sys/netinet/sctputil.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-3-Clause
   3  *
   4  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
   5  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   6  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions are met:
  10  *
  11  * a) Redistributions of source code must retain the above copyright notice,
  12  *    this list of conditions and the following disclaimer.
  13  *
  14  * b) Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in
  16  *    the documentation and/or other materials provided with the distribution.
  17  *
  18  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  19  *    contributors may be used to endorse or promote products derived
  20  *    from this software without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  24  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  26  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  32  * THE POSSIBILITY OF SUCH DAMAGE.
  33  */
  34
  35 #include <sys/cdefs.h>
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_pcb.h>
  38 #include <netinet/sctputil.h>
  39 #include <netinet/sctp_var.h>
  40 #include <netinet/sctp_sysctl.h>
  41 #ifdef INET6
  42 #include <netinet6/sctp6_var.h>
  43 #endif
  44 #include <netinet/sctp_header.h>
  45 #include <netinet/sctp_output.h>
  46 #include <netinet/sctp_uio.h>
  47 #include <netinet/sctp_timer.h>
  48 #include <netinet/sctp_indata.h>
  49 #include <netinet/sctp_auth.h>
  50 #include <netinet/sctp_asconf.h>
  51 #include <netinet/sctp_bsd_addr.h>
  52 #include <netinet/sctp_kdtrace.h>
  53 #if defined(INET6) || defined(INET)
  54 #include <netinet/tcp_var.h>
  55 #endif
  56 #include <netinet/udp.h>
  57 #include <netinet/udp_var.h>
  58 #include <sys/proc.h>
  59 #ifdef INET6
  60 #include <netinet/icmp6.h>
  61 #endif
  62
  63 #ifndef KTR_SCTP
  64 #define KTR_SCTP KTR_SUBSYS
  65 #endif
  66
  67 extern const struct sctp_cc_functions sctp_cc_functions[];
  68 extern const struct sctp_ss_functions sctp_ss_functions[];
  69
  70 void
  71 sctp_sblog(struct sockbuf *sb, struct sctp_tcb *stcb, int from, int incr)
  72 {
  73 #if defined(SCTP_LOCAL_TRACE_BUF)
  74         struct sctp_cwnd_log sctp_clog;
  75
  76         sctp_clog.x.sb.stcb = stcb;
  77         sctp_clog.x.sb.so_sbcc = SCTP_SBAVAIL(sb);
  78         if (stcb)
  79                 sctp_clog.x.sb.stcb_sbcc = stcb->asoc.sb_cc;
  80         else
  81                 sctp_clog.x.sb.stcb_sbcc = 0;
  82         sctp_clog.x.sb.incr = incr;
  83         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
  84             SCTP_LOG_EVENT_SB,
  85             from,
  86             sctp_clog.x.misc.log1,
  87             sctp_clog.x.misc.log2,
  88             sctp_clog.x.misc.log3,
  89             sctp_clog.x.misc.log4);
  90 #endif
  91 }
  92
  93 void
  94 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc)
  95 {
  96 #if defined(SCTP_LOCAL_TRACE_BUF)
  97         struct sctp_cwnd_log sctp_clog;
  98
  99         sctp_clog.x.close.inp = (void *)inp;
 100         sctp_clog.x.close.sctp_flags = inp->sctp_flags;
 101         if (stcb) {
 102                 sctp_clog.x.close.stcb = (void *)stcb;
 103                 sctp_clog.x.close.state = (uint16_t)stcb->asoc.state;
 104         } else {
 105                 sctp_clog.x.close.stcb = 0;
 106                 sctp_clog.x.close.state = 0;
 107         }
 108         sctp_clog.x.close.loc = loc;
 109         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 110             SCTP_LOG_EVENT_CLOSE,
 111             0,
 112             sctp_clog.x.misc.log1,
 113             sctp_clog.x.misc.log2,
 114             sctp_clog.x.misc.log3,
 115             sctp_clog.x.misc.log4);
 116 #endif
 117 }
 118
 119 void
 120 rto_logging(struct sctp_nets *net, int from)
 121 {
 122 #if defined(SCTP_LOCAL_TRACE_BUF)
 123         struct sctp_cwnd_log sctp_clog;
 124
 125         memset(&sctp_clog, 0, sizeof(sctp_clog));
 126         sctp_clog.x.rto.net = (void *)net;
 127         sctp_clog.x.rto.rtt = net->rtt / 1000;
 128         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 129             SCTP_LOG_EVENT_RTT,
 130             from,
 131             sctp_clog.x.misc.log1,
 132             sctp_clog.x.misc.log2,
 133             sctp_clog.x.misc.log3,
 134             sctp_clog.x.misc.log4);
 135 #endif
 136 }
 137
 138 void
 139 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from)
 140 {
 141 #if defined(SCTP_LOCAL_TRACE_BUF)
 142         struct sctp_cwnd_log sctp_clog;
 143
 144         sctp_clog.x.strlog.stcb = stcb;
 145         sctp_clog.x.strlog.n_tsn = tsn;
 146         sctp_clog.x.strlog.n_sseq = sseq;
 147         sctp_clog.x.strlog.e_tsn = 0;
 148         sctp_clog.x.strlog.e_sseq = 0;
 149         sctp_clog.x.strlog.strm = stream;
 150         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 151             SCTP_LOG_EVENT_STRM,
 152             from,
 153             sctp_clog.x.misc.log1,
 154             sctp_clog.x.misc.log2,
 155             sctp_clog.x.misc.log3,
 156             sctp_clog.x.misc.log4);
 157 #endif
 158 }
 159
 160 void
 161 sctp_log_nagle_event(struct sctp_tcb *stcb, int action)
 162 {
 163 #if defined(SCTP_LOCAL_TRACE_BUF)
 164         struct sctp_cwnd_log sctp_clog;
 165
 166         sctp_clog.x.nagle.stcb = (void *)stcb;
 167         sctp_clog.x.nagle.total_flight = stcb->asoc.total_flight;
 168         sctp_clog.x.nagle.total_in_queue = stcb->asoc.total_output_queue_size;
 169         sctp_clog.x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue;
 170         sctp_clog.x.nagle.count_in_flight = stcb->asoc.total_flight_count;
 171         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 172             SCTP_LOG_EVENT_NAGLE,
 173             action,
 174             sctp_clog.x.misc.log1,
 175             sctp_clog.x.misc.log2,
 176             sctp_clog.x.misc.log3,
 177             sctp_clog.x.misc.log4);
 178 #endif
 179 }
 180
 181 void
 182 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from)
 183 {
 184 #if defined(SCTP_LOCAL_TRACE_BUF)
 185         struct sctp_cwnd_log sctp_clog;
 186
 187         sctp_clog.x.sack.cumack = cumack;
 188         sctp_clog.x.sack.oldcumack = old_cumack;
 189         sctp_clog.x.sack.tsn = tsn;
 190         sctp_clog.x.sack.numGaps = gaps;
 191         sctp_clog.x.sack.numDups = dups;
 192         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 193             SCTP_LOG_EVENT_SACK,
 194             from,
 195             sctp_clog.x.misc.log1,
 196             sctp_clog.x.misc.log2,
 197             sctp_clog.x.misc.log3,
 198             sctp_clog.x.misc.log4);
 199 #endif
 200 }
 201
 202 void
 203 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from)
 204 {
 205 #if defined(SCTP_LOCAL_TRACE_BUF)
 206         struct sctp_cwnd_log sctp_clog;
 207
 208         memset(&sctp_clog, 0, sizeof(sctp_clog));
 209         sctp_clog.x.map.base = map;
 210         sctp_clog.x.map.cum = cum;
 211         sctp_clog.x.map.high = high;
 212         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 213             SCTP_LOG_EVENT_MAP,
 214             from,
 215             sctp_clog.x.misc.log1,
 216             sctp_clog.x.misc.log2,
 217             sctp_clog.x.misc.log3,
 218             sctp_clog.x.misc.log4);
 219 #endif
 220 }
 221
 222 void
 223 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn, int from)
 224 {
 225 #if defined(SCTP_LOCAL_TRACE_BUF)
 226         struct sctp_cwnd_log sctp_clog;
 227
 228         memset(&sctp_clog, 0, sizeof(sctp_clog));
 229         sctp_clog.x.fr.largest_tsn = biggest_tsn;
 230         sctp_clog.x.fr.largest_new_tsn = biggest_new_tsn;
 231         sctp_clog.x.fr.tsn = tsn;
 232         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 233             SCTP_LOG_EVENT_FR,
 234             from,
 235             sctp_clog.x.misc.log1,
 236             sctp_clog.x.misc.log2,
 237             sctp_clog.x.misc.log3,
 238             sctp_clog.x.misc.log4);
 239 #endif
 240 }
 241
 242 #ifdef SCTP_MBUF_LOGGING
 243 void
 244 sctp_log_mb(struct mbuf *m, int from)
 245 {
 246 #if defined(SCTP_LOCAL_TRACE_BUF)
 247         struct sctp_cwnd_log sctp_clog;
 248
 249         sctp_clog.x.mb.mp = m;
 250         sctp_clog.x.mb.mbuf_flags = (uint8_t)(SCTP_BUF_GET_FLAGS(m));
 251         sctp_clog.x.mb.size = (uint16_t)(SCTP_BUF_LEN(m));
 252         sctp_clog.x.mb.data = SCTP_BUF_AT(m, 0);
 253         if (SCTP_BUF_IS_EXTENDED(m)) {
 254                 sctp_clog.x.mb.ext = SCTP_BUF_EXTEND_BASE(m);
 255                 sctp_clog.x.mb.refcnt = (uint8_t)(SCTP_BUF_EXTEND_REFCNT(m));
 256         } else {
 257                 sctp_clog.x.mb.ext = 0;
 258                 sctp_clog.x.mb.refcnt = 0;
 259         }
 260         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 261             SCTP_LOG_EVENT_MBUF,
 262             from,
 263             sctp_clog.x.misc.log1,
 264             sctp_clog.x.misc.log2,
 265             sctp_clog.x.misc.log3,
 266             sctp_clog.x.misc.log4);
 267 #endif
 268 }
 269
 270 void
 271 sctp_log_mbc(struct mbuf *m, int from)
 272 {
 273         struct mbuf *mat;
 274
 275         for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) {
 276                 sctp_log_mb(mat, from);
 277         }
 278 }
 279 #endif
 280
 281 void
 282 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk, int from)
 283 {
 284 #if defined(SCTP_LOCAL_TRACE_BUF)
 285         struct sctp_cwnd_log sctp_clog;
 286
 287         if (control == NULL) {
 288                 SCTP_PRINTF("Gak log of NULL?\n");
 289                 return;
 290         }
 291         sctp_clog.x.strlog.stcb = control->stcb;
 292         sctp_clog.x.strlog.n_tsn = control->sinfo_tsn;
 293         sctp_clog.x.strlog.n_sseq = (uint16_t)control->mid;
 294         sctp_clog.x.strlog.strm = control->sinfo_stream;
 295         if (poschk != NULL) {
 296                 sctp_clog.x.strlog.e_tsn = poschk->sinfo_tsn;
 297                 sctp_clog.x.strlog.e_sseq = (uint16_t)poschk->mid;
 298         } else {
 299                 sctp_clog.x.strlog.e_tsn = 0;
 300                 sctp_clog.x.strlog.e_sseq = 0;
 301         }
 302         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 303             SCTP_LOG_EVENT_STRM,
 304             from,
 305             sctp_clog.x.misc.log1,
 306             sctp_clog.x.misc.log2,
 307             sctp_clog.x.misc.log3,
 308             sctp_clog.x.misc.log4);
 309 #endif
 310 }
 311
 312 void
 313 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from)
 314 {
 315 #if defined(SCTP_LOCAL_TRACE_BUF)
 316         struct sctp_cwnd_log sctp_clog;
 317
 318         sctp_clog.x.cwnd.net = net;
 319         if (stcb->asoc.send_queue_cnt > 255)
 320                 sctp_clog.x.cwnd.cnt_in_send = 255;
 321         else
 322                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 323         if (stcb->asoc.stream_queue_cnt > 255)
 324                 sctp_clog.x.cwnd.cnt_in_str = 255;
 325         else
 326                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 327
 328         if (net) {
 329                 sctp_clog.x.cwnd.cwnd_new_value = net->cwnd;
 330                 sctp_clog.x.cwnd.inflight = net->flight_size;
 331                 sctp_clog.x.cwnd.pseudo_cumack = net->pseudo_cumack;
 332                 sctp_clog.x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack;
 333                 sctp_clog.x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack;
 334         }
 335         if (SCTP_CWNDLOG_PRESEND == from) {
 336                 sctp_clog.x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd;
 337         }
 338         sctp_clog.x.cwnd.cwnd_augment = augment;
 339         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 340             SCTP_LOG_EVENT_CWND,
 341             from,
 342             sctp_clog.x.misc.log1,
 343             sctp_clog.x.misc.log2,
 344             sctp_clog.x.misc.log3,
 345             sctp_clog.x.misc.log4);
 346 #endif
 347 }
 348
 349 void
 350 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from)
 351 {
 352 #if defined(SCTP_LOCAL_TRACE_BUF)
 353         struct sctp_cwnd_log sctp_clog;
 354
 355         memset(&sctp_clog, 0, sizeof(sctp_clog));
 356         if (inp) {
 357                 sctp_clog.x.lock.sock = (void *)inp->sctp_socket;
 358
 359         } else {
 360                 sctp_clog.x.lock.sock = (void *)NULL;
 361         }
 362         sctp_clog.x.lock.inp = (void *)inp;
 363         if (stcb) {
 364                 sctp_clog.x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx);
 365         } else {
 366                 sctp_clog.x.lock.tcb_lock = SCTP_LOCK_UNKNOWN;
 367         }
 368         if (inp) {
 369                 sctp_clog.x.lock.inp_lock = mtx_owned(&inp->inp_mtx);
 370                 sctp_clog.x.lock.create_lock = mtx_owned(&inp->inp_create_mtx);
 371         } else {
 372                 sctp_clog.x.lock.inp_lock = SCTP_LOCK_UNKNOWN;
 373                 sctp_clog.x.lock.create_lock = SCTP_LOCK_UNKNOWN;
 374         }
 375         sctp_clog.x.lock.info_lock = rw_wowned(&SCTP_BASE_INFO(ipi_ep_mtx));
 376         if (inp && (inp->sctp_socket)) {
 377                 sctp_clog.x.lock.sock_lock = mtx_owned(SOCK_MTX(inp->sctp_socket));
 378                 sctp_clog.x.lock.sockrcvbuf_lock = mtx_owned(SOCKBUF_MTX(&inp->sctp_socket->so_rcv));
 379                 sctp_clog.x.lock.socksndbuf_lock = mtx_owned(SOCKBUF_MTX(&inp->sctp_socket->so_snd));
 380         } else {
 381                 sctp_clog.x.lock.sock_lock = SCTP_LOCK_UNKNOWN;
 382                 sctp_clog.x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN;
 383                 sctp_clog.x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN;
 384         }
 385         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 386             SCTP_LOG_LOCK_EVENT,
 387             from,
 388             sctp_clog.x.misc.log1,
 389             sctp_clog.x.misc.log2,
 390             sctp_clog.x.misc.log3,
 391             sctp_clog.x.misc.log4);
 392 #endif
 393 }
 394
 395 void
 396 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from)
 397 {
 398 #if defined(SCTP_LOCAL_TRACE_BUF)
 399         struct sctp_cwnd_log sctp_clog;
 400
 401         memset(&sctp_clog, 0, sizeof(sctp_clog));
 402         sctp_clog.x.cwnd.net = net;
 403         sctp_clog.x.cwnd.cwnd_new_value = error;
 404         sctp_clog.x.cwnd.inflight = net->flight_size;
 405         sctp_clog.x.cwnd.cwnd_augment = burst;
 406         if (stcb->asoc.send_queue_cnt > 255)
 407                 sctp_clog.x.cwnd.cnt_in_send = 255;
 408         else
 409                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 410         if (stcb->asoc.stream_queue_cnt > 255)
 411                 sctp_clog.x.cwnd.cnt_in_str = 255;
 412         else
 413                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 414         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 415             SCTP_LOG_EVENT_MAXBURST,
 416             from,
 417             sctp_clog.x.misc.log1,
 418             sctp_clog.x.misc.log2,
 419             sctp_clog.x.misc.log3,
 420             sctp_clog.x.misc.log4);
 421 #endif
 422 }
 423
 424 void
 425 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead)
 426 {
 427 #if defined(SCTP_LOCAL_TRACE_BUF)
 428         struct sctp_cwnd_log sctp_clog;
 429
 430         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 431         sctp_clog.x.rwnd.send_size = snd_size;
 432         sctp_clog.x.rwnd.overhead = overhead;
 433         sctp_clog.x.rwnd.new_rwnd = 0;
 434         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 435             SCTP_LOG_EVENT_RWND,
 436             from,
 437             sctp_clog.x.misc.log1,
 438             sctp_clog.x.misc.log2,
 439             sctp_clog.x.misc.log3,
 440             sctp_clog.x.misc.log4);
 441 #endif
 442 }
 443
 444 void
 445 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval)
 446 {
 447 #if defined(SCTP_LOCAL_TRACE_BUF)
 448         struct sctp_cwnd_log sctp_clog;
 449
 450         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 451         sctp_clog.x.rwnd.send_size = flight_size;
 452         sctp_clog.x.rwnd.overhead = overhead;
 453         sctp_clog.x.rwnd.new_rwnd = a_rwndval;
 454         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 455             SCTP_LOG_EVENT_RWND,
 456             from,
 457             sctp_clog.x.misc.log1,
 458             sctp_clog.x.misc.log2,
 459             sctp_clog.x.misc.log3,
 460             sctp_clog.x.misc.log4);
 461 #endif
 462 }
 463
 464 #ifdef SCTP_MBCNT_LOGGING
 465 static void
 466 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt)
 467 {
 468 #if defined(SCTP_LOCAL_TRACE_BUF)
 469         struct sctp_cwnd_log sctp_clog;
 470
 471         sctp_clog.x.mbcnt.total_queue_size = total_oq;
 472         sctp_clog.x.mbcnt.size_change = book;
 473         sctp_clog.x.mbcnt.total_queue_mb_size = total_mbcnt_q;
 474         sctp_clog.x.mbcnt.mbcnt_change = mbcnt;
 475         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 476             SCTP_LOG_EVENT_MBCNT,
 477             from,
 478             sctp_clog.x.misc.log1,
 479             sctp_clog.x.misc.log2,
 480             sctp_clog.x.misc.log3,
 481             sctp_clog.x.misc.log4);
 482 #endif
 483 }
 484 #endif
 485
 486 void
 487 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d)
 488 {
 489 #if defined(SCTP_LOCAL_TRACE_BUF)
 490         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 491             SCTP_LOG_MISC_EVENT,
 492             from,
 493             a, b, c, d);
 494 #endif
 495 }
 496
 497 void
 498 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t wake_cnt, int from)
 499 {
 500 #if defined(SCTP_LOCAL_TRACE_BUF)
 501         struct sctp_cwnd_log sctp_clog;
 502
 503         sctp_clog.x.wake.stcb = (void *)stcb;
 504         sctp_clog.x.wake.wake_cnt = wake_cnt;
 505         sctp_clog.x.wake.flight = stcb->asoc.total_flight_count;
 506         sctp_clog.x.wake.send_q = stcb->asoc.send_queue_cnt;
 507         sctp_clog.x.wake.sent_q = stcb->asoc.sent_queue_cnt;
 508
 509         if (stcb->asoc.stream_queue_cnt < 0xff)
 510                 sctp_clog.x.wake.stream_qcnt = (uint8_t)stcb->asoc.stream_queue_cnt;
 511         else
 512                 sctp_clog.x.wake.stream_qcnt = 0xff;
 513
 514         if (stcb->asoc.chunks_on_out_queue < 0xff)
 515                 sctp_clog.x.wake.chunks_on_oque = (uint8_t)stcb->asoc.chunks_on_out_queue;
 516         else
 517                 sctp_clog.x.wake.chunks_on_oque = 0xff;
 518
 519         sctp_clog.x.wake.sctpflags = 0;
 520         /* set in the defered mode stuff */
 521         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE)
 522                 sctp_clog.x.wake.sctpflags |= 1;
 523         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT)
 524                 sctp_clog.x.wake.sctpflags |= 2;
 525         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT)
 526                 sctp_clog.x.wake.sctpflags |= 4;
 527         /* what about the sb */
 528         if (stcb->sctp_socket) {
 529                 struct socket *so = stcb->sctp_socket;
 530
 531                 sctp_clog.x.wake.sbflags = (uint8_t)((so->so_snd.sb_flags & 0x00ff));
 532         } else {
 533                 sctp_clog.x.wake.sbflags = 0xff;
 534         }
 535         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 536             SCTP_LOG_EVENT_WAKE,
 537             from,
 538             sctp_clog.x.misc.log1,
 539             sctp_clog.x.misc.log2,
 540             sctp_clog.x.misc.log3,
 541             sctp_clog.x.misc.log4);
 542 #endif
 543 }
 544
 545 void
 546 sctp_log_block(uint8_t from, struct sctp_association *asoc, ssize_t sendlen)
 547 {
 548 #if defined(SCTP_LOCAL_TRACE_BUF)
 549         struct sctp_cwnd_log sctp_clog;
 550
 551         sctp_clog.x.blk.onsb = asoc->total_output_queue_size;
 552         sctp_clog.x.blk.send_sent_qcnt = (uint16_t)(asoc->send_queue_cnt + asoc->sent_queue_cnt);
 553         sctp_clog.x.blk.peer_rwnd = asoc->peers_rwnd;
 554         sctp_clog.x.blk.stream_qcnt = (uint16_t)asoc->stream_queue_cnt;
 555         sctp_clog.x.blk.chunks_on_oque = (uint16_t)asoc->chunks_on_out_queue;
 556         sctp_clog.x.blk.flight_size = (uint16_t)(asoc->total_flight / 1024);
 557         sctp_clog.x.blk.sndlen = (uint32_t)sendlen;
 558         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 559             SCTP_LOG_EVENT_BLOCK,
 560             from,
 561             sctp_clog.x.misc.log1,
 562             sctp_clog.x.misc.log2,
 563             sctp_clog.x.misc.log3,
 564             sctp_clog.x.misc.log4);
 565 #endif
 566 }
 567
 568 int
 569 sctp_fill_stat_log(void *optval SCTP_UNUSED, size_t *optsize SCTP_UNUSED)
 570 {
 571         /* May need to fix this if ktrdump does not work */
 572         return (0);
 573 }
 574
 575 #ifdef SCTP_AUDITING_ENABLED
 576 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2];
 577 static int sctp_audit_indx = 0;
 578
 579 static
 580 void
 581 sctp_print_audit_report(void)
 582 {
 583         int i;
 584         int cnt;
 585
 586         cnt = 0;
 587         for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) {
 588                 if ((sctp_audit_data[i][0] == 0xe0) &&
 589                     (sctp_audit_data[i][1] == 0x01)) {
 590                         cnt = 0;
 591                         SCTP_PRINTF("\n");
 592                 } else if (sctp_audit_data[i][0] == 0xf0) {
 593                         cnt = 0;
 594                         SCTP_PRINTF("\n");
 595                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 596                     (sctp_audit_data[i][1] == 0x01)) {
 597                         SCTP_PRINTF("\n");
 598                         cnt = 0;
 599                 }
 600                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0],
 601                     (uint32_t)sctp_audit_data[i][1]);
 602                 cnt++;
 603                 if ((cnt % 14) == 0)
 604                         SCTP_PRINTF("\n");
 605         }
 606         for (i = 0; i < sctp_audit_indx; i++) {
 607                 if ((sctp_audit_data[i][0] == 0xe0) &&
 608                     (sctp_audit_data[i][1] == 0x01)) {
 609                         cnt = 0;
 610                         SCTP_PRINTF("\n");
 611                 } else if (sctp_audit_data[i][0] == 0xf0) {
 612                         cnt = 0;
 613                         SCTP_PRINTF("\n");
 614                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 615                     (sctp_audit_data[i][1] == 0x01)) {
 616                         SCTP_PRINTF("\n");
 617                         cnt = 0;
 618                 }
 619                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0],
 620                     (uint32_t)sctp_audit_data[i][1]);
 621                 cnt++;
 622                 if ((cnt % 14) == 0)
 623                         SCTP_PRINTF("\n");
 624         }
 625         SCTP_PRINTF("\n");
 626 }
 627
 628 void
 629 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 630     struct sctp_nets *net)
 631 {
 632         int resend_cnt, tot_out, rep, tot_book_cnt;
 633         struct sctp_nets *lnet;
 634         struct sctp_tmit_chunk *chk;
 635
 636         sctp_audit_data[sctp_audit_indx][0] = 0xAA;
 637         sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from;
 638         sctp_audit_indx++;
 639         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 640                 sctp_audit_indx = 0;
 641         }
 642         if (inp == NULL) {
 643                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 644                 sctp_audit_data[sctp_audit_indx][1] = 0x01;
 645                 sctp_audit_indx++;
 646                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 647                         sctp_audit_indx = 0;
 648                 }
 649                 return;
 650         }
 651         if (stcb == NULL) {
 652                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 653                 sctp_audit_data[sctp_audit_indx][1] = 0x02;
 654                 sctp_audit_indx++;
 655                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 656                         sctp_audit_indx = 0;
 657                 }
 658                 return;
 659         }
 660         sctp_audit_data[sctp_audit_indx][0] = 0xA1;
 661         sctp_audit_data[sctp_audit_indx][1] =
 662             (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 663         sctp_audit_indx++;
 664         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 665                 sctp_audit_indx = 0;
 666         }
 667         rep = 0;
 668         tot_book_cnt = 0;
 669         resend_cnt = tot_out = 0;
 670         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 671                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 672                         resend_cnt++;
 673                 } else if (chk->sent < SCTP_DATAGRAM_RESEND) {
 674                         tot_out += chk->book_size;
 675                         tot_book_cnt++;
 676                 }
 677         }
 678         if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) {
 679                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 680                 sctp_audit_data[sctp_audit_indx][1] = 0xA1;
 681                 sctp_audit_indx++;
 682                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 683                         sctp_audit_indx = 0;
 684                 }
 685                 SCTP_PRINTF("resend_cnt:%d asoc-tot:%d\n",
 686                     resend_cnt, stcb->asoc.sent_queue_retran_cnt);
 687                 rep = 1;
 688                 stcb->asoc.sent_queue_retran_cnt = resend_cnt;
 689                 sctp_audit_data[sctp_audit_indx][0] = 0xA2;
 690                 sctp_audit_data[sctp_audit_indx][1] =
 691                     (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 692                 sctp_audit_indx++;
 693                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 694                         sctp_audit_indx = 0;
 695                 }
 696         }
 697         if (tot_out != stcb->asoc.total_flight) {
 698                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 699                 sctp_audit_data[sctp_audit_indx][1] = 0xA2;
 700                 sctp_audit_indx++;
 701                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 702                         sctp_audit_indx = 0;
 703                 }
 704                 rep = 1;
 705                 SCTP_PRINTF("tot_flt:%d asoc_tot:%d\n", tot_out,
 706                     (int)stcb->asoc.total_flight);
 707                 stcb->asoc.total_flight = tot_out;
 708         }
 709         if (tot_book_cnt != stcb->asoc.total_flight_count) {
 710                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 711                 sctp_audit_data[sctp_audit_indx][1] = 0xA5;
 712                 sctp_audit_indx++;
 713                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 714                         sctp_audit_indx = 0;
 715                 }
 716                 rep = 1;
 717                 SCTP_PRINTF("tot_flt_book:%d\n", tot_book_cnt);
 718
 719                 stcb->asoc.total_flight_count = tot_book_cnt;
 720         }
 721         tot_out = 0;
 722         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 723                 tot_out += lnet->flight_size;
 724         }
 725         if (tot_out != stcb->asoc.total_flight) {
 726                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 727                 sctp_audit_data[sctp_audit_indx][1] = 0xA3;
 728                 sctp_audit_indx++;
 729                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 730                         sctp_audit_indx = 0;
 731                 }
 732                 rep = 1;
 733                 SCTP_PRINTF("real flight:%d net total was %d\n",
 734                     stcb->asoc.total_flight, tot_out);
 735                 /* now corrective action */
 736                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 737                         tot_out = 0;
 738                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 739                                 if ((chk->whoTo == lnet) &&
 740                                     (chk->sent < SCTP_DATAGRAM_RESEND)) {
 741                                         tot_out += chk->book_size;
 742                                 }
 743                         }
 744                         if (lnet->flight_size != tot_out) {
 745                                 SCTP_PRINTF("net:%p flight was %d corrected to %d\n",
 746                                     (void *)lnet, lnet->flight_size,
 747                                     tot_out);
 748                                 lnet->flight_size = tot_out;
 749                         }
 750                 }
 751         }
 752         if (rep) {
 753                 sctp_print_audit_report();
 754         }
 755 }
 756
 757 void
 758 sctp_audit_log(uint8_t ev, uint8_t fd)
 759 {
 760
 761         sctp_audit_data[sctp_audit_indx][0] = ev;
 762         sctp_audit_data[sctp_audit_indx][1] = fd;
 763         sctp_audit_indx++;
 764         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 765                 sctp_audit_indx = 0;
 766         }
 767 }
 768
 769 #endif
 770
 771 /*
 772  * The conversion from time to ticks and vice versa is done by rounding
 773  * upwards. This way we can test in the code the time to be positive and
 774  * know that this corresponds to a positive number of ticks.
 775  */
 776
 777 uint32_t
 778 sctp_msecs_to_ticks(uint32_t msecs)
 779 {
 780         uint64_t temp;
 781         uint32_t ticks;
 782
 783         if (hz == 1000) {
 784                 ticks = msecs;
 785         } else {
 786                 temp = (((uint64_t)msecs * hz) + 999) / 1000;
 787                 if (temp > UINT32_MAX) {
 788                         ticks = UINT32_MAX;
 789                 } else {
 790                         ticks = (uint32_t)temp;
 791                 }
 792         }
 793         return (ticks);
 794 }
 795
 796 uint32_t
 797 sctp_ticks_to_msecs(uint32_t ticks)
 798 {
 799         uint64_t temp;
 800         uint32_t msecs;
 801
 802         if (hz == 1000) {
 803                 msecs = ticks;
 804         } else {
 805                 temp = (((uint64_t)ticks * 1000) + (hz - 1)) / hz;
 806                 if (temp > UINT32_MAX) {
 807                         msecs = UINT32_MAX;
 808                 } else {
 809                         msecs = (uint32_t)temp;
 810                 }
 811         }
 812         return (msecs);
 813 }
 814
 815 uint32_t
 816 sctp_secs_to_ticks(uint32_t secs)
 817 {
 818         uint64_t temp;
 819         uint32_t ticks;
 820
 821         temp = (uint64_t)secs * hz;
 822         if (temp > UINT32_MAX) {
 823                 ticks = UINT32_MAX;
 824         } else {
 825                 ticks = (uint32_t)temp;
 826         }
 827         return (ticks);
 828 }
 829
 830 uint32_t
 831 sctp_ticks_to_secs(uint32_t ticks)
 832 {
 833         uint64_t temp;
 834         uint32_t secs;
 835
 836         temp = ((uint64_t)ticks + (hz - 1)) / hz;
 837         if (temp > UINT32_MAX) {
 838                 secs = UINT32_MAX;
 839         } else {
 840                 secs = (uint32_t)temp;
 841         }
 842         return (secs);
 843 }
 844
 845 /*
 846  * sctp_stop_timers_for_shutdown() should be called
 847  * when entering the SHUTDOWN_SENT or SHUTDOWN_ACK_SENT
 848  * state to make sure that all timers are stopped.
 849  */
 850 void
 851 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb)
 852 {
 853         struct sctp_inpcb *inp;
 854         struct sctp_nets *net;
 855
 856         inp = stcb->sctp_ep;
 857
 858         sctp_timer_stop(SCTP_TIMER_TYPE_RECV, inp, stcb, NULL,
 859             SCTP_FROM_SCTPUTIL + SCTP_LOC_12);
 860         sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, inp, stcb, NULL,
 861             SCTP_FROM_SCTPUTIL + SCTP_LOC_13);
 862         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, inp, stcb, NULL,
 863             SCTP_FROM_SCTPUTIL + SCTP_LOC_14);
 864         sctp_timer_stop(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL,
 865             SCTP_FROM_SCTPUTIL + SCTP_LOC_15);
 866         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 867                 sctp_timer_stop(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net,
 868                     SCTP_FROM_SCTPUTIL + SCTP_LOC_16);
 869                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
 870                     SCTP_FROM_SCTPUTIL + SCTP_LOC_17);
 871         }
 872 }
 873
 874 void
 875 sctp_stop_association_timers(struct sctp_tcb *stcb, bool stop_assoc_kill_timer)
 876 {
 877         struct sctp_inpcb *inp;
 878         struct sctp_nets *net;
 879
 880         inp = stcb->sctp_ep;
 881         sctp_timer_stop(SCTP_TIMER_TYPE_RECV, inp, stcb, NULL,
 882             SCTP_FROM_SCTPUTIL + SCTP_LOC_18);
 883         sctp_timer_stop(SCTP_TIMER_TYPE_STRRESET, inp, stcb, NULL,
 884             SCTP_FROM_SCTPUTIL + SCTP_LOC_19);
 885         if (stop_assoc_kill_timer) {
 886                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL,
 887                     SCTP_FROM_SCTPUTIL + SCTP_LOC_20);
 888         }
 889         sctp_timer_stop(SCTP_TIMER_TYPE_ASCONF, inp, stcb, NULL,
 890             SCTP_FROM_SCTPUTIL + SCTP_LOC_21);
 891         sctp_timer_stop(SCTP_TIMER_TYPE_AUTOCLOSE, inp, stcb, NULL,
 892             SCTP_FROM_SCTPUTIL + SCTP_LOC_22);
 893         sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNGUARD, inp, stcb, NULL,
 894             SCTP_FROM_SCTPUTIL + SCTP_LOC_23);
 895         /* Mobility adaptation */
 896         sctp_timer_stop(SCTP_TIMER_TYPE_PRIM_DELETED, inp, stcb, NULL,
 897             SCTP_FROM_SCTPUTIL + SCTP_LOC_24);
 898         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
 899                 sctp_timer_stop(SCTP_TIMER_TYPE_SEND, inp, stcb, net,
 900                     SCTP_FROM_SCTPUTIL + SCTP_LOC_25);
 901                 sctp_timer_stop(SCTP_TIMER_TYPE_INIT, inp, stcb, net,
 902                     SCTP_FROM_SCTPUTIL + SCTP_LOC_26);
 903                 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWN, inp, stcb, net,
 904                     SCTP_FROM_SCTPUTIL + SCTP_LOC_27);
 905                 sctp_timer_stop(SCTP_TIMER_TYPE_COOKIE, inp, stcb, net,
 906                     SCTP_FROM_SCTPUTIL + SCTP_LOC_28);
 907                 sctp_timer_stop(SCTP_TIMER_TYPE_SHUTDOWNACK, inp, stcb, net,
 908                     SCTP_FROM_SCTPUTIL + SCTP_LOC_29);
 909                 sctp_timer_stop(SCTP_TIMER_TYPE_PATHMTURAISE, inp, stcb, net,
 910                     SCTP_FROM_SCTPUTIL + SCTP_LOC_30);
 911                 sctp_timer_stop(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net,
 912                     SCTP_FROM_SCTPUTIL + SCTP_LOC_31);
 913         }
 914 }
 915
 916 /*
 917  * A list of sizes based on typical mtu's, used only if next hop size not
 918  * returned. These values MUST be multiples of 4 and MUST be ordered.
 919  */
 920 static uint32_t sctp_mtu_sizes[] = {
 921         68,
 922         296,
 923         508,
 924         512,
 925         544,
 926         576,
 927         1004,
 928         1492,
 929         1500,
 930         1536,
 931         2000,
 932         2048,
 933         4352,
 934         4464,
 935         8168,
 936         17912,
 937         32000,
 938         65532
 939 };
 940
 941 /*
 942  * Return the largest MTU in sctp_mtu_sizes smaller than val.
 943  * If val is smaller than the minimum, just return the largest
 944  * multiple of 4 smaller or equal to val.
 945  * Ensure that the result is a multiple of 4.
 946  */
 947 uint32_t
 948 sctp_get_prev_mtu(uint32_t val)
 949 {
 950         uint32_t i;
 951
 952         val &= 0xfffffffc;
 953         if (val <= sctp_mtu_sizes[0]) {
 954                 return (val);
 955         }
 956         for (i = 1; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 957                 if (val <= sctp_mtu_sizes[i]) {
 958                         break;
 959                 }
 960         }
 961         KASSERT((sctp_mtu_sizes[i - 1] & 0x00000003) == 0,
 962             ("sctp_mtu_sizes[%u] not a multiple of 4", i - 1));
 963         return (sctp_mtu_sizes[i - 1]);
 964 }
 965
 966 /*
 967  * Return the smallest MTU in sctp_mtu_sizes larger than val.
 968  * If val is larger than the maximum, just return the largest multiple of 4 smaller
 969  * or equal to val.
 970  * Ensure that the result is a multiple of 4.
 971  */
 972 uint32_t
 973 sctp_get_next_mtu(uint32_t val)
 974 {
 975         /* select another MTU that is just bigger than this one */
 976         uint32_t i;
 977
 978         val &= 0xfffffffc;
 979         for (i = 0; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 980                 if (val < sctp_mtu_sizes[i]) {
 981                         KASSERT((sctp_mtu_sizes[i] & 0x00000003) == 0,
 982                             ("sctp_mtu_sizes[%u] not a multiple of 4", i));
 983                         return (sctp_mtu_sizes[i]);
 984                 }
 985         }
 986         return (val);
 987 }
 988
 989 void
 990 sctp_fill_random_store(struct sctp_pcb *m)
 991 {
 992         /*
 993          * Here we use the MD5/SHA-1 to hash with our good randomNumbers and
 994          * our counter. The result becomes our good random numbers and we
 995          * then setup to give these out. Note that we do no locking to
 996          * protect this. This is ok, since if competing folks call this we
 997          * will get more gobbled gook in the random store which is what we
 998          * want. There is a danger that two guys will use the same random
 999          * numbers, but thats ok too since that is random as well :->
1000          */
1001         m->store_at = 0;
1002         (void)sctp_hmac(SCTP_HMAC, (uint8_t *)m->random_numbers,
1003             sizeof(m->random_numbers), (uint8_t *)&m->random_counter,
1004             sizeof(m->random_counter), (uint8_t *)m->random_store);
1005         m->random_counter++;
1006 }
1007
1008 uint32_t
1009 sctp_select_initial_TSN(struct sctp_pcb *inp)
1010 {
1011         /*
1012          * A true implementation should use random selection process to get
1013          * the initial stream sequence number, using RFC1750 as a good
1014          * guideline
1015          */
1016         uint32_t x, *xp;
1017         uint8_t *p;
1018         int store_at, new_store;
1019
1020         if (inp->initial_sequence_debug != 0) {
1021                 uint32_t ret;
1022
1023                 ret = inp->initial_sequence_debug;
1024                 inp->initial_sequence_debug++;
1025                 return (ret);
1026         }
1027 retry:
1028         store_at = inp->store_at;
1029         new_store = store_at + sizeof(uint32_t);
1030         if (new_store >= (SCTP_SIGNATURE_SIZE - 3)) {
1031                 new_store = 0;
1032         }
1033         if (!atomic_cmpset_int(&inp->store_at, store_at, new_store)) {
1034                 goto retry;
1035         }
1036         if (new_store == 0) {
1037                 /* Refill the random store */
1038                 sctp_fill_random_store(inp);
1039         }
1040         p = &inp->random_store[store_at];
1041         xp = (uint32_t *)p;
1042         x = *xp;
1043         return (x);
1044 }
1045
1046 uint32_t
1047 sctp_select_a_tag(struct sctp_inpcb *inp, uint16_t lport, uint16_t rport, int check)
1048 {
1049         uint32_t x;
1050         struct timeval now;
1051
1052         if (check) {
1053                 (void)SCTP_GETTIME_TIMEVAL(&now);
1054         }
1055         for (;;) {
1056                 x = sctp_select_initial_TSN(&inp->sctp_ep);
1057                 if (x == 0) {
1058                         /* we never use 0 */
1059                         continue;
1060                 }
1061                 if (!check || sctp_is_vtag_good(x, lport, rport, &now)) {
1062                         break;
1063                 }
1064         }
1065         return (x);
1066 }
1067
1068 int32_t
1069 sctp_map_assoc_state(int kernel_state)
1070 {
1071         int32_t user_state;
1072
1073         if (kernel_state & SCTP_STATE_WAS_ABORTED) {
1074                 user_state = SCTP_CLOSED;
1075         } else if (kernel_state & SCTP_STATE_SHUTDOWN_PENDING) {
1076                 user_state = SCTP_SHUTDOWN_PENDING;
1077         } else {
1078                 switch (kernel_state & SCTP_STATE_MASK) {
1079                 case SCTP_STATE_EMPTY:
1080                         user_state = SCTP_CLOSED;
1081                         break;
1082                 case SCTP_STATE_INUSE:
1083                         user_state = SCTP_CLOSED;
1084                         break;
1085                 case SCTP_STATE_COOKIE_WAIT:
1086                         user_state = SCTP_COOKIE_WAIT;
1087                         break;
1088                 case SCTP_STATE_COOKIE_ECHOED:
1089                         user_state = SCTP_COOKIE_ECHOED;
1090                         break;
1091                 case SCTP_STATE_OPEN:
1092                         user_state = SCTP_ESTABLISHED;
1093                         break;
1094                 case SCTP_STATE_SHUTDOWN_SENT:
1095                         user_state = SCTP_SHUTDOWN_SENT;
1096                         break;
1097                 case SCTP_STATE_SHUTDOWN_RECEIVED:
1098                         user_state = SCTP_SHUTDOWN_RECEIVED;
1099                         break;
1100                 case SCTP_STATE_SHUTDOWN_ACK_SENT:
1101                         user_state = SCTP_SHUTDOWN_ACK_SENT;
1102                         break;
1103                 default:
1104                         user_state = SCTP_CLOSED;
1105                         break;
1106                 }
1107         }
1108         return (user_state);
1109 }
1110
1111 int
1112 sctp_init_asoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1113     uint32_t override_tag, uint32_t initial_tsn, uint32_t vrf_id,
1114     uint16_t o_strms)
1115 {
1116         struct sctp_association *asoc;
1117
1118         /*
1119          * Anything set to zero is taken care of by the allocation routine's
1120          * bzero
1121          */
1122
1123         /*
1124          * Up front select what scoping to apply on addresses I tell my peer
1125          * Not sure what to do with these right now, we will need to come up
1126          * with a way to set them. We may need to pass them through from the
1127          * caller in the sctp_aloc_assoc() function.
1128          */
1129         int i;
1130 #if defined(SCTP_DETAILED_STR_STATS)
1131         int j;
1132 #endif
1133
1134         asoc = &stcb->asoc;
1135         /* init all variables to a known value. */
1136         SCTP_SET_STATE(stcb, SCTP_STATE_INUSE);
1137         asoc->max_burst = inp->sctp_ep.max_burst;
1138         asoc->fr_max_burst = inp->sctp_ep.fr_max_burst;
1139         asoc->heart_beat_delay = sctp_ticks_to_msecs(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]);
1140         asoc->cookie_life = inp->sctp_ep.def_cookie_life;
1141         asoc->sctp_cmt_on_off = inp->sctp_cmt_on_off;
1142         asoc->ecn_supported = inp->ecn_supported;
1143         asoc->prsctp_supported = inp->prsctp_supported;
1144         asoc->auth_supported = inp->auth_supported;
1145         asoc->asconf_supported = inp->asconf_supported;
1146         asoc->reconfig_supported = inp->reconfig_supported;
1147         asoc->nrsack_supported = inp->nrsack_supported;
1148         asoc->pktdrop_supported = inp->pktdrop_supported;
1149         asoc->idata_supported = inp->idata_supported;
1150         asoc->sctp_cmt_pf = (uint8_t)0;
1151         asoc->sctp_frag_point = inp->sctp_frag_point;
1152         asoc->sctp_features = inp->sctp_features;
1153         asoc->default_dscp = inp->sctp_ep.default_dscp;
1154         asoc->max_cwnd = inp->max_cwnd;
1155 #ifdef INET6
1156         if (inp->sctp_ep.default_flowlabel) {
1157                 asoc->default_flowlabel = inp->sctp_ep.default_flowlabel;
1158         } else {
1159                 if (inp->ip_inp.inp.inp_flags & IN6P_AUTOFLOWLABEL) {
1160                         asoc->default_flowlabel = sctp_select_initial_TSN(&inp->sctp_ep);
1161                         asoc->default_flowlabel &= 0x000fffff;
1162                         asoc->default_flowlabel |= 0x80000000;
1163                 } else {
1164                         asoc->default_flowlabel = 0;
1165                 }
1166         }
1167 #endif
1168         asoc->sb_send_resv = 0;
1169         if (override_tag) {
1170                 asoc->my_vtag = override_tag;
1171         } else {
1172                 asoc->my_vtag = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
1173         }
1174         /* Get the nonce tags */
1175         asoc->my_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
1176         asoc->peer_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
1177         asoc->vrf_id = vrf_id;
1178
1179 #ifdef SCTP_ASOCLOG_OF_TSNS
1180         asoc->tsn_in_at = 0;
1181         asoc->tsn_out_at = 0;
1182         asoc->tsn_in_wrapped = 0;
1183         asoc->tsn_out_wrapped = 0;
1184         asoc->cumack_log_at = 0;
1185         asoc->cumack_log_atsnt = 0;
1186 #endif
1187 #ifdef SCTP_FS_SPEC_LOG
1188         asoc->fs_index = 0;
1189 #endif
1190         asoc->refcnt = 0;
1191         asoc->assoc_up_sent = 0;
1192         if (override_tag) {
1193                 asoc->init_seq_number = initial_tsn;
1194         } else {
1195                 asoc->init_seq_number = sctp_select_initial_TSN(&inp->sctp_ep);
1196         }
1197         asoc->asconf_seq_out = asoc->init_seq_number;
1198         asoc->str_reset_seq_out = asoc->init_seq_number;
1199         asoc->sending_seq = asoc->init_seq_number;
1200         asoc->asconf_seq_out_acked = asoc->init_seq_number - 1;
1201         /* we are optimistic here */
1202         asoc->peer_supports_nat = 0;
1203         asoc->sent_queue_retran_cnt = 0;
1204
1205         /* for CMT */
1206         asoc->last_net_cmt_send_started = NULL;
1207
1208         asoc->last_acked_seq = asoc->init_seq_number - 1;
1209         asoc->advanced_peer_ack_point = asoc->init_seq_number - 1;
1210         asoc->asconf_seq_in = asoc->init_seq_number - 1;
1211
1212         /* here we are different, we hold the next one we expect */
1213         asoc->str_reset_seq_in = asoc->init_seq_number;
1214
1215         asoc->initial_init_rto_max = inp->sctp_ep.initial_init_rto_max;
1216         asoc->initial_rto = inp->sctp_ep.initial_rto;
1217
1218         asoc->default_mtu = inp->sctp_ep.default_mtu;
1219         asoc->max_init_times = inp->sctp_ep.max_init_times;
1220         asoc->max_send_times = inp->sctp_ep.max_send_times;
1221         asoc->def_net_failure = inp->sctp_ep.def_net_failure;
1222         asoc->def_net_pf_threshold = inp->sctp_ep.def_net_pf_threshold;
1223         asoc->free_chunk_cnt = 0;
1224
1225         asoc->iam_blocking = 0;
1226         asoc->context = inp->sctp_context;
1227         asoc->local_strreset_support = inp->local_strreset_support;
1228         asoc->def_send = inp->def_send;
1229         asoc->delayed_ack = sctp_ticks_to_msecs(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]);
1230         asoc->sack_freq = inp->sctp_ep.sctp_sack_freq;
1231         asoc->pr_sctp_cnt = 0;
1232         asoc->total_output_queue_size = 0;
1233
1234         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1235                 asoc->scope.ipv6_addr_legal = 1;
1236                 if (SCTP_IPV6_V6ONLY(inp) == 0) {
1237                         asoc->scope.ipv4_addr_legal = 1;
1238                 } else {
1239                         asoc->scope.ipv4_addr_legal = 0;
1240                 }
1241         } else {
1242                 asoc->scope.ipv6_addr_legal = 0;
1243                 asoc->scope.ipv4_addr_legal = 1;
1244         }
1245
1246         asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(inp->sctp_socket), SCTP_MINIMAL_RWND);
1247         asoc->peers_rwnd = SCTP_SB_LIMIT_RCV(inp->sctp_socket);
1248
1249         asoc->smallest_mtu = 0;
1250         asoc->minrto = inp->sctp_ep.sctp_minrto;
1251         asoc->maxrto = inp->sctp_ep.sctp_maxrto;
1252
1253         asoc->stream_locked_on = 0;
1254         asoc->ecn_echo_cnt_onq = 0;
1255         asoc->stream_locked = 0;
1256
1257         asoc->send_sack = 1;
1258
1259         LIST_INIT(&asoc->sctp_restricted_addrs);
1260
1261         TAILQ_INIT(&asoc->nets);
1262         TAILQ_INIT(&asoc->pending_reply_queue);
1263         TAILQ_INIT(&asoc->asconf_ack_sent);
1264         /* Setup to fill the hb random cache at first HB */
1265         asoc->hb_random_idx = 4;
1266
1267         asoc->sctp_autoclose_ticks = inp->sctp_ep.auto_close_time;
1268
1269         stcb->asoc.congestion_control_module = inp->sctp_ep.sctp_default_cc_module;
1270         stcb->asoc.cc_functions = sctp_cc_functions[inp->sctp_ep.sctp_default_cc_module];
1271
1272         stcb->asoc.stream_scheduling_module = inp->sctp_ep.sctp_default_ss_module;
1273         stcb->asoc.ss_functions = sctp_ss_functions[inp->sctp_ep.sctp_default_ss_module];
1274
1275         /*
1276          * Now the stream parameters, here we allocate space for all streams
1277          * that we request by default.
1278          */
1279         asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams =
1280             o_strms;
1281         SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *,
1282             asoc->streamoutcnt * sizeof(struct sctp_stream_out),
1283             SCTP_M_STRMO);
1284         if (asoc->strmout == NULL) {
1285                 /* big trouble no memory */
1286                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1287                 return (ENOMEM);
1288         }
1289         SCTP_TCB_LOCK(stcb);
1290         for (i = 0; i < asoc->streamoutcnt; i++) {
1291                 /*
1292                  * inbound side must be set to 0xffff, also NOTE when we get
1293                  * the INIT-ACK back (for INIT sender) we MUST reduce the
1294                  * count (streamoutcnt) but first check if we sent to any of
1295                  * the upper streams that were dropped (if some were). Those
1296                  * that were dropped must be notified to the upper layer as
1297                  * failed to send.
1298                  */
1299                 TAILQ_INIT(&asoc->strmout[i].outqueue);
1300                 asoc->ss_functions.sctp_ss_init_stream(stcb, &asoc->strmout[i], NULL);
1301                 asoc->strmout[i].chunks_on_queues = 0;
1302 #if defined(SCTP_DETAILED_STR_STATS)
1303                 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) {
1304                         asoc->strmout[i].abandoned_sent[j] = 0;
1305                         asoc->strmout[i].abandoned_unsent[j] = 0;
1306                 }
1307 #else
1308                 asoc->strmout[i].abandoned_sent[0] = 0;
1309                 asoc->strmout[i].abandoned_unsent[0] = 0;
1310 #endif
1311                 asoc->strmout[i].next_mid_ordered = 0;
1312                 asoc->strmout[i].next_mid_unordered = 0;
1313                 asoc->strmout[i].sid = i;
1314                 asoc->strmout[i].last_msg_incomplete = 0;
1315                 asoc->strmout[i].state = SCTP_STREAM_OPENING;
1316         }
1317         asoc->ss_functions.sctp_ss_init(stcb, asoc);
1318         SCTP_TCB_UNLOCK(stcb);
1319
1320         /* Now the mapping array */
1321         asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY;
1322         SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size,
1323             SCTP_M_MAP);
1324         if (asoc->mapping_array == NULL) {
1325                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1326                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1327                 return (ENOMEM);
1328         }
1329         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
1330         SCTP_MALLOC(asoc->nr_mapping_array, uint8_t *, asoc->mapping_array_size,
1331             SCTP_M_MAP);
1332         if (asoc->nr_mapping_array == NULL) {
1333                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1334                 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1335                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1336                 return (ENOMEM);
1337         }
1338         memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
1339
1340         /* Now the init of the other outqueues */
1341         TAILQ_INIT(&asoc->free_chunks);
1342         TAILQ_INIT(&asoc->control_send_queue);
1343         TAILQ_INIT(&asoc->asconf_send_queue);
1344         TAILQ_INIT(&asoc->send_queue);
1345         TAILQ_INIT(&asoc->sent_queue);
1346         TAILQ_INIT(&asoc->resetHead);
1347         asoc->max_inbound_streams = inp->sctp_ep.max_open_streams_intome;
1348         TAILQ_INIT(&asoc->asconf_queue);
1349         /* authentication fields */
1350         asoc->authinfo.random = NULL;
1351         asoc->authinfo.active_keyid = 0;
1352         asoc->authinfo.assoc_key = NULL;
1353         asoc->authinfo.assoc_keyid = 0;
1354         asoc->authinfo.recv_key = NULL;
1355         asoc->authinfo.recv_keyid = 0;
1356         LIST_INIT(&asoc->shared_keys);
1357         asoc->marked_retrans = 0;
1358         asoc->port = inp->sctp_ep.port;
1359         asoc->timoinit = 0;
1360         asoc->timodata = 0;
1361         asoc->timosack = 0;
1362         asoc->timoshutdown = 0;
1363         asoc->timoheartbeat = 0;
1364         asoc->timocookie = 0;
1365         asoc->timoshutdownack = 0;
1366         (void)SCTP_GETTIME_TIMEVAL(&asoc->start_time);
1367         asoc->discontinuity_time = asoc->start_time;
1368         for (i = 0; i < SCTP_PR_SCTP_MAX + 1; i++) {
1369                 asoc->abandoned_unsent[i] = 0;
1370                 asoc->abandoned_sent[i] = 0;
1371         }
1372         /*
1373          * sa_ignore MEMLEAK {memory is put in the assoc mapping array and
1374          * freed later when the association is freed.
1375          */
1376         return (0);
1377 }
1378
1379 void
1380 sctp_print_mapping_array(struct sctp_association *asoc)
1381 {
1382         unsigned int i, limit;
1383
1384         SCTP_PRINTF("Mapping array size: %d, baseTSN: %8.8x, cumAck: %8.8x, highestTSN: (%8.8x, %8.8x).\n",
1385             asoc->mapping_array_size,
1386             asoc->mapping_array_base_tsn,
1387             asoc->cumulative_tsn,
1388             asoc->highest_tsn_inside_map,
1389             asoc->highest_tsn_inside_nr_map);
1390         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1391                 if (asoc->mapping_array[limit - 1] != 0) {
1392                         break;
1393                 }
1394         }
1395         SCTP_PRINTF("Renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1396         for (i = 0; i < limit; i++) {
1397                 SCTP_PRINTF("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1398         }
1399         if (limit % 16)
1400                 SCTP_PRINTF("\n");
1401         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1402                 if (asoc->nr_mapping_array[limit - 1]) {
1403                         break;
1404                 }
1405         }
1406         SCTP_PRINTF("Non renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1407         for (i = 0; i < limit; i++) {
1408                 SCTP_PRINTF("%2.2x%c", asoc->nr_mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1409         }
1410         if (limit % 16)
1411                 SCTP_PRINTF("\n");
1412 }
1413
1414 int
1415 sctp_expand_mapping_array(struct sctp_association *asoc, uint32_t needed)
1416 {
1417         /* mapping array needs to grow */
1418         uint8_t *new_array1, *new_array2;
1419         uint32_t new_size;
1420
1421         new_size = asoc->mapping_array_size + ((needed + 7) / 8 + SCTP_MAPPING_ARRAY_INCR);
1422         SCTP_MALLOC(new_array1, uint8_t *, new_size, SCTP_M_MAP);
1423         SCTP_MALLOC(new_array2, uint8_t *, new_size, SCTP_M_MAP);
1424         if ((new_array1 == NULL) || (new_array2 == NULL)) {
1425                 /* can't get more, forget it */
1426                 SCTP_PRINTF("No memory for expansion of SCTP mapping array %d\n", new_size);
1427                 if (new_array1) {
1428                         SCTP_FREE(new_array1, SCTP_M_MAP);
1429                 }
1430                 if (new_array2) {
1431                         SCTP_FREE(new_array2, SCTP_M_MAP);
1432                 }
1433                 return (-1);
1434         }
1435         memset(new_array1, 0, new_size);
1436         memset(new_array2, 0, new_size);
1437         memcpy(new_array1, asoc->mapping_array, asoc->mapping_array_size);
1438         memcpy(new_array2, asoc->nr_mapping_array, asoc->mapping_array_size);
1439         SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1440         SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
1441         asoc->mapping_array = new_array1;
1442         asoc->nr_mapping_array = new_array2;
1443         asoc->mapping_array_size = new_size;
1444         return (0);
1445 }
1446
1447 static void
1448 sctp_iterator_work(struct sctp_iterator *it)
1449 {
1450         struct epoch_tracker et;
1451         struct sctp_inpcb *tinp;
1452         int iteration_count = 0;
1453         int inp_skip = 0;
1454         int first_in = 1;
1455
1456         NET_EPOCH_ENTER(et);
1457         SCTP_INP_INFO_RLOCK();
1458         SCTP_ITERATOR_LOCK();
1459         sctp_it_ctl.cur_it = it;
1460         if (it->inp) {
1461                 SCTP_INP_RLOCK(it->inp);
1462                 SCTP_INP_DECR_REF(it->inp);
1463         }
1464         if (it->inp == NULL) {
1465                 /* iterator is complete */
1466 done_with_iterator:
1467                 sctp_it_ctl.cur_it = NULL;
1468                 SCTP_ITERATOR_UNLOCK();
1469                 SCTP_INP_INFO_RUNLOCK();
1470                 if (it->function_atend != NULL) {
1471                         (*it->function_atend) (it->pointer, it->val);
1472                 }
1473                 SCTP_FREE(it, SCTP_M_ITER);
1474                 NET_EPOCH_EXIT(et);
1475                 return;
1476         }
1477 select_a_new_ep:
1478         if (first_in) {
1479                 first_in = 0;
1480         } else {
1481                 SCTP_INP_RLOCK(it->inp);
1482         }
1483         while (((it->pcb_flags) &&
1484             ((it->inp->sctp_flags & it->pcb_flags) != it->pcb_flags)) ||
1485             ((it->pcb_features) &&
1486             ((it->inp->sctp_features & it->pcb_features) != it->pcb_features))) {
1487                 /* endpoint flags or features don't match, so keep looking */
1488                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1489                         SCTP_INP_RUNLOCK(it->inp);
1490                         goto done_with_iterator;
1491                 }
1492                 tinp = it->inp;
1493                 it->inp = LIST_NEXT(it->inp, sctp_list);
1494                 it->stcb = NULL;
1495                 SCTP_INP_RUNLOCK(tinp);
1496                 if (it->inp == NULL) {
1497                         goto done_with_iterator;
1498                 }
1499                 SCTP_INP_RLOCK(it->inp);
1500         }
1501         /* now go through each assoc which is in the desired state */
1502         if (it->done_current_ep == 0) {
1503                 if (it->function_inp != NULL)
1504                         inp_skip = (*it->function_inp) (it->inp, it->pointer, it->val);
1505                 it->done_current_ep = 1;
1506         }
1507         if (it->stcb == NULL) {
1508                 /* run the per instance function */
1509                 it->stcb = LIST_FIRST(&it->inp->sctp_asoc_list);
1510         }
1511         if ((inp_skip) || it->stcb == NULL) {
1512                 if (it->function_inp_end != NULL) {
1513                         inp_skip = (*it->function_inp_end) (it->inp,
1514                             it->pointer,
1515                             it->val);
1516                 }
1517                 SCTP_INP_RUNLOCK(it->inp);
1518                 goto no_stcb;
1519         }
1520         while (it->stcb != NULL) {
1521                 SCTP_TCB_LOCK(it->stcb);
1522                 if (it->asoc_state && ((it->stcb->asoc.state & it->asoc_state) != it->asoc_state)) {
1523                         /* not in the right state... keep looking */
1524                         SCTP_TCB_UNLOCK(it->stcb);
1525                         goto next_assoc;
1526                 }
1527                 /* see if we have limited out the iterator loop */
1528                 iteration_count++;
1529                 if (iteration_count > SCTP_ITERATOR_MAX_AT_ONCE) {
1530                         /* Pause to let others grab the lock */
1531                         atomic_add_int(&it->stcb->asoc.refcnt, 1);
1532                         SCTP_TCB_UNLOCK(it->stcb);
1533                         SCTP_INP_INCR_REF(it->inp);
1534                         SCTP_INP_RUNLOCK(it->inp);
1535                         SCTP_ITERATOR_UNLOCK();
1536                         SCTP_INP_INFO_RUNLOCK();
1537                         SCTP_INP_INFO_RLOCK();
1538                         SCTP_ITERATOR_LOCK();
1539                         if (sctp_it_ctl.iterator_flags) {
1540                                 /* We won't be staying here */
1541                                 SCTP_INP_DECR_REF(it->inp);
1542                                 atomic_subtract_int(&it->stcb->asoc.refcnt, 1);
1543                                 if (sctp_it_ctl.iterator_flags &
1544                                     SCTP_ITERATOR_STOP_CUR_IT) {
1545                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_IT;
1546                                         goto done_with_iterator;
1547                                 }
1548                                 if (sctp_it_ctl.iterator_flags &
1549                                     SCTP_ITERATOR_STOP_CUR_INP) {
1550                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_INP;
1551                                         goto no_stcb;
1552                                 }
1553                                 /* If we reach here huh? */
1554                                 SCTP_PRINTF("Unknown it ctl flag %x\n",
1555                                     sctp_it_ctl.iterator_flags);
1556                                 sctp_it_ctl.iterator_flags = 0;
1557                         }
1558                         SCTP_INP_RLOCK(it->inp);
1559                         SCTP_INP_DECR_REF(it->inp);
1560                         SCTP_TCB_LOCK(it->stcb);
1561                         atomic_subtract_int(&it->stcb->asoc.refcnt, 1);
1562                         iteration_count = 0;
1563                 }
1564                 KASSERT(it->inp == it->stcb->sctp_ep,
1565                     ("%s: stcb %p does not belong to inp %p, but inp %p",
1566                     __func__, it->stcb, it->inp, it->stcb->sctp_ep));
1567                 SCTP_INP_RLOCK_ASSERT(it->inp);
1568                 SCTP_TCB_LOCK_ASSERT(it->stcb);
1569
1570                 /* run function on this one */
1571                 (*it->function_assoc) (it->inp, it->stcb, it->pointer, it->val);
1572                 SCTP_INP_RLOCK_ASSERT(it->inp);
1573                 SCTP_TCB_LOCK_ASSERT(it->stcb);
1574
1575                 /*
1576                  * we lie here, it really needs to have its own type but
1577                  * first I must verify that this won't effect things :-0
1578                  */
1579                 if (it->no_chunk_output == 0) {
1580                         sctp_chunk_output(it->inp, it->stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1581                         SCTP_INP_RLOCK_ASSERT(it->inp);
1582                         SCTP_TCB_LOCK_ASSERT(it->stcb);
1583                 }
1584
1585                 SCTP_TCB_UNLOCK(it->stcb);
1586 next_assoc:
1587                 it->stcb = LIST_NEXT(it->stcb, sctp_tcblist);
1588                 if (it->stcb == NULL) {
1589                         /* Run last function */
1590                         if (it->function_inp_end != NULL) {
1591                                 inp_skip = (*it->function_inp_end) (it->inp,
1592                                     it->pointer,
1593                                     it->val);
1594                         }
1595                 }
1596         }
1597         SCTP_INP_RUNLOCK(it->inp);
1598 no_stcb:
1599         /* done with all assocs on this endpoint, move on to next endpoint */
1600         it->done_current_ep = 0;
1601         if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1602                 it->inp = NULL;
1603         } else {
1604                 it->inp = LIST_NEXT(it->inp, sctp_list);
1605         }
1606         it->stcb = NULL;
1607         if (it->inp == NULL) {
1608                 goto done_with_iterator;
1609         }
1610         goto select_a_new_ep;
1611 }
1612
1613 void
1614 sctp_iterator_worker(void)
1615 {
1616         struct sctp_iterator *it;
1617
1618         /* This function is called with the WQ lock in place */
1619         sctp_it_ctl.iterator_running = 1;
1620         while ((it = TAILQ_FIRST(&sctp_it_ctl.iteratorhead)) != NULL) {
1621                 /* now lets work on this one */
1622                 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
1623                 SCTP_IPI_ITERATOR_WQ_UNLOCK();
1624                 CURVNET_SET(it->vn);
1625                 sctp_iterator_work(it);
1626                 CURVNET_RESTORE();
1627                 SCTP_IPI_ITERATOR_WQ_LOCK();
1628                 /* sa_ignore FREED_MEMORY */
1629         }
1630         sctp_it_ctl.iterator_running = 0;
1631         return;
1632 }
1633
1634 static void
1635 sctp_handle_addr_wq(void)
1636 {
1637         /* deal with the ADDR wq from the rtsock calls */
1638         struct sctp_laddr *wi, *nwi;
1639         struct sctp_asconf_iterator *asc;
1640
1641         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
1642             sizeof(struct sctp_asconf_iterator), SCTP_M_ASC_IT);
1643         if (asc == NULL) {
1644                 /* Try later, no memory */
1645                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
1646                     (struct sctp_inpcb *)NULL,
1647                     (struct sctp_tcb *)NULL,
1648                     (struct sctp_nets *)NULL);
1649                 return;
1650         }
1651         LIST_INIT(&asc->list_of_work);
1652         asc->cnt = 0;
1653
1654         LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) {
1655                 LIST_REMOVE(wi, sctp_nxt_addr);
1656                 LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
1657                 asc->cnt++;
1658         }
1659
1660         if (asc->cnt == 0) {
1661                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1662         } else {
1663                 int ret;
1664
1665                 ret = sctp_initiate_iterator(sctp_asconf_iterator_ep,
1666                     sctp_asconf_iterator_stcb,
1667                     NULL,       /* No ep end for boundall */
1668                     SCTP_PCB_FLAGS_BOUNDALL,
1669                     SCTP_PCB_ANY_FEATURES,
1670                     SCTP_ASOC_ANY_STATE,
1671                     (void *)asc, 0,
1672                     sctp_asconf_iterator_end, NULL, 0);
1673                 if (ret) {
1674                         SCTP_PRINTF("Failed to initiate iterator for handle_addr_wq\n");
1675                         /*
1676                          * Freeing if we are stopping or put back on the
1677                          * addr_wq.
1678                          */
1679                         if (SCTP_BASE_VAR(sctp_pcb_initialized) == 0) {
1680                                 sctp_asconf_iterator_end(asc, 0);
1681                         } else {
1682                                 LIST_FOREACH(wi, &asc->list_of_work, sctp_nxt_addr) {
1683                                         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
1684                                 }
1685                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1686                         }
1687                 }
1688         }
1689 }
1690
1691 /*-
1692  * The following table shows which pointers for the inp, stcb, or net are
1693  * stored for each timer after it was started.
1694  *
1695  *|Name                         |Timer                        |inp |stcb|net |
1696  *|-----------------------------|-----------------------------|----|----|----|
1697  *|SCTP_TIMER_TYPE_SEND         |net->rxt_timer               |Yes |Yes |Yes |
1698  *|SCTP_TIMER_TYPE_INIT         |net->rxt_timer               |Yes |Yes |Yes |
1699  *|SCTP_TIMER_TYPE_RECV         |stcb->asoc.dack_timer        |Yes |Yes |No  |
1700  *|SCTP_TIMER_TYPE_SHUTDOWN     |net->rxt_timer               |Yes |Yes |Yes |
1701  *|SCTP_TIMER_TYPE_HEARTBEAT    |net->hb_timer                |Yes |Yes |Yes |
1702  *|SCTP_TIMER_TYPE_COOKIE       |net->rxt_timer               |Yes |Yes |Yes |
1703  *|SCTP_TIMER_TYPE_NEWCOOKIE    |inp->sctp_ep.signature_change|Yes |No  |No  |
1704  *|SCTP_TIMER_TYPE_PATHMTURAISE |net->pmtu_timer              |Yes |Yes |Yes |
1705  *|SCTP_TIMER_TYPE_SHUTDOWNACK  |net->rxt_timer               |Yes |Yes |Yes |
1706  *|SCTP_TIMER_TYPE_ASCONF       |stcb->asoc.asconf_timer      |Yes |Yes |Yes |
1707  *|SCTP_TIMER_TYPE_SHUTDOWNGUARD|stcb->asoc.shut_guard_timer  |Yes |Yes |No  |
1708  *|SCTP_TIMER_TYPE_AUTOCLOSE    |stcb->asoc.autoclose_timer   |Yes |Yes |No  |
1709  *|SCTP_TIMER_TYPE_STRRESET     |stcb->asoc.strreset_timer    |Yes |Yes |No  |
1710  *|SCTP_TIMER_TYPE_INPKILL      |inp->sctp_ep.signature_change|Yes |No  |No  |
1711  *|SCTP_TIMER_TYPE_ASOCKILL     |stcb->asoc.strreset_timer    |Yes |Yes |No  |
1712  *|SCTP_TIMER_TYPE_ADDR_WQ      |SCTP_BASE_INFO(addr_wq_timer)|No  |No  |No  |
1713  *|SCTP_TIMER_TYPE_PRIM_DELETED |stcb->asoc.delete_prim_timer |Yes |Yes |No  |
1714  */
1715
1716 void
1717 sctp_timeout_handler(void *t)
1718 {
1719         struct epoch_tracker et;
1720         struct timeval tv;
1721         struct sctp_inpcb *inp;
1722         struct sctp_tcb *stcb;
1723         struct sctp_nets *net;
1724         struct sctp_timer *tmr;
1725         struct mbuf *op_err;
1726         int type;
1727         int i, secret;
1728         bool did_output, released_asoc_reference;
1729
1730         /*
1731          * If inp, stcb or net are not NULL, then references to these were
1732          * added when the timer was started, and must be released before
1733          * this function returns.
1734          */
1735         tmr = (struct sctp_timer *)t;
1736         inp = (struct sctp_inpcb *)tmr->ep;
1737         stcb = (struct sctp_tcb *)tmr->tcb;
1738         net = (struct sctp_nets *)tmr->net;
1739         CURVNET_SET((struct vnet *)tmr->vnet);
1740         NET_EPOCH_ENTER(et);
1741         released_asoc_reference = false;
1742
1743 #ifdef SCTP_AUDITING_ENABLED
1744         sctp_audit_log(0xF0, (uint8_t)tmr->type);
1745         sctp_auditing(3, inp, stcb, net);
1746 #endif
1747
1748         /* sanity checks... */
1749         KASSERT(tmr->self == NULL || tmr->self == tmr,
1750             ("sctp_timeout_handler: tmr->self corrupted"));
1751         KASSERT(SCTP_IS_TIMER_TYPE_VALID(tmr->type),
1752             ("sctp_timeout_handler: invalid timer type %d", tmr->type));
1753         type = tmr->type;
1754         KASSERT(stcb == NULL || stcb->sctp_ep == inp,
1755             ("sctp_timeout_handler of type %d: inp = %p, stcb->sctp_ep %p",
1756             type, stcb, stcb->sctp_ep));
1757         tmr->stopped_from = 0xa001;
1758         if ((stcb != NULL) && (stcb->asoc.state == SCTP_STATE_EMPTY)) {
1759                 SCTPDBG(SCTP_DEBUG_TIMER2,
1760                     "Timer type %d handler exiting due to CLOSED association.\n",
1761                     type);
1762                 goto out_decr;
1763         }
1764         tmr->stopped_from = 0xa002;
1765         SCTPDBG(SCTP_DEBUG_TIMER2, "Timer type %d goes off.\n", type);
1766         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1767                 SCTPDBG(SCTP_DEBUG_TIMER2,
1768                     "Timer type %d handler exiting due to not being active.\n",
1769                     type);
1770                 goto out_decr;
1771         }
1772
1773         tmr->stopped_from = 0xa003;
1774         if (stcb) {
1775                 SCTP_TCB_LOCK(stcb);
1776                 /*
1777                  * Release reference so that association can be freed if
1778                  * necessary below. This is safe now that we have acquired
1779                  * the lock.
1780                  */
1781                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1782                 released_asoc_reference = true;
1783                 if ((type != SCTP_TIMER_TYPE_ASOCKILL) &&
1784                     ((stcb->asoc.state == SCTP_STATE_EMPTY) ||
1785                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED))) {
1786                         SCTPDBG(SCTP_DEBUG_TIMER2,
1787                             "Timer type %d handler exiting due to CLOSED association.\n",
1788                             type);
1789                         goto out;
1790                 }
1791         } else if (inp != NULL) {
1792                 SCTP_INP_WLOCK(inp);
1793         } else {
1794                 SCTP_WQ_ADDR_LOCK();
1795         }
1796
1797         /* Record in stopped_from which timeout occurred. */
1798         tmr->stopped_from = type;
1799         /* mark as being serviced now */
1800         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
1801                 /*
1802                  * Callout has been rescheduled.
1803                  */
1804                 goto out;
1805         }
1806         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1807                 /*
1808                  * Not active, so no action.
1809                  */
1810                 goto out;
1811         }
1812         SCTP_OS_TIMER_DEACTIVATE(&tmr->timer);
1813
1814         /* call the handler for the appropriate timer type */
1815         switch (type) {
1816         case SCTP_TIMER_TYPE_SEND:
1817                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1818                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1819                     type, inp, stcb, net));
1820                 SCTP_STAT_INCR(sctps_timodata);
1821                 stcb->asoc.timodata++;
1822                 stcb->asoc.num_send_timers_up--;
1823                 if (stcb->asoc.num_send_timers_up < 0) {
1824                         stcb->asoc.num_send_timers_up = 0;
1825                 }
1826                 SCTP_TCB_LOCK_ASSERT(stcb);
1827                 if (sctp_t3rxt_timer(inp, stcb, net)) {
1828                         /* no need to unlock on tcb its gone */
1829
1830                         goto out_decr;
1831                 }
1832                 SCTP_TCB_LOCK_ASSERT(stcb);
1833 #ifdef SCTP_AUDITING_ENABLED
1834                 sctp_auditing(4, inp, stcb, net);
1835 #endif
1836                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1837                 did_output = true;
1838                 if ((stcb->asoc.num_send_timers_up == 0) &&
1839                     (stcb->asoc.sent_queue_cnt > 0)) {
1840                         struct sctp_tmit_chunk *chk;
1841
1842                         /*
1843                          * Safeguard. If there on some on the sent queue
1844                          * somewhere but no timers running something is
1845                          * wrong... so we start a timer on the first chunk
1846                          * on the send queue on whatever net it is sent to.
1847                          */
1848                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
1849                                 if (chk->whoTo != NULL) {
1850                                         break;
1851                                 }
1852                         }
1853                         if (chk != NULL) {
1854                                 sctp_timer_start(SCTP_TIMER_TYPE_SEND, stcb->sctp_ep, stcb, chk->whoTo);
1855                         }
1856                 }
1857                 break;
1858         case SCTP_TIMER_TYPE_INIT:
1859                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1860                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1861                     type, inp, stcb, net));
1862                 SCTP_STAT_INCR(sctps_timoinit);
1863                 stcb->asoc.timoinit++;
1864                 if (sctp_t1init_timer(inp, stcb, net)) {
1865                         /* no need to unlock on tcb its gone */
1866                         goto out_decr;
1867                 }
1868                 did_output = false;
1869                 break;
1870         case SCTP_TIMER_TYPE_RECV:
1871                 KASSERT(inp != NULL && stcb != NULL && net == NULL,
1872                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1873                     type, inp, stcb, net));
1874                 SCTP_STAT_INCR(sctps_timosack);
1875                 stcb->asoc.timosack++;
1876                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
1877 #ifdef SCTP_AUDITING_ENABLED
1878                 sctp_auditing(4, inp, stcb, NULL);
1879 #endif
1880                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR, SCTP_SO_NOT_LOCKED);
1881                 did_output = true;
1882                 break;
1883         case SCTP_TIMER_TYPE_SHUTDOWN:
1884                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1885                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1886                     type, inp, stcb, net));
1887                 SCTP_STAT_INCR(sctps_timoshutdown);
1888                 stcb->asoc.timoshutdown++;
1889                 if (sctp_shutdown_timer(inp, stcb, net)) {
1890                         /* no need to unlock on tcb its gone */
1891                         goto out_decr;
1892                 }
1893 #ifdef SCTP_AUDITING_ENABLED
1894                 sctp_auditing(4, inp, stcb, net);
1895 #endif
1896                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_NOT_LOCKED);
1897                 did_output = true;
1898                 break;
1899         case SCTP_TIMER_TYPE_HEARTBEAT:
1900                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1901                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1902                     type, inp, stcb, net));
1903                 SCTP_STAT_INCR(sctps_timoheartbeat);
1904                 stcb->asoc.timoheartbeat++;
1905                 if (sctp_heartbeat_timer(inp, stcb, net)) {
1906                         /* no need to unlock on tcb its gone */
1907                         goto out_decr;
1908                 }
1909 #ifdef SCTP_AUDITING_ENABLED
1910                 sctp_auditing(4, inp, stcb, net);
1911 #endif
1912                 if ((net->dest_state & SCTP_ADDR_NOHB) == 0) {
1913                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net);
1914                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR, SCTP_SO_NOT_LOCKED);
1915                         did_output = true;
1916                 } else {
1917                         did_output = false;
1918                 }
1919                 break;
1920         case SCTP_TIMER_TYPE_COOKIE:
1921                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1922                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1923                     type, inp, stcb, net));
1924                 SCTP_STAT_INCR(sctps_timocookie);
1925                 stcb->asoc.timocookie++;
1926                 if (sctp_cookie_timer(inp, stcb, net)) {
1927                         /* no need to unlock on tcb its gone */
1928                         goto out_decr;
1929                 }
1930 #ifdef SCTP_AUDITING_ENABLED
1931                 sctp_auditing(4, inp, stcb, net);
1932 #endif
1933                 /*
1934                  * We consider T3 and Cookie timer pretty much the same with
1935                  * respect to where from in chunk_output.
1936                  */
1937                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1938                 did_output = true;
1939                 break;
1940         case SCTP_TIMER_TYPE_NEWCOOKIE:
1941                 KASSERT(inp != NULL && stcb == NULL && net == NULL,
1942                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1943                     type, inp, stcb, net));
1944                 SCTP_STAT_INCR(sctps_timosecret);
1945                 (void)SCTP_GETTIME_TIMEVAL(&tv);
1946                 inp->sctp_ep.time_of_secret_change = (unsigned int)tv.tv_sec;
1947                 inp->sctp_ep.last_secret_number =
1948                     inp->sctp_ep.current_secret_number;
1949                 inp->sctp_ep.current_secret_number++;
1950                 if (inp->sctp_ep.current_secret_number >=
1951                     SCTP_HOW_MANY_SECRETS) {
1952                         inp->sctp_ep.current_secret_number = 0;
1953                 }
1954                 secret = (int)inp->sctp_ep.current_secret_number;
1955                 for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1956                         inp->sctp_ep.secret_key[secret][i] =
1957                             sctp_select_initial_TSN(&inp->sctp_ep);
1958                 }
1959                 sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, NULL, NULL);
1960                 did_output = false;
1961                 break;
1962         case SCTP_TIMER_TYPE_PATHMTURAISE:
1963                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1964                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1965                     type, inp, stcb, net));
1966                 SCTP_STAT_INCR(sctps_timopathmtu);
1967                 sctp_pathmtu_timer(inp, stcb, net);
1968                 did_output = false;
1969                 break;
1970         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1971                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1972                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1973                     type, inp, stcb, net));
1974                 if (sctp_shutdownack_timer(inp, stcb, net)) {
1975                         /* no need to unlock on tcb its gone */
1976                         goto out_decr;
1977                 }
1978                 SCTP_STAT_INCR(sctps_timoshutdownack);
1979                 stcb->asoc.timoshutdownack++;
1980 #ifdef SCTP_AUDITING_ENABLED
1981                 sctp_auditing(4, inp, stcb, net);
1982 #endif
1983                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR, SCTP_SO_NOT_LOCKED);
1984                 did_output = true;
1985                 break;
1986         case SCTP_TIMER_TYPE_ASCONF:
1987                 KASSERT(inp != NULL && stcb != NULL && net != NULL,
1988                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
1989                     type, inp, stcb, net));
1990                 SCTP_STAT_INCR(sctps_timoasconf);
1991                 if (sctp_asconf_timer(inp, stcb, net)) {
1992                         /* no need to unlock on tcb its gone */
1993                         goto out_decr;
1994                 }
1995 #ifdef SCTP_AUDITING_ENABLED
1996                 sctp_auditing(4, inp, stcb, net);
1997 #endif
1998                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR, SCTP_SO_NOT_LOCKED);
1999                 did_output = true;
2000                 break;
2001         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2002                 KASSERT(inp != NULL && stcb != NULL && net == NULL,
2003                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2004                     type, inp, stcb, net));
2005                 SCTP_STAT_INCR(sctps_timoshutdownguard);
2006                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
2007                     "Shutdown guard timer expired");
2008                 sctp_abort_an_association(inp, stcb, op_err, true, SCTP_SO_NOT_LOCKED);
2009                 /* no need to unlock on tcb its gone */
2010                 goto out_decr;
2011         case SCTP_TIMER_TYPE_AUTOCLOSE:
2012                 KASSERT(inp != NULL && stcb != NULL && net == NULL,
2013                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2014                     type, inp, stcb, net));
2015                 SCTP_STAT_INCR(sctps_timoautoclose);
2016                 sctp_autoclose_timer(inp, stcb);
2017                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED);
2018                 did_output = true;
2019                 break;
2020         case SCTP_TIMER_TYPE_STRRESET:
2021                 KASSERT(inp != NULL && stcb != NULL && net == NULL,
2022                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2023                     type, inp, stcb, net));
2024                 SCTP_STAT_INCR(sctps_timostrmrst);
2025                 if (sctp_strreset_timer(inp, stcb)) {
2026                         /* no need to unlock on tcb its gone */
2027                         goto out_decr;
2028                 }
2029                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR, SCTP_SO_NOT_LOCKED);
2030                 did_output = true;
2031                 break;
2032         case SCTP_TIMER_TYPE_INPKILL:
2033                 KASSERT(inp != NULL && stcb == NULL && net == NULL,
2034                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2035                     type, inp, stcb, net));
2036                 SCTP_STAT_INCR(sctps_timoinpkill);
2037                 /*
2038                  * special case, take away our increment since WE are the
2039                  * killer
2040                  */
2041                 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL,
2042                     SCTP_FROM_SCTPUTIL + SCTP_LOC_3);
2043                 SCTP_INP_DECR_REF(inp);
2044                 SCTP_INP_WUNLOCK(inp);
2045                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
2046                     SCTP_CALLED_FROM_INPKILL_TIMER);
2047                 inp = NULL;
2048                 goto out_decr;
2049         case SCTP_TIMER_TYPE_ASOCKILL:
2050                 KASSERT(inp != NULL && stcb != NULL && net == NULL,
2051                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2052                     type, inp, stcb, net));
2053                 SCTP_STAT_INCR(sctps_timoassockill);
2054                 /* Can we free it yet? */
2055                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL,
2056                     SCTP_FROM_SCTPUTIL + SCTP_LOC_1);
2057                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
2058                     SCTP_FROM_SCTPUTIL + SCTP_LOC_2);
2059                 /*
2060                  * free asoc, always unlocks (or destroy's) so prevent
2061                  * duplicate unlock or unlock of a free mtx :-0
2062                  */
2063                 stcb = NULL;
2064                 goto out_decr;
2065         case SCTP_TIMER_TYPE_ADDR_WQ:
2066                 KASSERT(inp == NULL && stcb == NULL && net == NULL,
2067                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2068                     type, inp, stcb, net));
2069                 sctp_handle_addr_wq();
2070                 did_output = true;
2071                 break;
2072         case SCTP_TIMER_TYPE_PRIM_DELETED:
2073                 KASSERT(inp != NULL && stcb != NULL && net == NULL,
2074                     ("timeout of type %d: inp = %p, stcb = %p, net = %p",
2075                     type, inp, stcb, net));
2076                 SCTP_STAT_INCR(sctps_timodelprim);
2077                 sctp_delete_prim_timer(inp, stcb);
2078                 did_output = false;
2079                 break;
2080         default:
2081 #ifdef INVARIANTS
2082                 panic("Unknown timer type %d", type);
2083 #else
2084                 goto out;
2085 #endif
2086         }
2087 #ifdef SCTP_AUDITING_ENABLED
2088         sctp_audit_log(0xF1, (uint8_t)type);
2089         if (inp != NULL)
2090                 sctp_auditing(5, inp, stcb, net);
2091 #endif
2092         if (did_output && (stcb != NULL)) {
2093                 /*
2094                  * Now we need to clean up the control chunk chain if an
2095                  * ECNE is on it. It must be marked as UNSENT again so next
2096                  * call will continue to send it until such time that we get
2097                  * a CWR, to remove it. It is, however, less likely that we
2098                  * will find a ecn echo on the chain though.
2099                  */
2100                 sctp_fix_ecn_echo(&stcb->asoc);
2101         }
2102 out:
2103         if (stcb != NULL) {
2104                 SCTP_TCB_UNLOCK(stcb);
2105         } else if (inp != NULL) {
2106                 SCTP_INP_WUNLOCK(inp);
2107         } else {
2108                 SCTP_WQ_ADDR_UNLOCK();
2109         }
2110
2111 out_decr:
2112         /* These reference counts were incremented in sctp_timer_start(). */
2113         if (inp != NULL) {
2114                 SCTP_INP_DECR_REF(inp);
2115         }
2116         if ((stcb != NULL) && !released_asoc_reference) {
2117                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2118         }
2119         if (net != NULL) {
2120                 sctp_free_remote_addr(net);
2121         }
2122         SCTPDBG(SCTP_DEBUG_TIMER2, "Timer type %d handler finished.\n", type);
2123         CURVNET_RESTORE();
2124         NET_EPOCH_EXIT(et);
2125 }
2126
2127 /*-
2128  * The following table shows which parameters must be provided
2129  * when calling sctp_timer_start(). For parameters not being
2130  * provided, NULL must be used.
2131  *
2132  * |Name                         |inp |stcb|net |
2133  * |-----------------------------|----|----|----|
2134  * |SCTP_TIMER_TYPE_SEND         |Yes |Yes |Yes |
2135  * |SCTP_TIMER_TYPE_INIT         |Yes |Yes |Yes |
2136  * |SCTP_TIMER_TYPE_RECV         |Yes |Yes |No  |
2137  * |SCTP_TIMER_TYPE_SHUTDOWN     |Yes |Yes |Yes |
2138  * |SCTP_TIMER_TYPE_HEARTBEAT    |Yes |Yes |Yes |
2139  * |SCTP_TIMER_TYPE_COOKIE       |Yes |Yes |Yes |
2140  * |SCTP_TIMER_TYPE_NEWCOOKIE    |Yes |No  |No  |
2141  * |SCTP_TIMER_TYPE_PATHMTURAISE |Yes |Yes |Yes |
2142  * |SCTP_TIMER_TYPE_SHUTDOWNACK  |Yes |Yes |Yes |
2143  * |SCTP_TIMER_TYPE_ASCONF       |Yes |Yes |Yes |
2144  * |SCTP_TIMER_TYPE_SHUTDOWNGUARD|Yes |Yes |No  |
2145  * |SCTP_TIMER_TYPE_AUTOCLOSE    |Yes |Yes |No  |
2146  * |SCTP_TIMER_TYPE_STRRESET     |Yes |Yes |Yes |
2147  * |SCTP_TIMER_TYPE_INPKILL      |Yes |No  |No  |
2148  * |SCTP_TIMER_TYPE_ASOCKILL     |Yes |Yes |No  |
2149  * |SCTP_TIMER_TYPE_ADDR_WQ      |No  |No  |No  |
2150  * |SCTP_TIMER_TYPE_PRIM_DELETED |Yes |Yes |No  |
2151  *
2152  */
2153
2154 void
2155 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2156     struct sctp_nets *net)
2157 {
2158         struct sctp_timer *tmr;
2159         uint32_t to_ticks;
2160         uint32_t rndval, jitter;
2161
2162         KASSERT(stcb == NULL || stcb->sctp_ep == inp,
2163             ("sctp_timer_start of type %d: inp = %p, stcb->sctp_ep %p",
2164             t_type, stcb, stcb->sctp_ep));
2165         tmr = NULL;
2166         if (stcb != NULL) {
2167                 SCTP_TCB_LOCK_ASSERT(stcb);
2168         } else if (inp != NULL) {
2169                 SCTP_INP_WLOCK_ASSERT(inp);
2170         } else {
2171                 SCTP_WQ_ADDR_LOCK_ASSERT();
2172         }
2173         if (stcb != NULL) {
2174                 /*
2175                  * Don't restart timer on association that's about to be
2176                  * killed.
2177                  */
2178                 if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) &&
2179                     (t_type != SCTP_TIMER_TYPE_ASOCKILL)) {
2180                         SCTPDBG(SCTP_DEBUG_TIMER2,
2181                             "Timer type %d not started: inp=%p, stcb=%p, net=%p (stcb deleted).\n",
2182                             t_type, inp, stcb, net);
2183                         return;
2184                 }
2185                 /* Don't restart timer on net that's been removed. */
2186                 if (net != NULL && (net->dest_state & SCTP_ADDR_BEING_DELETED)) {
2187                         SCTPDBG(SCTP_DEBUG_TIMER2,
2188                             "Timer type %d not started: inp=%p, stcb=%p, net=%p (net deleted).\n",
2189                             t_type, inp, stcb, net);
2190                         return;
2191                 }
2192         }
2193         switch (t_type) {
2194         case SCTP_TIMER_TYPE_SEND:
2195                 /* Here we use the RTO timer. */
2196                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2197 #ifdef INVARIANTS
2198                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2199                             t_type, inp, stcb, net);
2200 #else
2201                         return;
2202 #endif
2203                 }
2204                 tmr = &net->rxt_timer;
2205                 if (net->RTO == 0) {
2206                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2207                 } else {
2208                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2209                 }
2210                 break;
2211         case SCTP_TIMER_TYPE_INIT:
2212                 /*
2213                  * Here we use the INIT timer default usually about 1
2214                  * second.
2215                  */
2216                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2217 #ifdef INVARIANTS
2218                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2219                             t_type, inp, stcb, net);
2220 #else
2221                         return;
2222 #endif
2223                 }
2224                 tmr = &net->rxt_timer;
2225                 if (net->RTO == 0) {
2226                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2227                 } else {
2228                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2229                 }
2230                 break;
2231         case SCTP_TIMER_TYPE_RECV:
2232                 /*
2233                  * Here we use the Delayed-Ack timer value from the inp,
2234                  * usually about 200ms.
2235                  */
2236                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2237 #ifdef INVARIANTS
2238                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2239                             t_type, inp, stcb, net);
2240 #else
2241                         return;
2242 #endif
2243                 }
2244                 tmr = &stcb->asoc.dack_timer;
2245                 to_ticks = sctp_msecs_to_ticks(stcb->asoc.delayed_ack);
2246                 break;
2247         case SCTP_TIMER_TYPE_SHUTDOWN:
2248                 /* Here we use the RTO of the destination. */
2249                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2250 #ifdef INVARIANTS
2251                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2252                             t_type, inp, stcb, net);
2253 #else
2254                         return;
2255 #endif
2256                 }
2257                 tmr = &net->rxt_timer;
2258                 if (net->RTO == 0) {
2259                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2260                 } else {
2261                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2262                 }
2263                 break;
2264         case SCTP_TIMER_TYPE_HEARTBEAT:
2265                 /*
2266                  * The net is used here so that we can add in the RTO. Even
2267                  * though we use a different timer. We also add the HB timer
2268                  * PLUS a random jitter.
2269                  */
2270                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2271 #ifdef INVARIANTS
2272                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2273                             t_type, inp, stcb, net);
2274 #else
2275                         return;
2276 #endif
2277                 }
2278                 if ((net->dest_state & SCTP_ADDR_NOHB) &&
2279                     ((net->dest_state & SCTP_ADDR_UNCONFIRMED) == 0)) {
2280                         SCTPDBG(SCTP_DEBUG_TIMER2,
2281                             "Timer type %d not started: inp=%p, stcb=%p, net=%p.\n",
2282                             t_type, inp, stcb, net);
2283                         return;
2284                 }
2285                 tmr = &net->hb_timer;
2286                 if (net->RTO == 0) {
2287                         to_ticks = stcb->asoc.initial_rto;
2288                 } else {
2289                         to_ticks = net->RTO;
2290                 }
2291                 rndval = sctp_select_initial_TSN(&inp->sctp_ep);
2292                 jitter = rndval % to_ticks;
2293                 if (to_ticks > 1) {
2294                         to_ticks >>= 1;
2295                 }
2296                 if (jitter < (UINT32_MAX - to_ticks)) {
2297                         to_ticks += jitter;
2298                 } else {
2299                         to_ticks = UINT32_MAX;
2300                 }
2301                 if (!((net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
2302                     (net->dest_state & SCTP_ADDR_REACHABLE)) &&
2303                     ((net->dest_state & SCTP_ADDR_PF) == 0)) {
2304                         if (net->heart_beat_delay < (UINT32_MAX - to_ticks)) {
2305                                 to_ticks += net->heart_beat_delay;
2306                         } else {
2307                                 to_ticks = UINT32_MAX;
2308                         }
2309                 }
2310                 /*
2311                  * Now we must convert the to_ticks that are now in ms to
2312                  * ticks.
2313                  */
2314                 to_ticks = sctp_msecs_to_ticks(to_ticks);
2315                 break;
2316         case SCTP_TIMER_TYPE_COOKIE:
2317                 /*
2318                  * Here we can use the RTO timer from the network since one
2319                  * RTT was complete. If a retransmission happened then we
2320                  * will be using the RTO initial value.
2321                  */
2322                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2323 #ifdef INVARIANTS
2324                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2325                             t_type, inp, stcb, net);
2326 #else
2327                         return;
2328 #endif
2329                 }
2330                 tmr = &net->rxt_timer;
2331                 if (net->RTO == 0) {
2332                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2333                 } else {
2334                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2335                 }
2336                 break;
2337         case SCTP_TIMER_TYPE_NEWCOOKIE:
2338                 /*
2339                  * Nothing needed but the endpoint here usually about 60
2340                  * minutes.
2341                  */
2342                 if ((inp == NULL) || (stcb != NULL) || (net != NULL)) {
2343 #ifdef INVARIANTS
2344                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2345                             t_type, inp, stcb, net);
2346 #else
2347                         return;
2348 #endif
2349                 }
2350                 tmr = &inp->sctp_ep.signature_change;
2351                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE];
2352                 break;
2353         case SCTP_TIMER_TYPE_PATHMTURAISE:
2354                 /*
2355                  * Here we use the value found in the EP for PMTUD, usually
2356                  * about 10 minutes.
2357                  */
2358                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2359 #ifdef INVARIANTS
2360                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2361                             t_type, inp, stcb, net);
2362 #else
2363                         return;
2364 #endif
2365                 }
2366                 if (net->dest_state & SCTP_ADDR_NO_PMTUD) {
2367                         SCTPDBG(SCTP_DEBUG_TIMER2,
2368                             "Timer type %d not started: inp=%p, stcb=%p, net=%p.\n",
2369                             t_type, inp, stcb, net);
2370                         return;
2371                 }
2372                 tmr = &net->pmtu_timer;
2373                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU];
2374                 break;
2375         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2376                 /* Here we use the RTO of the destination. */
2377                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2378 #ifdef INVARIANTS
2379                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2380                             t_type, inp, stcb, net);
2381 #else
2382                         return;
2383 #endif
2384                 }
2385                 tmr = &net->rxt_timer;
2386                 if (net->RTO == 0) {
2387                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2388                 } else {
2389                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2390                 }
2391                 break;
2392         case SCTP_TIMER_TYPE_ASCONF:
2393                 /*
2394                  * Here the timer comes from the stcb but its value is from
2395                  * the net's RTO.
2396                  */
2397                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2398 #ifdef INVARIANTS
2399                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2400                             t_type, inp, stcb, net);
2401 #else
2402                         return;
2403 #endif
2404                 }
2405                 tmr = &stcb->asoc.asconf_timer;
2406                 if (net->RTO == 0) {
2407                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2408                 } else {
2409                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2410                 }
2411                 break;
2412         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2413                 /*
2414                  * Here we use the endpoints shutdown guard timer usually
2415                  * about 3 minutes.
2416                  */
2417                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2418 #ifdef INVARIANTS
2419                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2420                             t_type, inp, stcb, net);
2421 #else
2422                         return;
2423 #endif
2424                 }
2425                 tmr = &stcb->asoc.shut_guard_timer;
2426                 if (inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] == 0) {
2427                         if (stcb->asoc.maxrto < UINT32_MAX / 5) {
2428                                 to_ticks = sctp_msecs_to_ticks(5 * stcb->asoc.maxrto);
2429                         } else {
2430                                 to_ticks = sctp_msecs_to_ticks(UINT32_MAX);
2431                         }
2432                 } else {
2433                         to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN];
2434                 }
2435                 break;
2436         case SCTP_TIMER_TYPE_AUTOCLOSE:
2437                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2438 #ifdef INVARIANTS
2439                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2440                             t_type, inp, stcb, net);
2441 #else
2442                         return;
2443 #endif
2444                 }
2445                 tmr = &stcb->asoc.autoclose_timer;
2446                 to_ticks = stcb->asoc.sctp_autoclose_ticks;
2447                 break;
2448         case SCTP_TIMER_TYPE_STRRESET:
2449                 /*
2450                  * Here the timer comes from the stcb but its value is from
2451                  * the net's RTO.
2452                  */
2453                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2454 #ifdef INVARIANTS
2455                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2456                             t_type, inp, stcb, net);
2457 #else
2458                         return;
2459 #endif
2460                 }
2461                 tmr = &stcb->asoc.strreset_timer;
2462                 if (net->RTO == 0) {
2463                         to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2464                 } else {
2465                         to_ticks = sctp_msecs_to_ticks(net->RTO);
2466                 }
2467                 break;
2468         case SCTP_TIMER_TYPE_INPKILL:
2469                 /*
2470                  * The inp is setup to die. We re-use the signature_change
2471                  * timer since that has stopped and we are in the GONE
2472                  * state.
2473                  */
2474                 if ((inp == NULL) || (stcb != NULL) || (net != NULL)) {
2475 #ifdef INVARIANTS
2476                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2477                             t_type, inp, stcb, net);
2478 #else
2479                         return;
2480 #endif
2481                 }
2482                 tmr = &inp->sctp_ep.signature_change;
2483                 to_ticks = sctp_msecs_to_ticks(SCTP_INP_KILL_TIMEOUT);
2484                 break;
2485         case SCTP_TIMER_TYPE_ASOCKILL:
2486                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2487 #ifdef INVARIANTS
2488                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2489                             t_type, inp, stcb, net);
2490 #else
2491                         return;
2492 #endif
2493                 }
2494                 tmr = &stcb->asoc.strreset_timer;
2495                 to_ticks = sctp_msecs_to_ticks(SCTP_ASOC_KILL_TIMEOUT);
2496                 break;
2497         case SCTP_TIMER_TYPE_ADDR_WQ:
2498                 if ((inp != NULL) || (stcb != NULL) || (net != NULL)) {
2499 #ifdef INVARIANTS
2500                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2501                             t_type, inp, stcb, net);
2502 #else
2503                         return;
2504 #endif
2505                 }
2506                 /* Only 1 tick away :-) */
2507                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2508                 to_ticks = SCTP_ADDRESS_TICK_DELAY;
2509                 break;
2510         case SCTP_TIMER_TYPE_PRIM_DELETED:
2511                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2512 #ifdef INVARIANTS
2513                         panic("sctp_timer_start of type %d: inp = %p, stcb = %p, net = %p",
2514                             t_type, inp, stcb, net);
2515 #else
2516                         return;
2517 #endif
2518                 }
2519                 tmr = &stcb->asoc.delete_prim_timer;
2520                 to_ticks = sctp_msecs_to_ticks(stcb->asoc.initial_rto);
2521                 break;
2522         default:
2523 #ifdef INVARIANTS
2524                 panic("Unknown timer type %d", t_type);
2525 #else
2526                 return;
2527 #endif
2528         }
2529         KASSERT(tmr != NULL, ("tmr is NULL for timer type %d", t_type));
2530         KASSERT(to_ticks > 0, ("to_ticks == 0 for timer type %d", t_type));
2531         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
2532                 /*
2533                  * We do NOT allow you to have it already running. If it is,
2534                  * we leave the current one up unchanged.
2535                  */
2536                 SCTPDBG(SCTP_DEBUG_TIMER2,
2537                     "Timer type %d already running: inp=%p, stcb=%p, net=%p.\n",
2538                     t_type, inp, stcb, net);
2539                 return;
2540         }
2541         /* At this point we can proceed. */
2542         if (t_type == SCTP_TIMER_TYPE_SEND) {
2543                 stcb->asoc.num_send_timers_up++;
2544         }
2545         tmr->stopped_from = 0;
2546         tmr->type = t_type;
2547         tmr->ep = (void *)inp;
2548         tmr->tcb = (void *)stcb;
2549         if (t_type == SCTP_TIMER_TYPE_STRRESET) {
2550                 tmr->net = NULL;
2551         } else {
2552                 tmr->net = (void *)net;
2553         }
2554         tmr->self = (void *)tmr;
2555         tmr->vnet = (void *)curvnet;
2556         tmr->ticks = sctp_get_tick_count();
2557         if (SCTP_OS_TIMER_START(&tmr->timer, to_ticks, sctp_timeout_handler, tmr) == 0) {
2558                 SCTPDBG(SCTP_DEBUG_TIMER2,
2559                     "Timer type %d started: ticks=%u, inp=%p, stcb=%p, net=%p.\n",
2560                     t_type, to_ticks, inp, stcb, net);
2561                 /*
2562                  * If this is a newly scheduled callout, as opposed to a
2563                  * rescheduled one, increment relevant reference counts.
2564                  */
2565                 if (tmr->ep != NULL) {
2566                         SCTP_INP_INCR_REF(inp);
2567                 }
2568                 if (tmr->tcb != NULL) {
2569                         atomic_add_int(&stcb->asoc.refcnt, 1);
2570                 }
2571                 if (tmr->net != NULL) {
2572                         atomic_add_int(&net->ref_count, 1);
2573                 }
2574         } else {
2575                 /*
2576                  * This should not happen, since we checked for pending
2577                  * above.
2578                  */
2579                 SCTPDBG(SCTP_DEBUG_TIMER2,
2580                     "Timer type %d restarted: ticks=%u, inp=%p, stcb=%p, net=%p.\n",
2581                     t_type, to_ticks, inp, stcb, net);
2582         }
2583         return;
2584 }
2585
2586 /*-
2587  * The following table shows which parameters must be provided
2588  * when calling sctp_timer_stop(). For parameters not being
2589  * provided, NULL must be used.
2590  *
2591  * |Name                         |inp |stcb|net |
2592  * |-----------------------------|----|----|----|
2593  * |SCTP_TIMER_TYPE_SEND         |Yes |Yes |Yes |
2594  * |SCTP_TIMER_TYPE_INIT         |Yes |Yes |Yes |
2595  * |SCTP_TIMER_TYPE_RECV         |Yes |Yes |No  |
2596  * |SCTP_TIMER_TYPE_SHUTDOWN     |Yes |Yes |Yes |
2597  * |SCTP_TIMER_TYPE_HEARTBEAT    |Yes |Yes |Yes |
2598  * |SCTP_TIMER_TYPE_COOKIE       |Yes |Yes |Yes |
2599  * |SCTP_TIMER_TYPE_NEWCOOKIE    |Yes |No  |No  |
2600  * |SCTP_TIMER_TYPE_PATHMTURAISE |Yes |Yes |Yes |
2601  * |SCTP_TIMER_TYPE_SHUTDOWNACK  |Yes |Yes |Yes |
2602  * |SCTP_TIMER_TYPE_ASCONF       |Yes |Yes |No  |
2603  * |SCTP_TIMER_TYPE_SHUTDOWNGUARD|Yes |Yes |No  |
2604  * |SCTP_TIMER_TYPE_AUTOCLOSE    |Yes |Yes |No  |
2605  * |SCTP_TIMER_TYPE_STRRESET     |Yes |Yes |No  |
2606  * |SCTP_TIMER_TYPE_INPKILL      |Yes |No  |No  |
2607  * |SCTP_TIMER_TYPE_ASOCKILL     |Yes |Yes |No  |
2608  * |SCTP_TIMER_TYPE_ADDR_WQ      |No  |No  |No  |
2609  * |SCTP_TIMER_TYPE_PRIM_DELETED |Yes |Yes |No  |
2610  *
2611  */
2612
2613 void
2614 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2615     struct sctp_nets *net, uint32_t from)
2616 {
2617         struct sctp_timer *tmr;
2618
2619         KASSERT(stcb == NULL || stcb->sctp_ep == inp,
2620             ("sctp_timer_stop of type %d: inp = %p, stcb->sctp_ep %p",
2621             t_type, stcb, stcb->sctp_ep));
2622         if (stcb != NULL) {
2623                 SCTP_TCB_LOCK_ASSERT(stcb);
2624         } else if (inp != NULL) {
2625                 SCTP_INP_WLOCK_ASSERT(inp);
2626         } else {
2627                 SCTP_WQ_ADDR_LOCK_ASSERT();
2628         }
2629         tmr = NULL;
2630         switch (t_type) {
2631         case SCTP_TIMER_TYPE_SEND:
2632                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2633 #ifdef INVARIANTS
2634                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2635                             t_type, inp, stcb, net);
2636 #else
2637                         return;
2638 #endif
2639                 }
2640                 tmr = &net->rxt_timer;
2641                 break;
2642         case SCTP_TIMER_TYPE_INIT:
2643                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2644 #ifdef INVARIANTS
2645                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2646                             t_type, inp, stcb, net);
2647 #else
2648                         return;
2649 #endif
2650                 }
2651                 tmr = &net->rxt_timer;
2652                 break;
2653         case SCTP_TIMER_TYPE_RECV:
2654                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2655 #ifdef INVARIANTS
2656                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2657                             t_type, inp, stcb, net);
2658 #else
2659                         return;
2660 #endif
2661                 }
2662                 tmr = &stcb->asoc.dack_timer;
2663                 break;
2664         case SCTP_TIMER_TYPE_SHUTDOWN:
2665                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2666 #ifdef INVARIANTS
2667                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2668                             t_type, inp, stcb, net);
2669 #else
2670                         return;
2671 #endif
2672                 }
2673                 tmr = &net->rxt_timer;
2674                 break;
2675         case SCTP_TIMER_TYPE_HEARTBEAT:
2676                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2677 #ifdef INVARIANTS
2678                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2679                             t_type, inp, stcb, net);
2680 #else
2681                         return;
2682 #endif
2683                 }
2684                 tmr = &net->hb_timer;
2685                 break;
2686         case SCTP_TIMER_TYPE_COOKIE:
2687                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2688 #ifdef INVARIANTS
2689                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2690                             t_type, inp, stcb, net);
2691 #else
2692                         return;
2693 #endif
2694                 }
2695                 tmr = &net->rxt_timer;
2696                 break;
2697         case SCTP_TIMER_TYPE_NEWCOOKIE:
2698                 if ((inp == NULL) || (stcb != NULL) || (net != NULL)) {
2699 #ifdef INVARIANTS
2700                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2701                             t_type, inp, stcb, net);
2702 #else
2703                         return;
2704 #endif
2705                 }
2706                 tmr = &inp->sctp_ep.signature_change;
2707                 break;
2708         case SCTP_TIMER_TYPE_PATHMTURAISE:
2709                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2710 #ifdef INVARIANTS
2711                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2712                             t_type, inp, stcb, net);
2713 #else
2714                         return;
2715 #endif
2716                 }
2717                 tmr = &net->pmtu_timer;
2718                 break;
2719         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2720                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
2721 #ifdef INVARIANTS
2722                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2723                             t_type, inp, stcb, net);
2724 #else
2725                         return;
2726 #endif
2727                 }
2728                 tmr = &net->rxt_timer;
2729                 break;
2730         case SCTP_TIMER_TYPE_ASCONF:
2731                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2732 #ifdef INVARIANTS
2733                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2734                             t_type, inp, stcb, net);
2735 #else
2736                         return;
2737 #endif
2738                 }
2739                 tmr = &stcb->asoc.asconf_timer;
2740                 break;
2741         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2742                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2743 #ifdef INVARIANTS
2744                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2745                             t_type, inp, stcb, net);
2746 #else
2747                         return;
2748 #endif
2749                 }
2750                 tmr = &stcb->asoc.shut_guard_timer;
2751                 break;
2752         case SCTP_TIMER_TYPE_AUTOCLOSE:
2753                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2754 #ifdef INVARIANTS
2755                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2756                             t_type, inp, stcb, net);
2757 #else
2758                         return;
2759 #endif
2760                 }
2761                 tmr = &stcb->asoc.autoclose_timer;
2762                 break;
2763         case SCTP_TIMER_TYPE_STRRESET:
2764                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2765 #ifdef INVARIANTS
2766                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2767                             t_type, inp, stcb, net);
2768 #else
2769                         return;
2770 #endif
2771                 }
2772                 tmr = &stcb->asoc.strreset_timer;
2773                 break;
2774         case SCTP_TIMER_TYPE_INPKILL:
2775                 /*
2776                  * The inp is setup to die. We re-use the signature_change
2777                  * timer since that has stopped and we are in the GONE
2778                  * state.
2779                  */
2780                 if ((inp == NULL) || (stcb != NULL) || (net != NULL)) {
2781 #ifdef INVARIANTS
2782                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2783                             t_type, inp, stcb, net);
2784 #else
2785                         return;
2786 #endif
2787                 }
2788                 tmr = &inp->sctp_ep.signature_change;
2789                 break;
2790         case SCTP_TIMER_TYPE_ASOCKILL:
2791                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2792 #ifdef INVARIANTS
2793                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2794                             t_type, inp, stcb, net);
2795 #else
2796                         return;
2797 #endif
2798                 }
2799                 tmr = &stcb->asoc.strreset_timer;
2800                 break;
2801         case SCTP_TIMER_TYPE_ADDR_WQ:
2802                 if ((inp != NULL) || (stcb != NULL) || (net != NULL)) {
2803 #ifdef INVARIANTS
2804                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2805                             t_type, inp, stcb, net);
2806 #else
2807                         return;
2808 #endif
2809                 }
2810                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2811                 break;
2812         case SCTP_TIMER_TYPE_PRIM_DELETED:
2813                 if ((inp == NULL) || (stcb == NULL) || (net != NULL)) {
2814 #ifdef INVARIANTS
2815                         panic("sctp_timer_stop of type %d: inp = %p, stcb = %p, net = %p",
2816                             t_type, inp, stcb, net);
2817 #else
2818                         return;
2819 #endif
2820                 }
2821                 tmr = &stcb->asoc.delete_prim_timer;
2822                 break;
2823         default:
2824 #ifdef INVARIANTS
2825                 panic("Unknown timer type %d", t_type);
2826 #else
2827                 return;
2828 #endif
2829         }
2830         KASSERT(tmr != NULL, ("tmr is NULL for timer type %d", t_type));
2831         if ((tmr->type != SCTP_TIMER_TYPE_NONE) &&
2832             (tmr->type != t_type)) {
2833                 /*
2834                  * Ok we have a timer that is under joint use. Cookie timer
2835                  * per chance with the SEND timer. We therefore are NOT
2836                  * running the timer that the caller wants stopped.  So just
2837                  * return.
2838                  */
2839                 SCTPDBG(SCTP_DEBUG_TIMER2,
2840                     "Shared timer type %d not running: inp=%p, stcb=%p, net=%p.\n",
2841                     t_type, inp, stcb, net);
2842                 return;
2843         }
2844         if ((t_type == SCTP_TIMER_TYPE_SEND) && (stcb != NULL)) {
2845                 stcb->asoc.num_send_timers_up--;
2846                 if (stcb->asoc.num_send_timers_up < 0) {
2847                         stcb->asoc.num_send_timers_up = 0;
2848                 }
2849         }
2850         tmr->self = NULL;
2851         tmr->stopped_from = from;
2852         if (SCTP_OS_TIMER_STOP(&tmr->timer) == 1) {
2853                 KASSERT(tmr->ep == inp,
2854                     ("sctp_timer_stop of type %d: inp = %p, tmr->inp = %p",
2855                     t_type, inp, tmr->ep));
2856                 KASSERT(tmr->tcb == stcb,
2857                     ("sctp_timer_stop of type %d: stcb = %p, tmr->stcb = %p",
2858                     t_type, stcb, tmr->tcb));
2859                 KASSERT(((t_type == SCTP_TIMER_TYPE_ASCONF) && (tmr->net != NULL)) ||
2860                     ((t_type != SCTP_TIMER_TYPE_ASCONF) && (tmr->net == net)),
2861                     ("sctp_timer_stop of type %d: net = %p, tmr->net = %p",
2862                     t_type, net, tmr->net));
2863                 SCTPDBG(SCTP_DEBUG_TIMER2,
2864                     "Timer type %d stopped: inp=%p, stcb=%p, net=%p.\n",
2865                     t_type, inp, stcb, net);
2866                 /*
2867                  * If the timer was actually stopped, decrement reference
2868                  * counts that were incremented in sctp_timer_start().
2869                  */
2870                 if (tmr->ep != NULL) {
2871                         tmr->ep = NULL;
2872                         SCTP_INP_DECR_REF(inp);
2873                 }
2874                 if (tmr->tcb != NULL) {
2875                         tmr->tcb = NULL;
2876                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
2877                 }
2878                 if (tmr->net != NULL) {
2879                         struct sctp_nets *tmr_net;
2880
2881                         /*
2882                          * Can't use net, since it doesn't work for
2883                          * SCTP_TIMER_TYPE_ASCONF.
2884                          */
2885                         tmr_net = tmr->net;
2886                         tmr->net = NULL;
2887                         sctp_free_remote_addr(tmr_net);
2888                 }
2889         } else {
2890                 SCTPDBG(SCTP_DEBUG_TIMER2,
2891                     "Timer type %d not stopped: inp=%p, stcb=%p, net=%p.\n",
2892                     t_type, inp, stcb, net);
2893         }
2894         return;
2895 }
2896
2897 uint32_t
2898 sctp_calculate_len(struct mbuf *m)
2899 {
2900         struct mbuf *at;
2901         uint32_t tlen;
2902
2903         tlen = 0;
2904         for (at = m; at != NULL; at = SCTP_BUF_NEXT(at)) {
2905                 tlen += SCTP_BUF_LEN(at);
2906         }
2907         return (tlen);
2908 }
2909
2910 /*
2911  * Given an association and starting time of the current RTT period, update
2912  * RTO in number of msecs. net should point to the current network.
2913  * Return 1, if an RTO update was performed, return 0 if no update was
2914  * performed due to invalid starting point.
2915  */
2916
2917 int
2918 sctp_calculate_rto(struct sctp_tcb *stcb,
2919     struct sctp_association *asoc,
2920     struct sctp_nets *net,
2921     struct timeval *old,
2922     int rtt_from_sack)
2923 {
2924         struct timeval now;
2925         uint64_t rtt_us;        /* RTT in us */
2926         int32_t rtt;            /* RTT in ms */
2927         uint32_t new_rto;
2928         int first_measure = 0;
2929
2930         /************************/
2931         /* 1. calculate new RTT */
2932         /************************/
2933         /* get the current time */
2934         if (stcb->asoc.use_precise_time) {
2935                 (void)SCTP_GETPTIME_TIMEVAL(&now);
2936         } else {
2937                 (void)SCTP_GETTIME_TIMEVAL(&now);
2938         }
2939         if ((old->tv_sec > now.tv_sec) ||
2940             ((old->tv_sec == now.tv_sec) && (old->tv_usec > now.tv_usec))) {
2941                 /* The starting point is in the future. */
2942                 return (0);
2943         }
2944         timevalsub(&now, old);
2945         rtt_us = (uint64_t)1000000 * (uint64_t)now.tv_sec + (uint64_t)now.tv_usec;
2946         if (rtt_us > SCTP_RTO_UPPER_BOUND * 1000) {
2947                 /* The RTT is larger than a sane value. */
2948                 return (0);
2949         }
2950         /* store the current RTT in us */
2951         net->rtt = rtt_us;
2952         /* compute rtt in ms */
2953         rtt = (int32_t)(net->rtt / 1000);
2954         if ((asoc->cc_functions.sctp_rtt_calculated) && (rtt_from_sack == SCTP_RTT_FROM_DATA)) {
2955                 /*
2956                  * Tell the CC module that a new update has just occurred
2957                  * from a sack
2958                  */
2959                 (*asoc->cc_functions.sctp_rtt_calculated) (stcb, net, &now);
2960         }
2961         /*
2962          * Do we need to determine the lan? We do this only on sacks i.e.
2963          * RTT being determined from data not non-data (HB/INIT->INITACK).
2964          */
2965         if ((rtt_from_sack == SCTP_RTT_FROM_DATA) &&
2966             (net->lan_type == SCTP_LAN_UNKNOWN)) {
2967                 if (net->rtt > SCTP_LOCAL_LAN_RTT) {
2968                         net->lan_type = SCTP_LAN_INTERNET;
2969                 } else {
2970                         net->lan_type = SCTP_LAN_LOCAL;
2971                 }
2972         }
2973
2974         /***************************/
2975         /* 2. update RTTVAR & SRTT */
2976         /***************************/
2977         /*-
2978          * Compute the scaled average lastsa and the
2979          * scaled variance lastsv as described in van Jacobson
2980          * Paper "Congestion Avoidance and Control", Annex A.
2981          *
2982          * (net->lastsa >> SCTP_RTT_SHIFT) is the srtt
2983          * (net->lastsv >> SCTP_RTT_VAR_SHIFT) is the rttvar
2984          */
2985         if (net->RTO_measured) {
2986                 rtt -= (net->lastsa >> SCTP_RTT_SHIFT);
2987                 net->lastsa += rtt;
2988                 if (rtt < 0) {
2989                         rtt = -rtt;
2990                 }
2991                 rtt -= (net->lastsv >> SCTP_RTT_VAR_SHIFT);
2992                 net->lastsv += rtt;
2993                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2994                         rto_logging(net, SCTP_LOG_RTTVAR);
2995                 }
2996         } else {
2997                 /* First RTO measurement */
2998                 net->RTO_measured = 1;
2999                 first_measure = 1;
3000                 net->lastsa = rtt << SCTP_RTT_SHIFT;
3001                 net->lastsv = (rtt / 2) << SCTP_RTT_VAR_SHIFT;
3002                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
3003                         rto_logging(net, SCTP_LOG_INITIAL_RTT);
3004                 }
3005         }
3006         if (net->lastsv == 0) {
3007                 net->lastsv = SCTP_CLOCK_GRANULARITY;
3008         }
3009         new_rto = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
3010         if ((new_rto > SCTP_SAT_NETWORK_MIN) &&
3011             (stcb->asoc.sat_network_lockout == 0)) {
3012                 stcb->asoc.sat_network = 1;
3013         } else if ((!first_measure) && stcb->asoc.sat_network) {
3014                 stcb->asoc.sat_network = 0;
3015                 stcb->asoc.sat_network_lockout = 1;
3016         }
3017         /* bound it, per C6/C7 in Section 5.3.1 */
3018         if (new_rto < stcb->asoc.minrto) {
3019                 new_rto = stcb->asoc.minrto;
3020         }
3021         if (new_rto > stcb->asoc.maxrto) {
3022                 new_rto = stcb->asoc.maxrto;
3023         }
3024         net->RTO = new_rto;
3025         return (1);
3026 }
3027
3028 /*
3029  * return a pointer to a contiguous piece of data from the given mbuf chain
3030  * starting at 'off' for 'len' bytes.  If the desired piece spans more than
3031  * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size
3032  * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain.
3033  */
3034 caddr_t
3035 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t *in_ptr)
3036 {
3037         uint32_t count;
3038         uint8_t *ptr;
3039
3040         ptr = in_ptr;
3041         if ((off < 0) || (len <= 0))
3042                 return (NULL);
3043
3044         /* find the desired start location */
3045         while ((m != NULL) && (off > 0)) {
3046                 if (off < SCTP_BUF_LEN(m))
3047                         break;
3048                 off -= SCTP_BUF_LEN(m);
3049                 m = SCTP_BUF_NEXT(m);
3050         }
3051         if (m == NULL)
3052                 return (NULL);
3053
3054         /* is the current mbuf large enough (eg. contiguous)? */
3055         if ((SCTP_BUF_LEN(m) - off) >= len) {
3056                 return (mtod(m, caddr_t)+off);
3057         } else {
3058                 /* else, it spans more than one mbuf, so save a temp copy... */
3059                 while ((m != NULL) && (len > 0)) {
3060                         count = min(SCTP_BUF_LEN(m) - off, len);
3061                         memcpy(ptr, mtod(m, caddr_t)+off, count);
3062                         len -= count;
3063                         ptr += count;
3064                         off = 0;
3065                         m = SCTP_BUF_NEXT(m);
3066                 }
3067                 if ((m == NULL) && (len > 0))
3068                         return (NULL);
3069                 else
3070                         return ((caddr_t)in_ptr);
3071         }
3072 }
3073
3074 struct sctp_paramhdr *
3075 sctp_get_next_param(struct mbuf *m,
3076     int offset,
3077     struct sctp_paramhdr *pull,
3078     int pull_limit)
3079 {
3080         /* This just provides a typed signature to Peter's Pull routine */
3081         return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit,
3082             (uint8_t *)pull));
3083 }
3084
3085 struct mbuf *
3086 sctp_add_pad_tombuf(struct mbuf *m, int padlen)
3087 {
3088         struct mbuf *m_last;
3089         caddr_t dp;
3090
3091         if (padlen > 3) {
3092                 return (NULL);
3093         }
3094         if (padlen <= M_TRAILINGSPACE(m)) {
3095                 /*
3096                  * The easy way. We hope the majority of the time we hit
3097                  * here :)
3098                  */
3099                 m_last = m;
3100         } else {
3101                 /* Hard way we must grow the mbuf chain */
3102                 m_last = sctp_get_mbuf_for_msg(padlen, 0, M_NOWAIT, 1, MT_DATA);
3103                 if (m_last == NULL) {
3104                         return (NULL);
3105                 }
3106                 SCTP_BUF_LEN(m_last) = 0;
3107                 SCTP_BUF_NEXT(m_last) = NULL;
3108                 SCTP_BUF_NEXT(m) = m_last;
3109         }
3110         dp = mtod(m_last, caddr_t)+SCTP_BUF_LEN(m_last);
3111         SCTP_BUF_LEN(m_last) += padlen;
3112         memset(dp, 0, padlen);
3113         return (m_last);
3114 }
3115
3116 struct mbuf *
3117 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf)
3118 {
3119         /* find the last mbuf in chain and pad it */
3120         struct mbuf *m_at;
3121
3122         if (last_mbuf != NULL) {
3123                 return (sctp_add_pad_tombuf(last_mbuf, padval));
3124         } else {
3125                 for (m_at = m; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
3126                         if (SCTP_BUF_NEXT(m_at) == NULL) {
3127                                 return (sctp_add_pad_tombuf(m_at, padval));
3128                         }
3129                 }
3130         }
3131         return (NULL);
3132 }
3133
3134 static void
3135 sctp_notify_assoc_change(uint16_t state, struct sctp_tcb *stcb,
3136     uint16_t error, struct sctp_abort_chunk *abort,
3137     bool from_peer, bool timedout, int so_locked)
3138 {
3139         struct mbuf *m_notify;
3140         struct sctp_assoc_change *sac;
3141         struct sctp_queued_to_read *control;
3142         unsigned int notif_len;
3143         uint16_t abort_len;
3144         unsigned int i;
3145
3146         KASSERT(abort == NULL || from_peer,
3147             ("sctp_notify_assoc_change: ABORT chunk provided for local termination"));
3148         KASSERT(!from_peer || !timedout,
3149             ("sctp_notify_assoc_change: timeouts can only be local"));
3150         if (stcb == NULL) {
3151                 return;
3152         }
3153         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVASSOCEVNT)) {
3154                 notif_len = (unsigned int)sizeof(struct sctp_assoc_change);
3155                 if (abort != NULL) {
3156                         abort_len = ntohs(abort->ch.chunk_length);
3157                         /*
3158                          * Only SCTP_CHUNK_BUFFER_SIZE are guaranteed to be
3159                          * contiguous.
3160                          */
3161                         if (abort_len > SCTP_CHUNK_BUFFER_SIZE) {
3162                                 abort_len = SCTP_CHUNK_BUFFER_SIZE;
3163                         }
3164                 } else {
3165                         abort_len = 0;
3166                 }
3167                 if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
3168                         notif_len += SCTP_ASSOC_SUPPORTS_MAX;
3169                 } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
3170                         notif_len += abort_len;
3171                 }
3172                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3173                 if (m_notify == NULL) {
3174                         /* Retry with smaller value. */
3175                         notif_len = (unsigned int)sizeof(struct sctp_assoc_change);
3176                         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3177                         if (m_notify == NULL) {
3178                                 goto set_error;
3179                         }
3180                 }
3181                 SCTP_BUF_NEXT(m_notify) = NULL;
3182                 sac = mtod(m_notify, struct sctp_assoc_change *);
3183                 memset(sac, 0, notif_len);
3184                 sac->sac_type = SCTP_ASSOC_CHANGE;
3185                 sac->sac_flags = 0;
3186                 sac->sac_length = sizeof(struct sctp_assoc_change);
3187                 sac->sac_state = state;
3188                 sac->sac_error = error;
3189                 if (state == SCTP_CANT_STR_ASSOC) {
3190                         sac->sac_outbound_streams = 0;
3191                         sac->sac_inbound_streams = 0;
3192                 } else {
3193                         sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
3194                         sac->sac_inbound_streams = stcb->asoc.streamincnt;
3195                 }
3196                 sac->sac_assoc_id = sctp_get_associd(stcb);
3197                 if (notif_len > sizeof(struct sctp_assoc_change)) {
3198                         if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
3199                                 i = 0;
3200                                 if (stcb->asoc.prsctp_supported == 1) {
3201                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_PR;
3202                                 }
3203                                 if (stcb->asoc.auth_supported == 1) {
3204                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_AUTH;
3205                                 }
3206                                 if (stcb->asoc.asconf_supported == 1) {
3207                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_ASCONF;
3208                                 }
3209                                 if (stcb->asoc.idata_supported == 1) {
3210                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_INTERLEAVING;
3211                                 }
3212                                 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_MULTIBUF;
3213                                 if (stcb->asoc.reconfig_supported == 1) {
3214                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_RE_CONFIG;
3215                                 }
3216                                 sac->sac_length += i;
3217                         } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
3218                                 memcpy(sac->sac_info, abort, abort_len);
3219                                 sac->sac_length += abort_len;
3220                         }
3221                 }
3222                 SCTP_BUF_LEN(m_notify) = sac->sac_length;
3223                 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3224                     0, 0, stcb->asoc.context, 0, 0, 0,
3225                     m_notify);
3226                 if (control != NULL) {
3227                         control->length = SCTP_BUF_LEN(m_notify);
3228                         control->spec_flags = M_NOTIFICATION;
3229                         /* not that we need this */
3230                         control->tail_mbuf = m_notify;
3231                         sctp_add_to_readq(stcb->sctp_ep, stcb,
3232                             control,
3233                             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD,
3234                             so_locked);
3235                 } else {
3236                         sctp_m_freem(m_notify);
3237                 }
3238         }
3239         /*
3240          * For 1-to-1 style sockets, we send up and error when an ABORT
3241          * comes in.
3242          */
3243 set_error:
3244         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3245             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
3246             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
3247                 SOCK_LOCK(stcb->sctp_socket);
3248                 if (from_peer) {
3249                         if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) {
3250                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNREFUSED);
3251                                 stcb->sctp_socket->so_error = ECONNREFUSED;
3252                         } else {
3253                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
3254                                 stcb->sctp_socket->so_error = ECONNRESET;
3255                         }
3256                 } else {
3257                         if (timedout) {
3258                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ETIMEDOUT);
3259                                 stcb->sctp_socket->so_error = ETIMEDOUT;
3260                         } else {
3261                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNABORTED);
3262                                 stcb->sctp_socket->so_error = ECONNABORTED;
3263                         }
3264                 }
3265                 SOCK_UNLOCK(stcb->sctp_socket);
3266         }
3267         /* Wake ANY sleepers */
3268         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3269             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
3270             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
3271                 socantrcvmore(stcb->sctp_socket);
3272         }
3273         sorwakeup(stcb->sctp_socket);
3274         sowwakeup(stcb->sctp_socket);
3275 }
3276
3277 static void
3278 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
3279     struct sockaddr *sa, uint32_t error, int so_locked)
3280 {
3281         struct mbuf *m_notify;
3282         struct sctp_paddr_change *spc;
3283         struct sctp_queued_to_read *control;
3284
3285         if ((stcb == NULL) ||
3286             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPADDREVNT)) {
3287                 /* event not enabled */
3288                 return;
3289         }
3290         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 0, M_NOWAIT, 1, MT_DATA);
3291         if (m_notify == NULL)
3292                 return;
3293         SCTP_BUF_LEN(m_notify) = 0;
3294         spc = mtod(m_notify, struct sctp_paddr_change *);
3295         memset(spc, 0, sizeof(struct sctp_paddr_change));
3296         spc->spc_type = SCTP_PEER_ADDR_CHANGE;
3297         spc->spc_flags = 0;
3298         spc->spc_length = sizeof(struct sctp_paddr_change);
3299         switch (sa->sa_family) {
3300 #ifdef INET
3301         case AF_INET:
3302 #ifdef INET6
3303                 if (sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
3304                         in6_sin_2_v4mapsin6((struct sockaddr_in *)sa,
3305                             (struct sockaddr_in6 *)&spc->spc_aaddr);
3306                 } else {
3307                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
3308                 }
3309 #else
3310                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
3311 #endif
3312                 break;
3313 #endif
3314 #ifdef INET6
3315         case AF_INET6:
3316                 {
3317                         struct sockaddr_in6 *sin6;
3318
3319                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6));
3320
3321                         sin6 = (struct sockaddr_in6 *)&spc->spc_aaddr;
3322                         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
3323                                 if (sin6->sin6_scope_id == 0) {
3324                                         /* recover scope_id for user */
3325                                         (void)sa6_recoverscope(sin6);
3326                                 } else {
3327                                         /* clear embedded scope_id for user */
3328                                         in6_clearscope(&sin6->sin6_addr);
3329                                 }
3330                         }
3331                         break;
3332                 }
3333 #endif
3334         default:
3335                 /* TSNH */
3336                 break;
3337         }
3338         spc->spc_state = state;
3339         spc->spc_error = error;
3340         spc->spc_assoc_id = sctp_get_associd(stcb);
3341
3342         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_paddr_change);
3343         SCTP_BUF_NEXT(m_notify) = NULL;
3344
3345         /* append to socket */
3346         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3347             0, 0, stcb->asoc.context, 0, 0, 0,
3348             m_notify);
3349         if (control == NULL) {
3350                 /* no memory */
3351                 sctp_m_freem(m_notify);
3352                 return;
3353         }
3354         control->length = SCTP_BUF_LEN(m_notify);
3355         control->spec_flags = M_NOTIFICATION;
3356         /* not that we need this */
3357         control->tail_mbuf = m_notify;
3358         sctp_add_to_readq(stcb->sctp_ep, stcb,
3359             control,
3360             &stcb->sctp_socket->so_rcv, 1,
3361             SCTP_READ_LOCK_NOT_HELD,
3362             so_locked);
3363 }
3364
3365 static void
3366 sctp_notify_send_failed(struct sctp_tcb *stcb, uint8_t sent, uint32_t error,
3367     struct sctp_tmit_chunk *chk, int so_locked)
3368 {
3369         struct mbuf *m_notify;
3370         struct sctp_send_failed *ssf;
3371         struct sctp_send_failed_event *ssfe;
3372         struct sctp_queued_to_read *control;
3373         struct sctp_chunkhdr *chkhdr;
3374         int notifhdr_len, chk_len, chkhdr_len, padding_len, payload_len;
3375
3376         if ((stcb == NULL) ||
3377             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
3378             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
3379                 /* event not enabled */
3380                 return;
3381         }
3382
3383         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3384                 notifhdr_len = sizeof(struct sctp_send_failed_event);
3385         } else {
3386                 notifhdr_len = sizeof(struct sctp_send_failed);
3387         }
3388         m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA);
3389         if (m_notify == NULL)
3390                 /* no space left */
3391                 return;
3392         SCTP_BUF_LEN(m_notify) = notifhdr_len;
3393         if (stcb->asoc.idata_supported) {
3394                 chkhdr_len = sizeof(struct sctp_idata_chunk);
3395         } else {
3396                 chkhdr_len = sizeof(struct sctp_data_chunk);
3397         }
3398         /* Use some defaults in case we can't access the chunk header */
3399         if (chk->send_size >= chkhdr_len) {
3400                 payload_len = chk->send_size - chkhdr_len;
3401         } else {
3402                 payload_len = 0;
3403         }
3404         padding_len = 0;
3405         if (chk->data != NULL) {
3406                 chkhdr = mtod(chk->data, struct sctp_chunkhdr *);
3407                 if (chkhdr != NULL) {
3408                         chk_len = ntohs(chkhdr->chunk_length);
3409                         if ((chk_len >= chkhdr_len) &&
3410                             (chk->send_size >= chk_len) &&
3411                             (chk->send_size - chk_len < 4)) {
3412                                 padding_len = chk->send_size - chk_len;
3413                                 payload_len = chk->send_size - chkhdr_len - padding_len;
3414                         }
3415                 }
3416         }
3417         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3418                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
3419                 memset(ssfe, 0, notifhdr_len);
3420                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
3421                 if (sent) {
3422                         ssfe->ssfe_flags = SCTP_DATA_SENT;
3423                 } else {
3424                         ssfe->ssfe_flags = SCTP_DATA_UNSENT;
3425                 }
3426                 ssfe->ssfe_length = (uint32_t)(notifhdr_len + payload_len);
3427                 ssfe->ssfe_error = error;
3428                 /* not exactly what the user sent in, but should be close :) */
3429                 ssfe->ssfe_info.snd_sid = chk->rec.data.sid;
3430                 ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags;
3431                 ssfe->ssfe_info.snd_ppid = chk->rec.data.ppid;
3432                 ssfe->ssfe_info.snd_context = chk->rec.data.context;
3433                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
3434                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
3435         } else {
3436                 ssf = mtod(m_notify, struct sctp_send_failed *);
3437                 memset(ssf, 0, notifhdr_len);
3438                 ssf->ssf_type = SCTP_SEND_FAILED;
3439                 if (sent) {
3440                         ssf->ssf_flags = SCTP_DATA_SENT;
3441                 } else {
3442                         ssf->ssf_flags = SCTP_DATA_UNSENT;
3443                 }
3444                 ssf->ssf_length = (uint32_t)(notifhdr_len + payload_len);
3445                 ssf->ssf_error = error;
3446                 /* not exactly what the user sent in, but should be close :) */
3447                 ssf->ssf_info.sinfo_stream = chk->rec.data.sid;
3448                 ssf->ssf_info.sinfo_ssn = (uint16_t)chk->rec.data.mid;
3449                 ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags;
3450                 ssf->ssf_info.sinfo_ppid = chk->rec.data.ppid;
3451                 ssf->ssf_info.sinfo_context = chk->rec.data.context;
3452                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
3453                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
3454         }
3455         if (chk->data != NULL) {
3456                 /* Trim off the sctp chunk header (it should be there) */
3457                 if (chk->send_size == chkhdr_len + payload_len + padding_len) {
3458                         m_adj(chk->data, chkhdr_len);
3459                         m_adj(chk->data, -padding_len);
3460                         sctp_mbuf_crush(chk->data);
3461                         chk->send_size -= (chkhdr_len + padding_len);
3462                 }
3463         }
3464         SCTP_BUF_NEXT(m_notify) = chk->data;
3465         /* Steal off the mbuf */
3466         chk->data = NULL;
3467         /*
3468          * For this case, we check the actual socket buffer, since the assoc
3469          * is going away we don't want to overfill the socket buffer for a
3470          * non-reader
3471          */
3472         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3473                 sctp_m_freem(m_notify);
3474                 return;
3475         }
3476         /* append to socket */
3477         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3478             0, 0, stcb->asoc.context, 0, 0, 0,
3479             m_notify);
3480         if (control == NULL) {
3481                 /* no memory */
3482                 sctp_m_freem(m_notify);
3483                 return;
3484         }
3485         control->length = SCTP_BUF_LEN(m_notify);
3486         control->spec_flags = M_NOTIFICATION;
3487         /* not that we need this */
3488         control->tail_mbuf = m_notify;
3489         sctp_add_to_readq(stcb->sctp_ep, stcb,
3490             control,
3491             &stcb->sctp_socket->so_rcv, 1,
3492             SCTP_READ_LOCK_NOT_HELD,
3493             so_locked);
3494 }
3495
3496 static void
3497 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
3498     struct sctp_stream_queue_pending *sp, int so_locked)
3499 {
3500         struct mbuf *m_notify;
3501         struct sctp_send_failed *ssf;
3502         struct sctp_send_failed_event *ssfe;
3503         struct sctp_queued_to_read *control;
3504         int notifhdr_len;
3505
3506         if ((stcb == NULL) ||
3507             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
3508             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
3509                 /* event not enabled */
3510                 return;
3511         }
3512         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3513                 notifhdr_len = sizeof(struct sctp_send_failed_event);
3514         } else {
3515                 notifhdr_len = sizeof(struct sctp_send_failed);
3516         }
3517         m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA);
3518         if (m_notify == NULL) {
3519                 /* no space left */
3520                 return;
3521         }
3522         SCTP_BUF_LEN(m_notify) = notifhdr_len;
3523         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3524                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
3525                 memset(ssfe, 0, notifhdr_len);
3526                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
3527                 ssfe->ssfe_flags = SCTP_DATA_UNSENT;
3528                 ssfe->ssfe_length = (uint32_t)(notifhdr_len + sp->length);
3529                 ssfe->ssfe_error = error;
3530                 /* not exactly what the user sent in, but should be close :) */
3531                 ssfe->ssfe_info.snd_sid = sp->sid;
3532                 if (sp->some_taken) {
3533                         ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG;
3534                 } else {
3535                         ssfe->ssfe_info.snd_flags = SCTP_DATA_NOT_FRAG;
3536                 }
3537                 ssfe->ssfe_info.snd_ppid = sp->ppid;
3538                 ssfe->ssfe_info.snd_context = sp->context;
3539                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
3540                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
3541         } else {
3542                 ssf = mtod(m_notify, struct sctp_send_failed *);
3543                 memset(ssf, 0, notifhdr_len);
3544                 ssf->ssf_type = SCTP_SEND_FAILED;
3545                 ssf->ssf_flags = SCTP_DATA_UNSENT;
3546                 ssf->ssf_length = (uint32_t)(notifhdr_len + sp->length);
3547                 ssf->ssf_error = error;
3548                 /* not exactly what the user sent in, but should be close :) */
3549                 ssf->ssf_info.sinfo_stream = sp->sid;
3550                 ssf->ssf_info.sinfo_ssn = 0;
3551                 if (sp->some_taken) {
3552                         ssf->ssf_info.sinfo_flags = SCTP_DATA_LAST_FRAG;
3553                 } else {
3554                         ssf->ssf_info.sinfo_flags = SCTP_DATA_NOT_FRAG;
3555                 }
3556                 ssf->ssf_info.sinfo_ppid = sp->ppid;
3557                 ssf->ssf_info.sinfo_context = sp->context;
3558                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
3559                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
3560         }
3561         SCTP_BUF_NEXT(m_notify) = sp->data;
3562
3563         /* Steal off the mbuf */
3564         sp->data = NULL;
3565         /*
3566          * For this case, we check the actual socket buffer, since the assoc
3567          * is going away we don't want to overfill the socket buffer for a
3568          * non-reader
3569          */
3570         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3571                 sctp_m_freem(m_notify);
3572                 return;
3573         }
3574         /* append to socket */
3575         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3576             0, 0, stcb->asoc.context, 0, 0, 0,
3577             m_notify);
3578         if (control == NULL) {
3579                 /* no memory */
3580                 sctp_m_freem(m_notify);
3581                 return;
3582         }
3583         control->length = SCTP_BUF_LEN(m_notify);
3584         control->spec_flags = M_NOTIFICATION;
3585         /* not that we need this */
3586         control->tail_mbuf = m_notify;
3587         sctp_add_to_readq(stcb->sctp_ep, stcb,
3588             control,
3589             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3590 }
3591
3592 static void
3593 sctp_notify_adaptation_layer(struct sctp_tcb *stcb)
3594 {
3595         struct mbuf *m_notify;
3596         struct sctp_adaptation_event *sai;
3597         struct sctp_queued_to_read *control;
3598
3599         if ((stcb == NULL) ||
3600             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ADAPTATIONEVNT)) {
3601                 /* event not enabled */
3602                 return;
3603         }
3604
3605         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_NOWAIT, 1, MT_DATA);
3606         if (m_notify == NULL)
3607                 /* no space left */
3608                 return;
3609         SCTP_BUF_LEN(m_notify) = 0;
3610         sai = mtod(m_notify, struct sctp_adaptation_event *);
3611         memset(sai, 0, sizeof(struct sctp_adaptation_event));
3612         sai->sai_type = SCTP_ADAPTATION_INDICATION;
3613         sai->sai_flags = 0;
3614         sai->sai_length = sizeof(struct sctp_adaptation_event);
3615         sai->sai_adaptation_ind = stcb->asoc.peers_adaptation;
3616         sai->sai_assoc_id = sctp_get_associd(stcb);
3617
3618         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_adaptation_event);
3619         SCTP_BUF_NEXT(m_notify) = NULL;
3620
3621         /* append to socket */
3622         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3623             0, 0, stcb->asoc.context, 0, 0, 0,
3624             m_notify);
3625         if (control == NULL) {
3626                 /* no memory */
3627                 sctp_m_freem(m_notify);
3628                 return;
3629         }
3630         control->length = SCTP_BUF_LEN(m_notify);
3631         control->spec_flags = M_NOTIFICATION;
3632         /* not that we need this */
3633         control->tail_mbuf = m_notify;
3634         sctp_add_to_readq(stcb->sctp_ep, stcb,
3635             control,
3636             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3637 }
3638
3639 /* This always must be called with the read-queue LOCKED in the INP */
3640 static void
3641 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb, uint32_t error,
3642     uint32_t val, int so_locked)
3643 {
3644         struct mbuf *m_notify;
3645         struct sctp_pdapi_event *pdapi;
3646         struct sctp_queued_to_read *control;
3647         struct sockbuf *sb;
3648
3649         if ((stcb == NULL) ||
3650             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_PDAPIEVNT)) {
3651                 /* event not enabled */
3652                 return;
3653         }
3654         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
3655                 return;
3656         }
3657
3658         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 0, M_NOWAIT, 1, MT_DATA);
3659         if (m_notify == NULL)
3660                 /* no space left */
3661                 return;
3662         SCTP_BUF_LEN(m_notify) = 0;
3663         pdapi = mtod(m_notify, struct sctp_pdapi_event *);
3664         memset(pdapi, 0, sizeof(struct sctp_pdapi_event));
3665         pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
3666         pdapi->pdapi_flags = 0;
3667         pdapi->pdapi_length = sizeof(struct sctp_pdapi_event);
3668         pdapi->pdapi_indication = error;
3669         pdapi->pdapi_stream = (val >> 16);
3670         pdapi->pdapi_seq = (val & 0x0000ffff);
3671         pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
3672
3673         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_pdapi_event);
3674         SCTP_BUF_NEXT(m_notify) = NULL;
3675         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3676             0, 0, stcb->asoc.context, 0, 0, 0,
3677             m_notify);
3678         if (control == NULL) {
3679                 /* no memory */
3680                 sctp_m_freem(m_notify);
3681                 return;
3682         }
3683         control->length = SCTP_BUF_LEN(m_notify);
3684         control->spec_flags = M_NOTIFICATION;
3685         /* not that we need this */
3686         control->tail_mbuf = m_notify;
3687         sb = &stcb->sctp_socket->so_rcv;
3688         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3689                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m_notify));
3690         }
3691         sctp_sballoc(stcb, sb, m_notify);
3692         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3693                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3694         }
3695         control->end_added = 1;
3696         if (stcb->asoc.control_pdapi)
3697                 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next);
3698         else {
3699                 /* we really should not see this case */
3700                 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next);
3701         }
3702         if (stcb->sctp_ep && stcb->sctp_socket) {
3703                 /* This should always be the case */
3704                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
3705         }
3706 }
3707
3708 static void
3709 sctp_notify_shutdown_event(struct sctp_tcb *stcb)
3710 {
3711         struct mbuf *m_notify;
3712         struct sctp_shutdown_event *sse;
3713         struct sctp_queued_to_read *control;
3714
3715         /*
3716          * For TCP model AND UDP connected sockets we will send an error up
3717          * when an SHUTDOWN completes
3718          */
3719         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3720             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
3721                 /* mark socket closed for read/write and wakeup! */
3722                 socantsendmore(stcb->sctp_socket);
3723         }
3724         if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT)) {
3725                 /* event not enabled */
3726                 return;
3727         }
3728
3729         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 0, M_NOWAIT, 1, MT_DATA);
3730         if (m_notify == NULL)
3731                 /* no space left */
3732                 return;
3733         sse = mtod(m_notify, struct sctp_shutdown_event *);
3734         memset(sse, 0, sizeof(struct sctp_shutdown_event));
3735         sse->sse_type = SCTP_SHUTDOWN_EVENT;
3736         sse->sse_flags = 0;
3737         sse->sse_length = sizeof(struct sctp_shutdown_event);
3738         sse->sse_assoc_id = sctp_get_associd(stcb);
3739
3740         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_shutdown_event);
3741         SCTP_BUF_NEXT(m_notify) = NULL;
3742
3743         /* append to socket */
3744         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3745             0, 0, stcb->asoc.context, 0, 0, 0,
3746             m_notify);
3747         if (control == NULL) {
3748                 /* no memory */
3749                 sctp_m_freem(m_notify);
3750                 return;
3751         }
3752         control->length = SCTP_BUF_LEN(m_notify);
3753         control->spec_flags = M_NOTIFICATION;
3754         /* not that we need this */
3755         control->tail_mbuf = m_notify;
3756         sctp_add_to_readq(stcb->sctp_ep, stcb,
3757             control,
3758             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3759 }
3760
3761 static void
3762 sctp_notify_sender_dry_event(struct sctp_tcb *stcb,
3763     int so_locked)
3764 {
3765         struct mbuf *m_notify;
3766         struct sctp_sender_dry_event *event;
3767         struct sctp_queued_to_read *control;
3768
3769         if ((stcb == NULL) ||
3770             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DRYEVNT)) {
3771                 /* event not enabled */
3772                 return;
3773         }
3774
3775         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_sender_dry_event), 0, M_NOWAIT, 1, MT_DATA);
3776         if (m_notify == NULL) {
3777                 /* no space left */
3778                 return;
3779         }
3780         SCTP_BUF_LEN(m_notify) = 0;
3781         event = mtod(m_notify, struct sctp_sender_dry_event *);
3782         memset(event, 0, sizeof(struct sctp_sender_dry_event));
3783         event->sender_dry_type = SCTP_SENDER_DRY_EVENT;
3784         event->sender_dry_flags = 0;
3785         event->sender_dry_length = sizeof(struct sctp_sender_dry_event);
3786         event->sender_dry_assoc_id = sctp_get_associd(stcb);
3787
3788         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_sender_dry_event);
3789         SCTP_BUF_NEXT(m_notify) = NULL;
3790
3791         /* append to socket */
3792         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3793             0, 0, stcb->asoc.context, 0, 0, 0,
3794             m_notify);
3795         if (control == NULL) {
3796                 /* no memory */
3797                 sctp_m_freem(m_notify);
3798                 return;
3799         }
3800         control->length = SCTP_BUF_LEN(m_notify);
3801         control->spec_flags = M_NOTIFICATION;
3802         /* not that we need this */
3803         control->tail_mbuf = m_notify;
3804         sctp_add_to_readq(stcb->sctp_ep, stcb, control,
3805             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3806 }
3807
3808 void
3809 sctp_notify_stream_reset_add(struct sctp_tcb *stcb, uint16_t numberin, uint16_t numberout, int flag)
3810 {
3811         struct mbuf *m_notify;
3812         struct sctp_queued_to_read *control;
3813         struct sctp_stream_change_event *stradd;
3814
3815         if ((stcb == NULL) ||
3816             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3817             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3818             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3819                 /* If the socket is gone we are out of here. */
3820                 return;
3821         }
3822         if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT)) {
3823                 /* event not enabled */
3824                 return;
3825         }
3826
3827         if ((stcb->asoc.peer_req_out) && flag) {
3828                 /* Peer made the request, don't tell the local user */
3829                 stcb->asoc.peer_req_out = 0;
3830                 return;
3831         }
3832         stcb->asoc.peer_req_out = 0;
3833         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_stream_change_event), 0, M_NOWAIT, 1, MT_DATA);
3834         if (m_notify == NULL)
3835                 /* no space left */
3836                 return;
3837         SCTP_BUF_LEN(m_notify) = 0;
3838         stradd = mtod(m_notify, struct sctp_stream_change_event *);
3839         memset(stradd, 0, sizeof(struct sctp_stream_change_event));
3840         stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT;
3841         stradd->strchange_flags = flag;
3842         stradd->strchange_length = sizeof(struct sctp_stream_change_event);
3843         stradd->strchange_assoc_id = sctp_get_associd(stcb);
3844         stradd->strchange_instrms = numberin;
3845         stradd->strchange_outstrms = numberout;
3846         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_stream_change_event);
3847         SCTP_BUF_NEXT(m_notify) = NULL;
3848         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3849                 /* no space */
3850                 sctp_m_freem(m_notify);
3851                 return;
3852         }
3853         /* append to socket */
3854         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3855             0, 0, stcb->asoc.context, 0, 0, 0,
3856             m_notify);
3857         if (control == NULL) {
3858                 /* no memory */
3859                 sctp_m_freem(m_notify);
3860                 return;
3861         }
3862         control->length = SCTP_BUF_LEN(m_notify);
3863         control->spec_flags = M_NOTIFICATION;
3864         /* not that we need this */
3865         control->tail_mbuf = m_notify;
3866         sctp_add_to_readq(stcb->sctp_ep, stcb,
3867             control,
3868             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3869 }
3870
3871 void
3872 sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb, uint32_t sending_tsn, uint32_t recv_tsn, int flag)
3873 {
3874         struct mbuf *m_notify;
3875         struct sctp_queued_to_read *control;
3876         struct sctp_assoc_reset_event *strasoc;
3877
3878         if ((stcb == NULL) ||
3879             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3880             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3881             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3882                 /* If the socket is gone we are out of here. */
3883                 return;
3884         }
3885         if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT)) {
3886                 /* event not enabled */
3887                 return;
3888         }
3889
3890         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_reset_event), 0, M_NOWAIT, 1, MT_DATA);
3891         if (m_notify == NULL)
3892                 /* no space left */
3893                 return;
3894         SCTP_BUF_LEN(m_notify) = 0;
3895         strasoc = mtod(m_notify, struct sctp_assoc_reset_event *);
3896         memset(strasoc, 0, sizeof(struct sctp_assoc_reset_event));
3897         strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT;
3898         strasoc->assocreset_flags = flag;
3899         strasoc->assocreset_length = sizeof(struct sctp_assoc_reset_event);
3900         strasoc->assocreset_assoc_id = sctp_get_associd(stcb);
3901         strasoc->assocreset_local_tsn = sending_tsn;
3902         strasoc->assocreset_remote_tsn = recv_tsn;
3903         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_reset_event);
3904         SCTP_BUF_NEXT(m_notify) = NULL;
3905         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3906                 /* no space */
3907                 sctp_m_freem(m_notify);
3908                 return;
3909         }
3910         /* append to socket */
3911         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3912             0, 0, stcb->asoc.context, 0, 0, 0,
3913             m_notify);
3914         if (control == NULL) {
3915                 /* no memory */
3916                 sctp_m_freem(m_notify);
3917                 return;
3918         }
3919         control->length = SCTP_BUF_LEN(m_notify);
3920         control->spec_flags = M_NOTIFICATION;
3921         /* not that we need this */
3922         control->tail_mbuf = m_notify;
3923         sctp_add_to_readq(stcb->sctp_ep, stcb,
3924             control,
3925             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3926 }
3927
3928 static void
3929 sctp_notify_stream_reset(struct sctp_tcb *stcb,
3930     int number_entries, uint16_t *list, int flag)
3931 {
3932         struct mbuf *m_notify;
3933         struct sctp_queued_to_read *control;
3934         struct sctp_stream_reset_event *strreset;
3935         int len;
3936
3937         if ((stcb == NULL) ||
3938             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_RESETEVNT))) {
3939                 /* event not enabled */
3940                 return;
3941         }
3942
3943         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
3944         if (m_notify == NULL)
3945                 /* no space left */
3946                 return;
3947         SCTP_BUF_LEN(m_notify) = 0;
3948         len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
3949         if (len > M_TRAILINGSPACE(m_notify)) {
3950                 /* never enough room */
3951                 sctp_m_freem(m_notify);
3952                 return;
3953         }
3954         strreset = mtod(m_notify, struct sctp_stream_reset_event *);
3955         memset(strreset, 0, len);
3956         strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
3957         strreset->strreset_flags = flag;
3958         strreset->strreset_length = len;
3959         strreset->strreset_assoc_id = sctp_get_associd(stcb);
3960         if (number_entries) {
3961                 int i;
3962
3963                 for (i = 0; i < number_entries; i++) {
3964                         strreset->strreset_stream_list[i] = ntohs(list[i]);
3965                 }
3966         }
3967         SCTP_BUF_LEN(m_notify) = len;
3968         SCTP_BUF_NEXT(m_notify) = NULL;
3969         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3970                 /* no space */
3971                 sctp_m_freem(m_notify);
3972                 return;
3973         }
3974         /* append to socket */
3975         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3976             0, 0, stcb->asoc.context, 0, 0, 0,
3977             m_notify);
3978         if (control == NULL) {
3979                 /* no memory */
3980                 sctp_m_freem(m_notify);
3981                 return;
3982         }
3983         control->length = SCTP_BUF_LEN(m_notify);
3984         control->spec_flags = M_NOTIFICATION;
3985         /* not that we need this */
3986         control->tail_mbuf = m_notify;
3987         sctp_add_to_readq(stcb->sctp_ep, stcb,
3988             control,
3989             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3990 }
3991
3992 static void
3993 sctp_notify_remote_error(struct sctp_tcb *stcb, uint16_t error, struct sctp_error_chunk *chunk)
3994 {
3995         struct mbuf *m_notify;
3996         struct sctp_remote_error *sre;
3997         struct sctp_queued_to_read *control;
3998         unsigned int notif_len;
3999         uint16_t chunk_len;
4000
4001         if ((stcb == NULL) ||
4002             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPEERERR)) {
4003                 return;
4004         }
4005         if (chunk != NULL) {
4006                 chunk_len = ntohs(chunk->ch.chunk_length);
4007                 /*
4008                  * Only SCTP_CHUNK_BUFFER_SIZE are guaranteed to be
4009                  * contiguous.
4010                  */
4011                 if (chunk_len > SCTP_CHUNK_BUFFER_SIZE) {
4012                         chunk_len = SCTP_CHUNK_BUFFER_SIZE;
4013                 }
4014         } else {
4015                 chunk_len = 0;
4016         }
4017         notif_len = (unsigned int)(sizeof(struct sctp_remote_error) + chunk_len);
4018         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
4019         if (m_notify == NULL) {
4020                 /* Retry with smaller value. */
4021                 notif_len = (unsigned int)sizeof(struct sctp_remote_error);
4022                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
4023                 if (m_notify == NULL) {
4024                         return;
4025                 }
4026         }
4027         SCTP_BUF_NEXT(m_notify) = NULL;
4028         sre = mtod(m_notify, struct sctp_remote_error *);
4029         memset(sre, 0, notif_len);
4030         sre->sre_type = SCTP_REMOTE_ERROR;
4031         sre->sre_flags = 0;
4032         sre->sre_length = sizeof(struct sctp_remote_error);
4033         sre->sre_error = error;
4034         sre->sre_assoc_id = sctp_get_associd(stcb);
4035         if (notif_len > sizeof(struct sctp_remote_error)) {
4036                 memcpy(sre->sre_data, chunk, chunk_len);
4037                 sre->sre_length += chunk_len;
4038         }
4039         SCTP_BUF_LEN(m_notify) = sre->sre_length;
4040         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
4041             0, 0, stcb->asoc.context, 0, 0, 0,
4042             m_notify);
4043         if (control != NULL) {
4044                 control->length = SCTP_BUF_LEN(m_notify);
4045                 control->spec_flags = M_NOTIFICATION;
4046                 /* not that we need this */
4047                 control->tail_mbuf = m_notify;
4048                 sctp_add_to_readq(stcb->sctp_ep, stcb,
4049                     control,
4050                     &stcb->sctp_socket->so_rcv, 1,
4051                     SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
4052         } else {
4053                 sctp_m_freem(m_notify);
4054         }
4055 }
4056
4057 void
4058 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb,
4059     uint32_t error, void *data, int so_locked)
4060 {
4061         if ((stcb == NULL) ||
4062             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
4063             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4064             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
4065                 /* If the socket is gone we are out of here */
4066                 return;
4067         }
4068         if (stcb->sctp_socket->so_rcv.sb_state & SBS_CANTRCVMORE) {
4069                 return;
4070         }
4071         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
4072             (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
4073                 if ((notification == SCTP_NOTIFY_INTERFACE_DOWN) ||
4074                     (notification == SCTP_NOTIFY_INTERFACE_UP) ||
4075                     (notification == SCTP_NOTIFY_INTERFACE_CONFIRMED)) {
4076                         /* Don't report these in front states */
4077                         return;
4078                 }
4079         }
4080         switch (notification) {
4081         case SCTP_NOTIFY_ASSOC_UP:
4082                 if (stcb->asoc.assoc_up_sent == 0) {
4083                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, NULL, false, false, so_locked);
4084                         stcb->asoc.assoc_up_sent = 1;
4085                 }
4086                 if (stcb->asoc.adaptation_needed && (stcb->asoc.adaptation_sent == 0)) {
4087                         sctp_notify_adaptation_layer(stcb);
4088                 }
4089                 if (stcb->asoc.auth_supported == 0) {
4090                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
4091                             NULL, so_locked);
4092                 }
4093                 break;
4094         case SCTP_NOTIFY_ASSOC_DOWN:
4095                 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, NULL, false, false, so_locked);
4096                 break;
4097         case SCTP_NOTIFY_INTERFACE_DOWN:
4098                 {
4099                         struct sctp_nets *net;
4100
4101                         net = (struct sctp_nets *)data;
4102                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE,
4103                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
4104                         break;
4105                 }
4106         case SCTP_NOTIFY_INTERFACE_UP:
4107                 {
4108                         struct sctp_nets *net;
4109
4110                         net = (struct sctp_nets *)data;
4111                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE,
4112                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
4113                         break;
4114                 }
4115         case SCTP_NOTIFY_INTERFACE_CONFIRMED:
4116                 {
4117                         struct sctp_nets *net;
4118
4119                         net = (struct sctp_nets *)data;
4120                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED,
4121                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
4122                         break;
4123                 }
4124         case SCTP_NOTIFY_SPECIAL_SP_FAIL:
4125                 sctp_notify_send_failed2(stcb, error,
4126                     (struct sctp_stream_queue_pending *)data, so_locked);
4127                 break;
4128         case SCTP_NOTIFY_SENT_DG_FAIL:
4129                 sctp_notify_send_failed(stcb, 1, error,
4130                     (struct sctp_tmit_chunk *)data, so_locked);
4131                 break;
4132         case SCTP_NOTIFY_UNSENT_DG_FAIL:
4133                 sctp_notify_send_failed(stcb, 0, error,
4134                     (struct sctp_tmit_chunk *)data, so_locked);
4135                 break;
4136         case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION:
4137                 {
4138                         uint32_t val;
4139
4140                         val = *((uint32_t *)data);
4141
4142                         sctp_notify_partial_delivery_indication(stcb, error, val, so_locked);
4143                         break;
4144                 }
4145         case SCTP_NOTIFY_ASSOC_LOC_ABORTED:
4146                 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
4147                     (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
4148                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, false, false, so_locked);
4149                 } else {
4150                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, false, false, so_locked);
4151                 }
4152                 break;
4153         case SCTP_NOTIFY_ASSOC_REM_ABORTED:
4154                 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
4155                     (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
4156                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, true, false, so_locked);
4157                 } else {
4158                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, true, false, so_locked);
4159                 }
4160                 break;
4161         case SCTP_NOTIFY_ASSOC_TIMEDOUT:
4162                 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
4163                     (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
4164                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, false, true, so_locked);
4165                 } else {
4166                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, false, true, so_locked);
4167                 }
4168                 break;
4169         case SCTP_NOTIFY_ASSOC_RESTART:
4170                 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, NULL, false, false, so_locked);
4171                 if (stcb->asoc.auth_supported == 0) {
4172                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
4173                             NULL, so_locked);
4174                 }
4175                 break;
4176         case SCTP_NOTIFY_STR_RESET_SEND:
4177                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_OUTGOING_SSN);
4178                 break;
4179         case SCTP_NOTIFY_STR_RESET_RECV:
4180                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_INCOMING);
4181                 break;
4182         case SCTP_NOTIFY_STR_RESET_FAILED_OUT:
4183                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
4184                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_FAILED));
4185                 break;
4186         case SCTP_NOTIFY_STR_RESET_DENIED_OUT:
4187                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
4188                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_DENIED));
4189                 break;
4190         case SCTP_NOTIFY_STR_RESET_FAILED_IN:
4191                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
4192                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_FAILED));
4193                 break;
4194         case SCTP_NOTIFY_STR_RESET_DENIED_IN:
4195                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
4196                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_DENIED));
4197                 break;
4198         case SCTP_NOTIFY_ASCONF_ADD_IP:
4199                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data,
4200                     error, so_locked);
4201                 break;
4202         case SCTP_NOTIFY_ASCONF_DELETE_IP:
4203                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data,
4204                     error, so_locked);
4205                 break;
4206         case SCTP_NOTIFY_ASCONF_SET_PRIMARY:
4207                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data,
4208                     error, so_locked);
4209                 break;
4210         case SCTP_NOTIFY_PEER_SHUTDOWN:
4211                 sctp_notify_shutdown_event(stcb);
4212                 break;
4213         case SCTP_NOTIFY_AUTH_NEW_KEY:
4214                 sctp_notify_authentication(stcb, SCTP_AUTH_NEW_KEY, error,
4215                     (uint16_t)(uintptr_t)data,
4216                     so_locked);
4217                 break;
4218         case SCTP_NOTIFY_AUTH_FREE_KEY:
4219                 sctp_notify_authentication(stcb, SCTP_AUTH_FREE_KEY, error,
4220                     (uint16_t)(uintptr_t)data,
4221                     so_locked);
4222                 break;
4223         case SCTP_NOTIFY_NO_PEER_AUTH:
4224                 sctp_notify_authentication(stcb, SCTP_AUTH_NO_AUTH, error,
4225                     (uint16_t)(uintptr_t)data,
4226                     so_locked);
4227                 break;
4228         case SCTP_NOTIFY_SENDER_DRY:
4229                 sctp_notify_sender_dry_event(stcb, so_locked);
4230                 break;
4231         case SCTP_NOTIFY_REMOTE_ERROR:
4232                 sctp_notify_remote_error(stcb, error, data);
4233                 break;
4234         default:
4235                 SCTPDBG(SCTP_DEBUG_UTIL1, "%s: unknown notification %xh (%u)\n",
4236                     __func__, notification, notification);
4237                 break;
4238         }                       /* end switch */
4239 }
4240
4241 void
4242 sctp_report_all_outbound(struct sctp_tcb *stcb, uint16_t error, int so_locked)
4243 {
4244         struct sctp_association *asoc;
4245         struct sctp_stream_out *outs;
4246         struct sctp_tmit_chunk *chk, *nchk;
4247         struct sctp_stream_queue_pending *sp, *nsp;
4248         int i;
4249
4250         if (stcb == NULL) {
4251                 return;
4252         }
4253         asoc = &stcb->asoc;
4254         if (asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) {
4255                 /* already being freed */
4256                 return;
4257         }
4258         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
4259             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4260             (asoc->state & SCTP_STATE_CLOSED_SOCKET)) {
4261                 return;
4262         }
4263         /* now through all the gunk freeing chunks */
4264         /* sent queue SHOULD be empty */
4265         TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) {
4266                 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
4267                 asoc->sent_queue_cnt--;
4268                 if (chk->sent != SCTP_DATAGRAM_NR_ACKED) {
4269                         if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
4270                                 asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
4271 #ifdef INVARIANTS
4272                         } else {
4273                                 panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
4274 #endif
4275                         }
4276                 }
4277                 if (chk->data != NULL) {
4278                         sctp_free_bufspace(stcb, asoc, chk, 1);
4279                         sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb,
4280                             error, chk, so_locked);
4281                         if (chk->data) {
4282                                 sctp_m_freem(chk->data);
4283                                 chk->data = NULL;
4284                         }
4285                 }
4286                 sctp_free_a_chunk(stcb, chk, so_locked);
4287                 /* sa_ignore FREED_MEMORY */
4288         }
4289         /* pending send queue SHOULD be empty */
4290         TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
4291                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
4292                 asoc->send_queue_cnt--;
4293                 if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
4294                         asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
4295 #ifdef INVARIANTS
4296                 } else {
4297                         panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
4298 #endif
4299                 }
4300                 if (chk->data != NULL) {
4301                         sctp_free_bufspace(stcb, asoc, chk, 1);
4302                         sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
4303                             error, chk, so_locked);
4304                         if (chk->data) {
4305                                 sctp_m_freem(chk->data);
4306                                 chk->data = NULL;
4307                         }
4308                 }
4309                 sctp_free_a_chunk(stcb, chk, so_locked);
4310                 /* sa_ignore FREED_MEMORY */
4311         }
4312         for (i = 0; i < asoc->streamoutcnt; i++) {
4313                 /* For each stream */
4314                 outs = &asoc->strmout[i];
4315                 /* clean up any sends there */
4316                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
4317                         atomic_subtract_int(&asoc->stream_queue_cnt, 1);
4318                         TAILQ_REMOVE(&outs->outqueue, sp, next);
4319                         stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp);
4320                         sctp_free_spbufspace(stcb, asoc, sp);
4321                         if (sp->data) {
4322                                 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
4323                                     error, (void *)sp, so_locked);
4324                                 if (sp->data) {
4325                                         sctp_m_freem(sp->data);
4326                                         sp->data = NULL;
4327                                         sp->tail_mbuf = NULL;
4328                                         sp->length = 0;
4329                                 }
4330                         }
4331                         if (sp->net) {
4332                                 sctp_free_remote_addr(sp->net);
4333                                 sp->net = NULL;
4334                         }
4335                         /* Free the chunk */
4336                         sctp_free_a_strmoq(stcb, sp, so_locked);
4337                         /* sa_ignore FREED_MEMORY */
4338                 }
4339         }
4340 }
4341
4342 void
4343 sctp_abort_notification(struct sctp_tcb *stcb, bool from_peer, bool timeout,
4344     uint16_t error, struct sctp_abort_chunk *abort,
4345     int so_locked)
4346 {
4347         if (stcb == NULL) {
4348                 return;
4349         }
4350         SCTP_TCB_LOCK_ASSERT(stcb);
4351
4352         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
4353             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
4354             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
4355                 sctp_pcb_add_flags(stcb->sctp_ep, SCTP_PCB_FLAGS_WAS_ABORTED);
4356         }
4357         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
4358             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4359             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
4360                 return;
4361         }
4362         SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_WAS_ABORTED);
4363         /* Tell them we lost the asoc */
4364         sctp_report_all_outbound(stcb, error, so_locked);
4365         if (from_peer) {
4366                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_REM_ABORTED, stcb, error, abort, so_locked);
4367         } else {
4368                 if (timeout) {
4369                         sctp_ulp_notify(SCTP_NOTIFY_ASSOC_TIMEDOUT, stcb, error, abort, so_locked);
4370                 } else {
4371                         sctp_ulp_notify(SCTP_NOTIFY_ASSOC_LOC_ABORTED, stcb, error, abort, so_locked);
4372                 }
4373         }
4374 }
4375
4376 void
4377 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
4378     struct mbuf *m, int iphlen,
4379     struct sockaddr *src, struct sockaddr *dst,
4380     struct sctphdr *sh, struct mbuf *op_err,
4381     uint8_t mflowtype, uint32_t mflowid,
4382     uint32_t vrf_id, uint16_t port)
4383 {
4384         struct sctp_gen_error_cause *cause;
4385         uint32_t vtag;
4386         uint16_t cause_code;
4387
4388         if (stcb != NULL) {
4389                 vtag = stcb->asoc.peer_vtag;
4390                 vrf_id = stcb->asoc.vrf_id;
4391                 if (op_err != NULL) {
4392                         /* Read the cause code from the error cause. */
4393                         cause = mtod(op_err, struct sctp_gen_error_cause *);
4394                         cause_code = ntohs(cause->code);
4395                 } else {
4396                         cause_code = 0;
4397                 }
4398         } else {
4399                 vtag = 0;
4400         }
4401         sctp_send_abort(m, iphlen, src, dst, sh, vtag, op_err,
4402             mflowtype, mflowid, inp->fibnum,
4403             vrf_id, port);
4404         if (stcb != NULL) {
4405                 /* We have a TCB to abort, send notification too */
4406                 sctp_abort_notification(stcb, false, false, cause_code, NULL, SCTP_SO_NOT_LOCKED);
4407                 /* Ok, now lets free it */
4408                 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4409                 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
4410                     (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4411                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4412                 }
4413                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4414                     SCTP_FROM_SCTPUTIL + SCTP_LOC_4);
4415         }
4416 }
4417 #ifdef SCTP_ASOCLOG_OF_TSNS
4418 void
4419 sctp_print_out_track_log(struct sctp_tcb *stcb)
4420 {
4421 #ifdef NOSIY_PRINTS
4422         int i;
4423
4424         SCTP_PRINTF("Last ep reason:%x\n", stcb->sctp_ep->last_abort_code);
4425         SCTP_PRINTF("IN bound TSN log-aaa\n");
4426         if ((stcb->asoc.tsn_in_at == 0) && (stcb->asoc.tsn_in_wrapped == 0)) {
4427                 SCTP_PRINTF("None rcvd\n");
4428                 goto none_in;
4429         }
4430         if (stcb->asoc.tsn_in_wrapped) {
4431                 for (i = stcb->asoc.tsn_in_at; i < SCTP_TSN_LOG_SIZE; i++) {
4432                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4433                             stcb->asoc.in_tsnlog[i].tsn,
4434                             stcb->asoc.in_tsnlog[i].strm,
4435                             stcb->asoc.in_tsnlog[i].seq,
4436                             stcb->asoc.in_tsnlog[i].flgs,
4437                             stcb->asoc.in_tsnlog[i].sz);
4438                 }
4439         }
4440         if (stcb->asoc.tsn_in_at) {
4441                 for (i = 0; i < stcb->asoc.tsn_in_at; i++) {
4442                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4443                             stcb->asoc.in_tsnlog[i].tsn,
4444                             stcb->asoc.in_tsnlog[i].strm,
4445                             stcb->asoc.in_tsnlog[i].seq,
4446                             stcb->asoc.in_tsnlog[i].flgs,
4447                             stcb->asoc.in_tsnlog[i].sz);
4448                 }
4449         }
4450 none_in:
4451         SCTP_PRINTF("OUT bound TSN log-aaa\n");
4452         if ((stcb->asoc.tsn_out_at == 0) &&
4453             (stcb->asoc.tsn_out_wrapped == 0)) {
4454                 SCTP_PRINTF("None sent\n");
4455         }
4456         if (stcb->asoc.tsn_out_wrapped) {
4457                 for (i = stcb->asoc.tsn_out_at; i < SCTP_TSN_LOG_SIZE; i++) {
4458                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4459                             stcb->asoc.out_tsnlog[i].tsn,
4460                             stcb->asoc.out_tsnlog[i].strm,
4461                             stcb->asoc.out_tsnlog[i].seq,
4462                             stcb->asoc.out_tsnlog[i].flgs,
4463                             stcb->asoc.out_tsnlog[i].sz);
4464                 }
4465         }
4466         if (stcb->asoc.tsn_out_at) {
4467                 for (i = 0; i < stcb->asoc.tsn_out_at; i++) {
4468                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4469                             stcb->asoc.out_tsnlog[i].tsn,
4470                             stcb->asoc.out_tsnlog[i].strm,
4471                             stcb->asoc.out_tsnlog[i].seq,
4472                             stcb->asoc.out_tsnlog[i].flgs,
4473                             stcb->asoc.out_tsnlog[i].sz);
4474                 }
4475         }
4476 #endif
4477 }
4478 #endif
4479
4480 void
4481 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
4482     struct mbuf *op_err, bool timedout, int so_locked)
4483 {
4484         struct sctp_gen_error_cause *cause;
4485         uint16_t cause_code;
4486
4487         if (stcb == NULL) {
4488                 /* Got to have a TCB */
4489                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4490                         if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4491                                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4492                                     SCTP_CALLED_DIRECTLY_NOCMPSET);
4493                         }
4494                 }
4495                 return;
4496         }
4497         if (op_err != NULL) {
4498                 /* Read the cause code from the error cause. */
4499                 cause = mtod(op_err, struct sctp_gen_error_cause *);
4500                 cause_code = ntohs(cause->code);
4501         } else {
4502                 cause_code = 0;
4503         }
4504         /* notify the peer */
4505         sctp_send_abort_tcb(stcb, op_err, so_locked);
4506         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4507         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
4508             (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4509                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4510         }
4511         /* notify the ulp */
4512         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) {
4513                 sctp_abort_notification(stcb, false, timedout, cause_code, NULL, so_locked);
4514         }
4515         /* now free the asoc */
4516 #ifdef SCTP_ASOCLOG_OF_TSNS
4517         sctp_print_out_track_log(stcb);
4518 #endif
4519         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4520             SCTP_FROM_SCTPUTIL + SCTP_LOC_5);
4521 }
4522
4523 void
4524 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset,
4525     struct sockaddr *src, struct sockaddr *dst,
4526     struct sctphdr *sh, struct sctp_inpcb *inp,
4527     struct mbuf *cause,
4528     uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
4529     uint32_t vrf_id, uint16_t port)
4530 {
4531         struct sctp_chunkhdr *ch, chunk_buf;
4532         unsigned int chk_length;
4533         int contains_init_chunk;
4534
4535         SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue);
4536         /* Generate a TO address for future reference */
4537         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
4538                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4539                         sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4540                             SCTP_CALLED_DIRECTLY_NOCMPSET);
4541                 }
4542         }
4543         contains_init_chunk = 0;
4544         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4545             sizeof(*ch), (uint8_t *)&chunk_buf);
4546         while (ch != NULL) {
4547                 chk_length = ntohs(ch->chunk_length);
4548                 if (chk_length < sizeof(*ch)) {
4549                         /* break to abort land */
4550                         break;
4551                 }
4552                 switch (ch->chunk_type) {
4553                 case SCTP_INIT:
4554                         contains_init_chunk = 1;
4555                         break;
4556                 case SCTP_PACKET_DROPPED:
4557                         /* we don't respond to pkt-dropped */
4558                         return;
4559                 case SCTP_ABORT_ASSOCIATION:
4560                         /* we don't respond with an ABORT to an ABORT */
4561                         return;
4562                 case SCTP_SHUTDOWN_COMPLETE:
4563                         /*
4564                          * we ignore it since we are not waiting for it and
4565                          * peer is gone
4566                          */
4567                         return;
4568                 case SCTP_SHUTDOWN_ACK:
4569                         sctp_send_shutdown_complete2(src, dst, sh,
4570                             mflowtype, mflowid, fibnum,
4571                             vrf_id, port);
4572                         return;
4573                 default:
4574                         break;
4575                 }
4576                 offset += SCTP_SIZE32(chk_length);
4577                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4578                     sizeof(*ch), (uint8_t *)&chunk_buf);
4579         }
4580         if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
4581             ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
4582             (contains_init_chunk == 0))) {
4583                 sctp_send_abort(m, iphlen, src, dst, sh, 0, cause,
4584                     mflowtype, mflowid, fibnum,
4585                     vrf_id, port);
4586         }
4587 }
4588
4589 /*
4590  * check the inbound datagram to make sure there is not an abort inside it,
4591  * if there is return 1, else return 0.
4592  */
4593 int
4594 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t *vtag)
4595 {
4596         struct sctp_chunkhdr *ch;
4597         struct sctp_init_chunk *init_chk, chunk_buf;
4598         int offset;
4599         unsigned int chk_length;
4600
4601         offset = iphlen + sizeof(struct sctphdr);
4602         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch),
4603             (uint8_t *)&chunk_buf);
4604         while (ch != NULL) {
4605                 chk_length = ntohs(ch->chunk_length);
4606                 if (chk_length < sizeof(*ch)) {
4607                         /* packet is probably corrupt */
4608                         break;
4609                 }
4610                 /* we seem to be ok, is it an abort? */
4611                 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) {
4612                         /* yep, tell them */
4613                         return (1);
4614                 }
4615                 if ((ch->chunk_type == SCTP_INITIATION) ||
4616                     (ch->chunk_type == SCTP_INITIATION_ACK)) {
4617                         /* need to update the Vtag */
4618                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
4619                             offset, sizeof(struct sctp_init_chunk), (uint8_t *)&chunk_buf);
4620                         if (init_chk != NULL) {
4621                                 *vtag = ntohl(init_chk->init.initiate_tag);
4622                         }
4623                 }
4624                 /* Nope, move to the next chunk */
4625                 offset += SCTP_SIZE32(chk_length);
4626                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4627                     sizeof(*ch), (uint8_t *)&chunk_buf);
4628         }
4629         return (0);
4630 }
4631
4632 /*
4633  * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id
4634  * set (i.e. it's 0) so, create this function to compare link local scopes
4635  */
4636 #ifdef INET6
4637 uint32_t
4638 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2)
4639 {
4640         struct sockaddr_in6 a, b;
4641
4642         /* save copies */
4643         a = *addr1;
4644         b = *addr2;
4645
4646         if (a.sin6_scope_id == 0)
4647                 if (sa6_recoverscope(&a)) {
4648                         /* can't get scope, so can't match */
4649                         return (0);
4650                 }
4651         if (b.sin6_scope_id == 0)
4652                 if (sa6_recoverscope(&b)) {
4653                         /* can't get scope, so can't match */
4654                         return (0);
4655                 }
4656         if (a.sin6_scope_id != b.sin6_scope_id)
4657                 return (0);
4658
4659         return (1);
4660 }
4661
4662 /*
4663  * returns a sockaddr_in6 with embedded scope recovered and removed
4664  */
4665 struct sockaddr_in6 *
4666 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store)
4667 {
4668         /* check and strip embedded scope junk */
4669         if (addr->sin6_family == AF_INET6) {
4670                 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) {
4671                         if (addr->sin6_scope_id == 0) {
4672                                 *store = *addr;
4673                                 if (!sa6_recoverscope(store)) {
4674                                         /* use the recovered scope */
4675                                         addr = store;
4676                                 }
4677                         } else {
4678                                 /* else, return the original "to" addr */
4679                                 in6_clearscope(&addr->sin6_addr);
4680                         }
4681                 }
4682         }
4683         return (addr);
4684 }
4685 #endif
4686
4687 /*
4688  * are the two addresses the same?  currently a "scopeless" check returns: 1
4689  * if same, 0 if not
4690  */
4691 int
4692 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2)
4693 {
4694
4695         /* must be valid */
4696         if (sa1 == NULL || sa2 == NULL)
4697                 return (0);
4698
4699         /* must be the same family */
4700         if (sa1->sa_family != sa2->sa_family)
4701                 return (0);
4702
4703         switch (sa1->sa_family) {
4704 #ifdef INET6
4705         case AF_INET6:
4706                 {
4707                         /* IPv6 addresses */
4708                         struct sockaddr_in6 *sin6_1, *sin6_2;
4709
4710                         sin6_1 = (struct sockaddr_in6 *)sa1;
4711                         sin6_2 = (struct sockaddr_in6 *)sa2;
4712                         return (SCTP6_ARE_ADDR_EQUAL(sin6_1,
4713                             sin6_2));
4714                 }
4715 #endif
4716 #ifdef INET
4717         case AF_INET:
4718                 {
4719                         /* IPv4 addresses */
4720                         struct sockaddr_in *sin_1, *sin_2;
4721
4722                         sin_1 = (struct sockaddr_in *)sa1;
4723                         sin_2 = (struct sockaddr_in *)sa2;
4724                         return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr);
4725                 }
4726 #endif
4727         default:
4728                 /* we don't do these... */
4729                 return (0);
4730         }
4731 }
4732
4733 void
4734 sctp_print_address(struct sockaddr *sa)
4735 {
4736 #ifdef INET6
4737         char ip6buf[INET6_ADDRSTRLEN];
4738 #endif
4739
4740         switch (sa->sa_family) {
4741 #ifdef INET6
4742         case AF_INET6:
4743                 {
4744                         struct sockaddr_in6 *sin6;
4745
4746                         sin6 = (struct sockaddr_in6 *)sa;
4747                         SCTP_PRINTF("IPv6 address: %s:port:%d scope:%u\n",
4748                             ip6_sprintf(ip6buf, &sin6->sin6_addr),
4749                             ntohs(sin6->sin6_port),
4750                             sin6->sin6_scope_id);
4751                         break;
4752                 }
4753 #endif
4754 #ifdef INET
4755         case AF_INET:
4756                 {
4757                         struct sockaddr_in *sin;
4758                         unsigned char *p;
4759
4760                         sin = (struct sockaddr_in *)sa;
4761                         p = (unsigned char *)&sin->sin_addr;
4762                         SCTP_PRINTF("IPv4 address: %u.%u.%u.%u:%d\n",
4763                             p[0], p[1], p[2], p[3], ntohs(sin->sin_port));
4764                         break;
4765                 }
4766 #endif
4767         default:
4768                 SCTP_PRINTF("?\n");
4769                 break;
4770         }
4771 }
4772
4773 void
4774 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
4775     struct sctp_inpcb *new_inp,
4776     struct sctp_tcb *stcb,
4777     int waitflags)
4778 {
4779         /*
4780          * go through our old INP and pull off any control structures that
4781          * belong to stcb and move then to the new inp.
4782          */
4783         struct socket *old_so, *new_so;
4784         struct sctp_queued_to_read *control, *nctl;
4785         struct sctp_readhead tmp_queue;
4786         struct mbuf *m;
4787         int error = 0;
4788
4789         old_so = old_inp->sctp_socket;
4790         new_so = new_inp->sctp_socket;
4791         TAILQ_INIT(&tmp_queue);
4792         error = SOCK_IO_RECV_LOCK(old_so, waitflags);
4793         if (error) {
4794                 /*
4795                  * Gak, can't get I/O lock, we have a problem. data will be
4796                  * left stranded.. and we don't dare look at it since the
4797                  * other thread may be reading something. Oh well, its a
4798                  * screwed up app that does a peeloff OR a accept while
4799                  * reading from the main socket... actually its only the
4800                  * peeloff() case, since I think read will fail on a
4801                  * listening socket..
4802                  */
4803                 return;
4804         }
4805         /* lock the socket buffers */
4806         SCTP_INP_READ_LOCK(old_inp);
4807         TAILQ_FOREACH_SAFE(control, &old_inp->read_queue, next, nctl) {
4808                 /* Pull off all for out target stcb */
4809                 if (control->stcb == stcb) {
4810                         /* remove it we want it */
4811                         TAILQ_REMOVE(&old_inp->read_queue, control, next);
4812                         TAILQ_INSERT_TAIL(&tmp_queue, control, next);
4813                         m = control->data;
4814                         while (m) {
4815                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4816                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
4817                                 }
4818                                 sctp_sbfree(control, stcb, &old_so->so_rcv, m);
4819                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4820                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4821                                 }
4822                                 m = SCTP_BUF_NEXT(m);
4823                         }
4824                 }
4825         }
4826         SCTP_INP_READ_UNLOCK(old_inp);
4827         /* Remove the recv-lock on the old socket */
4828         SOCK_IO_RECV_UNLOCK(old_so);
4829         /* Now we move them over to the new socket buffer */
4830         SCTP_INP_READ_LOCK(new_inp);
4831         TAILQ_FOREACH_SAFE(control, &tmp_queue, next, nctl) {
4832                 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next);
4833                 m = control->data;
4834                 while (m) {
4835                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4836                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4837                         }
4838                         sctp_sballoc(stcb, &new_so->so_rcv, m);
4839                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4840                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4841                         }
4842                         m = SCTP_BUF_NEXT(m);
4843                 }
4844         }
4845         SCTP_INP_READ_UNLOCK(new_inp);
4846 }
4847
4848 void
4849 sctp_wakeup_the_read_socket(struct sctp_inpcb *inp,
4850     struct sctp_tcb *stcb,
4851     int so_locked
4852     SCTP_UNUSED
4853 )
4854 {
4855         if ((inp != NULL) &&
4856             (inp->sctp_socket != NULL) &&
4857             (((inp->sctp_flags & (SCTP_PCB_FLAGS_TCPTYPE | SCTP_PCB_FLAGS_IN_TCPPOOL)) == 0) ||
4858             !SCTP_IS_LISTENING(inp))) {
4859                 sctp_sorwakeup(inp, inp->sctp_socket);
4860         }
4861 }
4862
4863 void
4864 sctp_add_to_readq(struct sctp_inpcb *inp,
4865     struct sctp_tcb *stcb,
4866     struct sctp_queued_to_read *control,
4867     struct sockbuf *sb,
4868     int end,
4869     int inp_read_lock_held,
4870     int so_locked)
4871 {
4872         /*
4873          * Here we must place the control on the end of the socket read
4874          * queue AND increment sb_cc so that select will work properly on
4875          * read.
4876          */
4877         struct mbuf *m, *prev = NULL;
4878
4879         if (inp == NULL) {
4880                 /* Gak, TSNH!! */
4881 #ifdef INVARIANTS
4882                 panic("Gak, inp NULL on add_to_readq");
4883 #endif
4884                 return;
4885         }
4886         if (inp_read_lock_held == SCTP_READ_LOCK_NOT_HELD) {
4887                 SCTP_INP_READ_LOCK(inp);
4888         }
4889         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
4890                 if (!control->on_strm_q) {
4891                         sctp_free_remote_addr(control->whoFrom);
4892                         if (control->data) {
4893                                 sctp_m_freem(control->data);
4894                                 control->data = NULL;
4895                         }
4896                         sctp_free_a_readq(stcb, control);
4897                 }
4898                 if (inp_read_lock_held == SCTP_READ_LOCK_NOT_HELD) {
4899                         SCTP_INP_READ_UNLOCK(inp);
4900                 }
4901                 return;
4902         }
4903         if ((control->spec_flags & M_NOTIFICATION) == 0) {
4904                 atomic_add_int(&inp->total_recvs, 1);
4905                 if (!control->do_not_ref_stcb) {
4906                         atomic_add_int(&stcb->total_recvs, 1);
4907                 }
4908         }
4909         m = control->data;
4910         control->held_length = 0;
4911         control->length = 0;
4912         while (m != NULL) {
4913                 if (SCTP_BUF_LEN(m) == 0) {
4914                         /* Skip mbufs with NO length */
4915                         if (prev == NULL) {
4916                                 /* First one */
4917                                 control->data = sctp_m_free(m);
4918                                 m = control->data;
4919                         } else {
4920                                 SCTP_BUF_NEXT(prev) = sctp_m_free(m);
4921                                 m = SCTP_BUF_NEXT(prev);
4922                         }
4923                         if (m == NULL) {
4924                                 control->tail_mbuf = prev;
4925                         }
4926                         continue;
4927                 }
4928                 prev = m;
4929                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4930                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4931                 }
4932                 sctp_sballoc(stcb, sb, m);
4933                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4934                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4935                 }
4936                 atomic_add_int(&control->length, SCTP_BUF_LEN(m));
4937                 m = SCTP_BUF_NEXT(m);
4938         }
4939         if (prev != NULL) {
4940                 control->tail_mbuf = prev;
4941         } else {
4942                 /* Everything got collapsed out?? */
4943                 if (!control->on_strm_q) {
4944                         sctp_free_remote_addr(control->whoFrom);
4945                         sctp_free_a_readq(stcb, control);
4946                 }
4947                 if (inp_read_lock_held == 0)
4948                         SCTP_INP_READ_UNLOCK(inp);
4949                 return;
4950         }
4951         if (end) {
4952                 control->end_added = 1;
4953         }
4954         TAILQ_INSERT_TAIL(&inp->read_queue, control, next);
4955         control->on_read_q = 1;
4956         if ((inp != NULL) && (inp->sctp_socket != NULL)) {
4957                 sctp_wakeup_the_read_socket(inp, stcb, so_locked);
4958         }
4959         if (inp_read_lock_held == SCTP_READ_LOCK_NOT_HELD) {
4960                 SCTP_INP_READ_UNLOCK(inp);
4961         }
4962 }
4963
4964 /*************HOLD THIS COMMENT FOR PATCH FILE OF
4965  *************ALTERNATE ROUTING CODE
4966  */
4967
4968 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF
4969  *************ALTERNATE ROUTING CODE
4970  */
4971
4972 struct mbuf *
4973 sctp_generate_cause(uint16_t code, char *info)
4974 {
4975         struct mbuf *m;
4976         struct sctp_gen_error_cause *cause;
4977         size_t info_len;
4978         uint16_t len;
4979
4980         if ((code == 0) || (info == NULL)) {
4981                 return (NULL);
4982         }
4983         info_len = strlen(info);
4984         if (info_len > (SCTP_MAX_CAUSE_LENGTH - sizeof(struct sctp_paramhdr))) {
4985                 return (NULL);
4986         }
4987         len = (uint16_t)(sizeof(struct sctp_paramhdr) + info_len);
4988         m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
4989         if (m != NULL) {
4990                 SCTP_BUF_LEN(m) = len;
4991                 cause = mtod(m, struct sctp_gen_error_cause *);
4992                 cause->code = htons(code);
4993                 cause->length = htons(len);
4994                 memcpy(cause->info, info, info_len);
4995         }
4996         return (m);
4997 }
4998
4999 struct mbuf *
5000 sctp_generate_no_user_data_cause(uint32_t tsn)
5001 {
5002         struct mbuf *m;
5003         struct sctp_error_no_user_data *no_user_data_cause;
5004         uint16_t len;
5005
5006         len = (uint16_t)sizeof(struct sctp_error_no_user_data);
5007         m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
5008         if (m != NULL) {
5009                 SCTP_BUF_LEN(m) = len;
5010                 no_user_data_cause = mtod(m, struct sctp_error_no_user_data *);
5011                 no_user_data_cause->cause.code = htons(SCTP_CAUSE_NO_USER_DATA);
5012                 no_user_data_cause->cause.length = htons(len);
5013                 no_user_data_cause->tsn = htonl(tsn);
5014         }
5015         return (m);
5016 }
5017
5018 void
5019 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc,
5020     struct sctp_tmit_chunk *tp1, int chk_cnt)
5021 {
5022         if (tp1->data == NULL) {
5023                 return;
5024         }
5025         atomic_subtract_int(&asoc->chunks_on_out_queue, chk_cnt);
5026 #ifdef SCTP_MBCNT_LOGGING
5027         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBCNT_LOGGING_ENABLE) {
5028                 sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE,
5029                     asoc->total_output_queue_size,
5030                     tp1->book_size,
5031                     0,
5032                     tp1->mbcnt);
5033         }
5034 #endif
5035         if (asoc->total_output_queue_size >= tp1->book_size) {
5036                 atomic_subtract_int(&asoc->total_output_queue_size, tp1->book_size);
5037         } else {
5038                 asoc->total_output_queue_size = 0;
5039         }
5040         if ((stcb->sctp_socket != NULL) &&
5041             (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) ||
5042             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) {
5043                 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) {
5044                         atomic_subtract_int(&((stcb)->sctp_socket->so_snd.sb_cc), tp1->book_size);
5045                 } else {
5046                         stcb->sctp_socket->so_snd.sb_cc = 0;
5047                 }
5048         }
5049 }
5050
5051 int
5052 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1,
5053     uint8_t sent, int so_locked)
5054 {
5055         struct sctp_stream_out *strq;
5056         struct sctp_tmit_chunk *chk = NULL, *tp2;
5057         struct sctp_stream_queue_pending *sp;
5058         uint32_t mid;
5059         uint16_t sid;
5060         uint8_t foundeom = 0;
5061         int ret_sz = 0;
5062         int notdone;
5063         int do_wakeup_routine = 0;
5064
5065         SCTP_TCB_LOCK_ASSERT(stcb);
5066
5067         sid = tp1->rec.data.sid;
5068         mid = tp1->rec.data.mid;
5069         if (sent || ((tp1->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG) == 0)) {
5070                 stcb->asoc.abandoned_sent[0]++;
5071                 stcb->asoc.abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
5072                 stcb->asoc.strmout[sid].abandoned_sent[0]++;
5073 #if defined(SCTP_DETAILED_STR_STATS)
5074                 stcb->asoc.strmout[sid].abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
5075 #endif
5076         } else {
5077                 stcb->asoc.abandoned_unsent[0]++;
5078                 stcb->asoc.abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
5079                 stcb->asoc.strmout[sid].abandoned_unsent[0]++;
5080 #if defined(SCTP_DETAILED_STR_STATS)
5081                 stcb->asoc.strmout[sid].abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
5082 #endif
5083         }
5084         do {
5085                 ret_sz += tp1->book_size;
5086                 if (tp1->data != NULL) {
5087                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
5088                                 sctp_flight_size_decrease(tp1);
5089                                 sctp_total_flight_decrease(stcb, tp1);
5090                         }
5091                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
5092                         stcb->asoc.peers_rwnd += tp1->send_size;
5093                         stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh);
5094                         if (sent) {
5095                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
5096                         } else {
5097                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
5098                         }
5099                         if (tp1->data) {
5100                                 sctp_m_freem(tp1->data);
5101                                 tp1->data = NULL;
5102                         }
5103                         do_wakeup_routine = 1;
5104                         if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
5105                                 stcb->asoc.sent_queue_cnt_removeable--;
5106                         }
5107                 }
5108                 tp1->sent = SCTP_FORWARD_TSN_SKIP;
5109                 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
5110                     SCTP_DATA_NOT_FRAG) {
5111                         /* not frag'ed we ae done   */
5112                         notdone = 0;
5113                         foundeom = 1;
5114                 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
5115                         /* end of frag, we are done */
5116                         notdone = 0;
5117                         foundeom = 1;
5118                 } else {
5119                         /*
5120                          * Its a begin or middle piece, we must mark all of
5121                          * it
5122                          */
5123                         notdone = 1;
5124                         tp1 = TAILQ_NEXT(tp1, sctp_next);
5125                 }
5126         } while (tp1 && notdone);
5127         if (foundeom == 0) {
5128                 /*
5129                  * The multi-part message was scattered across the send and
5130                  * sent queue.
5131                  */
5132                 TAILQ_FOREACH_SAFE(tp1, &stcb->asoc.send_queue, sctp_next, tp2) {
5133                         if ((tp1->rec.data.sid != sid) ||
5134                             (!SCTP_MID_EQ(stcb->asoc.idata_supported, tp1->rec.data.mid, mid))) {
5135                                 break;
5136                         }
5137                         /*
5138                          * save to chk in case we have some on stream out
5139                          * queue. If so and we have an un-transmitted one we
5140                          * don't have to fudge the TSN.
5141                          */
5142                         chk = tp1;
5143                         ret_sz += tp1->book_size;
5144                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
5145                         if (sent) {
5146                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
5147                         } else {
5148                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
5149                         }
5150                         if (tp1->data) {
5151                                 sctp_m_freem(tp1->data);
5152                                 tp1->data = NULL;
5153                         }
5154                         /* No flight involved here book the size to 0 */
5155                         tp1->book_size = 0;
5156                         if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
5157                                 foundeom = 1;
5158                         }
5159                         do_wakeup_routine = 1;
5160                         tp1->sent = SCTP_FORWARD_TSN_SKIP;
5161                         TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next);
5162                         /*
5163                          * on to the sent queue so we can wait for it to be
5164                          * passed by.
5165                          */
5166                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1,
5167                             sctp_next);
5168                         stcb->asoc.send_queue_cnt--;
5169                         stcb->asoc.sent_queue_cnt++;
5170                 }
5171         }
5172         if (foundeom == 0) {
5173                 /*
5174                  * Still no eom found. That means there is stuff left on the
5175                  * stream out queue.. yuck.
5176                  */
5177                 strq = &stcb->asoc.strmout[sid];
5178                 sp = TAILQ_FIRST(&strq->outqueue);
5179                 if (sp != NULL) {
5180                         sp->discard_rest = 1;
5181                         /*
5182                          * We may need to put a chunk on the queue that
5183                          * holds the TSN that would have been sent with the
5184                          * LAST bit.
5185                          */
5186                         if (chk == NULL) {
5187                                 /* Yep, we have to */
5188                                 sctp_alloc_a_chunk(stcb, chk);
5189                                 if (chk == NULL) {
5190                                         /*
5191                                          * we are hosed. All we can do is
5192                                          * nothing.. which will cause an
5193                                          * abort if the peer is paying
5194                                          * attention.
5195                                          */
5196                                         goto oh_well;
5197                                 }
5198                                 memset(chk, 0, sizeof(*chk));
5199                                 chk->rec.data.rcv_flags = 0;
5200                                 chk->sent = SCTP_FORWARD_TSN_SKIP;
5201                                 chk->asoc = &stcb->asoc;
5202                                 if (stcb->asoc.idata_supported == 0) {
5203                                         if (sp->sinfo_flags & SCTP_UNORDERED) {
5204                                                 chk->rec.data.mid = 0;
5205                                         } else {
5206                                                 chk->rec.data.mid = strq->next_mid_ordered;
5207                                         }
5208                                 } else {
5209                                         if (sp->sinfo_flags & SCTP_UNORDERED) {
5210                                                 chk->rec.data.mid = strq->next_mid_unordered;
5211                                         } else {
5212                                                 chk->rec.data.mid = strq->next_mid_ordered;
5213                                         }
5214                                 }
5215                                 chk->rec.data.sid = sp->sid;
5216                                 chk->rec.data.ppid = sp->ppid;
5217                                 chk->rec.data.context = sp->context;
5218                                 chk->flags = sp->act_flags;
5219                                 chk->whoTo = NULL;
5220                                 chk->rec.data.tsn = atomic_fetchadd_int(&stcb->asoc.sending_seq, 1);
5221                                 strq->chunks_on_queues++;
5222                                 TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, chk, sctp_next);
5223                                 stcb->asoc.sent_queue_cnt++;
5224                                 stcb->asoc.pr_sctp_cnt++;
5225                         }
5226                         chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
5227                         if (sp->sinfo_flags & SCTP_UNORDERED) {
5228                                 chk->rec.data.rcv_flags |= SCTP_DATA_UNORDERED;
5229                         }
5230                         if (stcb->asoc.idata_supported == 0) {
5231                                 if ((sp->sinfo_flags & SCTP_UNORDERED) == 0) {
5232                                         strq->next_mid_ordered++;
5233                                 }
5234                         } else {
5235                                 if (sp->sinfo_flags & SCTP_UNORDERED) {
5236                                         strq->next_mid_unordered++;
5237                                 } else {
5238                                         strq->next_mid_ordered++;
5239                                 }
5240                         }
5241         oh_well:
5242                         if (sp->data) {
5243                                 /*
5244                                  * Pull any data to free up the SB and allow
5245                                  * sender to "add more" while we will throw
5246                                  * away :-)
5247                                  */
5248                                 sctp_free_spbufspace(stcb, &stcb->asoc, sp);
5249                                 ret_sz += sp->length;
5250                                 do_wakeup_routine = 1;
5251                                 sp->some_taken = 1;
5252                                 sctp_m_freem(sp->data);
5253                                 sp->data = NULL;
5254                                 sp->tail_mbuf = NULL;
5255                                 sp->length = 0;
5256                         }
5257                 }
5258         }
5259         if (do_wakeup_routine) {
5260                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
5261         }
5262         return (ret_sz);
5263 }
5264
5265 /*
5266  * checks to see if the given address, sa, is one that is currently known by
5267  * the kernel note: can't distinguish the same address on multiple interfaces
5268  * and doesn't handle multiple addresses with different zone/scope id's note:
5269  * ifa_ifwithaddr() compares the entire sockaddr struct
5270  */
5271 struct sctp_ifa *
5272 sctp_find_ifa_in_ep(struct sctp_inpcb *inp, struct sockaddr *addr,
5273     int holds_lock)
5274 {
5275         struct sctp_laddr *laddr;
5276
5277         if (holds_lock == 0) {
5278                 SCTP_INP_RLOCK(inp);
5279         }
5280
5281         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
5282                 if (laddr->ifa == NULL)
5283                         continue;
5284                 if (addr->sa_family != laddr->ifa->address.sa.sa_family)
5285                         continue;
5286 #ifdef INET
5287                 if (addr->sa_family == AF_INET) {
5288                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
5289                             laddr->ifa->address.sin.sin_addr.s_addr) {
5290                                 /* found him. */
5291                                 break;
5292                         }
5293                 }
5294 #endif
5295 #ifdef INET6
5296                 if (addr->sa_family == AF_INET6) {
5297                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5298                             &laddr->ifa->address.sin6)) {
5299                                 /* found him. */
5300                                 break;
5301                         }
5302                 }
5303 #endif
5304         }
5305         if (holds_lock == 0) {
5306                 SCTP_INP_RUNLOCK(inp);
5307         }
5308         if (laddr != NULL) {
5309                 return (laddr->ifa);
5310         } else {
5311                 return (NULL);
5312         }
5313 }
5314
5315 uint32_t
5316 sctp_get_ifa_hash_val(struct sockaddr *addr)
5317 {
5318         switch (addr->sa_family) {
5319 #ifdef INET
5320         case AF_INET:
5321                 {
5322                         struct sockaddr_in *sin;
5323
5324                         sin = (struct sockaddr_in *)addr;
5325                         return (sin->sin_addr.s_addr ^ (sin->sin_addr.s_addr >> 16));
5326                 }
5327 #endif
5328 #ifdef INET6
5329         case AF_INET6:
5330                 {
5331                         struct sockaddr_in6 *sin6;
5332                         uint32_t hash_of_addr;
5333
5334                         sin6 = (struct sockaddr_in6 *)addr;
5335                         hash_of_addr = (sin6->sin6_addr.s6_addr32[0] +
5336                             sin6->sin6_addr.s6_addr32[1] +
5337                             sin6->sin6_addr.s6_addr32[2] +
5338                             sin6->sin6_addr.s6_addr32[3]);
5339                         hash_of_addr = (hash_of_addr ^ (hash_of_addr >> 16));
5340                         return (hash_of_addr);
5341                 }
5342 #endif
5343         default:
5344                 break;
5345         }
5346         return (0);
5347 }
5348
5349 struct sctp_ifa *
5350 sctp_find_ifa_by_addr(struct sockaddr *addr, uint32_t vrf_id, int holds_lock)
5351 {
5352         struct sctp_ifa *sctp_ifap;
5353         struct sctp_vrf *vrf;
5354         struct sctp_ifalist *hash_head;
5355         uint32_t hash_of_addr;
5356
5357         if (holds_lock == 0) {
5358                 SCTP_IPI_ADDR_RLOCK();
5359         } else {
5360                 SCTP_IPI_ADDR_LOCK_ASSERT();
5361         }
5362
5363         vrf = sctp_find_vrf(vrf_id);
5364         if (vrf == NULL) {
5365                 if (holds_lock == 0)
5366                         SCTP_IPI_ADDR_RUNLOCK();
5367                 return (NULL);
5368         }
5369
5370         hash_of_addr = sctp_get_ifa_hash_val(addr);
5371
5372         hash_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)];
5373         if (hash_head == NULL) {
5374                 SCTP_PRINTF("hash_of_addr:%x mask:%x table:%x - ",
5375                     hash_of_addr, (uint32_t)vrf->vrf_addr_hashmark,
5376                     (uint32_t)(hash_of_addr & vrf->vrf_addr_hashmark));
5377                 sctp_print_address(addr);
5378                 SCTP_PRINTF("No such bucket for address\n");
5379                 if (holds_lock == 0)
5380                         SCTP_IPI_ADDR_RUNLOCK();
5381
5382                 return (NULL);
5383         }
5384         LIST_FOREACH(sctp_ifap, hash_head, next_bucket) {
5385                 if (addr->sa_family != sctp_ifap->address.sa.sa_family)
5386                         continue;
5387 #ifdef INET
5388                 if (addr->sa_family == AF_INET) {
5389                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
5390                             sctp_ifap->address.sin.sin_addr.s_addr) {
5391                                 /* found him. */
5392                                 break;
5393                         }
5394                 }
5395 #endif
5396 #ifdef INET6
5397                 if (addr->sa_family == AF_INET6) {
5398                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5399                             &sctp_ifap->address.sin6)) {
5400                                 /* found him. */
5401                                 break;
5402                         }
5403                 }
5404 #endif
5405         }
5406         if (holds_lock == 0)
5407                 SCTP_IPI_ADDR_RUNLOCK();
5408         return (sctp_ifap);
5409 }
5410
5411 static void
5412 sctp_user_rcvd(struct sctp_tcb *stcb, uint32_t *freed_so_far, int hold_rlock,
5413     uint32_t rwnd_req)
5414 {
5415         /* User pulled some data, do we need a rwnd update? */
5416         struct epoch_tracker et;
5417         int r_unlocked = 0;
5418         uint32_t dif, rwnd;
5419         struct socket *so = NULL;
5420
5421         if (stcb == NULL)
5422                 return;
5423
5424         atomic_add_int(&stcb->asoc.refcnt, 1);
5425
5426         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
5427             (stcb->asoc.state & (SCTP_STATE_ABOUT_TO_BE_FREED | SCTP_STATE_SHUTDOWN_RECEIVED))) {
5428                 /* Pre-check If we are freeing no update */
5429                 goto no_lock;
5430         }
5431         SCTP_INP_INCR_REF(stcb->sctp_ep);
5432         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5433             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5434                 goto out;
5435         }
5436         so = stcb->sctp_socket;
5437         if (so == NULL) {
5438                 goto out;
5439         }
5440         atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far);
5441         /* Have you have freed enough to look */
5442         *freed_so_far = 0;
5443         /* Yep, its worth a look and the lock overhead */
5444
5445         /* Figure out what the rwnd would be */
5446         rwnd = sctp_calc_rwnd(stcb, &stcb->asoc);
5447         if (rwnd >= stcb->asoc.my_last_reported_rwnd) {
5448                 dif = rwnd - stcb->asoc.my_last_reported_rwnd;
5449         } else {
5450                 dif = 0;
5451         }
5452         if (dif >= rwnd_req) {
5453                 if (hold_rlock) {
5454                         SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5455                         r_unlocked = 1;
5456                 }
5457                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5458                         /*
5459                          * One last check before we allow the guy possibly
5460                          * to get in. There is a race, where the guy has not
5461                          * reached the gate. In that case
5462                          */
5463                         goto out;
5464                 }
5465                 SCTP_TCB_LOCK(stcb);
5466                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5467                         /* No reports here */
5468                         SCTP_TCB_UNLOCK(stcb);
5469                         goto out;
5470                 }
5471                 SCTP_STAT_INCR(sctps_wu_sacks_sent);
5472                 NET_EPOCH_ENTER(et);
5473                 sctp_send_sack(stcb, SCTP_SO_LOCKED);
5474
5475                 sctp_chunk_output(stcb->sctp_ep, stcb,
5476                     SCTP_OUTPUT_FROM_USR_RCVD, SCTP_SO_LOCKED);
5477                 /* make sure no timer is running */
5478                 NET_EPOCH_EXIT(et);
5479                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL,
5480                     SCTP_FROM_SCTPUTIL + SCTP_LOC_6);
5481                 SCTP_TCB_UNLOCK(stcb);
5482         } else {
5483                 /* Update how much we have pending */
5484                 stcb->freed_by_sorcv_sincelast = dif;
5485         }
5486 out:
5487         if (so && r_unlocked && hold_rlock) {
5488                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
5489         }
5490
5491         SCTP_INP_DECR_REF(stcb->sctp_ep);
5492 no_lock:
5493         atomic_subtract_int(&stcb->asoc.refcnt, 1);
5494         return;
5495 }
5496
5497 int
5498 sctp_sorecvmsg(struct socket *so,
5499     struct uio *uio,
5500     struct mbuf **mp,
5501     struct sockaddr *from,
5502     int fromlen,
5503     int *msg_flags,
5504     struct sctp_sndrcvinfo *sinfo,
5505     int filling_sinfo)
5506 {
5507         /*
5508          * MSG flags we will look at MSG_DONTWAIT - non-blocking IO.
5509          * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy
5510          * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ??
5511          * On the way out we may send out any combination of:
5512          * MSG_NOTIFICATION MSG_EOR
5513          *
5514          */
5515         struct sctp_inpcb *inp = NULL;
5516         ssize_t my_len = 0;
5517         ssize_t cp_len = 0;
5518         int error = 0;
5519         struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
5520         struct mbuf *m = NULL;
5521         struct sctp_tcb *stcb = NULL;
5522         int wakeup_read_socket = 0;
5523         int freecnt_applied = 0;
5524         int out_flags = 0, in_flags = 0;
5525         int block_allowed = 1;
5526         uint32_t freed_so_far = 0;
5527         ssize_t copied_so_far = 0;
5528         int in_eeor_mode = 0;
5529         int no_rcv_needed = 0;
5530         uint32_t rwnd_req = 0;
5531         int hold_sblock = 0;
5532         int hold_rlock = 0;
5533         ssize_t slen = 0;
5534         uint32_t held_length = 0;
5535         int sockbuf_lock = 0;
5536
5537         if (uio == NULL) {
5538                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5539                 return (EINVAL);
5540         }
5541
5542         if (msg_flags) {
5543                 in_flags = *msg_flags;
5544                 if (in_flags & MSG_PEEK)
5545                         SCTP_STAT_INCR(sctps_read_peeks);
5546         } else {
5547                 in_flags = 0;
5548         }
5549         slen = uio->uio_resid;
5550
5551         /* Pull in and set up our int flags */
5552         if (in_flags & MSG_OOB) {
5553                 /* Out of band's NOT supported */
5554                 return (EOPNOTSUPP);
5555         }
5556         if ((in_flags & MSG_PEEK) && (mp != NULL)) {
5557                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5558                 return (EINVAL);
5559         }
5560         if ((in_flags & (MSG_DONTWAIT
5561             | MSG_NBIO
5562             )) ||
5563             SCTP_SO_IS_NBIO(so)) {
5564                 block_allowed = 0;
5565         }
5566         /* setup the endpoint */
5567         inp = (struct sctp_inpcb *)so->so_pcb;
5568         if (inp == NULL) {
5569                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
5570                 return (EFAULT);
5571         }
5572         rwnd_req = (SCTP_SB_LIMIT_RCV(so) >> SCTP_RWND_HIWAT_SHIFT);
5573         /* Must be at least a MTU's worth */
5574         if (rwnd_req < SCTP_MIN_RWND)
5575                 rwnd_req = SCTP_MIN_RWND;
5576         in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
5577         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5578                 sctp_misc_ints(SCTP_SORECV_ENTER,
5579                     rwnd_req, in_eeor_mode, SCTP_SBAVAIL(&so->so_rcv), (uint32_t)uio->uio_resid);
5580         }
5581         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5582                 sctp_misc_ints(SCTP_SORECV_ENTERPL,
5583                     rwnd_req, block_allowed, SCTP_SBAVAIL(&so->so_rcv), (uint32_t)uio->uio_resid);
5584         }
5585
5586         error = SOCK_IO_RECV_LOCK(so, SBLOCKWAIT(in_flags));
5587         if (error) {
5588                 goto release_unlocked;
5589         }
5590         sockbuf_lock = 1;
5591 restart:
5592
5593 restart_nosblocks:
5594         if (hold_sblock == 0) {
5595                 SOCKBUF_LOCK(&so->so_rcv);
5596                 hold_sblock = 1;
5597         }
5598         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5599             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5600                 goto out;
5601         }
5602         if ((so->so_rcv.sb_state & SBS_CANTRCVMORE) && SCTP_SBAVAIL(&so->so_rcv) == 0) {
5603                 if (so->so_error) {
5604                         error = so->so_error;
5605                         if ((in_flags & MSG_PEEK) == 0)
5606                                 so->so_error = 0;
5607                         goto out;
5608                 } else {
5609                         if (SCTP_SBAVAIL(&so->so_rcv) == 0) {
5610                                 /* indicate EOF */
5611                                 error = 0;
5612                                 goto out;
5613                         }
5614                 }
5615         }
5616         if (SCTP_SBAVAIL(&so->so_rcv) <= held_length) {
5617                 if (so->so_error) {
5618                         error = so->so_error;
5619                         if ((in_flags & MSG_PEEK) == 0) {
5620                                 so->so_error = 0;
5621                         }
5622                         goto out;
5623                 }
5624                 if ((SCTP_SBAVAIL(&so->so_rcv) == 0) &&
5625                     ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5626                     (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) {
5627                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5628                                 /*
5629                                  * For active open side clear flags for
5630                                  * re-use passive open is blocked by
5631                                  * connect.
5632                                  */
5633                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5634                                         /*
5635                                          * You were aborted, passive side
5636                                          * always hits here
5637                                          */
5638                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5639                                         error = ECONNRESET;
5640                                 }
5641                                 so->so_state &= ~(SS_ISCONNECTING |
5642                                     SS_ISDISCONNECTING |
5643                                     SS_ISCONFIRMING |
5644                                     SS_ISCONNECTED);
5645                                 if (error == 0) {
5646                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5647                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5648                                                 error = ENOTCONN;
5649                                         }
5650                                 }
5651                                 goto out;
5652                         }
5653                 }
5654                 if (block_allowed) {
5655                         error = sbwait(&so->so_rcv);
5656                         if (error) {
5657                                 goto out;
5658                         }
5659                         held_length = 0;
5660                         goto restart_nosblocks;
5661                 } else {
5662                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EWOULDBLOCK);
5663                         error = EWOULDBLOCK;
5664                         goto out;
5665                 }
5666         }
5667         if (hold_sblock == 1) {
5668                 SOCKBUF_UNLOCK(&so->so_rcv);
5669                 hold_sblock = 0;
5670         }
5671         /* we possibly have data we can read */
5672         /* sa_ignore FREED_MEMORY */
5673         control = TAILQ_FIRST(&inp->read_queue);
5674         if (control == NULL) {
5675                 /*
5676                  * This could be happening since the appender did the
5677                  * increment but as not yet did the tailq insert onto the
5678                  * read_queue
5679                  */
5680                 if (hold_rlock == 0) {
5681                         SCTP_INP_READ_LOCK(inp);
5682                 }
5683                 control = TAILQ_FIRST(&inp->read_queue);
5684                 if ((control == NULL) && (SCTP_SBAVAIL(&so->so_rcv) > 0)) {
5685 #ifdef INVARIANTS
5686                         panic("Huh, its non zero and nothing on control?");
5687 #endif
5688                         SCTP_SB_CLEAR(so->so_rcv);
5689                 }
5690                 SCTP_INP_READ_UNLOCK(inp);
5691                 hold_rlock = 0;
5692                 goto restart;
5693         }
5694
5695         if ((control->length == 0) &&
5696             (control->do_not_ref_stcb)) {
5697                 /*
5698                  * Clean up code for freeing assoc that left behind a
5699                  * pdapi.. maybe a peer in EEOR that just closed after
5700                  * sending and never indicated a EOR.
5701                  */
5702                 if (hold_rlock == 0) {
5703                         hold_rlock = 1;
5704                         SCTP_INP_READ_LOCK(inp);
5705                 }
5706                 control->held_length = 0;
5707                 if (control->data) {
5708                         /* Hmm there is data here .. fix */
5709                         struct mbuf *m_tmp;
5710                         int cnt = 0;
5711
5712                         m_tmp = control->data;
5713                         while (m_tmp) {
5714                                 cnt += SCTP_BUF_LEN(m_tmp);
5715                                 if (SCTP_BUF_NEXT(m_tmp) == NULL) {
5716                                         control->tail_mbuf = m_tmp;
5717                                         control->end_added = 1;
5718                                 }
5719                                 m_tmp = SCTP_BUF_NEXT(m_tmp);
5720                         }
5721                         control->length = cnt;
5722                 } else {
5723                         /* remove it */
5724                         TAILQ_REMOVE(&inp->read_queue, control, next);
5725                         /* Add back any hidden data */
5726                         sctp_free_remote_addr(control->whoFrom);
5727                         sctp_free_a_readq(stcb, control);
5728                 }
5729                 if (hold_rlock) {
5730                         hold_rlock = 0;
5731                         SCTP_INP_READ_UNLOCK(inp);
5732                 }
5733                 goto restart;
5734         }
5735         if ((control->length == 0) &&
5736             (control->end_added == 1)) {
5737                 /*
5738                  * Do we also need to check for (control->pdapi_aborted ==
5739                  * 1)?
5740                  */
5741                 if (hold_rlock == 0) {
5742                         hold_rlock = 1;
5743                         SCTP_INP_READ_LOCK(inp);
5744                 }
5745                 TAILQ_REMOVE(&inp->read_queue, control, next);
5746                 if (control->data) {
5747 #ifdef INVARIANTS
5748                         panic("control->data not null but control->length == 0");
5749 #else
5750                         SCTP_PRINTF("Strange, data left in the control buffer. Cleaning up.\n");
5751                         sctp_m_freem(control->data);
5752                         control->data = NULL;
5753 #endif
5754                 }
5755                 if (control->aux_data) {
5756                         sctp_m_free(control->aux_data);
5757                         control->aux_data = NULL;
5758                 }
5759 #ifdef INVARIANTS
5760                 if (control->on_strm_q) {
5761                         panic("About to free ctl:%p so:%p and its in %d",
5762                             control, so, control->on_strm_q);
5763                 }
5764 #endif
5765                 sctp_free_remote_addr(control->whoFrom);
5766                 sctp_free_a_readq(stcb, control);
5767                 if (hold_rlock) {
5768                         hold_rlock = 0;
5769                         SCTP_INP_READ_UNLOCK(inp);
5770                 }
5771                 goto restart;
5772         }
5773         if (control->length == 0) {
5774                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) &&
5775                     (filling_sinfo)) {
5776                         /* find a more suitable one then this */
5777                         ctl = TAILQ_NEXT(control, next);
5778                         while (ctl) {
5779                                 if ((ctl->stcb != control->stcb) && (ctl->length) &&
5780                                     (ctl->some_taken ||
5781                                     (ctl->spec_flags & M_NOTIFICATION) ||
5782                                     ((ctl->do_not_ref_stcb == 0) &&
5783                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))
5784                                     ) {
5785                                         /*-
5786                                          * If we have a different TCB next, and there is data
5787                                          * present. If we have already taken some (pdapi), OR we can
5788                                          * ref the tcb and no delivery as started on this stream, we
5789                                          * take it. Note we allow a notification on a different
5790                                          * assoc to be delivered..
5791                                          */
5792                                         control = ctl;
5793                                         goto found_one;
5794                                 } else if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS)) &&
5795                                             (ctl->length) &&
5796                                             ((ctl->some_taken) ||
5797                                             ((ctl->do_not_ref_stcb == 0) &&
5798                                             ((ctl->spec_flags & M_NOTIFICATION) == 0) &&
5799                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))) {
5800                                         /*-
5801                                          * If we have the same tcb, and there is data present, and we
5802                                          * have the strm interleave feature present. Then if we have
5803                                          * taken some (pdapi) or we can refer to tht tcb AND we have
5804                                          * not started a delivery for this stream, we can take it.
5805                                          * Note we do NOT allow a notification on the same assoc to
5806                                          * be delivered.
5807                                          */
5808                                         control = ctl;
5809                                         goto found_one;
5810                                 }
5811                                 ctl = TAILQ_NEXT(ctl, next);
5812                         }
5813                 }
5814                 /*
5815                  * if we reach here, not suitable replacement is available
5816                  * <or> fragment interleave is NOT on. So stuff the sb_cc
5817                  * into the our held count, and its time to sleep again.
5818                  */
5819                 held_length = SCTP_SBAVAIL(&so->so_rcv);
5820                 control->held_length = SCTP_SBAVAIL(&so->so_rcv);
5821                 goto restart;
5822         }
5823         /* Clear the held length since there is something to read */
5824         control->held_length = 0;
5825 found_one:
5826         /*
5827          * If we reach here, control has a some data for us to read off.
5828          * Note that stcb COULD be NULL.
5829          */
5830         if (hold_rlock == 0) {
5831                 hold_rlock = 1;
5832                 SCTP_INP_READ_LOCK(inp);
5833         }
5834         control->some_taken++;
5835         stcb = control->stcb;
5836         if (stcb) {
5837                 if ((control->do_not_ref_stcb == 0) &&
5838                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5839                         if (freecnt_applied == 0)
5840                                 stcb = NULL;
5841                 } else if (control->do_not_ref_stcb == 0) {
5842                         /* you can't free it on me please */
5843                         /*
5844                          * The lock on the socket buffer protects us so the
5845                          * free code will stop. But since we used the
5846                          * socketbuf lock and the sender uses the tcb_lock
5847                          * to increment, we need to use the atomic add to
5848                          * the refcnt
5849                          */
5850                         if (freecnt_applied) {
5851 #ifdef INVARIANTS
5852                                 panic("refcnt already incremented");
5853 #else
5854                                 SCTP_PRINTF("refcnt already incremented?\n");
5855 #endif
5856                         } else {
5857                                 atomic_add_int(&stcb->asoc.refcnt, 1);
5858                                 freecnt_applied = 1;
5859                         }
5860                         /*
5861                          * Setup to remember how much we have not yet told
5862                          * the peer our rwnd has opened up. Note we grab the
5863                          * value from the tcb from last time. Note too that
5864                          * sack sending clears this when a sack is sent,
5865                          * which is fine. Once we hit the rwnd_req, we then
5866                          * will go to the sctp_user_rcvd() that will not
5867                          * lock until it KNOWs it MUST send a WUP-SACK.
5868                          */
5869                         freed_so_far = (uint32_t)stcb->freed_by_sorcv_sincelast;
5870                         stcb->freed_by_sorcv_sincelast = 0;
5871                 }
5872         }
5873         if (stcb &&
5874             ((control->spec_flags & M_NOTIFICATION) == 0) &&
5875             control->do_not_ref_stcb == 0) {
5876                 stcb->asoc.strmin[control->sinfo_stream].delivery_started = 1;
5877         }
5878
5879         /* First lets get off the sinfo and sockaddr info */
5880         if ((sinfo != NULL) && (filling_sinfo != 0)) {
5881                 sinfo->sinfo_stream = control->sinfo_stream;
5882                 sinfo->sinfo_ssn = (uint16_t)control->mid;
5883                 sinfo->sinfo_flags = control->sinfo_flags;
5884                 sinfo->sinfo_ppid = control->sinfo_ppid;
5885                 sinfo->sinfo_context = control->sinfo_context;
5886                 sinfo->sinfo_timetolive = control->sinfo_timetolive;
5887                 sinfo->sinfo_tsn = control->sinfo_tsn;
5888                 sinfo->sinfo_cumtsn = control->sinfo_cumtsn;
5889                 sinfo->sinfo_assoc_id = control->sinfo_assoc_id;
5890                 nxt = TAILQ_NEXT(control, next);
5891                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
5892                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) {
5893                         struct sctp_extrcvinfo *s_extra;
5894
5895                         s_extra = (struct sctp_extrcvinfo *)sinfo;
5896                         if ((nxt) &&
5897                             (nxt->length)) {
5898                                 s_extra->serinfo_next_flags = SCTP_NEXT_MSG_AVAIL;
5899                                 if (nxt->sinfo_flags & SCTP_UNORDERED) {
5900                                         s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_UNORDERED;
5901                                 }
5902                                 if (nxt->spec_flags & M_NOTIFICATION) {
5903                                         s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_NOTIFICATION;
5904                                 }
5905                                 s_extra->serinfo_next_aid = nxt->sinfo_assoc_id;
5906                                 s_extra->serinfo_next_length = nxt->length;
5907                                 s_extra->serinfo_next_ppid = nxt->sinfo_ppid;
5908                                 s_extra->serinfo_next_stream = nxt->sinfo_stream;
5909                                 if (nxt->tail_mbuf != NULL) {
5910                                         if (nxt->end_added) {
5911                                                 s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_ISCOMPLETE;
5912                                         }
5913                                 }
5914                         } else {
5915                                 /*
5916                                  * we explicitly 0 this, since the memcpy
5917                                  * got some other things beyond the older
5918                                  * sinfo_ that is on the control's structure
5919                                  * :-D
5920                                  */
5921                                 nxt = NULL;
5922                                 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG;
5923                                 s_extra->serinfo_next_aid = 0;
5924                                 s_extra->serinfo_next_length = 0;
5925                                 s_extra->serinfo_next_ppid = 0;
5926                                 s_extra->serinfo_next_stream = 0;
5927                         }
5928                 }
5929                 /*
5930                  * update off the real current cum-ack, if we have an stcb.
5931                  */
5932                 if ((control->do_not_ref_stcb == 0) && stcb)
5933                         sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
5934                 /*
5935                  * mask off the high bits, we keep the actual chunk bits in
5936                  * there.
5937                  */
5938                 sinfo->sinfo_flags &= 0x00ff;
5939                 if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) {
5940                         sinfo->sinfo_flags |= SCTP_UNORDERED;
5941                 }
5942         }
5943 #ifdef SCTP_ASOCLOG_OF_TSNS
5944         {
5945                 int index, newindex;
5946                 struct sctp_pcbtsn_rlog *entry;
5947
5948                 do {
5949                         index = inp->readlog_index;
5950                         newindex = index + 1;
5951                         if (newindex >= SCTP_READ_LOG_SIZE) {
5952                                 newindex = 0;
5953                         }
5954                 } while (atomic_cmpset_int(&inp->readlog_index, index, newindex) == 0);
5955                 entry = &inp->readlog[index];
5956                 entry->vtag = control->sinfo_assoc_id;
5957                 entry->strm = control->sinfo_stream;
5958                 entry->seq = (uint16_t)control->mid;
5959                 entry->sz = control->length;
5960                 entry->flgs = control->sinfo_flags;
5961         }
5962 #endif
5963         if ((fromlen > 0) && (from != NULL)) {
5964                 union sctp_sockstore store;
5965                 size_t len;
5966
5967                 switch (control->whoFrom->ro._l_addr.sa.sa_family) {
5968 #ifdef INET6
5969                 case AF_INET6:
5970                         len = sizeof(struct sockaddr_in6);
5971                         store.sin6 = control->whoFrom->ro._l_addr.sin6;
5972                         store.sin6.sin6_port = control->port_from;
5973                         break;
5974 #endif
5975 #ifdef INET
5976                 case AF_INET:
5977 #ifdef INET6
5978                         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
5979                                 len = sizeof(struct sockaddr_in6);
5980                                 in6_sin_2_v4mapsin6(&control->whoFrom->ro._l_addr.sin,
5981                                     &store.sin6);
5982                                 store.sin6.sin6_port = control->port_from;
5983                         } else {
5984                                 len = sizeof(struct sockaddr_in);
5985                                 store.sin = control->whoFrom->ro._l_addr.sin;
5986                                 store.sin.sin_port = control->port_from;
5987                         }
5988 #else
5989                         len = sizeof(struct sockaddr_in);
5990                         store.sin = control->whoFrom->ro._l_addr.sin;
5991                         store.sin.sin_port = control->port_from;
5992 #endif
5993                         break;
5994 #endif
5995                 default:
5996                         len = 0;
5997                         break;
5998                 }
5999                 memcpy(from, &store, min((size_t)fromlen, len));
6000 #ifdef INET6
6001                 {
6002                         struct sockaddr_in6 lsa6, *from6;
6003
6004                         from6 = (struct sockaddr_in6 *)from;
6005                         sctp_recover_scope_mac(from6, (&lsa6));
6006                 }
6007 #endif
6008         }
6009         if (hold_rlock) {
6010                 SCTP_INP_READ_UNLOCK(inp);
6011                 hold_rlock = 0;
6012         }
6013         if (hold_sblock) {
6014                 SOCKBUF_UNLOCK(&so->so_rcv);
6015                 hold_sblock = 0;
6016         }
6017         /* now copy out what data we can */
6018         if (mp == NULL) {
6019                 /* copy out each mbuf in the chain up to length */
6020 get_more_data:
6021                 m = control->data;
6022                 while (m) {
6023                         /* Move out all we can */
6024                         cp_len = uio->uio_resid;
6025                         my_len = SCTP_BUF_LEN(m);
6026                         if (cp_len > my_len) {
6027                                 /* not enough in this buf */
6028                                 cp_len = my_len;
6029                         }
6030                         if (hold_rlock) {
6031                                 SCTP_INP_READ_UNLOCK(inp);
6032                                 hold_rlock = 0;
6033                         }
6034                         if (cp_len > 0)
6035                                 error = uiomove(mtod(m, char *), (int)cp_len, uio);
6036                         /* re-read */
6037                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
6038                                 goto release;
6039                         }
6040
6041                         if ((control->do_not_ref_stcb == 0) && stcb &&
6042                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
6043                                 no_rcv_needed = 1;
6044                         }
6045                         if (error) {
6046                                 /* error we are out of here */
6047                                 goto release;
6048                         }
6049                         SCTP_INP_READ_LOCK(inp);
6050                         hold_rlock = 1;
6051                         if (cp_len == SCTP_BUF_LEN(m)) {
6052                                 if ((SCTP_BUF_NEXT(m) == NULL) &&
6053                                     (control->end_added)) {
6054                                         out_flags |= MSG_EOR;
6055                                         if ((control->do_not_ref_stcb == 0) &&
6056                                             (control->stcb != NULL) &&
6057                                             ((control->spec_flags & M_NOTIFICATION) == 0))
6058                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6059                                 }
6060                                 if (control->spec_flags & M_NOTIFICATION) {
6061                                         out_flags |= MSG_NOTIFICATION;
6062                                 }
6063                                 /* we ate up the mbuf */
6064                                 if (in_flags & MSG_PEEK) {
6065                                         /* just looking */
6066                                         m = SCTP_BUF_NEXT(m);
6067                                         copied_so_far += cp_len;
6068                                 } else {
6069                                         /* dispose of the mbuf */
6070                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6071                                                 sctp_sblog(&so->so_rcv,
6072                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
6073                                         }
6074                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
6075                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6076                                                 sctp_sblog(&so->so_rcv,
6077                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
6078                                         }
6079                                         copied_so_far += cp_len;
6080                                         freed_so_far += (uint32_t)cp_len;
6081                                         freed_so_far += MSIZE;
6082                                         atomic_subtract_int(&control->length, (int)cp_len);
6083                                         control->data = sctp_m_free(m);
6084                                         m = control->data;
6085                                         /*
6086                                          * been through it all, must hold sb
6087                                          * lock ok to null tail
6088                                          */
6089                                         if (control->data == NULL) {
6090 #ifdef INVARIANTS
6091                                                 if ((control->end_added == 0) ||
6092                                                     (TAILQ_NEXT(control, next) == NULL)) {
6093                                                         /*
6094                                                          * If the end is not
6095                                                          * added, OR the
6096                                                          * next is NOT null
6097                                                          * we MUST have the
6098                                                          * lock.
6099                                                          */
6100                                                         if (mtx_owned(&inp->inp_rdata_mtx) == 0) {
6101                                                                 panic("Hmm we don't own the lock?");
6102                                                         }
6103                                                 }
6104 #endif
6105                                                 control->tail_mbuf = NULL;
6106 #ifdef INVARIANTS
6107                                                 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) {
6108                                                         panic("end_added, nothing left and no MSG_EOR");
6109                                                 }
6110 #endif
6111                                         }
6112                                 }
6113                         } else {
6114                                 /* Do we need to trim the mbuf? */
6115                                 if (control->spec_flags & M_NOTIFICATION) {
6116                                         out_flags |= MSG_NOTIFICATION;
6117                                 }
6118                                 if ((in_flags & MSG_PEEK) == 0) {
6119                                         SCTP_BUF_RESV_UF(m, cp_len);
6120                                         SCTP_BUF_LEN(m) -= (int)cp_len;
6121                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6122                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, (int)cp_len);
6123                                         }
6124                                         atomic_subtract_int(&so->so_rcv.sb_cc, (int)cp_len);
6125                                         if ((control->do_not_ref_stcb == 0) &&
6126                                             stcb) {
6127                                                 atomic_subtract_int(&stcb->asoc.sb_cc, (int)cp_len);
6128                                         }
6129                                         copied_so_far += cp_len;
6130                                         freed_so_far += (uint32_t)cp_len;
6131                                         freed_so_far += MSIZE;
6132                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6133                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
6134                                                     SCTP_LOG_SBRESULT, 0);
6135                                         }
6136                                         atomic_subtract_int(&control->length, (int)cp_len);
6137                                 } else {
6138                                         copied_so_far += cp_len;
6139                                 }
6140                         }
6141                         if ((out_flags & MSG_EOR) || (uio->uio_resid == 0)) {
6142                                 break;
6143                         }
6144                         if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
6145                             (control->do_not_ref_stcb == 0) &&
6146                             (freed_so_far >= rwnd_req)) {
6147                                 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6148                         }
6149                 }               /* end while(m) */
6150                 /*
6151                  * At this point we have looked at it all and we either have
6152                  * a MSG_EOR/or read all the user wants... <OR>
6153                  * control->length == 0.
6154                  */
6155                 if ((out_flags & MSG_EOR) && ((in_flags & MSG_PEEK) == 0)) {
6156                         /* we are done with this control */
6157                         if (control->length == 0) {
6158                                 if (control->data) {
6159 #ifdef INVARIANTS
6160                                         panic("control->data not null at read eor?");
6161 #else
6162                                         SCTP_PRINTF("Strange, data left in the control buffer .. invariants would panic?\n");
6163                                         sctp_m_freem(control->data);
6164                                         control->data = NULL;
6165 #endif
6166                                 }
6167                 done_with_control:
6168                                 if (hold_rlock == 0) {
6169                                         SCTP_INP_READ_LOCK(inp);
6170                                         hold_rlock = 1;
6171                                 }
6172                                 TAILQ_REMOVE(&inp->read_queue, control, next);
6173                                 /* Add back any hidden data */
6174                                 if (control->held_length) {
6175                                         held_length = 0;
6176                                         control->held_length = 0;
6177                                         wakeup_read_socket = 1;
6178                                 }
6179                                 if (control->aux_data) {
6180                                         sctp_m_free(control->aux_data);
6181                                         control->aux_data = NULL;
6182                                 }
6183                                 no_rcv_needed = control->do_not_ref_stcb;
6184                                 sctp_free_remote_addr(control->whoFrom);
6185                                 control->data = NULL;
6186 #ifdef INVARIANTS
6187                                 if (control->on_strm_q) {
6188                                         panic("About to free ctl:%p so:%p and its in %d",
6189                                             control, so, control->on_strm_q);
6190                                 }
6191 #endif
6192                                 sctp_free_a_readq(stcb, control);
6193                                 control = NULL;
6194                                 if ((freed_so_far >= rwnd_req) &&
6195                                     (no_rcv_needed == 0))
6196                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6197
6198                         } else {
6199                                 /*
6200                                  * The user did not read all of this
6201                                  * message, turn off the returned MSG_EOR
6202                                  * since we are leaving more behind on the
6203                                  * control to read.
6204                                  */
6205 #ifdef INVARIANTS
6206                                 if (control->end_added &&
6207                                     (control->data == NULL) &&
6208                                     (control->tail_mbuf == NULL)) {
6209                                         panic("Gak, control->length is corrupt?");
6210                                 }
6211 #endif
6212                                 no_rcv_needed = control->do_not_ref_stcb;
6213                                 out_flags &= ~MSG_EOR;
6214                         }
6215                 }
6216                 if (out_flags & MSG_EOR) {
6217                         goto release;
6218                 }
6219                 if ((uio->uio_resid == 0) ||
6220                     ((in_eeor_mode) &&
6221                     (copied_so_far >= max(so->so_rcv.sb_lowat, 1)))) {
6222                         goto release;
6223                 }
6224                 /*
6225                  * If I hit here the receiver wants more and this message is
6226                  * NOT done (pd-api). So two questions. Can we block? if not
6227                  * we are done. Did the user NOT set MSG_WAITALL?
6228                  */
6229                 if (block_allowed == 0) {
6230                         goto release;
6231                 }
6232                 /*
6233                  * We need to wait for more data a few things: - We don't
6234                  * release the I/O lock so we don't get someone else
6235                  * reading. - We must be sure to account for the case where
6236                  * what is added is NOT to our control when we wakeup.
6237                  */
6238
6239                 /*
6240                  * Do we need to tell the transport a rwnd update might be
6241                  * needed before we go to sleep?
6242                  */
6243                 if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
6244                     ((freed_so_far >= rwnd_req) &&
6245                     (control->do_not_ref_stcb == 0) &&
6246                     (no_rcv_needed == 0))) {
6247                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6248                 }
6249 wait_some_more:
6250                 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
6251                         goto release;
6252                 }
6253
6254                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
6255                         goto release;
6256
6257                 if (hold_rlock == 1) {
6258                         SCTP_INP_READ_UNLOCK(inp);
6259                         hold_rlock = 0;
6260                 }
6261                 if (hold_sblock == 0) {
6262                         SOCKBUF_LOCK(&so->so_rcv);
6263                         hold_sblock = 1;
6264                 }
6265                 if ((copied_so_far) && (control->length == 0) &&
6266                     (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE))) {
6267                         goto release;
6268                 }
6269                 if (SCTP_SBAVAIL(&so->so_rcv) <= control->held_length) {
6270                         error = sbwait(&so->so_rcv);
6271                         if (error) {
6272                                 goto release;
6273                         }
6274                         control->held_length = 0;
6275                 }
6276                 if (hold_sblock) {
6277                         SOCKBUF_UNLOCK(&so->so_rcv);
6278                         hold_sblock = 0;
6279                 }
6280                 if (control->length == 0) {
6281                         /* still nothing here */
6282                         if (control->end_added == 1) {
6283                                 /* he aborted, or is done i.e.did a shutdown */
6284                                 out_flags |= MSG_EOR;
6285                                 if (control->pdapi_aborted) {
6286                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
6287                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6288
6289                                         out_flags |= MSG_TRUNC;
6290                                 } else {
6291                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
6292                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6293                                 }
6294                                 goto done_with_control;
6295                         }
6296                         if (SCTP_SBAVAIL(&so->so_rcv) > held_length) {
6297                                 control->held_length = SCTP_SBAVAIL(&so->so_rcv);
6298                                 held_length = 0;
6299                         }
6300                         goto wait_some_more;
6301                 } else if (control->data == NULL) {
6302                         /*
6303                          * we must re-sync since data is probably being
6304                          * added
6305                          */
6306                         SCTP_INP_READ_LOCK(inp);
6307                         if ((control->length > 0) && (control->data == NULL)) {
6308                                 /*
6309                                  * big trouble.. we have the lock and its
6310                                  * corrupt?
6311                                  */
6312 #ifdef INVARIANTS
6313                                 panic("Impossible data==NULL length !=0");
6314 #endif
6315                                 out_flags |= MSG_EOR;
6316                                 out_flags |= MSG_TRUNC;
6317                                 control->length = 0;
6318                                 SCTP_INP_READ_UNLOCK(inp);
6319                                 goto done_with_control;
6320                         }
6321                         SCTP_INP_READ_UNLOCK(inp);
6322                         /* We will fall around to get more data */
6323                 }
6324                 goto get_more_data;
6325         } else {
6326                 /*-
6327                  * Give caller back the mbuf chain,
6328                  * store in uio_resid the length
6329                  */
6330                 wakeup_read_socket = 0;
6331                 if ((control->end_added == 0) ||
6332                     (TAILQ_NEXT(control, next) == NULL)) {
6333                         /* Need to get rlock */
6334                         if (hold_rlock == 0) {
6335                                 SCTP_INP_READ_LOCK(inp);
6336                                 hold_rlock = 1;
6337                         }
6338                 }
6339                 if (control->end_added) {
6340                         out_flags |= MSG_EOR;
6341                         if ((control->do_not_ref_stcb == 0) &&
6342                             (control->stcb != NULL) &&
6343                             ((control->spec_flags & M_NOTIFICATION) == 0))
6344                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6345                 }
6346                 if (control->spec_flags & M_NOTIFICATION) {
6347                         out_flags |= MSG_NOTIFICATION;
6348                 }
6349                 uio->uio_resid = control->length;
6350                 *mp = control->data;
6351                 m = control->data;
6352                 while (m) {
6353                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6354                                 sctp_sblog(&so->so_rcv,
6355                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
6356                         }
6357                         sctp_sbfree(control, stcb, &so->so_rcv, m);
6358                         freed_so_far += (uint32_t)SCTP_BUF_LEN(m);
6359                         freed_so_far += MSIZE;
6360                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6361                                 sctp_sblog(&so->so_rcv,
6362                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
6363                         }
6364                         m = SCTP_BUF_NEXT(m);
6365                 }
6366                 control->data = control->tail_mbuf = NULL;
6367                 control->length = 0;
6368                 if (out_flags & MSG_EOR) {
6369                         /* Done with this control */
6370                         goto done_with_control;
6371                 }
6372         }
6373 release:
6374         if (hold_rlock == 1) {
6375                 SCTP_INP_READ_UNLOCK(inp);
6376                 hold_rlock = 0;
6377         }
6378         if (hold_sblock == 1) {
6379                 SOCKBUF_UNLOCK(&so->so_rcv);
6380                 hold_sblock = 0;
6381         }
6382
6383         SOCK_IO_RECV_UNLOCK(so);
6384         sockbuf_lock = 0;
6385
6386 release_unlocked:
6387         if (hold_sblock) {
6388                 SOCKBUF_UNLOCK(&so->so_rcv);
6389                 hold_sblock = 0;
6390         }
6391         if ((stcb) && (in_flags & MSG_PEEK) == 0) {
6392                 if ((freed_so_far >= rwnd_req) &&
6393                     (control && (control->do_not_ref_stcb == 0)) &&
6394                     (no_rcv_needed == 0))
6395                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6396         }
6397 out:
6398         if (msg_flags) {
6399                 *msg_flags = out_flags;
6400         }
6401         if (((out_flags & MSG_EOR) == 0) &&
6402             ((in_flags & MSG_PEEK) == 0) &&
6403             (sinfo) &&
6404             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
6405             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO))) {
6406                 struct sctp_extrcvinfo *s_extra;
6407
6408                 s_extra = (struct sctp_extrcvinfo *)sinfo;
6409                 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG;
6410         }
6411         if (hold_rlock == 1) {
6412                 SCTP_INP_READ_UNLOCK(inp);
6413         }
6414         if (hold_sblock) {
6415                 SOCKBUF_UNLOCK(&so->so_rcv);
6416         }
6417         if (sockbuf_lock) {
6418                 SOCK_IO_RECV_UNLOCK(so);
6419         }
6420
6421         if (freecnt_applied) {
6422                 /*
6423                  * The lock on the socket buffer protects us so the free
6424                  * code will stop. But since we used the socketbuf lock and
6425                  * the sender uses the tcb_lock to increment, we need to use
6426                  * the atomic add to the refcnt.
6427                  */
6428                 if (stcb == NULL) {
6429 #ifdef INVARIANTS
6430                         panic("stcb for refcnt has gone NULL?");
6431                         goto stage_left;
6432 #else
6433                         goto stage_left;
6434 #endif
6435                 }
6436                 /* Save the value back for next time */
6437                 stcb->freed_by_sorcv_sincelast = freed_so_far;
6438                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
6439         }
6440         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
6441                 if (stcb) {
6442                         sctp_misc_ints(SCTP_SORECV_DONE,
6443                             freed_so_far,
6444                             (uint32_t)((uio) ? (slen - uio->uio_resid) : slen),
6445                             stcb->asoc.my_rwnd,
6446                             SCTP_SBAVAIL(&so->so_rcv));
6447                 } else {
6448                         sctp_misc_ints(SCTP_SORECV_DONE,
6449                             freed_so_far,
6450                             (uint32_t)((uio) ? (slen - uio->uio_resid) : slen),
6451                             0,
6452                             SCTP_SBAVAIL(&so->so_rcv));
6453                 }
6454         }
6455 stage_left:
6456         if (wakeup_read_socket) {
6457                 sctp_sorwakeup(inp, so);
6458         }
6459         return (error);
6460 }
6461
6462 #ifdef SCTP_MBUF_LOGGING
6463 struct mbuf *
6464 sctp_m_free(struct mbuf *m)
6465 {
6466         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
6467                 sctp_log_mb(m, SCTP_MBUF_IFREE);
6468         }
6469         return (m_free(m));
6470 }
6471
6472 void
6473 sctp_m_freem(struct mbuf *mb)
6474 {
6475         while (mb != NULL)
6476                 mb = sctp_m_free(mb);
6477 }
6478
6479 #endif
6480
6481 int
6482 sctp_dynamic_set_primary(struct sockaddr *sa, uint32_t vrf_id)
6483 {
6484         /*
6485          * Given a local address. For all associations that holds the
6486          * address, request a peer-set-primary.
6487          */
6488         struct sctp_ifa *ifa;
6489         struct sctp_laddr *wi;
6490
6491         ifa = sctp_find_ifa_by_addr(sa, vrf_id, SCTP_ADDR_NOT_LOCKED);
6492         if (ifa == NULL) {
6493                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EADDRNOTAVAIL);
6494                 return (EADDRNOTAVAIL);
6495         }
6496         /*
6497          * Now that we have the ifa we must awaken the iterator with this
6498          * message.
6499          */
6500         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
6501         if (wi == NULL) {
6502                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
6503                 return (ENOMEM);
6504         }
6505         /* Now incr the count and int wi structure */
6506         SCTP_INCR_LADDR_COUNT();
6507         memset(wi, 0, sizeof(*wi));
6508         (void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
6509         wi->ifa = ifa;
6510         wi->action = SCTP_SET_PRIM_ADDR;
6511         atomic_add_int(&ifa->refcount, 1);
6512
6513         /* Now add it to the work queue */
6514         SCTP_WQ_ADDR_LOCK();
6515         /*
6516          * Should this really be a tailq? As it is we will process the
6517          * newest first :-0
6518          */
6519         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
6520         sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
6521             (struct sctp_inpcb *)NULL,
6522             (struct sctp_tcb *)NULL,
6523             (struct sctp_nets *)NULL);
6524         SCTP_WQ_ADDR_UNLOCK();
6525         return (0);
6526 }
6527
6528 int
6529 sctp_soreceive(struct socket *so,
6530     struct sockaddr **psa,
6531     struct uio *uio,
6532     struct mbuf **mp0,
6533     struct mbuf **controlp,
6534     int *flagsp)
6535 {
6536         int error, fromlen;
6537         uint8_t sockbuf[256];
6538         struct sockaddr *from;
6539         struct sctp_extrcvinfo sinfo;
6540         int filling_sinfo = 1;
6541         int flags;
6542         struct sctp_inpcb *inp;
6543
6544         inp = (struct sctp_inpcb *)so->so_pcb;
6545         /* pickup the assoc we are reading from */
6546         if (inp == NULL) {
6547                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6548                 return (EINVAL);
6549         }
6550         if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) &&
6551             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) &&
6552             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) ||
6553             (controlp == NULL)) {
6554                 /* user does not want the sndrcv ctl */
6555                 filling_sinfo = 0;
6556         }
6557         if (psa) {
6558                 from = (struct sockaddr *)sockbuf;
6559                 fromlen = sizeof(sockbuf);
6560                 from->sa_len = 0;
6561         } else {
6562                 from = NULL;
6563                 fromlen = 0;
6564         }
6565
6566         if (filling_sinfo) {
6567                 memset(&sinfo, 0, sizeof(struct sctp_extrcvinfo));
6568         }
6569         if (flagsp != NULL) {
6570                 flags = *flagsp;
6571         } else {
6572                 flags = 0;
6573         }
6574         error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, &flags,
6575             (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo);
6576         if (flagsp != NULL) {
6577                 *flagsp = flags;
6578         }
6579         if (controlp != NULL) {
6580                 /* copy back the sinfo in a CMSG format */
6581                 if (filling_sinfo && ((flags & MSG_NOTIFICATION) == 0)) {
6582                         *controlp = sctp_build_ctl_nchunk(inp,
6583                             (struct sctp_sndrcvinfo *)&sinfo);
6584                 } else {
6585                         *controlp = NULL;
6586                 }
6587         }
6588         if (psa) {
6589                 /* copy back the address info */
6590                 if (from && from->sa_len) {
6591                         *psa = sodupsockaddr(from, M_NOWAIT);
6592                 } else {
6593                         *psa = NULL;
6594                 }
6595         }
6596         return (error);
6597 }
6598
6599 int
6600 sctp_connectx_helper_add(struct sctp_tcb *stcb, struct sockaddr *addr,
6601     int totaddr, int *error)
6602 {
6603         int added = 0;
6604         int i;
6605         struct sctp_inpcb *inp;
6606         struct sockaddr *sa;
6607         size_t incr = 0;
6608 #ifdef INET
6609         struct sockaddr_in *sin;
6610 #endif
6611 #ifdef INET6
6612         struct sockaddr_in6 *sin6;
6613 #endif
6614
6615         sa = addr;
6616         inp = stcb->sctp_ep;
6617         *error = 0;
6618         for (i = 0; i < totaddr; i++) {
6619                 switch (sa->sa_family) {
6620 #ifdef INET
6621                 case AF_INET:
6622                         incr = sizeof(struct sockaddr_in);
6623                         sin = (struct sockaddr_in *)sa;
6624                         if ((sin->sin_addr.s_addr == INADDR_ANY) ||
6625                             (sin->sin_addr.s_addr == INADDR_BROADCAST) ||
6626                             IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
6627                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6628                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6629                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_7);
6630                                 *error = EINVAL;
6631                                 goto out_now;
6632                         }
6633                         if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port,
6634                             SCTP_DONOT_SETSCOPE,
6635                             SCTP_ADDR_IS_CONFIRMED)) {
6636                                 /* assoc gone no un-lock */
6637                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6638                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6639                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_8);
6640                                 *error = ENOBUFS;
6641                                 goto out_now;
6642                         }
6643                         added++;
6644                         break;
6645 #endif
6646 #ifdef INET6
6647                 case AF_INET6:
6648                         incr = sizeof(struct sockaddr_in6);
6649                         sin6 = (struct sockaddr_in6 *)sa;
6650                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
6651                             IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
6652                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6653                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6654                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_9);
6655                                 *error = EINVAL;
6656                                 goto out_now;
6657                         }
6658                         if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port,
6659                             SCTP_DONOT_SETSCOPE,
6660                             SCTP_ADDR_IS_CONFIRMED)) {
6661                                 /* assoc gone no un-lock */
6662                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6663                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6664                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_10);
6665                                 *error = ENOBUFS;
6666                                 goto out_now;
6667                         }
6668                         added++;
6669                         break;
6670 #endif
6671                 default:
6672                         break;
6673                 }
6674                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6675         }
6676 out_now:
6677         return (added);
6678 }
6679
6680 int
6681 sctp_connectx_helper_find(struct sctp_inpcb *inp, struct sockaddr *addr,
6682     unsigned int totaddr,
6683     unsigned int *num_v4, unsigned int *num_v6,
6684     unsigned int limit)
6685 {
6686         struct sockaddr *sa;
6687         struct sctp_tcb *stcb;
6688         unsigned int incr, at, i;
6689
6690         at = 0;
6691         sa = addr;
6692         *num_v6 = *num_v4 = 0;
6693         /* account and validate addresses */
6694         if (totaddr == 0) {
6695                 return (EINVAL);
6696         }
6697         for (i = 0; i < totaddr; i++) {
6698                 if (at + sizeof(struct sockaddr) > limit) {
6699                         return (EINVAL);
6700                 }
6701                 switch (sa->sa_family) {
6702 #ifdef INET
6703                 case AF_INET:
6704                         incr = (unsigned int)sizeof(struct sockaddr_in);
6705                         if (sa->sa_len != incr) {
6706                                 return (EINVAL);
6707                         }
6708                         (*num_v4) += 1;
6709                         break;
6710 #endif
6711 #ifdef INET6
6712                 case AF_INET6:
6713                         {
6714                                 struct sockaddr_in6 *sin6;
6715
6716                                 incr = (unsigned int)sizeof(struct sockaddr_in6);
6717                                 if (sa->sa_len != incr) {
6718                                         return (EINVAL);
6719                                 }
6720                                 sin6 = (struct sockaddr_in6 *)sa;
6721                                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6722                                         /* Must be non-mapped for connectx */
6723                                         return (EINVAL);
6724                                 }
6725                                 (*num_v6) += 1;
6726                                 break;
6727                         }
6728 #endif
6729                 default:
6730                         return (EINVAL);
6731                 }
6732                 if ((at + incr) > limit) {
6733                         return (EINVAL);
6734                 }
6735                 SCTP_INP_INCR_REF(inp);
6736                 stcb = sctp_findassociation_ep_addr(&inp, sa, NULL, NULL, NULL);
6737                 if (stcb != NULL) {
6738                         SCTP_TCB_UNLOCK(stcb);
6739                         return (EALREADY);
6740                 } else {
6741                         SCTP_INP_DECR_REF(inp);
6742                 }
6743                 at += incr;
6744                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6745         }
6746         return (0);
6747 }
6748
6749 /*
6750  * sctp_bindx(ADD) for one address.
6751  * assumes all arguments are valid/checked by caller.
6752  */
6753 void
6754 sctp_bindx_add_address(struct socket *so, struct sctp_inpcb *inp,
6755     struct sockaddr *sa, uint32_t vrf_id, int *error,
6756     void *p)
6757 {
6758 #if defined(INET) && defined(INET6)
6759         struct sockaddr_in sin;
6760 #endif
6761 #ifdef INET6
6762         struct sockaddr_in6 *sin6;
6763 #endif
6764 #ifdef INET
6765         struct sockaddr_in *sinp;
6766 #endif
6767         struct sockaddr *addr_to_use;
6768         struct sctp_inpcb *lep;
6769         uint16_t port;
6770
6771         /* see if we're bound all already! */
6772         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6773                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6774                 *error = EINVAL;
6775                 return;
6776         }
6777         switch (sa->sa_family) {
6778 #ifdef INET6
6779         case AF_INET6:
6780                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6781                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6782                         *error = EINVAL;
6783                         return;
6784                 }
6785                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6786                         /* can only bind v6 on PF_INET6 sockets */
6787                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6788                         *error = EINVAL;
6789                         return;
6790                 }
6791                 sin6 = (struct sockaddr_in6 *)sa;
6792                 port = sin6->sin6_port;
6793 #ifdef INET
6794                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6795                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6796                             SCTP_IPV6_V6ONLY(inp)) {
6797                                 /* can't bind v4-mapped on PF_INET sockets */
6798                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6799                                 *error = EINVAL;
6800                                 return;
6801                         }
6802                         in6_sin6_2_sin(&sin, sin6);
6803                         addr_to_use = (struct sockaddr *)&sin;
6804                 } else {
6805                         addr_to_use = sa;
6806                 }
6807 #else
6808                 addr_to_use = sa;
6809 #endif
6810                 break;
6811 #endif
6812 #ifdef INET
6813         case AF_INET:
6814                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6815                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6816                         *error = EINVAL;
6817                         return;
6818                 }
6819                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6820                     SCTP_IPV6_V6ONLY(inp)) {
6821                         /* can't bind v4 on PF_INET sockets */
6822                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6823                         *error = EINVAL;
6824                         return;
6825                 }
6826                 sinp = (struct sockaddr_in *)sa;
6827                 port = sinp->sin_port;
6828                 addr_to_use = sa;
6829                 break;
6830 #endif
6831         default:
6832                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6833                 *error = EINVAL;
6834                 return;
6835         }
6836         if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
6837                 if (p == NULL) {
6838                         /* Can't get proc for Net/Open BSD */
6839                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6840                         *error = EINVAL;
6841                         return;
6842                 }
6843                 *error = sctp_inpcb_bind(so, addr_to_use, NULL, p);
6844                 return;
6845         }
6846         /* Validate the incoming port. */
6847         if ((port != 0) && (port != inp->sctp_lport)) {
6848                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6849                 *error = EINVAL;
6850                 return;
6851         }
6852         lep = sctp_pcb_findep(addr_to_use, 1, 0, vrf_id);
6853         if (lep == NULL) {
6854                 /* add the address */
6855                 *error = sctp_addr_mgmt_ep_sa(inp, addr_to_use,
6856                     SCTP_ADD_IP_ADDRESS, vrf_id);
6857         } else {
6858                 if (lep != inp) {
6859                         *error = EADDRINUSE;
6860                 }
6861                 SCTP_INP_DECR_REF(lep);
6862         }
6863 }
6864
6865 /*
6866  * sctp_bindx(DELETE) for one address.
6867  * assumes all arguments are valid/checked by caller.
6868  */
6869 void
6870 sctp_bindx_delete_address(struct sctp_inpcb *inp,
6871     struct sockaddr *sa, uint32_t vrf_id, int *error)
6872 {
6873         struct sockaddr *addr_to_use;
6874 #if defined(INET) && defined(INET6)
6875         struct sockaddr_in6 *sin6;
6876         struct sockaddr_in sin;
6877 #endif
6878
6879         /* see if we're bound all already! */
6880         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6881                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6882                 *error = EINVAL;
6883                 return;
6884         }
6885         switch (sa->sa_family) {
6886 #ifdef INET6
6887         case AF_INET6:
6888                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6889                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6890                         *error = EINVAL;
6891                         return;
6892                 }
6893                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6894                         /* can only bind v6 on PF_INET6 sockets */
6895                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6896                         *error = EINVAL;
6897                         return;
6898                 }
6899 #ifdef INET
6900                 sin6 = (struct sockaddr_in6 *)sa;
6901                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6902                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6903                             SCTP_IPV6_V6ONLY(inp)) {
6904                                 /* can't bind mapped-v4 on PF_INET sockets */
6905                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6906                                 *error = EINVAL;
6907                                 return;
6908                         }
6909                         in6_sin6_2_sin(&sin, sin6);
6910                         addr_to_use = (struct sockaddr *)&sin;
6911                 } else {
6912                         addr_to_use = sa;
6913                 }
6914 #else
6915                 addr_to_use = sa;
6916 #endif
6917                 break;
6918 #endif
6919 #ifdef INET
6920         case AF_INET:
6921                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6922                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6923                         *error = EINVAL;
6924                         return;
6925                 }
6926                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6927                     SCTP_IPV6_V6ONLY(inp)) {
6928                         /* can't bind v4 on PF_INET sockets */
6929                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6930                         *error = EINVAL;
6931                         return;
6932                 }
6933                 addr_to_use = sa;
6934                 break;
6935 #endif
6936         default:
6937                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6938                 *error = EINVAL;
6939                 return;
6940         }
6941         /* No lock required mgmt_ep_sa does its own locking. */
6942         *error = sctp_addr_mgmt_ep_sa(inp, addr_to_use, SCTP_DEL_IP_ADDRESS,
6943             vrf_id);
6944 }
6945
6946 /*
6947  * returns the valid local address count for an assoc, taking into account
6948  * all scoping rules
6949  */
6950 int
6951 sctp_local_addr_count(struct sctp_tcb *stcb)
6952 {
6953         int loopback_scope;
6954 #if defined(INET)
6955         int ipv4_local_scope, ipv4_addr_legal;
6956 #endif
6957 #if defined(INET6)
6958         int local_scope, site_scope, ipv6_addr_legal;
6959 #endif
6960         struct sctp_vrf *vrf;
6961         struct sctp_ifn *sctp_ifn;
6962         struct sctp_ifa *sctp_ifa;
6963         int count = 0;
6964
6965         /* Turn on all the appropriate scopes */
6966         loopback_scope = stcb->asoc.scope.loopback_scope;
6967 #if defined(INET)
6968         ipv4_local_scope = stcb->asoc.scope.ipv4_local_scope;
6969         ipv4_addr_legal = stcb->asoc.scope.ipv4_addr_legal;
6970 #endif
6971 #if defined(INET6)
6972         local_scope = stcb->asoc.scope.local_scope;
6973         site_scope = stcb->asoc.scope.site_scope;
6974         ipv6_addr_legal = stcb->asoc.scope.ipv6_addr_legal;
6975 #endif
6976         SCTP_IPI_ADDR_RLOCK();
6977         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
6978         if (vrf == NULL) {
6979                 /* no vrf, no addresses */
6980                 SCTP_IPI_ADDR_RUNLOCK();
6981                 return (0);
6982         }
6983
6984         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6985                 /*
6986                  * bound all case: go through all ifns on the vrf
6987                  */
6988                 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
6989                         if ((loopback_scope == 0) &&
6990                             SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
6991                                 continue;
6992                         }
6993                         LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
6994                                 if (sctp_is_addr_restricted(stcb, sctp_ifa))
6995                                         continue;
6996                                 switch (sctp_ifa->address.sa.sa_family) {
6997 #ifdef INET
6998                                 case AF_INET:
6999                                         if (ipv4_addr_legal) {
7000                                                 struct sockaddr_in *sin;
7001
7002                                                 sin = &sctp_ifa->address.sin;
7003                                                 if (sin->sin_addr.s_addr == 0) {
7004                                                         /*
7005                                                          * skip unspecified
7006                                                          * addrs
7007                                                          */
7008                                                         continue;
7009                                                 }
7010                                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
7011                                                     &sin->sin_addr) != 0) {
7012                                                         continue;
7013                                                 }
7014                                                 if ((ipv4_local_scope == 0) &&
7015                                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
7016                                                         continue;
7017                                                 }
7018                                                 /* count this one */
7019                                                 count++;
7020                                         } else {
7021                                                 continue;
7022                                         }
7023                                         break;
7024 #endif
7025 #ifdef INET6
7026                                 case AF_INET6:
7027                                         if (ipv6_addr_legal) {
7028                                                 struct sockaddr_in6 *sin6;
7029
7030                                                 sin6 = &sctp_ifa->address.sin6;
7031                                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
7032                                                         continue;
7033                                                 }
7034                                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
7035                                                     &sin6->sin6_addr) != 0) {
7036                                                         continue;
7037                                                 }
7038                                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
7039                                                         if (local_scope == 0)
7040                                                                 continue;
7041                                                         if (sin6->sin6_scope_id == 0) {
7042                                                                 if (sa6_recoverscope(sin6) != 0)
7043                                                                         /*
7044                                                                          *
7045                                                                          * bad
7046                                                                          * link
7047                                                                          *
7048                                                                          * local
7049                                                                          *
7050                                                                          * address
7051                                                                          */
7052                                                                         continue;
7053                                                         }
7054                                                 }
7055                                                 if ((site_scope == 0) &&
7056                                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
7057                                                         continue;
7058                                                 }
7059                                                 /* count this one */
7060                                                 count++;
7061                                         }
7062                                         break;
7063 #endif
7064                                 default:
7065                                         /* TSNH */
7066                                         break;
7067                                 }
7068                         }
7069                 }
7070         } else {
7071                 /*
7072                  * subset bound case
7073                  */
7074                 struct sctp_laddr *laddr;
7075
7076                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list,
7077                     sctp_nxt_addr) {
7078                         if (sctp_is_addr_restricted(stcb, laddr->ifa)) {
7079                                 continue;
7080                         }
7081                         /* count this one */
7082                         count++;
7083                 }
7084         }
7085         SCTP_IPI_ADDR_RUNLOCK();
7086         return (count);
7087 }
7088
7089 #if defined(SCTP_LOCAL_TRACE_BUF)
7090
7091 void
7092 sctp_log_trace(uint32_t subsys, const char *str SCTP_UNUSED, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f)
7093 {
7094         uint32_t saveindex, newindex;
7095
7096         do {
7097                 saveindex = SCTP_BASE_SYSCTL(sctp_log).index;
7098                 if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
7099                         newindex = 1;
7100                 } else {
7101                         newindex = saveindex + 1;
7102                 }
7103         } while (atomic_cmpset_int(&SCTP_BASE_SYSCTL(sctp_log).index, saveindex, newindex) == 0);
7104         if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
7105                 saveindex = 0;
7106         }
7107         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].timestamp = SCTP_GET_CYCLECOUNT;
7108         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].subsys = subsys;
7109         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[0] = a;
7110         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[1] = b;
7111         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[2] = c;
7112         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[3] = d;
7113         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[4] = e;
7114         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[5] = f;
7115 }
7116
7117 #endif
7118 static void
7119 sctp_recv_udp_tunneled_packet(struct mbuf *m, int off, struct inpcb *inp,
7120     const struct sockaddr *sa SCTP_UNUSED, void *ctx SCTP_UNUSED)
7121 {
7122         struct ip *iph;
7123 #ifdef INET6
7124         struct ip6_hdr *ip6;
7125 #endif
7126         struct mbuf *sp, *last;
7127         struct udphdr *uhdr;
7128         uint16_t port;
7129
7130         if ((m->m_flags & M_PKTHDR) == 0) {
7131                 /* Can't handle one that is not a pkt hdr */
7132                 goto out;
7133         }
7134         /* Pull the src port */
7135         iph = mtod(m, struct ip *);
7136         uhdr = (struct udphdr *)((caddr_t)iph + off);
7137         port = uhdr->uh_sport;
7138         /*
7139          * Split out the mbuf chain. Leave the IP header in m, place the
7140          * rest in the sp.
7141          */
7142         sp = m_split(m, off, M_NOWAIT);
7143         if (sp == NULL) {
7144                 /* Gak, drop packet, we can't do a split */
7145                 goto out;
7146         }
7147         if (sp->m_pkthdr.len < sizeof(struct udphdr) + sizeof(struct sctphdr)) {
7148                 /* Gak, packet can't have an SCTP header in it - too small */
7149                 m_freem(sp);
7150                 goto out;
7151         }
7152         /* Now pull up the UDP header and SCTP header together */
7153         sp = m_pullup(sp, sizeof(struct udphdr) + sizeof(struct sctphdr));
7154         if (sp == NULL) {
7155                 /* Gak pullup failed */
7156                 goto out;
7157         }
7158         /* Trim out the UDP header */
7159         m_adj(sp, sizeof(struct udphdr));
7160
7161         /* Now reconstruct the mbuf chain */
7162         for (last = m; last->m_next; last = last->m_next);
7163         last->m_next = sp;
7164         m->m_pkthdr.len += sp->m_pkthdr.len;
7165         /*
7166          * The CSUM_DATA_VALID flags indicates that the HW checked the UDP
7167          * checksum and it was valid. Since CSUM_DATA_VALID ==
7168          * CSUM_SCTP_VALID this would imply that the HW also verified the
7169          * SCTP checksum. Therefore, clear the bit.
7170          */
7171         SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
7172             "sctp_recv_udp_tunneled_packet(): Packet of length %d received on %s with csum_flags 0x%b.\n",
7173             m->m_pkthdr.len,
7174             if_name(m->m_pkthdr.rcvif),
7175             (int)m->m_pkthdr.csum_flags, CSUM_BITS);
7176         m->m_pkthdr.csum_flags &= ~CSUM_DATA_VALID;
7177         iph = mtod(m, struct ip *);
7178         switch (iph->ip_v) {
7179 #ifdef INET
7180         case IPVERSION:
7181                 iph->ip_len = htons(ntohs(iph->ip_len) - sizeof(struct udphdr));
7182                 sctp_input_with_port(m, off, port);
7183                 break;
7184 #endif
7185 #ifdef INET6
7186         case IPV6_VERSION >> 4:
7187                 ip6 = mtod(m, struct ip6_hdr *);
7188                 ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - sizeof(struct udphdr));
7189                 sctp6_input_with_port(&m, &off, port);
7190                 break;
7191 #endif
7192         default:
7193                 goto out;
7194                 break;
7195         }
7196         return;
7197 out:
7198         m_freem(m);
7199 }
7200
7201 #ifdef INET
7202 static void
7203 sctp_recv_icmp_tunneled_packet(int cmd, struct sockaddr *sa, void *vip, void *ctx SCTP_UNUSED)
7204 {
7205         struct ip *outer_ip, *inner_ip;
7206         struct sctphdr *sh;
7207         struct icmp *icmp;
7208         struct udphdr *udp;
7209         struct sctp_inpcb *inp;
7210         struct sctp_tcb *stcb;
7211         struct sctp_nets *net;
7212         struct sctp_init_chunk *ch;
7213         struct sockaddr_in src, dst;
7214         uint8_t type, code;
7215
7216         inner_ip = (struct ip *)vip;
7217         icmp = (struct icmp *)((caddr_t)inner_ip -
7218             (sizeof(struct icmp) - sizeof(struct ip)));
7219         outer_ip = (struct ip *)((caddr_t)icmp - sizeof(struct ip));
7220         if (ntohs(outer_ip->ip_len) <
7221             sizeof(struct ip) + 8 + (inner_ip->ip_hl << 2) + sizeof(struct udphdr) + 8) {
7222                 return;
7223         }
7224         udp = (struct udphdr *)((caddr_t)inner_ip + (inner_ip->ip_hl << 2));
7225         sh = (struct sctphdr *)(udp + 1);
7226         memset(&src, 0, sizeof(struct sockaddr_in));
7227         src.sin_family = AF_INET;
7228         src.sin_len = sizeof(struct sockaddr_in);
7229         src.sin_port = sh->src_port;
7230         src.sin_addr = inner_ip->ip_src;
7231         memset(&dst, 0, sizeof(struct sockaddr_in));
7232         dst.sin_family = AF_INET;
7233         dst.sin_len = sizeof(struct sockaddr_in);
7234         dst.sin_port = sh->dest_port;
7235         dst.sin_addr = inner_ip->ip_dst;
7236         /*
7237          * 'dst' holds the dest of the packet that failed to be sent. 'src'
7238          * holds our local endpoint address. Thus we reverse the dst and the
7239          * src in the lookup.
7240          */
7241         inp = NULL;
7242         net = NULL;
7243         stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst,
7244             (struct sockaddr *)&src,
7245             &inp, &net, 1,
7246             SCTP_DEFAULT_VRFID);
7247         if ((stcb != NULL) &&
7248             (net != NULL) &&
7249             (inp != NULL)) {
7250                 /* Check the UDP port numbers */
7251                 if ((udp->uh_dport != net->port) ||
7252                     (udp->uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) {
7253                         SCTP_TCB_UNLOCK(stcb);
7254                         return;
7255                 }
7256                 /* Check the verification tag */
7257                 if (ntohl(sh->v_tag) != 0) {
7258                         /*
7259                          * This must be the verification tag used for
7260                          * sending out packets. We don't consider packets
7261                          * reflecting the verification tag.
7262                          */
7263                         if (ntohl(sh->v_tag) != stcb->asoc.peer_vtag) {
7264                                 SCTP_TCB_UNLOCK(stcb);
7265                                 return;
7266                         }
7267                 } else {
7268                         if (ntohs(outer_ip->ip_len) >=
7269                             sizeof(struct ip) +
7270                             8 + (inner_ip->ip_hl << 2) + 8 + 20) {
7271                                 /*
7272                                  * In this case we can check if we got an
7273                                  * INIT chunk and if the initiate tag
7274                                  * matches.
7275                                  */
7276                                 ch = (struct sctp_init_chunk *)(sh + 1);
7277                                 if ((ch->ch.chunk_type != SCTP_INITIATION) ||
7278                                     (ntohl(ch->init.initiate_tag) != stcb->asoc.my_vtag)) {
7279                                         SCTP_TCB_UNLOCK(stcb);
7280                                         return;
7281                                 }
7282                         } else {
7283                                 SCTP_TCB_UNLOCK(stcb);
7284                                 return;
7285                         }
7286                 }
7287                 type = icmp->icmp_type;
7288                 code = icmp->icmp_code;
7289                 if ((type == ICMP_UNREACH) &&
7290                     (code == ICMP_UNREACH_PORT)) {
7291                         code = ICMP_UNREACH_PROTOCOL;
7292                 }
7293                 sctp_notify(inp, stcb, net, type, code,
7294                     ntohs(inner_ip->ip_len),
7295                     (uint32_t)ntohs(icmp->icmp_nextmtu));
7296         } else {
7297                 if ((stcb == NULL) && (inp != NULL)) {
7298                         /* reduce ref-count */
7299                         SCTP_INP_WLOCK(inp);
7300                         SCTP_INP_DECR_REF(inp);
7301                         SCTP_INP_WUNLOCK(inp);
7302                 }
7303                 if (stcb) {
7304                         SCTP_TCB_UNLOCK(stcb);
7305                 }
7306         }
7307         return;
7308 }
7309 #endif
7310
7311 #ifdef INET6
7312 static void
7313 sctp_recv_icmp6_tunneled_packet(int cmd, struct sockaddr *sa, void *d, void *ctx SCTP_UNUSED)
7314 {
7315         struct ip6ctlparam *ip6cp;
7316         struct sctp_inpcb *inp;
7317         struct sctp_tcb *stcb;
7318         struct sctp_nets *net;
7319         struct sctphdr sh;
7320         struct udphdr udp;
7321         struct sockaddr_in6 src, dst;
7322         uint8_t type, code;
7323
7324         ip6cp = (struct ip6ctlparam *)d;
7325         /*
7326          * XXX: We assume that when IPV6 is non NULL, M and OFF are valid.
7327          */
7328         if (ip6cp->ip6c_m == NULL) {
7329                 return;
7330         }
7331         /*
7332          * Check if we can safely examine the ports and the verification tag
7333          * of the SCTP common header.
7334          */
7335         if (ip6cp->ip6c_m->m_pkthdr.len <
7336             ip6cp->ip6c_off + sizeof(struct udphdr) + offsetof(struct sctphdr, checksum)) {
7337                 return;
7338         }
7339         /* Copy out the UDP header. */
7340         memset(&udp, 0, sizeof(struct udphdr));
7341         m_copydata(ip6cp->ip6c_m,
7342             ip6cp->ip6c_off,
7343             sizeof(struct udphdr),
7344             (caddr_t)&udp);
7345         /* Copy out the port numbers and the verification tag. */
7346         memset(&sh, 0, sizeof(struct sctphdr));
7347         m_copydata(ip6cp->ip6c_m,
7348             ip6cp->ip6c_off + sizeof(struct udphdr),
7349             sizeof(uint16_t) + sizeof(uint16_t) + sizeof(uint32_t),
7350             (caddr_t)&sh);
7351         memset(&src, 0, sizeof(struct sockaddr_in6));
7352         src.sin6_family = AF_INET6;
7353         src.sin6_len = sizeof(struct sockaddr_in6);
7354         src.sin6_port = sh.src_port;
7355         src.sin6_addr = ip6cp->ip6c_ip6->ip6_src;
7356         if (in6_setscope(&src.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) {
7357                 return;
7358         }
7359         memset(&dst, 0, sizeof(struct sockaddr_in6));
7360         dst.sin6_family = AF_INET6;
7361         dst.sin6_len = sizeof(struct sockaddr_in6);
7362         dst.sin6_port = sh.dest_port;
7363         dst.sin6_addr = ip6cp->ip6c_ip6->ip6_dst;
7364         if (in6_setscope(&dst.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) {
7365                 return;
7366         }
7367         inp = NULL;
7368         net = NULL;
7369         stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst,
7370             (struct sockaddr *)&src,
7371             &inp, &net, 1, SCTP_DEFAULT_VRFID);
7372         if ((stcb != NULL) &&
7373             (net != NULL) &&
7374             (inp != NULL)) {
7375                 /* Check the UDP port numbers */
7376                 if ((udp.uh_dport != net->port) ||
7377                     (udp.uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) {
7378                         SCTP_TCB_UNLOCK(stcb);
7379                         return;
7380                 }
7381                 /* Check the verification tag */
7382                 if (ntohl(sh.v_tag) != 0) {
7383                         /*
7384                          * This must be the verification tag used for
7385                          * sending out packets. We don't consider packets
7386                          * reflecting the verification tag.
7387                          */
7388                         if (ntohl(sh.v_tag) != stcb->asoc.peer_vtag) {
7389                                 SCTP_TCB_UNLOCK(stcb);
7390                                 return;
7391                         }
7392                 } else {
7393                         if (ip6cp->ip6c_m->m_pkthdr.len >=
7394                             ip6cp->ip6c_off + sizeof(struct udphdr) +
7395                             sizeof(struct sctphdr) +
7396                             sizeof(struct sctp_chunkhdr) +
7397                             offsetof(struct sctp_init, a_rwnd)) {
7398                                 /*
7399                                  * In this case we can check if we got an
7400                                  * INIT chunk and if the initiate tag
7401                                  * matches.
7402                                  */
7403                                 uint32_t initiate_tag;
7404                                 uint8_t chunk_type;
7405
7406                                 m_copydata(ip6cp->ip6c_m,
7407                                     ip6cp->ip6c_off +
7408                                     sizeof(struct udphdr) +
7409                                     sizeof(struct sctphdr),
7410                                     sizeof(uint8_t),
7411                                     (caddr_t)&chunk_type);
7412                                 m_copydata(ip6cp->ip6c_m,
7413                                     ip6cp->ip6c_off +
7414                                     sizeof(struct udphdr) +
7415                                     sizeof(struct sctphdr) +
7416                                     sizeof(struct sctp_chunkhdr),
7417                                     sizeof(uint32_t),
7418                                     (caddr_t)&initiate_tag);
7419                                 if ((chunk_type != SCTP_INITIATION) ||
7420                                     (ntohl(initiate_tag) != stcb->asoc.my_vtag)) {
7421                                         SCTP_TCB_UNLOCK(stcb);
7422                                         return;
7423                                 }
7424                         } else {
7425                                 SCTP_TCB_UNLOCK(stcb);
7426                                 return;
7427                         }
7428                 }
7429                 type = ip6cp->ip6c_icmp6->icmp6_type;
7430                 code = ip6cp->ip6c_icmp6->icmp6_code;
7431                 if ((type == ICMP6_DST_UNREACH) &&
7432                     (code == ICMP6_DST_UNREACH_NOPORT)) {
7433                         type = ICMP6_PARAM_PROB;
7434                         code = ICMP6_PARAMPROB_NEXTHEADER;
7435                 }
7436                 sctp6_notify(inp, stcb, net, type, code,
7437                     ntohl(ip6cp->ip6c_icmp6->icmp6_mtu));
7438         } else {
7439                 if ((stcb == NULL) && (inp != NULL)) {
7440                         /* reduce inp's ref-count */
7441                         SCTP_INP_WLOCK(inp);
7442                         SCTP_INP_DECR_REF(inp);
7443                         SCTP_INP_WUNLOCK(inp);
7444                 }
7445                 if (stcb) {
7446                         SCTP_TCB_UNLOCK(stcb);
7447                 }
7448         }
7449 }
7450 #endif
7451
7452 void
7453 sctp_over_udp_stop(void)
7454 {
7455         /*
7456          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
7457          * for writing!
7458          */
7459 #ifdef INET
7460         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
7461                 soclose(SCTP_BASE_INFO(udp4_tun_socket));
7462                 SCTP_BASE_INFO(udp4_tun_socket) = NULL;
7463         }
7464 #endif
7465 #ifdef INET6
7466         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
7467                 soclose(SCTP_BASE_INFO(udp6_tun_socket));
7468                 SCTP_BASE_INFO(udp6_tun_socket) = NULL;
7469         }
7470 #endif
7471 }
7472
7473 int
7474 sctp_over_udp_start(void)
7475 {
7476         uint16_t port;
7477         int ret;
7478 #ifdef INET
7479         struct sockaddr_in sin;
7480 #endif
7481 #ifdef INET6
7482         struct sockaddr_in6 sin6;
7483 #endif
7484         /*
7485          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
7486          * for writing!
7487          */
7488         port = SCTP_BASE_SYSCTL(sctp_udp_tunneling_port);
7489         if (ntohs(port) == 0) {
7490                 /* Must have a port set */
7491                 return (EINVAL);
7492         }
7493 #ifdef INET
7494         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
7495                 /* Already running -- must stop first */
7496                 return (EALREADY);
7497         }
7498 #endif
7499 #ifdef INET6
7500         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
7501                 /* Already running -- must stop first */
7502                 return (EALREADY);
7503         }
7504 #endif
7505 #ifdef INET
7506         if ((ret = socreate(PF_INET, &SCTP_BASE_INFO(udp4_tun_socket),
7507             SOCK_DGRAM, IPPROTO_UDP,
7508             curthread->td_ucred, curthread))) {
7509                 sctp_over_udp_stop();
7510                 return (ret);
7511         }
7512         /* Call the special UDP hook. */
7513         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp4_tun_socket),
7514             sctp_recv_udp_tunneled_packet,
7515             sctp_recv_icmp_tunneled_packet,
7516             NULL))) {
7517                 sctp_over_udp_stop();
7518                 return (ret);
7519         }
7520         /* Ok, we have a socket, bind it to the port. */
7521         memset(&sin, 0, sizeof(struct sockaddr_in));
7522         sin.sin_len = sizeof(struct sockaddr_in);
7523         sin.sin_family = AF_INET;
7524         sin.sin_port = htons(port);
7525         if ((ret = sobind(SCTP_BASE_INFO(udp4_tun_socket),
7526             (struct sockaddr *)&sin, curthread))) {
7527                 sctp_over_udp_stop();
7528                 return (ret);
7529         }
7530 #endif
7531 #ifdef INET6
7532         if ((ret = socreate(PF_INET6, &SCTP_BASE_INFO(udp6_tun_socket),
7533             SOCK_DGRAM, IPPROTO_UDP,
7534             curthread->td_ucred, curthread))) {
7535                 sctp_over_udp_stop();
7536                 return (ret);
7537         }
7538         /* Call the special UDP hook. */
7539         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp6_tun_socket),
7540             sctp_recv_udp_tunneled_packet,
7541             sctp_recv_icmp6_tunneled_packet,
7542             NULL))) {
7543                 sctp_over_udp_stop();
7544                 return (ret);
7545         }
7546         /* Ok, we have a socket, bind it to the port. */
7547         memset(&sin6, 0, sizeof(struct sockaddr_in6));
7548         sin6.sin6_len = sizeof(struct sockaddr_in6);
7549         sin6.sin6_family = AF_INET6;
7550         sin6.sin6_port = htons(port);
7551         if ((ret = sobind(SCTP_BASE_INFO(udp6_tun_socket),
7552             (struct sockaddr *)&sin6, curthread))) {
7553                 sctp_over_udp_stop();
7554                 return (ret);
7555         }
7556 #endif
7557         return (0);
7558 }
7559
7560 /*
7561  * sctp_min_mtu ()returns the minimum of all non-zero arguments.
7562  * If all arguments are zero, zero is returned.
7563  */
7564 uint32_t
7565 sctp_min_mtu(uint32_t mtu1, uint32_t mtu2, uint32_t mtu3)
7566 {
7567         if (mtu1 > 0) {
7568                 if (mtu2 > 0) {
7569                         if (mtu3 > 0) {
7570                                 return (min(mtu1, min(mtu2, mtu3)));
7571                         } else {
7572                                 return (min(mtu1, mtu2));
7573                         }
7574                 } else {
7575                         if (mtu3 > 0) {
7576                                 return (min(mtu1, mtu3));
7577                         } else {
7578                                 return (mtu1);
7579                         }
7580                 }
7581         } else {
7582                 if (mtu2 > 0) {
7583                         if (mtu3 > 0) {
7584                                 return (min(mtu2, mtu3));
7585                         } else {
7586                                 return (mtu2);
7587                         }
7588                 } else {
7589                         return (mtu3);
7590                 }
7591         }
7592 }
7593
7594 void
7595 sctp_hc_set_mtu(union sctp_sockstore *addr, uint16_t fibnum, uint32_t mtu)
7596 {
7597         struct in_conninfo inc;
7598
7599         memset(&inc, 0, sizeof(struct in_conninfo));
7600         inc.inc_fibnum = fibnum;
7601         switch (addr->sa.sa_family) {
7602 #ifdef INET
7603         case AF_INET:
7604                 inc.inc_faddr = addr->sin.sin_addr;
7605                 break;
7606 #endif
7607 #ifdef INET6
7608         case AF_INET6:
7609                 inc.inc_flags |= INC_ISIPV6;
7610                 inc.inc6_faddr = addr->sin6.sin6_addr;
7611                 break;
7612 #endif
7613         default:
7614                 return;
7615         }
7616         tcp_hc_updatemtu(&inc, (u_long)mtu);
7617 }
7618
7619 uint32_t
7620 sctp_hc_get_mtu(union sctp_sockstore *addr, uint16_t fibnum)
7621 {
7622         struct in_conninfo inc;
7623
7624         memset(&inc, 0, sizeof(struct in_conninfo));
7625         inc.inc_fibnum = fibnum;
7626         switch (addr->sa.sa_family) {
7627 #ifdef INET
7628         case AF_INET:
7629                 inc.inc_faddr = addr->sin.sin_addr;
7630                 break;
7631 #endif
7632 #ifdef INET6
7633         case AF_INET6:
7634                 inc.inc_flags |= INC_ISIPV6;
7635                 inc.inc6_faddr = addr->sin6.sin6_addr;
7636                 break;
7637 #endif
7638         default:
7639                 return (0);
7640         }
7641         return ((uint32_t)tcp_hc_getmtu(&inc));
7642 }
7643
7644 void
7645 sctp_set_state(struct sctp_tcb *stcb, int new_state)
7646 {
7647 #if defined(KDTRACE_HOOKS)
7648         int old_state = stcb->asoc.state;
7649 #endif
7650
7651         KASSERT((new_state & ~SCTP_STATE_MASK) == 0,
7652             ("sctp_set_state: Can't set substate (new_state = %x)",
7653             new_state));
7654         stcb->asoc.state = (stcb->asoc.state & ~SCTP_STATE_MASK) | new_state;
7655         if ((new_state == SCTP_STATE_SHUTDOWN_RECEIVED) ||
7656             (new_state == SCTP_STATE_SHUTDOWN_SENT) ||
7657             (new_state == SCTP_STATE_SHUTDOWN_ACK_SENT)) {
7658                 SCTP_CLEAR_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING);
7659         }
7660 #if defined(KDTRACE_HOOKS)
7661         if (((old_state & SCTP_STATE_MASK) != new_state) &&
7662             !(((old_state & SCTP_STATE_MASK) == SCTP_STATE_EMPTY) &&
7663             (new_state == SCTP_STATE_INUSE))) {
7664                 SCTP_PROBE6(state__change, NULL, stcb, NULL, stcb, NULL, old_state);
7665         }
7666 #endif
7667 }
7668
7669 void
7670 sctp_add_substate(struct sctp_tcb *stcb, int substate)
7671 {
7672 #if defined(KDTRACE_HOOKS)
7673         int old_state = stcb->asoc.state;
7674 #endif
7675
7676         KASSERT((substate & SCTP_STATE_MASK) == 0,
7677             ("sctp_add_substate: Can't set state (substate = %x)",
7678             substate));
7679         stcb->asoc.state |= substate;
7680 #if defined(KDTRACE_HOOKS)
7681         if (((substate & SCTP_STATE_ABOUT_TO_BE_FREED) &&
7682             ((old_state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0)) ||
7683             ((substate & SCTP_STATE_SHUTDOWN_PENDING) &&
7684             ((old_state & SCTP_STATE_SHUTDOWN_PENDING) == 0))) {
7685                 SCTP_PROBE6(state__change, NULL, stcb, NULL, stcb, NULL, old_state);
7686         }
7687 #endif
7688 }