sys/netinet/sctputil.c

   1 /*-
   2  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_pcb.h>
  38 #include <netinet/sctputil.h>
  39 #include <netinet/sctp_var.h>
  40 #include <netinet/sctp_sysctl.h>
  41 #ifdef INET6
  42 #include <netinet6/sctp6_var.h>
  43 #endif
  44 #include <netinet/sctp_header.h>
  45 #include <netinet/sctp_output.h>
  46 #include <netinet/sctp_uio.h>
  47 #include <netinet/sctp_timer.h>
  48 #include <netinet/sctp_indata.h>/* for sctp_deliver_data() */
  49 #include <netinet/sctp_auth.h>
  50 #include <netinet/sctp_asconf.h>
  51 #include <netinet/sctp_bsd_addr.h>
  52 #include <netinet/udp.h>
  53 #include <netinet/udp_var.h>
  54 #include <sys/proc.h>
  55
  56
  57 #ifndef KTR_SCTP
  58 #define KTR_SCTP KTR_SUBSYS
  59 #endif
  60
  61 extern struct sctp_cc_functions sctp_cc_functions[];
  62 extern struct sctp_ss_functions sctp_ss_functions[];
  63
  64 void
  65 sctp_sblog(struct sockbuf *sb, struct sctp_tcb *stcb, int from, int incr)
  66 {
  67         struct sctp_cwnd_log sctp_clog;
  68
  69         sctp_clog.x.sb.stcb = stcb;
  70         sctp_clog.x.sb.so_sbcc = sb->sb_cc;
  71         if (stcb)
  72                 sctp_clog.x.sb.stcb_sbcc = stcb->asoc.sb_cc;
  73         else
  74                 sctp_clog.x.sb.stcb_sbcc = 0;
  75         sctp_clog.x.sb.incr = incr;
  76         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
  77             SCTP_LOG_EVENT_SB,
  78             from,
  79             sctp_clog.x.misc.log1,
  80             sctp_clog.x.misc.log2,
  81             sctp_clog.x.misc.log3,
  82             sctp_clog.x.misc.log4);
  83 }
  84
  85 void
  86 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc)
  87 {
  88         struct sctp_cwnd_log sctp_clog;
  89
  90         sctp_clog.x.close.inp = (void *)inp;
  91         sctp_clog.x.close.sctp_flags = inp->sctp_flags;
  92         if (stcb) {
  93                 sctp_clog.x.close.stcb = (void *)stcb;
  94                 sctp_clog.x.close.state = (uint16_t) stcb->asoc.state;
  95         } else {
  96                 sctp_clog.x.close.stcb = 0;
  97                 sctp_clog.x.close.state = 0;
  98         }
  99         sctp_clog.x.close.loc = loc;
 100         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 101             SCTP_LOG_EVENT_CLOSE,
 102             0,
 103             sctp_clog.x.misc.log1,
 104             sctp_clog.x.misc.log2,
 105             sctp_clog.x.misc.log3,
 106             sctp_clog.x.misc.log4);
 107 }
 108
 109 void
 110 rto_logging(struct sctp_nets *net, int from)
 111 {
 112         struct sctp_cwnd_log sctp_clog;
 113
 114         memset(&sctp_clog, 0, sizeof(sctp_clog));
 115         sctp_clog.x.rto.net = (void *)net;
 116         sctp_clog.x.rto.rtt = net->rtt / 1000;
 117         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 118             SCTP_LOG_EVENT_RTT,
 119             from,
 120             sctp_clog.x.misc.log1,
 121             sctp_clog.x.misc.log2,
 122             sctp_clog.x.misc.log3,
 123             sctp_clog.x.misc.log4);
 124 }
 125
 126 void
 127 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from)
 128 {
 129         struct sctp_cwnd_log sctp_clog;
 130
 131         sctp_clog.x.strlog.stcb = stcb;
 132         sctp_clog.x.strlog.n_tsn = tsn;
 133         sctp_clog.x.strlog.n_sseq = sseq;
 134         sctp_clog.x.strlog.e_tsn = 0;
 135         sctp_clog.x.strlog.e_sseq = 0;
 136         sctp_clog.x.strlog.strm = stream;
 137         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 138             SCTP_LOG_EVENT_STRM,
 139             from,
 140             sctp_clog.x.misc.log1,
 141             sctp_clog.x.misc.log2,
 142             sctp_clog.x.misc.log3,
 143             sctp_clog.x.misc.log4);
 144 }
 145
 146 void
 147 sctp_log_nagle_event(struct sctp_tcb *stcb, int action)
 148 {
 149         struct sctp_cwnd_log sctp_clog;
 150
 151         sctp_clog.x.nagle.stcb = (void *)stcb;
 152         sctp_clog.x.nagle.total_flight = stcb->asoc.total_flight;
 153         sctp_clog.x.nagle.total_in_queue = stcb->asoc.total_output_queue_size;
 154         sctp_clog.x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue;
 155         sctp_clog.x.nagle.count_in_flight = stcb->asoc.total_flight_count;
 156         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 157             SCTP_LOG_EVENT_NAGLE,
 158             action,
 159             sctp_clog.x.misc.log1,
 160             sctp_clog.x.misc.log2,
 161             sctp_clog.x.misc.log3,
 162             sctp_clog.x.misc.log4);
 163 }
 164
 165 void
 166 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from)
 167 {
 168         struct sctp_cwnd_log sctp_clog;
 169
 170         sctp_clog.x.sack.cumack = cumack;
 171         sctp_clog.x.sack.oldcumack = old_cumack;
 172         sctp_clog.x.sack.tsn = tsn;
 173         sctp_clog.x.sack.numGaps = gaps;
 174         sctp_clog.x.sack.numDups = dups;
 175         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 176             SCTP_LOG_EVENT_SACK,
 177             from,
 178             sctp_clog.x.misc.log1,
 179             sctp_clog.x.misc.log2,
 180             sctp_clog.x.misc.log3,
 181             sctp_clog.x.misc.log4);
 182 }
 183
 184 void
 185 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from)
 186 {
 187         struct sctp_cwnd_log sctp_clog;
 188
 189         memset(&sctp_clog, 0, sizeof(sctp_clog));
 190         sctp_clog.x.map.base = map;
 191         sctp_clog.x.map.cum = cum;
 192         sctp_clog.x.map.high = high;
 193         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 194             SCTP_LOG_EVENT_MAP,
 195             from,
 196             sctp_clog.x.misc.log1,
 197             sctp_clog.x.misc.log2,
 198             sctp_clog.x.misc.log3,
 199             sctp_clog.x.misc.log4);
 200 }
 201
 202 void
 203 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn, int from)
 204 {
 205         struct sctp_cwnd_log sctp_clog;
 206
 207         memset(&sctp_clog, 0, sizeof(sctp_clog));
 208         sctp_clog.x.fr.largest_tsn = biggest_tsn;
 209         sctp_clog.x.fr.largest_new_tsn = biggest_new_tsn;
 210         sctp_clog.x.fr.tsn = tsn;
 211         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 212             SCTP_LOG_EVENT_FR,
 213             from,
 214             sctp_clog.x.misc.log1,
 215             sctp_clog.x.misc.log2,
 216             sctp_clog.x.misc.log3,
 217             sctp_clog.x.misc.log4);
 218 }
 219
 220 void
 221 sctp_log_mb(struct mbuf *m, int from)
 222 {
 223         struct sctp_cwnd_log sctp_clog;
 224
 225         sctp_clog.x.mb.mp = m;
 226         sctp_clog.x.mb.mbuf_flags = (uint8_t) (SCTP_BUF_GET_FLAGS(m));
 227         sctp_clog.x.mb.size = (uint16_t) (SCTP_BUF_LEN(m));
 228         sctp_clog.x.mb.data = SCTP_BUF_AT(m, 0);
 229         if (SCTP_BUF_IS_EXTENDED(m)) {
 230                 sctp_clog.x.mb.ext = SCTP_BUF_EXTEND_BASE(m);
 231                 sctp_clog.x.mb.refcnt = (uint8_t) (SCTP_BUF_EXTEND_REFCNT(m));
 232         } else {
 233                 sctp_clog.x.mb.ext = 0;
 234                 sctp_clog.x.mb.refcnt = 0;
 235         }
 236         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 237             SCTP_LOG_EVENT_MBUF,
 238             from,
 239             sctp_clog.x.misc.log1,
 240             sctp_clog.x.misc.log2,
 241             sctp_clog.x.misc.log3,
 242             sctp_clog.x.misc.log4);
 243 }
 244
 245 void
 246 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk, int from)
 247 {
 248         struct sctp_cwnd_log sctp_clog;
 249
 250         if (control == NULL) {
 251                 SCTP_PRINTF("Gak log of NULL?\n");
 252                 return;
 253         }
 254         sctp_clog.x.strlog.stcb = control->stcb;
 255         sctp_clog.x.strlog.n_tsn = control->sinfo_tsn;
 256         sctp_clog.x.strlog.n_sseq = control->sinfo_ssn;
 257         sctp_clog.x.strlog.strm = control->sinfo_stream;
 258         if (poschk != NULL) {
 259                 sctp_clog.x.strlog.e_tsn = poschk->sinfo_tsn;
 260                 sctp_clog.x.strlog.e_sseq = poschk->sinfo_ssn;
 261         } else {
 262                 sctp_clog.x.strlog.e_tsn = 0;
 263                 sctp_clog.x.strlog.e_sseq = 0;
 264         }
 265         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 266             SCTP_LOG_EVENT_STRM,
 267             from,
 268             sctp_clog.x.misc.log1,
 269             sctp_clog.x.misc.log2,
 270             sctp_clog.x.misc.log3,
 271             sctp_clog.x.misc.log4);
 272 }
 273
 274 void
 275 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from)
 276 {
 277         struct sctp_cwnd_log sctp_clog;
 278
 279         sctp_clog.x.cwnd.net = net;
 280         if (stcb->asoc.send_queue_cnt > 255)
 281                 sctp_clog.x.cwnd.cnt_in_send = 255;
 282         else
 283                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 284         if (stcb->asoc.stream_queue_cnt > 255)
 285                 sctp_clog.x.cwnd.cnt_in_str = 255;
 286         else
 287                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 288
 289         if (net) {
 290                 sctp_clog.x.cwnd.cwnd_new_value = net->cwnd;
 291                 sctp_clog.x.cwnd.inflight = net->flight_size;
 292                 sctp_clog.x.cwnd.pseudo_cumack = net->pseudo_cumack;
 293                 sctp_clog.x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack;
 294                 sctp_clog.x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack;
 295         }
 296         if (SCTP_CWNDLOG_PRESEND == from) {
 297                 sctp_clog.x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd;
 298         }
 299         sctp_clog.x.cwnd.cwnd_augment = augment;
 300         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 301             SCTP_LOG_EVENT_CWND,
 302             from,
 303             sctp_clog.x.misc.log1,
 304             sctp_clog.x.misc.log2,
 305             sctp_clog.x.misc.log3,
 306             sctp_clog.x.misc.log4);
 307 }
 308
 309 void
 310 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from)
 311 {
 312         struct sctp_cwnd_log sctp_clog;
 313
 314         memset(&sctp_clog, 0, sizeof(sctp_clog));
 315         if (inp) {
 316                 sctp_clog.x.lock.sock = (void *)inp->sctp_socket;
 317
 318         } else {
 319                 sctp_clog.x.lock.sock = (void *)NULL;
 320         }
 321         sctp_clog.x.lock.inp = (void *)inp;
 322         if (stcb) {
 323                 sctp_clog.x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx);
 324         } else {
 325                 sctp_clog.x.lock.tcb_lock = SCTP_LOCK_UNKNOWN;
 326         }
 327         if (inp) {
 328                 sctp_clog.x.lock.inp_lock = mtx_owned(&inp->inp_mtx);
 329                 sctp_clog.x.lock.create_lock = mtx_owned(&inp->inp_create_mtx);
 330         } else {
 331                 sctp_clog.x.lock.inp_lock = SCTP_LOCK_UNKNOWN;
 332                 sctp_clog.x.lock.create_lock = SCTP_LOCK_UNKNOWN;
 333         }
 334         sctp_clog.x.lock.info_lock = rw_wowned(&SCTP_BASE_INFO(ipi_ep_mtx));
 335         if (inp && (inp->sctp_socket)) {
 336                 sctp_clog.x.lock.sock_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 337                 sctp_clog.x.lock.sockrcvbuf_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 338                 sctp_clog.x.lock.socksndbuf_lock = mtx_owned(&(inp->sctp_socket->so_snd.sb_mtx));
 339         } else {
 340                 sctp_clog.x.lock.sock_lock = SCTP_LOCK_UNKNOWN;
 341                 sctp_clog.x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN;
 342                 sctp_clog.x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN;
 343         }
 344         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 345             SCTP_LOG_LOCK_EVENT,
 346             from,
 347             sctp_clog.x.misc.log1,
 348             sctp_clog.x.misc.log2,
 349             sctp_clog.x.misc.log3,
 350             sctp_clog.x.misc.log4);
 351 }
 352
 353 void
 354 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from)
 355 {
 356         struct sctp_cwnd_log sctp_clog;
 357
 358         memset(&sctp_clog, 0, sizeof(sctp_clog));
 359         sctp_clog.x.cwnd.net = net;
 360         sctp_clog.x.cwnd.cwnd_new_value = error;
 361         sctp_clog.x.cwnd.inflight = net->flight_size;
 362         sctp_clog.x.cwnd.cwnd_augment = burst;
 363         if (stcb->asoc.send_queue_cnt > 255)
 364                 sctp_clog.x.cwnd.cnt_in_send = 255;
 365         else
 366                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 367         if (stcb->asoc.stream_queue_cnt > 255)
 368                 sctp_clog.x.cwnd.cnt_in_str = 255;
 369         else
 370                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 371         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 372             SCTP_LOG_EVENT_MAXBURST,
 373             from,
 374             sctp_clog.x.misc.log1,
 375             sctp_clog.x.misc.log2,
 376             sctp_clog.x.misc.log3,
 377             sctp_clog.x.misc.log4);
 378 }
 379
 380 void
 381 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead)
 382 {
 383         struct sctp_cwnd_log sctp_clog;
 384
 385         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 386         sctp_clog.x.rwnd.send_size = snd_size;
 387         sctp_clog.x.rwnd.overhead = overhead;
 388         sctp_clog.x.rwnd.new_rwnd = 0;
 389         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 390             SCTP_LOG_EVENT_RWND,
 391             from,
 392             sctp_clog.x.misc.log1,
 393             sctp_clog.x.misc.log2,
 394             sctp_clog.x.misc.log3,
 395             sctp_clog.x.misc.log4);
 396 }
 397
 398 void
 399 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval)
 400 {
 401         struct sctp_cwnd_log sctp_clog;
 402
 403         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 404         sctp_clog.x.rwnd.send_size = flight_size;
 405         sctp_clog.x.rwnd.overhead = overhead;
 406         sctp_clog.x.rwnd.new_rwnd = a_rwndval;
 407         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 408             SCTP_LOG_EVENT_RWND,
 409             from,
 410             sctp_clog.x.misc.log1,
 411             sctp_clog.x.misc.log2,
 412             sctp_clog.x.misc.log3,
 413             sctp_clog.x.misc.log4);
 414 }
 415
 416 void
 417 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt)
 418 {
 419         struct sctp_cwnd_log sctp_clog;
 420
 421         sctp_clog.x.mbcnt.total_queue_size = total_oq;
 422         sctp_clog.x.mbcnt.size_change = book;
 423         sctp_clog.x.mbcnt.total_queue_mb_size = total_mbcnt_q;
 424         sctp_clog.x.mbcnt.mbcnt_change = mbcnt;
 425         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 426             SCTP_LOG_EVENT_MBCNT,
 427             from,
 428             sctp_clog.x.misc.log1,
 429             sctp_clog.x.misc.log2,
 430             sctp_clog.x.misc.log3,
 431             sctp_clog.x.misc.log4);
 432 }
 433
 434 void
 435 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d)
 436 {
 437         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 438             SCTP_LOG_MISC_EVENT,
 439             from,
 440             a, b, c, d);
 441 }
 442
 443 void
 444 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t wake_cnt, int from)
 445 {
 446         struct sctp_cwnd_log sctp_clog;
 447
 448         sctp_clog.x.wake.stcb = (void *)stcb;
 449         sctp_clog.x.wake.wake_cnt = wake_cnt;
 450         sctp_clog.x.wake.flight = stcb->asoc.total_flight_count;
 451         sctp_clog.x.wake.send_q = stcb->asoc.send_queue_cnt;
 452         sctp_clog.x.wake.sent_q = stcb->asoc.sent_queue_cnt;
 453
 454         if (stcb->asoc.stream_queue_cnt < 0xff)
 455                 sctp_clog.x.wake.stream_qcnt = (uint8_t) stcb->asoc.stream_queue_cnt;
 456         else
 457                 sctp_clog.x.wake.stream_qcnt = 0xff;
 458
 459         if (stcb->asoc.chunks_on_out_queue < 0xff)
 460                 sctp_clog.x.wake.chunks_on_oque = (uint8_t) stcb->asoc.chunks_on_out_queue;
 461         else
 462                 sctp_clog.x.wake.chunks_on_oque = 0xff;
 463
 464         sctp_clog.x.wake.sctpflags = 0;
 465         /* set in the defered mode stuff */
 466         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE)
 467                 sctp_clog.x.wake.sctpflags |= 1;
 468         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT)
 469                 sctp_clog.x.wake.sctpflags |= 2;
 470         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT)
 471                 sctp_clog.x.wake.sctpflags |= 4;
 472         /* what about the sb */
 473         if (stcb->sctp_socket) {
 474                 struct socket *so = stcb->sctp_socket;
 475
 476                 sctp_clog.x.wake.sbflags = (uint8_t) ((so->so_snd.sb_flags & 0x00ff));
 477         } else {
 478                 sctp_clog.x.wake.sbflags = 0xff;
 479         }
 480         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 481             SCTP_LOG_EVENT_WAKE,
 482             from,
 483             sctp_clog.x.misc.log1,
 484             sctp_clog.x.misc.log2,
 485             sctp_clog.x.misc.log3,
 486             sctp_clog.x.misc.log4);
 487 }
 488
 489 void
 490 sctp_log_block(uint8_t from, struct sctp_association *asoc, int sendlen)
 491 {
 492         struct sctp_cwnd_log sctp_clog;
 493
 494         sctp_clog.x.blk.onsb = asoc->total_output_queue_size;
 495         sctp_clog.x.blk.send_sent_qcnt = (uint16_t) (asoc->send_queue_cnt + asoc->sent_queue_cnt);
 496         sctp_clog.x.blk.peer_rwnd = asoc->peers_rwnd;
 497         sctp_clog.x.blk.stream_qcnt = (uint16_t) asoc->stream_queue_cnt;
 498         sctp_clog.x.blk.chunks_on_oque = (uint16_t) asoc->chunks_on_out_queue;
 499         sctp_clog.x.blk.flight_size = (uint16_t) (asoc->total_flight / 1024);
 500         sctp_clog.x.blk.sndlen = sendlen;
 501         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 502             SCTP_LOG_EVENT_BLOCK,
 503             from,
 504             sctp_clog.x.misc.log1,
 505             sctp_clog.x.misc.log2,
 506             sctp_clog.x.misc.log3,
 507             sctp_clog.x.misc.log4);
 508 }
 509
 510 int
 511 sctp_fill_stat_log(void *optval SCTP_UNUSED, size_t *optsize SCTP_UNUSED)
 512 {
 513         /* May need to fix this if ktrdump does not work */
 514         return (0);
 515 }
 516
 517 #ifdef SCTP_AUDITING_ENABLED
 518 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2];
 519 static int sctp_audit_indx = 0;
 520
 521 static
 522 void
 523 sctp_print_audit_report(void)
 524 {
 525         int i;
 526         int cnt;
 527
 528         cnt = 0;
 529         for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) {
 530                 if ((sctp_audit_data[i][0] == 0xe0) &&
 531                     (sctp_audit_data[i][1] == 0x01)) {
 532                         cnt = 0;
 533                         SCTP_PRINTF("\n");
 534                 } else if (sctp_audit_data[i][0] == 0xf0) {
 535                         cnt = 0;
 536                         SCTP_PRINTF("\n");
 537                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 538                     (sctp_audit_data[i][1] == 0x01)) {
 539                         SCTP_PRINTF("\n");
 540                         cnt = 0;
 541                 }
 542                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0],
 543                     (uint32_t) sctp_audit_data[i][1]);
 544                 cnt++;
 545                 if ((cnt % 14) == 0)
 546                         SCTP_PRINTF("\n");
 547         }
 548         for (i = 0; i < sctp_audit_indx; i++) {
 549                 if ((sctp_audit_data[i][0] == 0xe0) &&
 550                     (sctp_audit_data[i][1] == 0x01)) {
 551                         cnt = 0;
 552                         SCTP_PRINTF("\n");
 553                 } else if (sctp_audit_data[i][0] == 0xf0) {
 554                         cnt = 0;
 555                         SCTP_PRINTF("\n");
 556                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 557                     (sctp_audit_data[i][1] == 0x01)) {
 558                         SCTP_PRINTF("\n");
 559                         cnt = 0;
 560                 }
 561                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0],
 562                     (uint32_t) sctp_audit_data[i][1]);
 563                 cnt++;
 564                 if ((cnt % 14) == 0)
 565                         SCTP_PRINTF("\n");
 566         }
 567         SCTP_PRINTF("\n");
 568 }
 569
 570 void
 571 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 572     struct sctp_nets *net)
 573 {
 574         int resend_cnt, tot_out, rep, tot_book_cnt;
 575         struct sctp_nets *lnet;
 576         struct sctp_tmit_chunk *chk;
 577
 578         sctp_audit_data[sctp_audit_indx][0] = 0xAA;
 579         sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from;
 580         sctp_audit_indx++;
 581         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 582                 sctp_audit_indx = 0;
 583         }
 584         if (inp == NULL) {
 585                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 586                 sctp_audit_data[sctp_audit_indx][1] = 0x01;
 587                 sctp_audit_indx++;
 588                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 589                         sctp_audit_indx = 0;
 590                 }
 591                 return;
 592         }
 593         if (stcb == NULL) {
 594                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 595                 sctp_audit_data[sctp_audit_indx][1] = 0x02;
 596                 sctp_audit_indx++;
 597                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 598                         sctp_audit_indx = 0;
 599                 }
 600                 return;
 601         }
 602         sctp_audit_data[sctp_audit_indx][0] = 0xA1;
 603         sctp_audit_data[sctp_audit_indx][1] =
 604             (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 605         sctp_audit_indx++;
 606         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 607                 sctp_audit_indx = 0;
 608         }
 609         rep = 0;
 610         tot_book_cnt = 0;
 611         resend_cnt = tot_out = 0;
 612         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 613                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 614                         resend_cnt++;
 615                 } else if (chk->sent < SCTP_DATAGRAM_RESEND) {
 616                         tot_out += chk->book_size;
 617                         tot_book_cnt++;
 618                 }
 619         }
 620         if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) {
 621                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 622                 sctp_audit_data[sctp_audit_indx][1] = 0xA1;
 623                 sctp_audit_indx++;
 624                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 625                         sctp_audit_indx = 0;
 626                 }
 627                 SCTP_PRINTF("resend_cnt:%d asoc-tot:%d\n",
 628                     resend_cnt, stcb->asoc.sent_queue_retran_cnt);
 629                 rep = 1;
 630                 stcb->asoc.sent_queue_retran_cnt = resend_cnt;
 631                 sctp_audit_data[sctp_audit_indx][0] = 0xA2;
 632                 sctp_audit_data[sctp_audit_indx][1] =
 633                     (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 634                 sctp_audit_indx++;
 635                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 636                         sctp_audit_indx = 0;
 637                 }
 638         }
 639         if (tot_out != stcb->asoc.total_flight) {
 640                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 641                 sctp_audit_data[sctp_audit_indx][1] = 0xA2;
 642                 sctp_audit_indx++;
 643                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 644                         sctp_audit_indx = 0;
 645                 }
 646                 rep = 1;
 647                 SCTP_PRINTF("tot_flt:%d asoc_tot:%d\n", tot_out,
 648                     (int)stcb->asoc.total_flight);
 649                 stcb->asoc.total_flight = tot_out;
 650         }
 651         if (tot_book_cnt != stcb->asoc.total_flight_count) {
 652                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 653                 sctp_audit_data[sctp_audit_indx][1] = 0xA5;
 654                 sctp_audit_indx++;
 655                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 656                         sctp_audit_indx = 0;
 657                 }
 658                 rep = 1;
 659                 SCTP_PRINTF("tot_flt_book:%d\n", tot_book_cnt);
 660
 661                 stcb->asoc.total_flight_count = tot_book_cnt;
 662         }
 663         tot_out = 0;
 664         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 665                 tot_out += lnet->flight_size;
 666         }
 667         if (tot_out != stcb->asoc.total_flight) {
 668                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 669                 sctp_audit_data[sctp_audit_indx][1] = 0xA3;
 670                 sctp_audit_indx++;
 671                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 672                         sctp_audit_indx = 0;
 673                 }
 674                 rep = 1;
 675                 SCTP_PRINTF("real flight:%d net total was %d\n",
 676                     stcb->asoc.total_flight, tot_out);
 677                 /* now corrective action */
 678                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 679
 680                         tot_out = 0;
 681                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 682                                 if ((chk->whoTo == lnet) &&
 683                                     (chk->sent < SCTP_DATAGRAM_RESEND)) {
 684                                         tot_out += chk->book_size;
 685                                 }
 686                         }
 687                         if (lnet->flight_size != tot_out) {
 688                                 SCTP_PRINTF("net:%p flight was %d corrected to %d\n",
 689                                     (void *)lnet, lnet->flight_size,
 690                                     tot_out);
 691                                 lnet->flight_size = tot_out;
 692                         }
 693                 }
 694         }
 695         if (rep) {
 696                 sctp_print_audit_report();
 697         }
 698 }
 699
 700 void
 701 sctp_audit_log(uint8_t ev, uint8_t fd)
 702 {
 703
 704         sctp_audit_data[sctp_audit_indx][0] = ev;
 705         sctp_audit_data[sctp_audit_indx][1] = fd;
 706         sctp_audit_indx++;
 707         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 708                 sctp_audit_indx = 0;
 709         }
 710 }
 711
 712 #endif
 713
 714 /*
 715  * sctp_stop_timers_for_shutdown() should be called
 716  * when entering the SHUTDOWN_SENT or SHUTDOWN_ACK_SENT
 717  * state to make sure that all timers are stopped.
 718  */
 719 void
 720 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb)
 721 {
 722         struct sctp_association *asoc;
 723         struct sctp_nets *net;
 724
 725         asoc = &stcb->asoc;
 726
 727         (void)SCTP_OS_TIMER_STOP(&asoc->dack_timer.timer);
 728         (void)SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
 729         (void)SCTP_OS_TIMER_STOP(&asoc->asconf_timer.timer);
 730         (void)SCTP_OS_TIMER_STOP(&asoc->autoclose_timer.timer);
 731         (void)SCTP_OS_TIMER_STOP(&asoc->delayed_event_timer.timer);
 732         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
 733                 (void)SCTP_OS_TIMER_STOP(&net->pmtu_timer.timer);
 734                 (void)SCTP_OS_TIMER_STOP(&net->hb_timer.timer);
 735         }
 736 }
 737
 738 /*
 739  * a list of sizes based on typical mtu's, used only if next hop size not
 740  * returned.
 741  */
 742 static uint32_t sctp_mtu_sizes[] = {
 743         68,
 744         296,
 745         508,
 746         512,
 747         544,
 748         576,
 749         1006,
 750         1492,
 751         1500,
 752         1536,
 753         2002,
 754         2048,
 755         4352,
 756         4464,
 757         8166,
 758         17914,
 759         32000,
 760         65535
 761 };
 762
 763 /*
 764  * Return the largest MTU smaller than val. If there is no
 765  * entry, just return val.
 766  */
 767 uint32_t
 768 sctp_get_prev_mtu(uint32_t val)
 769 {
 770         uint32_t i;
 771
 772         if (val <= sctp_mtu_sizes[0]) {
 773                 return (val);
 774         }
 775         for (i = 1; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 776                 if (val <= sctp_mtu_sizes[i]) {
 777                         break;
 778                 }
 779         }
 780         return (sctp_mtu_sizes[i - 1]);
 781 }
 782
 783 /*
 784  * Return the smallest MTU larger than val. If there is no
 785  * entry, just return val.
 786  */
 787 uint32_t
 788 sctp_get_next_mtu(uint32_t val)
 789 {
 790         /* select another MTU that is just bigger than this one */
 791         uint32_t i;
 792
 793         for (i = 0; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 794                 if (val < sctp_mtu_sizes[i]) {
 795                         return (sctp_mtu_sizes[i]);
 796                 }
 797         }
 798         return (val);
 799 }
 800
 801 void
 802 sctp_fill_random_store(struct sctp_pcb *m)
 803 {
 804         /*
 805          * Here we use the MD5/SHA-1 to hash with our good randomNumbers and
 806          * our counter. The result becomes our good random numbers and we
 807          * then setup to give these out. Note that we do no locking to
 808          * protect this. This is ok, since if competing folks call this we
 809          * will get more gobbled gook in the random store which is what we
 810          * want. There is a danger that two guys will use the same random
 811          * numbers, but thats ok too since that is random as well :->
 812          */
 813         m->store_at = 0;
 814         (void)sctp_hmac(SCTP_HMAC, (uint8_t *) m->random_numbers,
 815             sizeof(m->random_numbers), (uint8_t *) & m->random_counter,
 816             sizeof(m->random_counter), (uint8_t *) m->random_store);
 817         m->random_counter++;
 818 }
 819
 820 uint32_t
 821 sctp_select_initial_TSN(struct sctp_pcb *inp)
 822 {
 823         /*
 824          * A true implementation should use random selection process to get
 825          * the initial stream sequence number, using RFC1750 as a good
 826          * guideline
 827          */
 828         uint32_t x, *xp;
 829         uint8_t *p;
 830         int store_at, new_store;
 831
 832         if (inp->initial_sequence_debug != 0) {
 833                 uint32_t ret;
 834
 835                 ret = inp->initial_sequence_debug;
 836                 inp->initial_sequence_debug++;
 837                 return (ret);
 838         }
 839 retry:
 840         store_at = inp->store_at;
 841         new_store = store_at + sizeof(uint32_t);
 842         if (new_store >= (SCTP_SIGNATURE_SIZE - 3)) {
 843                 new_store = 0;
 844         }
 845         if (!atomic_cmpset_int(&inp->store_at, store_at, new_store)) {
 846                 goto retry;
 847         }
 848         if (new_store == 0) {
 849                 /* Refill the random store */
 850                 sctp_fill_random_store(inp);
 851         }
 852         p = &inp->random_store[store_at];
 853         xp = (uint32_t *) p;
 854         x = *xp;
 855         return (x);
 856 }
 857
 858 uint32_t
 859 sctp_select_a_tag(struct sctp_inpcb *inp, uint16_t lport, uint16_t rport, int check)
 860 {
 861         uint32_t x;
 862         struct timeval now;
 863
 864         if (check) {
 865                 (void)SCTP_GETTIME_TIMEVAL(&now);
 866         }
 867         for (;;) {
 868                 x = sctp_select_initial_TSN(&inp->sctp_ep);
 869                 if (x == 0) {
 870                         /* we never use 0 */
 871                         continue;
 872                 }
 873                 if (!check || sctp_is_vtag_good(x, lport, rport, &now)) {
 874                         break;
 875                 }
 876         }
 877         return (x);
 878 }
 879
 880 int
 881 sctp_init_asoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 882     uint32_t override_tag, uint32_t vrf_id)
 883 {
 884         struct sctp_association *asoc;
 885
 886         /*
 887          * Anything set to zero is taken care of by the allocation routine's
 888          * bzero
 889          */
 890
 891         /*
 892          * Up front select what scoping to apply on addresses I tell my peer
 893          * Not sure what to do with these right now, we will need to come up
 894          * with a way to set them. We may need to pass them through from the
 895          * caller in the sctp_aloc_assoc() function.
 896          */
 897         int i;
 898
 899         asoc = &stcb->asoc;
 900         /* init all variables to a known value. */
 901         SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_INUSE);
 902         asoc->max_burst = inp->sctp_ep.max_burst;
 903         asoc->fr_max_burst = inp->sctp_ep.fr_max_burst;
 904         asoc->heart_beat_delay = TICKS_TO_MSEC(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]);
 905         asoc->cookie_life = inp->sctp_ep.def_cookie_life;
 906         asoc->sctp_cmt_on_off = inp->sctp_cmt_on_off;
 907         asoc->ecn_allowed = inp->sctp_ecn_enable;
 908         asoc->sctp_nr_sack_on_off = (uint8_t) SCTP_BASE_SYSCTL(sctp_nr_sack_on_off);
 909         asoc->sctp_cmt_pf = (uint8_t) 0;
 910         asoc->sctp_frag_point = inp->sctp_frag_point;
 911         asoc->sctp_features = inp->sctp_features;
 912         asoc->default_dscp = inp->sctp_ep.default_dscp;
 913 #ifdef INET6
 914         if (inp->sctp_ep.default_flowlabel) {
 915                 asoc->default_flowlabel = inp->sctp_ep.default_flowlabel;
 916         } else {
 917                 if (inp->ip_inp.inp.inp_flags & IN6P_AUTOFLOWLABEL) {
 918                         asoc->default_flowlabel = sctp_select_initial_TSN(&inp->sctp_ep);
 919                         asoc->default_flowlabel &= 0x000fffff;
 920                         asoc->default_flowlabel |= 0x80000000;
 921                 } else {
 922                         asoc->default_flowlabel = 0;
 923                 }
 924         }
 925 #endif
 926         asoc->sb_send_resv = 0;
 927         if (override_tag) {
 928                 asoc->my_vtag = override_tag;
 929         } else {
 930                 asoc->my_vtag = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
 931         }
 932         /* Get the nonce tags */
 933         asoc->my_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
 934         asoc->peer_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
 935         asoc->vrf_id = vrf_id;
 936
 937 #ifdef SCTP_ASOCLOG_OF_TSNS
 938         asoc->tsn_in_at = 0;
 939         asoc->tsn_out_at = 0;
 940         asoc->tsn_in_wrapped = 0;
 941         asoc->tsn_out_wrapped = 0;
 942         asoc->cumack_log_at = 0;
 943         asoc->cumack_log_atsnt = 0;
 944 #endif
 945 #ifdef SCTP_FS_SPEC_LOG
 946         asoc->fs_index = 0;
 947 #endif
 948         asoc->refcnt = 0;
 949         asoc->assoc_up_sent = 0;
 950         asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number = asoc->sending_seq =
 951             sctp_select_initial_TSN(&inp->sctp_ep);
 952         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
 953         /* we are optimisitic here */
 954         asoc->peer_supports_pktdrop = 1;
 955         asoc->peer_supports_nat = 0;
 956         asoc->sent_queue_retran_cnt = 0;
 957
 958         /* for CMT */
 959         asoc->last_net_cmt_send_started = NULL;
 960
 961         /* This will need to be adjusted */
 962         asoc->last_acked_seq = asoc->init_seq_number - 1;
 963         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
 964         asoc->asconf_seq_in = asoc->last_acked_seq;
 965
 966         /* here we are different, we hold the next one we expect */
 967         asoc->str_reset_seq_in = asoc->last_acked_seq + 1;
 968
 969         asoc->initial_init_rto_max = inp->sctp_ep.initial_init_rto_max;
 970         asoc->initial_rto = inp->sctp_ep.initial_rto;
 971
 972         asoc->max_init_times = inp->sctp_ep.max_init_times;
 973         asoc->max_send_times = inp->sctp_ep.max_send_times;
 974         asoc->def_net_failure = inp->sctp_ep.def_net_failure;
 975         asoc->def_net_pf_threshold = inp->sctp_ep.def_net_pf_threshold;
 976         asoc->free_chunk_cnt = 0;
 977
 978         asoc->iam_blocking = 0;
 979         asoc->context = inp->sctp_context;
 980         asoc->local_strreset_support = inp->local_strreset_support;
 981         asoc->def_send = inp->def_send;
 982         asoc->delayed_ack = TICKS_TO_MSEC(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]);
 983         asoc->sack_freq = inp->sctp_ep.sctp_sack_freq;
 984         asoc->pr_sctp_cnt = 0;
 985         asoc->total_output_queue_size = 0;
 986
 987         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
 988                 asoc->scope.ipv6_addr_legal = 1;
 989                 if (SCTP_IPV6_V6ONLY(inp) == 0) {
 990                         asoc->scope.ipv4_addr_legal = 1;
 991                 } else {
 992                         asoc->scope.ipv4_addr_legal = 0;
 993                 }
 994         } else {
 995                 asoc->scope.ipv6_addr_legal = 0;
 996                 asoc->scope.ipv4_addr_legal = 1;
 997         }
 998
 999         asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(inp->sctp_socket), SCTP_MINIMAL_RWND);
1000         asoc->peers_rwnd = SCTP_SB_LIMIT_RCV(inp->sctp_socket);
1001
1002         asoc->smallest_mtu = inp->sctp_frag_point;
1003         asoc->minrto = inp->sctp_ep.sctp_minrto;
1004         asoc->maxrto = inp->sctp_ep.sctp_maxrto;
1005
1006         asoc->locked_on_sending = NULL;
1007         asoc->stream_locked_on = 0;
1008         asoc->ecn_echo_cnt_onq = 0;
1009         asoc->stream_locked = 0;
1010
1011         asoc->send_sack = 1;
1012
1013         LIST_INIT(&asoc->sctp_restricted_addrs);
1014
1015         TAILQ_INIT(&asoc->nets);
1016         TAILQ_INIT(&asoc->pending_reply_queue);
1017         TAILQ_INIT(&asoc->asconf_ack_sent);
1018         /* Setup to fill the hb random cache at first HB */
1019         asoc->hb_random_idx = 4;
1020
1021         asoc->sctp_autoclose_ticks = inp->sctp_ep.auto_close_time;
1022
1023         stcb->asoc.congestion_control_module = inp->sctp_ep.sctp_default_cc_module;
1024         stcb->asoc.cc_functions = sctp_cc_functions[inp->sctp_ep.sctp_default_cc_module];
1025
1026         stcb->asoc.stream_scheduling_module = inp->sctp_ep.sctp_default_ss_module;
1027         stcb->asoc.ss_functions = sctp_ss_functions[inp->sctp_ep.sctp_default_ss_module];
1028
1029         /*
1030          * Now the stream parameters, here we allocate space for all streams
1031          * that we request by default.
1032          */
1033         asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams =
1034             inp->sctp_ep.pre_open_stream_count;
1035         SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *,
1036             asoc->streamoutcnt * sizeof(struct sctp_stream_out),
1037             SCTP_M_STRMO);
1038         if (asoc->strmout == NULL) {
1039                 /* big trouble no memory */
1040                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1041                 return (ENOMEM);
1042         }
1043         for (i = 0; i < asoc->streamoutcnt; i++) {
1044                 /*
1045                  * inbound side must be set to 0xffff, also NOTE when we get
1046                  * the INIT-ACK back (for INIT sender) we MUST reduce the
1047                  * count (streamoutcnt) but first check if we sent to any of
1048                  * the upper streams that were dropped (if some were). Those
1049                  * that were dropped must be notified to the upper layer as
1050                  * failed to send.
1051                  */
1052                 asoc->strmout[i].next_sequence_send = 0x0;
1053                 TAILQ_INIT(&asoc->strmout[i].outqueue);
1054                 asoc->strmout[i].chunks_on_queues = 0;
1055                 asoc->strmout[i].stream_no = i;
1056                 asoc->strmout[i].last_msg_incomplete = 0;
1057                 asoc->ss_functions.sctp_ss_init_stream(&asoc->strmout[i], NULL);
1058         }
1059         asoc->ss_functions.sctp_ss_init(stcb, asoc, 0);
1060
1061         /* Now the mapping array */
1062         asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY;
1063         SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size,
1064             SCTP_M_MAP);
1065         if (asoc->mapping_array == NULL) {
1066                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1067                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1068                 return (ENOMEM);
1069         }
1070         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
1071         SCTP_MALLOC(asoc->nr_mapping_array, uint8_t *, asoc->mapping_array_size,
1072             SCTP_M_MAP);
1073         if (asoc->nr_mapping_array == NULL) {
1074                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1075                 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1076                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1077                 return (ENOMEM);
1078         }
1079         memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
1080
1081         /* Now the init of the other outqueues */
1082         TAILQ_INIT(&asoc->free_chunks);
1083         TAILQ_INIT(&asoc->control_send_queue);
1084         TAILQ_INIT(&asoc->asconf_send_queue);
1085         TAILQ_INIT(&asoc->send_queue);
1086         TAILQ_INIT(&asoc->sent_queue);
1087         TAILQ_INIT(&asoc->reasmqueue);
1088         TAILQ_INIT(&asoc->resetHead);
1089         asoc->max_inbound_streams = inp->sctp_ep.max_open_streams_intome;
1090         TAILQ_INIT(&asoc->asconf_queue);
1091         /* authentication fields */
1092         asoc->authinfo.random = NULL;
1093         asoc->authinfo.active_keyid = 0;
1094         asoc->authinfo.assoc_key = NULL;
1095         asoc->authinfo.assoc_keyid = 0;
1096         asoc->authinfo.recv_key = NULL;
1097         asoc->authinfo.recv_keyid = 0;
1098         LIST_INIT(&asoc->shared_keys);
1099         asoc->marked_retrans = 0;
1100         asoc->port = inp->sctp_ep.port;
1101         asoc->timoinit = 0;
1102         asoc->timodata = 0;
1103         asoc->timosack = 0;
1104         asoc->timoshutdown = 0;
1105         asoc->timoheartbeat = 0;
1106         asoc->timocookie = 0;
1107         asoc->timoshutdownack = 0;
1108         (void)SCTP_GETTIME_TIMEVAL(&asoc->start_time);
1109         asoc->discontinuity_time = asoc->start_time;
1110         /*
1111          * sa_ignore MEMLEAK {memory is put in the assoc mapping array and
1112          * freed later when the association is freed.
1113          */
1114         return (0);
1115 }
1116
1117 void
1118 sctp_print_mapping_array(struct sctp_association *asoc)
1119 {
1120         unsigned int i, limit;
1121
1122         SCTP_PRINTF("Mapping array size: %d, baseTSN: %8.8x, cumAck: %8.8x, highestTSN: (%8.8x, %8.8x).\n",
1123             asoc->mapping_array_size,
1124             asoc->mapping_array_base_tsn,
1125             asoc->cumulative_tsn,
1126             asoc->highest_tsn_inside_map,
1127             asoc->highest_tsn_inside_nr_map);
1128         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1129                 if (asoc->mapping_array[limit - 1] != 0) {
1130                         break;
1131                 }
1132         }
1133         SCTP_PRINTF("Renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1134         for (i = 0; i < limit; i++) {
1135                 SCTP_PRINTF("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1136         }
1137         if (limit % 16)
1138                 SCTP_PRINTF("\n");
1139         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1140                 if (asoc->nr_mapping_array[limit - 1]) {
1141                         break;
1142                 }
1143         }
1144         SCTP_PRINTF("Non renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1145         for (i = 0; i < limit; i++) {
1146                 SCTP_PRINTF("%2.2x%c", asoc->nr_mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1147         }
1148         if (limit % 16)
1149                 SCTP_PRINTF("\n");
1150 }
1151
1152 int
1153 sctp_expand_mapping_array(struct sctp_association *asoc, uint32_t needed)
1154 {
1155         /* mapping array needs to grow */
1156         uint8_t *new_array1, *new_array2;
1157         uint32_t new_size;
1158
1159         new_size = asoc->mapping_array_size + ((needed + 7) / 8 + SCTP_MAPPING_ARRAY_INCR);
1160         SCTP_MALLOC(new_array1, uint8_t *, new_size, SCTP_M_MAP);
1161         SCTP_MALLOC(new_array2, uint8_t *, new_size, SCTP_M_MAP);
1162         if ((new_array1 == NULL) || (new_array2 == NULL)) {
1163                 /* can't get more, forget it */
1164                 SCTP_PRINTF("No memory for expansion of SCTP mapping array %d\n", new_size);
1165                 if (new_array1) {
1166                         SCTP_FREE(new_array1, SCTP_M_MAP);
1167                 }
1168                 if (new_array2) {
1169                         SCTP_FREE(new_array2, SCTP_M_MAP);
1170                 }
1171                 return (-1);
1172         }
1173         memset(new_array1, 0, new_size);
1174         memset(new_array2, 0, new_size);
1175         memcpy(new_array1, asoc->mapping_array, asoc->mapping_array_size);
1176         memcpy(new_array2, asoc->nr_mapping_array, asoc->mapping_array_size);
1177         SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1178         SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
1179         asoc->mapping_array = new_array1;
1180         asoc->nr_mapping_array = new_array2;
1181         asoc->mapping_array_size = new_size;
1182         return (0);
1183 }
1184
1185
1186 static void
1187 sctp_iterator_work(struct sctp_iterator *it)
1188 {
1189         int iteration_count = 0;
1190         int inp_skip = 0;
1191         int first_in = 1;
1192         struct sctp_inpcb *tinp;
1193
1194         SCTP_INP_INFO_RLOCK();
1195         SCTP_ITERATOR_LOCK();
1196         if (it->inp) {
1197                 SCTP_INP_RLOCK(it->inp);
1198                 SCTP_INP_DECR_REF(it->inp);
1199         }
1200         if (it->inp == NULL) {
1201                 /* iterator is complete */
1202 done_with_iterator:
1203                 SCTP_ITERATOR_UNLOCK();
1204                 SCTP_INP_INFO_RUNLOCK();
1205                 if (it->function_atend != NULL) {
1206                         (*it->function_atend) (it->pointer, it->val);
1207                 }
1208                 SCTP_FREE(it, SCTP_M_ITER);
1209                 return;
1210         }
1211 select_a_new_ep:
1212         if (first_in) {
1213                 first_in = 0;
1214         } else {
1215                 SCTP_INP_RLOCK(it->inp);
1216         }
1217         while (((it->pcb_flags) &&
1218             ((it->inp->sctp_flags & it->pcb_flags) != it->pcb_flags)) ||
1219             ((it->pcb_features) &&
1220             ((it->inp->sctp_features & it->pcb_features) != it->pcb_features))) {
1221                 /* endpoint flags or features don't match, so keep looking */
1222                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1223                         SCTP_INP_RUNLOCK(it->inp);
1224                         goto done_with_iterator;
1225                 }
1226                 tinp = it->inp;
1227                 it->inp = LIST_NEXT(it->inp, sctp_list);
1228                 SCTP_INP_RUNLOCK(tinp);
1229                 if (it->inp == NULL) {
1230                         goto done_with_iterator;
1231                 }
1232                 SCTP_INP_RLOCK(it->inp);
1233         }
1234         /* now go through each assoc which is in the desired state */
1235         if (it->done_current_ep == 0) {
1236                 if (it->function_inp != NULL)
1237                         inp_skip = (*it->function_inp) (it->inp, it->pointer, it->val);
1238                 it->done_current_ep = 1;
1239         }
1240         if (it->stcb == NULL) {
1241                 /* run the per instance function */
1242                 it->stcb = LIST_FIRST(&it->inp->sctp_asoc_list);
1243         }
1244         if ((inp_skip) || it->stcb == NULL) {
1245                 if (it->function_inp_end != NULL) {
1246                         inp_skip = (*it->function_inp_end) (it->inp,
1247                             it->pointer,
1248                             it->val);
1249                 }
1250                 SCTP_INP_RUNLOCK(it->inp);
1251                 goto no_stcb;
1252         }
1253         while (it->stcb) {
1254                 SCTP_TCB_LOCK(it->stcb);
1255                 if (it->asoc_state && ((it->stcb->asoc.state & it->asoc_state) != it->asoc_state)) {
1256                         /* not in the right state... keep looking */
1257                         SCTP_TCB_UNLOCK(it->stcb);
1258                         goto next_assoc;
1259                 }
1260                 /* see if we have limited out the iterator loop */
1261                 iteration_count++;
1262                 if (iteration_count > SCTP_ITERATOR_MAX_AT_ONCE) {
1263                         /* Pause to let others grab the lock */
1264                         atomic_add_int(&it->stcb->asoc.refcnt, 1);
1265                         SCTP_TCB_UNLOCK(it->stcb);
1266                         SCTP_INP_INCR_REF(it->inp);
1267                         SCTP_INP_RUNLOCK(it->inp);
1268                         SCTP_ITERATOR_UNLOCK();
1269                         SCTP_INP_INFO_RUNLOCK();
1270                         SCTP_INP_INFO_RLOCK();
1271                         SCTP_ITERATOR_LOCK();
1272                         if (sctp_it_ctl.iterator_flags) {
1273                                 /* We won't be staying here */
1274                                 SCTP_INP_DECR_REF(it->inp);
1275                                 atomic_add_int(&it->stcb->asoc.refcnt, -1);
1276                                 if (sctp_it_ctl.iterator_flags &
1277                                     SCTP_ITERATOR_STOP_CUR_IT) {
1278                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_IT;
1279                                         goto done_with_iterator;
1280                                 }
1281                                 if (sctp_it_ctl.iterator_flags &
1282                                     SCTP_ITERATOR_STOP_CUR_INP) {
1283                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_INP;
1284                                         goto no_stcb;
1285                                 }
1286                                 /* If we reach here huh? */
1287                                 SCTP_PRINTF("Unknown it ctl flag %x\n",
1288                                     sctp_it_ctl.iterator_flags);
1289                                 sctp_it_ctl.iterator_flags = 0;
1290                         }
1291                         SCTP_INP_RLOCK(it->inp);
1292                         SCTP_INP_DECR_REF(it->inp);
1293                         SCTP_TCB_LOCK(it->stcb);
1294                         atomic_add_int(&it->stcb->asoc.refcnt, -1);
1295                         iteration_count = 0;
1296                 }
1297                 /* run function on this one */
1298                 (*it->function_assoc) (it->inp, it->stcb, it->pointer, it->val);
1299
1300                 /*
1301                  * we lie here, it really needs to have its own type but
1302                  * first I must verify that this won't effect things :-0
1303                  */
1304                 if (it->no_chunk_output == 0)
1305                         sctp_chunk_output(it->inp, it->stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1306
1307                 SCTP_TCB_UNLOCK(it->stcb);
1308 next_assoc:
1309                 it->stcb = LIST_NEXT(it->stcb, sctp_tcblist);
1310                 if (it->stcb == NULL) {
1311                         /* Run last function */
1312                         if (it->function_inp_end != NULL) {
1313                                 inp_skip = (*it->function_inp_end) (it->inp,
1314                                     it->pointer,
1315                                     it->val);
1316                         }
1317                 }
1318         }
1319         SCTP_INP_RUNLOCK(it->inp);
1320 no_stcb:
1321         /* done with all assocs on this endpoint, move on to next endpoint */
1322         it->done_current_ep = 0;
1323         if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1324                 it->inp = NULL;
1325         } else {
1326                 it->inp = LIST_NEXT(it->inp, sctp_list);
1327         }
1328         if (it->inp == NULL) {
1329                 goto done_with_iterator;
1330         }
1331         goto select_a_new_ep;
1332 }
1333
1334 void
1335 sctp_iterator_worker(void)
1336 {
1337         struct sctp_iterator *it, *nit;
1338
1339         /* This function is called with the WQ lock in place */
1340
1341         sctp_it_ctl.iterator_running = 1;
1342         TAILQ_FOREACH_SAFE(it, &sctp_it_ctl.iteratorhead, sctp_nxt_itr, nit) {
1343                 sctp_it_ctl.cur_it = it;
1344                 /* now lets work on this one */
1345                 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
1346                 SCTP_IPI_ITERATOR_WQ_UNLOCK();
1347                 CURVNET_SET(it->vn);
1348                 sctp_iterator_work(it);
1349                 sctp_it_ctl.cur_it = NULL;
1350                 CURVNET_RESTORE();
1351                 SCTP_IPI_ITERATOR_WQ_LOCK();
1352                 /* sa_ignore FREED_MEMORY */
1353         }
1354         sctp_it_ctl.iterator_running = 0;
1355         return;
1356 }
1357
1358
1359 static void
1360 sctp_handle_addr_wq(void)
1361 {
1362         /* deal with the ADDR wq from the rtsock calls */
1363         struct sctp_laddr *wi, *nwi;
1364         struct sctp_asconf_iterator *asc;
1365
1366         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
1367             sizeof(struct sctp_asconf_iterator), SCTP_M_ASC_IT);
1368         if (asc == NULL) {
1369                 /* Try later, no memory */
1370                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
1371                     (struct sctp_inpcb *)NULL,
1372                     (struct sctp_tcb *)NULL,
1373                     (struct sctp_nets *)NULL);
1374                 return;
1375         }
1376         LIST_INIT(&asc->list_of_work);
1377         asc->cnt = 0;
1378
1379         SCTP_WQ_ADDR_LOCK();
1380         LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) {
1381                 LIST_REMOVE(wi, sctp_nxt_addr);
1382                 LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
1383                 asc->cnt++;
1384         }
1385         SCTP_WQ_ADDR_UNLOCK();
1386
1387         if (asc->cnt == 0) {
1388                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1389         } else {
1390                 (void)sctp_initiate_iterator(sctp_asconf_iterator_ep,
1391                     sctp_asconf_iterator_stcb,
1392                     NULL,       /* No ep end for boundall */
1393                     SCTP_PCB_FLAGS_BOUNDALL,
1394                     SCTP_PCB_ANY_FEATURES,
1395                     SCTP_ASOC_ANY_STATE,
1396                     (void *)asc, 0,
1397                     sctp_asconf_iterator_end, NULL, 0);
1398         }
1399 }
1400
1401 void
1402 sctp_timeout_handler(void *t)
1403 {
1404         struct sctp_inpcb *inp;
1405         struct sctp_tcb *stcb;
1406         struct sctp_nets *net;
1407         struct sctp_timer *tmr;
1408
1409 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1410         struct socket *so;
1411
1412 #endif
1413         int did_output, type;
1414
1415         tmr = (struct sctp_timer *)t;
1416         inp = (struct sctp_inpcb *)tmr->ep;
1417         stcb = (struct sctp_tcb *)tmr->tcb;
1418         net = (struct sctp_nets *)tmr->net;
1419         CURVNET_SET((struct vnet *)tmr->vnet);
1420         did_output = 1;
1421
1422 #ifdef SCTP_AUDITING_ENABLED
1423         sctp_audit_log(0xF0, (uint8_t) tmr->type);
1424         sctp_auditing(3, inp, stcb, net);
1425 #endif
1426
1427         /* sanity checks... */
1428         if (tmr->self != (void *)tmr) {
1429                 /*
1430                  * SCTP_PRINTF("Stale SCTP timer fired (%p), ignoring...\n",
1431                  * (void *)tmr);
1432                  */
1433                 CURVNET_RESTORE();
1434                 return;
1435         }
1436         tmr->stopped_from = 0xa001;
1437         if (!SCTP_IS_TIMER_TYPE_VALID(tmr->type)) {
1438                 /*
1439                  * SCTP_PRINTF("SCTP timer fired with invalid type: 0x%x\n",
1440                  * tmr->type);
1441                  */
1442                 CURVNET_RESTORE();
1443                 return;
1444         }
1445         tmr->stopped_from = 0xa002;
1446         if ((tmr->type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL)) {
1447                 CURVNET_RESTORE();
1448                 return;
1449         }
1450         /* if this is an iterator timeout, get the struct and clear inp */
1451         tmr->stopped_from = 0xa003;
1452         type = tmr->type;
1453         if (inp) {
1454                 SCTP_INP_INCR_REF(inp);
1455                 if ((inp->sctp_socket == NULL) &&
1456                     ((tmr->type != SCTP_TIMER_TYPE_INPKILL) &&
1457                     (tmr->type != SCTP_TIMER_TYPE_INIT) &&
1458                     (tmr->type != SCTP_TIMER_TYPE_SEND) &&
1459                     (tmr->type != SCTP_TIMER_TYPE_RECV) &&
1460                     (tmr->type != SCTP_TIMER_TYPE_HEARTBEAT) &&
1461                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWN) &&
1462                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNACK) &&
1463                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNGUARD) &&
1464                     (tmr->type != SCTP_TIMER_TYPE_ASOCKILL))
1465                     ) {
1466                         SCTP_INP_DECR_REF(inp);
1467                         CURVNET_RESTORE();
1468                         return;
1469                 }
1470         }
1471         tmr->stopped_from = 0xa004;
1472         if (stcb) {
1473                 atomic_add_int(&stcb->asoc.refcnt, 1);
1474                 if (stcb->asoc.state == 0) {
1475                         atomic_add_int(&stcb->asoc.refcnt, -1);
1476                         if (inp) {
1477                                 SCTP_INP_DECR_REF(inp);
1478                         }
1479                         CURVNET_RESTORE();
1480                         return;
1481                 }
1482         }
1483         tmr->stopped_from = 0xa005;
1484         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer type %d goes off\n", tmr->type);
1485         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1486                 if (inp) {
1487                         SCTP_INP_DECR_REF(inp);
1488                 }
1489                 if (stcb) {
1490                         atomic_add_int(&stcb->asoc.refcnt, -1);
1491                 }
1492                 CURVNET_RESTORE();
1493                 return;
1494         }
1495         tmr->stopped_from = 0xa006;
1496
1497         if (stcb) {
1498                 SCTP_TCB_LOCK(stcb);
1499                 atomic_add_int(&stcb->asoc.refcnt, -1);
1500                 if ((tmr->type != SCTP_TIMER_TYPE_ASOCKILL) &&
1501                     ((stcb->asoc.state == 0) ||
1502                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED))) {
1503                         SCTP_TCB_UNLOCK(stcb);
1504                         if (inp) {
1505                                 SCTP_INP_DECR_REF(inp);
1506                         }
1507                         CURVNET_RESTORE();
1508                         return;
1509                 }
1510         }
1511         /* record in stopped what t-o occured */
1512         tmr->stopped_from = tmr->type;
1513
1514         /* mark as being serviced now */
1515         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
1516                 /*
1517                  * Callout has been rescheduled.
1518                  */
1519                 goto get_out;
1520         }
1521         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1522                 /*
1523                  * Not active, so no action.
1524                  */
1525                 goto get_out;
1526         }
1527         SCTP_OS_TIMER_DEACTIVATE(&tmr->timer);
1528
1529         /* call the handler for the appropriate timer type */
1530         switch (tmr->type) {
1531         case SCTP_TIMER_TYPE_ZERO_COPY:
1532                 if (inp == NULL) {
1533                         break;
1534                 }
1535                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
1536                         SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket);
1537                 }
1538                 break;
1539         case SCTP_TIMER_TYPE_ZCOPY_SENDQ:
1540                 if (inp == NULL) {
1541                         break;
1542                 }
1543                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
1544                         SCTP_ZERO_COPY_SENDQ_EVENT(inp, inp->sctp_socket);
1545                 }
1546                 break;
1547         case SCTP_TIMER_TYPE_ADDR_WQ:
1548                 sctp_handle_addr_wq();
1549                 break;
1550         case SCTP_TIMER_TYPE_SEND:
1551                 if ((stcb == NULL) || (inp == NULL)) {
1552                         break;
1553                 }
1554                 SCTP_STAT_INCR(sctps_timodata);
1555                 stcb->asoc.timodata++;
1556                 stcb->asoc.num_send_timers_up--;
1557                 if (stcb->asoc.num_send_timers_up < 0) {
1558                         stcb->asoc.num_send_timers_up = 0;
1559                 }
1560                 SCTP_TCB_LOCK_ASSERT(stcb);
1561                 if (sctp_t3rxt_timer(inp, stcb, net)) {
1562                         /* no need to unlock on tcb its gone */
1563
1564                         goto out_decr;
1565                 }
1566                 SCTP_TCB_LOCK_ASSERT(stcb);
1567 #ifdef SCTP_AUDITING_ENABLED
1568                 sctp_auditing(4, inp, stcb, net);
1569 #endif
1570                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1571                 if ((stcb->asoc.num_send_timers_up == 0) &&
1572                     (stcb->asoc.sent_queue_cnt > 0)) {
1573                         struct sctp_tmit_chunk *chk;
1574
1575                         /*
1576                          * safeguard. If there on some on the sent queue
1577                          * somewhere but no timers running something is
1578                          * wrong... so we start a timer on the first chunk
1579                          * on the send queue on whatever net it is sent to.
1580                          */
1581                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1582                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb,
1583                             chk->whoTo);
1584                 }
1585                 break;
1586         case SCTP_TIMER_TYPE_INIT:
1587                 if ((stcb == NULL) || (inp == NULL)) {
1588                         break;
1589                 }
1590                 SCTP_STAT_INCR(sctps_timoinit);
1591                 stcb->asoc.timoinit++;
1592                 if (sctp_t1init_timer(inp, stcb, net)) {
1593                         /* no need to unlock on tcb its gone */
1594                         goto out_decr;
1595                 }
1596                 /* We do output but not here */
1597                 did_output = 0;
1598                 break;
1599         case SCTP_TIMER_TYPE_RECV:
1600                 if ((stcb == NULL) || (inp == NULL)) {
1601                         break;
1602                 }
1603                 SCTP_STAT_INCR(sctps_timosack);
1604                 stcb->asoc.timosack++;
1605                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
1606 #ifdef SCTP_AUDITING_ENABLED
1607                 sctp_auditing(4, inp, stcb, net);
1608 #endif
1609                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR, SCTP_SO_NOT_LOCKED);
1610                 break;
1611         case SCTP_TIMER_TYPE_SHUTDOWN:
1612                 if ((stcb == NULL) || (inp == NULL)) {
1613                         break;
1614                 }
1615                 if (sctp_shutdown_timer(inp, stcb, net)) {
1616                         /* no need to unlock on tcb its gone */
1617                         goto out_decr;
1618                 }
1619                 SCTP_STAT_INCR(sctps_timoshutdown);
1620                 stcb->asoc.timoshutdown++;
1621 #ifdef SCTP_AUDITING_ENABLED
1622                 sctp_auditing(4, inp, stcb, net);
1623 #endif
1624                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_NOT_LOCKED);
1625                 break;
1626         case SCTP_TIMER_TYPE_HEARTBEAT:
1627                 if ((stcb == NULL) || (inp == NULL) || (net == NULL)) {
1628                         break;
1629                 }
1630                 SCTP_STAT_INCR(sctps_timoheartbeat);
1631                 stcb->asoc.timoheartbeat++;
1632                 if (sctp_heartbeat_timer(inp, stcb, net)) {
1633                         /* no need to unlock on tcb its gone */
1634                         goto out_decr;
1635                 }
1636 #ifdef SCTP_AUDITING_ENABLED
1637                 sctp_auditing(4, inp, stcb, net);
1638 #endif
1639                 if (!(net->dest_state & SCTP_ADDR_NOHB)) {
1640                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net);
1641                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR, SCTP_SO_NOT_LOCKED);
1642                 }
1643                 break;
1644         case SCTP_TIMER_TYPE_COOKIE:
1645                 if ((stcb == NULL) || (inp == NULL)) {
1646                         break;
1647                 }
1648                 if (sctp_cookie_timer(inp, stcb, net)) {
1649                         /* no need to unlock on tcb its gone */
1650                         goto out_decr;
1651                 }
1652                 SCTP_STAT_INCR(sctps_timocookie);
1653                 stcb->asoc.timocookie++;
1654 #ifdef SCTP_AUDITING_ENABLED
1655                 sctp_auditing(4, inp, stcb, net);
1656 #endif
1657                 /*
1658                  * We consider T3 and Cookie timer pretty much the same with
1659                  * respect to where from in chunk_output.
1660                  */
1661                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1662                 break;
1663         case SCTP_TIMER_TYPE_NEWCOOKIE:
1664                 {
1665                         struct timeval tv;
1666                         int i, secret;
1667
1668                         if (inp == NULL) {
1669                                 break;
1670                         }
1671                         SCTP_STAT_INCR(sctps_timosecret);
1672                         (void)SCTP_GETTIME_TIMEVAL(&tv);
1673                         SCTP_INP_WLOCK(inp);
1674                         inp->sctp_ep.time_of_secret_change = tv.tv_sec;
1675                         inp->sctp_ep.last_secret_number =
1676                             inp->sctp_ep.current_secret_number;
1677                         inp->sctp_ep.current_secret_number++;
1678                         if (inp->sctp_ep.current_secret_number >=
1679                             SCTP_HOW_MANY_SECRETS) {
1680                                 inp->sctp_ep.current_secret_number = 0;
1681                         }
1682                         secret = (int)inp->sctp_ep.current_secret_number;
1683                         for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1684                                 inp->sctp_ep.secret_key[secret][i] =
1685                                     sctp_select_initial_TSN(&inp->sctp_ep);
1686                         }
1687                         SCTP_INP_WUNLOCK(inp);
1688                         sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, stcb, net);
1689                 }
1690                 did_output = 0;
1691                 break;
1692         case SCTP_TIMER_TYPE_PATHMTURAISE:
1693                 if ((stcb == NULL) || (inp == NULL)) {
1694                         break;
1695                 }
1696                 SCTP_STAT_INCR(sctps_timopathmtu);
1697                 sctp_pathmtu_timer(inp, stcb, net);
1698                 did_output = 0;
1699                 break;
1700         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1701                 if ((stcb == NULL) || (inp == NULL)) {
1702                         break;
1703                 }
1704                 if (sctp_shutdownack_timer(inp, stcb, net)) {
1705                         /* no need to unlock on tcb its gone */
1706                         goto out_decr;
1707                 }
1708                 SCTP_STAT_INCR(sctps_timoshutdownack);
1709                 stcb->asoc.timoshutdownack++;
1710 #ifdef SCTP_AUDITING_ENABLED
1711                 sctp_auditing(4, inp, stcb, net);
1712 #endif
1713                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR, SCTP_SO_NOT_LOCKED);
1714                 break;
1715         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1716                 if ((stcb == NULL) || (inp == NULL)) {
1717                         break;
1718                 }
1719                 SCTP_STAT_INCR(sctps_timoshutdownguard);
1720                 sctp_abort_an_association(inp, stcb, NULL, SCTP_SO_NOT_LOCKED);
1721                 /* no need to unlock on tcb its gone */
1722                 goto out_decr;
1723
1724         case SCTP_TIMER_TYPE_STRRESET:
1725                 if ((stcb == NULL) || (inp == NULL)) {
1726                         break;
1727                 }
1728                 if (sctp_strreset_timer(inp, stcb, net)) {
1729                         /* no need to unlock on tcb its gone */
1730                         goto out_decr;
1731                 }
1732                 SCTP_STAT_INCR(sctps_timostrmrst);
1733                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR, SCTP_SO_NOT_LOCKED);
1734                 break;
1735         case SCTP_TIMER_TYPE_ASCONF:
1736                 if ((stcb == NULL) || (inp == NULL)) {
1737                         break;
1738                 }
1739                 if (sctp_asconf_timer(inp, stcb, net)) {
1740                         /* no need to unlock on tcb its gone */
1741                         goto out_decr;
1742                 }
1743                 SCTP_STAT_INCR(sctps_timoasconf);
1744 #ifdef SCTP_AUDITING_ENABLED
1745                 sctp_auditing(4, inp, stcb, net);
1746 #endif
1747                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR, SCTP_SO_NOT_LOCKED);
1748                 break;
1749         case SCTP_TIMER_TYPE_PRIM_DELETED:
1750                 if ((stcb == NULL) || (inp == NULL)) {
1751                         break;
1752                 }
1753                 sctp_delete_prim_timer(inp, stcb, net);
1754                 SCTP_STAT_INCR(sctps_timodelprim);
1755                 break;
1756
1757         case SCTP_TIMER_TYPE_AUTOCLOSE:
1758                 if ((stcb == NULL) || (inp == NULL)) {
1759                         break;
1760                 }
1761                 SCTP_STAT_INCR(sctps_timoautoclose);
1762                 sctp_autoclose_timer(inp, stcb, net);
1763                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED);
1764                 did_output = 0;
1765                 break;
1766         case SCTP_TIMER_TYPE_ASOCKILL:
1767                 if ((stcb == NULL) || (inp == NULL)) {
1768                         break;
1769                 }
1770                 SCTP_STAT_INCR(sctps_timoassockill);
1771                 /* Can we free it yet? */
1772                 SCTP_INP_DECR_REF(inp);
1773                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_1);
1774 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1775                 so = SCTP_INP_SO(inp);
1776                 atomic_add_int(&stcb->asoc.refcnt, 1);
1777                 SCTP_TCB_UNLOCK(stcb);
1778                 SCTP_SOCKET_LOCK(so, 1);
1779                 SCTP_TCB_LOCK(stcb);
1780                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1781 #endif
1782                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_2);
1783 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1784                 SCTP_SOCKET_UNLOCK(so, 1);
1785 #endif
1786                 /*
1787                  * free asoc, always unlocks (or destroy's) so prevent
1788                  * duplicate unlock or unlock of a free mtx :-0
1789                  */
1790                 stcb = NULL;
1791                 goto out_no_decr;
1792         case SCTP_TIMER_TYPE_INPKILL:
1793                 SCTP_STAT_INCR(sctps_timoinpkill);
1794                 if (inp == NULL) {
1795                         break;
1796                 }
1797                 /*
1798                  * special case, take away our increment since WE are the
1799                  * killer
1800                  */
1801                 SCTP_INP_DECR_REF(inp);
1802                 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_3);
1803                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
1804                     SCTP_CALLED_FROM_INPKILL_TIMER);
1805                 inp = NULL;
1806                 goto out_no_decr;
1807         default:
1808                 SCTPDBG(SCTP_DEBUG_TIMER1, "sctp_timeout_handler:unknown timer %d\n",
1809                     tmr->type);
1810                 break;
1811         }
1812 #ifdef SCTP_AUDITING_ENABLED
1813         sctp_audit_log(0xF1, (uint8_t) tmr->type);
1814         if (inp)
1815                 sctp_auditing(5, inp, stcb, net);
1816 #endif
1817         if ((did_output) && stcb) {
1818                 /*
1819                  * Now we need to clean up the control chunk chain if an
1820                  * ECNE is on it. It must be marked as UNSENT again so next
1821                  * call will continue to send it until such time that we get
1822                  * a CWR, to remove it. It is, however, less likely that we
1823                  * will find a ecn echo on the chain though.
1824                  */
1825                 sctp_fix_ecn_echo(&stcb->asoc);
1826         }
1827 get_out:
1828         if (stcb) {
1829                 SCTP_TCB_UNLOCK(stcb);
1830         }
1831 out_decr:
1832         if (inp) {
1833                 SCTP_INP_DECR_REF(inp);
1834         }
1835 out_no_decr:
1836         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer now complete (type %d)\n",
1837             type);
1838         CURVNET_RESTORE();
1839 }
1840
1841 void
1842 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1843     struct sctp_nets *net)
1844 {
1845         uint32_t to_ticks;
1846         struct sctp_timer *tmr;
1847
1848         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL))
1849                 return;
1850
1851         tmr = NULL;
1852         if (stcb) {
1853                 SCTP_TCB_LOCK_ASSERT(stcb);
1854         }
1855         switch (t_type) {
1856         case SCTP_TIMER_TYPE_ZERO_COPY:
1857                 tmr = &inp->sctp_ep.zero_copy_timer;
1858                 to_ticks = SCTP_ZERO_COPY_TICK_DELAY;
1859                 break;
1860         case SCTP_TIMER_TYPE_ZCOPY_SENDQ:
1861                 tmr = &inp->sctp_ep.zero_copy_sendq_timer;
1862                 to_ticks = SCTP_ZERO_COPY_SENDQ_TICK_DELAY;
1863                 break;
1864         case SCTP_TIMER_TYPE_ADDR_WQ:
1865                 /* Only 1 tick away :-) */
1866                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
1867                 to_ticks = SCTP_ADDRESS_TICK_DELAY;
1868                 break;
1869         case SCTP_TIMER_TYPE_SEND:
1870                 /* Here we use the RTO timer */
1871                 {
1872                         int rto_val;
1873
1874                         if ((stcb == NULL) || (net == NULL)) {
1875                                 return;
1876                         }
1877                         tmr = &net->rxt_timer;
1878                         if (net->RTO == 0) {
1879                                 rto_val = stcb->asoc.initial_rto;
1880                         } else {
1881                                 rto_val = net->RTO;
1882                         }
1883                         to_ticks = MSEC_TO_TICKS(rto_val);
1884                 }
1885                 break;
1886         case SCTP_TIMER_TYPE_INIT:
1887                 /*
1888                  * Here we use the INIT timer default usually about 1
1889                  * minute.
1890                  */
1891                 if ((stcb == NULL) || (net == NULL)) {
1892                         return;
1893                 }
1894                 tmr = &net->rxt_timer;
1895                 if (net->RTO == 0) {
1896                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1897                 } else {
1898                         to_ticks = MSEC_TO_TICKS(net->RTO);
1899                 }
1900                 break;
1901         case SCTP_TIMER_TYPE_RECV:
1902                 /*
1903                  * Here we use the Delayed-Ack timer value from the inp
1904                  * ususually about 200ms.
1905                  */
1906                 if (stcb == NULL) {
1907                         return;
1908                 }
1909                 tmr = &stcb->asoc.dack_timer;
1910                 to_ticks = MSEC_TO_TICKS(stcb->asoc.delayed_ack);
1911                 break;
1912         case SCTP_TIMER_TYPE_SHUTDOWN:
1913                 /* Here we use the RTO of the destination. */
1914                 if ((stcb == NULL) || (net == NULL)) {
1915                         return;
1916                 }
1917                 if (net->RTO == 0) {
1918                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1919                 } else {
1920                         to_ticks = MSEC_TO_TICKS(net->RTO);
1921                 }
1922                 tmr = &net->rxt_timer;
1923                 break;
1924         case SCTP_TIMER_TYPE_HEARTBEAT:
1925                 /*
1926                  * the net is used here so that we can add in the RTO. Even
1927                  * though we use a different timer. We also add the HB timer
1928                  * PLUS a random jitter.
1929                  */
1930                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
1931                         return;
1932                 } else {
1933                         uint32_t rndval;
1934                         uint32_t jitter;
1935
1936                         if ((net->dest_state & SCTP_ADDR_NOHB) &&
1937                             !(net->dest_state & SCTP_ADDR_UNCONFIRMED)) {
1938                                 return;
1939                         }
1940                         if (net->RTO == 0) {
1941                                 to_ticks = stcb->asoc.initial_rto;
1942                         } else {
1943                                 to_ticks = net->RTO;
1944                         }
1945                         rndval = sctp_select_initial_TSN(&inp->sctp_ep);
1946                         jitter = rndval % to_ticks;
1947                         if (jitter >= (to_ticks >> 1)) {
1948                                 to_ticks = to_ticks + (jitter - (to_ticks >> 1));
1949                         } else {
1950                                 to_ticks = to_ticks - jitter;
1951                         }
1952                         if (!(net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
1953                             !(net->dest_state & SCTP_ADDR_PF)) {
1954                                 to_ticks += net->heart_beat_delay;
1955                         }
1956                         /*
1957                          * Now we must convert the to_ticks that are now in
1958                          * ms to ticks.
1959                          */
1960                         to_ticks = MSEC_TO_TICKS(to_ticks);
1961                         tmr = &net->hb_timer;
1962                 }
1963                 break;
1964         case SCTP_TIMER_TYPE_COOKIE:
1965                 /*
1966                  * Here we can use the RTO timer from the network since one
1967                  * RTT was compelete. If a retran happened then we will be
1968                  * using the RTO initial value.
1969                  */
1970                 if ((stcb == NULL) || (net == NULL)) {
1971                         return;
1972                 }
1973                 if (net->RTO == 0) {
1974                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1975                 } else {
1976                         to_ticks = MSEC_TO_TICKS(net->RTO);
1977                 }
1978                 tmr = &net->rxt_timer;
1979                 break;
1980         case SCTP_TIMER_TYPE_NEWCOOKIE:
1981                 /*
1982                  * nothing needed but the endpoint here ususually about 60
1983                  * minutes.
1984                  */
1985                 if (inp == NULL) {
1986                         return;
1987                 }
1988                 tmr = &inp->sctp_ep.signature_change;
1989                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE];
1990                 break;
1991         case SCTP_TIMER_TYPE_ASOCKILL:
1992                 if (stcb == NULL) {
1993                         return;
1994                 }
1995                 tmr = &stcb->asoc.strreset_timer;
1996                 to_ticks = MSEC_TO_TICKS(SCTP_ASOC_KILL_TIMEOUT);
1997                 break;
1998         case SCTP_TIMER_TYPE_INPKILL:
1999                 /*
2000                  * The inp is setup to die. We re-use the signature_chage
2001                  * timer since that has stopped and we are in the GONE
2002                  * state.
2003                  */
2004                 if (inp == NULL) {
2005                         return;
2006                 }
2007                 tmr = &inp->sctp_ep.signature_change;
2008                 to_ticks = MSEC_TO_TICKS(SCTP_INP_KILL_TIMEOUT);
2009                 break;
2010         case SCTP_TIMER_TYPE_PATHMTURAISE:
2011                 /*
2012                  * Here we use the value found in the EP for PMTU ususually
2013                  * about 10 minutes.
2014                  */
2015                 if ((stcb == NULL) || (inp == NULL)) {
2016                         return;
2017                 }
2018                 if (net == NULL) {
2019                         return;
2020                 }
2021                 if (net->dest_state & SCTP_ADDR_NO_PMTUD) {
2022                         return;
2023                 }
2024                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU];
2025                 tmr = &net->pmtu_timer;
2026                 break;
2027         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2028                 /* Here we use the RTO of the destination */
2029                 if ((stcb == NULL) || (net == NULL)) {
2030                         return;
2031                 }
2032                 if (net->RTO == 0) {
2033                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2034                 } else {
2035                         to_ticks = MSEC_TO_TICKS(net->RTO);
2036                 }
2037                 tmr = &net->rxt_timer;
2038                 break;
2039         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2040                 /*
2041                  * Here we use the endpoints shutdown guard timer usually
2042                  * about 3 minutes.
2043                  */
2044                 if ((inp == NULL) || (stcb == NULL)) {
2045                         return;
2046                 }
2047                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN];
2048                 tmr = &stcb->asoc.shut_guard_timer;
2049                 break;
2050         case SCTP_TIMER_TYPE_STRRESET:
2051                 /*
2052                  * Here the timer comes from the stcb but its value is from
2053                  * the net's RTO.
2054                  */
2055                 if ((stcb == NULL) || (net == NULL)) {
2056                         return;
2057                 }
2058                 if (net->RTO == 0) {
2059                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2060                 } else {
2061                         to_ticks = MSEC_TO_TICKS(net->RTO);
2062                 }
2063                 tmr = &stcb->asoc.strreset_timer;
2064                 break;
2065         case SCTP_TIMER_TYPE_ASCONF:
2066                 /*
2067                  * Here the timer comes from the stcb but its value is from
2068                  * the net's RTO.
2069                  */
2070                 if ((stcb == NULL) || (net == NULL)) {
2071                         return;
2072                 }
2073                 if (net->RTO == 0) {
2074                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2075                 } else {
2076                         to_ticks = MSEC_TO_TICKS(net->RTO);
2077                 }
2078                 tmr = &stcb->asoc.asconf_timer;
2079                 break;
2080         case SCTP_TIMER_TYPE_PRIM_DELETED:
2081                 if ((stcb == NULL) || (net != NULL)) {
2082                         return;
2083                 }
2084                 to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2085                 tmr = &stcb->asoc.delete_prim_timer;
2086                 break;
2087         case SCTP_TIMER_TYPE_AUTOCLOSE:
2088                 if (stcb == NULL) {
2089                         return;
2090                 }
2091                 if (stcb->asoc.sctp_autoclose_ticks == 0) {
2092                         /*
2093                          * Really an error since stcb is NOT set to
2094                          * autoclose
2095                          */
2096                         return;
2097                 }
2098                 to_ticks = stcb->asoc.sctp_autoclose_ticks;
2099                 tmr = &stcb->asoc.autoclose_timer;
2100                 break;
2101         default:
2102                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2103                     __FUNCTION__, t_type);
2104                 return;
2105                 break;
2106         }
2107         if ((to_ticks <= 0) || (tmr == NULL)) {
2108                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: %d:software error to_ticks:%d tmr:%p not set ??\n",
2109                     __FUNCTION__, t_type, to_ticks, (void *)tmr);
2110                 return;
2111         }
2112         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
2113                 /*
2114                  * we do NOT allow you to have it already running. if it is
2115                  * we leave the current one up unchanged
2116                  */
2117                 return;
2118         }
2119         /* At this point we can proceed */
2120         if (t_type == SCTP_TIMER_TYPE_SEND) {
2121                 stcb->asoc.num_send_timers_up++;
2122         }
2123         tmr->stopped_from = 0;
2124         tmr->type = t_type;
2125         tmr->ep = (void *)inp;
2126         tmr->tcb = (void *)stcb;
2127         tmr->net = (void *)net;
2128         tmr->self = (void *)tmr;
2129         tmr->vnet = (void *)curvnet;
2130         tmr->ticks = sctp_get_tick_count();
2131         (void)SCTP_OS_TIMER_START(&tmr->timer, to_ticks, sctp_timeout_handler, tmr);
2132         return;
2133 }
2134
2135 void
2136 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2137     struct sctp_nets *net, uint32_t from)
2138 {
2139         struct sctp_timer *tmr;
2140
2141         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) &&
2142             (inp == NULL))
2143                 return;
2144
2145         tmr = NULL;
2146         if (stcb) {
2147                 SCTP_TCB_LOCK_ASSERT(stcb);
2148         }
2149         switch (t_type) {
2150         case SCTP_TIMER_TYPE_ZERO_COPY:
2151                 tmr = &inp->sctp_ep.zero_copy_timer;
2152                 break;
2153         case SCTP_TIMER_TYPE_ZCOPY_SENDQ:
2154                 tmr = &inp->sctp_ep.zero_copy_sendq_timer;
2155                 break;
2156         case SCTP_TIMER_TYPE_ADDR_WQ:
2157                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2158                 break;
2159         case SCTP_TIMER_TYPE_SEND:
2160                 if ((stcb == NULL) || (net == NULL)) {
2161                         return;
2162                 }
2163                 tmr = &net->rxt_timer;
2164                 break;
2165         case SCTP_TIMER_TYPE_INIT:
2166                 if ((stcb == NULL) || (net == NULL)) {
2167                         return;
2168                 }
2169                 tmr = &net->rxt_timer;
2170                 break;
2171         case SCTP_TIMER_TYPE_RECV:
2172                 if (stcb == NULL) {
2173                         return;
2174                 }
2175                 tmr = &stcb->asoc.dack_timer;
2176                 break;
2177         case SCTP_TIMER_TYPE_SHUTDOWN:
2178                 if ((stcb == NULL) || (net == NULL)) {
2179                         return;
2180                 }
2181                 tmr = &net->rxt_timer;
2182                 break;
2183         case SCTP_TIMER_TYPE_HEARTBEAT:
2184                 if ((stcb == NULL) || (net == NULL)) {
2185                         return;
2186                 }
2187                 tmr = &net->hb_timer;
2188                 break;
2189         case SCTP_TIMER_TYPE_COOKIE:
2190                 if ((stcb == NULL) || (net == NULL)) {
2191                         return;
2192                 }
2193                 tmr = &net->rxt_timer;
2194                 break;
2195         case SCTP_TIMER_TYPE_NEWCOOKIE:
2196                 /* nothing needed but the endpoint here */
2197                 tmr = &inp->sctp_ep.signature_change;
2198                 /*
2199                  * We re-use the newcookie timer for the INP kill timer. We
2200                  * must assure that we do not kill it by accident.
2201                  */
2202                 break;
2203         case SCTP_TIMER_TYPE_ASOCKILL:
2204                 /*
2205                  * Stop the asoc kill timer.
2206                  */
2207                 if (stcb == NULL) {
2208                         return;
2209                 }
2210                 tmr = &stcb->asoc.strreset_timer;
2211                 break;
2212
2213         case SCTP_TIMER_TYPE_INPKILL:
2214                 /*
2215                  * The inp is setup to die. We re-use the signature_chage
2216                  * timer since that has stopped and we are in the GONE
2217                  * state.
2218                  */
2219                 tmr = &inp->sctp_ep.signature_change;
2220                 break;
2221         case SCTP_TIMER_TYPE_PATHMTURAISE:
2222                 if ((stcb == NULL) || (net == NULL)) {
2223                         return;
2224                 }
2225                 tmr = &net->pmtu_timer;
2226                 break;
2227         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2228                 if ((stcb == NULL) || (net == NULL)) {
2229                         return;
2230                 }
2231                 tmr = &net->rxt_timer;
2232                 break;
2233         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2234                 if (stcb == NULL) {
2235                         return;
2236                 }
2237                 tmr = &stcb->asoc.shut_guard_timer;
2238                 break;
2239         case SCTP_TIMER_TYPE_STRRESET:
2240                 if (stcb == NULL) {
2241                         return;
2242                 }
2243                 tmr = &stcb->asoc.strreset_timer;
2244                 break;
2245         case SCTP_TIMER_TYPE_ASCONF:
2246                 if (stcb == NULL) {
2247                         return;
2248                 }
2249                 tmr = &stcb->asoc.asconf_timer;
2250                 break;
2251         case SCTP_TIMER_TYPE_PRIM_DELETED:
2252                 if (stcb == NULL) {
2253                         return;
2254                 }
2255                 tmr = &stcb->asoc.delete_prim_timer;
2256                 break;
2257         case SCTP_TIMER_TYPE_AUTOCLOSE:
2258                 if (stcb == NULL) {
2259                         return;
2260                 }
2261                 tmr = &stcb->asoc.autoclose_timer;
2262                 break;
2263         default:
2264                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2265                     __FUNCTION__, t_type);
2266                 break;
2267         }
2268         if (tmr == NULL) {
2269                 return;
2270         }
2271         if ((tmr->type != t_type) && tmr->type) {
2272                 /*
2273                  * Ok we have a timer that is under joint use. Cookie timer
2274                  * per chance with the SEND timer. We therefore are NOT
2275                  * running the timer that the caller wants stopped.  So just
2276                  * return.
2277                  */
2278                 return;
2279         }
2280         if ((t_type == SCTP_TIMER_TYPE_SEND) && (stcb != NULL)) {
2281                 stcb->asoc.num_send_timers_up--;
2282                 if (stcb->asoc.num_send_timers_up < 0) {
2283                         stcb->asoc.num_send_timers_up = 0;
2284                 }
2285         }
2286         tmr->self = NULL;
2287         tmr->stopped_from = from;
2288         (void)SCTP_OS_TIMER_STOP(&tmr->timer);
2289         return;
2290 }
2291
2292 uint32_t
2293 sctp_calculate_len(struct mbuf *m)
2294 {
2295         uint32_t tlen = 0;
2296         struct mbuf *at;
2297
2298         at = m;
2299         while (at) {
2300                 tlen += SCTP_BUF_LEN(at);
2301                 at = SCTP_BUF_NEXT(at);
2302         }
2303         return (tlen);
2304 }
2305
2306 void
2307 sctp_mtu_size_reset(struct sctp_inpcb *inp,
2308     struct sctp_association *asoc, uint32_t mtu)
2309 {
2310         /*
2311          * Reset the P-MTU size on this association, this involves changing
2312          * the asoc MTU, going through ANY chunk+overhead larger than mtu to
2313          * allow the DF flag to be cleared.
2314          */
2315         struct sctp_tmit_chunk *chk;
2316         unsigned int eff_mtu, ovh;
2317
2318         asoc->smallest_mtu = mtu;
2319         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2320                 ovh = SCTP_MIN_OVERHEAD;
2321         } else {
2322                 ovh = SCTP_MIN_V4_OVERHEAD;
2323         }
2324         eff_mtu = mtu - ovh;
2325         TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
2326                 if (chk->send_size > eff_mtu) {
2327                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2328                 }
2329         }
2330         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
2331                 if (chk->send_size > eff_mtu) {
2332                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2333                 }
2334         }
2335 }
2336
2337
2338 /*
2339  * given an association and starting time of the current RTT period return
2340  * RTO in number of msecs net should point to the current network
2341  */
2342
2343 uint32_t
2344 sctp_calculate_rto(struct sctp_tcb *stcb,
2345     struct sctp_association *asoc,
2346     struct sctp_nets *net,
2347     struct timeval *told,
2348     int safe, int rtt_from_sack)
2349 {
2350         /*-
2351          * given an association and the starting time of the current RTT
2352          * period (in value1/value2) return RTO in number of msecs.
2353          */
2354         int32_t rtt;            /* RTT in ms */
2355         uint32_t new_rto;
2356         int first_measure = 0;
2357         struct timeval now, then, *old;
2358
2359         /* Copy it out for sparc64 */
2360         if (safe == sctp_align_unsafe_makecopy) {
2361                 old = &then;
2362                 memcpy(&then, told, sizeof(struct timeval));
2363         } else if (safe == sctp_align_safe_nocopy) {
2364                 old = told;
2365         } else {
2366                 /* error */
2367                 SCTP_PRINTF("Huh, bad rto calc call\n");
2368                 return (0);
2369         }
2370         /************************/
2371         /* 1. calculate new RTT */
2372         /************************/
2373         /* get the current time */
2374         if (stcb->asoc.use_precise_time) {
2375                 (void)SCTP_GETPTIME_TIMEVAL(&now);
2376         } else {
2377                 (void)SCTP_GETTIME_TIMEVAL(&now);
2378         }
2379         timevalsub(&now, old);
2380         /* store the current RTT in us */
2381         net->rtt = (uint64_t) 1000000 *(uint64_t) now.tv_sec +
2382                 (uint64_t) now.tv_usec;
2383
2384         /* computer rtt in ms */
2385         rtt = net->rtt / 1000;
2386         if ((asoc->cc_functions.sctp_rtt_calculated) && (rtt_from_sack == SCTP_RTT_FROM_DATA)) {
2387                 /*
2388                  * Tell the CC module that a new update has just occurred
2389                  * from a sack
2390                  */
2391                 (*asoc->cc_functions.sctp_rtt_calculated) (stcb, net, &now);
2392         }
2393         /*
2394          * Do we need to determine the lan? We do this only on sacks i.e.
2395          * RTT being determined from data not non-data (HB/INIT->INITACK).
2396          */
2397         if ((rtt_from_sack == SCTP_RTT_FROM_DATA) &&
2398             (net->lan_type == SCTP_LAN_UNKNOWN)) {
2399                 if (net->rtt > SCTP_LOCAL_LAN_RTT) {
2400                         net->lan_type = SCTP_LAN_INTERNET;
2401                 } else {
2402                         net->lan_type = SCTP_LAN_LOCAL;
2403                 }
2404         }
2405         /***************************/
2406         /* 2. update RTTVAR & SRTT */
2407         /***************************/
2408         /*-
2409          * Compute the scaled average lastsa and the
2410          * scaled variance lastsv as described in van Jacobson
2411          * Paper "Congestion Avoidance and Control", Annex A.
2412          *
2413          * (net->lastsa >> SCTP_RTT_SHIFT) is the srtt
2414          * (net->lastsa >> SCTP_RTT_VAR_SHIFT) is the rttvar
2415          */
2416         if (net->RTO_measured) {
2417                 rtt -= (net->lastsa >> SCTP_RTT_SHIFT);
2418                 net->lastsa += rtt;
2419                 if (rtt < 0) {
2420                         rtt = -rtt;
2421                 }
2422                 rtt -= (net->lastsv >> SCTP_RTT_VAR_SHIFT);
2423                 net->lastsv += rtt;
2424                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2425                         rto_logging(net, SCTP_LOG_RTTVAR);
2426                 }
2427         } else {
2428                 /* First RTO measurment */
2429                 net->RTO_measured = 1;
2430                 first_measure = 1;
2431                 net->lastsa = rtt << SCTP_RTT_SHIFT;
2432                 net->lastsv = (rtt / 2) << SCTP_RTT_VAR_SHIFT;
2433                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2434                         rto_logging(net, SCTP_LOG_INITIAL_RTT);
2435                 }
2436         }
2437         if (net->lastsv == 0) {
2438                 net->lastsv = SCTP_CLOCK_GRANULARITY;
2439         }
2440         new_rto = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
2441         if ((new_rto > SCTP_SAT_NETWORK_MIN) &&
2442             (stcb->asoc.sat_network_lockout == 0)) {
2443                 stcb->asoc.sat_network = 1;
2444         } else if ((!first_measure) && stcb->asoc.sat_network) {
2445                 stcb->asoc.sat_network = 0;
2446                 stcb->asoc.sat_network_lockout = 1;
2447         }
2448         /* bound it, per C6/C7 in Section 5.3.1 */
2449         if (new_rto < stcb->asoc.minrto) {
2450                 new_rto = stcb->asoc.minrto;
2451         }
2452         if (new_rto > stcb->asoc.maxrto) {
2453                 new_rto = stcb->asoc.maxrto;
2454         }
2455         /* we are now returning the RTO */
2456         return (new_rto);
2457 }
2458
2459 /*
2460  * return a pointer to a contiguous piece of data from the given mbuf chain
2461  * starting at 'off' for 'len' bytes.  If the desired piece spans more than
2462  * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size
2463  * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain.
2464  */
2465 caddr_t
2466 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t * in_ptr)
2467 {
2468         uint32_t count;
2469         uint8_t *ptr;
2470
2471         ptr = in_ptr;
2472         if ((off < 0) || (len <= 0))
2473                 return (NULL);
2474
2475         /* find the desired start location */
2476         while ((m != NULL) && (off > 0)) {
2477                 if (off < SCTP_BUF_LEN(m))
2478                         break;
2479                 off -= SCTP_BUF_LEN(m);
2480                 m = SCTP_BUF_NEXT(m);
2481         }
2482         if (m == NULL)
2483                 return (NULL);
2484
2485         /* is the current mbuf large enough (eg. contiguous)? */
2486         if ((SCTP_BUF_LEN(m) - off) >= len) {
2487                 return (mtod(m, caddr_t)+off);
2488         } else {
2489                 /* else, it spans more than one mbuf, so save a temp copy... */
2490                 while ((m != NULL) && (len > 0)) {
2491                         count = min(SCTP_BUF_LEN(m) - off, len);
2492                         bcopy(mtod(m, caddr_t)+off, ptr, count);
2493                         len -= count;
2494                         ptr += count;
2495                         off = 0;
2496                         m = SCTP_BUF_NEXT(m);
2497                 }
2498                 if ((m == NULL) && (len > 0))
2499                         return (NULL);
2500                 else
2501                         return ((caddr_t)in_ptr);
2502         }
2503 }
2504
2505
2506
2507 struct sctp_paramhdr *
2508 sctp_get_next_param(struct mbuf *m,
2509     int offset,
2510     struct sctp_paramhdr *pull,
2511     int pull_limit)
2512 {
2513         /* This just provides a typed signature to Peter's Pull routine */
2514         return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit,
2515             (uint8_t *) pull));
2516 }
2517
2518
2519 int
2520 sctp_add_pad_tombuf(struct mbuf *m, int padlen)
2521 {
2522         /*
2523          * add padlen bytes of 0 filled padding to the end of the mbuf. If
2524          * padlen is > 3 this routine will fail.
2525          */
2526         uint8_t *dp;
2527         int i;
2528
2529         if (padlen > 3) {
2530                 SCTP_LTRACE_ERR_RET_PKT(m, NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
2531                 return (ENOBUFS);
2532         }
2533         if (padlen <= M_TRAILINGSPACE(m)) {
2534                 /*
2535                  * The easy way. We hope the majority of the time we hit
2536                  * here :)
2537                  */
2538                 dp = (uint8_t *) (mtod(m, caddr_t)+SCTP_BUF_LEN(m));
2539                 SCTP_BUF_LEN(m) += padlen;
2540         } else {
2541                 /* Hard way we must grow the mbuf */
2542                 struct mbuf *tmp;
2543
2544                 tmp = sctp_get_mbuf_for_msg(padlen, 0, M_NOWAIT, 1, MT_DATA);
2545                 if (tmp == NULL) {
2546                         /* Out of space GAK! we are in big trouble. */
2547                         SCTP_LTRACE_ERR_RET_PKT(m, NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
2548                         return (ENOBUFS);
2549                 }
2550                 /* setup and insert in middle */
2551                 SCTP_BUF_LEN(tmp) = padlen;
2552                 SCTP_BUF_NEXT(tmp) = NULL;
2553                 SCTP_BUF_NEXT(m) = tmp;
2554                 dp = mtod(tmp, uint8_t *);
2555         }
2556         /* zero out the pad */
2557         for (i = 0; i < padlen; i++) {
2558                 *dp = 0;
2559                 dp++;
2560         }
2561         return (0);
2562 }
2563
2564 int
2565 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf)
2566 {
2567         /* find the last mbuf in chain and pad it */
2568         struct mbuf *m_at;
2569
2570         if (last_mbuf) {
2571                 return (sctp_add_pad_tombuf(last_mbuf, padval));
2572         } else {
2573                 for (m_at = m; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
2574                         if (SCTP_BUF_NEXT(m_at) == NULL) {
2575                                 return (sctp_add_pad_tombuf(m_at, padval));
2576                         }
2577                 }
2578         }
2579         SCTP_LTRACE_ERR_RET_PKT(m, NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
2580         return (EFAULT);
2581 }
2582
2583 static void
2584 sctp_notify_assoc_change(uint16_t state, struct sctp_tcb *stcb,
2585     uint16_t error, struct sctp_abort_chunk *abort, uint8_t from_peer, int so_locked
2586 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2587     SCTP_UNUSED
2588 #endif
2589 )
2590 {
2591         struct mbuf *m_notify;
2592         struct sctp_assoc_change *sac;
2593         struct sctp_queued_to_read *control;
2594         size_t notif_len, abort_len;
2595         unsigned int i;
2596
2597 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2598         struct socket *so;
2599
2600 #endif
2601
2602         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVASSOCEVNT)) {
2603                 notif_len = sizeof(struct sctp_assoc_change);
2604                 if (abort != NULL) {
2605                         abort_len = htons(abort->ch.chunk_length);
2606                 } else {
2607                         abort_len = 0;
2608                 }
2609                 if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
2610                         notif_len += SCTP_ASSOC_SUPPORTS_MAX;
2611                 } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
2612                         notif_len += abort_len;
2613                 }
2614                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
2615                 if (m_notify == NULL) {
2616                         /* Retry with smaller value. */
2617                         notif_len = sizeof(struct sctp_assoc_change);
2618                         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
2619                         if (m_notify == NULL) {
2620                                 goto set_error;
2621                         }
2622                 }
2623                 SCTP_BUF_NEXT(m_notify) = NULL;
2624                 sac = mtod(m_notify, struct sctp_assoc_change *);
2625                 sac->sac_type = SCTP_ASSOC_CHANGE;
2626                 sac->sac_flags = 0;
2627                 sac->sac_length = sizeof(struct sctp_assoc_change);
2628                 sac->sac_state = state;
2629                 sac->sac_error = error;
2630                 /* XXX verify these stream counts */
2631                 sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
2632                 sac->sac_inbound_streams = stcb->asoc.streamincnt;
2633                 sac->sac_assoc_id = sctp_get_associd(stcb);
2634                 if (notif_len > sizeof(struct sctp_assoc_change)) {
2635                         if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
2636                                 i = 0;
2637                                 if (stcb->asoc.peer_supports_prsctp) {
2638                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_PR;
2639                                 }
2640                                 if (stcb->asoc.peer_supports_auth) {
2641                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_AUTH;
2642                                 }
2643                                 if (stcb->asoc.peer_supports_asconf) {
2644                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_ASCONF;
2645                                 }
2646                                 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_MULTIBUF;
2647                                 if (stcb->asoc.peer_supports_strreset) {
2648                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_RE_CONFIG;
2649                                 }
2650                                 sac->sac_length += i;
2651                         } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
2652                                 memcpy(sac->sac_info, abort, abort_len);
2653                                 sac->sac_length += abort_len;
2654                         }
2655                 }
2656                 SCTP_BUF_LEN(m_notify) = sac->sac_length;
2657                 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2658                     0, 0, stcb->asoc.context, 0, 0, 0,
2659                     m_notify);
2660                 if (control != NULL) {
2661                         control->length = SCTP_BUF_LEN(m_notify);
2662                         /* not that we need this */
2663                         control->tail_mbuf = m_notify;
2664                         control->spec_flags = M_NOTIFICATION;
2665                         sctp_add_to_readq(stcb->sctp_ep, stcb,
2666                             control,
2667                             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD,
2668                             so_locked);
2669                 } else {
2670                         sctp_m_freem(m_notify);
2671                 }
2672         }
2673         /*
2674          * For 1-to-1 style sockets, we send up and error when an ABORT
2675          * comes in.
2676          */
2677 set_error:
2678         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2679             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2680             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
2681                 if (from_peer) {
2682                         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) {
2683                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNREFUSED);
2684                                 stcb->sctp_socket->so_error = ECONNREFUSED;
2685                         } else {
2686                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
2687                                 stcb->sctp_socket->so_error = ECONNRESET;
2688                         }
2689                 } else {
2690                         SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNABORTED);
2691                         stcb->sctp_socket->so_error = ECONNABORTED;
2692                 }
2693         }
2694         /* Wake ANY sleepers */
2695 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2696         so = SCTP_INP_SO(stcb->sctp_ep);
2697         if (!so_locked) {
2698                 atomic_add_int(&stcb->asoc.refcnt, 1);
2699                 SCTP_TCB_UNLOCK(stcb);
2700                 SCTP_SOCKET_LOCK(so, 1);
2701                 SCTP_TCB_LOCK(stcb);
2702                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2703                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2704                         SCTP_SOCKET_UNLOCK(so, 1);
2705                         return;
2706                 }
2707         }
2708 #endif
2709         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2710             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2711             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
2712                 socantrcvmore(stcb->sctp_socket);
2713         }
2714         sorwakeup(stcb->sctp_socket);
2715         sowwakeup(stcb->sctp_socket);
2716 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2717         if (!so_locked) {
2718                 SCTP_SOCKET_UNLOCK(so, 1);
2719         }
2720 #endif
2721 }
2722
2723 static void
2724 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
2725     struct sockaddr *sa, uint32_t error)
2726 {
2727         struct mbuf *m_notify;
2728         struct sctp_paddr_change *spc;
2729         struct sctp_queued_to_read *control;
2730
2731         if ((stcb == NULL) ||
2732             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPADDREVNT)) {
2733                 /* event not enabled */
2734                 return;
2735         }
2736         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 0, M_NOWAIT, 1, MT_DATA);
2737         if (m_notify == NULL)
2738                 return;
2739         SCTP_BUF_LEN(m_notify) = 0;
2740         spc = mtod(m_notify, struct sctp_paddr_change *);
2741         spc->spc_type = SCTP_PEER_ADDR_CHANGE;
2742         spc->spc_flags = 0;
2743         spc->spc_length = sizeof(struct sctp_paddr_change);
2744         switch (sa->sa_family) {
2745 #ifdef INET
2746         case AF_INET:
2747                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2748                 break;
2749 #endif
2750 #ifdef INET6
2751         case AF_INET6:
2752                 {
2753                         struct sockaddr_in6 *sin6;
2754
2755                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6));
2756
2757                         sin6 = (struct sockaddr_in6 *)&spc->spc_aaddr;
2758                         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2759                                 if (sin6->sin6_scope_id == 0) {
2760                                         /* recover scope_id for user */
2761                                         (void)sa6_recoverscope(sin6);
2762                                 } else {
2763                                         /* clear embedded scope_id for user */
2764                                         in6_clearscope(&sin6->sin6_addr);
2765                                 }
2766                         }
2767                         break;
2768                 }
2769 #endif
2770         default:
2771                 /* TSNH */
2772                 break;
2773         }
2774         spc->spc_state = state;
2775         spc->spc_error = error;
2776         spc->spc_assoc_id = sctp_get_associd(stcb);
2777
2778         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_paddr_change);
2779         SCTP_BUF_NEXT(m_notify) = NULL;
2780
2781         /* append to socket */
2782         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2783             0, 0, stcb->asoc.context, 0, 0, 0,
2784             m_notify);
2785         if (control == NULL) {
2786                 /* no memory */
2787                 sctp_m_freem(m_notify);
2788                 return;
2789         }
2790         control->length = SCTP_BUF_LEN(m_notify);
2791         control->spec_flags = M_NOTIFICATION;
2792         /* not that we need this */
2793         control->tail_mbuf = m_notify;
2794         sctp_add_to_readq(stcb->sctp_ep, stcb,
2795             control,
2796             &stcb->sctp_socket->so_rcv, 1,
2797             SCTP_READ_LOCK_NOT_HELD,
2798             SCTP_SO_NOT_LOCKED);
2799 }
2800
2801
2802 static void
2803 sctp_notify_send_failed(struct sctp_tcb *stcb, uint8_t sent, uint32_t error,
2804     struct sctp_tmit_chunk *chk, int so_locked
2805 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2806     SCTP_UNUSED
2807 #endif
2808 )
2809 {
2810         struct mbuf *m_notify;
2811         struct sctp_send_failed *ssf;
2812         struct sctp_send_failed_event *ssfe;
2813         struct sctp_queued_to_read *control;
2814         int length;
2815
2816         if ((stcb == NULL) ||
2817             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
2818             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
2819                 /* event not enabled */
2820                 return;
2821         }
2822         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2823                 length = sizeof(struct sctp_send_failed_event);
2824         } else {
2825                 length = sizeof(struct sctp_send_failed);
2826         }
2827         m_notify = sctp_get_mbuf_for_msg(length, 0, M_NOWAIT, 1, MT_DATA);
2828         if (m_notify == NULL)
2829                 /* no space left */
2830                 return;
2831         length += chk->send_size;
2832         length -= sizeof(struct sctp_data_chunk);
2833         SCTP_BUF_LEN(m_notify) = 0;
2834         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2835                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
2836                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
2837                 if (sent) {
2838                         ssfe->ssfe_flags = SCTP_DATA_SENT;
2839                 } else {
2840                         ssfe->ssfe_flags = SCTP_DATA_UNSENT;
2841                 }
2842                 ssfe->ssfe_length = length;
2843                 ssfe->ssfe_error = error;
2844                 /* not exactly what the user sent in, but should be close :) */
2845                 bzero(&ssfe->ssfe_info, sizeof(ssfe->ssfe_info));
2846                 ssfe->ssfe_info.snd_sid = chk->rec.data.stream_number;
2847                 ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags;
2848                 ssfe->ssfe_info.snd_ppid = chk->rec.data.payloadtype;
2849                 ssfe->ssfe_info.snd_context = chk->rec.data.context;
2850                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
2851                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
2852                 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed_event);
2853         } else {
2854                 ssf = mtod(m_notify, struct sctp_send_failed *);
2855                 ssf->ssf_type = SCTP_SEND_FAILED;
2856                 if (sent) {
2857                         ssf->ssf_flags = SCTP_DATA_SENT;
2858                 } else {
2859                         ssf->ssf_flags = SCTP_DATA_UNSENT;
2860                 }
2861                 ssf->ssf_length = length;
2862                 ssf->ssf_error = error;
2863                 /* not exactly what the user sent in, but should be close :) */
2864                 bzero(&ssf->ssf_info, sizeof(ssf->ssf_info));
2865                 ssf->ssf_info.sinfo_stream = chk->rec.data.stream_number;
2866                 ssf->ssf_info.sinfo_ssn = chk->rec.data.stream_seq;
2867                 ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags;
2868                 ssf->ssf_info.sinfo_ppid = chk->rec.data.payloadtype;
2869                 ssf->ssf_info.sinfo_context = chk->rec.data.context;
2870                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
2871                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
2872                 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed);
2873         }
2874         if (chk->data) {
2875                 /*
2876                  * trim off the sctp chunk header(it should be there)
2877                  */
2878                 if (chk->send_size >= sizeof(struct sctp_data_chunk)) {
2879                         m_adj(chk->data, sizeof(struct sctp_data_chunk));
2880                         sctp_mbuf_crush(chk->data);
2881                         chk->send_size -= sizeof(struct sctp_data_chunk);
2882                 }
2883         }
2884         SCTP_BUF_NEXT(m_notify) = chk->data;
2885         /* Steal off the mbuf */
2886         chk->data = NULL;
2887         /*
2888          * For this case, we check the actual socket buffer, since the assoc
2889          * is going away we don't want to overfill the socket buffer for a
2890          * non-reader
2891          */
2892         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
2893                 sctp_m_freem(m_notify);
2894                 return;
2895         }
2896         /* append to socket */
2897         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2898             0, 0, stcb->asoc.context, 0, 0, 0,
2899             m_notify);
2900         if (control == NULL) {
2901                 /* no memory */
2902                 sctp_m_freem(m_notify);
2903                 return;
2904         }
2905         control->spec_flags = M_NOTIFICATION;
2906         sctp_add_to_readq(stcb->sctp_ep, stcb,
2907             control,
2908             &stcb->sctp_socket->so_rcv, 1,
2909             SCTP_READ_LOCK_NOT_HELD,
2910             so_locked);
2911 }
2912
2913
2914 static void
2915 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
2916     struct sctp_stream_queue_pending *sp, int so_locked
2917 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2918     SCTP_UNUSED
2919 #endif
2920 )
2921 {
2922         struct mbuf *m_notify;
2923         struct sctp_send_failed *ssf;
2924         struct sctp_send_failed_event *ssfe;
2925         struct sctp_queued_to_read *control;
2926         int length;
2927
2928         if ((stcb == NULL) ||
2929             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
2930             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
2931                 /* event not enabled */
2932                 return;
2933         }
2934         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2935                 length = sizeof(struct sctp_send_failed_event);
2936         } else {
2937                 length = sizeof(struct sctp_send_failed);
2938         }
2939         m_notify = sctp_get_mbuf_for_msg(length, 0, M_NOWAIT, 1, MT_DATA);
2940         if (m_notify == NULL) {
2941                 /* no space left */
2942                 return;
2943         }
2944         length += sp->length;
2945         SCTP_BUF_LEN(m_notify) = 0;
2946         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2947                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
2948                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
2949                 ssfe->ssfe_flags = SCTP_DATA_UNSENT;
2950                 ssfe->ssfe_length = length;
2951                 ssfe->ssfe_error = error;
2952                 /* not exactly what the user sent in, but should be close :) */
2953                 bzero(&ssfe->ssfe_info, sizeof(ssfe->ssfe_info));
2954                 ssfe->ssfe_info.snd_sid = sp->stream;
2955                 if (sp->some_taken) {
2956                         ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG;
2957                 } else {
2958                         ssfe->ssfe_info.snd_flags = SCTP_DATA_NOT_FRAG;
2959                 }
2960                 ssfe->ssfe_info.snd_ppid = sp->ppid;
2961                 ssfe->ssfe_info.snd_context = sp->context;
2962                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
2963                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
2964                 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed_event);
2965         } else {
2966                 ssf = mtod(m_notify, struct sctp_send_failed *);
2967                 ssf->ssf_type = SCTP_SEND_FAILED;
2968                 ssf->ssf_flags = SCTP_DATA_UNSENT;
2969                 ssf->ssf_length = length;
2970                 ssf->ssf_error = error;
2971                 /* not exactly what the user sent in, but should be close :) */
2972                 bzero(&ssf->ssf_info, sizeof(ssf->ssf_info));
2973                 ssf->ssf_info.sinfo_stream = sp->stream;
2974                 ssf->ssf_info.sinfo_ssn = 0;
2975                 if (sp->some_taken) {
2976                         ssf->ssf_info.sinfo_flags = SCTP_DATA_LAST_FRAG;
2977                 } else {
2978                         ssf->ssf_info.sinfo_flags = SCTP_DATA_NOT_FRAG;
2979                 }
2980                 ssf->ssf_info.sinfo_ppid = sp->ppid;
2981                 ssf->ssf_info.sinfo_context = sp->context;
2982                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
2983                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
2984                 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed);
2985         }
2986         SCTP_BUF_NEXT(m_notify) = sp->data;
2987
2988         /* Steal off the mbuf */
2989         sp->data = NULL;
2990         /*
2991          * For this case, we check the actual socket buffer, since the assoc
2992          * is going away we don't want to overfill the socket buffer for a
2993          * non-reader
2994          */
2995         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
2996                 sctp_m_freem(m_notify);
2997                 return;
2998         }
2999         /* append to socket */
3000         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3001             0, 0, stcb->asoc.context, 0, 0, 0,
3002             m_notify);
3003         if (control == NULL) {
3004                 /* no memory */
3005                 sctp_m_freem(m_notify);
3006                 return;
3007         }
3008         control->spec_flags = M_NOTIFICATION;
3009         sctp_add_to_readq(stcb->sctp_ep, stcb,
3010             control,
3011             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3012 }
3013
3014
3015
3016 static void
3017 sctp_notify_adaptation_layer(struct sctp_tcb *stcb)
3018 {
3019         struct mbuf *m_notify;
3020         struct sctp_adaptation_event *sai;
3021         struct sctp_queued_to_read *control;
3022
3023         if ((stcb == NULL) ||
3024             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ADAPTATIONEVNT)) {
3025                 /* event not enabled */
3026                 return;
3027         }
3028         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_NOWAIT, 1, MT_DATA);
3029         if (m_notify == NULL)
3030                 /* no space left */
3031                 return;
3032         SCTP_BUF_LEN(m_notify) = 0;
3033         sai = mtod(m_notify, struct sctp_adaptation_event *);
3034         sai->sai_type = SCTP_ADAPTATION_INDICATION;
3035         sai->sai_flags = 0;
3036         sai->sai_length = sizeof(struct sctp_adaptation_event);
3037         sai->sai_adaptation_ind = stcb->asoc.peers_adaptation;
3038         sai->sai_assoc_id = sctp_get_associd(stcb);
3039
3040         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_adaptation_event);
3041         SCTP_BUF_NEXT(m_notify) = NULL;
3042
3043         /* append to socket */
3044         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3045             0, 0, stcb->asoc.context, 0, 0, 0,
3046             m_notify);
3047         if (control == NULL) {
3048                 /* no memory */
3049                 sctp_m_freem(m_notify);
3050                 return;
3051         }
3052         control->length = SCTP_BUF_LEN(m_notify);
3053         control->spec_flags = M_NOTIFICATION;
3054         /* not that we need this */
3055         control->tail_mbuf = m_notify;
3056         sctp_add_to_readq(stcb->sctp_ep, stcb,
3057             control,
3058             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3059 }
3060
3061 /* This always must be called with the read-queue LOCKED in the INP */
3062 static void
3063 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb, uint32_t error,
3064     uint32_t val, int so_locked
3065 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3066     SCTP_UNUSED
3067 #endif
3068 )
3069 {
3070         struct mbuf *m_notify;
3071         struct sctp_pdapi_event *pdapi;
3072         struct sctp_queued_to_read *control;
3073         struct sockbuf *sb;
3074
3075         if ((stcb == NULL) ||
3076             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_PDAPIEVNT)) {
3077                 /* event not enabled */
3078                 return;
3079         }
3080         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
3081                 return;
3082         }
3083         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 0, M_NOWAIT, 1, MT_DATA);
3084         if (m_notify == NULL)
3085                 /* no space left */
3086                 return;
3087         SCTP_BUF_LEN(m_notify) = 0;
3088         pdapi = mtod(m_notify, struct sctp_pdapi_event *);
3089         pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
3090         pdapi->pdapi_flags = 0;
3091         pdapi->pdapi_length = sizeof(struct sctp_pdapi_event);
3092         pdapi->pdapi_indication = error;
3093         pdapi->pdapi_stream = (val >> 16);
3094         pdapi->pdapi_seq = (val & 0x0000ffff);
3095         pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
3096
3097         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_pdapi_event);
3098         SCTP_BUF_NEXT(m_notify) = NULL;
3099         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3100             0, 0, stcb->asoc.context, 0, 0, 0,
3101             m_notify);
3102         if (control == NULL) {
3103                 /* no memory */
3104                 sctp_m_freem(m_notify);
3105                 return;
3106         }
3107         control->spec_flags = M_NOTIFICATION;
3108         control->length = SCTP_BUF_LEN(m_notify);
3109         /* not that we need this */
3110         control->tail_mbuf = m_notify;
3111         control->held_length = 0;
3112         control->length = 0;
3113         sb = &stcb->sctp_socket->so_rcv;
3114         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3115                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m_notify));
3116         }
3117         sctp_sballoc(stcb, sb, m_notify);
3118         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3119                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3120         }
3121         atomic_add_int(&control->length, SCTP_BUF_LEN(m_notify));
3122         control->end_added = 1;
3123         if (stcb->asoc.control_pdapi)
3124                 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next);
3125         else {
3126                 /* we really should not see this case */
3127                 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next);
3128         }
3129         if (stcb->sctp_ep && stcb->sctp_socket) {
3130                 /* This should always be the case */
3131 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3132                 struct socket *so;
3133
3134                 so = SCTP_INP_SO(stcb->sctp_ep);
3135                 if (!so_locked) {
3136                         atomic_add_int(&stcb->asoc.refcnt, 1);
3137                         SCTP_TCB_UNLOCK(stcb);
3138                         SCTP_SOCKET_LOCK(so, 1);
3139                         SCTP_TCB_LOCK(stcb);
3140                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
3141                         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3142                                 SCTP_SOCKET_UNLOCK(so, 1);
3143                                 return;
3144                         }
3145                 }
3146 #endif
3147                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
3148 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3149                 if (!so_locked) {
3150                         SCTP_SOCKET_UNLOCK(so, 1);
3151                 }
3152 #endif
3153         }
3154 }
3155
3156 static void
3157 sctp_notify_shutdown_event(struct sctp_tcb *stcb)
3158 {
3159         struct mbuf *m_notify;
3160         struct sctp_shutdown_event *sse;
3161         struct sctp_queued_to_read *control;
3162
3163         /*
3164          * For TCP model AND UDP connected sockets we will send an error up
3165          * when an SHUTDOWN completes
3166          */
3167         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3168             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
3169                 /* mark socket closed for read/write and wakeup! */
3170 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3171                 struct socket *so;
3172
3173                 so = SCTP_INP_SO(stcb->sctp_ep);
3174                 atomic_add_int(&stcb->asoc.refcnt, 1);
3175                 SCTP_TCB_UNLOCK(stcb);
3176                 SCTP_SOCKET_LOCK(so, 1);
3177                 SCTP_TCB_LOCK(stcb);
3178                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3179                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
3180                         SCTP_SOCKET_UNLOCK(so, 1);
3181                         return;
3182                 }
3183 #endif
3184                 socantsendmore(stcb->sctp_socket);
3185 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3186                 SCTP_SOCKET_UNLOCK(so, 1);
3187 #endif
3188         }
3189         if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT)) {
3190                 /* event not enabled */
3191                 return;
3192         }
3193         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 0, M_NOWAIT, 1, MT_DATA);
3194         if (m_notify == NULL)
3195                 /* no space left */
3196                 return;
3197         sse = mtod(m_notify, struct sctp_shutdown_event *);
3198         sse->sse_type = SCTP_SHUTDOWN_EVENT;
3199         sse->sse_flags = 0;
3200         sse->sse_length = sizeof(struct sctp_shutdown_event);
3201         sse->sse_assoc_id = sctp_get_associd(stcb);
3202
3203         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_shutdown_event);
3204         SCTP_BUF_NEXT(m_notify) = NULL;
3205
3206         /* append to socket */
3207         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3208             0, 0, stcb->asoc.context, 0, 0, 0,
3209             m_notify);
3210         if (control == NULL) {
3211                 /* no memory */
3212                 sctp_m_freem(m_notify);
3213                 return;
3214         }
3215         control->spec_flags = M_NOTIFICATION;
3216         control->length = SCTP_BUF_LEN(m_notify);
3217         /* not that we need this */
3218         control->tail_mbuf = m_notify;
3219         sctp_add_to_readq(stcb->sctp_ep, stcb,
3220             control,
3221             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3222 }
3223
3224 static void
3225 sctp_notify_sender_dry_event(struct sctp_tcb *stcb,
3226     int so_locked
3227 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3228     SCTP_UNUSED
3229 #endif
3230 )
3231 {
3232         struct mbuf *m_notify;
3233         struct sctp_sender_dry_event *event;
3234         struct sctp_queued_to_read *control;
3235
3236         if ((stcb == NULL) ||
3237             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DRYEVNT)) {
3238                 /* event not enabled */
3239                 return;
3240         }
3241         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_sender_dry_event), 0, M_NOWAIT, 1, MT_DATA);
3242         if (m_notify == NULL) {
3243                 /* no space left */
3244                 return;
3245         }
3246         SCTP_BUF_LEN(m_notify) = 0;
3247         event = mtod(m_notify, struct sctp_sender_dry_event *);
3248         event->sender_dry_type = SCTP_SENDER_DRY_EVENT;
3249         event->sender_dry_flags = 0;
3250         event->sender_dry_length = sizeof(struct sctp_sender_dry_event);
3251         event->sender_dry_assoc_id = sctp_get_associd(stcb);
3252
3253         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_sender_dry_event);
3254         SCTP_BUF_NEXT(m_notify) = NULL;
3255
3256         /* append to socket */
3257         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3258             0, 0, stcb->asoc.context, 0, 0, 0,
3259             m_notify);
3260         if (control == NULL) {
3261                 /* no memory */
3262                 sctp_m_freem(m_notify);
3263                 return;
3264         }
3265         control->length = SCTP_BUF_LEN(m_notify);
3266         control->spec_flags = M_NOTIFICATION;
3267         /* not that we need this */
3268         control->tail_mbuf = m_notify;
3269         sctp_add_to_readq(stcb->sctp_ep, stcb, control,
3270             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3271 }
3272
3273
3274 void
3275 sctp_notify_stream_reset_add(struct sctp_tcb *stcb, uint16_t numberin, uint16_t numberout, int flag)
3276 {
3277         struct mbuf *m_notify;
3278         struct sctp_queued_to_read *control;
3279         struct sctp_stream_change_event *stradd;
3280         int len;
3281
3282         if ((stcb == NULL) ||
3283             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT))) {
3284                 /* event not enabled */
3285                 return;
3286         }
3287         if ((stcb->asoc.peer_req_out) && flag) {
3288                 /* Peer made the request, don't tell the local user */
3289                 stcb->asoc.peer_req_out = 0;
3290                 return;
3291         }
3292         stcb->asoc.peer_req_out = 0;
3293         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
3294         if (m_notify == NULL)
3295                 /* no space left */
3296                 return;
3297         SCTP_BUF_LEN(m_notify) = 0;
3298         len = sizeof(struct sctp_stream_change_event);
3299         if (len > M_TRAILINGSPACE(m_notify)) {
3300                 /* never enough room */
3301                 sctp_m_freem(m_notify);
3302                 return;
3303         }
3304         stradd = mtod(m_notify, struct sctp_stream_change_event *);
3305         stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT;
3306         stradd->strchange_flags = flag;
3307         stradd->strchange_length = len;
3308         stradd->strchange_assoc_id = sctp_get_associd(stcb);
3309         stradd->strchange_instrms = numberin;
3310         stradd->strchange_outstrms = numberout;
3311         SCTP_BUF_LEN(m_notify) = len;
3312         SCTP_BUF_NEXT(m_notify) = NULL;
3313         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3314                 /* no space */
3315                 sctp_m_freem(m_notify);
3316                 return;
3317         }
3318         /* append to socket */
3319         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3320             0, 0, stcb->asoc.context, 0, 0, 0,
3321             m_notify);
3322         if (control == NULL) {
3323                 /* no memory */
3324                 sctp_m_freem(m_notify);
3325                 return;
3326         }
3327         control->spec_flags = M_NOTIFICATION;
3328         control->length = SCTP_BUF_LEN(m_notify);
3329         /* not that we need this */
3330         control->tail_mbuf = m_notify;
3331         sctp_add_to_readq(stcb->sctp_ep, stcb,
3332             control,
3333             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3334 }
3335
3336 void
3337 sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb, uint32_t sending_tsn, uint32_t recv_tsn, int flag)
3338 {
3339         struct mbuf *m_notify;
3340         struct sctp_queued_to_read *control;
3341         struct sctp_assoc_reset_event *strasoc;
3342         int len;
3343
3344         if ((stcb == NULL) ||
3345             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT))) {
3346                 /* event not enabled */
3347                 return;
3348         }
3349         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
3350         if (m_notify == NULL)
3351                 /* no space left */
3352                 return;
3353         SCTP_BUF_LEN(m_notify) = 0;
3354         len = sizeof(struct sctp_assoc_reset_event);
3355         if (len > M_TRAILINGSPACE(m_notify)) {
3356                 /* never enough room */
3357                 sctp_m_freem(m_notify);
3358                 return;
3359         }
3360         strasoc = mtod(m_notify, struct sctp_assoc_reset_event *);
3361         strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT;
3362         strasoc->assocreset_flags = flag;
3363         strasoc->assocreset_length = len;
3364         strasoc->assocreset_assoc_id = sctp_get_associd(stcb);
3365         strasoc->assocreset_local_tsn = sending_tsn;
3366         strasoc->assocreset_remote_tsn = recv_tsn;
3367         SCTP_BUF_LEN(m_notify) = len;
3368         SCTP_BUF_NEXT(m_notify) = NULL;
3369         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3370                 /* no space */
3371                 sctp_m_freem(m_notify);
3372                 return;
3373         }
3374         /* append to socket */
3375         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3376             0, 0, stcb->asoc.context, 0, 0, 0,
3377             m_notify);
3378         if (control == NULL) {
3379                 /* no memory */
3380                 sctp_m_freem(m_notify);
3381                 return;
3382         }
3383         control->spec_flags = M_NOTIFICATION;
3384         control->length = SCTP_BUF_LEN(m_notify);
3385         /* not that we need this */
3386         control->tail_mbuf = m_notify;
3387         sctp_add_to_readq(stcb->sctp_ep, stcb,
3388             control,
3389             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3390 }
3391
3392
3393
3394 static void
3395 sctp_notify_stream_reset(struct sctp_tcb *stcb,
3396     int number_entries, uint16_t * list, int flag)
3397 {
3398         struct mbuf *m_notify;
3399         struct sctp_queued_to_read *control;
3400         struct sctp_stream_reset_event *strreset;
3401         int len;
3402
3403         if ((stcb == NULL) ||
3404             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_RESETEVNT))) {
3405                 /* event not enabled */
3406                 return;
3407         }
3408         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
3409         if (m_notify == NULL)
3410                 /* no space left */
3411                 return;
3412         SCTP_BUF_LEN(m_notify) = 0;
3413         len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
3414         if (len > M_TRAILINGSPACE(m_notify)) {
3415                 /* never enough room */
3416                 sctp_m_freem(m_notify);
3417                 return;
3418         }
3419         strreset = mtod(m_notify, struct sctp_stream_reset_event *);
3420         strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
3421         strreset->strreset_flags = flag;
3422         strreset->strreset_length = len;
3423         strreset->strreset_assoc_id = sctp_get_associd(stcb);
3424         if (number_entries) {
3425                 int i;
3426
3427                 for (i = 0; i < number_entries; i++) {
3428                         strreset->strreset_stream_list[i] = ntohs(list[i]);
3429                 }
3430         }
3431         SCTP_BUF_LEN(m_notify) = len;
3432         SCTP_BUF_NEXT(m_notify) = NULL;
3433         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3434                 /* no space */
3435                 sctp_m_freem(m_notify);
3436                 return;
3437         }
3438         /* append to socket */
3439         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3440             0, 0, stcb->asoc.context, 0, 0, 0,
3441             m_notify);
3442         if (control == NULL) {
3443                 /* no memory */
3444                 sctp_m_freem(m_notify);
3445                 return;
3446         }
3447         control->spec_flags = M_NOTIFICATION;
3448         control->length = SCTP_BUF_LEN(m_notify);
3449         /* not that we need this */
3450         control->tail_mbuf = m_notify;
3451         sctp_add_to_readq(stcb->sctp_ep, stcb,
3452             control,
3453             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3454 }
3455
3456
3457 static void
3458 sctp_notify_remote_error(struct sctp_tcb *stcb, uint16_t error, struct sctp_error_chunk *chunk)
3459 {
3460         struct mbuf *m_notify;
3461         struct sctp_remote_error *sre;
3462         struct sctp_queued_to_read *control;
3463         size_t notif_len, chunk_len;
3464
3465         if ((stcb == NULL) ||
3466             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPEERERR)) {
3467                 return;
3468         }
3469         if (chunk != NULL) {
3470                 chunk_len = htons(chunk->ch.chunk_length);
3471         } else {
3472                 chunk_len = 0;
3473         }
3474         notif_len = sizeof(struct sctp_remote_error) + chunk_len;
3475         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3476         if (m_notify == NULL) {
3477                 /* Retry with smaller value. */
3478                 notif_len = sizeof(struct sctp_remote_error);
3479                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3480                 if (m_notify == NULL) {
3481                         return;
3482                 }
3483         }
3484         SCTP_BUF_NEXT(m_notify) = NULL;
3485         sre = mtod(m_notify, struct sctp_remote_error *);
3486         sre->sre_type = SCTP_REMOTE_ERROR;
3487         sre->sre_flags = 0;
3488         sre->sre_length = sizeof(struct sctp_remote_error);
3489         sre->sre_error = error;
3490         sre->sre_assoc_id = sctp_get_associd(stcb);
3491         if (notif_len > sizeof(struct sctp_remote_error)) {
3492                 memcpy(sre->sre_data, chunk, chunk_len);
3493                 sre->sre_length += chunk_len;
3494         }
3495         SCTP_BUF_LEN(m_notify) = sre->sre_length;
3496         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3497             0, 0, stcb->asoc.context, 0, 0, 0,
3498             m_notify);
3499         if (control != NULL) {
3500                 control->length = SCTP_BUF_LEN(m_notify);
3501                 /* not that we need this */
3502                 control->tail_mbuf = m_notify;
3503                 control->spec_flags = M_NOTIFICATION;
3504                 sctp_add_to_readq(stcb->sctp_ep, stcb,
3505                     control,
3506                     &stcb->sctp_socket->so_rcv, 1,
3507                     SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3508         } else {
3509                 sctp_m_freem(m_notify);
3510         }
3511 }
3512
3513
3514 void
3515 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb,
3516     uint32_t error, void *data, int so_locked
3517 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3518     SCTP_UNUSED
3519 #endif
3520 )
3521 {
3522         if ((stcb == NULL) ||
3523             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3524             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3525             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3526                 /* If the socket is gone we are out of here */
3527                 return;
3528         }
3529         if (stcb->sctp_socket->so_rcv.sb_state & SBS_CANTRCVMORE) {
3530                 return;
3531         }
3532         if (stcb && ((stcb->asoc.state & SCTP_STATE_COOKIE_WAIT) ||
3533             (stcb->asoc.state & SCTP_STATE_COOKIE_ECHOED))) {
3534                 if ((notification == SCTP_NOTIFY_INTERFACE_DOWN) ||
3535                     (notification == SCTP_NOTIFY_INTERFACE_UP) ||
3536                     (notification == SCTP_NOTIFY_INTERFACE_CONFIRMED)) {
3537                         /* Don't report these in front states */
3538                         return;
3539                 }
3540         }
3541         switch (notification) {
3542         case SCTP_NOTIFY_ASSOC_UP:
3543                 if (stcb->asoc.assoc_up_sent == 0) {
3544                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, NULL, 0, so_locked);
3545                         stcb->asoc.assoc_up_sent = 1;
3546                 }
3547                 if (stcb->asoc.adaptation_needed && (stcb->asoc.adaptation_sent == 0)) {
3548                         sctp_notify_adaptation_layer(stcb);
3549                 }
3550                 if (stcb->asoc.peer_supports_auth == 0) {
3551                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3552                             NULL, so_locked);
3553                 }
3554                 break;
3555         case SCTP_NOTIFY_ASSOC_DOWN:
3556                 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, NULL, 0, so_locked);
3557                 break;
3558         case SCTP_NOTIFY_INTERFACE_DOWN:
3559                 {
3560                         struct sctp_nets *net;
3561
3562                         net = (struct sctp_nets *)data;
3563                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE,
3564                             (struct sockaddr *)&net->ro._l_addr, error);
3565                         break;
3566                 }
3567         case SCTP_NOTIFY_INTERFACE_UP:
3568                 {
3569                         struct sctp_nets *net;
3570
3571                         net = (struct sctp_nets *)data;
3572                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE,
3573                             (struct sockaddr *)&net->ro._l_addr, error);
3574                         break;
3575                 }
3576         case SCTP_NOTIFY_INTERFACE_CONFIRMED:
3577                 {
3578                         struct sctp_nets *net;
3579
3580                         net = (struct sctp_nets *)data;
3581                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED,
3582                             (struct sockaddr *)&net->ro._l_addr, error);
3583                         break;
3584                 }
3585         case SCTP_NOTIFY_SPECIAL_SP_FAIL:
3586                 sctp_notify_send_failed2(stcb, error,
3587                     (struct sctp_stream_queue_pending *)data, so_locked);
3588                 break;
3589         case SCTP_NOTIFY_SENT_DG_FAIL:
3590                 sctp_notify_send_failed(stcb, 1, error,
3591                     (struct sctp_tmit_chunk *)data, so_locked);
3592                 break;
3593         case SCTP_NOTIFY_UNSENT_DG_FAIL:
3594                 sctp_notify_send_failed(stcb, 0, error,
3595                     (struct sctp_tmit_chunk *)data, so_locked);
3596                 break;
3597         case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION:
3598                 {
3599                         uint32_t val;
3600
3601                         val = *((uint32_t *) data);
3602
3603                         sctp_notify_partial_delivery_indication(stcb, error, val, so_locked);
3604                         break;
3605                 }
3606         case SCTP_NOTIFY_ASSOC_LOC_ABORTED:
3607                 if ((stcb) && (((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_WAIT) ||
3608                     ((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_ECHOED))) {
3609                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 0, so_locked);
3610                 } else {
3611                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 0, so_locked);
3612                 }
3613                 break;
3614         case SCTP_NOTIFY_ASSOC_REM_ABORTED:
3615                 if ((stcb) && (((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_WAIT) ||
3616                     ((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_ECHOED))) {
3617                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 1, so_locked);
3618                 } else {
3619                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 1, so_locked);
3620                 }
3621                 break;
3622         case SCTP_NOTIFY_ASSOC_RESTART:
3623                 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, NULL, 0, so_locked);
3624                 if (stcb->asoc.peer_supports_auth == 0) {
3625                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3626                             NULL, so_locked);
3627                 }
3628                 break;
3629         case SCTP_NOTIFY_STR_RESET_SEND:
3630                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STREAM_RESET_OUTGOING_SSN);
3631                 break;
3632         case SCTP_NOTIFY_STR_RESET_RECV:
3633                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STREAM_RESET_INCOMING);
3634                 break;
3635         case SCTP_NOTIFY_STR_RESET_FAILED_OUT:
3636                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3637                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_FAILED));
3638                 break;
3639         case SCTP_NOTIFY_STR_RESET_DENIED_OUT:
3640                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3641                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_DENIED));
3642                 break;
3643         case SCTP_NOTIFY_STR_RESET_FAILED_IN:
3644                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3645                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_FAILED));
3646                 break;
3647         case SCTP_NOTIFY_STR_RESET_DENIED_IN:
3648                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3649                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_DENIED));
3650                 break;
3651         case SCTP_NOTIFY_ASCONF_ADD_IP:
3652                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data,
3653                     error);
3654                 break;
3655         case SCTP_NOTIFY_ASCONF_DELETE_IP:
3656                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data,
3657                     error);
3658                 break;
3659         case SCTP_NOTIFY_ASCONF_SET_PRIMARY:
3660                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data,
3661                     error);
3662                 break;
3663         case SCTP_NOTIFY_PEER_SHUTDOWN:
3664                 sctp_notify_shutdown_event(stcb);
3665                 break;
3666         case SCTP_NOTIFY_AUTH_NEW_KEY:
3667                 sctp_notify_authentication(stcb, SCTP_AUTH_NEW_KEY, error,
3668                     (uint16_t) (uintptr_t) data,
3669                     so_locked);
3670                 break;
3671         case SCTP_NOTIFY_AUTH_FREE_KEY:
3672                 sctp_notify_authentication(stcb, SCTP_AUTH_FREE_KEY, error,
3673                     (uint16_t) (uintptr_t) data,
3674                     so_locked);
3675                 break;
3676         case SCTP_NOTIFY_NO_PEER_AUTH:
3677                 sctp_notify_authentication(stcb, SCTP_AUTH_NO_AUTH, error,
3678                     (uint16_t) (uintptr_t) data,
3679                     so_locked);
3680                 break;
3681         case SCTP_NOTIFY_SENDER_DRY:
3682                 sctp_notify_sender_dry_event(stcb, so_locked);
3683                 break;
3684         case SCTP_NOTIFY_REMOTE_ERROR:
3685                 sctp_notify_remote_error(stcb, error, data);
3686                 break;
3687         default:
3688                 SCTPDBG(SCTP_DEBUG_UTIL1, "%s: unknown notification %xh (%u)\n",
3689                     __FUNCTION__, notification, notification);
3690                 break;
3691         }                       /* end switch */
3692 }
3693
3694 void
3695 sctp_report_all_outbound(struct sctp_tcb *stcb, uint16_t error, int holds_lock, int so_locked
3696 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3697     SCTP_UNUSED
3698 #endif
3699 )
3700 {
3701         struct sctp_association *asoc;
3702         struct sctp_stream_out *outs;
3703         struct sctp_tmit_chunk *chk, *nchk;
3704         struct sctp_stream_queue_pending *sp, *nsp;
3705         int i;
3706
3707         if (stcb == NULL) {
3708                 return;
3709         }
3710         asoc = &stcb->asoc;
3711         if (asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) {
3712                 /* already being freed */
3713                 return;
3714         }
3715         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3716             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3717             (asoc->state & SCTP_STATE_CLOSED_SOCKET)) {
3718                 return;
3719         }
3720         /* now through all the gunk freeing chunks */
3721         if (holds_lock == 0) {
3722                 SCTP_TCB_SEND_LOCK(stcb);
3723         }
3724         /* sent queue SHOULD be empty */
3725         TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) {
3726                 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
3727                 asoc->sent_queue_cnt--;
3728                 if (chk->sent != SCTP_DATAGRAM_NR_ACKED) {
3729                         if (asoc->strmout[chk->rec.data.stream_number].chunks_on_queues > 0) {
3730                                 asoc->strmout[chk->rec.data.stream_number].chunks_on_queues--;
3731 #ifdef INVARIANTS
3732                         } else {
3733                                 panic("No chunks on the queues for sid %u.", chk->rec.data.stream_number);
3734 #endif
3735                         }
3736                 }
3737                 if (chk->data != NULL) {
3738                         sctp_free_bufspace(stcb, asoc, chk, 1);
3739                         sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb,
3740                             error, chk, so_locked);
3741                         if (chk->data) {
3742                                 sctp_m_freem(chk->data);
3743                                 chk->data = NULL;
3744                         }
3745                 }
3746                 sctp_free_a_chunk(stcb, chk, so_locked);
3747                 /* sa_ignore FREED_MEMORY */
3748         }
3749         /* pending send queue SHOULD be empty */
3750         TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
3751                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
3752                 asoc->send_queue_cnt--;
3753                 if (asoc->strmout[chk->rec.data.stream_number].chunks_on_queues > 0) {
3754                         asoc->strmout[chk->rec.data.stream_number].chunks_on_queues--;
3755 #ifdef INVARIANTS
3756                 } else {
3757                         panic("No chunks on the queues for sid %u.", chk->rec.data.stream_number);
3758 #endif
3759                 }
3760                 if (chk->data != NULL) {
3761                         sctp_free_bufspace(stcb, asoc, chk, 1);
3762                         sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
3763                             error, chk, so_locked);
3764                         if (chk->data) {
3765                                 sctp_m_freem(chk->data);
3766                                 chk->data = NULL;
3767                         }
3768                 }
3769                 sctp_free_a_chunk(stcb, chk, so_locked);
3770                 /* sa_ignore FREED_MEMORY */
3771         }
3772         for (i = 0; i < asoc->streamoutcnt; i++) {
3773                 /* For each stream */
3774                 outs = &asoc->strmout[i];
3775                 /* clean up any sends there */
3776                 asoc->locked_on_sending = NULL;
3777                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
3778                         asoc->stream_queue_cnt--;
3779                         TAILQ_REMOVE(&outs->outqueue, sp, next);
3780                         sctp_free_spbufspace(stcb, asoc, sp);
3781                         if (sp->data) {
3782                                 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
3783                                     error, (void *)sp, so_locked);
3784                                 if (sp->data) {
3785                                         sctp_m_freem(sp->data);
3786                                         sp->data = NULL;
3787                                         sp->tail_mbuf = NULL;
3788                                         sp->length = 0;
3789                                 }
3790                         }
3791                         if (sp->net) {
3792                                 sctp_free_remote_addr(sp->net);
3793                                 sp->net = NULL;
3794                         }
3795                         /* Free the chunk */
3796                         sctp_free_a_strmoq(stcb, sp, so_locked);
3797                         /* sa_ignore FREED_MEMORY */
3798                 }
3799         }
3800
3801         if (holds_lock == 0) {
3802                 SCTP_TCB_SEND_UNLOCK(stcb);
3803         }
3804 }
3805
3806 void
3807 sctp_abort_notification(struct sctp_tcb *stcb, uint8_t from_peer, uint16_t error,
3808     struct sctp_abort_chunk *abort, int so_locked
3809 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3810     SCTP_UNUSED
3811 #endif
3812 )
3813 {
3814         if (stcb == NULL) {
3815                 return;
3816         }
3817         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
3818             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
3819             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
3820                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED;
3821         }
3822         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3823             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3824             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3825                 return;
3826         }
3827         /* Tell them we lost the asoc */
3828         sctp_report_all_outbound(stcb, error, 1, so_locked);
3829         if (from_peer) {
3830                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_REM_ABORTED, stcb, error, abort, so_locked);
3831         } else {
3832                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_LOC_ABORTED, stcb, error, abort, so_locked);
3833         }
3834 }
3835
3836 void
3837 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3838     struct mbuf *m, int iphlen,
3839     struct sockaddr *src, struct sockaddr *dst,
3840     struct sctphdr *sh, struct mbuf *op_err,
3841     uint8_t use_mflowid, uint32_t mflowid,
3842     uint32_t vrf_id, uint16_t port)
3843 {
3844         uint32_t vtag;
3845
3846 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3847         struct socket *so;
3848
3849 #endif
3850
3851         vtag = 0;
3852         if (stcb != NULL) {
3853                 /* We have a TCB to abort, send notification too */
3854                 vtag = stcb->asoc.peer_vtag;
3855                 sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED);
3856                 /* get the assoc vrf id and table id */
3857                 vrf_id = stcb->asoc.vrf_id;
3858                 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
3859         }
3860         sctp_send_abort(m, iphlen, src, dst, sh, vtag, op_err,
3861             use_mflowid, mflowid,
3862             vrf_id, port);
3863         if (stcb != NULL) {
3864                 /* Ok, now lets free it */
3865 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3866                 so = SCTP_INP_SO(inp);
3867                 atomic_add_int(&stcb->asoc.refcnt, 1);
3868                 SCTP_TCB_UNLOCK(stcb);
3869                 SCTP_SOCKET_LOCK(so, 1);
3870                 SCTP_TCB_LOCK(stcb);
3871                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3872 #endif
3873                 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3874                 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
3875                     (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3876                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3877                 }
3878                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_4);
3879 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3880                 SCTP_SOCKET_UNLOCK(so, 1);
3881 #endif
3882         }
3883 }
3884
3885 #ifdef SCTP_ASOCLOG_OF_TSNS
3886 void
3887 sctp_print_out_track_log(struct sctp_tcb *stcb)
3888 {
3889 #ifdef NOSIY_PRINTS
3890         int i;
3891
3892         SCTP_PRINTF("Last ep reason:%x\n", stcb->sctp_ep->last_abort_code);
3893         SCTP_PRINTF("IN bound TSN log-aaa\n");
3894         if ((stcb->asoc.tsn_in_at == 0) && (stcb->asoc.tsn_in_wrapped == 0)) {
3895                 SCTP_PRINTF("None rcvd\n");
3896                 goto none_in;
3897         }
3898         if (stcb->asoc.tsn_in_wrapped) {
3899                 for (i = stcb->asoc.tsn_in_at; i < SCTP_TSN_LOG_SIZE; i++) {
3900                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3901                             stcb->asoc.in_tsnlog[i].tsn,
3902                             stcb->asoc.in_tsnlog[i].strm,
3903                             stcb->asoc.in_tsnlog[i].seq,
3904                             stcb->asoc.in_tsnlog[i].flgs,
3905                             stcb->asoc.in_tsnlog[i].sz);
3906                 }
3907         }
3908         if (stcb->asoc.tsn_in_at) {
3909                 for (i = 0; i < stcb->asoc.tsn_in_at; i++) {
3910                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3911                             stcb->asoc.in_tsnlog[i].tsn,
3912                             stcb->asoc.in_tsnlog[i].strm,
3913                             stcb->asoc.in_tsnlog[i].seq,
3914                             stcb->asoc.in_tsnlog[i].flgs,
3915                             stcb->asoc.in_tsnlog[i].sz);
3916                 }
3917         }
3918 none_in:
3919         SCTP_PRINTF("OUT bound TSN log-aaa\n");
3920         if ((stcb->asoc.tsn_out_at == 0) &&
3921             (stcb->asoc.tsn_out_wrapped == 0)) {
3922                 SCTP_PRINTF("None sent\n");
3923         }
3924         if (stcb->asoc.tsn_out_wrapped) {
3925                 for (i = stcb->asoc.tsn_out_at; i < SCTP_TSN_LOG_SIZE; i++) {
3926                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3927                             stcb->asoc.out_tsnlog[i].tsn,
3928                             stcb->asoc.out_tsnlog[i].strm,
3929                             stcb->asoc.out_tsnlog[i].seq,
3930                             stcb->asoc.out_tsnlog[i].flgs,
3931                             stcb->asoc.out_tsnlog[i].sz);
3932                 }
3933         }
3934         if (stcb->asoc.tsn_out_at) {
3935                 for (i = 0; i < stcb->asoc.tsn_out_at; i++) {
3936                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3937                             stcb->asoc.out_tsnlog[i].tsn,
3938                             stcb->asoc.out_tsnlog[i].strm,
3939                             stcb->asoc.out_tsnlog[i].seq,
3940                             stcb->asoc.out_tsnlog[i].flgs,
3941                             stcb->asoc.out_tsnlog[i].sz);
3942                 }
3943         }
3944 #endif
3945 }
3946
3947 #endif
3948
3949 void
3950 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3951     struct mbuf *op_err,
3952     int so_locked
3953 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3954     SCTP_UNUSED
3955 #endif
3956 )
3957 {
3958 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3959         struct socket *so;
3960
3961 #endif
3962
3963 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3964         so = SCTP_INP_SO(inp);
3965 #endif
3966         if (stcb == NULL) {
3967                 /* Got to have a TCB */
3968                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3969                         if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
3970                                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
3971                                     SCTP_CALLED_DIRECTLY_NOCMPSET);
3972                         }
3973                 }
3974                 return;
3975         } else {
3976                 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
3977         }
3978         /* notify the ulp */
3979         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) {
3980                 sctp_abort_notification(stcb, 0, 0, NULL, so_locked);
3981         }
3982         /* notify the peer */
3983         sctp_send_abort_tcb(stcb, op_err, so_locked);
3984         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3985         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
3986             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3987                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3988         }
3989         /* now free the asoc */
3990 #ifdef SCTP_ASOCLOG_OF_TSNS
3991         sctp_print_out_track_log(stcb);
3992 #endif
3993 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3994         if (!so_locked) {
3995                 atomic_add_int(&stcb->asoc.refcnt, 1);
3996                 SCTP_TCB_UNLOCK(stcb);
3997                 SCTP_SOCKET_LOCK(so, 1);
3998                 SCTP_TCB_LOCK(stcb);
3999                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4000         }
4001 #endif
4002         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_5);
4003 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4004         if (!so_locked) {
4005                 SCTP_SOCKET_UNLOCK(so, 1);
4006         }
4007 #endif
4008 }
4009
4010 void
4011 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset,
4012     struct sockaddr *src, struct sockaddr *dst,
4013     struct sctphdr *sh, struct sctp_inpcb *inp,
4014     uint8_t use_mflowid, uint32_t mflowid,
4015     uint32_t vrf_id, uint16_t port)
4016 {
4017         struct sctp_chunkhdr *ch, chunk_buf;
4018         unsigned int chk_length;
4019         int contains_init_chunk;
4020
4021         SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue);
4022         /* Generate a TO address for future reference */
4023         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
4024                 if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
4025                         sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4026                             SCTP_CALLED_DIRECTLY_NOCMPSET);
4027                 }
4028         }
4029         contains_init_chunk = 0;
4030         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4031             sizeof(*ch), (uint8_t *) & chunk_buf);
4032         while (ch != NULL) {
4033                 chk_length = ntohs(ch->chunk_length);
4034                 if (chk_length < sizeof(*ch)) {
4035                         /* break to abort land */
4036                         break;
4037                 }
4038                 switch (ch->chunk_type) {
4039                 case SCTP_INIT:
4040                         contains_init_chunk = 1;
4041                         break;
4042                 case SCTP_COOKIE_ECHO:
4043                         /* We hit here only if the assoc is being freed */
4044                         return;
4045                 case SCTP_PACKET_DROPPED:
4046                         /* we don't respond to pkt-dropped */
4047                         return;
4048                 case SCTP_ABORT_ASSOCIATION:
4049                         /* we don't respond with an ABORT to an ABORT */
4050                         return;
4051                 case SCTP_SHUTDOWN_COMPLETE:
4052                         /*
4053                          * we ignore it since we are not waiting for it and
4054                          * peer is gone
4055                          */
4056                         return;
4057                 case SCTP_SHUTDOWN_ACK:
4058                         sctp_send_shutdown_complete2(src, dst, sh,
4059                             use_mflowid, mflowid,
4060                             vrf_id, port);
4061                         return;
4062                 default:
4063                         break;
4064                 }
4065                 offset += SCTP_SIZE32(chk_length);
4066                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4067                     sizeof(*ch), (uint8_t *) & chunk_buf);
4068         }
4069         if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
4070             ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
4071             (contains_init_chunk == 0))) {
4072                 sctp_send_abort(m, iphlen, src, dst, sh, 0, NULL,
4073                     use_mflowid, mflowid,
4074                     vrf_id, port);
4075         }
4076 }
4077
4078 /*
4079  * check the inbound datagram to make sure there is not an abort inside it,
4080  * if there is return 1, else return 0.
4081  */
4082 int
4083 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t * vtagfill)
4084 {
4085         struct sctp_chunkhdr *ch;
4086         struct sctp_init_chunk *init_chk, chunk_buf;
4087         int offset;
4088         unsigned int chk_length;
4089
4090         offset = iphlen + sizeof(struct sctphdr);
4091         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch),
4092             (uint8_t *) & chunk_buf);
4093         while (ch != NULL) {
4094                 chk_length = ntohs(ch->chunk_length);
4095                 if (chk_length < sizeof(*ch)) {
4096                         /* packet is probably corrupt */
4097                         break;
4098                 }
4099                 /* we seem to be ok, is it an abort? */
4100                 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) {
4101                         /* yep, tell them */
4102                         return (1);
4103                 }
4104                 if (ch->chunk_type == SCTP_INITIATION) {
4105                         /* need to update the Vtag */
4106                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
4107                             offset, sizeof(*init_chk), (uint8_t *) & chunk_buf);
4108                         if (init_chk != NULL) {
4109                                 *vtagfill = ntohl(init_chk->init.initiate_tag);
4110                         }
4111                 }
4112                 /* Nope, move to the next chunk */
4113                 offset += SCTP_SIZE32(chk_length);
4114                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4115                     sizeof(*ch), (uint8_t *) & chunk_buf);
4116         }
4117         return (0);
4118 }
4119
4120 /*
4121  * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id
4122  * set (i.e. it's 0) so, create this function to compare link local scopes
4123  */
4124 #ifdef INET6
4125 uint32_t
4126 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2)
4127 {
4128         struct sockaddr_in6 a, b;
4129
4130         /* save copies */
4131         a = *addr1;
4132         b = *addr2;
4133
4134         if (a.sin6_scope_id == 0)
4135                 if (sa6_recoverscope(&a)) {
4136                         /* can't get scope, so can't match */
4137                         return (0);
4138                 }
4139         if (b.sin6_scope_id == 0)
4140                 if (sa6_recoverscope(&b)) {
4141                         /* can't get scope, so can't match */
4142                         return (0);
4143                 }
4144         if (a.sin6_scope_id != b.sin6_scope_id)
4145                 return (0);
4146
4147         return (1);
4148 }
4149
4150 /*
4151  * returns a sockaddr_in6 with embedded scope recovered and removed
4152  */
4153 struct sockaddr_in6 *
4154 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store)
4155 {
4156         /* check and strip embedded scope junk */
4157         if (addr->sin6_family == AF_INET6) {
4158                 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) {
4159                         if (addr->sin6_scope_id == 0) {
4160                                 *store = *addr;
4161                                 if (!sa6_recoverscope(store)) {
4162                                         /* use the recovered scope */
4163                                         addr = store;
4164                                 }
4165                         } else {
4166                                 /* else, return the original "to" addr */
4167                                 in6_clearscope(&addr->sin6_addr);
4168                         }
4169                 }
4170         }
4171         return (addr);
4172 }
4173
4174 #endif
4175
4176 /*
4177  * are the two addresses the same?  currently a "scopeless" check returns: 1
4178  * if same, 0 if not
4179  */
4180 int
4181 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2)
4182 {
4183
4184         /* must be valid */
4185         if (sa1 == NULL || sa2 == NULL)
4186                 return (0);
4187
4188         /* must be the same family */
4189         if (sa1->sa_family != sa2->sa_family)
4190                 return (0);
4191
4192         switch (sa1->sa_family) {
4193 #ifdef INET6
4194         case AF_INET6:
4195                 {
4196                         /* IPv6 addresses */
4197                         struct sockaddr_in6 *sin6_1, *sin6_2;
4198
4199                         sin6_1 = (struct sockaddr_in6 *)sa1;
4200                         sin6_2 = (struct sockaddr_in6 *)sa2;
4201                         return (SCTP6_ARE_ADDR_EQUAL(sin6_1,
4202                             sin6_2));
4203                 }
4204 #endif
4205 #ifdef INET
4206         case AF_INET:
4207                 {
4208                         /* IPv4 addresses */
4209                         struct sockaddr_in *sin_1, *sin_2;
4210
4211                         sin_1 = (struct sockaddr_in *)sa1;
4212                         sin_2 = (struct sockaddr_in *)sa2;
4213                         return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr);
4214                 }
4215 #endif
4216         default:
4217                 /* we don't do these... */
4218                 return (0);
4219         }
4220 }
4221
4222 void
4223 sctp_print_address(struct sockaddr *sa)
4224 {
4225 #ifdef INET6
4226         char ip6buf[INET6_ADDRSTRLEN];
4227
4228 #endif
4229
4230         switch (sa->sa_family) {
4231 #ifdef INET6
4232         case AF_INET6:
4233                 {
4234                         struct sockaddr_in6 *sin6;
4235
4236                         sin6 = (struct sockaddr_in6 *)sa;
4237                         SCTP_PRINTF("IPv6 address: %s:port:%d scope:%u\n",
4238                             ip6_sprintf(ip6buf, &sin6->sin6_addr),
4239                             ntohs(sin6->sin6_port),
4240                             sin6->sin6_scope_id);
4241                         break;
4242                 }
4243 #endif
4244 #ifdef INET
4245         case AF_INET:
4246                 {
4247                         struct sockaddr_in *sin;
4248                         unsigned char *p;
4249
4250                         sin = (struct sockaddr_in *)sa;
4251                         p = (unsigned char *)&sin->sin_addr;
4252                         SCTP_PRINTF("IPv4 address: %u.%u.%u.%u:%d\n",
4253                             p[0], p[1], p[2], p[3], ntohs(sin->sin_port));
4254                         break;
4255                 }
4256 #endif
4257         default:
4258                 SCTP_PRINTF("?\n");
4259                 break;
4260         }
4261 }
4262
4263 void
4264 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
4265     struct sctp_inpcb *new_inp,
4266     struct sctp_tcb *stcb,
4267     int waitflags)
4268 {
4269         /*
4270          * go through our old INP and pull off any control structures that
4271          * belong to stcb and move then to the new inp.
4272          */
4273         struct socket *old_so, *new_so;
4274         struct sctp_queued_to_read *control, *nctl;
4275         struct sctp_readhead tmp_queue;
4276         struct mbuf *m;
4277         int error = 0;
4278
4279         old_so = old_inp->sctp_socket;
4280         new_so = new_inp->sctp_socket;
4281         TAILQ_INIT(&tmp_queue);
4282         error = sblock(&old_so->so_rcv, waitflags);
4283         if (error) {
4284                 /*
4285                  * Gak, can't get sblock, we have a problem. data will be
4286                  * left stranded.. and we don't dare look at it since the
4287                  * other thread may be reading something. Oh well, its a
4288                  * screwed up app that does a peeloff OR a accept while
4289                  * reading from the main socket... actually its only the
4290                  * peeloff() case, since I think read will fail on a
4291                  * listening socket..
4292                  */
4293                 return;
4294         }
4295         /* lock the socket buffers */
4296         SCTP_INP_READ_LOCK(old_inp);
4297         TAILQ_FOREACH_SAFE(control, &old_inp->read_queue, next, nctl) {
4298                 /* Pull off all for out target stcb */
4299                 if (control->stcb == stcb) {
4300                         /* remove it we want it */
4301                         TAILQ_REMOVE(&old_inp->read_queue, control, next);
4302                         TAILQ_INSERT_TAIL(&tmp_queue, control, next);
4303                         m = control->data;
4304                         while (m) {
4305                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4306                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
4307                                 }
4308                                 sctp_sbfree(control, stcb, &old_so->so_rcv, m);
4309                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4310                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4311                                 }
4312                                 m = SCTP_BUF_NEXT(m);
4313                         }
4314                 }
4315         }
4316         SCTP_INP_READ_UNLOCK(old_inp);
4317         /* Remove the sb-lock on the old socket */
4318
4319         sbunlock(&old_so->so_rcv);
4320         /* Now we move them over to the new socket buffer */
4321         SCTP_INP_READ_LOCK(new_inp);
4322         TAILQ_FOREACH_SAFE(control, &tmp_queue, next, nctl) {
4323                 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next);
4324                 m = control->data;
4325                 while (m) {
4326                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4327                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4328                         }
4329                         sctp_sballoc(stcb, &new_so->so_rcv, m);
4330                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4331                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4332                         }
4333                         m = SCTP_BUF_NEXT(m);
4334                 }
4335         }
4336         SCTP_INP_READ_UNLOCK(new_inp);
4337 }
4338
4339 void
4340 sctp_add_to_readq(struct sctp_inpcb *inp,
4341     struct sctp_tcb *stcb,
4342     struct sctp_queued_to_read *control,
4343     struct sockbuf *sb,
4344     int end,
4345     int inp_read_lock_held,
4346     int so_locked
4347 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4348     SCTP_UNUSED
4349 #endif
4350 )
4351 {
4352         /*
4353          * Here we must place the control on the end of the socket read
4354          * queue AND increment sb_cc so that select will work properly on
4355          * read.
4356          */
4357         struct mbuf *m, *prev = NULL;
4358
4359         if (inp == NULL) {
4360                 /* Gak, TSNH!! */
4361 #ifdef INVARIANTS
4362                 panic("Gak, inp NULL on add_to_readq");
4363 #endif
4364                 return;
4365         }
4366         if (inp_read_lock_held == 0)
4367                 SCTP_INP_READ_LOCK(inp);
4368         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
4369                 sctp_free_remote_addr(control->whoFrom);
4370                 if (control->data) {
4371                         sctp_m_freem(control->data);
4372                         control->data = NULL;
4373                 }
4374                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_readq), control);
4375                 if (inp_read_lock_held == 0)
4376                         SCTP_INP_READ_UNLOCK(inp);
4377                 return;
4378         }
4379         if (!(control->spec_flags & M_NOTIFICATION)) {
4380                 atomic_add_int(&inp->total_recvs, 1);
4381                 if (!control->do_not_ref_stcb) {
4382                         atomic_add_int(&stcb->total_recvs, 1);
4383                 }
4384         }
4385         m = control->data;
4386         control->held_length = 0;
4387         control->length = 0;
4388         while (m) {
4389                 if (SCTP_BUF_LEN(m) == 0) {
4390                         /* Skip mbufs with NO length */
4391                         if (prev == NULL) {
4392                                 /* First one */
4393                                 control->data = sctp_m_free(m);
4394                                 m = control->data;
4395                         } else {
4396                                 SCTP_BUF_NEXT(prev) = sctp_m_free(m);
4397                                 m = SCTP_BUF_NEXT(prev);
4398                         }
4399                         if (m == NULL) {
4400                                 control->tail_mbuf = prev;
4401                         }
4402                         continue;
4403                 }
4404                 prev = m;
4405                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4406                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4407                 }
4408                 sctp_sballoc(stcb, sb, m);
4409                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4410                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4411                 }
4412                 atomic_add_int(&control->length, SCTP_BUF_LEN(m));
4413                 m = SCTP_BUF_NEXT(m);
4414         }
4415         if (prev != NULL) {
4416                 control->tail_mbuf = prev;
4417         } else {
4418                 /* Everything got collapsed out?? */
4419                 sctp_free_remote_addr(control->whoFrom);
4420                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_readq), control);
4421                 if (inp_read_lock_held == 0)
4422                         SCTP_INP_READ_UNLOCK(inp);
4423                 return;
4424         }
4425         if (end) {
4426                 control->end_added = 1;
4427         }
4428         TAILQ_INSERT_TAIL(&inp->read_queue, control, next);
4429         if (inp_read_lock_held == 0)
4430                 SCTP_INP_READ_UNLOCK(inp);
4431         if (inp && inp->sctp_socket) {
4432                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
4433                         SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket);
4434                 } else {
4435 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4436                         struct socket *so;
4437
4438                         so = SCTP_INP_SO(inp);
4439                         if (!so_locked) {
4440                                 if (stcb) {
4441                                         atomic_add_int(&stcb->asoc.refcnt, 1);
4442                                         SCTP_TCB_UNLOCK(stcb);
4443                                 }
4444                                 SCTP_SOCKET_LOCK(so, 1);
4445                                 if (stcb) {
4446                                         SCTP_TCB_LOCK(stcb);
4447                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
4448                                 }
4449                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4450                                         SCTP_SOCKET_UNLOCK(so, 1);
4451                                         return;
4452                                 }
4453                         }
4454 #endif
4455                         sctp_sorwakeup(inp, inp->sctp_socket);
4456 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4457                         if (!so_locked) {
4458                                 SCTP_SOCKET_UNLOCK(so, 1);
4459                         }
4460 #endif
4461                 }
4462         }
4463 }
4464
4465
4466 int
4467 sctp_append_to_readq(struct sctp_inpcb *inp,
4468     struct sctp_tcb *stcb,
4469     struct sctp_queued_to_read *control,
4470     struct mbuf *m,
4471     int end,
4472     int ctls_cumack,
4473     struct sockbuf *sb)
4474 {
4475         /*
4476          * A partial delivery API event is underway. OR we are appending on
4477          * the reassembly queue.
4478          *
4479          * If PDAPI this means we need to add m to the end of the data.
4480          * Increase the length in the control AND increment the sb_cc.
4481          * Otherwise sb is NULL and all we need to do is put it at the end
4482          * of the mbuf chain.
4483          */
4484         int len = 0;
4485         struct mbuf *mm, *tail = NULL, *prev = NULL;
4486
4487         if (inp) {
4488                 SCTP_INP_READ_LOCK(inp);
4489         }
4490         if (control == NULL) {
4491 get_out:
4492                 if (inp) {
4493                         SCTP_INP_READ_UNLOCK(inp);
4494                 }
4495                 return (-1);
4496         }
4497         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ)) {
4498                 SCTP_INP_READ_UNLOCK(inp);
4499                 return (0);
4500         }
4501         if (control->end_added) {
4502                 /* huh this one is complete? */
4503                 goto get_out;
4504         }
4505         mm = m;
4506         if (mm == NULL) {
4507                 goto get_out;
4508         }
4509         while (mm) {
4510                 if (SCTP_BUF_LEN(mm) == 0) {
4511                         /* Skip mbufs with NO lenght */
4512                         if (prev == NULL) {
4513                                 /* First one */
4514                                 m = sctp_m_free(mm);
4515                                 mm = m;
4516                         } else {
4517                                 SCTP_BUF_NEXT(prev) = sctp_m_free(mm);
4518                                 mm = SCTP_BUF_NEXT(prev);
4519                         }
4520                         continue;
4521                 }
4522                 prev = mm;
4523                 len += SCTP_BUF_LEN(mm);
4524                 if (sb) {
4525                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4526                                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(mm));
4527                         }
4528                         sctp_sballoc(stcb, sb, mm);
4529                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4530                                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4531                         }
4532                 }
4533                 mm = SCTP_BUF_NEXT(mm);
4534         }
4535         if (prev) {
4536                 tail = prev;
4537         } else {
4538                 /* Really there should always be a prev */
4539                 if (m == NULL) {
4540                         /* Huh nothing left? */
4541 #ifdef INVARIANTS
4542                         panic("Nothing left to add?");
4543 #else
4544                         goto get_out;
4545 #endif
4546                 }
4547                 tail = m;
4548         }
4549         if (control->tail_mbuf) {
4550                 /* append */
4551                 SCTP_BUF_NEXT(control->tail_mbuf) = m;
4552                 control->tail_mbuf = tail;
4553         } else {
4554                 /* nothing there */
4555 #ifdef INVARIANTS
4556                 if (control->data != NULL) {
4557                         panic("This should NOT happen");
4558                 }
4559 #endif
4560                 control->data = m;
4561                 control->tail_mbuf = tail;
4562         }
4563         atomic_add_int(&control->length, len);
4564         if (end) {
4565                 /* message is complete */
4566                 if (stcb && (control == stcb->asoc.control_pdapi)) {
4567                         stcb->asoc.control_pdapi = NULL;
4568                 }
4569                 control->held_length = 0;
4570                 control->end_added = 1;
4571         }
4572         if (stcb == NULL) {
4573                 control->do_not_ref_stcb = 1;
4574         }
4575         /*
4576          * When we are appending in partial delivery, the cum-ack is used
4577          * for the actual pd-api highest tsn on this mbuf. The true cum-ack
4578          * is populated in the outbound sinfo structure from the true cumack
4579          * if the association exists...
4580          */
4581         control->sinfo_tsn = control->sinfo_cumtsn = ctls_cumack;
4582         if (inp) {
4583                 SCTP_INP_READ_UNLOCK(inp);
4584         }
4585         if (inp && inp->sctp_socket) {
4586                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
4587                         SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket);
4588                 } else {
4589 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4590                         struct socket *so;
4591
4592                         so = SCTP_INP_SO(inp);
4593                         if (stcb) {
4594                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4595                                 SCTP_TCB_UNLOCK(stcb);
4596                         }
4597                         SCTP_SOCKET_LOCK(so, 1);
4598                         if (stcb) {
4599                                 SCTP_TCB_LOCK(stcb);
4600                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4601                         }
4602                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4603                                 SCTP_SOCKET_UNLOCK(so, 1);
4604                                 return (0);
4605                         }
4606 #endif
4607                         sctp_sorwakeup(inp, inp->sctp_socket);
4608 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4609                         SCTP_SOCKET_UNLOCK(so, 1);
4610 #endif
4611                 }
4612         }
4613         return (0);
4614 }
4615
4616
4617
4618 /*************HOLD THIS COMMENT FOR PATCH FILE OF
4619  *************ALTERNATE ROUTING CODE
4620  */
4621
4622 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF
4623  *************ALTERNATE ROUTING CODE
4624  */
4625
4626 struct mbuf *
4627 sctp_generate_invmanparam(int err)
4628 {
4629         /* Return a MBUF with a invalid mandatory parameter */
4630         struct mbuf *m;
4631
4632         m = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_NOWAIT, 1, MT_DATA);
4633         if (m) {
4634                 struct sctp_paramhdr *ph;
4635
4636                 SCTP_BUF_LEN(m) = sizeof(struct sctp_paramhdr);
4637                 ph = mtod(m, struct sctp_paramhdr *);
4638                 ph->param_length = htons(sizeof(struct sctp_paramhdr));
4639                 ph->param_type = htons(err);
4640         }
4641         return (m);
4642 }
4643
4644 #ifdef SCTP_MBCNT_LOGGING
4645 void
4646 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc,
4647     struct sctp_tmit_chunk *tp1, int chk_cnt)
4648 {
4649         if (tp1->data == NULL) {
4650                 return;
4651         }
4652         asoc->chunks_on_out_queue -= chk_cnt;
4653         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBCNT_LOGGING_ENABLE) {
4654                 sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE,
4655                     asoc->total_output_queue_size,
4656                     tp1->book_size,
4657                     0,
4658                     tp1->mbcnt);
4659         }
4660         if (asoc->total_output_queue_size >= tp1->book_size) {
4661                 atomic_add_int(&asoc->total_output_queue_size, -tp1->book_size);
4662         } else {
4663                 asoc->total_output_queue_size = 0;
4664         }
4665
4666         if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) ||
4667             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) {
4668                 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) {
4669                         stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size;
4670                 } else {
4671                         stcb->sctp_socket->so_snd.sb_cc = 0;
4672
4673                 }
4674         }
4675 }
4676
4677 #endif
4678
4679 int
4680 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1,
4681     uint8_t sent, int so_locked
4682 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4683     SCTP_UNUSED
4684 #endif
4685 )
4686 {
4687         struct sctp_stream_out *strq;
4688         struct sctp_tmit_chunk *chk = NULL, *tp2;
4689         struct sctp_stream_queue_pending *sp;
4690         uint16_t stream = 0, seq = 0;
4691         uint8_t foundeom = 0;
4692         int ret_sz = 0;
4693         int notdone;
4694         int do_wakeup_routine = 0;
4695
4696         stream = tp1->rec.data.stream_number;
4697         seq = tp1->rec.data.stream_seq;
4698         do {
4699                 ret_sz += tp1->book_size;
4700                 if (tp1->data != NULL) {
4701                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4702                                 sctp_flight_size_decrease(tp1);
4703                                 sctp_total_flight_decrease(stcb, tp1);
4704                         }
4705                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4706                         stcb->asoc.peers_rwnd += tp1->send_size;
4707                         stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh);
4708                         if (sent) {
4709                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
4710                         } else {
4711                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
4712                         }
4713                         if (tp1->data) {
4714                                 sctp_m_freem(tp1->data);
4715                                 tp1->data = NULL;
4716                         }
4717                         do_wakeup_routine = 1;
4718                         if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
4719                                 stcb->asoc.sent_queue_cnt_removeable--;
4720                         }
4721                 }
4722                 tp1->sent = SCTP_FORWARD_TSN_SKIP;
4723                 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
4724                     SCTP_DATA_NOT_FRAG) {
4725                         /* not frag'ed we ae done   */
4726                         notdone = 0;
4727                         foundeom = 1;
4728                 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4729                         /* end of frag, we are done */
4730                         notdone = 0;
4731                         foundeom = 1;
4732                 } else {
4733                         /*
4734                          * Its a begin or middle piece, we must mark all of
4735                          * it
4736                          */
4737                         notdone = 1;
4738                         tp1 = TAILQ_NEXT(tp1, sctp_next);
4739                 }
4740         } while (tp1 && notdone);
4741         if (foundeom == 0) {
4742                 /*
4743                  * The multi-part message was scattered across the send and
4744                  * sent queue.
4745                  */
4746                 TAILQ_FOREACH_SAFE(tp1, &stcb->asoc.send_queue, sctp_next, tp2) {
4747                         if ((tp1->rec.data.stream_number != stream) ||
4748                             (tp1->rec.data.stream_seq != seq)) {
4749                                 break;
4750                         }
4751                         /*
4752                          * save to chk in case we have some on stream out
4753                          * queue. If so and we have an un-transmitted one we
4754                          * don't have to fudge the TSN.
4755                          */
4756                         chk = tp1;
4757                         ret_sz += tp1->book_size;
4758                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4759                         if (sent) {
4760                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
4761                         } else {
4762                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
4763                         }
4764                         if (tp1->data) {
4765                                 sctp_m_freem(tp1->data);
4766                                 tp1->data = NULL;
4767                         }
4768                         /* No flight involved here book the size to 0 */
4769                         tp1->book_size = 0;
4770                         if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4771                                 foundeom = 1;
4772                         }
4773                         do_wakeup_routine = 1;
4774                         tp1->sent = SCTP_FORWARD_TSN_SKIP;
4775                         TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next);
4776                         /*
4777                          * on to the sent queue so we can wait for it to be
4778                          * passed by.
4779                          */
4780                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1,
4781                             sctp_next);
4782                         stcb->asoc.send_queue_cnt--;
4783                         stcb->asoc.sent_queue_cnt++;
4784                 }
4785         }
4786         if (foundeom == 0) {
4787                 /*
4788                  * Still no eom found. That means there is stuff left on the
4789                  * stream out queue.. yuck.
4790                  */
4791                 SCTP_TCB_SEND_LOCK(stcb);
4792                 strq = &stcb->asoc.strmout[stream];
4793                 sp = TAILQ_FIRST(&strq->outqueue);
4794                 if (sp != NULL) {
4795                         sp->discard_rest = 1;
4796                         /*
4797                          * We may need to put a chunk on the queue that
4798                          * holds the TSN that would have been sent with the
4799                          * LAST bit.
4800                          */
4801                         if (chk == NULL) {
4802                                 /* Yep, we have to */
4803                                 sctp_alloc_a_chunk(stcb, chk);
4804                                 if (chk == NULL) {
4805                                         /*
4806                                          * we are hosed. All we can do is
4807                                          * nothing.. which will cause an
4808                                          * abort if the peer is paying
4809                                          * attention.
4810                                          */
4811                                         goto oh_well;
4812                                 }
4813                                 memset(chk, 0, sizeof(*chk));
4814                                 chk->rec.data.rcv_flags = SCTP_DATA_LAST_FRAG;
4815                                 chk->sent = SCTP_FORWARD_TSN_SKIP;
4816                                 chk->asoc = &stcb->asoc;
4817                                 chk->rec.data.stream_seq = strq->next_sequence_send;
4818                                 chk->rec.data.stream_number = sp->stream;
4819                                 chk->rec.data.payloadtype = sp->ppid;
4820                                 chk->rec.data.context = sp->context;
4821                                 chk->flags = sp->act_flags;
4822                                 if (sp->net)
4823                                         chk->whoTo = sp->net;
4824                                 else
4825                                         chk->whoTo = stcb->asoc.primary_destination;
4826                                 atomic_add_int(&chk->whoTo->ref_count, 1);
4827                                 chk->rec.data.TSN_seq = atomic_fetchadd_int(&stcb->asoc.sending_seq, 1);
4828                                 stcb->asoc.pr_sctp_cnt++;
4829                                 chk->pr_sctp_on = 1;
4830                                 TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, chk, sctp_next);
4831                                 stcb->asoc.sent_queue_cnt++;
4832                                 stcb->asoc.pr_sctp_cnt++;
4833                         } else {
4834                                 chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
4835                         }
4836                         strq->next_sequence_send++;
4837         oh_well:
4838                         if (sp->data) {
4839                                 /*
4840                                  * Pull any data to free up the SB and allow
4841                                  * sender to "add more" while we will throw
4842                                  * away :-)
4843                                  */
4844                                 sctp_free_spbufspace(stcb, &stcb->asoc, sp);
4845                                 ret_sz += sp->length;
4846                                 do_wakeup_routine = 1;
4847                                 sp->some_taken = 1;
4848                                 sctp_m_freem(sp->data);
4849                                 sp->data = NULL;
4850                                 sp->tail_mbuf = NULL;
4851                                 sp->length = 0;
4852                         }
4853                 }
4854                 SCTP_TCB_SEND_UNLOCK(stcb);
4855         }
4856         if (do_wakeup_routine) {
4857 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4858                 struct socket *so;
4859
4860                 so = SCTP_INP_SO(stcb->sctp_ep);
4861                 if (!so_locked) {
4862                         atomic_add_int(&stcb->asoc.refcnt, 1);
4863                         SCTP_TCB_UNLOCK(stcb);
4864                         SCTP_SOCKET_LOCK(so, 1);
4865                         SCTP_TCB_LOCK(stcb);
4866                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
4867                         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
4868                                 /* assoc was freed while we were unlocked */
4869                                 SCTP_SOCKET_UNLOCK(so, 1);
4870                                 return (ret_sz);
4871                         }
4872                 }
4873 #endif
4874                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
4875 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4876                 if (!so_locked) {
4877                         SCTP_SOCKET_UNLOCK(so, 1);
4878                 }
4879 #endif
4880         }
4881         return (ret_sz);
4882 }
4883
4884 /*
4885  * checks to see if the given address, sa, is one that is currently known by
4886  * the kernel note: can't distinguish the same address on multiple interfaces
4887  * and doesn't handle multiple addresses with different zone/scope id's note:
4888  * ifa_ifwithaddr() compares the entire sockaddr struct
4889  */
4890 struct sctp_ifa *
4891 sctp_find_ifa_in_ep(struct sctp_inpcb *inp, struct sockaddr *addr,
4892     int holds_lock)
4893 {
4894         struct sctp_laddr *laddr;
4895
4896         if (holds_lock == 0) {
4897                 SCTP_INP_RLOCK(inp);
4898         }
4899         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
4900                 if (laddr->ifa == NULL)
4901                         continue;
4902                 if (addr->sa_family != laddr->ifa->address.sa.sa_family)
4903                         continue;
4904 #ifdef INET
4905                 if (addr->sa_family == AF_INET) {
4906                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
4907                             laddr->ifa->address.sin.sin_addr.s_addr) {
4908                                 /* found him. */
4909                                 if (holds_lock == 0) {
4910                                         SCTP_INP_RUNLOCK(inp);
4911                                 }
4912                                 return (laddr->ifa);
4913                                 break;
4914                         }
4915                 }
4916 #endif
4917 #ifdef INET6
4918                 if (addr->sa_family == AF_INET6) {
4919                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
4920                             &laddr->ifa->address.sin6)) {
4921                                 /* found him. */
4922                                 if (holds_lock == 0) {
4923                                         SCTP_INP_RUNLOCK(inp);
4924                                 }
4925                                 return (laddr->ifa);
4926                                 break;
4927                         }
4928                 }
4929 #endif
4930         }
4931         if (holds_lock == 0) {
4932                 SCTP_INP_RUNLOCK(inp);
4933         }
4934         return (NULL);
4935 }
4936
4937 uint32_t
4938 sctp_get_ifa_hash_val(struct sockaddr *addr)
4939 {
4940         switch (addr->sa_family) {
4941 #ifdef INET
4942         case AF_INET:
4943                 {
4944                         struct sockaddr_in *sin;
4945
4946                         sin = (struct sockaddr_in *)addr;
4947                         return (sin->sin_addr.s_addr ^ (sin->sin_addr.s_addr >> 16));
4948                 }
4949 #endif
4950 #ifdef INET6
4951         case AF_INET6:
4952                 {
4953                         struct sockaddr_in6 *sin6;
4954                         uint32_t hash_of_addr;
4955
4956                         sin6 = (struct sockaddr_in6 *)addr;
4957                         hash_of_addr = (sin6->sin6_addr.s6_addr32[0] +
4958                             sin6->sin6_addr.s6_addr32[1] +
4959                             sin6->sin6_addr.s6_addr32[2] +
4960                             sin6->sin6_addr.s6_addr32[3]);
4961                         hash_of_addr = (hash_of_addr ^ (hash_of_addr >> 16));
4962                         return (hash_of_addr);
4963                 }
4964 #endif
4965         default:
4966                 break;
4967         }
4968         return (0);
4969 }
4970
4971 struct sctp_ifa *
4972 sctp_find_ifa_by_addr(struct sockaddr *addr, uint32_t vrf_id, int holds_lock)
4973 {
4974         struct sctp_ifa *sctp_ifap;
4975         struct sctp_vrf *vrf;
4976         struct sctp_ifalist *hash_head;
4977         uint32_t hash_of_addr;
4978
4979         if (holds_lock == 0)
4980                 SCTP_IPI_ADDR_RLOCK();
4981
4982         vrf = sctp_find_vrf(vrf_id);
4983         if (vrf == NULL) {
4984 stage_right:
4985                 if (holds_lock == 0)
4986                         SCTP_IPI_ADDR_RUNLOCK();
4987                 return (NULL);
4988         }
4989         hash_of_addr = sctp_get_ifa_hash_val(addr);
4990
4991         hash_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)];
4992         if (hash_head == NULL) {
4993                 SCTP_PRINTF("hash_of_addr:%x mask:%x table:%x - ",
4994                     hash_of_addr, (uint32_t) vrf->vrf_addr_hashmark,
4995                     (uint32_t) (hash_of_addr & vrf->vrf_addr_hashmark));
4996                 sctp_print_address(addr);
4997                 SCTP_PRINTF("No such bucket for address\n");
4998                 if (holds_lock == 0)
4999                         SCTP_IPI_ADDR_RUNLOCK();
5000
5001                 return (NULL);
5002         }
5003         LIST_FOREACH(sctp_ifap, hash_head, next_bucket) {
5004                 if (sctp_ifap == NULL) {
5005 #ifdef INVARIANTS
5006                         panic("Huh LIST_FOREACH corrupt");
5007                         goto stage_right;
5008 #else
5009                         SCTP_PRINTF("LIST corrupt of sctp_ifap's?\n");
5010                         goto stage_right;
5011 #endif
5012                 }
5013                 if (addr->sa_family != sctp_ifap->address.sa.sa_family)
5014                         continue;
5015 #ifdef INET
5016                 if (addr->sa_family == AF_INET) {
5017                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
5018                             sctp_ifap->address.sin.sin_addr.s_addr) {
5019                                 /* found him. */
5020                                 if (holds_lock == 0)
5021                                         SCTP_IPI_ADDR_RUNLOCK();
5022                                 return (sctp_ifap);
5023                                 break;
5024                         }
5025                 }
5026 #endif
5027 #ifdef INET6
5028                 if (addr->sa_family == AF_INET6) {
5029                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5030                             &sctp_ifap->address.sin6)) {
5031                                 /* found him. */
5032                                 if (holds_lock == 0)
5033                                         SCTP_IPI_ADDR_RUNLOCK();
5034                                 return (sctp_ifap);
5035                                 break;
5036                         }
5037                 }
5038 #endif
5039         }
5040         if (holds_lock == 0)
5041                 SCTP_IPI_ADDR_RUNLOCK();
5042         return (NULL);
5043 }
5044
5045 static void
5046 sctp_user_rcvd(struct sctp_tcb *stcb, uint32_t * freed_so_far, int hold_rlock,
5047     uint32_t rwnd_req)
5048 {
5049         /* User pulled some data, do we need a rwnd update? */
5050         int r_unlocked = 0;
5051         uint32_t dif, rwnd;
5052         struct socket *so = NULL;
5053
5054         if (stcb == NULL)
5055                 return;
5056
5057         atomic_add_int(&stcb->asoc.refcnt, 1);
5058
5059         if (stcb->asoc.state & (SCTP_STATE_ABOUT_TO_BE_FREED |
5060             SCTP_STATE_SHUTDOWN_RECEIVED |
5061             SCTP_STATE_SHUTDOWN_ACK_SENT)) {
5062                 /* Pre-check If we are freeing no update */
5063                 goto no_lock;
5064         }
5065         SCTP_INP_INCR_REF(stcb->sctp_ep);
5066         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5067             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5068                 goto out;
5069         }
5070         so = stcb->sctp_socket;
5071         if (so == NULL) {
5072                 goto out;
5073         }
5074         atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far);
5075         /* Have you have freed enough to look */
5076         *freed_so_far = 0;
5077         /* Yep, its worth a look and the lock overhead */
5078
5079         /* Figure out what the rwnd would be */
5080         rwnd = sctp_calc_rwnd(stcb, &stcb->asoc);
5081         if (rwnd >= stcb->asoc.my_last_reported_rwnd) {
5082                 dif = rwnd - stcb->asoc.my_last_reported_rwnd;
5083         } else {
5084                 dif = 0;
5085         }
5086         if (dif >= rwnd_req) {
5087                 if (hold_rlock) {
5088                         SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5089                         r_unlocked = 1;
5090                 }
5091                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5092                         /*
5093                          * One last check before we allow the guy possibly
5094                          * to get in. There is a race, where the guy has not
5095                          * reached the gate. In that case
5096                          */
5097                         goto out;
5098                 }
5099                 SCTP_TCB_LOCK(stcb);
5100                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5101                         /* No reports here */
5102                         SCTP_TCB_UNLOCK(stcb);
5103                         goto out;
5104                 }
5105                 SCTP_STAT_INCR(sctps_wu_sacks_sent);
5106                 sctp_send_sack(stcb, SCTP_SO_LOCKED);
5107
5108                 sctp_chunk_output(stcb->sctp_ep, stcb,
5109                     SCTP_OUTPUT_FROM_USR_RCVD, SCTP_SO_LOCKED);
5110                 /* make sure no timer is running */
5111                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_6);
5112                 SCTP_TCB_UNLOCK(stcb);
5113         } else {
5114                 /* Update how much we have pending */
5115                 stcb->freed_by_sorcv_sincelast = dif;
5116         }
5117 out:
5118         if (so && r_unlocked && hold_rlock) {
5119                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
5120         }
5121         SCTP_INP_DECR_REF(stcb->sctp_ep);
5122 no_lock:
5123         atomic_add_int(&stcb->asoc.refcnt, -1);
5124         return;
5125 }
5126
5127 int
5128 sctp_sorecvmsg(struct socket *so,
5129     struct uio *uio,
5130     struct mbuf **mp,
5131     struct sockaddr *from,
5132     int fromlen,
5133     int *msg_flags,
5134     struct sctp_sndrcvinfo *sinfo,
5135     int filling_sinfo)
5136 {
5137         /*
5138          * MSG flags we will look at MSG_DONTWAIT - non-blocking IO.
5139          * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy
5140          * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ??
5141          * On the way out we may send out any combination of:
5142          * MSG_NOTIFICATION MSG_EOR
5143          *
5144          */
5145         struct sctp_inpcb *inp = NULL;
5146         int my_len = 0;
5147         int cp_len = 0, error = 0;
5148         struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
5149         struct mbuf *m = NULL;
5150         struct sctp_tcb *stcb = NULL;
5151         int wakeup_read_socket = 0;
5152         int freecnt_applied = 0;
5153         int out_flags = 0, in_flags = 0;
5154         int block_allowed = 1;
5155         uint32_t freed_so_far = 0;
5156         uint32_t copied_so_far = 0;
5157         int in_eeor_mode = 0;
5158         int no_rcv_needed = 0;
5159         uint32_t rwnd_req = 0;
5160         int hold_sblock = 0;
5161         int hold_rlock = 0;
5162         int slen = 0;
5163         uint32_t held_length = 0;
5164         int sockbuf_lock = 0;
5165
5166         if (uio == NULL) {
5167                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5168                 return (EINVAL);
5169         }
5170         if (msg_flags) {
5171                 in_flags = *msg_flags;
5172                 if (in_flags & MSG_PEEK)
5173                         SCTP_STAT_INCR(sctps_read_peeks);
5174         } else {
5175                 in_flags = 0;
5176         }
5177         slen = uio->uio_resid;
5178
5179         /* Pull in and set up our int flags */
5180         if (in_flags & MSG_OOB) {
5181                 /* Out of band's NOT supported */
5182                 return (EOPNOTSUPP);
5183         }
5184         if ((in_flags & MSG_PEEK) && (mp != NULL)) {
5185                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5186                 return (EINVAL);
5187         }
5188         if ((in_flags & (MSG_DONTWAIT
5189             | MSG_NBIO
5190             )) ||
5191             SCTP_SO_IS_NBIO(so)) {
5192                 block_allowed = 0;
5193         }
5194         /* setup the endpoint */
5195         inp = (struct sctp_inpcb *)so->so_pcb;
5196         if (inp == NULL) {
5197                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
5198                 return (EFAULT);
5199         }
5200         rwnd_req = (SCTP_SB_LIMIT_RCV(so) >> SCTP_RWND_HIWAT_SHIFT);
5201         /* Must be at least a MTU's worth */
5202         if (rwnd_req < SCTP_MIN_RWND)
5203                 rwnd_req = SCTP_MIN_RWND;
5204         in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
5205         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5206                 sctp_misc_ints(SCTP_SORECV_ENTER,
5207                     rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, uio->uio_resid);
5208         }
5209         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5210                 sctp_misc_ints(SCTP_SORECV_ENTERPL,
5211                     rwnd_req, block_allowed, so->so_rcv.sb_cc, uio->uio_resid);
5212         }
5213         error = sblock(&so->so_rcv, (block_allowed ? SBL_WAIT : 0));
5214         if (error) {
5215                 goto release_unlocked;
5216         }
5217         sockbuf_lock = 1;
5218 restart:
5219
5220
5221 restart_nosblocks:
5222         if (hold_sblock == 0) {
5223                 SOCKBUF_LOCK(&so->so_rcv);
5224                 hold_sblock = 1;
5225         }
5226         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5227             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5228                 goto out;
5229         }
5230         if ((so->so_rcv.sb_state & SBS_CANTRCVMORE) && (so->so_rcv.sb_cc == 0)) {
5231                 if (so->so_error) {
5232                         error = so->so_error;
5233                         if ((in_flags & MSG_PEEK) == 0)
5234                                 so->so_error = 0;
5235                         goto out;
5236                 } else {
5237                         if (so->so_rcv.sb_cc == 0) {
5238                                 /* indicate EOF */
5239                                 error = 0;
5240                                 goto out;
5241                         }
5242                 }
5243         }
5244         if ((so->so_rcv.sb_cc <= held_length) && block_allowed) {
5245                 /* we need to wait for data */
5246                 if ((so->so_rcv.sb_cc == 0) &&
5247                     ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5248                     (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) {
5249                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5250                                 /*
5251                                  * For active open side clear flags for
5252                                  * re-use passive open is blocked by
5253                                  * connect.
5254                                  */
5255                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5256                                         /*
5257                                          * You were aborted, passive side
5258                                          * always hits here
5259                                          */
5260                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5261                                         error = ECONNRESET;
5262                                 }
5263                                 so->so_state &= ~(SS_ISCONNECTING |
5264                                     SS_ISDISCONNECTING |
5265                                     SS_ISCONFIRMING |
5266                                     SS_ISCONNECTED);
5267                                 if (error == 0) {
5268                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5269                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5270                                                 error = ENOTCONN;
5271                                         }
5272                                 }
5273                                 goto out;
5274                         }
5275                 }
5276                 error = sbwait(&so->so_rcv);
5277                 if (error) {
5278                         goto out;
5279                 }
5280                 held_length = 0;
5281                 goto restart_nosblocks;
5282         } else if (so->so_rcv.sb_cc == 0) {
5283                 if (so->so_error) {
5284                         error = so->so_error;
5285                         if ((in_flags & MSG_PEEK) == 0)
5286                                 so->so_error = 0;
5287                 } else {
5288                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5289                             (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
5290                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5291                                         /*
5292                                          * For active open side clear flags
5293                                          * for re-use passive open is
5294                                          * blocked by connect.
5295                                          */
5296                                         if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5297                                                 /*
5298                                                  * You were aborted, passive
5299                                                  * side always hits here
5300                                                  */
5301                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5302                                                 error = ECONNRESET;
5303                                         }
5304                                         so->so_state &= ~(SS_ISCONNECTING |
5305                                             SS_ISDISCONNECTING |
5306                                             SS_ISCONFIRMING |
5307                                             SS_ISCONNECTED);
5308                                         if (error == 0) {
5309                                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5310                                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5311                                                         error = ENOTCONN;
5312                                                 }
5313                                         }
5314                                         goto out;
5315                                 }
5316                         }
5317                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EWOULDBLOCK);
5318                         error = EWOULDBLOCK;
5319                 }
5320                 goto out;
5321         }
5322         if (hold_sblock == 1) {
5323                 SOCKBUF_UNLOCK(&so->so_rcv);
5324                 hold_sblock = 0;
5325         }
5326         /* we possibly have data we can read */
5327         /* sa_ignore FREED_MEMORY */
5328         control = TAILQ_FIRST(&inp->read_queue);
5329         if (control == NULL) {
5330                 /*
5331                  * This could be happening since the appender did the
5332                  * increment but as not yet did the tailq insert onto the
5333                  * read_queue
5334                  */
5335                 if (hold_rlock == 0) {
5336                         SCTP_INP_READ_LOCK(inp);
5337                 }
5338                 control = TAILQ_FIRST(&inp->read_queue);
5339                 if ((control == NULL) && (so->so_rcv.sb_cc != 0)) {
5340 #ifdef INVARIANTS
5341                         panic("Huh, its non zero and nothing on control?");
5342 #endif
5343                         so->so_rcv.sb_cc = 0;
5344                 }
5345                 SCTP_INP_READ_UNLOCK(inp);
5346                 hold_rlock = 0;
5347                 goto restart;
5348         }
5349         if ((control->length == 0) &&
5350             (control->do_not_ref_stcb)) {
5351                 /*
5352                  * Clean up code for freeing assoc that left behind a
5353                  * pdapi.. maybe a peer in EEOR that just closed after
5354                  * sending and never indicated a EOR.
5355                  */
5356                 if (hold_rlock == 0) {
5357                         hold_rlock = 1;
5358                         SCTP_INP_READ_LOCK(inp);
5359                 }
5360                 control->held_length = 0;
5361                 if (control->data) {
5362                         /* Hmm there is data here .. fix */
5363                         struct mbuf *m_tmp;
5364                         int cnt = 0;
5365
5366                         m_tmp = control->data;
5367                         while (m_tmp) {
5368                                 cnt += SCTP_BUF_LEN(m_tmp);
5369                                 if (SCTP_BUF_NEXT(m_tmp) == NULL) {
5370                                         control->tail_mbuf = m_tmp;
5371                                         control->end_added = 1;
5372                                 }
5373                                 m_tmp = SCTP_BUF_NEXT(m_tmp);
5374                         }
5375                         control->length = cnt;
5376                 } else {
5377                         /* remove it */
5378                         TAILQ_REMOVE(&inp->read_queue, control, next);
5379                         /* Add back any hiddend data */
5380                         sctp_free_remote_addr(control->whoFrom);
5381                         sctp_free_a_readq(stcb, control);
5382                 }
5383                 if (hold_rlock) {
5384                         hold_rlock = 0;
5385                         SCTP_INP_READ_UNLOCK(inp);
5386                 }
5387                 goto restart;
5388         }
5389         if ((control->length == 0) &&
5390             (control->end_added == 1)) {
5391                 /*
5392                  * Do we also need to check for (control->pdapi_aborted ==
5393                  * 1)?
5394                  */
5395                 if (hold_rlock == 0) {
5396                         hold_rlock = 1;
5397                         SCTP_INP_READ_LOCK(inp);
5398                 }
5399                 TAILQ_REMOVE(&inp->read_queue, control, next);
5400                 if (control->data) {
5401 #ifdef INVARIANTS
5402                         panic("control->data not null but control->length == 0");
5403 #else
5404                         SCTP_PRINTF("Strange, data left in the control buffer. Cleaning up.\n");
5405                         sctp_m_freem(control->data);
5406                         control->data = NULL;
5407 #endif
5408                 }
5409                 if (control->aux_data) {
5410                         sctp_m_free(control->aux_data);
5411                         control->aux_data = NULL;
5412                 }
5413                 sctp_free_remote_addr(control->whoFrom);
5414                 sctp_free_a_readq(stcb, control);
5415                 if (hold_rlock) {
5416                         hold_rlock = 0;
5417                         SCTP_INP_READ_UNLOCK(inp);
5418                 }
5419                 goto restart;
5420         }
5421         if (control->length == 0) {
5422                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) &&
5423                     (filling_sinfo)) {
5424                         /* find a more suitable one then this */
5425                         ctl = TAILQ_NEXT(control, next);
5426                         while (ctl) {
5427                                 if ((ctl->stcb != control->stcb) && (ctl->length) &&
5428                                     (ctl->some_taken ||
5429                                     (ctl->spec_flags & M_NOTIFICATION) ||
5430                                     ((ctl->do_not_ref_stcb == 0) &&
5431                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))
5432                                     ) {
5433                                         /*-
5434                                          * If we have a different TCB next, and there is data
5435                                          * present. If we have already taken some (pdapi), OR we can
5436                                          * ref the tcb and no delivery as started on this stream, we
5437                                          * take it. Note we allow a notification on a different
5438                                          * assoc to be delivered..
5439                                          */
5440                                         control = ctl;
5441                                         goto found_one;
5442                                 } else if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS)) &&
5443                                             (ctl->length) &&
5444                                             ((ctl->some_taken) ||
5445                                             ((ctl->do_not_ref_stcb == 0) &&
5446                                             ((ctl->spec_flags & M_NOTIFICATION) == 0) &&
5447                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))) {
5448                                         /*-
5449                                          * If we have the same tcb, and there is data present, and we
5450                                          * have the strm interleave feature present. Then if we have
5451                                          * taken some (pdapi) or we can refer to tht tcb AND we have
5452                                          * not started a delivery for this stream, we can take it.
5453                                          * Note we do NOT allow a notificaiton on the same assoc to
5454                                          * be delivered.
5455                                          */
5456                                         control = ctl;
5457                                         goto found_one;
5458                                 }
5459                                 ctl = TAILQ_NEXT(ctl, next);
5460                         }
5461                 }
5462                 /*
5463                  * if we reach here, not suitable replacement is available
5464                  * <or> fragment interleave is NOT on. So stuff the sb_cc
5465                  * into the our held count, and its time to sleep again.
5466                  */
5467                 held_length = so->so_rcv.sb_cc;
5468                 control->held_length = so->so_rcv.sb_cc;
5469                 goto restart;
5470         }
5471         /* Clear the held length since there is something to read */
5472         control->held_length = 0;
5473         if (hold_rlock) {
5474                 SCTP_INP_READ_UNLOCK(inp);
5475                 hold_rlock = 0;
5476         }
5477 found_one:
5478         /*
5479          * If we reach here, control has a some data for us to read off.
5480          * Note that stcb COULD be NULL.
5481          */
5482         control->some_taken++;
5483         if (hold_sblock) {
5484                 SOCKBUF_UNLOCK(&so->so_rcv);
5485                 hold_sblock = 0;
5486         }
5487         stcb = control->stcb;
5488         if (stcb) {
5489                 if ((control->do_not_ref_stcb == 0) &&
5490                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5491                         if (freecnt_applied == 0)
5492                                 stcb = NULL;
5493                 } else if (control->do_not_ref_stcb == 0) {
5494                         /* you can't free it on me please */
5495                         /*
5496                          * The lock on the socket buffer protects us so the
5497                          * free code will stop. But since we used the
5498                          * socketbuf lock and the sender uses the tcb_lock
5499                          * to increment, we need to use the atomic add to
5500                          * the refcnt
5501                          */
5502                         if (freecnt_applied) {
5503 #ifdef INVARIANTS
5504                                 panic("refcnt already incremented");
5505 #else
5506                                 SCTP_PRINTF("refcnt already incremented?\n");
5507 #endif
5508                         } else {
5509                                 atomic_add_int(&stcb->asoc.refcnt, 1);
5510                                 freecnt_applied = 1;
5511                         }
5512                         /*
5513                          * Setup to remember how much we have not yet told
5514                          * the peer our rwnd has opened up. Note we grab the
5515                          * value from the tcb from last time. Note too that
5516                          * sack sending clears this when a sack is sent,
5517                          * which is fine. Once we hit the rwnd_req, we then
5518                          * will go to the sctp_user_rcvd() that will not
5519                          * lock until it KNOWs it MUST send a WUP-SACK.
5520                          */
5521                         freed_so_far = stcb->freed_by_sorcv_sincelast;
5522                         stcb->freed_by_sorcv_sincelast = 0;
5523                 }
5524         }
5525         if (stcb &&
5526             ((control->spec_flags & M_NOTIFICATION) == 0) &&
5527             control->do_not_ref_stcb == 0) {
5528                 stcb->asoc.strmin[control->sinfo_stream].delivery_started = 1;
5529         }
5530         /* First lets get off the sinfo and sockaddr info */
5531         if ((sinfo) && filling_sinfo) {
5532                 memcpy(sinfo, control, sizeof(struct sctp_nonpad_sndrcvinfo));
5533                 nxt = TAILQ_NEXT(control, next);
5534                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
5535                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) {
5536                         struct sctp_extrcvinfo *s_extra;
5537
5538                         s_extra = (struct sctp_extrcvinfo *)sinfo;
5539                         if ((nxt) &&
5540                             (nxt->length)) {
5541                                 s_extra->sreinfo_next_flags = SCTP_NEXT_MSG_AVAIL;
5542                                 if (nxt->sinfo_flags & SCTP_UNORDERED) {
5543                                         s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_IS_UNORDERED;
5544                                 }
5545                                 if (nxt->spec_flags & M_NOTIFICATION) {
5546                                         s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_IS_NOTIFICATION;
5547                                 }
5548                                 s_extra->sreinfo_next_aid = nxt->sinfo_assoc_id;
5549                                 s_extra->sreinfo_next_length = nxt->length;
5550                                 s_extra->sreinfo_next_ppid = nxt->sinfo_ppid;
5551                                 s_extra->sreinfo_next_stream = nxt->sinfo_stream;
5552                                 if (nxt->tail_mbuf != NULL) {
5553                                         if (nxt->end_added) {
5554                                                 s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_ISCOMPLETE;
5555                                         }
5556                                 }
5557                         } else {
5558                                 /*
5559                                  * we explicitly 0 this, since the memcpy
5560                                  * got some other things beyond the older
5561                                  * sinfo_ that is on the control's structure
5562                                  * :-D
5563                                  */
5564                                 nxt = NULL;
5565                                 s_extra->sreinfo_next_flags = SCTP_NO_NEXT_MSG;
5566                                 s_extra->sreinfo_next_aid = 0;
5567                                 s_extra->sreinfo_next_length = 0;
5568                                 s_extra->sreinfo_next_ppid = 0;
5569                                 s_extra->sreinfo_next_stream = 0;
5570                         }
5571                 }
5572                 /*
5573                  * update off the real current cum-ack, if we have an stcb.
5574                  */
5575                 if ((control->do_not_ref_stcb == 0) && stcb)
5576                         sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
5577                 /*
5578                  * mask off the high bits, we keep the actual chunk bits in
5579                  * there.
5580                  */
5581                 sinfo->sinfo_flags &= 0x00ff;
5582                 if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) {
5583                         sinfo->sinfo_flags |= SCTP_UNORDERED;
5584                 }
5585         }
5586 #ifdef SCTP_ASOCLOG_OF_TSNS
5587         {
5588                 int index, newindex;
5589                 struct sctp_pcbtsn_rlog *entry;
5590
5591                 do {
5592                         index = inp->readlog_index;
5593                         newindex = index + 1;
5594                         if (newindex >= SCTP_READ_LOG_SIZE) {
5595                                 newindex = 0;
5596                         }
5597                 } while (atomic_cmpset_int(&inp->readlog_index, index, newindex) == 0);
5598                 entry = &inp->readlog[index];
5599                 entry->vtag = control->sinfo_assoc_id;
5600                 entry->strm = control->sinfo_stream;
5601                 entry->seq = control->sinfo_ssn;
5602                 entry->sz = control->length;
5603                 entry->flgs = control->sinfo_flags;
5604         }
5605 #endif
5606         if (fromlen && from) {
5607                 cp_len = min((size_t)fromlen, (size_t)control->whoFrom->ro._l_addr.sa.sa_len);
5608                 switch (control->whoFrom->ro._l_addr.sa.sa_family) {
5609 #ifdef INET6
5610                 case AF_INET6:
5611                         ((struct sockaddr_in6 *)from)->sin6_port = control->port_from;
5612                         break;
5613 #endif
5614 #ifdef INET
5615                 case AF_INET:
5616                         ((struct sockaddr_in *)from)->sin_port = control->port_from;
5617                         break;
5618 #endif
5619                 default:
5620                         break;
5621                 }
5622                 memcpy(from, &control->whoFrom->ro._l_addr, cp_len);
5623
5624 #if defined(INET) && defined(INET6)
5625                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) &&
5626                     (from->sa_family == AF_INET) &&
5627                     ((size_t)fromlen >= sizeof(struct sockaddr_in6))) {
5628                         struct sockaddr_in *sin;
5629                         struct sockaddr_in6 sin6;
5630
5631                         sin = (struct sockaddr_in *)from;
5632                         bzero(&sin6, sizeof(sin6));
5633                         sin6.sin6_family = AF_INET6;
5634                         sin6.sin6_len = sizeof(struct sockaddr_in6);
5635                         sin6.sin6_addr.s6_addr32[2] = htonl(0xffff);
5636                         bcopy(&sin->sin_addr,
5637                             &sin6.sin6_addr.s6_addr32[3],
5638                             sizeof(sin6.sin6_addr.s6_addr32[3]));
5639                         sin6.sin6_port = sin->sin_port;
5640                         memcpy(from, &sin6, sizeof(struct sockaddr_in6));
5641                 }
5642 #endif
5643 #ifdef INET6
5644                 {
5645                         struct sockaddr_in6 lsa6, *from6;
5646
5647                         from6 = (struct sockaddr_in6 *)from;
5648                         sctp_recover_scope_mac(from6, (&lsa6));
5649                 }
5650 #endif
5651         }
5652         /* now copy out what data we can */
5653         if (mp == NULL) {
5654                 /* copy out each mbuf in the chain up to length */
5655 get_more_data:
5656                 m = control->data;
5657                 while (m) {
5658                         /* Move out all we can */
5659                         cp_len = (int)uio->uio_resid;
5660                         my_len = (int)SCTP_BUF_LEN(m);
5661                         if (cp_len > my_len) {
5662                                 /* not enough in this buf */
5663                                 cp_len = my_len;
5664                         }
5665                         if (hold_rlock) {
5666                                 SCTP_INP_READ_UNLOCK(inp);
5667                                 hold_rlock = 0;
5668                         }
5669                         if (cp_len > 0)
5670                                 error = uiomove(mtod(m, char *), cp_len, uio);
5671                         /* re-read */
5672                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5673                                 goto release;
5674                         }
5675                         if ((control->do_not_ref_stcb == 0) && stcb &&
5676                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5677                                 no_rcv_needed = 1;
5678                         }
5679                         if (error) {
5680                                 /* error we are out of here */
5681                                 goto release;
5682                         }
5683                         if ((SCTP_BUF_NEXT(m) == NULL) &&
5684                             (cp_len >= SCTP_BUF_LEN(m)) &&
5685                             ((control->end_added == 0) ||
5686                             (control->end_added &&
5687                             (TAILQ_NEXT(control, next) == NULL)))
5688                             ) {
5689                                 SCTP_INP_READ_LOCK(inp);
5690                                 hold_rlock = 1;
5691                         }
5692                         if (cp_len == SCTP_BUF_LEN(m)) {
5693                                 if ((SCTP_BUF_NEXT(m) == NULL) &&
5694                                     (control->end_added)) {
5695                                         out_flags |= MSG_EOR;
5696                                         if ((control->do_not_ref_stcb == 0) &&
5697                                             (control->stcb != NULL) &&
5698                                             ((control->spec_flags & M_NOTIFICATION) == 0))
5699                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5700                                 }
5701                                 if (control->spec_flags & M_NOTIFICATION) {
5702                                         out_flags |= MSG_NOTIFICATION;
5703                                 }
5704                                 /* we ate up the mbuf */
5705                                 if (in_flags & MSG_PEEK) {
5706                                         /* just looking */
5707                                         m = SCTP_BUF_NEXT(m);
5708                                         copied_so_far += cp_len;
5709                                 } else {
5710                                         /* dispose of the mbuf */
5711                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5712                                                 sctp_sblog(&so->so_rcv,
5713                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
5714                                         }
5715                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
5716                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5717                                                 sctp_sblog(&so->so_rcv,
5718                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5719                                         }
5720                                         copied_so_far += cp_len;
5721                                         freed_so_far += cp_len;
5722                                         freed_so_far += MSIZE;
5723                                         atomic_subtract_int(&control->length, cp_len);
5724                                         control->data = sctp_m_free(m);
5725                                         m = control->data;
5726                                         /*
5727                                          * been through it all, must hold sb
5728                                          * lock ok to null tail
5729                                          */
5730                                         if (control->data == NULL) {
5731 #ifdef INVARIANTS
5732                                                 if ((control->end_added == 0) ||
5733                                                     (TAILQ_NEXT(control, next) == NULL)) {
5734                                                         /*
5735                                                          * If the end is not
5736                                                          * added, OR the
5737                                                          * next is NOT null
5738                                                          * we MUST have the
5739                                                          * lock.
5740                                                          */
5741                                                         if (mtx_owned(&inp->inp_rdata_mtx) == 0) {
5742                                                                 panic("Hmm we don't own the lock?");
5743                                                         }
5744                                                 }
5745 #endif
5746                                                 control->tail_mbuf = NULL;
5747 #ifdef INVARIANTS
5748                                                 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) {
5749                                                         panic("end_added, nothing left and no MSG_EOR");
5750                                                 }
5751 #endif
5752                                         }
5753                                 }
5754                         } else {
5755                                 /* Do we need to trim the mbuf? */
5756                                 if (control->spec_flags & M_NOTIFICATION) {
5757                                         out_flags |= MSG_NOTIFICATION;
5758                                 }
5759                                 if ((in_flags & MSG_PEEK) == 0) {
5760                                         SCTP_BUF_RESV_UF(m, cp_len);
5761                                         SCTP_BUF_LEN(m) -= cp_len;
5762                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5763                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, cp_len);
5764                                         }
5765                                         atomic_subtract_int(&so->so_rcv.sb_cc, cp_len);
5766                                         if ((control->do_not_ref_stcb == 0) &&
5767                                             stcb) {
5768                                                 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len);
5769                                         }
5770                                         copied_so_far += cp_len;
5771                                         freed_so_far += cp_len;
5772                                         freed_so_far += MSIZE;
5773                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5774                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
5775                                                     SCTP_LOG_SBRESULT, 0);
5776                                         }
5777                                         atomic_subtract_int(&control->length, cp_len);
5778                                 } else {
5779                                         copied_so_far += cp_len;
5780                                 }
5781                         }
5782                         if ((out_flags & MSG_EOR) || (uio->uio_resid == 0)) {
5783                                 break;
5784                         }
5785                         if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5786                             (control->do_not_ref_stcb == 0) &&
5787                             (freed_so_far >= rwnd_req)) {
5788                                 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5789                         }
5790                 }               /* end while(m) */
5791                 /*
5792                  * At this point we have looked at it all and we either have
5793                  * a MSG_EOR/or read all the user wants... <OR>
5794                  * control->length == 0.
5795                  */
5796                 if ((out_flags & MSG_EOR) && ((in_flags & MSG_PEEK) == 0)) {
5797                         /* we are done with this control */
5798                         if (control->length == 0) {
5799                                 if (control->data) {
5800 #ifdef INVARIANTS
5801                                         panic("control->data not null at read eor?");
5802 #else
5803                                         SCTP_PRINTF("Strange, data left in the control buffer .. invarients would panic?\n");
5804                                         sctp_m_freem(control->data);
5805                                         control->data = NULL;
5806 #endif
5807                                 }
5808                 done_with_control:
5809                                 if (TAILQ_NEXT(control, next) == NULL) {
5810                                         /*
5811                                          * If we don't have a next we need a
5812                                          * lock, if there is a next
5813                                          * interrupt is filling ahead of us
5814                                          * and we don't need a lock to
5815                                          * remove this guy (which is the
5816                                          * head of the queue).
5817                                          */
5818                                         if (hold_rlock == 0) {
5819                                                 SCTP_INP_READ_LOCK(inp);
5820                                                 hold_rlock = 1;
5821                                         }
5822                                 }
5823                                 TAILQ_REMOVE(&inp->read_queue, control, next);
5824                                 /* Add back any hiddend data */
5825                                 if (control->held_length) {
5826                                         held_length = 0;
5827                                         control->held_length = 0;
5828                                         wakeup_read_socket = 1;
5829                                 }
5830                                 if (control->aux_data) {
5831                                         sctp_m_free(control->aux_data);
5832                                         control->aux_data = NULL;
5833                                 }
5834                                 no_rcv_needed = control->do_not_ref_stcb;
5835                                 sctp_free_remote_addr(control->whoFrom);
5836                                 control->data = NULL;
5837                                 sctp_free_a_readq(stcb, control);
5838                                 control = NULL;
5839                                 if ((freed_so_far >= rwnd_req) &&
5840                                     (no_rcv_needed == 0))
5841                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5842
5843                         } else {
5844                                 /*
5845                                  * The user did not read all of this
5846                                  * message, turn off the returned MSG_EOR
5847                                  * since we are leaving more behind on the
5848                                  * control to read.
5849                                  */
5850 #ifdef INVARIANTS
5851                                 if (control->end_added &&
5852                                     (control->data == NULL) &&
5853                                     (control->tail_mbuf == NULL)) {
5854                                         panic("Gak, control->length is corrupt?");
5855                                 }
5856 #endif
5857                                 no_rcv_needed = control->do_not_ref_stcb;
5858                                 out_flags &= ~MSG_EOR;
5859                         }
5860                 }
5861                 if (out_flags & MSG_EOR) {
5862                         goto release;
5863                 }
5864                 if ((uio->uio_resid == 0) ||
5865                     ((in_eeor_mode) && (copied_so_far >= max(so->so_rcv.sb_lowat, 1)))
5866                     ) {
5867                         goto release;
5868                 }
5869                 /*
5870                  * If I hit here the receiver wants more and this message is
5871                  * NOT done (pd-api). So two questions. Can we block? if not
5872                  * we are done. Did the user NOT set MSG_WAITALL?
5873                  */
5874                 if (block_allowed == 0) {
5875                         goto release;
5876                 }
5877                 /*
5878                  * We need to wait for more data a few things: - We don't
5879                  * sbunlock() so we don't get someone else reading. - We
5880                  * must be sure to account for the case where what is added
5881                  * is NOT to our control when we wakeup.
5882                  */
5883
5884                 /*
5885                  * Do we need to tell the transport a rwnd update might be
5886                  * needed before we go to sleep?
5887                  */
5888                 if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5889                     ((freed_so_far >= rwnd_req) &&
5890                     (control->do_not_ref_stcb == 0) &&
5891                     (no_rcv_needed == 0))) {
5892                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5893                 }
5894 wait_some_more:
5895                 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
5896                         goto release;
5897                 }
5898                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
5899                         goto release;
5900
5901                 if (hold_rlock == 1) {
5902                         SCTP_INP_READ_UNLOCK(inp);
5903                         hold_rlock = 0;
5904                 }
5905                 if (hold_sblock == 0) {
5906                         SOCKBUF_LOCK(&so->so_rcv);
5907                         hold_sblock = 1;
5908                 }
5909                 if ((copied_so_far) && (control->length == 0) &&
5910                     (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE))) {
5911                         goto release;
5912                 }
5913                 if (so->so_rcv.sb_cc <= control->held_length) {
5914                         error = sbwait(&so->so_rcv);
5915                         if (error) {
5916                                 goto release;
5917                         }
5918                         control->held_length = 0;
5919                 }
5920                 if (hold_sblock) {
5921                         SOCKBUF_UNLOCK(&so->so_rcv);
5922                         hold_sblock = 0;
5923                 }
5924                 if (control->length == 0) {
5925                         /* still nothing here */
5926                         if (control->end_added == 1) {
5927                                 /* he aborted, or is done i.e.did a shutdown */
5928                                 out_flags |= MSG_EOR;
5929                                 if (control->pdapi_aborted) {
5930                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5931                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5932
5933                                         out_flags |= MSG_TRUNC;
5934                                 } else {
5935                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5936                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5937                                 }
5938                                 goto done_with_control;
5939                         }
5940                         if (so->so_rcv.sb_cc > held_length) {
5941                                 control->held_length = so->so_rcv.sb_cc;
5942                                 held_length = 0;
5943                         }
5944                         goto wait_some_more;
5945                 } else if (control->data == NULL) {
5946                         /*
5947                          * we must re-sync since data is probably being
5948                          * added
5949                          */
5950                         SCTP_INP_READ_LOCK(inp);
5951                         if ((control->length > 0) && (control->data == NULL)) {
5952                                 /*
5953                                  * big trouble.. we have the lock and its
5954                                  * corrupt?
5955                                  */
5956 #ifdef INVARIANTS
5957                                 panic("Impossible data==NULL length !=0");
5958 #endif
5959                                 out_flags |= MSG_EOR;
5960                                 out_flags |= MSG_TRUNC;
5961                                 control->length = 0;
5962                                 SCTP_INP_READ_UNLOCK(inp);
5963                                 goto done_with_control;
5964                         }
5965                         SCTP_INP_READ_UNLOCK(inp);
5966                         /* We will fall around to get more data */
5967                 }
5968                 goto get_more_data;
5969         } else {
5970                 /*-
5971                  * Give caller back the mbuf chain,
5972                  * store in uio_resid the length
5973                  */
5974                 wakeup_read_socket = 0;
5975                 if ((control->end_added == 0) ||
5976                     (TAILQ_NEXT(control, next) == NULL)) {
5977                         /* Need to get rlock */
5978                         if (hold_rlock == 0) {
5979                                 SCTP_INP_READ_LOCK(inp);
5980                                 hold_rlock = 1;
5981                         }
5982                 }
5983                 if (control->end_added) {
5984                         out_flags |= MSG_EOR;
5985                         if ((control->do_not_ref_stcb == 0) &&
5986                             (control->stcb != NULL) &&
5987                             ((control->spec_flags & M_NOTIFICATION) == 0))
5988                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5989                 }
5990                 if (control->spec_flags & M_NOTIFICATION) {
5991                         out_flags |= MSG_NOTIFICATION;
5992                 }
5993                 uio->uio_resid = control->length;
5994                 *mp = control->data;
5995                 m = control->data;
5996                 while (m) {
5997                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5998                                 sctp_sblog(&so->so_rcv,
5999                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
6000                         }
6001                         sctp_sbfree(control, stcb, &so->so_rcv, m);
6002                         freed_so_far += SCTP_BUF_LEN(m);
6003                         freed_so_far += MSIZE;
6004                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6005                                 sctp_sblog(&so->so_rcv,
6006                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
6007                         }
6008                         m = SCTP_BUF_NEXT(m);
6009                 }
6010                 control->data = control->tail_mbuf = NULL;
6011                 control->length = 0;
6012                 if (out_flags & MSG_EOR) {
6013                         /* Done with this control */
6014                         goto done_with_control;
6015                 }
6016         }
6017 release:
6018         if (hold_rlock == 1) {
6019                 SCTP_INP_READ_UNLOCK(inp);
6020                 hold_rlock = 0;
6021         }
6022         if (hold_sblock == 1) {
6023                 SOCKBUF_UNLOCK(&so->so_rcv);
6024                 hold_sblock = 0;
6025         }
6026         sbunlock(&so->so_rcv);
6027         sockbuf_lock = 0;
6028
6029 release_unlocked:
6030         if (hold_sblock) {
6031                 SOCKBUF_UNLOCK(&so->so_rcv);
6032                 hold_sblock = 0;
6033         }
6034         if ((stcb) && (in_flags & MSG_PEEK) == 0) {
6035                 if ((freed_so_far >= rwnd_req) &&
6036                     (control && (control->do_not_ref_stcb == 0)) &&
6037                     (no_rcv_needed == 0))
6038                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6039         }
6040 out:
6041         if (msg_flags) {
6042                 *msg_flags = out_flags;
6043         }
6044         if (((out_flags & MSG_EOR) == 0) &&
6045             ((in_flags & MSG_PEEK) == 0) &&
6046             (sinfo) &&
6047             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
6048             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO))) {
6049                 struct sctp_extrcvinfo *s_extra;
6050
6051                 s_extra = (struct sctp_extrcvinfo *)sinfo;
6052                 s_extra->sreinfo_next_flags = SCTP_NO_NEXT_MSG;
6053         }
6054         if (hold_rlock == 1) {
6055                 SCTP_INP_READ_UNLOCK(inp);
6056         }
6057         if (hold_sblock) {
6058                 SOCKBUF_UNLOCK(&so->so_rcv);
6059         }
6060         if (sockbuf_lock) {
6061                 sbunlock(&so->so_rcv);
6062         }
6063         if (freecnt_applied) {
6064                 /*
6065                  * The lock on the socket buffer protects us so the free
6066                  * code will stop. But since we used the socketbuf lock and
6067                  * the sender uses the tcb_lock to increment, we need to use
6068                  * the atomic add to the refcnt.
6069                  */
6070                 if (stcb == NULL) {
6071 #ifdef INVARIANTS
6072                         panic("stcb for refcnt has gone NULL?");
6073                         goto stage_left;
6074 #else
6075                         goto stage_left;
6076 #endif
6077                 }
6078                 atomic_add_int(&stcb->asoc.refcnt, -1);
6079                 /* Save the value back for next time */
6080                 stcb->freed_by_sorcv_sincelast = freed_so_far;
6081         }
6082         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
6083                 if (stcb) {
6084                         sctp_misc_ints(SCTP_SORECV_DONE,
6085                             freed_so_far,
6086                             ((uio) ? (slen - uio->uio_resid) : slen),
6087                             stcb->asoc.my_rwnd,
6088                             so->so_rcv.sb_cc);
6089                 } else {
6090                         sctp_misc_ints(SCTP_SORECV_DONE,
6091                             freed_so_far,
6092                             ((uio) ? (slen - uio->uio_resid) : slen),
6093                             0,
6094                             so->so_rcv.sb_cc);
6095                 }
6096         }
6097 stage_left:
6098         if (wakeup_read_socket) {
6099                 sctp_sorwakeup(inp, so);
6100         }
6101         return (error);
6102 }
6103
6104
6105 #ifdef SCTP_MBUF_LOGGING
6106 struct mbuf *
6107 sctp_m_free(struct mbuf *m)
6108 {
6109         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
6110                 if (SCTP_BUF_IS_EXTENDED(m)) {
6111                         sctp_log_mb(m, SCTP_MBUF_IFREE);
6112                 }
6113         }
6114         return (m_free(m));
6115 }
6116
6117 void
6118 sctp_m_freem(struct mbuf *mb)
6119 {
6120         while (mb != NULL)
6121                 mb = sctp_m_free(mb);
6122 }
6123
6124 #endif
6125
6126 int
6127 sctp_dynamic_set_primary(struct sockaddr *sa, uint32_t vrf_id)
6128 {
6129         /*
6130          * Given a local address. For all associations that holds the
6131          * address, request a peer-set-primary.
6132          */
6133         struct sctp_ifa *ifa;
6134         struct sctp_laddr *wi;
6135
6136         ifa = sctp_find_ifa_by_addr(sa, vrf_id, 0);
6137         if (ifa == NULL) {
6138                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EADDRNOTAVAIL);
6139                 return (EADDRNOTAVAIL);
6140         }
6141         /*
6142          * Now that we have the ifa we must awaken the iterator with this
6143          * message.
6144          */
6145         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
6146         if (wi == NULL) {
6147                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
6148                 return (ENOMEM);
6149         }
6150         /* Now incr the count and int wi structure */
6151         SCTP_INCR_LADDR_COUNT();
6152         bzero(wi, sizeof(*wi));
6153         (void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
6154         wi->ifa = ifa;
6155         wi->action = SCTP_SET_PRIM_ADDR;
6156         atomic_add_int(&ifa->refcount, 1);
6157
6158         /* Now add it to the work queue */
6159         SCTP_WQ_ADDR_LOCK();
6160         /*
6161          * Should this really be a tailq? As it is we will process the
6162          * newest first :-0
6163          */
6164         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
6165         SCTP_WQ_ADDR_UNLOCK();
6166         sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
6167             (struct sctp_inpcb *)NULL,
6168             (struct sctp_tcb *)NULL,
6169             (struct sctp_nets *)NULL);
6170         return (0);
6171 }
6172
6173
6174 int
6175 sctp_soreceive(struct socket *so,
6176     struct sockaddr **psa,
6177     struct uio *uio,
6178     struct mbuf **mp0,
6179     struct mbuf **controlp,
6180     int *flagsp)
6181 {
6182         int error, fromlen;
6183         uint8_t sockbuf[256];
6184         struct sockaddr *from;
6185         struct sctp_extrcvinfo sinfo;
6186         int filling_sinfo = 1;
6187         struct sctp_inpcb *inp;
6188
6189         inp = (struct sctp_inpcb *)so->so_pcb;
6190         /* pickup the assoc we are reading from */
6191         if (inp == NULL) {
6192                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6193                 return (EINVAL);
6194         }
6195         if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) &&
6196             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) &&
6197             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) ||
6198             (controlp == NULL)) {
6199                 /* user does not want the sndrcv ctl */
6200                 filling_sinfo = 0;
6201         }
6202         if (psa) {
6203                 from = (struct sockaddr *)sockbuf;
6204                 fromlen = sizeof(sockbuf);
6205                 from->sa_len = 0;
6206         } else {
6207                 from = NULL;
6208                 fromlen = 0;
6209         }
6210
6211         error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, flagsp,
6212             (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo);
6213         if ((controlp) && (filling_sinfo)) {
6214                 /* copy back the sinfo in a CMSG format */
6215                 if (filling_sinfo)
6216                         *controlp = sctp_build_ctl_nchunk(inp,
6217                             (struct sctp_sndrcvinfo *)&sinfo);
6218                 else
6219                         *controlp = NULL;
6220         }
6221         if (psa) {
6222                 /* copy back the address info */
6223                 if (from && from->sa_len) {
6224                         *psa = sodupsockaddr(from, M_NOWAIT);
6225                 } else {
6226                         *psa = NULL;
6227                 }
6228         }
6229         return (error);
6230 }
6231
6232
6233
6234
6235
6236 int
6237 sctp_connectx_helper_add(struct sctp_tcb *stcb, struct sockaddr *addr,
6238     int totaddr, int *error)
6239 {
6240         int added = 0;
6241         int i;
6242         struct sctp_inpcb *inp;
6243         struct sockaddr *sa;
6244         size_t incr = 0;
6245
6246 #ifdef INET
6247         struct sockaddr_in *sin;
6248
6249 #endif
6250 #ifdef INET6
6251         struct sockaddr_in6 *sin6;
6252
6253 #endif
6254
6255         sa = addr;
6256         inp = stcb->sctp_ep;
6257         *error = 0;
6258         for (i = 0; i < totaddr; i++) {
6259                 switch (sa->sa_family) {
6260 #ifdef INET
6261                 case AF_INET:
6262                         incr = sizeof(struct sockaddr_in);
6263                         sin = (struct sockaddr_in *)sa;
6264                         if ((sin->sin_addr.s_addr == INADDR_ANY) ||
6265                             (sin->sin_addr.s_addr == INADDR_BROADCAST) ||
6266                             IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
6267                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6268                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_7);
6269                                 *error = EINVAL;
6270                                 goto out_now;
6271                         }
6272                         if (sctp_add_remote_addr(stcb, sa, NULL, SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) {
6273                                 /* assoc gone no un-lock */
6274                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6275                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_7);
6276                                 *error = ENOBUFS;
6277                                 goto out_now;
6278                         }
6279                         added++;
6280                         break;
6281 #endif
6282 #ifdef INET6
6283                 case AF_INET6:
6284                         incr = sizeof(struct sockaddr_in6);
6285                         sin6 = (struct sockaddr_in6 *)sa;
6286                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
6287                             IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
6288                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6289                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_8);
6290                                 *error = EINVAL;
6291                                 goto out_now;
6292                         }
6293                         if (sctp_add_remote_addr(stcb, sa, NULL, SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) {
6294                                 /* assoc gone no un-lock */
6295                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6296                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_8);
6297                                 *error = ENOBUFS;
6298                                 goto out_now;
6299                         }
6300                         added++;
6301                         break;
6302 #endif
6303                 default:
6304                         break;
6305                 }
6306                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6307         }
6308 out_now:
6309         return (added);
6310 }
6311
6312 struct sctp_tcb *
6313 sctp_connectx_helper_find(struct sctp_inpcb *inp, struct sockaddr *addr,
6314     int *totaddr, int *num_v4, int *num_v6, int *error,
6315     int limit, int *bad_addr)
6316 {
6317         struct sockaddr *sa;
6318         struct sctp_tcb *stcb = NULL;
6319         size_t incr, at, i;
6320
6321         at = incr = 0;
6322         sa = addr;
6323
6324         *error = *num_v6 = *num_v4 = 0;
6325         /* account and validate addresses */
6326         for (i = 0; i < (size_t)*totaddr; i++) {
6327                 switch (sa->sa_family) {
6328 #ifdef INET
6329                 case AF_INET:
6330                         (*num_v4) += 1;
6331                         incr = sizeof(struct sockaddr_in);
6332                         if (sa->sa_len != incr) {
6333                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6334                                 *error = EINVAL;
6335                                 *bad_addr = 1;
6336                                 return (NULL);
6337                         }
6338                         break;
6339 #endif
6340 #ifdef INET6
6341                 case AF_INET6:
6342                         {
6343                                 struct sockaddr_in6 *sin6;
6344
6345                                 sin6 = (struct sockaddr_in6 *)sa;
6346                                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6347                                         /* Must be non-mapped for connectx */
6348                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6349                                         *error = EINVAL;
6350                                         *bad_addr = 1;
6351                                         return (NULL);
6352                                 }
6353                                 (*num_v6) += 1;
6354                                 incr = sizeof(struct sockaddr_in6);
6355                                 if (sa->sa_len != incr) {
6356                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6357                                         *error = EINVAL;
6358                                         *bad_addr = 1;
6359                                         return (NULL);
6360                                 }
6361                                 break;
6362                         }
6363 #endif
6364                 default:
6365                         *totaddr = i;
6366                         /* we are done */
6367                         break;
6368                 }
6369                 if (i == (size_t)*totaddr) {
6370                         break;
6371                 }
6372                 SCTP_INP_INCR_REF(inp);
6373                 stcb = sctp_findassociation_ep_addr(&inp, sa, NULL, NULL, NULL);
6374                 if (stcb != NULL) {
6375                         /* Already have or am bring up an association */
6376                         return (stcb);
6377                 } else {
6378                         SCTP_INP_DECR_REF(inp);
6379                 }
6380                 if ((at + incr) > (size_t)limit) {
6381                         *totaddr = i;
6382                         break;
6383                 }
6384                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6385         }
6386         return ((struct sctp_tcb *)NULL);
6387 }
6388
6389 /*
6390  * sctp_bindx(ADD) for one address.
6391  * assumes all arguments are valid/checked by caller.
6392  */
6393 void
6394 sctp_bindx_add_address(struct socket *so, struct sctp_inpcb *inp,
6395     struct sockaddr *sa, sctp_assoc_t assoc_id,
6396     uint32_t vrf_id, int *error, void *p)
6397 {
6398         struct sockaddr *addr_touse;
6399
6400 #ifdef INET6
6401         struct sockaddr_in sin;
6402
6403 #endif
6404
6405         /* see if we're bound all already! */
6406         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6407                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6408                 *error = EINVAL;
6409                 return;
6410         }
6411         addr_touse = sa;
6412 #ifdef INET6
6413         if (sa->sa_family == AF_INET6) {
6414                 struct sockaddr_in6 *sin6;
6415
6416                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6417                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6418                         *error = EINVAL;
6419                         return;
6420                 }
6421                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6422                         /* can only bind v6 on PF_INET6 sockets */
6423                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6424                         *error = EINVAL;
6425                         return;
6426                 }
6427                 sin6 = (struct sockaddr_in6 *)addr_touse;
6428                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6429                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6430                             SCTP_IPV6_V6ONLY(inp)) {
6431                                 /* can't bind v4-mapped on PF_INET sockets */
6432                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6433                                 *error = EINVAL;
6434                                 return;
6435                         }
6436                         in6_sin6_2_sin(&sin, sin6);
6437                         addr_touse = (struct sockaddr *)&sin;
6438                 }
6439         }
6440 #endif
6441 #ifdef INET
6442         if (sa->sa_family == AF_INET) {
6443                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6444                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6445                         *error = EINVAL;
6446                         return;
6447                 }
6448                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6449                     SCTP_IPV6_V6ONLY(inp)) {
6450                         /* can't bind v4 on PF_INET sockets */
6451                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6452                         *error = EINVAL;
6453                         return;
6454                 }
6455         }
6456 #endif
6457         if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
6458                 if (p == NULL) {
6459                         /* Can't get proc for Net/Open BSD */
6460                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6461                         *error = EINVAL;
6462                         return;
6463                 }
6464                 *error = sctp_inpcb_bind(so, addr_touse, NULL, p);
6465                 return;
6466         }
6467         /*
6468          * No locks required here since bind and mgmt_ep_sa all do their own
6469          * locking. If we do something for the FIX: below we may need to
6470          * lock in that case.
6471          */
6472         if (assoc_id == 0) {
6473                 /* add the address */
6474                 struct sctp_inpcb *lep;
6475                 struct sockaddr_in *lsin = (struct sockaddr_in *)addr_touse;
6476
6477                 /* validate the incoming port */
6478                 if ((lsin->sin_port != 0) &&
6479                     (lsin->sin_port != inp->sctp_lport)) {
6480                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6481                         *error = EINVAL;
6482                         return;
6483                 } else {
6484                         /* user specified 0 port, set it to existing port */
6485                         lsin->sin_port = inp->sctp_lport;
6486                 }
6487
6488                 lep = sctp_pcb_findep(addr_touse, 1, 0, vrf_id);
6489                 if (lep != NULL) {
6490                         /*
6491                          * We must decrement the refcount since we have the
6492                          * ep already and are binding. No remove going on
6493                          * here.
6494                          */
6495                         SCTP_INP_DECR_REF(lep);
6496                 }
6497                 if (lep == inp) {
6498                         /* already bound to it.. ok */
6499                         return;
6500                 } else if (lep == NULL) {
6501                         ((struct sockaddr_in *)addr_touse)->sin_port = 0;
6502                         *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6503                             SCTP_ADD_IP_ADDRESS,
6504                             vrf_id, NULL);
6505                 } else {
6506                         *error = EADDRINUSE;
6507                 }
6508                 if (*error)
6509                         return;
6510         } else {
6511                 /*
6512                  * FIX: decide whether we allow assoc based bindx
6513                  */
6514         }
6515 }
6516
6517 /*
6518  * sctp_bindx(DELETE) for one address.
6519  * assumes all arguments are valid/checked by caller.
6520  */
6521 void
6522 sctp_bindx_delete_address(struct sctp_inpcb *inp,
6523     struct sockaddr *sa, sctp_assoc_t assoc_id,
6524     uint32_t vrf_id, int *error)
6525 {
6526         struct sockaddr *addr_touse;
6527
6528 #ifdef INET6
6529         struct sockaddr_in sin;
6530
6531 #endif
6532
6533         /* see if we're bound all already! */
6534         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6535                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6536                 *error = EINVAL;
6537                 return;
6538         }
6539         addr_touse = sa;
6540 #ifdef INET6
6541         if (sa->sa_family == AF_INET6) {
6542                 struct sockaddr_in6 *sin6;
6543
6544                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6545                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6546                         *error = EINVAL;
6547                         return;
6548                 }
6549                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6550                         /* can only bind v6 on PF_INET6 sockets */
6551                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6552                         *error = EINVAL;
6553                         return;
6554                 }
6555                 sin6 = (struct sockaddr_in6 *)addr_touse;
6556                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6557                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6558                             SCTP_IPV6_V6ONLY(inp)) {
6559                                 /* can't bind mapped-v4 on PF_INET sockets */
6560                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6561                                 *error = EINVAL;
6562                                 return;
6563                         }
6564                         in6_sin6_2_sin(&sin, sin6);
6565                         addr_touse = (struct sockaddr *)&sin;
6566                 }
6567         }
6568 #endif
6569 #ifdef INET
6570         if (sa->sa_family == AF_INET) {
6571                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6572                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6573                         *error = EINVAL;
6574                         return;
6575                 }
6576                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6577                     SCTP_IPV6_V6ONLY(inp)) {
6578                         /* can't bind v4 on PF_INET sockets */
6579                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6580                         *error = EINVAL;
6581                         return;
6582                 }
6583         }
6584 #endif
6585         /*
6586          * No lock required mgmt_ep_sa does its own locking. If the FIX:
6587          * below is ever changed we may need to lock before calling
6588          * association level binding.
6589          */
6590         if (assoc_id == 0) {
6591                 /* delete the address */
6592                 *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6593                     SCTP_DEL_IP_ADDRESS,
6594                     vrf_id, NULL);
6595         } else {
6596                 /*
6597                  * FIX: decide whether we allow assoc based bindx
6598                  */
6599         }
6600 }
6601
6602 /*
6603  * returns the valid local address count for an assoc, taking into account
6604  * all scoping rules
6605  */
6606 int
6607 sctp_local_addr_count(struct sctp_tcb *stcb)
6608 {
6609         int loopback_scope, ipv4_local_scope, local_scope, site_scope;
6610         int ipv4_addr_legal, ipv6_addr_legal;
6611         struct sctp_vrf *vrf;
6612         struct sctp_ifn *sctp_ifn;
6613         struct sctp_ifa *sctp_ifa;
6614         int count = 0;
6615
6616         /* Turn on all the appropriate scopes */
6617         loopback_scope = stcb->asoc.scope.loopback_scope;
6618         ipv4_local_scope = stcb->asoc.scope.ipv4_local_scope;
6619         local_scope = stcb->asoc.scope.local_scope;
6620         site_scope = stcb->asoc.scope.site_scope;
6621         ipv4_addr_legal = stcb->asoc.scope.ipv4_addr_legal;
6622         ipv6_addr_legal = stcb->asoc.scope.ipv6_addr_legal;
6623         SCTP_IPI_ADDR_RLOCK();
6624         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
6625         if (vrf == NULL) {
6626                 /* no vrf, no addresses */
6627                 SCTP_IPI_ADDR_RUNLOCK();
6628                 return (0);
6629         }
6630         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6631                 /*
6632                  * bound all case: go through all ifns on the vrf
6633                  */
6634                 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
6635                         if ((loopback_scope == 0) &&
6636                             SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
6637                                 continue;
6638                         }
6639                         LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
6640                                 if (sctp_is_addr_restricted(stcb, sctp_ifa))
6641                                         continue;
6642                                 switch (sctp_ifa->address.sa.sa_family) {
6643 #ifdef INET
6644                                 case AF_INET:
6645                                         if (ipv4_addr_legal) {
6646                                                 struct sockaddr_in *sin;
6647
6648                                                 sin = (struct sockaddr_in *)&sctp_ifa->address.sa;
6649                                                 if (sin->sin_addr.s_addr == 0) {
6650                                                         /*
6651                                                          * skip unspecified
6652                                                          * addrs
6653                                                          */
6654                                                         continue;
6655                                                 }
6656                                                 if ((ipv4_local_scope == 0) &&
6657                                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
6658                                                         continue;
6659                                                 }
6660                                                 /* count this one */
6661                                                 count++;
6662                                         } else {
6663                                                 continue;
6664                                         }
6665                                         break;
6666 #endif
6667 #ifdef INET6
6668                                 case AF_INET6:
6669                                         if (ipv6_addr_legal) {
6670                                                 struct sockaddr_in6 *sin6;
6671
6672                                                 sin6 = (struct sockaddr_in6 *)&sctp_ifa->address.sa;
6673                                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
6674                                                         continue;
6675                                                 }
6676                                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
6677                                                         if (local_scope == 0)
6678                                                                 continue;
6679                                                         if (sin6->sin6_scope_id == 0) {
6680                                                                 if (sa6_recoverscope(sin6) != 0)
6681                                                                         /*
6682                                                                          *
6683                                                                          * bad
6684                                                                          *
6685                                                                          * li
6686                                                                          * nk
6687                                                                          *
6688                                                                          * loc
6689                                                                          * al
6690                                                                          *
6691                                                                          * add
6692                                                                          * re
6693                                                                          * ss
6694                                                                          * */
6695                                                                         continue;
6696                                                         }
6697                                                 }
6698                                                 if ((site_scope == 0) &&
6699                                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
6700                                                         continue;
6701                                                 }
6702                                                 /* count this one */
6703                                                 count++;
6704                                         }
6705                                         break;
6706 #endif
6707                                 default:
6708                                         /* TSNH */
6709                                         break;
6710                                 }
6711                         }
6712                 }
6713         } else {
6714                 /*
6715                  * subset bound case
6716                  */
6717                 struct sctp_laddr *laddr;
6718
6719                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list,
6720                     sctp_nxt_addr) {
6721                         if (sctp_is_addr_restricted(stcb, laddr->ifa)) {
6722                                 continue;
6723                         }
6724                         /* count this one */
6725                         count++;
6726                 }
6727         }
6728         SCTP_IPI_ADDR_RUNLOCK();
6729         return (count);
6730 }
6731
6732 #if defined(SCTP_LOCAL_TRACE_BUF)
6733
6734 void
6735 sctp_log_trace(uint32_t subsys, const char *str SCTP_UNUSED, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f)
6736 {
6737         uint32_t saveindex, newindex;
6738
6739         do {
6740                 saveindex = SCTP_BASE_SYSCTL(sctp_log).index;
6741                 if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6742                         newindex = 1;
6743                 } else {
6744                         newindex = saveindex + 1;
6745                 }
6746         } while (atomic_cmpset_int(&SCTP_BASE_SYSCTL(sctp_log).index, saveindex, newindex) == 0);
6747         if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6748                 saveindex = 0;
6749         }
6750         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].timestamp = SCTP_GET_CYCLECOUNT;
6751         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].subsys = subsys;
6752         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[0] = a;
6753         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[1] = b;
6754         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[2] = c;
6755         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[3] = d;
6756         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[4] = e;
6757         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[5] = f;
6758 }
6759
6760 #endif
6761 static void
6762 sctp_recv_udp_tunneled_packet(struct mbuf *m, int off, struct inpcb *ignored)
6763 {
6764         struct ip *iph;
6765
6766 #ifdef INET6
6767         struct ip6_hdr *ip6;
6768
6769 #endif
6770         struct mbuf *sp, *last;
6771         struct udphdr *uhdr;
6772         uint16_t port;
6773
6774         if ((m->m_flags & M_PKTHDR) == 0) {
6775                 /* Can't handle one that is not a pkt hdr */
6776                 goto out;
6777         }
6778         /* Pull the src port */
6779         iph = mtod(m, struct ip *);
6780         uhdr = (struct udphdr *)((caddr_t)iph + off);
6781         port = uhdr->uh_sport;
6782         /*
6783          * Split out the mbuf chain. Leave the IP header in m, place the
6784          * rest in the sp.
6785          */
6786         sp = m_split(m, off, M_NOWAIT);
6787         if (sp == NULL) {
6788                 /* Gak, drop packet, we can't do a split */
6789                 goto out;
6790         }
6791         if (sp->m_pkthdr.len < sizeof(struct udphdr) + sizeof(struct sctphdr)) {
6792                 /* Gak, packet can't have an SCTP header in it - too small */
6793                 m_freem(sp);
6794                 goto out;
6795         }
6796         /* Now pull up the UDP header and SCTP header together */
6797         sp = m_pullup(sp, sizeof(struct udphdr) + sizeof(struct sctphdr));
6798         if (sp == NULL) {
6799                 /* Gak pullup failed */
6800                 goto out;
6801         }
6802         /* Trim out the UDP header */
6803         m_adj(sp, sizeof(struct udphdr));
6804
6805         /* Now reconstruct the mbuf chain */
6806         for (last = m; last->m_next; last = last->m_next);
6807         last->m_next = sp;
6808         m->m_pkthdr.len += sp->m_pkthdr.len;
6809         iph = mtod(m, struct ip *);
6810         switch (iph->ip_v) {
6811 #ifdef INET
6812         case IPVERSION:
6813                 iph->ip_len = htons(ntohs(iph->ip_len) - sizeof(struct udphdr));
6814                 sctp_input_with_port(m, off, port);
6815                 break;
6816 #endif
6817 #ifdef INET6
6818         case IPV6_VERSION >> 4:
6819                 ip6 = mtod(m, struct ip6_hdr *);
6820                 ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - sizeof(struct udphdr));
6821                 sctp6_input_with_port(&m, &off, port);
6822                 break;
6823 #endif
6824         default:
6825                 goto out;
6826                 break;
6827         }
6828         return;
6829 out:
6830         m_freem(m);
6831 }
6832
6833 void
6834 sctp_over_udp_stop(void)
6835 {
6836         /*
6837          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
6838          * for writting!
6839          */
6840 #ifdef INET
6841         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
6842                 soclose(SCTP_BASE_INFO(udp4_tun_socket));
6843                 SCTP_BASE_INFO(udp4_tun_socket) = NULL;
6844         }
6845 #endif
6846 #ifdef INET6
6847         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
6848                 soclose(SCTP_BASE_INFO(udp6_tun_socket));
6849                 SCTP_BASE_INFO(udp6_tun_socket) = NULL;
6850         }
6851 #endif
6852 }
6853
6854 int
6855 sctp_over_udp_start(void)
6856 {
6857         uint16_t port;
6858         int ret;
6859
6860 #ifdef INET
6861         struct sockaddr_in sin;
6862
6863 #endif
6864 #ifdef INET6
6865         struct sockaddr_in6 sin6;
6866
6867 #endif
6868         /*
6869          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
6870          * for writting!
6871          */
6872         port = SCTP_BASE_SYSCTL(sctp_udp_tunneling_port);
6873         if (ntohs(port) == 0) {
6874                 /* Must have a port set */
6875                 return (EINVAL);
6876         }
6877 #ifdef INET
6878         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
6879                 /* Already running -- must stop first */
6880                 return (EALREADY);
6881         }
6882 #endif
6883 #ifdef INET6
6884         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
6885                 /* Already running -- must stop first */
6886                 return (EALREADY);
6887         }
6888 #endif
6889 #ifdef INET
6890         if ((ret = socreate(PF_INET, &SCTP_BASE_INFO(udp4_tun_socket),
6891             SOCK_DGRAM, IPPROTO_UDP,
6892             curthread->td_ucred, curthread))) {
6893                 sctp_over_udp_stop();
6894                 return (ret);
6895         }
6896         /* Call the special UDP hook. */
6897         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp4_tun_socket),
6898             sctp_recv_udp_tunneled_packet))) {
6899                 sctp_over_udp_stop();
6900                 return (ret);
6901         }
6902         /* Ok, we have a socket, bind it to the port. */
6903         memset(&sin, 0, sizeof(struct sockaddr_in));
6904         sin.sin_len = sizeof(struct sockaddr_in);
6905         sin.sin_family = AF_INET;
6906         sin.sin_port = htons(port);
6907         if ((ret = sobind(SCTP_BASE_INFO(udp4_tun_socket),
6908             (struct sockaddr *)&sin, curthread))) {
6909                 sctp_over_udp_stop();
6910                 return (ret);
6911         }
6912 #endif
6913 #ifdef INET6
6914         if ((ret = socreate(PF_INET6, &SCTP_BASE_INFO(udp6_tun_socket),
6915             SOCK_DGRAM, IPPROTO_UDP,
6916             curthread->td_ucred, curthread))) {
6917                 sctp_over_udp_stop();
6918                 return (ret);
6919         }
6920         /* Call the special UDP hook. */
6921         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp6_tun_socket),
6922             sctp_recv_udp_tunneled_packet))) {
6923                 sctp_over_udp_stop();
6924                 return (ret);
6925         }
6926         /* Ok, we have a socket, bind it to the port. */
6927         memset(&sin6, 0, sizeof(struct sockaddr_in6));
6928         sin6.sin6_len = sizeof(struct sockaddr_in6);
6929         sin6.sin6_family = AF_INET6;
6930         sin6.sin6_port = htons(port);
6931         if ((ret = sobind(SCTP_BASE_INFO(udp6_tun_socket),
6932             (struct sockaddr *)&sin6, curthread))) {
6933                 sctp_over_udp_stop();
6934                 return (ret);
6935         }
6936 #endif
6937         return (0);
6938 }