh this one is complete? */
4492                 goto get_out;
4493         }
4494         mm = m;
4495         if (mm == NULL) {
4496                 goto get_out;
4497         }
4498         while (mm) {
4499                 if (SCTP_BUF_LEN(mm) == 0) {
4500                         /* Skip mbufs with NO lenght */
4501                         if (prev == NULL) {
4502                                 /* First one */
4503                                 m = sctp_m_free(mm);
4504                                 mm = m;
4505                         } else {
4506                                 SCTP_BUF_NEXT(prev) = sctp_m_free(mm);
4507                                 mm = SCTP_BUF_NEXT(prev);
4508                         }
4509                         continue;
4510                 }
4511                 prev = mm;
4512                 len += SCTP_BUF_LEN(mm);
4513                 if (sb) {
4514                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4515                                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(mm));
4516                         }
4517                         sctp_sballoc(stcb, sb, mm);
4518                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4519                                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4520                         }
4521                 }
4522                 mm = SCTP_BUF_NEXT(mm);
4523         }
4524         if (prev) {
4525                 tail = prev;
4526         } else {
4527                 /* Really there should always be a prev */
4528                 if (m == NULL) {
4529                         /* Huh nothing left? */
4530 #ifdef INVARIANTS
4531                         panic("Nothing left to add?");
4532 #else
4533                         goto get_out;
4534 #endif
4535                 }
4536                 tail = m;
4537         }
4538         if (control->tail_mbuf) {
4539                 /* append */
4540                 SCTP_BUF_NEXT(control->tail_mbuf) = m;
4541                 control->tail_mbuf = tail;
4542         } else {
4543                 /* nothing there */
4544 #ifdef INVARIANTS
4545                 if (control->data != NULL) {
4546                         panic("This should NOT happen");
4547                 }
4548 #endif
4549                 control->data = m;
4550                 control->tail_mbuf = tail;
4551         }
4552         atomic_add_int(&control->length, len);
4553         if (end) {
4554                 /* message is complete */
4555                 if (stcb && (control == stcb->asoc.control_pdapi)) {
4556                         stcb->asoc.control_pdapi = NULL;
4557                 }
4558                 control->held_length = 0;
4559                 control->end_added = 1;
4560         }
4561         if (stcb == NULL) {
4562                 control->do_not_ref_stcb = 1;
4563         }
4564         /*
4565          * When we are appending in partial delivery, the cum-ack is used
4566          * for the actual pd-api highest tsn on this mbuf. The true cum-ack
4567          * is populated in the outbound sinfo structure from the true cumack
4568          * if the association exists...
4569          */
4570         control->sinfo_tsn = control->sinfo_cumtsn = ctls_cumack;
4571         if (inp) {
4572                 SCTP_INP_READ_UNLOCK(inp);
4573         }
4574         if (inp && inp->sctp_socket) {
4575                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
4576                         SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket);
4577                 } else {
4578 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4579                         struct socket *so;
4580
4581                         so = SCTP_INP_SO(inp);
4582                         if (stcb) {
4583                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4584                                 SCTP_TCB_UNLOCK(stcb);
4585                         }
4586                         SCTP_SOCKET_LOCK(so, 1);
4587                         if (stcb) {
4588                                 SCTP_TCB_LOCK(stcb);
4589                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4590                         }
4591                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4592                                 SCTP_SOCKET_UNLOCK(so, 1);
4593                                 return (0);
4594                         }
4595 #endif
4596                         sctp_sorwakeup(inp, inp->sctp_socket);
4597 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4598                         SCTP_SOCKET_UNLOCK(so, 1);
4599 #endif
4600                 }
4601         }
4602         return (0);
4603 }
4604
4605
4606
4607 /*************HOLD THIS COMMENT FOR PATCH FILE OF
4608  *************ALTERNATE ROUTING CODE
4609  */
4610
4611 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF
4612  *************ALTERNATE ROUTING CODE
4613  */
4614
4615 struct mbuf *
4616 sctp_generate_invmanparam(int err)
4617 {
4618         /* Return a MBUF with a invalid mandatory parameter */
4619         struct mbuf *m;
4620
4621         m = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_DONTWAIT, 1, MT_DATA);
4622         if (m) {
4623                 struct sctp_paramhdr *ph;
4624
4625                 SCTP_BUF_LEN(m) = sizeof(struct sctp_paramhdr);
4626                 ph = mtod(m, struct sctp_paramhdr *);
4627                 ph->param_length = htons(sizeof(struct sctp_paramhdr));
4628                 ph->param_type = htons(err);
4629         }
4630         return (m);
4631 }
4632
4633 #ifdef SCTP_MBCNT_LOGGING
4634 void
4635 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc,
4636     struct sctp_tmit_chunk *tp1, int chk_cnt)
4637 {
4638         if (tp1->data == NULL) {
4639                 return;
4640         }
4641         asoc->chunks_on_out_queue -= chk_cnt;
4642         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBCNT_LOGGING_ENABLE) {
4643                 sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE,
4644                     asoc->total_output_queue_size,
4645                     tp1->book_size,
4646                     0,
4647                     tp1->mbcnt);
4648         }
4649         if (asoc->total_output_queue_size >= tp1->book_size) {
4650                 atomic_add_int(&asoc->total_output_queue_size, -tp1->book_size);
4651         } else {
4652                 asoc->total_output_queue_size = 0;
4653         }
4654
4655         if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) ||
4656             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) {
4657                 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) {
4658                         stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size;
4659                 } else {
4660                         stcb->sctp_socket->so_snd.sb_cc = 0;
4661
4662                 }
4663         }
4664 }
4665
4666 #endif
4667
4668 int
4669 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1,
4670     int reason, int so_locked
4671 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4672     SCTP_UNUSED
4673 #endif
4674 )
4675 {
4676         struct sctp_stream_out *strq;
4677         struct sctp_tmit_chunk *chk = NULL, *tp2;
4678         struct sctp_stream_queue_pending *sp;
4679         uint16_t stream = 0, seq = 0;
4680         uint8_t foundeom = 0;
4681         int ret_sz = 0;
4682         int notdone;
4683         int do_wakeup_routine = 0;
4684
4685         stream = tp1->rec.data.stream_number;
4686         seq = tp1->rec.data.stream_seq;
4687         do {
4688                 ret_sz += tp1->book_size;
4689                 if (tp1->data != NULL) {
4690                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4691                                 sctp_flight_size_decrease(tp1);
4692                                 sctp_total_flight_decrease(stcb, tp1);
4693                         }
4694                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4695                         stcb->asoc.peers_rwnd += tp1->send_size;
4696                         stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh);
4697                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, reason, tp1, so_locked);
4698                         if (tp1->data) {
4699                                 sctp_m_freem(tp1->data);
4700                                 tp1->data = NULL;
4701                         }
4702                         do_wakeup_routine = 1;
4703                         if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
4704                                 stcb->asoc.sent_queue_cnt_removeable--;
4705                         }
4706                 }
4707                 tp1->sent = SCTP_FORWARD_TSN_SKIP;
4708                 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
4709                     SCTP_DATA_NOT_FRAG) {
4710                         /* not frag'ed we ae done   */
4711                         notdone = 0;
4712                         foundeom = 1;
4713                 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4714                         /* end of frag, we are done */
4715                         notdone = 0;
4716                         foundeom = 1;
4717                 } else {
4718                         /*
4719                          * Its a begin or middle piece, we must mark all of
4720                          * it
4721                          */
4722                         notdone = 1;
4723                         tp1 = TAILQ_NEXT(tp1, sctp_next);
4724                 }
4725         } while (tp1 && notdone);
4726         if (foundeom == 0) {
4727                 /*
4728                  * The multi-part message was scattered across the send and
4729                  * sent queue.
4730                  */
4731                 TAILQ_FOREACH_SAFE(tp1, &stcb->asoc.send_queue, sctp_next, tp2) {
4732                         if ((tp1->rec.data.stream_number != stream) ||
4733                             (tp1->rec.data.stream_seq != seq)) {
4734                                 break;
4735                         }
4736                         /*
4737                          * save to chk in case we have some on stream out
4738                          * queue. If so and we have an un-transmitted one we
4739                          * don't have to fudge the TSN.
4740                          */
4741                         chk = tp1;
4742                         ret_sz += tp1->book_size;
4743                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4744                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, reason, tp1, so_locked);
4745                         if (tp1->data) {
4746                                 sctp_m_freem(tp1->data);
4747                                 tp1->data = NULL;
4748                         }
4749                         /* No flight involved here book the size to 0 */
4750                         tp1->book_size = 0;
4751                         if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4752                                 foundeom = 1;
4753                         }
4754                         do_wakeup_routine = 1;
4755                         tp1->sent = SCTP_FORWARD_TSN_SKIP;
4756                         TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next);
4757                         /*
4758                          * on to the sent queue so we can wait for it to be
4759                          * passed by.
4760                          */
4761                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1,
4762                             sctp_next);
4763                         stcb->asoc.send_queue_cnt--;
4764                         stcb->asoc.sent_queue_cnt++;
4765                 }
4766         }
4767         if (foundeom == 0) {
4768                 /*
4769                  * Still no eom found. That means there is stuff left on the
4770                  * stream out queue.. yuck.
4771                  */
4772                 strq = &stcb->asoc.strmout[stream];
4773                 SCTP_TCB_SEND_LOCK(stcb);
4774                 TAILQ_FOREACH(sp, &strq->outqueue, next) {
4775                         /* FIXME: Shouldn't this be a serial number check? */
4776                         if (sp->strseq > seq) {
4777                                 break;
4778                         }
4779                         /* Check if its our SEQ */
4780                         if (sp->strseq == seq) {
4781                                 sp->discard_rest = 1;
4782                                 /*
4783                                  * We may need to put a chunk on the queue
4784                                  * that holds the TSN that would have been
4785                                  * sent with the LAST bit.
4786                                  */
4787                                 if (chk == NULL) {
4788                                         /* Yep, we have to */
4789                                         sctp_alloc_a_chunk(stcb, chk);
4790                                         if (chk == NULL) {
4791                                                 /*
4792                                                  * we are hosed. All we can
4793                                                  * do is nothing.. which
4794                                                  * will cause an abort if
4795                                                  * the peer is paying
4796                                                  * attention.
4797                                                  */
4798                                                 goto oh_well;
4799                                         }
4800                                         memset(chk, 0, sizeof(*chk));
4801                                         chk->rec.data.rcv_flags = SCTP_DATA_LAST_FRAG;
4802                                         chk->sent = SCTP_FORWARD_TSN_SKIP;
4803                                         chk->asoc = &stcb->asoc;
4804                                         chk->rec.data.stream_seq = sp->strseq;
4805                                         chk->rec.data.stream_number = sp->stream;
4806                                         chk->rec.data.payloadtype = sp->ppid;
4807                                         chk->rec.data.context = sp->context;
4808                                         chk->flags = sp->act_flags;
4809                                         if (sp->net)
4810                                                 chk->whoTo = sp->net;
4811                                         else
4812                                                 chk->whoTo = stcb->asoc.primary_destination;
4813                                         atomic_add_int(&chk->whoTo->ref_count, 1);
4814                                         chk->rec.data.TSN_seq = atomic_fetchadd_int(&stcb->asoc.sending_seq, 1);
4815                                         stcb->asoc.pr_sctp_cnt++;
4816                                         chk->pr_sctp_on = 1;
4817                                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, chk, sctp_next);
4818                                         stcb->asoc.sent_queue_cnt++;
4819                                         stcb->asoc.pr_sctp_cnt++;
4820                                 } else {
4821                                         chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
4822                                 }
4823                 oh_well:
4824                                 if (sp->data) {
4825                                         /*
4826                                          * Pull any data to free up the SB
4827                                          * and allow sender to "add more"
4828                                          * whilc we will throw away :-)
4829                                          */
4830                                         sctp_free_spbufspace(stcb, &stcb->asoc,
4831                                             sp);
4832                                         ret_sz += sp->length;
4833                                         do_wakeup_routine = 1;
4834                                         sp->some_taken = 1;
4835                                         sctp_m_freem(sp->data);
4836                                         sp->length = 0;
4837                                         sp->data = NULL;
4838                                         sp->tail_mbuf = NULL;
4839                                 }
4840                                 break;
4841                         }
4842                 }               /* End tailq_foreach */
4843                 SCTP_TCB_SEND_UNLOCK(stcb);
4844         }
4845         if (do_wakeup_routine) {
4846 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4847                 struct socket *so;
4848
4849                 so = SCTP_INP_SO(stcb->sctp_ep);
4850                 if (!so_locked) {
4851                         atomic_add_int(&stcb->asoc.refcnt, 1);
4852                         SCTP_TCB_UNLOCK(stcb);
4853                         SCTP_SOCKET_LOCK(so, 1);
4854                         SCTP_TCB_LOCK(stcb);
4855                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
4856                         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
4857                                 /* assoc was freed while we were unlocked */
4858                                 SCTP_SOCKET_UNLOCK(so, 1);
4859                                 return (ret_sz);
4860                         }
4861                 }
4862 #endif
4863                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
4864 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4865                 if (!so_locked) {
4866                         SCTP_SOCKET_UNLOCK(so, 1);
4867                 }
4868 #endif
4869         }
4870         return (ret_sz);
4871 }
4872
4873 /*
4874  * checks to see if the given address, sa, is one that is currently known by
4875  * the kernel note: can't distinguish the same address on multiple interfaces
4876  * and doesn't handle multiple addresses with different zone/scope id's note:
4877  * ifa_ifwithaddr() compares the entire sockaddr struct
4878  */
4879 struct sctp_ifa *
4880 sctp_find_ifa_in_ep(struct sctp_inpcb *inp, struct sockaddr *addr,
4881     int holds_lock)
4882 {
4883         struct sctp_laddr *laddr;
4884
4885         if (holds_lock == 0) {
4886                 SCTP_INP_RLOCK(inp);
4887         }
4888         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
4889                 if (laddr->ifa == NULL)
4890                         continue;
4891                 if (addr->sa_family != laddr->ifa->address.sa.sa_family)
4892                         continue;
4893 #ifdef INET
4894                 if (addr->sa_family == AF_INET) {
4895                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
4896                             laddr->ifa->address.sin.sin_addr.s_addr) {
4897                                 /* found him. */
4898                                 if (holds_lock == 0) {
4899                                         SCTP_INP_RUNLOCK(inp);
4900                                 }
4901                                 return (laddr->ifa);
4902                                 break;
4903                         }
4904                 }
4905 #endif
4906 #ifdef INET6
4907                 if (addr->sa_family == AF_INET6) {
4908                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
4909                             &laddr->ifa->address.sin6)) {
4910                                 /* found him. */
4911                                 if (holds_lock == 0) {
4912                                         SCTP_INP_RUNLOCK(inp);
4913                                 }
4914                                 return (laddr->ifa);
4915                                 break;
4916                         }
4917                 }
4918 #endif
4919         }
4920         if (holds_lock == 0) {
4921                 SCTP_INP_RUNLOCK(inp);
4922         }
4923         return (NULL);
4924 }
4925
4926 uint32_t
4927 sctp_get_ifa_hash_val(struct sockaddr *addr)
4928 {
4929         switch (addr->sa_family) {
4930 #ifdef INET
4931         case AF_INET:
4932                 {
4933                         struct sockaddr_in *sin;
4934
4935                         sin = (struct sockaddr_in *)addr;
4936                         return (sin->sin_addr.s_addr ^ (sin->sin_addr.s_addr >> 16));
4937                 }
4938 #endif
4939 #ifdef INET6
4940         case INET6:
4941                 {
4942                         struct sockaddr_in6 *sin6;
4943                         uint32_t hash_of_addr;
4944
4945                         sin6 = (struct sockaddr_in6 *)addr;
4946                         hash_of_addr = (sin6->sin6_addr.s6_addr32[0] +
4947                             sin6->sin6_addr.s6_addr32[1] +
4948                             sin6->sin6_addr.s6_addr32[2] +
4949                             sin6->sin6_addr.s6_addr32[3]);
4950                         hash_of_addr = (hash_of_addr ^ (hash_of_addr >> 16));
4951                         return (hash_of_addr);
4952                 }
4953 #endif
4954         default:
4955                 break;
4956         }
4957         return (0);
4958 }
4959
4960 struct sctp_ifa *
4961 sctp_find_ifa_by_addr(struct sockaddr *addr, uint32_t vrf_id, int holds_lock)
4962 {
4963         struct sctp_ifa *sctp_ifap;
4964         struct sctp_vrf *vrf;
4965         struct sctp_ifalist *hash_head;
4966         uint32_t hash_of_addr;
4967
4968         if (holds_lock == 0)
4969                 SCTP_IPI_ADDR_RLOCK();
4970
4971         vrf = sctp_find_vrf(vrf_id);
4972         if (vrf == NULL) {
4973 stage_right:
4974                 if (holds_lock == 0)
4975                         SCTP_IPI_ADDR_RUNLOCK();
4976                 return (NULL);
4977         }
4978         hash_of_addr = sctp_get_ifa_hash_val(addr);
4979
4980         hash_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)];
4981         if (hash_head == NULL) {
4982                 SCTP_PRINTF("hash_of_addr:%x mask:%x table:%x - ",
4983                     hash_of_addr, (uint32_t) vrf->vrf_addr_hashmark,
4984                     (uint32_t) (hash_of_addr & vrf->vrf_addr_hashmark));
4985                 sctp_print_address(addr);
4986                 SCTP_PRINTF("No such bucket for address\n");
4987                 if (holds_lock == 0)
4988                         SCTP_IPI_ADDR_RUNLOCK();
4989
4990                 return (NULL);
4991         }
4992         LIST_FOREACH(sctp_ifap, hash_head, next_bucket) {
4993                 if (sctp_ifap == NULL) {
4994 #ifdef INVARIANTS
4995                         panic("Huh LIST_FOREACH corrupt");
4996                         goto stage_right;
4997 #else
4998                         SCTP_PRINTF("LIST corrupt of sctp_ifap's?\n");
4999                         goto stage_right;
5000 #endif
5001                 }
5002                 if (addr->sa_family != sctp_ifap->address.sa.sa_family)
5003                         continue;
5004 #ifdef INET
5005                 if (addr->sa_family == AF_INET) {
5006                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
5007                             sctp_ifap->address.sin.sin_addr.s_addr) {
5008                                 /* found him. */
5009                                 if (holds_lock == 0)
5010                                         SCTP_IPI_ADDR_RUNLOCK();
5011                                 return (sctp_ifap);
5012                                 break;
5013                         }
5014                 }
5015 #endif
5016 #ifdef INET6
5017                 if (addr->sa_family == AF_INET6) {
5018                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5019                             &sctp_ifap->address.sin6)) {
5020                                 /* found him. */
5021                                 if (holds_lock == 0)
5022                                         SCTP_IPI_ADDR_RUNLOCK();
5023                                 return (sctp_ifap);
5024                                 break;
5025                         }
5026                 }
5027 #endif
5028         }
5029         if (holds_lock == 0)
5030                 SCTP_IPI_ADDR_RUNLOCK();
5031         return (NULL);
5032 }
5033
5034 static void
5035 sctp_user_rcvd(struct sctp_tcb *stcb, uint32_t * freed_so_far, int hold_rlock,
5036     uint32_t rwnd_req)
5037 {
5038         /* User pulled some data, do we need a rwnd update? */
5039         int r_unlocked = 0;
5040         uint32_t dif, rwnd;
5041         struct socket *so = NULL;
5042
5043         if (stcb == NULL)
5044                 return;
5045
5046         atomic_add_int(&stcb->asoc.refcnt, 1);
5047
5048         if (stcb->asoc.state & (SCTP_STATE_ABOUT_TO_BE_FREED |
5049             SCTP_STATE_SHUTDOWN_RECEIVED |
5050             SCTP_STATE_SHUTDOWN_ACK_SENT)) {
5051                 /* Pre-check If we are freeing no update */
5052                 goto no_lock;
5053         }
5054         SCTP_INP_INCR_REF(stcb->sctp_ep);
5055         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5056             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5057                 goto out;
5058         }
5059         so = stcb->sctp_socket;
5060         if (so == NULL) {
5061                 goto out;
5062         }
5063         atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far);
5064         /* Have you have freed enough to look */
5065         *freed_so_far = 0;
5066         /* Yep, its worth a look and the lock overhead */
5067
5068         /* Figure out what the rwnd would be */
5069         rwnd = sctp_calc_rwnd(stcb, &stcb->asoc);
5070         if (rwnd >= stcb->asoc.my_last_reported_rwnd) {
5071                 dif = rwnd - stcb->asoc.my_last_reported_rwnd;
5072         } else {
5073                 dif = 0;
5074         }
5075         if (dif >= rwnd_req) {
5076                 if (hold_rlock) {
5077                         SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5078                         r_unlocked = 1;
5079                 }
5080                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5081                         /*
5082                          * One last check before we allow the guy possibly
5083                          * to get in. There is a race, where the guy has not
5084                          * reached the gate. In that case
5085                          */
5086                         goto out;
5087                 }
5088                 SCTP_TCB_LOCK(stcb);
5089                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5090                         /* No reports here */
5091                         SCTP_TCB_UNLOCK(stcb);
5092                         goto out;
5093                 }
5094                 SCTP_STAT_INCR(sctps_wu_sacks_sent);
5095                 sctp_send_sack(stcb, SCTP_SO_LOCKED);
5096
5097                 sctp_chunk_output(stcb->sctp_ep, stcb,
5098                     SCTP_OUTPUT_FROM_USR_RCVD, SCTP_SO_LOCKED);
5099                 /* make sure no timer is running */
5100                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_6);
5101                 SCTP_TCB_UNLOCK(stcb);
5102         } else {
5103                 /* Update how much we have pending */
5104                 stcb->freed_by_sorcv_sincelast = dif;
5105         }
5106 out:
5107         if (so && r_unlocked && hold_rlock) {
5108                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
5109         }
5110         SCTP_INP_DECR_REF(stcb->sctp_ep);
5111 no_lock:
5112         atomic_add_int(&stcb->asoc.refcnt, -1);
5113         return;
5114 }
5115
5116 int
5117 sctp_sorecvmsg(struct socket *so,
5118     struct uio *uio,
5119     struct mbuf **mp,
5120     struct sockaddr *from,
5121     int fromlen,
5122     int *msg_flags,
5123     struct sctp_sndrcvinfo *sinfo,
5124     int filling_sinfo)
5125 {
5126         /*
5127          * MSG flags we will look at MSG_DONTWAIT - non-blocking IO.
5128          * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy
5129          * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ??
5130          * On the way out we may send out any combination of:
5131          * MSG_NOTIFICATION MSG_EOR
5132          *
5133          */
5134         struct sctp_inpcb *inp = NULL;
5135         int my_len = 0;
5136         int cp_len = 0, error = 0;
5137         struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
5138         struct mbuf *m = NULL;
5139         struct sctp_tcb *stcb = NULL;
5140         int wakeup_read_socket = 0;
5141         int freecnt_applied = 0;
5142         int out_flags = 0, in_flags = 0;
5143         int block_allowed = 1;
5144         uint32_t freed_so_far = 0;
5145         uint32_t copied_so_far = 0;
5146         int in_eeor_mode = 0;
5147         int no_rcv_needed = 0;
5148         uint32_t rwnd_req = 0;
5149         int hold_sblock = 0;
5150         int hold_rlock = 0;
5151         int slen = 0;
5152         uint32_t held_length = 0;
5153         int sockbuf_lock = 0;
5154
5155         if (uio == NULL) {
5156                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5157                 return (EINVAL);
5158         }
5159         if (msg_flags) {
5160                 in_flags = *msg_flags;
5161                 if (in_flags & MSG_PEEK)
5162                         SCTP_STAT_INCR(sctps_read_peeks);
5163         } else {
5164                 in_flags = 0;
5165         }
5166         slen = uio->uio_resid;
5167
5168         /* Pull in and set up our int flags */
5169         if (in_flags & MSG_OOB) {
5170                 /* Out of band's NOT supported */
5171                 return (EOPNOTSUPP);
5172         }
5173         if ((in_flags & MSG_PEEK) && (mp != NULL)) {
5174                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5175                 return (EINVAL);
5176         }
5177         if ((in_flags & (MSG_DONTWAIT
5178             | MSG_NBIO
5179             )) ||
5180             SCTP_SO_IS_NBIO(so)) {
5181                 block_allowed = 0;
5182         }
5183         /* setup the endpoint */
5184         inp = (struct sctp_inpcb *)so->so_pcb;
5185         if (inp == NULL) {
5186                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
5187                 return (EFAULT);
5188         }
5189         rwnd_req = (SCTP_SB_LIMIT_RCV(so) >> SCTP_RWND_HIWAT_SHIFT);
5190         /* Must be at least a MTU's worth */
5191         if (rwnd_req < SCTP_MIN_RWND)
5192                 rwnd_req = SCTP_MIN_RWND;
5193         in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
5194         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5195                 sctp_misc_ints(SCTP_SORECV_ENTER,
5196                     rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, uio->uio_resid);
5197         }
5198         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5199                 sctp_misc_ints(SCTP_SORECV_ENTERPL,
5200                     rwnd_req, block_allowed, so->so_rcv.sb_cc, uio->uio_resid);
5201         }
5202         error = sblock(&so->so_rcv, (block_allowed ? SBL_WAIT : 0));
5203         if (error) {
5204                 goto release_unlocked;
5205         }
5206         sockbuf_lock = 1;
5207 restart:
5208
5209
5210 restart_nosblocks:
5211         if (hold_sblock == 0) {
5212                 SOCKBUF_LOCK(&so->so_rcv);
5213                 hold_sblock = 1;
5214         }
5215         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5216             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5217                 goto out;
5218         }
5219         if ((so->so_rcv.sb_state & SBS_CANTRCVMORE) && (so->so_rcv.sb_cc == 0)) {
5220                 if (so->so_error) {
5221                         error = so->so_error;
5222                         if ((in_flags & MSG_PEEK) == 0)
5223                                 so->so_error = 0;
5224                         goto out;
5225                 } else {
5226                         if (so->so_rcv.sb_cc == 0) {
5227                                 /* indicate EOF */
5228                                 error = 0;
5229                                 goto out;
5230                         }
5231                 }
5232         }
5233         if ((so->so_rcv.sb_cc <= held_length) && block_allowed) {
5234                 /* we need to wait for data */
5235                 if ((so->so_rcv.sb_cc == 0) &&
5236                     ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5237                     (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) {
5238                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5239                                 /*
5240                                  * For active open side clear flags for
5241                                  * re-use passive open is blocked by
5242                                  * connect.
5243                                  */
5244                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5245                                         /*
5246                                          * You were aborted, passive side
5247                                          * always hits here
5248                                          */
5249                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5250                                         error = ECONNRESET;
5251                                 }
5252                                 so->so_state &= ~(SS_ISCONNECTING |
5253                                     SS_ISDISCONNECTING |
5254                                     SS_ISCONFIRMING |
5255                                     SS_ISCONNECTED);
5256                                 if (error == 0) {
5257                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5258                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5259                                                 error = ENOTCONN;
5260                                         }
5261                                 }
5262                                 goto out;
5263                         }
5264                 }
5265                 error = sbwait(&so->so_rcv);
5266                 if (error) {
5267                         goto out;
5268                 }
5269                 held_length = 0;
5270                 goto restart_nosblocks;
5271         } else if (so->so_rcv.sb_cc == 0) {
5272                 if (so->so_error) {
5273                         error = so->so_error;
5274                         if ((in_flags & MSG_PEEK) == 0)
5275                                 so->so_error = 0;
5276                 } else {
5277                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5278                             (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
5279                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5280                                         /*
5281                                          * For active open side clear flags
5282                                          * for re-use passive open is
5283                                          * blocked by connect.
5284                                          */
5285                                         if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5286                                                 /*
5287                                                  * You were aborted, passive
5288                                                  * side always hits here
5289                                                  */
5290                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5291                                                 error = ECONNRESET;
5292                                         }
5293                                         so->so_state &= ~(SS_ISCONNECTING |
5294                                             SS_ISDISCONNECTING |
5295                                             SS_ISCONFIRMING |
5296                                             SS_ISCONNECTED);
5297                                         if (error == 0) {
5298                                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5299                                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5300                                                         error = ENOTCONN;
5301                                                 }
5302                                         }
5303                                         goto out;
5304                                 }
5305                         }
5306                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EWOULDBLOCK);
5307                         error = EWOULDBLOCK;
5308                 }
5309                 goto out;
5310         }
5311         if (hold_sblock == 1) {
5312                 SOCKBUF_UNLOCK(&so->so_rcv);
5313                 hold_sblock = 0;
5314         }
5315         /* we possibly have data we can read */
5316         /* sa_ignore FREED_MEMORY */
5317         control = TAILQ_FIRST(&inp->read_queue);
5318         if (control == NULL) {
5319                 /*
5320                  * This could be happening since the appender did the
5321                  * increment but as not yet did the tailq insert onto the
5322                  * read_queue
5323                  */
5324                 if (hold_rlock == 0) {
5325                         SCTP_INP_READ_LOCK(inp);
5326                 }
5327                 control = TAILQ_FIRST(&inp->read_queue);
5328                 if ((control == NULL) && (so->so_rcv.sb_cc != 0)) {
5329 #ifdef INVARIANTS
5330                         panic("Huh, its non zero and nothing on control?");
5331 #endif
5332                         so->so_rcv.sb_cc = 0;
5333                 }
5334                 SCTP_INP_READ_UNLOCK(inp);
5335                 hold_rlock = 0;
5336                 goto restart;
5337         }
5338         if ((control->length == 0) &&
5339             (control->do_not_ref_stcb)) {
5340                 /*
5341                  * Clean up code for freeing assoc that left behind a
5342                  * pdapi.. maybe a peer in EEOR that just closed after
5343                  * sending and never indicated a EOR.
5344                  */
5345                 if (hold_rlock == 0) {
5346                         hold_rlock = 1;
5347                         SCTP_INP_READ_LOCK(inp);
5348                 }
5349                 control->held_length = 0;
5350                 if (control->data) {
5351                         /* Hmm there is data here .. fix */
5352                         struct mbuf *m_tmp;
5353                         int cnt = 0;
5354
5355                         m_tmp = control->data;
5356                         while (m_tmp) {
5357                                 cnt += SCTP_BUF_LEN(m_tmp);
5358                                 if (SCTP_BUF_NEXT(m_tmp) == NULL) {
5359                                         control->tail_mbuf = m_tmp;
5360                                         control->end_added = 1;
5361                                 }
5362                                 m_tmp = SCTP_BUF_NEXT(m_tmp);
5363                         }
5364                         control->length = cnt;
5365                 } else {
5366                         /* remove it */
5367                         TAILQ_REMOVE(&inp->read_queue, control, next);
5368                         /* Add back any hiddend data */
5369                         sctp_free_remote_addr(control->whoFrom);
5370                         sctp_free_a_readq(stcb, control);
5371                 }
5372                 if (hold_rlock) {
5373                         hold_rlock = 0;
5374                         SCTP_INP_READ_UNLOCK(inp);
5375                 }
5376                 goto restart;
5377         }
5378         if ((control->length == 0) &&
5379             (control->end_added == 1)) {
5380                 /*
5381                  * Do we also need to check for (control->pdapi_aborted ==
5382                  * 1)?
5383                  */
5384                 if (hold_rlock == 0) {
5385                         hold_rlock = 1;
5386                         SCTP_INP_READ_LOCK(inp);
5387                 }
5388                 TAILQ_REMOVE(&inp->read_queue, control, next);
5389                 if (control->data) {
5390 #ifdef INVARIANTS
5391                         panic("control->data not null but control->length == 0");
5392 #else
5393                         SCTP_PRINTF("Strange, data left in the control buffer. Cleaning up.\n");
5394                         sctp_m_freem(control->data);
5395                         control->data = NULL;
5396 #endif
5397                 }
5398                 if (control->aux_data) {
5399                         sctp_m_free(control->aux_data);
5400                         control->aux_data = NULL;
5401                 }
5402                 sctp_free_remote_addr(control->whoFrom);
5403                 sctp_free_a_readq(stcb, control);
5404                 if (hold_rlock) {
5405                         hold_rlock = 0;
5406                         SCTP_INP_READ_UNLOCK(inp);
5407                 }
5408                 goto restart;
5409         }
5410         if (control->length == 0) {
5411                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) &&
5412                     (filling_sinfo)) {
5413                         /* find a more suitable one then this */
5414                         ctl = TAILQ_NEXT(control, next);
5415                         while (ctl) {
5416                                 if ((ctl->stcb != control->stcb) && (ctl->length) &&
5417                                     (ctl->some_taken ||
5418                                     (ctl->spec_flags & M_NOTIFICATION) ||
5419                                     ((ctl->do_not_ref_stcb == 0) &&
5420                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))
5421                                     ) {
5422                                         /*-
5423                                          * If we have a different TCB next, and there is data
5424                                          * present. If we have already taken some (pdapi), OR we can
5425                                          * ref the tcb and no delivery as started on this stream, we
5426                                          * take it. Note we allow a notification on a different
5427                                          * assoc to be delivered..
5428                                          */
5429                                         control = ctl;
5430                                         goto found_one;
5431                                 } else if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS)) &&
5432                                             (ctl->length) &&
5433                                             ((ctl->some_taken) ||
5434                                             ((ctl->do_not_ref_stcb == 0) &&
5435                                             ((ctl->spec_flags & M_NOTIFICATION) == 0) &&
5436                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))) {
5437                                         /*-
5438                                          * If we have the same tcb, and there is data present, and we
5439                                          * have the strm interleave feature present. Then if we have
5440                                          * taken some (pdapi) or we can refer to tht tcb AND we have
5441                                          * not started a delivery for this stream, we can take it.
5442                                          * Note we do NOT allow a notificaiton on the same assoc to
5443                                          * be delivered.
5444                                          */
5445                                         control = ctl;
5446                                         goto found_one;
5447                                 }
5448                                 ctl = TAILQ_NEXT(ctl, next);
5449                         }
5450                 }
5451                 /*
5452                  * if we reach here, not suitable replacement is available
5453                  * <or> fragment interleave is NOT on. So stuff the sb_cc
5454                  * into the our held count, and its time to sleep again.
5455                  */
5456                 held_length = so->so_rcv.sb_cc;
5457                 control->held_length = so->so_rcv.sb_cc;
5458                 goto restart;
5459         }
5460         /* Clear the held length since there is something to read */
5461         control->held_length = 0;
5462         if (hold_rlock) {
5463                 SCTP_INP_READ_UNLOCK(inp);
5464                 hold_rlock = 0;
5465         }
5466 found_one:
5467         /*
5468          * If we reach here, control has a some data for us to read off.
5469          * Note that stcb COULD be NULL.
5470          */
5471         control->some_taken++;
5472         if (hold_sblock) {
5473                 SOCKBUF_UNLOCK(&so->so_rcv);
5474                 hold_sblock = 0;
5475         }
5476         stcb = control->stcb;
5477         if (stcb) {
5478                 if ((control->do_not_ref_stcb == 0) &&
5479                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5480                         if (freecnt_applied == 0)
5481                                 stcb = NULL;
5482                 } else if (control->do_not_ref_stcb == 0) {
5483                         /* you can't free it on me please */
5484                         /*
5485                          * The lock on the socket buffer protects us so the
5486                          * free code will stop. But since we used the
5487                          * socketbuf lock and the sender uses the tcb_lock
5488                          * to increment, we need to use the atomic add to
5489                          * the refcnt
5490                          */
5491                         if (freecnt_applied) {
5492 #ifdef INVARIANTS
5493                                 panic("refcnt already incremented");
5494 #else
5495                                 SCTP_PRINTF("refcnt already incremented?\n");
5496 #endif
5497                         } else {
5498                                 atomic_add_int(&stcb->asoc.refcnt, 1);
5499                                 freecnt_applied = 1;
5500                         }
5501                         /*
5502                          * Setup to remember how much we have not yet told
5503                          * the peer our rwnd has opened up. Note we grab the
5504                          * value from the tcb from last time. Note too that
5505                          * sack sending clears this when a sack is sent,
5506                          * which is fine. Once we hit the rwnd_req, we then
5507                          * will go to the sctp_user_rcvd() that will not
5508                          * lock until it KNOWs it MUST send a WUP-SACK.
5509                          */
5510                         freed_so_far = stcb->freed_by_sorcv_sincelast;
5511                         stcb->freed_by_sorcv_sincelast = 0;
5512                 }
5513         }
5514         if (stcb &&
5515             ((control->spec_flags & M_NOTIFICATION) == 0) &&
5516             control->do_not_ref_stcb == 0) {
5517                 stcb->asoc.strmin[control->sinfo_stream].delivery_started = 1;
5518         }
5519         /* First lets get off the sinfo and sockaddr info */
5520         if ((sinfo) && filling_sinfo) {
5521                 memcpy(sinfo, control, sizeof(struct sctp_nonpad_sndrcvinfo));
5522                 nxt = TAILQ_NEXT(control, next);
5523                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
5524                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) {
5525                         struct sctp_extrcvinfo *s_extra;
5526
5527                         s_extra = (struct sctp_extrcvinfo *)sinfo;
5528                         if ((nxt) &&
5529                             (nxt->length)) {
5530                                 s_extra->sreinfo_next_flags = SCTP_NEXT_MSG_AVAIL;
5531                                 if (nxt->sinfo_flags & SCTP_UNORDERED) {
5532                                         s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_IS_UNORDERED;
5533                                 }
5534                                 if (nxt->spec_flags & M_NOTIFICATION) {
5535                                         s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_IS_NOTIFICATION;
5536                                 }
5537                                 s_extra->sreinfo_next_aid = nxt->sinfo_assoc_id;
5538                                 s_extra->sreinfo_next_length = nxt->length;
5539                                 s_extra->sreinfo_next_ppid = nxt->sinfo_ppid;
5540                                 s_extra->sreinfo_next_stream = nxt->sinfo_stream;
5541                                 if (nxt->tail_mbuf != NULL) {
5542                                         if (nxt->end_added) {
5543                                                 s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_ISCOMPLETE;
5544                                         }
5545                                 }
5546                         } else {
5547                                 /*
5548                                  * we explicitly 0 this, since the memcpy
5549                                  * got some other things beyond the older
5550                                  * sinfo_ that is on the control's structure
5551                                  * :-D
5552                                  */
5553                                 nxt = NULL;
5554                                 s_extra->sreinfo_next_flags = SCTP_NO_NEXT_MSG;
5555                                 s_extra->sreinfo_next_aid = 0;
5556                                 s_extra->sreinfo_next_length = 0;
5557                                 s_extra->sreinfo_next_ppid = 0;
5558                                 s_extra->sreinfo_next_stream = 0;
5559                         }
5560                 }
5561                 /*
5562                  * update off the real current cum-ack, if we have an stcb.
5563                  */
5564                 if ((control->do_not_ref_stcb == 0) && stcb)
5565                         sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
5566                 /*
5567                  * mask off the high bits, we keep the actual chunk bits in
5568                  * there.
5569                  */
5570                 sinfo->sinfo_flags &= 0x00ff;
5571                 if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) {
5572                         sinfo->sinfo_flags |= SCTP_UNORDERED;
5573                 }
5574         }
5575 #ifdef SCTP_ASOCLOG_OF_TSNS
5576         {
5577                 int index, newindex;
5578                 struct sctp_pcbtsn_rlog *entry;
5579
5580                 do {
5581                         index = inp->readlog_index;
5582                         newindex = index + 1;
5583                         if (newindex >= SCTP_READ_LOG_SIZE) {
5584                                 newindex = 0;
5585                         }
5586                 } while (atomic_cmpset_int(&inp->readlog_index, index, newindex) == 0);
5587                 entry = &inp->readlog[index];
5588                 entry->vtag = control->sinfo_assoc_id;
5589                 entry->strm = control->sinfo_stream;
5590                 entry->seq = control->sinfo_ssn;
5591                 entry->sz = control->length;
5592                 entry->flgs = control->sinfo_flags;
5593         }
5594 #endif
5595         if (fromlen && from) {
5596                 cp_len = min((size_t)fromlen, (size_t)control->whoFrom->ro._l_addr.sa.sa_len);
5597                 switch (control->whoFrom->ro._l_addr.sa.sa_family) {
5598 #ifdef INET6
5599                 case AF_INET6:
5600                         ((struct sockaddr_in6 *)from)->sin6_port = control->port_from;
5601                         break;
5602 #endif
5603 #ifdef INET
5604                 case AF_INET:
5605                         ((struct sockaddr_in *)from)->sin_port = control->port_from;
5606                         break;
5607 #endif
5608                 default:
5609                         break;
5610                 }
5611                 memcpy(from, &control->whoFrom->ro._l_addr, cp_len);
5612
5613 #if defined(INET) && defined(INET6)
5614                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) &&
5615                     (from->sa_family == AF_INET) &&
5616                     ((size_t)fromlen >= sizeof(struct sockaddr_in6))) {
5617                         struct sockaddr_in *sin;
5618                         struct sockaddr_in6 sin6;
5619
5620                         sin = (struct sockaddr_in *)from;
5621                         bzero(&sin6, sizeof(sin6));
5622                         sin6.sin6_family = AF_INET6;
5623                         sin6.sin6_len = sizeof(struct sockaddr_in6);
5624                         sin6.sin6_addr.s6_addr32[2] = htonl(0xffff);
5625                         bcopy(&sin->sin_addr,
5626                             &sin6.sin6_addr.s6_addr32[3],
5627                             sizeof(sin6.sin6_addr.s6_addr32[3]));
5628                         sin6.sin6_port = sin->sin_port;
5629                         memcpy(from, &sin6, sizeof(struct sockaddr_in6));
5630                 }
5631 #endif
5632 #if defined(INET6)
5633                 {
5634                         struct sockaddr_in6 lsa6, *from6;
5635
5636                         from6 = (struct sockaddr_in6 *)from;
5637                         sctp_recover_scope_mac(from6, (&lsa6));
5638                 }
5639 #endif
5640         }
5641         /* now copy out what data we can */
5642         if (mp == NULL) {
5643                 /* copy out each mbuf in the chain up to length */
5644 get_more_data:
5645                 m = control->data;
5646                 while (m) {
5647                         /* Move out all we can */
5648                         cp_len = (int)uio->uio_resid;
5649                         my_len = (int)SCTP_BUF_LEN(m);
5650                         if (cp_len > my_len) {
5651                                 /* not enough in this buf */
5652                                 cp_len = my_len;
5653                         }
5654                         if (hold_rlock) {
5655                                 SCTP_INP_READ_UNLOCK(inp);
5656                                 hold_rlock = 0;
5657                         }
5658                         if (cp_len > 0)
5659                                 error = uiomove(mtod(m, char *), cp_len, uio);
5660                         /* re-read */
5661                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5662                                 goto release;
5663                         }
5664                         if ((control->do_not_ref_stcb == 0) && stcb &&
5665                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5666                                 no_rcv_needed = 1;
5667                         }
5668                         if (error) {
5669                                 /* error we are out of here */
5670                                 goto release;
5671                         }
5672                         if ((SCTP_BUF_NEXT(m) == NULL) &&
5673                             (cp_len >= SCTP_BUF_LEN(m)) &&
5674                             ((control->end_added == 0) ||
5675                             (control->end_added &&
5676                             (TAILQ_NEXT(control, next) == NULL)))
5677                             ) {
5678                                 SCTP_INP_READ_LOCK(inp);
5679                                 hold_rlock = 1;
5680                         }
5681                         if (cp_len == SCTP_BUF_LEN(m)) {
5682                                 if ((SCTP_BUF_NEXT(m) == NULL) &&
5683                                     (control->end_added)) {
5684                                         out_flags |= MSG_EOR;
5685                                         if ((control->do_not_ref_stcb == 0) &&
5686                                             (control->stcb != NULL) &&
5687                                             ((control->spec_flags & M_NOTIFICATION) == 0))
5688                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5689                                 }
5690                                 if (control->spec_flags & M_NOTIFICATION) {
5691                                         out_flags |= MSG_NOTIFICATION;
5692                                 }
5693                                 /* we ate up the mbuf */
5694                                 if (in_flags & MSG_PEEK) {
5695                                         /* just looking */
5696                                         m = SCTP_BUF_NEXT(m);
5697                                         copied_so_far += cp_len;
5698                                 } else {
5699                                         /* dispose of the mbuf */
5700                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5701                                                 sctp_sblog(&so->so_rcv,
5702                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
5703                                         }
5704                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
5705                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5706                                                 sctp_sblog(&so->so_rcv,
5707                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5708                                         }
5709                                         copied_so_far += cp_len;
5710                                         freed_so_far += cp_len;
5711                                         freed_so_far += MSIZE;
5712                                         atomic_subtract_int(&control->length, cp_len);
5713                                         control->data = sctp_m_free(m);
5714                                         m = control->data;
5715                                         /*
5716                                          * been through it all, must hold sb
5717                                          * lock ok to null tail
5718                                          */
5719                                         if (control->data == NULL) {
5720 #ifdef INVARIANTS
5721                                                 if ((control->end_added == 0) ||
5722                                                     (TAILQ_NEXT(control, next) == NULL)) {
5723                                                         /*
5724                                                          * If the end is not
5725                                                          * added, OR the
5726                                                          * next is NOT null
5727                                                          * we MUST have the
5728                                                          * lock.
5729                                                          */
5730                                                         if (mtx_owned(&inp->inp_rdata_mtx) == 0) {
5731                                                                 panic("Hmm we don't own the lock?");
5732                                                         }
5733                                                 }
5734 #endif
5735                                                 control->tail_mbuf = NULL;
5736 #ifdef INVARIANTS
5737                                                 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) {
5738                                                         panic("end_added, nothing left and no MSG_EOR");
5739                                                 }
5740 #endif
5741                                         }
5742                                 }
5743                         } else {
5744                                 /* Do we need to trim the mbuf? */
5745                                 if (control->spec_flags & M_NOTIFICATION) {
5746                                         out_flags |= MSG_NOTIFICATION;
5747                                 }
5748                                 if ((in_flags & MSG_PEEK) == 0) {
5749                                         SCTP_BUF_RESV_UF(m, cp_len);
5750                                         SCTP_BUF_LEN(m) -= cp_len;
5751                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5752                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, cp_len);
5753                                         }
5754                                         atomic_subtract_int(&so->so_rcv.sb_cc, cp_len);
5755                                         if ((control->do_not_ref_stcb == 0) &&
5756                                             stcb) {
5757                                                 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len);
5758                                         }
5759                                         copied_so_far += cp_len;
5760                                         freed_so_far += cp_len;
5761                                         freed_so_far += MSIZE;
5762                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5763                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
5764                                                     SCTP_LOG_SBRESULT, 0);
5765                                         }
5766                                         atomic_subtract_int(&control->length, cp_len);
5767                                 } else {
5768                                         copied_so_far += cp_len;
5769                                 }
5770                         }
5771                         if ((out_flags & MSG_EOR) || (uio->uio_resid == 0)) {
5772                                 break;
5773                         }
5774                         if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5775                             (control->do_not_ref_stcb == 0) &&
5776                             (freed_so_far >= rwnd_req)) {
5777                                 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5778                         }
5779                 }               /* end while(m) */
5780                 /*
5781                  * At this point we have looked at it all and we either have
5782                  * a MSG_EOR/or read all the user wants... <OR>
5783                  * control->length == 0.
5784                  */
5785                 if ((out_flags & MSG_EOR) && ((in_flags & MSG_PEEK) == 0)) {
5786                         /* we are done with this control */
5787                         if (control->length == 0) {
5788                                 if (control->data) {
5789 #ifdef INVARIANTS
5790                                         panic("control->data not null at read eor?");
5791 #else
5792                                         SCTP_PRINTF("Strange, data left in the control buffer .. invarients would panic?\n");
5793                                         sctp_m_freem(control->data);
5794                                         control->data = NULL;
5795 #endif
5796                                 }
5797                 done_with_control:
5798                                 if (TAILQ_NEXT(control, next) == NULL) {
5799                                         /*
5800                                          * If we don't have a next we need a
5801                                          * lock, if there is a next
5802                                          * interrupt is filling ahead of us
5803                                          * and we don't need a lock to
5804                                          * remove this guy (which is the
5805                                          * head of the queue).
5806                                          */
5807                                         if (hold_rlock == 0) {
5808                                                 SCTP_INP_READ_LOCK(inp);
5809                                                 hold_rlock = 1;
5810                                         }
5811                                 }
5812                                 TAILQ_REMOVE(&inp->read_queue, control, next);
5813                                 /* Add back any hiddend data */
5814                                 if (control->held_length) {
5815                                         held_length = 0;
5816                                         control->held_length = 0;
5817                                         wakeup_read_socket = 1;
5818                                 }
5819                                 if (control->aux_data) {
5820                                         sctp_m_free(control->aux_data);
5821                                         control->aux_data = NULL;
5822                                 }
5823                                 no_rcv_needed = control->do_not_ref_stcb;
5824                                 sctp_free_remote_addr(control->whoFrom);
5825                                 control->data = NULL;
5826                                 sctp_free_a_readq(stcb, control);
5827                                 control = NULL;
5828                                 if ((freed_so_far >= rwnd_req) &&
5829                                     (no_rcv_needed == 0))
5830                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5831
5832                         } else {
5833                                 /*
5834                                  * The user did not read all of this
5835                                  * message, turn off the returned MSG_EOR
5836                                  * since we are leaving more behind on the
5837                                  * control to read.
5838                                  */
5839 #ifdef INVARIANTS
5840                                 if (control->end_added &&
5841                                     (control->data == NULL) &&
5842                                     (control->tail_mbuf == NULL)) {
5843                                         panic("Gak, control->length is corrupt?");
5844                                 }
5845 #endif
5846                                 no_rcv_needed = control->do_not_ref_stcb;
5847                                 out_flags &= ~MSG_EOR;
5848                         }
5849                 }
5850                 if (out_flags & MSG_EOR) {
5851                         goto release;
5852                 }
5853                 if ((uio->uio_resid == 0) ||
5854                     ((in_eeor_mode) && (copied_so_far >= max(so->so_rcv.sb_lowat, 1)))
5855                     ) {
5856                         goto release;
5857                 }
5858                 /*
5859                  * If I hit here the receiver wants more and this message is
5860                  * NOT done (pd-api). So two questions. Can we block? if not
5861                  * we are done. Did the user NOT set MSG_WAITALL?
5862                  */
5863                 if (block_allowed == 0) {
5864                         goto release;
5865                 }
5866                 /*
5867                  * We need to wait for more data a few things: - We don't
5868                  * sbunlock() so we don't get someone else reading. - We
5869                  * must be sure to account for the case where what is added
5870                  * is NOT to our control when we wakeup.
5871                  */
5872
5873                 /*
5874                  * Do we need to tell the transport a rwnd update might be
5875                  * needed before we go to sleep?
5876                  */
5877                 if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5878                     ((freed_so_far >= rwnd_req) &&
5879                     (control->do_not_ref_stcb == 0) &&
5880                     (no_rcv_needed == 0))) {
5881                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5882                 }
5883 wait_some_more:
5884                 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
5885                         goto release;
5886                 }
5887                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
5888                         goto release;
5889
5890                 if (hold_rlock == 1) {
5891                         SCTP_INP_READ_UNLOCK(inp);
5892                         hold_rlock = 0;
5893                 }
5894                 if (hold_sblock == 0) {
5895                         SOCKBUF_LOCK(&so->so_rcv);
5896                         hold_sblock = 1;
5897                 }
5898                 if ((copied_so_far) && (control->length == 0) &&
5899                     (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE))) {
5900                         goto release;
5901                 }
5902                 if (so->so_rcv.sb_cc <= control->held_length) {
5903                         error = sbwait(&so->so_rcv);
5904                         if (error) {
5905                                 goto release;
5906                         }
5907                         control->held_length = 0;
5908                 }
5909                 if (hold_sblock) {
5910                         SOCKBUF_UNLOCK(&so->so_rcv);
5911                         hold_sblock = 0;
5912                 }
5913                 if (control->length == 0) {
5914                         /* still nothing here */
5915                         if (control->end_added == 1) {
5916                                 /* he aborted, or is done i.e.did a shutdown */
5917                                 out_flags |= MSG_EOR;
5918                                 if (control->pdapi_aborted) {
5919                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5920                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5921
5922                                         out_flags |= MSG_TRUNC;
5923                                 } else {
5924                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5925                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5926                                 }
5927                                 goto done_with_control;
5928                         }
5929                         if (so->so_rcv.sb_cc > held_length) {
5930                                 control->held_length = so->so_rcv.sb_cc;
5931                                 held_length = 0;
5932                         }
5933                         goto wait_some_more;
5934                 } else if (control->data == NULL) {
5935                         /*
5936                          * we must re-sync since data is probably being
5937                          * added
5938                          */
5939                         SCTP_INP_READ_LOCK(inp);
5940                         if ((control->length > 0) && (control->data == NULL)) {
5941                                 /*
5942                                  * big trouble.. we have the lock and its
5943                                  * corrupt?
5944                                  */
5945 #ifdef INVARIANTS
5946                                 panic("Impossible data==NULL length !=0");
5947 #endif
5948                                 out_flags |= MSG_EOR;
5949                                 out_flags |= MSG_TRUNC;
5950                                 control->length = 0;
5951                                 SCTP_INP_READ_UNLOCK(inp);
5952                                 goto done_with_control;
5953                         }
5954                         SCTP_INP_READ_UNLOCK(inp);
5955                         /* We will fall around to get more data */
5956                 }
5957                 goto get_more_data;
5958         } else {
5959                 /*-
5960                  * Give caller back the mbuf chain,
5961                  * store in uio_resid the length
5962                  */
5963                 wakeup_read_socket = 0;
5964                 if ((control->end_added == 0) ||
5965                     (TAILQ_NEXT(control, next) == NULL)) {
5966                         /* Need to get rlock */
5967                         if (hold_rlock == 0) {
5968                                 SCTP_INP_READ_LOCK(inp);
5969                                 hold_rlock = 1;
5970                         }
5971                 }
5972                 if (control->end_added) {
5973                         out_flags |= MSG_EOR;
5974                         if ((control->do_not_ref_stcb == 0) &&
5975                             (control->stcb != NULL) &&
5976                             ((control->spec_flags & M_NOTIFICATION) == 0))
5977                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5978                 }
5979                 if (control->spec_flags & M_NOTIFICATION) {
5980                         out_flags |= MSG_NOTIFICATION;
5981                 }
5982                 uio->uio_resid = control->length;
5983                 *mp = control->data;
5984                 m = control->data;
5985                 while (m) {
5986                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5987                                 sctp_sblog(&so->so_rcv,
5988                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
5989                         }
5990                         sctp_sbfree(control, stcb, &so->so_rcv, m);
5991                         freed_so_far += SCTP_BUF_LEN(m);
5992                         freed_so_far += MSIZE;
5993                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5994                                 sctp_sblog(&so->so_rcv,
5995                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5996                         }
5997                         m = SCTP_BUF_NEXT(m);
5998                 }
5999                 control->data = control->tail_mbuf = NULL;
6000                 control->length = 0;
6001                 if (out_flags & MSG_EOR) {
6002                         /* Done with this control */
6003                         goto done_with_control;
6004                 }
6005         }
6006 release:
6007         if (hold_rlock == 1) {
6008                 SCTP_INP_READ_UNLOCK(inp);
6009                 hold_rlock = 0;
6010         }
6011         if (hold_sblock == 1) {
6012                 SOCKBUF_UNLOCK(&so->so_rcv);
6013                 hold_sblock = 0;
6014         }
6015         sbunlock(&so->so_rcv);
6016         sockbuf_lock = 0;
6017
6018 release_unlocked:
6019         if (hold_sblock) {
6020                 SOCKBUF_UNLOCK(&so->so_rcv);
6021                 hold_sblock = 0;
6022         }
6023         if ((stcb) && (in_flags & MSG_PEEK) == 0) {
6024                 if ((freed_so_far >= rwnd_req) &&
6025                     (control && (control->do_not_ref_stcb == 0)) &&
6026                     (no_rcv_needed == 0))
6027                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6028         }
6029 out:
6030         if (msg_flags) {
6031                 *msg_flags = out_flags;
6032         }
6033         if (((out_flags & MSG_EOR) == 0) &&
6034             ((in_flags & MSG_PEEK) == 0) &&
6035             (sinfo) &&
6036             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
6037             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO))) {
6038                 struct sctp_extrcvinfo *s_extra;
6039
6040                 s_extra = (struct sctp_extrcvinfo *)sinfo;
6041                 s_extra->sreinfo_next_flags = SCTP_NO_NEXT_MSG;
6042         }
6043         if (hold_rlock == 1) {
6044                 SCTP_INP_READ_UNLOCK(inp);
6045         }
6046         if (hold_sblock) {
6047                 SOCKBUF_UNLOCK(&so->so_rcv);
6048         }
6049         if (sockbuf_lock) {
6050                 sbunlock(&so->so_rcv);
6051         }
6052         if (freecnt_applied) {
6053                 /*
6054                  * The lock on the socket buffer protects us so the free
6055                  * code will stop. But since we used the socketbuf lock and
6056                  * the sender uses the tcb_lock to increment, we need to use
6057                  * the atomic add to the refcnt.
6058                  */
6059                 if (stcb == NULL) {
6060 #ifdef INVARIANTS
6061                         panic("stcb for refcnt has gone NULL?");
6062                         goto stage_left;
6063 #else
6064                         goto stage_left;
6065 #endif
6066                 }
6067                 atomic_add_int(&stcb->asoc.refcnt, -1);
6068                 /* Save the value back for next time */
6069                 stcb->freed_by_sorcv_sincelast = freed_so_far;
6070         }
6071         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
6072                 if (stcb) {
6073                         sctp_misc_ints(SCTP_SORECV_DONE,
6074                             freed_so_far,
6075                             ((uio) ? (slen - uio->uio_resid) : slen),
6076                             stcb->asoc.my_rwnd,
6077                             so->so_rcv.sb_cc);
6078                 } else {
6079                         sctp_misc_ints(SCTP_SORECV_DONE,
6080                             freed_so_far,
6081                             ((uio) ? (slen - uio->uio_resid) : slen),
6082                             0,
6083                             so->so_rcv.sb_cc);
6084                 }
6085         }
6086 stage_left:
6087         if (wakeup_read_socket) {
6088                 sctp_sorwakeup(inp, so);
6089         }
6090         return (error);
6091 }
6092
6093
6094 #ifdef SCTP_MBUF_LOGGING
6095 struct mbuf *
6096 sctp_m_free(struct mbuf *m)
6097 {
6098         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
6099                 if (SCTP_BUF_IS_EXTENDED(m)) {
6100                         sctp_log_mb(m, SCTP_MBUF_IFREE);
6101                 }
6102         }
6103         return (m_free(m));
6104 }
6105
6106 void
6107 sctp_m_freem(struct mbuf *mb)
6108 {
6109         while (mb != NULL)
6110                 mb = sctp_m_free(mb);
6111 }
6112
6113 #endif
6114
6115 int
6116 sctp_dynamic_set_primary(struct sockaddr *sa, uint32_t vrf_id)
6117 {
6118         /*
6119          * Given a local address. For all associations that holds the
6120          * address, request a peer-set-primary.
6121          */
6122         struct sctp_ifa *ifa;
6123         struct sctp_laddr *wi;
6124
6125         ifa = sctp_find_ifa_by_addr(sa, vrf_id, 0);
6126         if (ifa == NULL) {
6127                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EADDRNOTAVAIL);
6128                 return (EADDRNOTAVAIL);
6129         }
6130         /*
6131          * Now that we have the ifa we must awaken the iterator with this
6132          * message.
6133          */
6134         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
6135         if (wi == NULL) {
6136                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
6137                 return (ENOMEM);
6138         }
6139         /* Now incr the count and int wi structure */
6140         SCTP_INCR_LADDR_COUNT();
6141         bzero(wi, sizeof(*wi));
6142         (void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
6143         wi->ifa = ifa;
6144         wi->action = SCTP_SET_PRIM_ADDR;
6145         atomic_add_int(&ifa->refcount, 1);
6146
6147         /* Now add it to the work queue */
6148         SCTP_WQ_ADDR_LOCK();
6149         /*
6150          * Should this really be a tailq? As it is we will process the
6151          * newest first :-0
6152          */
6153         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
6154         SCTP_WQ_ADDR_UNLOCK();
6155         sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
6156             (struct sctp_inpcb *)NULL,
6157             (struct sctp_tcb *)NULL,
6158             (struct sctp_nets *)NULL);
6159         return (0);
6160 }
6161
6162
6163 int
6164 sctp_soreceive(struct socket *so,
6165     struct sockaddr **psa,
6166     struct uio *uio,
6167     struct mbuf **mp0,
6168     struct mbuf **controlp,
6169     int *flagsp)
6170 {
6171         int error, fromlen;
6172         uint8_t sockbuf[256];
6173         struct sockaddr *from;
6174         struct sctp_extrcvinfo sinfo;
6175         int filling_sinfo = 1;
6176         struct sctp_inpcb *inp;
6177
6178         inp = (struct sctp_inpcb *)so->so_pcb;
6179         /* pickup the assoc we are reading from */
6180         if (inp == NULL) {
6181                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6182                 return (EINVAL);
6183         }
6184         if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) &&
6185             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) &&
6186             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) ||
6187             (controlp == NULL)) {
6188                 /* user does not want the sndrcv ctl */
6189                 filling_sinfo = 0;
6190         }
6191         if (psa) {
6192                 from = (struct sockaddr *)sockbuf;
6193                 fromlen = sizeof(sockbuf);
6194                 from->sa_len = 0;
6195         } else {
6196                 from = NULL;
6197                 fromlen = 0;
6198         }
6199
6200         error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, flagsp,
6201             (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo);
6202         if ((controlp) && (filling_sinfo)) {
6203                 /* copy back the sinfo in a CMSG format */
6204                 if (filling_sinfo)
6205                         *controlp = sctp_build_ctl_nchunk(inp,
6206                             (struct sctp_sndrcvinfo *)&sinfo);
6207                 else
6208                         *controlp = NULL;
6209         }
6210         if (psa) {
6211                 /* copy back the address info */
6212                 if (from && from->sa_len) {
6213                         *psa = sodupsockaddr(from, M_NOWAIT);
6214                 } else {
6215                         *psa = NULL;
6216                 }
6217         }
6218         return (error);
6219 }
6220
6221
6222
6223
6224
6225 int
6226 sctp_connectx_helper_add(struct sctp_tcb *stcb, struct sockaddr *addr,
6227     int totaddr, int *error)
6228 {
6229         int added = 0;
6230         int i;
6231         struct sctp_inpcb *inp;
6232         struct sockaddr *sa;
6233         size_t incr = 0;
6234
6235 #ifdef INET
6236         struct sockaddr_in *sin;
6237
6238 #endif
6239 #ifdef INET6
6240         struct sockaddr_in6 *sin6;
6241
6242 #endif
6243
6244         sa = addr;
6245         inp = stcb->sctp_ep;
6246         *error = 0;
6247         for (i = 0; i < totaddr; i++) {
6248                 switch (sa->sa_family) {
6249 #ifdef INET
6250                 case AF_INET:
6251                         incr = sizeof(struct sockaddr_in);
6252                         sin = (struct sockaddr_in *)sa;
6253                         if ((sin->sin_addr.s_addr == INADDR_ANY) ||
6254                             (sin->sin_addr.s_addr == INADDR_BROADCAST) ||
6255                             IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
6256                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6257                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_7);
6258                                 *error = EINVAL;
6259                                 goto out_now;
6260                         }
6261                         if (sctp_add_remote_addr(stcb, sa, NULL, SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) {
6262                                 /* assoc gone no un-lock */
6263                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6264                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_7);
6265                                 *error = ENOBUFS;
6266                                 goto out_now;
6267                         }
6268                         added++;
6269                         break;
6270 #endif
6271 #ifdef INET6
6272                 case AF_INET6:
6273                         incr = sizeof(struct sockaddr_in6);
6274                         sin6 = (struct sockaddr_in6 *)sa;
6275                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
6276                             IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
6277                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6278                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_8);
6279                                 *error = EINVAL;
6280                                 goto out_now;
6281                         }
6282                         if (sctp_add_remote_addr(stcb, sa, NULL, SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) {
6283                                 /* assoc gone no un-lock */
6284                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6285                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_8);
6286                                 *error = ENOBUFS;
6287                                 goto out_now;
6288                         }
6289                         added++;
6290                         break;
6291 #endif
6292                 default:
6293                         break;
6294                 }
6295                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6296         }
6297 out_now:
6298         return (added);
6299 }
6300
6301 struct sctp_tcb *
6302 sctp_connectx_helper_find(struct sctp_inpcb *inp, struct sockaddr *addr,
6303     int *totaddr, int *num_v4, int *num_v6, int *error,
6304     int limit, int *bad_addr)
6305 {
6306         struct sockaddr *sa;
6307         struct sctp_tcb *stcb = NULL;
6308         size_t incr, at, i;
6309
6310         at = incr = 0;
6311         sa = addr;
6312
6313         *error = *num_v6 = *num_v4 = 0;
6314         /* account and validate addresses */
6315         for (i = 0; i < (size_t)*totaddr; i++) {
6316                 switch (sa->sa_family) {
6317 #ifdef INET
6318                 case AF_INET:
6319                         (*num_v4) += 1;
6320                         incr = sizeof(struct sockaddr_in);
6321                         if (sa->sa_len != incr) {
6322                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6323                                 *error = EINVAL;
6324                                 *bad_addr = 1;
6325                                 return (NULL);
6326                         }
6327                         break;
6328 #endif
6329 #ifdef INET6
6330                 case AF_INET6:
6331                         {
6332                                 struct sockaddr_in6 *sin6;
6333
6334                                 sin6 = (struct sockaddr_in6 *)sa;
6335                                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6336                                         /* Must be non-mapped for connectx */
6337                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6338                                         *error = EINVAL;
6339                                         *bad_addr = 1;
6340                                         return (NULL);
6341                                 }
6342                                 (*num_v6) += 1;
6343                                 incr = sizeof(struct sockaddr_in6);
6344                                 if (sa->sa_len != incr) {
6345                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6346                                         *error = EINVAL;
6347                                         *bad_addr = 1;
6348                                         return (NULL);
6349                                 }
6350                                 break;
6351                         }
6352 #endif
6353                 default:
6354                         *totaddr = i;
6355                         /* we are done */
6356                         break;
6357                 }
6358                 if (i == (size_t)*totaddr) {
6359                         break;
6360                 }
6361                 SCTP_INP_INCR_REF(inp);
6362                 stcb = sctp_findassociation_ep_addr(&inp, sa, NULL, NULL, NULL);
6363                 if (stcb != NULL) {
6364                         /* Already have or am bring up an association */
6365                         return (stcb);
6366                 } else {
6367                         SCTP_INP_DECR_REF(inp);
6368                 }
6369                 if ((at + incr) > (size_t)limit) {
6370                         *totaddr = i;
6371                         break;
6372                 }
6373                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6374         }
6375         return ((struct sctp_tcb *)NULL);
6376 }
6377
6378 /*
6379  * sctp_bindx(ADD) for one address.
6380  * assumes all arguments are valid/checked by caller.
6381  */
6382 void
6383 sctp_bindx_add_address(struct socket *so, struct sctp_inpcb *inp,
6384     struct sockaddr *sa, sctp_assoc_t assoc_id,
6385     uint32_t vrf_id, int *error, void *p)
6386 {
6387         struct sockaddr *addr_touse;
6388
6389 #ifdef INET6
6390         struct sockaddr_in sin;
6391
6392 #endif
6393
6394         /* see if we're bound all already! */
6395         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6396                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6397                 *error = EINVAL;
6398                 return;
6399         }
6400         addr_touse = sa;
6401 #ifdef INET6
6402         if (sa->sa_family == AF_INET6) {
6403                 struct sockaddr_in6 *sin6;
6404
6405                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6406                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6407                         *error = EINVAL;
6408                         return;
6409                 }
6410                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6411                         /* can only bind v6 on PF_INET6 sockets */
6412                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6413                         *error = EINVAL;
6414                         return;
6415                 }
6416                 sin6 = (struct sockaddr_in6 *)addr_touse;
6417                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6418                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6419                             SCTP_IPV6_V6ONLY(inp)) {
6420                                 /* can't bind v4-mapped on PF_INET sockets */
6421                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6422                                 *error = EINVAL;
6423                                 return;
6424                         }
6425                         in6_sin6_2_sin(&sin, sin6);
6426                         addr_touse = (struct sockaddr *)&sin;
6427                 }
6428         }
6429 #endif
6430 #ifdef INET
6431         if (sa->sa_family == AF_INET) {
6432                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6433                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6434                         *error = EINVAL;
6435                         return;
6436                 }
6437                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6438                     SCTP_IPV6_V6ONLY(inp)) {
6439                         /* can't bind v4 on PF_INET sockets */
6440                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6441                         *error = EINVAL;
6442                         return;
6443                 }
6444         }
6445 #endif
6446         if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
6447                 if (p == NULL) {
6448                         /* Can't get proc for Net/Open BSD */
6449                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6450                         *error = EINVAL;
6451                         return;
6452                 }
6453                 *error = sctp_inpcb_bind(so, addr_touse, NULL, p);
6454                 return;
6455         }
6456         /*
6457          * No locks required here since bind and mgmt_ep_sa all do their own
6458          * locking. If we do something for the FIX: below we may need to
6459          * lock in that case.
6460          */
6461         if (assoc_id == 0) {
6462                 /* add the address */
6463                 struct sctp_inpcb *lep;
6464                 struct sockaddr_in *lsin = (struct sockaddr_in *)addr_touse;
6465
6466                 /* validate the incoming port */
6467                 if ((lsin->sin_port != 0) &&
6468                     (lsin->sin_port != inp->sctp_lport)) {
6469                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6470                         *error = EINVAL;
6471                         return;
6472                 } else {
6473                         /* user specified 0 port, set it to existing port */
6474                         lsin->sin_port = inp->sctp_lport;
6475                 }
6476
6477                 lep = sctp_pcb_findep(addr_touse, 1, 0, vrf_id);
6478                 if (lep != NULL) {
6479                         /*
6480                          * We must decrement the refcount since we have the
6481                          * ep already and are binding. No remove going on
6482                          * here.
6483                          */
6484                         SCTP_INP_DECR_REF(lep);
6485                 }
6486                 if (lep == inp) {
6487                         /* already bound to it.. ok */
6488                         return;
6489                 } else if (lep == NULL) {
6490                         ((struct sockaddr_in *)addr_touse)->sin_port = 0;
6491                         *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6492                             SCTP_ADD_IP_ADDRESS,
6493                             vrf_id, NULL);
6494                 } else {
6495                         *error = EADDRINUSE;
6496                 }
6497                 if (*error)
6498                         return;
6499         } else {
6500                 /*
6501                  * FIX: decide whether we allow assoc based bindx
6502                  */
6503         }
6504 }
6505
6506 /*
6507  * sctp_bindx(DELETE) for one address.
6508  * assumes all arguments are valid/checked by caller.
6509  */
6510 void
6511 sctp_bindx_delete_address(struct sctp_inpcb *inp,
6512     struct sockaddr *sa, sctp_assoc_t assoc_id,
6513     uint32_t vrf_id, int *error)
6514 {
6515         struct sockaddr *addr_touse;
6516
6517 #ifdef INET6
6518         struct sockaddr_in sin;
6519
6520 #endif
6521
6522         /* see if we're bound all already! */
6523         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6524                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6525                 *error = EINVAL;
6526                 return;
6527         }
6528         addr_touse = sa;
6529 #if defined(INET6)
6530         if (sa->sa_family == AF_INET6) {
6531                 struct sockaddr_in6 *sin6;
6532
6533                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6534                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6535                         *error = EINVAL;
6536                         return;
6537                 }
6538                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6539                         /* can only bind v6 on PF_INET6 sockets */
6540                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6541                         *error = EINVAL;
6542                         return;
6543                 }
6544                 sin6 = (struct sockaddr_in6 *)addr_touse;
6545                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6546                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6547                             SCTP_IPV6_V6ONLY(inp)) {
6548                                 /* can't bind mapped-v4 on PF_INET sockets */
6549                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6550                                 *error = EINVAL;
6551                                 return;
6552                         }
6553                         in6_sin6_2_sin(&sin, sin6);
6554                         addr_touse = (struct sockaddr *)&sin;
6555                 }
6556         }
6557 #endif
6558 #ifdef INET
6559         if (sa->sa_family == AF_INET) {
6560                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6561                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6562                         *error = EINVAL;
6563                         return;
6564                 }
6565                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6566                     SCTP_IPV6_V6ONLY(inp)) {
6567                         /* can't bind v4 on PF_INET sockets */
6568                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6569                         *error = EINVAL;
6570                         return;
6571                 }
6572         }
6573 #endif
6574         /*
6575          * No lock required mgmt_ep_sa does its own locking. If the FIX:
6576          * below is ever changed we may need to lock before calling
6577          * association level binding.
6578          */
6579         if (assoc_id == 0) {
6580                 /* delete the address */
6581                 *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6582                     SCTP_DEL_IP_ADDRESS,
6583                     vrf_id, NULL);
6584         } else {
6585                 /*
6586                  * FIX: decide whether we allow assoc based bindx
6587                  */
6588         }
6589 }
6590
6591 /*
6592  * returns the valid local address count for an assoc, taking into account
6593  * all scoping rules
6594  */
6595 int
6596 sctp_local_addr_count(struct sctp_tcb *stcb)
6597 {
6598         int loopback_scope, ipv4_local_scope, local_scope, site_scope;
6599         int ipv4_addr_legal, ipv6_addr_legal;
6600         struct sctp_vrf *vrf;
6601         struct sctp_ifn *sctp_ifn;
6602         struct sctp_ifa *sctp_ifa;
6603         int count = 0;
6604
6605         /* Turn on all the appropriate scopes */
6606         loopback_scope = stcb->asoc.loopback_scope;
6607         ipv4_local_scope = stcb->asoc.ipv4_local_scope;
6608         local_scope = stcb->asoc.local_scope;
6609         site_scope = stcb->asoc.site_scope;
6610         ipv4_addr_legal = ipv6_addr_legal = 0;
6611         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
6612                 ipv6_addr_legal = 1;
6613                 if (SCTP_IPV6_V6ONLY(stcb->sctp_ep) == 0) {
6614                         ipv4_addr_legal = 1;
6615                 }
6616         } else {
6617                 ipv4_addr_legal = 1;
6618         }
6619
6620         SCTP_IPI_ADDR_RLOCK();
6621         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
6622         if (vrf == NULL) {
6623                 /* no vrf, no addresses */
6624                 SCTP_IPI_ADDR_RUNLOCK();
6625                 return (0);
6626         }
6627         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6628                 /*
6629                  * bound all case: go through all ifns on the vrf
6630                  */
6631                 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
6632                         if ((loopback_scope == 0) &&
6633                             SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
6634                                 continue;
6635                         }
6636                         LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
6637                                 if (sctp_is_addr_restricted(stcb, sctp_ifa))
6638                                         continue;
6639                                 switch (sctp_ifa->address.sa.sa_family) {
6640 #ifdef INET
6641                                 case AF_INET:
6642                                         if (ipv4_addr_legal) {
6643                                                 struct sockaddr_in *sin;
6644
6645                                                 sin = (struct sockaddr_in *)&sctp_ifa->address.sa;
6646                                                 if (sin->sin_addr.s_addr == 0) {
6647                                                         /*
6648                                                          * skip unspecified
6649                                                          * addrs
6650                                                          */
6651                                                         continue;
6652                                                 }
6653                                                 if ((ipv4_local_scope == 0) &&
6654                                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
6655                                                         continue;
6656                                                 }
6657                                                 /* count this one */
6658                                                 count++;
6659                                         } else {
6660                                                 continue;
6661                                         }
6662                                         break;
6663 #endif
6664 #ifdef INET6
6665                                 case AF_INET6:
6666                                         if (ipv6_addr_legal) {
6667                                                 struct sockaddr_in6 *sin6;
6668
6669                                                 sin6 = (struct sockaddr_in6 *)&sctp_ifa->address.sa;
6670                                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
6671                                                         continue;
6672                                                 }
6673                                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
6674                                                         if (local_scope == 0)
6675                                                                 continue;
6676                                                         if (sin6->sin6_scope_id == 0) {
6677                                                                 if (sa6_recoverscope(sin6) != 0)
6678                                                                         /*
6679                                                                          *
6680                                                                          * bad
6681                                                                          *
6682                                                                          * li
6683                                                                          * nk
6684                                                                          *
6685                                                                          * loc
6686                                                                          * al
6687                                                                          *
6688                                                                          * add
6689                                                                          * re
6690                                                                          * ss
6691                                                                          * */
6692                                                                         continue;
6693                                                         }
6694                                                 }
6695                                                 if ((site_scope == 0) &&
6696                                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
6697                                                         continue;
6698                                                 }
6699                                                 /* count this one */
6700                                                 count++;
6701                                         }
6702                                         break;
6703 #endif
6704                                 default:
6705                                         /* TSNH */
6706                                         break;
6707                                 }
6708                         }
6709                 }
6710         } else {
6711                 /*
6712                  * subset bound case
6713                  */
6714                 struct sctp_laddr *laddr;
6715
6716                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list,
6717                     sctp_nxt_addr) {
6718                         if (sctp_is_addr_restricted(stcb, laddr->ifa)) {
6719                                 continue;
6720                         }
6721                         /* count this one */
6722                         count++;
6723                 }
6724         }
6725         SCTP_IPI_ADDR_RUNLOCK();
6726         return (count);
6727 }
6728
6729 #if defined(SCTP_LOCAL_TRACE_BUF)
6730
6731 void
6732 sctp_log_trace(uint32_t subsys, const char *str SCTP_UNUSED, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f)
6733 {
6734         uint32_t saveindex, newindex;
6735
6736         do {
6737                 saveindex = SCTP_BASE_SYSCTL(sctp_log).index;
6738                 if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6739                         newindex = 1;
6740                 } else {
6741                         newindex = saveindex + 1;
6742                 }
6743         } while (atomic_cmpset_int(&SCTP_BASE_SYSCTL(sctp_log).index, saveindex, newindex) == 0);
6744         if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6745                 saveindex = 0;
6746         }
6747         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].timestamp = SCTP_GET_CYCLECOUNT;
6748         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].subsys = subsys;
6749         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[0] = a;
6750         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[1] = b;
6751         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[2] = c;
6752         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[3] = d;
6753         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[4] = e;
6754         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[5] = f;
6755 }
6756
6757 #endif
6758 /* XXX: Remove the #ifdef after tunneling over IPv6 works also on FreeBSD. */
6759 #ifdef INET
6760 /* We will need to add support
6761  * to bind the ports and such here
6762  * so we can do UDP tunneling. In
6763  * the mean-time, we return error
6764  */
6765 #include <netinet/udp.h>
6766 #include <netinet/udp_var.h>
6767 #include <sys/proc.h>
6768 #ifdef INET6
6769 #include <netinet6/sctp6_var.h>
6770 #endif
6771
6772 static void
6773 sctp_recv_udp_tunneled_packet(struct mbuf *m, int off, struct inpcb *ignored)
6774 {
6775         struct ip *iph;
6776         struct mbuf *sp, *last;
6777         struct udphdr *uhdr;
6778         uint16_t port = 0;
6779         int header_size = sizeof(struct udphdr) + sizeof(struct sctphdr);
6780
6781         /*
6782          * Split out the mbuf chain. Leave the IP header in m, place the
6783          * rest in the sp.
6784          */
6785         if ((m->m_flags & M_PKTHDR) == 0) {
6786                 /* Can't handle one that is not a pkt hdr */
6787                 goto out;
6788         }
6789         /* pull the src port */
6790         iph = mtod(m, struct ip *);
6791         uhdr = (struct udphdr *)((caddr_t)iph + off);
6792
6793         port = uhdr->uh_sport;
6794         sp = m_split(m, off, M_DONTWAIT);
6795         if (sp == NULL) {
6796                 /* Gak, drop packet, we can't do a split */
6797                 goto out;
6798         }
6799         if (sp->m_pkthdr.len < header_size) {
6800                 /* Gak, packet can't have an SCTP header in it - to small */
6801                 m_freem(sp);
6802                 goto out;
6803         }
6804         /* ok now pull up the UDP header and SCTP header together */
6805         sp = m_pullup(sp, header_size);
6806         if (sp == NULL) {
6807                 /* Gak pullup failed */
6808                 goto out;
6809         }
6810         /* trim out the UDP header */
6811         m_adj(sp, sizeof(struct udphdr));
6812
6813         /* Now reconstruct the mbuf chain */
6814         /* 1) find last one */
6815         last = m;
6816         while (last->m_next != NULL) {
6817                 last = last->m_next;
6818         }
6819         last->m_next = sp;
6820         m->m_pkthdr.len += sp->m_pkthdr.len;
6821         last = m;
6822         while (last != NULL) {
6823                 last = last->m_next;
6824         }
6825         /* Now its ready for sctp_input or sctp6_input */
6826         iph = mtod(m, struct ip *);
6827         switch (iph->ip_v) {
6828 #ifdef INET
6829         case IPVERSION:
6830                 {
6831                         uint16_t len;
6832
6833                         /* its IPv4 */
6834                         len = SCTP_GET_IPV4_LENGTH(iph);
6835                         len -= sizeof(struct udphdr);
6836                         SCTP_GET_IPV4_LENGTH(iph) = len;
6837                         sctp_input_with_port(m, off, port);
6838                         break;
6839                 }
6840 #endif
6841 #ifdef INET6
6842         case IPV6_VERSION >> 4:
6843                 {
6844                         /* its IPv6 - NOT supported */
6845                         goto out;
6846                         break;
6847
6848                 }
6849 #endif
6850         default:
6851                 {
6852                         m_freem(m);
6853                         break;
6854                 }
6855         }
6856         return;
6857 out:
6858         m_freem(m);
6859 }
6860
6861 void
6862 sctp_over_udp_stop(void)
6863 {
6864         struct socket *sop;
6865
6866         /*
6867          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
6868          * for writting!
6869          */
6870         if (SCTP_BASE_INFO(udp_tun_socket) == NULL) {
6871                 /* Nothing to do */
6872                 return;
6873         }
6874         sop = SCTP_BASE_INFO(udp_tun_socket);
6875         soclose(sop);
6876         SCTP_BASE_INFO(udp_tun_socket) = NULL;
6877 }
6878
6879 int
6880 sctp_over_udp_start(void)
6881 {
6882         uint16_t port;
6883         int ret;
6884         struct sockaddr_in sin;
6885         struct socket *sop = NULL;
6886         struct thread *th;
6887         struct ucred *cred;
6888
6889         /*
6890          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
6891          * for writting!
6892          */
6893         port = SCTP_BASE_SYSCTL(sctp_udp_tunneling_port);
6894         if (port == 0) {
6895                 /* Must have a port set */
6896                 return (EINVAL);
6897         }
6898         if (SCTP_BASE_INFO(udp_tun_socket) != NULL) {
6899                 /* Already running -- must stop first */
6900                 return (EALREADY);
6901         }
6902         th = curthread;
6903         cred = th->td_ucred;
6904         if ((ret = socreate(PF_INET, &sop,
6905             SOCK_DGRAM, IPPROTO_UDP, cred, th))) {
6906                 return (ret);
6907         }
6908         SCTP_BASE_INFO(udp_tun_socket) = sop;
6909         /* call the special UDP hook */
6910         ret = udp_set_kernel_tunneling(sop, sctp_recv_udp_tunneled_packet);
6911         if (ret) {
6912                 goto exit_stage_left;
6913         }
6914         /* Ok we have a socket, bind it to the port */
6915         memset(&sin, 0, sizeof(sin));
6916         sin.sin_len = sizeof(sin);
6917         sin.sin_family = AF_INET;
6918         sin.sin_port = htons(port);
6919         ret = sobind(sop, (struct sockaddr *)&sin, th);
6920         if (ret) {
6921                 /* Close up we cant get the port */
6922 exit_stage_left:
6923                 sctp_over_udp_stop();
6924                 return (ret);
6925         }
6926         /*
6927          * Ok we should now get UDP packets directly to our input routine
6928          * sctp_recv_upd_tunneled_packet().
6929          */
6930         return (0);
6931 }
6932
6933 #endif