sys/netinet/sctputil.c

   1 /*-
   2  * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions are met:
   6  *
   7  * a) Redistributions of source code must retain the above copyright notice,
   8  *   this list of conditions and the following disclaimer.
   9  *
  10  * b) Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in
  12  *   the documentation and/or other materials provided with the distribution.
  13  *
  14  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  15  *    contributors may be used to endorse or promote products derived
  16  *    from this software without specific prior written permission.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  20  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  22  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  28  * THE POSSIBILITY OF SUCH DAMAGE.
  29  */
  30
  31 /* $KAME: sctputil.c,v 1.37 2005/03/07 23:26:09 itojun Exp $     */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36
  37 #include "opt_ipsec.h"
  38 #include "opt_compat.h"
  39 #include "opt_inet6.h"
  40 #include "opt_inet.h"
  41 #include "opt_sctp.h"
  42
  43 #include <sys/param.h>
  44 #include <sys/systm.h>
  45 #include <sys/fcntl.h>
  46 #include <sys/lock.h>
  47 #include <sys/malloc.h>
  48 #include <sys/mbuf.h>
  49 #include <sys/domain.h>
  50 #include <sys/file.h>           /* for struct knote */
  51 #include <sys/kernel.h>
  52 #include <sys/event.h>
  53 #include <sys/poll.h>
  54
  55 #include <sys/protosw.h>
  56 #include <sys/socket.h>
  57 #include <sys/socketvar.h>
  58 #include <sys/proc.h>
  59 #include <sys/kernel.h>
  60 #include <sys/resourcevar.h>
  61 #include <sys/signalvar.h>
  62 #include <sys/sysctl.h>
  63 #include <sys/uio.h>
  64 #include <sys/jail.h>
  65
  66 #include <sys/callout.h>
  67
  68 #include <net/radix.h>
  69 #include <net/route.h>
  70
  71 #ifdef INET6
  72 #include <sys/domain.h>
  73 #endif
  74
  75 #include <sys/limits.h>
  76 #include <sys/mac.h>
  77 #include <sys/mutex.h>
  78
  79 #include <net/if.h>
  80 #include <net/if_types.h>
  81 #include <net/route.h>
  82
  83 #include <netinet/in.h>
  84 #include <netinet/in_systm.h>
  85 #include <netinet/ip.h>
  86 #include <netinet/in_pcb.h>
  87 #include <netinet/in_var.h>
  88 #include <netinet/ip_var.h>
  89
  90 #ifdef INET6
  91 #include <netinet/ip6.h>
  92 #include <netinet6/ip6_var.h>
  93
  94 #include <netinet6/in6_pcb.h>
  95
  96 #include <netinet6/scope6_var.h>
  97 #endif                          /* INET6 */
  98
  99 #ifdef IPSEC
 100 #include <netinet6/ipsec.h>
 101 #include <netkey/key.h>
 102 #endif                          /* IPSEC */
 103
 104 #include <netinet/sctp_os.h>
 105 #include <netinet/sctp_pcb.h>
 106 #include <netinet/sctputil.h>
 107 #include <netinet/sctp_var.h>
 108 #ifdef INET6
 109 #include <netinet6/sctp6_var.h>
 110 #endif
 111 #include <netinet/sctp_header.h>
 112 #include <netinet/sctp_output.h>
 113 #include <netinet/sctp_uio.h>
 114 #include <netinet/sctp_timer.h>
 115 #include <netinet/sctp_crc32.h>
 116 #include <netinet/sctp_indata.h>/* for sctp_deliver_data() */
 117 #include <netinet/sctp_auth.h>
 118 #include <netinet/sctp_asconf.h>
 119
 120 extern int sctp_warm_the_crc32_table;
 121
 122 #define NUMBER_OF_MTU_SIZES 18
 123
 124 #ifdef SCTP_DEBUG
 125 extern uint32_t sctp_debug_on;
 126
 127 #endif
 128
 129
 130 #ifdef SCTP_STAT_LOGGING
 131 int global_sctp_cwnd_log_at = 0;
 132 int global_sctp_cwnd_log_rolled = 0;
 133 struct sctp_cwnd_log sctp_clog[SCTP_STAT_LOG_SIZE];
 134
 135 static uint32_t
 136 sctp_get_time_of_event(void)
 137 {
 138         struct timeval now;
 139         uint32_t timeval;
 140
 141         SCTP_GETPTIME_TIMEVAL(&now);
 142         timeval = (now.tv_sec % 0x00000fff);
 143         timeval <<= 20;
 144         timeval |= now.tv_usec & 0xfffff;
 145         return (timeval);
 146 }
 147
 148
 149 void
 150 sctp_clr_stat_log(void)
 151 {
 152         global_sctp_cwnd_log_at = 0;
 153         global_sctp_cwnd_log_rolled = 0;
 154 }
 155
 156
 157 void
 158 sctp_sblog(struct sockbuf *sb,
 159     struct sctp_tcb *stcb, int from, int incr)
 160 {
 161         int sctp_cwnd_log_at;
 162
 163         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 164         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 165         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 166         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_SB;
 167         sctp_clog[sctp_cwnd_log_at].x.sb.stcb = stcb;
 168         sctp_clog[sctp_cwnd_log_at].x.sb.so_sbcc = sb->sb_cc;
 169         if (stcb)
 170                 sctp_clog[sctp_cwnd_log_at].x.sb.stcb_sbcc = stcb->asoc.sb_cc;
 171         else
 172                 sctp_clog[sctp_cwnd_log_at].x.sb.stcb_sbcc = 0;
 173         sctp_clog[sctp_cwnd_log_at].x.sb.incr = incr;
 174 }
 175
 176 void
 177 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc)
 178 {
 179         int sctp_cwnd_log_at;
 180
 181         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 182         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 183         sctp_clog[sctp_cwnd_log_at].from = 0;
 184         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_CLOSE;
 185         sctp_clog[sctp_cwnd_log_at].x.close.inp = (void *)inp;
 186         sctp_clog[sctp_cwnd_log_at].x.close.sctp_flags = inp->sctp_flags;
 187         if (stcb) {
 188                 sctp_clog[sctp_cwnd_log_at].x.close.stcb = (void *)stcb;
 189                 sctp_clog[sctp_cwnd_log_at].x.close.state = (uint16_t) stcb->asoc.state;
 190         } else {
 191                 sctp_clog[sctp_cwnd_log_at].x.close.stcb = 0;
 192                 sctp_clog[sctp_cwnd_log_at].x.close.state = 0;
 193         }
 194         sctp_clog[sctp_cwnd_log_at].x.close.loc = loc;
 195 }
 196
 197
 198 void
 199 rto_logging(struct sctp_nets *net, int from)
 200 {
 201         int sctp_cwnd_log_at;
 202
 203         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 204         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 205         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 206         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_RTT;
 207         sctp_clog[sctp_cwnd_log_at].x.rto.net = (void *)net;
 208         sctp_clog[sctp_cwnd_log_at].x.rto.rtt = net->prev_rtt;
 209         sctp_clog[sctp_cwnd_log_at].x.rto.rttvar = net->rtt_variance;
 210         sctp_clog[sctp_cwnd_log_at].x.rto.direction = net->rto_variance_dir;
 211 }
 212
 213 void
 214 sctp_log_strm_del_alt(uint32_t tsn, uint16_t sseq, int from)
 215 {
 216         int sctp_cwnd_log_at;
 217
 218         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 219         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 220         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 221         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_STRM;
 222         sctp_clog[sctp_cwnd_log_at].x.strlog.n_tsn = tsn;
 223         sctp_clog[sctp_cwnd_log_at].x.strlog.n_sseq = sseq;
 224         sctp_clog[sctp_cwnd_log_at].x.strlog.e_tsn = 0;
 225         sctp_clog[sctp_cwnd_log_at].x.strlog.e_sseq = 0;
 226 }
 227
 228 void
 229 sctp_log_nagle_event(struct sctp_tcb *stcb, int action)
 230 {
 231         int sctp_cwnd_log_at;
 232
 233         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 234         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 235         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) action;
 236         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_NAGLE;
 237         sctp_clog[sctp_cwnd_log_at].x.nagle.stcb = (void *)stcb;
 238         sctp_clog[sctp_cwnd_log_at].x.nagle.total_flight = stcb->asoc.total_flight;
 239         sctp_clog[sctp_cwnd_log_at].x.nagle.total_in_queue = stcb->asoc.total_output_queue_size;
 240         sctp_clog[sctp_cwnd_log_at].x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue;
 241         sctp_clog[sctp_cwnd_log_at].x.nagle.count_in_flight = stcb->asoc.total_flight_count;
 242 }
 243
 244
 245 void
 246 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from)
 247 {
 248         int sctp_cwnd_log_at;
 249
 250         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 251         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 252         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 253         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_SACK;
 254         sctp_clog[sctp_cwnd_log_at].x.sack.cumack = cumack;
 255         sctp_clog[sctp_cwnd_log_at].x.sack.oldcumack = old_cumack;
 256         sctp_clog[sctp_cwnd_log_at].x.sack.tsn = tsn;
 257         sctp_clog[sctp_cwnd_log_at].x.sack.numGaps = gaps;
 258         sctp_clog[sctp_cwnd_log_at].x.sack.numDups = dups;
 259 }
 260
 261 void
 262 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from)
 263 {
 264         int sctp_cwnd_log_at;
 265
 266         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 267         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 268         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 269         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_MAP;
 270         sctp_clog[sctp_cwnd_log_at].x.map.base = map;
 271         sctp_clog[sctp_cwnd_log_at].x.map.cum = cum;
 272         sctp_clog[sctp_cwnd_log_at].x.map.high = high;
 273 }
 274
 275 void
 276 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn,
 277     int from)
 278 {
 279         int sctp_cwnd_log_at;
 280
 281         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 282         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 283         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 284         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_FR;
 285         sctp_clog[sctp_cwnd_log_at].x.fr.largest_tsn = biggest_tsn;
 286         sctp_clog[sctp_cwnd_log_at].x.fr.largest_new_tsn = biggest_new_tsn;
 287         sctp_clog[sctp_cwnd_log_at].x.fr.tsn = tsn;
 288 }
 289
 290
 291 void
 292 sctp_log_mb(struct mbuf *m, int from)
 293 {
 294         int sctp_cwnd_log_at;
 295
 296         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 297         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 298         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 299         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_MBUF;
 300         sctp_clog[sctp_cwnd_log_at].x.mb.mp = m;
 301         sctp_clog[sctp_cwnd_log_at].x.mb.mbuf_flags = (uint8_t) (m->m_flags);
 302         sctp_clog[sctp_cwnd_log_at].x.mb.size = (uint16_t) (m->m_len);
 303         sctp_clog[sctp_cwnd_log_at].x.mb.data = m->m_data;
 304         if (m->m_flags & M_EXT) {
 305                 sctp_clog[sctp_cwnd_log_at].x.mb.ext = m->m_ext.ext_buf;
 306                 sctp_clog[sctp_cwnd_log_at].x.mb.refcnt = (uint8_t) (*m->m_ext.ref_cnt);
 307         } else {
 308                 sctp_clog[sctp_cwnd_log_at].x.mb.ext = 0;
 309                 sctp_clog[sctp_cwnd_log_at].x.mb.refcnt = 0;
 310         }
 311 }
 312
 313
 314 void
 315 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk,
 316     int from)
 317 {
 318         int sctp_cwnd_log_at;
 319
 320         if (control == NULL) {
 321                 printf("Gak log of NULL?\n");
 322                 return;
 323         }
 324         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 325         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 326         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 327         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_STRM;
 328         sctp_clog[sctp_cwnd_log_at].x.strlog.n_tsn = control->sinfo_tsn;
 329         sctp_clog[sctp_cwnd_log_at].x.strlog.n_sseq = control->sinfo_ssn;
 330         if (poschk != NULL) {
 331                 sctp_clog[sctp_cwnd_log_at].x.strlog.e_tsn = poschk->sinfo_tsn;
 332                 sctp_clog[sctp_cwnd_log_at].x.strlog.e_sseq = poschk->sinfo_ssn;
 333         } else {
 334                 sctp_clog[sctp_cwnd_log_at].x.strlog.e_tsn = 0;
 335                 sctp_clog[sctp_cwnd_log_at].x.strlog.e_sseq = 0;
 336         }
 337 }
 338
 339 void
 340 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from)
 341 {
 342         int sctp_cwnd_log_at;
 343
 344         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 345         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 346         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 347         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_CWND;
 348         sctp_clog[sctp_cwnd_log_at].x.cwnd.net = net;
 349         if (stcb->asoc.send_queue_cnt > 255)
 350                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_send = 255;
 351         else
 352                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 353         if (stcb->asoc.stream_queue_cnt > 255)
 354                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_str = 255;
 355         else
 356                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 357
 358         if (net) {
 359                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cwnd_new_value = net->cwnd;
 360                 sctp_clog[sctp_cwnd_log_at].x.cwnd.inflight = net->flight_size;
 361                 sctp_clog[sctp_cwnd_log_at].x.cwnd.pseudo_cumack = net->pseudo_cumack;
 362                 sctp_clog[sctp_cwnd_log_at].x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack;
 363                 sctp_clog[sctp_cwnd_log_at].x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack;
 364         }
 365         if (SCTP_CWNDLOG_PRESEND == from) {
 366                 sctp_clog[sctp_cwnd_log_at].x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd;
 367         }
 368         sctp_clog[sctp_cwnd_log_at].x.cwnd.cwnd_augment = augment;
 369 }
 370
 371 void
 372 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from)
 373 {
 374         int sctp_cwnd_log_at;
 375
 376         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 377         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 378         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 379         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_LOCK_EVENT;
 380         if (inp) {
 381                 sctp_clog[sctp_cwnd_log_at].x.lock.sock = (void *)inp->sctp_socket;
 382
 383         } else {
 384                 sctp_clog[sctp_cwnd_log_at].x.lock.sock = (void *)NULL;
 385         }
 386         sctp_clog[sctp_cwnd_log_at].x.lock.inp = (void *)inp;
 387         if (stcb) {
 388                 sctp_clog[sctp_cwnd_log_at].x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx);
 389         } else {
 390                 sctp_clog[sctp_cwnd_log_at].x.lock.tcb_lock = SCTP_LOCK_UNKNOWN;
 391         }
 392         if (inp) {
 393                 sctp_clog[sctp_cwnd_log_at].x.lock.inp_lock = mtx_owned(&inp->inp_mtx);
 394                 sctp_clog[sctp_cwnd_log_at].x.lock.create_lock = mtx_owned(&inp->inp_create_mtx);
 395         } else {
 396                 sctp_clog[sctp_cwnd_log_at].x.lock.inp_lock = SCTP_LOCK_UNKNOWN;
 397                 sctp_clog[sctp_cwnd_log_at].x.lock.create_lock = SCTP_LOCK_UNKNOWN;
 398         }
 399         sctp_clog[sctp_cwnd_log_at].x.lock.info_lock = mtx_owned(&sctppcbinfo.ipi_ep_mtx);
 400         if (inp->sctp_socket) {
 401                 sctp_clog[sctp_cwnd_log_at].x.lock.sock_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 402                 sctp_clog[sctp_cwnd_log_at].x.lock.sockrcvbuf_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 403                 sctp_clog[sctp_cwnd_log_at].x.lock.socksndbuf_lock = mtx_owned(&(inp->sctp_socket->so_snd.sb_mtx));
 404         } else {
 405                 sctp_clog[sctp_cwnd_log_at].x.lock.sock_lock = SCTP_LOCK_UNKNOWN;
 406                 sctp_clog[sctp_cwnd_log_at].x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN;
 407                 sctp_clog[sctp_cwnd_log_at].x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN;
 408         }
 409 }
 410
 411 void
 412 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from)
 413 {
 414         int sctp_cwnd_log_at;
 415
 416         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 417         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 418         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 419         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_MAXBURST;
 420         sctp_clog[sctp_cwnd_log_at].x.cwnd.net = net;
 421         sctp_clog[sctp_cwnd_log_at].x.cwnd.cwnd_new_value = error;
 422         sctp_clog[sctp_cwnd_log_at].x.cwnd.inflight = net->flight_size;
 423         sctp_clog[sctp_cwnd_log_at].x.cwnd.cwnd_augment = burst;
 424         if (stcb->asoc.send_queue_cnt > 255)
 425                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_send = 255;
 426         else
 427                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 428         if (stcb->asoc.stream_queue_cnt > 255)
 429                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_str = 255;
 430         else
 431                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 432 }
 433
 434 void
 435 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead)
 436 {
 437         int sctp_cwnd_log_at;
 438
 439         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 440         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 441         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 442         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_RWND;
 443         sctp_clog[sctp_cwnd_log_at].x.rwnd.rwnd = peers_rwnd;
 444         sctp_clog[sctp_cwnd_log_at].x.rwnd.send_size = snd_size;
 445         sctp_clog[sctp_cwnd_log_at].x.rwnd.overhead = overhead;
 446         sctp_clog[sctp_cwnd_log_at].x.rwnd.new_rwnd = 0;
 447 }
 448
 449 void
 450 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval)
 451 {
 452         int sctp_cwnd_log_at;
 453
 454         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 455         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 456         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 457         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_RWND;
 458         sctp_clog[sctp_cwnd_log_at].x.rwnd.rwnd = peers_rwnd;
 459         sctp_clog[sctp_cwnd_log_at].x.rwnd.send_size = flight_size;
 460         sctp_clog[sctp_cwnd_log_at].x.rwnd.overhead = overhead;
 461         sctp_clog[sctp_cwnd_log_at].x.rwnd.new_rwnd = a_rwndval;
 462 }
 463
 464 void
 465 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt)
 466 {
 467         int sctp_cwnd_log_at;
 468
 469         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 470         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 471         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 472         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_MBCNT;
 473         sctp_clog[sctp_cwnd_log_at].x.mbcnt.total_queue_size = total_oq;
 474         sctp_clog[sctp_cwnd_log_at].x.mbcnt.size_change = book;
 475         sctp_clog[sctp_cwnd_log_at].x.mbcnt.total_queue_mb_size = total_mbcnt_q;
 476         sctp_clog[sctp_cwnd_log_at].x.mbcnt.mbcnt_change = mbcnt;
 477 }
 478
 479 void
 480 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d)
 481 {
 482         int sctp_cwnd_log_at;
 483
 484         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 485         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 486         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 487         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_MISC_EVENT;
 488         sctp_clog[sctp_cwnd_log_at].x.misc.log1 = a;
 489         sctp_clog[sctp_cwnd_log_at].x.misc.log2 = b;
 490         sctp_clog[sctp_cwnd_log_at].x.misc.log3 = c;
 491         sctp_clog[sctp_cwnd_log_at].x.misc.log4 = d;
 492 }
 493
 494 void
 495 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t cumtsn, uint32_t wake_cnt, int from)
 496 {
 497         int sctp_cwnd_log_at;
 498
 499         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 500         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 501         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 502         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_WAKE;
 503         sctp_clog[sctp_cwnd_log_at].x.wake.stcb = (void *)stcb;
 504         sctp_clog[sctp_cwnd_log_at].x.wake.wake_cnt = wake_cnt;
 505         sctp_clog[sctp_cwnd_log_at].x.wake.flight = stcb->asoc.total_flight_count;
 506         sctp_clog[sctp_cwnd_log_at].x.wake.send_q = stcb->asoc.send_queue_cnt;
 507         sctp_clog[sctp_cwnd_log_at].x.wake.sent_q = stcb->asoc.sent_queue_cnt;
 508
 509         if (stcb->asoc.stream_queue_cnt < 0xff)
 510                 sctp_clog[sctp_cwnd_log_at].x.wake.stream_qcnt = (uint8_t) stcb->asoc.stream_queue_cnt;
 511         else
 512                 sctp_clog[sctp_cwnd_log_at].x.wake.stream_qcnt = 0xff;
 513
 514         if (stcb->asoc.chunks_on_out_queue < 0xff)
 515                 sctp_clog[sctp_cwnd_log_at].x.wake.chunks_on_oque = (uint8_t) stcb->asoc.chunks_on_out_queue;
 516         else
 517                 sctp_clog[sctp_cwnd_log_at].x.wake.chunks_on_oque = 0xff;
 518
 519         sctp_clog[sctp_cwnd_log_at].x.wake.sctpflags = 0;
 520         /* set in the defered mode stuff */
 521         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE)
 522                 sctp_clog[sctp_cwnd_log_at].x.wake.sctpflags |= 1;
 523         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT)
 524                 sctp_clog[sctp_cwnd_log_at].x.wake.sctpflags |= 2;
 525         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT)
 526                 sctp_clog[sctp_cwnd_log_at].x.wake.sctpflags |= 4;
 527         /* what about the sb */
 528         if (stcb->sctp_socket) {
 529                 struct socket *so = stcb->sctp_socket;
 530
 531                 sctp_clog[sctp_cwnd_log_at].x.wake.sbflags = (uint8_t) ((so->so_snd.sb_flags & 0x00ff));
 532         } else {
 533                 sctp_clog[sctp_cwnd_log_at].x.wake.sbflags = 0xff;
 534         }
 535 }
 536
 537 void
 538 sctp_log_block(uint8_t from, struct socket *so, struct sctp_association *asoc, int sendlen)
 539 {
 540         int sctp_cwnd_log_at;
 541
 542         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 543         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 544         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 545         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_BLOCK;
 546         sctp_clog[sctp_cwnd_log_at].x.blk.onsb = asoc->total_output_queue_size;
 547         sctp_clog[sctp_cwnd_log_at].x.blk.send_sent_qcnt = (uint16_t) (asoc->send_queue_cnt + asoc->sent_queue_cnt);
 548         sctp_clog[sctp_cwnd_log_at].x.blk.peer_rwnd = asoc->peers_rwnd;
 549         sctp_clog[sctp_cwnd_log_at].x.blk.stream_qcnt = (uint16_t) asoc->stream_queue_cnt;
 550         sctp_clog[sctp_cwnd_log_at].x.blk.chunks_on_oque = (uint16_t) asoc->chunks_on_out_queue;
 551         sctp_clog[sctp_cwnd_log_at].x.blk.flight_size = (uint16_t) (asoc->total_flight / 1024);
 552         sctp_clog[sctp_cwnd_log_at].x.blk.sndlen = sendlen;
 553 }
 554
 555 int
 556 sctp_fill_stat_log(struct mbuf *m)
 557 {
 558         int sctp_cwnd_log_at;
 559         struct sctp_cwnd_log_req *req;
 560         size_t size_limit;
 561         int num, i, at, cnt_out = 0;
 562
 563         if (m == NULL)
 564                 return (EINVAL);
 565
 566         size_limit = (m->m_len - sizeof(struct sctp_cwnd_log_req));
 567         if (size_limit < sizeof(struct sctp_cwnd_log)) {
 568                 return (EINVAL);
 569         }
 570         sctp_cwnd_log_at = global_sctp_cwnd_log_at;
 571         req = mtod(m, struct sctp_cwnd_log_req *);
 572         num = size_limit / sizeof(struct sctp_cwnd_log);
 573         if (global_sctp_cwnd_log_rolled) {
 574                 req->num_in_log = SCTP_STAT_LOG_SIZE;
 575         } else {
 576                 req->num_in_log = sctp_cwnd_log_at;
 577                 /*
 578                  * if the log has not rolled, we don't let you have old
 579                  * data.
 580                  */
 581                 if (req->end_at > sctp_cwnd_log_at) {
 582                         req->end_at = sctp_cwnd_log_at;
 583                 }
 584         }
 585         if ((num < SCTP_STAT_LOG_SIZE) &&
 586             ((global_sctp_cwnd_log_rolled) || (sctp_cwnd_log_at > num))) {
 587                 /* we can't return all of it */
 588                 if (((req->start_at == 0) && (req->end_at == 0)) ||
 589                     (req->start_at >= SCTP_STAT_LOG_SIZE) ||
 590                     (req->end_at >= SCTP_STAT_LOG_SIZE)) {
 591                         /* No user request or user is wacked. */
 592                         req->num_ret = num;
 593                         req->end_at = sctp_cwnd_log_at - 1;
 594                         if ((sctp_cwnd_log_at - num) < 0) {
 595                                 int cc;
 596
 597                                 cc = num - sctp_cwnd_log_at;
 598                                 req->start_at = SCTP_STAT_LOG_SIZE - cc;
 599                         } else {
 600                                 req->start_at = sctp_cwnd_log_at - num;
 601                         }
 602                 } else {
 603                         /* a user request */
 604                         int cc;
 605
 606                         if (req->start_at > req->end_at) {
 607                                 cc = (SCTP_STAT_LOG_SIZE - req->start_at) +
 608                                     (req->end_at + 1);
 609                         } else {
 610
 611                                 cc = (req->end_at - req->start_at) + 1;
 612                         }
 613                         if (cc < num) {
 614                                 num = cc;
 615                         }
 616                         req->num_ret = num;
 617                 }
 618         } else {
 619                 /* We can return all  of it */
 620                 req->start_at = 0;
 621                 req->end_at = sctp_cwnd_log_at - 1;
 622                 req->num_ret = sctp_cwnd_log_at;
 623         }
 624 #ifdef INVARIENTS
 625         if (req->num_ret > num) {
 626                 panic("Bad statlog get?");
 627         }
 628 #endif
 629         for (i = 0, at = req->start_at; i < req->num_ret; i++) {
 630                 req->log[i] = sctp_clog[at];
 631                 cnt_out++;
 632                 at++;
 633                 if (at >= SCTP_STAT_LOG_SIZE)
 634                         at = 0;
 635         }
 636         m->m_len = (cnt_out * sizeof(struct sctp_cwnd_log)) + sizeof(struct sctp_cwnd_log_req);
 637         return (0);
 638 }
 639
 640 #endif
 641
 642 #ifdef SCTP_AUDITING_ENABLED
 643 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2];
 644 static int sctp_audit_indx = 0;
 645
 646 static
 647 void
 648 sctp_print_audit_report(void)
 649 {
 650         int i;
 651         int cnt;
 652
 653         cnt = 0;
 654         for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) {
 655                 if ((sctp_audit_data[i][0] == 0xe0) &&
 656                     (sctp_audit_data[i][1] == 0x01)) {
 657                         cnt = 0;
 658                         printf("\n");
 659                 } else if (sctp_audit_data[i][0] == 0xf0) {
 660                         cnt = 0;
 661                         printf("\n");
 662                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 663                     (sctp_audit_data[i][1] == 0x01)) {
 664                         printf("\n");
 665                         cnt = 0;
 666                 }
 667                 printf("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0],
 668                     (uint32_t) sctp_audit_data[i][1]);
 669                 cnt++;
 670                 if ((cnt % 14) == 0)
 671                         printf("\n");
 672         }
 673         for (i = 0; i < sctp_audit_indx; i++) {
 674                 if ((sctp_audit_data[i][0] == 0xe0) &&
 675                     (sctp_audit_data[i][1] == 0x01)) {
 676                         cnt = 0;
 677                         printf("\n");
 678                 } else if (sctp_audit_data[i][0] == 0xf0) {
 679                         cnt = 0;
 680                         printf("\n");
 681                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 682                     (sctp_audit_data[i][1] == 0x01)) {
 683                         printf("\n");
 684                         cnt = 0;
 685                 }
 686                 printf("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0],
 687                     (uint32_t) sctp_audit_data[i][1]);
 688                 cnt++;
 689                 if ((cnt % 14) == 0)
 690                         printf("\n");
 691         }
 692         printf("\n");
 693 }
 694
 695 void
 696 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 697     struct sctp_nets *net)
 698 {
 699         int resend_cnt, tot_out, rep, tot_book_cnt;
 700         struct sctp_nets *lnet;
 701         struct sctp_tmit_chunk *chk;
 702
 703         sctp_audit_data[sctp_audit_indx][0] = 0xAA;
 704         sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from;
 705         sctp_audit_indx++;
 706         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 707                 sctp_audit_indx = 0;
 708         }
 709         if (inp == NULL) {
 710                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 711                 sctp_audit_data[sctp_audit_indx][1] = 0x01;
 712                 sctp_audit_indx++;
 713                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 714                         sctp_audit_indx = 0;
 715                 }
 716                 return;
 717         }
 718         if (stcb == NULL) {
 719                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 720                 sctp_audit_data[sctp_audit_indx][1] = 0x02;
 721                 sctp_audit_indx++;
 722                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 723                         sctp_audit_indx = 0;
 724                 }
 725                 return;
 726         }
 727         sctp_audit_data[sctp_audit_indx][0] = 0xA1;
 728         sctp_audit_data[sctp_audit_indx][1] =
 729             (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 730         sctp_audit_indx++;
 731         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 732                 sctp_audit_indx = 0;
 733         }
 734         rep = 0;
 735         tot_book_cnt = 0;
 736         resend_cnt = tot_out = 0;
 737         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 738                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 739                         resend_cnt++;
 740                 } else if (chk->sent < SCTP_DATAGRAM_RESEND) {
 741                         tot_out += chk->book_size;
 742                         tot_book_cnt++;
 743                 }
 744         }
 745         if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) {
 746                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 747                 sctp_audit_data[sctp_audit_indx][1] = 0xA1;
 748                 sctp_audit_indx++;
 749                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 750                         sctp_audit_indx = 0;
 751                 }
 752                 printf("resend_cnt:%d asoc-tot:%d\n",
 753                     resend_cnt, stcb->asoc.sent_queue_retran_cnt);
 754                 rep = 1;
 755                 stcb->asoc.sent_queue_retran_cnt = resend_cnt;
 756                 sctp_audit_data[sctp_audit_indx][0] = 0xA2;
 757                 sctp_audit_data[sctp_audit_indx][1] =
 758                     (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 759                 sctp_audit_indx++;
 760                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 761                         sctp_audit_indx = 0;
 762                 }
 763         }
 764         if (tot_out != stcb->asoc.total_flight) {
 765                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 766                 sctp_audit_data[sctp_audit_indx][1] = 0xA2;
 767                 sctp_audit_indx++;
 768                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 769                         sctp_audit_indx = 0;
 770                 }
 771                 rep = 1;
 772                 printf("tot_flt:%d asoc_tot:%d\n", tot_out,
 773                     (int)stcb->asoc.total_flight);
 774                 stcb->asoc.total_flight = tot_out;
 775         }
 776         if (tot_book_cnt != stcb->asoc.total_flight_count) {
 777                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 778                 sctp_audit_data[sctp_audit_indx][1] = 0xA5;
 779                 sctp_audit_indx++;
 780                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 781                         sctp_audit_indx = 0;
 782                 }
 783                 rep = 1;
 784                 printf("tot_flt_book:%d\n", tot_book);
 785
 786                 stcb->asoc.total_flight_count = tot_book_cnt;
 787         }
 788         tot_out = 0;
 789         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 790                 tot_out += lnet->flight_size;
 791         }
 792         if (tot_out != stcb->asoc.total_flight) {
 793                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 794                 sctp_audit_data[sctp_audit_indx][1] = 0xA3;
 795                 sctp_audit_indx++;
 796                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 797                         sctp_audit_indx = 0;
 798                 }
 799                 rep = 1;
 800                 printf("real flight:%d net total was %d\n",
 801                     stcb->asoc.total_flight, tot_out);
 802                 /* now corrective action */
 803                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 804
 805                         tot_out = 0;
 806                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 807                                 if ((chk->whoTo == lnet) &&
 808                                     (chk->sent < SCTP_DATAGRAM_RESEND)) {
 809                                         tot_out += chk->book_size;
 810                                 }
 811                         }
 812                         if (lnet->flight_size != tot_out) {
 813                                 printf("net:%x flight was %d corrected to %d\n",
 814                                     (uint32_t) lnet, lnet->flight_size, tot_out);
 815                                 lnet->flight_size = tot_out;
 816                         }
 817                 }
 818         }
 819         if (rep) {
 820                 sctp_print_audit_report();
 821         }
 822 }
 823
 824 void
 825 sctp_audit_log(uint8_t ev, uint8_t fd)
 826 {
 827         int s;
 828
 829         s = splnet();
 830         sctp_audit_data[sctp_audit_indx][0] = ev;
 831         sctp_audit_data[sctp_audit_indx][1] = fd;
 832         sctp_audit_indx++;
 833         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 834                 sctp_audit_indx = 0;
 835         }
 836         splx(s);
 837 }
 838
 839 #endif
 840
 841 /*
 842  * a list of sizes based on typical mtu's, used only if next hop size not
 843  * returned.
 844  */
 845 static int sctp_mtu_sizes[] = {
 846         68,
 847         296,
 848         508,
 849         512,
 850         544,
 851         576,
 852         1006,
 853         1492,
 854         1500,
 855         1536,
 856         2002,
 857         2048,
 858         4352,
 859         4464,
 860         8166,
 861         17914,
 862         32000,
 863         65535
 864 };
 865
 866 void
 867 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb)
 868 {
 869         struct sctp_association *asoc;
 870         struct sctp_nets *net;
 871
 872         asoc = &stcb->asoc;
 873
 874         callout_stop(&asoc->hb_timer.timer);
 875         callout_stop(&asoc->dack_timer.timer);
 876         callout_stop(&asoc->strreset_timer.timer);
 877         callout_stop(&asoc->asconf_timer.timer);
 878         callout_stop(&asoc->autoclose_timer.timer);
 879         callout_stop(&asoc->delayed_event_timer.timer);
 880         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
 881                 callout_stop(&net->fr_timer.timer);
 882                 callout_stop(&net->pmtu_timer.timer);
 883         }
 884 }
 885
 886 int
 887 find_next_best_mtu(int totsz)
 888 {
 889         int i, perfer;
 890
 891         /*
 892          * if we are in here we must find the next best fit based on the
 893          * size of the dg that failed to be sent.
 894          */
 895         perfer = 0;
 896         for (i = 0; i < NUMBER_OF_MTU_SIZES; i++) {
 897                 if (totsz < sctp_mtu_sizes[i]) {
 898                         perfer = i - 1;
 899                         if (perfer < 0)
 900                                 perfer = 0;
 901                         break;
 902                 }
 903         }
 904         return (sctp_mtu_sizes[perfer]);
 905 }
 906
 907 void
 908 sctp_fill_random_store(struct sctp_pcb *m)
 909 {
 910         /*
 911          * Here we use the MD5/SHA-1 to hash with our good randomNumbers and
 912          * our counter. The result becomes our good random numbers and we
 913          * then setup to give these out. Note that we do no locking to
 914          * protect this. This is ok, since if competing folks call this we
 915          * will get more gobbled gook in the random store whic is what we
 916          * want. There is a danger that two guys will use the same random
 917          * numbers, but thats ok too since that is random as well :->
 918          */
 919         m->store_at = 0;
 920         sctp_hmac(SCTP_HMAC, (uint8_t *) m->random_numbers,
 921             sizeof(m->random_numbers), (uint8_t *) & m->random_counter,
 922             sizeof(m->random_counter), (uint8_t *) m->random_store);
 923         m->random_counter++;
 924 }
 925
 926 uint32_t
 927 sctp_select_initial_TSN(struct sctp_pcb *m)
 928 {
 929         /*
 930          * A true implementation should use random selection process to get
 931          * the initial stream sequence number, using RFC1750 as a good
 932          * guideline
 933          */
 934         u_long x, *xp;
 935         uint8_t *p;
 936
 937         if (m->initial_sequence_debug != 0) {
 938                 uint32_t ret;
 939
 940                 ret = m->initial_sequence_debug;
 941                 m->initial_sequence_debug++;
 942                 return (ret);
 943         }
 944         if ((m->store_at + sizeof(u_long)) > SCTP_SIGNATURE_SIZE) {
 945                 /* Refill the random store */
 946                 sctp_fill_random_store(m);
 947         }
 948         p = &m->random_store[(int)m->store_at];
 949         xp = (u_long *)p;
 950         x = *xp;
 951         m->store_at += sizeof(u_long);
 952         return (x);
 953 }
 954
 955 uint32_t
 956 sctp_select_a_tag(struct sctp_inpcb *m)
 957 {
 958         u_long x, not_done;
 959         struct timeval now;
 960
 961         SCTP_GETTIME_TIMEVAL(&now);
 962         not_done = 1;
 963         while (not_done) {
 964                 x = sctp_select_initial_TSN(&m->sctp_ep);
 965                 if (x == 0) {
 966                         /* we never use 0 */
 967                         continue;
 968                 }
 969                 if (sctp_is_vtag_good(m, x, &now)) {
 970                         not_done = 0;
 971                 }
 972         }
 973         return (x);
 974 }
 975
 976
 977 int
 978 sctp_init_asoc(struct sctp_inpcb *m, struct sctp_association *asoc,
 979     int for_a_init, uint32_t override_tag)
 980 {
 981         /*
 982          * Anything set to zero is taken care of by the allocation routine's
 983          * bzero
 984          */
 985
 986         /*
 987          * Up front select what scoping to apply on addresses I tell my peer
 988          * Not sure what to do with these right now, we will need to come up
 989          * with a way to set them. We may need to pass them through from the
 990          * caller in the sctp_aloc_assoc() function.
 991          */
 992         int i;
 993
 994         /* init all variables to a known value. */
 995         asoc->state = SCTP_STATE_INUSE;
 996         asoc->max_burst = m->sctp_ep.max_burst;
 997         asoc->heart_beat_delay = TICKS_TO_MSEC(m->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]);
 998         asoc->cookie_life = m->sctp_ep.def_cookie_life;
 999         asoc->sctp_cmt_on_off = (uint8_t) sctp_cmt_on_off;
1000 #ifdef AF_INET
1001         asoc->default_tos = m->ip_inp.inp.inp_ip_tos;
1002 #else
1003         asoc->default_tos = 0;
1004 #endif
1005
1006 #ifdef AF_INET6
1007         asoc->default_flowlabel = ((struct in6pcb *)m)->in6p_flowinfo;
1008 #else
1009         asoc->default_flowlabel = 0;
1010 #endif
1011         if (override_tag) {
1012                 struct timeval now;
1013
1014                 if (sctp_is_vtag_good(m, override_tag, &now)) {
1015                         asoc->my_vtag = override_tag;
1016                 } else {
1017                         return (ENOMEM);
1018                 }
1019
1020         } else {
1021                 asoc->my_vtag = sctp_select_a_tag(m);
1022         }
1023         if (sctp_is_feature_on(m, SCTP_PCB_FLAGS_DONOT_HEARTBEAT))
1024                 asoc->hb_is_disabled = 1;
1025         else
1026                 asoc->hb_is_disabled = 0;
1027
1028         asoc->refcnt = 0;
1029         asoc->assoc_up_sent = 0;
1030         asoc->assoc_id = asoc->my_vtag;
1031         asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number = asoc->sending_seq =
1032             sctp_select_initial_TSN(&m->sctp_ep);
1033         /* we are optimisitic here */
1034         asoc->peer_supports_pktdrop = 1;
1035
1036         asoc->sent_queue_retran_cnt = 0;
1037
1038         /* for CMT */
1039         asoc->last_net_data_came_from = NULL;
1040
1041         /* This will need to be adjusted */
1042         asoc->last_cwr_tsn = asoc->init_seq_number - 1;
1043         asoc->last_acked_seq = asoc->init_seq_number - 1;
1044         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1045         asoc->asconf_seq_in = asoc->last_acked_seq;
1046
1047         /* here we are different, we hold the next one we expect */
1048         asoc->str_reset_seq_in = asoc->last_acked_seq + 1;
1049
1050         asoc->initial_init_rto_max = m->sctp_ep.initial_init_rto_max;
1051         asoc->initial_rto = m->sctp_ep.initial_rto;
1052
1053         asoc->max_init_times = m->sctp_ep.max_init_times;
1054         asoc->max_send_times = m->sctp_ep.max_send_times;
1055         asoc->def_net_failure = m->sctp_ep.def_net_failure;
1056         asoc->free_chunk_cnt = 0;
1057
1058         asoc->iam_blocking = 0;
1059         /* ECN Nonce initialization */
1060         asoc->context = m->sctp_context;
1061         asoc->def_send = m->def_send;
1062         asoc->ecn_nonce_allowed = 0;
1063         asoc->receiver_nonce_sum = 1;
1064         asoc->nonce_sum_expect_base = 1;
1065         asoc->nonce_sum_check = 1;
1066         asoc->nonce_resync_tsn = 0;
1067         asoc->nonce_wait_for_ecne = 0;
1068         asoc->nonce_wait_tsn = 0;
1069         asoc->delayed_ack = TICKS_TO_MSEC(m->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]);
1070         asoc->pr_sctp_cnt = 0;
1071         asoc->total_output_queue_size = 0;
1072
1073         if (m->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1074                 struct in6pcb *inp6;
1075
1076
1077                 /* Its a V6 socket */
1078                 inp6 = (struct in6pcb *)m;
1079                 asoc->ipv6_addr_legal = 1;
1080                 /* Now look at the binding flag to see if V4 will be legal */
1081                 if (
1082                     (inp6->inp_flags & IN6P_IPV6_V6ONLY)
1083                     == 0) {
1084                         asoc->ipv4_addr_legal = 1;
1085                 } else {
1086                         /* V4 addresses are NOT legal on the association */
1087                         asoc->ipv4_addr_legal = 0;
1088                 }
1089         } else {
1090                 /* Its a V4 socket, no - V6 */
1091                 asoc->ipv4_addr_legal = 1;
1092                 asoc->ipv6_addr_legal = 0;
1093         }
1094
1095
1096         asoc->my_rwnd = max(m->sctp_socket->so_rcv.sb_hiwat, SCTP_MINIMAL_RWND);
1097         asoc->peers_rwnd = m->sctp_socket->so_rcv.sb_hiwat;
1098
1099         asoc->smallest_mtu = m->sctp_frag_point;
1100         asoc->minrto = m->sctp_ep.sctp_minrto;
1101         asoc->maxrto = m->sctp_ep.sctp_maxrto;
1102
1103         asoc->locked_on_sending = NULL;
1104         asoc->stream_locked_on = 0;
1105         asoc->ecn_echo_cnt_onq = 0;
1106         asoc->stream_locked = 0;
1107
1108         LIST_INIT(&asoc->sctp_local_addr_list);
1109         TAILQ_INIT(&asoc->nets);
1110         TAILQ_INIT(&asoc->pending_reply_queue);
1111         asoc->last_asconf_ack_sent = NULL;
1112         /* Setup to fill the hb random cache at first HB */
1113         asoc->hb_random_idx = 4;
1114
1115         asoc->sctp_autoclose_ticks = m->sctp_ep.auto_close_time;
1116
1117         /*
1118          * Now the stream parameters, here we allocate space for all streams
1119          * that we request by default.
1120          */
1121         asoc->streamoutcnt = asoc->pre_open_streams =
1122             m->sctp_ep.pre_open_stream_count;
1123         SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *,
1124             asoc->streamoutcnt * sizeof(struct sctp_stream_out),
1125             "StreamsOut");
1126         if (asoc->strmout == NULL) {
1127                 /* big trouble no memory */
1128                 return (ENOMEM);
1129         }
1130         for (i = 0; i < asoc->streamoutcnt; i++) {
1131                 /*
1132                  * inbound side must be set to 0xffff, also NOTE when we get
1133                  * the INIT-ACK back (for INIT sender) we MUST reduce the
1134                  * count (streamoutcnt) but first check if we sent to any of
1135                  * the upper streams that were dropped (if some were). Those
1136                  * that were dropped must be notified to the upper layer as
1137                  * failed to send.
1138                  */
1139                 asoc->strmout[i].next_sequence_sent = 0x0;
1140                 TAILQ_INIT(&asoc->strmout[i].outqueue);
1141                 asoc->strmout[i].stream_no = i;
1142                 asoc->strmout[i].last_msg_incomplete = 0;
1143                 asoc->strmout[i].next_spoke.tqe_next = 0;
1144                 asoc->strmout[i].next_spoke.tqe_prev = 0;
1145         }
1146         /* Now the mapping array */
1147         asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY;
1148         SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size,
1149             "MappingArray");
1150         if (asoc->mapping_array == NULL) {
1151                 SCTP_FREE(asoc->strmout);
1152                 return (ENOMEM);
1153         }
1154         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
1155         /* Now the init of the other outqueues */
1156         TAILQ_INIT(&asoc->free_chunks);
1157         TAILQ_INIT(&asoc->free_strmoq);
1158         TAILQ_INIT(&asoc->out_wheel);
1159         TAILQ_INIT(&asoc->control_send_queue);
1160         TAILQ_INIT(&asoc->send_queue);
1161         TAILQ_INIT(&asoc->sent_queue);
1162         TAILQ_INIT(&asoc->reasmqueue);
1163         TAILQ_INIT(&asoc->resetHead);
1164         asoc->max_inbound_streams = m->sctp_ep.max_open_streams_intome;
1165         TAILQ_INIT(&asoc->asconf_queue);
1166         /* authentication fields */
1167         asoc->authinfo.random = NULL;
1168         asoc->authinfo.assoc_key = NULL;
1169         asoc->authinfo.assoc_keyid = 0;
1170         asoc->authinfo.recv_key = NULL;
1171         asoc->authinfo.recv_keyid = 0;
1172         LIST_INIT(&asoc->shared_keys);
1173
1174         return (0);
1175 }
1176
1177 int
1178 sctp_expand_mapping_array(struct sctp_association *asoc)
1179 {
1180         /* mapping array needs to grow */
1181         uint8_t *new_array;
1182         uint16_t new_size;
1183
1184         new_size = asoc->mapping_array_size + SCTP_MAPPING_ARRAY_INCR;
1185         SCTP_MALLOC(new_array, uint8_t *, new_size, "MappingArray");
1186         if (new_array == NULL) {
1187                 /* can't get more, forget it */
1188                 printf("No memory for expansion of SCTP mapping array %d\n",
1189                     new_size);
1190                 return (-1);
1191         }
1192         memset(new_array, 0, new_size);
1193         memcpy(new_array, asoc->mapping_array, asoc->mapping_array_size);
1194         SCTP_FREE(asoc->mapping_array);
1195         asoc->mapping_array = new_array;
1196         asoc->mapping_array_size = new_size;
1197         return (0);
1198 }
1199
1200 extern unsigned int sctp_early_fr_msec;
1201
1202 static void
1203 sctp_handle_addr_wq(void)
1204 {
1205         /* deal with the ADDR wq from the rtsock calls */
1206         struct sctp_laddr *wi;
1207
1208         SCTP_IPI_ADDR_LOCK();
1209         wi = LIST_FIRST(&sctppcbinfo.addr_wq);
1210         if (wi == NULL) {
1211                 SCTP_IPI_ADDR_UNLOCK();
1212                 return;
1213         }
1214         LIST_REMOVE(wi, sctp_nxt_addr);
1215         if (!LIST_EMPTY(&sctppcbinfo.addr_wq)) {
1216                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
1217                     (struct sctp_inpcb *)NULL,
1218                     (struct sctp_tcb *)NULL,
1219                     (struct sctp_nets *)NULL);
1220         }
1221         SCTP_IPI_ADDR_UNLOCK();
1222         if (wi->action == RTM_ADD) {
1223                 sctp_add_ip_address(wi->ifa);
1224         } else if (wi->action == RTM_DELETE) {
1225                 sctp_delete_ip_address(wi->ifa);
1226         }
1227         IFAFREE(wi->ifa);
1228         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, wi);
1229         SCTP_DECR_LADDR_COUNT();
1230 }
1231
1232 void
1233 sctp_timeout_handler(void *t)
1234 {
1235         struct sctp_inpcb *inp;
1236         struct sctp_tcb *stcb;
1237         struct sctp_nets *net;
1238         struct sctp_timer *tmr;
1239         int s, did_output;
1240         struct sctp_iterator *it = NULL;
1241
1242
1243         s = splnet();
1244         tmr = (struct sctp_timer *)t;
1245         inp = (struct sctp_inpcb *)tmr->ep;
1246         stcb = (struct sctp_tcb *)tmr->tcb;
1247         net = (struct sctp_nets *)tmr->net;
1248         did_output = 1;
1249
1250 #ifdef SCTP_AUDITING_ENABLED
1251         sctp_audit_log(0xF0, (uint8_t) tmr->type);
1252         sctp_auditing(3, inp, stcb, net);
1253 #endif
1254
1255         /* sanity checks... */
1256         if (tmr->self != (void *)tmr) {
1257                 /*
1258                  * printf("Stale SCTP timer fired (%p), ignoring...\n",
1259                  * tmr);
1260                  */
1261                 splx(s);
1262                 return;
1263         }
1264         if (!SCTP_IS_TIMER_TYPE_VALID(tmr->type)) {
1265                 /*
1266                  * printf("SCTP timer fired with invalid type: 0x%x\n",
1267                  * tmr->type);
1268                  */
1269                 splx(s);
1270                 return;
1271         }
1272         if ((tmr->type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL)) {
1273                 splx(s);
1274                 return;
1275         }
1276         /* if this is an iterator timeout, get the struct and clear inp */
1277         if (tmr->type == SCTP_TIMER_TYPE_ITERATOR) {
1278                 it = (struct sctp_iterator *)inp;
1279                 inp = NULL;
1280         }
1281         if (inp) {
1282                 SCTP_INP_INCR_REF(inp);
1283                 if ((inp->sctp_socket == 0) &&
1284                     ((tmr->type != SCTP_TIMER_TYPE_INPKILL) &&
1285                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWN) &&
1286                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNACK) &&
1287                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNGUARD) &&
1288                     (tmr->type != SCTP_TIMER_TYPE_ASOCKILL))
1289                     ) {
1290                         splx(s);
1291                         SCTP_INP_DECR_REF(inp);
1292                         return;
1293                 }
1294         }
1295         if (stcb) {
1296                 if (stcb->asoc.state == 0) {
1297                         splx(s);
1298                         if (inp) {
1299                                 SCTP_INP_DECR_REF(inp);
1300                         }
1301                         return;
1302                 }
1303         }
1304 #ifdef SCTP_DEBUG
1305         if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1306                 printf("Timer type %d goes off\n", tmr->type);
1307         }
1308 #endif                          /* SCTP_DEBUG */
1309         if (!callout_active(&tmr->timer)) {
1310                 splx(s);
1311                 if (inp) {
1312                         SCTP_INP_DECR_REF(inp);
1313                 }
1314                 return;
1315         }
1316         if (stcb) {
1317                 atomic_add_int(&stcb->asoc.refcnt, 1);
1318                 SCTP_TCB_LOCK(stcb);
1319                 atomic_add_int(&stcb->asoc.refcnt, -1);
1320         }
1321         /* mark as being serviced now */
1322         callout_deactivate(&tmr->timer);
1323
1324         /* call the handler for the appropriate timer type */
1325         switch (tmr->type) {
1326         case SCTP_TIMER_TYPE_ADDR_WQ:
1327                 sctp_handle_addr_wq();
1328                 break;
1329         case SCTP_TIMER_TYPE_ITERATOR:
1330                 SCTP_STAT_INCR(sctps_timoiterator);
1331                 sctp_iterator_timer(it);
1332                 break;
1333         case SCTP_TIMER_TYPE_SEND:
1334                 SCTP_STAT_INCR(sctps_timodata);
1335                 stcb->asoc.num_send_timers_up--;
1336                 if (stcb->asoc.num_send_timers_up < 0) {
1337                         stcb->asoc.num_send_timers_up = 0;
1338                 }
1339                 if (sctp_t3rxt_timer(inp, stcb, net)) {
1340                         /* no need to unlock on tcb its gone */
1341
1342                         goto out_decr;
1343                 }
1344 #ifdef SCTP_AUDITING_ENABLED
1345                 sctp_auditing(4, inp, stcb, net);
1346 #endif
1347                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3);
1348                 if ((stcb->asoc.num_send_timers_up == 0) &&
1349                     (stcb->asoc.sent_queue_cnt > 0)
1350                     ) {
1351                         struct sctp_tmit_chunk *chk;
1352
1353                         /*
1354                          * safeguard. If there on some on the sent queue
1355                          * somewhere but no timers running something is
1356                          * wrong... so we start a timer on the first chunk
1357                          * on the send queue on whatever net it is sent to.
1358                          */
1359                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1360                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb,
1361                             chk->whoTo);
1362                 }
1363                 break;
1364         case SCTP_TIMER_TYPE_INIT:
1365                 SCTP_STAT_INCR(sctps_timoinit);
1366                 if (sctp_t1init_timer(inp, stcb, net)) {
1367                         /* no need to unlock on tcb its gone */
1368                         goto out_decr;
1369                 }
1370                 /* We do output but not here */
1371                 did_output = 0;
1372                 break;
1373         case SCTP_TIMER_TYPE_RECV:
1374                 SCTP_STAT_INCR(sctps_timosack);
1375                 sctp_send_sack(stcb);
1376 #ifdef SCTP_AUDITING_ENABLED
1377                 sctp_auditing(4, inp, stcb, net);
1378 #endif
1379                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR);
1380                 break;
1381         case SCTP_TIMER_TYPE_SHUTDOWN:
1382                 if (sctp_shutdown_timer(inp, stcb, net)) {
1383                         /* no need to unlock on tcb its gone */
1384                         goto out_decr;
1385                 }
1386                 SCTP_STAT_INCR(sctps_timoshutdown);
1387 #ifdef SCTP_AUDITING_ENABLED
1388                 sctp_auditing(4, inp, stcb, net);
1389 #endif
1390                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR);
1391                 break;
1392         case SCTP_TIMER_TYPE_HEARTBEAT:
1393                 {
1394                         struct sctp_nets *net;
1395                         int cnt_of_unconf = 0;
1396
1397                         SCTP_STAT_INCR(sctps_timoheartbeat);
1398                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1399                                 if ((net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
1400                                     (net->dest_state & SCTP_ADDR_REACHABLE)) {
1401                                         cnt_of_unconf++;
1402                                 }
1403                         }
1404                         if (cnt_of_unconf == 0) {
1405                                 if (sctp_heartbeat_timer(inp, stcb, net, cnt_of_unconf)) {
1406                                         /* no need to unlock on tcb its gone */
1407                                         goto out_decr;
1408                                 }
1409                         }
1410 #ifdef SCTP_AUDITING_ENABLED
1411                         sctp_auditing(4, inp, stcb, net);
1412 #endif
1413                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
1414                             stcb, net);
1415                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR);
1416                 }
1417                 break;
1418         case SCTP_TIMER_TYPE_COOKIE:
1419                 if (sctp_cookie_timer(inp, stcb, net)) {
1420                         /* no need to unlock on tcb its gone */
1421                         goto out_decr;
1422                 }
1423                 SCTP_STAT_INCR(sctps_timocookie);
1424 #ifdef SCTP_AUDITING_ENABLED
1425                 sctp_auditing(4, inp, stcb, net);
1426 #endif
1427                 /*
1428                  * We consider T3 and Cookie timer pretty much the same with
1429                  * respect to where from in chunk_output.
1430                  */
1431                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3);
1432                 break;
1433         case SCTP_TIMER_TYPE_NEWCOOKIE:
1434                 {
1435                         struct timeval tv;
1436                         int i, secret;
1437
1438                         SCTP_STAT_INCR(sctps_timosecret);
1439                         SCTP_GETTIME_TIMEVAL(&tv);
1440                         SCTP_INP_WLOCK(inp);
1441                         inp->sctp_ep.time_of_secret_change = tv.tv_sec;
1442                         inp->sctp_ep.last_secret_number =
1443                             inp->sctp_ep.current_secret_number;
1444                         inp->sctp_ep.current_secret_number++;
1445                         if (inp->sctp_ep.current_secret_number >=
1446                             SCTP_HOW_MANY_SECRETS) {
1447                                 inp->sctp_ep.current_secret_number = 0;
1448                         }
1449                         secret = (int)inp->sctp_ep.current_secret_number;
1450                         for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1451                                 inp->sctp_ep.secret_key[secret][i] =
1452                                     sctp_select_initial_TSN(&inp->sctp_ep);
1453                         }
1454                         SCTP_INP_WUNLOCK(inp);
1455                         sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, stcb, net);
1456                 }
1457                 did_output = 0;
1458                 break;
1459         case SCTP_TIMER_TYPE_PATHMTURAISE:
1460                 SCTP_STAT_INCR(sctps_timopathmtu);
1461                 sctp_pathmtu_timer(inp, stcb, net);
1462                 did_output = 0;
1463                 break;
1464         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1465                 if (sctp_shutdownack_timer(inp, stcb, net)) {
1466                         /* no need to unlock on tcb its gone */
1467                         goto out_decr;
1468                 }
1469                 SCTP_STAT_INCR(sctps_timoshutdownack);
1470 #ifdef SCTP_AUDITING_ENABLED
1471                 sctp_auditing(4, inp, stcb, net);
1472 #endif
1473                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR);
1474                 break;
1475         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1476                 SCTP_STAT_INCR(sctps_timoshutdownguard);
1477                 sctp_abort_an_association(inp, stcb,
1478                     SCTP_SHUTDOWN_GUARD_EXPIRES, NULL);
1479                 /* no need to unlock on tcb its gone */
1480                 goto out_decr;
1481                 break;
1482
1483         case SCTP_TIMER_TYPE_STRRESET:
1484                 if (sctp_strreset_timer(inp, stcb, net)) {
1485                         /* no need to unlock on tcb its gone */
1486                         goto out_decr;
1487                 }
1488                 SCTP_STAT_INCR(sctps_timostrmrst);
1489                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR);
1490                 break;
1491         case SCTP_TIMER_TYPE_EARLYFR:
1492                 /* Need to do FR of things for net */
1493                 SCTP_STAT_INCR(sctps_timoearlyfr);
1494                 sctp_early_fr_timer(inp, stcb, net);
1495                 break;
1496         case SCTP_TIMER_TYPE_ASCONF:
1497                 if (sctp_asconf_timer(inp, stcb, net)) {
1498                         /* no need to unlock on tcb its gone */
1499                         goto out_decr;
1500                 }
1501                 SCTP_STAT_INCR(sctps_timoasconf);
1502 #ifdef SCTP_AUDITING_ENABLED
1503                 sctp_auditing(4, inp, stcb, net);
1504 #endif
1505                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR);
1506                 break;
1507
1508         case SCTP_TIMER_TYPE_AUTOCLOSE:
1509                 SCTP_STAT_INCR(sctps_timoautoclose);
1510                 sctp_autoclose_timer(inp, stcb, net);
1511                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR);
1512                 did_output = 0;
1513                 break;
1514         case SCTP_TIMER_TYPE_ASOCKILL:
1515                 SCTP_STAT_INCR(sctps_timoassockill);
1516                 /* Can we free it yet? */
1517                 SCTP_INP_DECR_REF(inp);
1518                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
1519                 sctp_free_assoc(inp, stcb, 0);
1520                 /*
1521                  * free asoc, always unlocks (or destroy's) so prevent
1522                  * duplicate unlock or unlock of a free mtx :-0
1523                  */
1524                 stcb = NULL;
1525                 goto out_no_decr;
1526                 break;
1527         case SCTP_TIMER_TYPE_INPKILL:
1528                 SCTP_STAT_INCR(sctps_timoinpkill);
1529                 /*
1530                  * special case, take away our increment since WE are the
1531                  * killer
1532                  */
1533                 SCTP_INP_DECR_REF(inp);
1534                 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL);
1535                 sctp_inpcb_free(inp, 1, 0);
1536                 goto out_no_decr;
1537                 break;
1538         default:
1539 #ifdef SCTP_DEBUG
1540                 if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1541                         printf("sctp_timeout_handler:unknown timer %d\n",
1542                             tmr->type);
1543                 }
1544 #endif                          /* SCTP_DEBUG */
1545                 break;
1546         };
1547 #ifdef SCTP_AUDITING_ENABLED
1548         sctp_audit_log(0xF1, (uint8_t) tmr->type);
1549         if (inp)
1550                 sctp_auditing(5, inp, stcb, net);
1551 #endif
1552         if ((did_output) && stcb) {
1553                 /*
1554                  * Now we need to clean up the control chunk chain if an
1555                  * ECNE is on it. It must be marked as UNSENT again so next
1556                  * call will continue to send it until such time that we get
1557                  * a CWR, to remove it. It is, however, less likely that we
1558                  * will find a ecn echo on the chain though.
1559                  */
1560                 sctp_fix_ecn_echo(&stcb->asoc);
1561         }
1562         if (stcb) {
1563                 SCTP_TCB_UNLOCK(stcb);
1564         }
1565 out_decr:
1566         if (inp) {
1567                 SCTP_INP_DECR_REF(inp);
1568         }
1569 out_no_decr:
1570
1571 #ifdef SCTP_DEBUG
1572         if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1573                 printf("Timer now complete (type %d)\n", tmr->type);
1574         }
1575 #endif                          /* SCTP_DEBUG */
1576         splx(s);
1577         if (inp) {
1578         }
1579 }
1580
1581 int
1582 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1583     struct sctp_nets *net)
1584 {
1585         int to_ticks;
1586         struct sctp_timer *tmr;
1587
1588
1589         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) &&
1590             (inp == NULL))
1591                 return (EFAULT);
1592
1593         to_ticks = 0;
1594
1595         tmr = NULL;
1596         if (stcb) {
1597                 SCTP_TCB_LOCK_ASSERT(stcb);
1598         }
1599         switch (t_type) {
1600         case SCTP_TIMER_TYPE_ADDR_WQ:
1601                 /* Only 1 tick away :-) */
1602                 tmr = &sctppcbinfo.addr_wq_timer;
1603                 to_ticks = 1;
1604                 break;
1605         case SCTP_TIMER_TYPE_ITERATOR:
1606                 {
1607                         struct sctp_iterator *it;
1608
1609                         it = (struct sctp_iterator *)inp;
1610                         tmr = &it->tmr;
1611                         to_ticks = SCTP_ITERATOR_TICKS;
1612                 }
1613                 break;
1614         case SCTP_TIMER_TYPE_SEND:
1615                 /* Here we use the RTO timer */
1616                 {
1617                         int rto_val;
1618
1619                         if ((stcb == NULL) || (net == NULL)) {
1620                                 return (EFAULT);
1621                         }
1622                         tmr = &net->rxt_timer;
1623                         if (net->RTO == 0) {
1624                                 rto_val = stcb->asoc.initial_rto;
1625                         } else {
1626                                 rto_val = net->RTO;
1627                         }
1628                         to_ticks = MSEC_TO_TICKS(rto_val);
1629                 }
1630                 break;
1631         case SCTP_TIMER_TYPE_INIT:
1632                 /*
1633                  * Here we use the INIT timer default usually about 1
1634                  * minute.
1635                  */
1636                 if ((stcb == NULL) || (net == NULL)) {
1637                         return (EFAULT);
1638                 }
1639                 tmr = &net->rxt_timer;
1640                 if (net->RTO == 0) {
1641                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1642                 } else {
1643                         to_ticks = MSEC_TO_TICKS(net->RTO);
1644                 }
1645                 break;
1646         case SCTP_TIMER_TYPE_RECV:
1647                 /*
1648                  * Here we use the Delayed-Ack timer value from the inp
1649                  * ususually about 200ms.
1650                  */
1651                 if (stcb == NULL) {
1652                         return (EFAULT);
1653                 }
1654                 tmr = &stcb->asoc.dack_timer;
1655                 to_ticks = MSEC_TO_TICKS(stcb->asoc.delayed_ack);
1656                 break;
1657         case SCTP_TIMER_TYPE_SHUTDOWN:
1658                 /* Here we use the RTO of the destination. */
1659                 if ((stcb == NULL) || (net == NULL)) {
1660                         return (EFAULT);
1661                 }
1662                 if (net->RTO == 0) {
1663                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1664                 } else {
1665                         to_ticks = MSEC_TO_TICKS(net->RTO);
1666                 }
1667                 tmr = &net->rxt_timer;
1668                 break;
1669         case SCTP_TIMER_TYPE_HEARTBEAT:
1670                 /*
1671                  * the net is used here so that we can add in the RTO. Even
1672                  * though we use a different timer. We also add the HB timer
1673                  * PLUS a random jitter.
1674                  */
1675                 if (stcb == NULL) {
1676                         return (EFAULT);
1677                 } {
1678                         uint32_t rndval;
1679                         uint8_t this_random;
1680                         int cnt_of_unconf = 0;
1681                         struct sctp_nets *lnet;
1682
1683                         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
1684                                 if ((lnet->dest_state & SCTP_ADDR_UNCONFIRMED) &&
1685                                     (lnet->dest_state & SCTP_ADDR_REACHABLE)) {
1686                                         cnt_of_unconf++;
1687                                 }
1688                         }
1689                         if (cnt_of_unconf) {
1690                                 lnet = NULL;
1691                                 sctp_heartbeat_timer(inp, stcb, lnet, cnt_of_unconf);
1692                         }
1693                         if (stcb->asoc.hb_random_idx > 3) {
1694                                 rndval = sctp_select_initial_TSN(&inp->sctp_ep);
1695                                 memcpy(stcb->asoc.hb_random_values, &rndval,
1696                                     sizeof(stcb->asoc.hb_random_values));
1697                                 this_random = stcb->asoc.hb_random_values[0];
1698                                 stcb->asoc.hb_random_idx = 0;
1699                                 stcb->asoc.hb_ect_randombit = 0;
1700                         } else {
1701                                 this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
1702                                 stcb->asoc.hb_random_idx++;
1703                                 stcb->asoc.hb_ect_randombit = 0;
1704                         }
1705                         /*
1706                          * this_random will be 0 - 256 ms RTO is in ms.
1707                          */
1708                         if ((stcb->asoc.hb_is_disabled) &&
1709                             (cnt_of_unconf == 0)) {
1710                                 return (0);
1711                         }
1712                         if (net) {
1713                                 struct sctp_nets *lnet;
1714                                 int delay;
1715
1716                                 delay = stcb->asoc.heart_beat_delay;
1717                                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
1718                                         if ((lnet->dest_state & SCTP_ADDR_UNCONFIRMED) &&
1719                                             ((lnet->dest_state & SCTP_ADDR_OUT_OF_SCOPE) == 0) &&
1720                                             (lnet->dest_state & SCTP_ADDR_REACHABLE)) {
1721                                                 delay = 0;
1722                                         }
1723                                 }
1724                                 if (net->RTO == 0) {
1725                                         /* Never been checked */
1726                                         to_ticks = this_random + stcb->asoc.initial_rto + delay;
1727                                 } else {
1728                                         /* set rto_val to the ms */
1729                                         to_ticks = delay + net->RTO + this_random;
1730                                 }
1731                         } else {
1732                                 if (cnt_of_unconf) {
1733                                         to_ticks = this_random + stcb->asoc.initial_rto;
1734                                 } else {
1735                                         to_ticks = stcb->asoc.heart_beat_delay + this_random + stcb->asoc.initial_rto;
1736                                 }
1737                         }
1738                         /*
1739                          * Now we must convert the to_ticks that are now in
1740                          * ms to ticks.
1741                          */
1742                         to_ticks = MSEC_TO_TICKS(to_ticks);
1743                         tmr = &stcb->asoc.hb_timer;
1744                 }
1745                 break;
1746         case SCTP_TIMER_TYPE_COOKIE:
1747                 /*
1748                  * Here we can use the RTO timer from the network since one
1749                  * RTT was compelete. If a retran happened then we will be
1750                  * using the RTO initial value.
1751                  */
1752                 if ((stcb == NULL) || (net == NULL)) {
1753                         return (EFAULT);
1754                 }
1755                 if (net->RTO == 0) {
1756                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1757                 } else {
1758                         to_ticks = MSEC_TO_TICKS(net->RTO);
1759                 }
1760                 tmr = &net->rxt_timer;
1761                 break;
1762         case SCTP_TIMER_TYPE_NEWCOOKIE:
1763                 /*
1764                  * nothing needed but the endpoint here ususually about 60
1765                  * minutes.
1766                  */
1767                 tmr = &inp->sctp_ep.signature_change;
1768                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE];
1769                 break;
1770         case SCTP_TIMER_TYPE_ASOCKILL:
1771                 if (stcb == NULL) {
1772                         return (EFAULT);
1773                 }
1774                 tmr = &stcb->asoc.strreset_timer;
1775                 to_ticks = MSEC_TO_TICKS(SCTP_ASOC_KILL_TIMEOUT);
1776                 break;
1777         case SCTP_TIMER_TYPE_INPKILL:
1778                 /*
1779                  * The inp is setup to die. We re-use the signature_chage
1780                  * timer since that has stopped and we are in the GONE
1781                  * state.
1782                  */
1783                 tmr = &inp->sctp_ep.signature_change;
1784                 to_ticks = MSEC_TO_TICKS(SCTP_INP_KILL_TIMEOUT);
1785                 break;
1786         case SCTP_TIMER_TYPE_PATHMTURAISE:
1787                 /*
1788                  * Here we use the value found in the EP for PMTU ususually
1789                  * about 10 minutes.
1790                  */
1791                 if (stcb == NULL) {
1792                         return (EFAULT);
1793                 }
1794                 if (net == NULL) {
1795                         return (EFAULT);
1796                 }
1797                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU];
1798                 tmr = &net->pmtu_timer;
1799                 break;
1800         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1801                 /* Here we use the RTO of the destination */
1802                 if ((stcb == NULL) || (net == NULL)) {
1803                         return (EFAULT);
1804                 }
1805                 if (net->RTO == 0) {
1806                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1807                 } else {
1808                         to_ticks = MSEC_TO_TICKS(net->RTO);
1809                 }
1810                 tmr = &net->rxt_timer;
1811                 break;
1812         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1813                 /*
1814                  * Here we use the endpoints shutdown guard timer usually
1815                  * about 3 minutes.
1816                  */
1817                 if (stcb == NULL) {
1818                         return (EFAULT);
1819                 }
1820                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN];
1821                 tmr = &stcb->asoc.shut_guard_timer;
1822                 break;
1823         case SCTP_TIMER_TYPE_STRRESET:
1824                 /*
1825                  * Here the timer comes from the inp but its value is from
1826                  * the RTO.
1827                  */
1828                 if ((stcb == NULL) || (net == NULL)) {
1829                         return (EFAULT);
1830                 }
1831                 if (net->RTO == 0) {
1832                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1833                 } else {
1834                         to_ticks = MSEC_TO_TICKS(net->RTO);
1835                 }
1836                 tmr = &stcb->asoc.strreset_timer;
1837                 break;
1838
1839         case SCTP_TIMER_TYPE_EARLYFR:
1840                 {
1841                         unsigned int msec;
1842
1843                         if ((stcb == NULL) || (net == NULL)) {
1844                                 return (EFAULT);
1845                         }
1846                         if (net->flight_size > net->cwnd) {
1847                                 /* no need to start */
1848                                 return (0);
1849                         }
1850                         SCTP_STAT_INCR(sctps_earlyfrstart);
1851                         if (net->lastsa == 0) {
1852                                 /* Hmm no rtt estimate yet? */
1853                                 msec = stcb->asoc.initial_rto >> 2;
1854                         } else {
1855                                 msec = ((net->lastsa >> 2) + net->lastsv) >> 1;
1856                         }
1857                         if (msec < sctp_early_fr_msec) {
1858                                 msec = sctp_early_fr_msec;
1859                                 if (msec < SCTP_MINFR_MSEC_FLOOR) {
1860                                         msec = SCTP_MINFR_MSEC_FLOOR;
1861                                 }
1862                         }
1863                         to_ticks = MSEC_TO_TICKS(msec);
1864                         tmr = &net->fr_timer;
1865                 }
1866                 break;
1867         case SCTP_TIMER_TYPE_ASCONF:
1868                 /*
1869                  * Here the timer comes from the inp but its value is from
1870                  * the RTO.
1871                  */
1872                 if ((stcb == NULL) || (net == NULL)) {
1873                         return (EFAULT);
1874                 }
1875                 if (net->RTO == 0) {
1876                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1877                 } else {
1878                         to_ticks = MSEC_TO_TICKS(net->RTO);
1879                 }
1880                 tmr = &stcb->asoc.asconf_timer;
1881                 break;
1882         case SCTP_TIMER_TYPE_AUTOCLOSE:
1883                 if (stcb == NULL) {
1884                         return (EFAULT);
1885                 }
1886                 if (stcb->asoc.sctp_autoclose_ticks == 0) {
1887                         /*
1888                          * Really an error since stcb is NOT set to
1889                          * autoclose
1890                          */
1891                         return (0);
1892                 }
1893                 to_ticks = stcb->asoc.sctp_autoclose_ticks;
1894                 tmr = &stcb->asoc.autoclose_timer;
1895                 break;
1896         default:
1897 #ifdef SCTP_DEBUG
1898                 if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1899                         printf("sctp_timer_start:Unknown timer type %d\n",
1900                             t_type);
1901                 }
1902 #endif                          /* SCTP_DEBUG */
1903                 return (EFAULT);
1904                 break;
1905         };
1906         if ((to_ticks <= 0) || (tmr == NULL)) {
1907 #ifdef SCTP_DEBUG
1908                 if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1909                         printf("sctp_timer_start:%d:software error to_ticks:%d tmr:%p not set ??\n",
1910                             t_type, to_ticks, tmr);
1911                 }
1912 #endif                          /* SCTP_DEBUG */
1913                 return (EFAULT);
1914         }
1915         if (callout_pending(&tmr->timer)) {
1916                 /*
1917                  * we do NOT allow you to have it already running. if it is
1918                  * we leave the current one up unchanged
1919                  */
1920                 return (EALREADY);
1921         }
1922         /* At this point we can proceed */
1923         if (t_type == SCTP_TIMER_TYPE_SEND) {
1924                 stcb->asoc.num_send_timers_up++;
1925         }
1926         tmr->type = t_type;
1927         tmr->ep = (void *)inp;
1928         tmr->tcb = (void *)stcb;
1929         tmr->net = (void *)net;
1930         tmr->self = (void *)tmr;
1931         tmr->ticks = ticks;
1932         callout_reset(&tmr->timer, to_ticks, sctp_timeout_handler, tmr);
1933         return (0);
1934 }
1935
1936 int
1937 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1938     struct sctp_nets *net)
1939 {
1940         struct sctp_timer *tmr;
1941
1942         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) &&
1943             (inp == NULL))
1944                 return (EFAULT);
1945
1946         tmr = NULL;
1947         if (stcb) {
1948                 SCTP_TCB_LOCK_ASSERT(stcb);
1949         }
1950         switch (t_type) {
1951         case SCTP_TIMER_TYPE_ADDR_WQ:
1952                 tmr = &sctppcbinfo.addr_wq_timer;
1953                 break;
1954         case SCTP_TIMER_TYPE_EARLYFR:
1955                 if ((stcb == NULL) || (net == NULL)) {
1956                         return (EFAULT);
1957                 }
1958                 tmr = &net->fr_timer;
1959                 SCTP_STAT_INCR(sctps_earlyfrstop);
1960                 break;
1961         case SCTP_TIMER_TYPE_ITERATOR:
1962                 {
1963                         struct sctp_iterator *it;
1964
1965                         it = (struct sctp_iterator *)inp;
1966                         tmr = &it->tmr;
1967                 }
1968                 break;
1969         case SCTP_TIMER_TYPE_SEND:
1970                 if ((stcb == NULL) || (net == NULL)) {
1971                         return (EFAULT);
1972                 }
1973                 tmr = &net->rxt_timer;
1974                 break;
1975         case SCTP_TIMER_TYPE_INIT:
1976                 if ((stcb == NULL) || (net == NULL)) {
1977                         return (EFAULT);
1978                 }
1979                 tmr = &net->rxt_timer;
1980                 break;
1981         case SCTP_TIMER_TYPE_RECV:
1982                 if (stcb == NULL) {
1983                         return (EFAULT);
1984                 }
1985                 tmr = &stcb->asoc.dack_timer;
1986                 break;
1987         case SCTP_TIMER_TYPE_SHUTDOWN:
1988                 if ((stcb == NULL) || (net == NULL)) {
1989                         return (EFAULT);
1990                 }
1991                 tmr = &net->rxt_timer;
1992                 break;
1993         case SCTP_TIMER_TYPE_HEARTBEAT:
1994                 if (stcb == NULL) {
1995                         return (EFAULT);
1996                 }
1997                 tmr = &stcb->asoc.hb_timer;
1998                 break;
1999         case SCTP_TIMER_TYPE_COOKIE:
2000                 if ((stcb == NULL) || (net == NULL)) {
2001                         return (EFAULT);
2002                 }
2003                 tmr = &net->rxt_timer;
2004                 break;
2005         case SCTP_TIMER_TYPE_NEWCOOKIE:
2006                 /* nothing needed but the endpoint here */
2007                 tmr = &inp->sctp_ep.signature_change;
2008                 /*
2009                  * We re-use the newcookie timer for the INP kill timer. We
2010                  * must assure that we do not kill it by accident.
2011                  */
2012                 break;
2013         case SCTP_TIMER_TYPE_ASOCKILL:
2014                 /*
2015                  * Stop the asoc kill timer.
2016                  */
2017                 if (stcb == NULL) {
2018                         return (EFAULT);
2019                 }
2020                 tmr = &stcb->asoc.strreset_timer;
2021                 break;
2022
2023         case SCTP_TIMER_TYPE_INPKILL:
2024                 /*
2025                  * The inp is setup to die. We re-use the signature_chage
2026                  * timer since that has stopped and we are in the GONE
2027                  * state.
2028                  */
2029                 tmr = &inp->sctp_ep.signature_change;
2030                 break;
2031         case SCTP_TIMER_TYPE_PATHMTURAISE:
2032                 if ((stcb == NULL) || (net == NULL)) {
2033                         return (EFAULT);
2034                 }
2035                 tmr = &net->pmtu_timer;
2036                 break;
2037         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2038                 if ((stcb == NULL) || (net == NULL)) {
2039                         return (EFAULT);
2040                 }
2041                 tmr = &net->rxt_timer;
2042                 break;
2043         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2044                 if (stcb == NULL) {
2045                         return (EFAULT);
2046                 }
2047                 tmr = &stcb->asoc.shut_guard_timer;
2048                 break;
2049         case SCTP_TIMER_TYPE_STRRESET:
2050                 if (stcb == NULL) {
2051                         return (EFAULT);
2052                 }
2053                 tmr = &stcb->asoc.strreset_timer;
2054                 break;
2055         case SCTP_TIMER_TYPE_ASCONF:
2056                 if (stcb == NULL) {
2057                         return (EFAULT);
2058                 }
2059                 tmr = &stcb->asoc.asconf_timer;
2060                 break;
2061         case SCTP_TIMER_TYPE_AUTOCLOSE:
2062                 if (stcb == NULL) {
2063                         return (EFAULT);
2064                 }
2065                 tmr = &stcb->asoc.autoclose_timer;
2066                 break;
2067         default:
2068 #ifdef SCTP_DEBUG
2069                 if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
2070                         printf("sctp_timer_stop:Unknown timer type %d\n",
2071                             t_type);
2072                 }
2073 #endif                          /* SCTP_DEBUG */
2074                 break;
2075         };
2076         if (tmr == NULL) {
2077                 return (EFAULT);
2078         }
2079         if ((tmr->type != t_type) && tmr->type) {
2080                 /*
2081                  * Ok we have a timer that is under joint use. Cookie timer
2082                  * per chance with the SEND timer. We therefore are NOT
2083                  * running the timer that the caller wants stopped.  So just
2084                  * return.
2085                  */
2086                 return (0);
2087         }
2088         if (t_type == SCTP_TIMER_TYPE_SEND) {
2089                 stcb->asoc.num_send_timers_up--;
2090                 if (stcb->asoc.num_send_timers_up < 0) {
2091                         stcb->asoc.num_send_timers_up = 0;
2092                 }
2093         }
2094         tmr->self = NULL;
2095         callout_stop(&tmr->timer);
2096         return (0);
2097 }
2098
2099 #ifdef SCTP_USE_ADLER32
2100 static uint32_t
2101 update_adler32(uint32_t adler, uint8_t * buf, int32_t len)
2102 {
2103         uint32_t s1 = adler & 0xffff;
2104         uint32_t s2 = (adler >> 16) & 0xffff;
2105         int n;
2106
2107         for (n = 0; n < len; n++, buf++) {
2108                 /* s1 = (s1 + buf[n]) % BASE */
2109                 /* first we add */
2110                 s1 = (s1 + *buf);
2111                 /*
2112                  * now if we need to, we do a mod by subtracting. It seems a
2113                  * bit faster since I really will only ever do one subtract
2114                  * at the MOST, since buf[n] is a max of 255.
2115                  */
2116                 if (s1 >= SCTP_ADLER32_BASE) {
2117                         s1 -= SCTP_ADLER32_BASE;
2118                 }
2119                 /* s2 = (s2 + s1) % BASE */
2120                 /* first we add */
2121                 s2 = (s2 + s1);
2122                 /*
2123                  * again, it is more efficent (it seems) to subtract since
2124                  * the most s2 will ever be is (BASE-1 + BASE-1) in the
2125                  * worse case. This would then be (2 * BASE) - 2, which will
2126                  * still only do one subtract. On Intel this is much better
2127                  * to do this way and avoid the divide. Have not -pg'd on
2128                  * sparc.
2129                  */
2130                 if (s2 >= SCTP_ADLER32_BASE) {
2131                         s2 -= SCTP_ADLER32_BASE;
2132                 }
2133         }
2134         /* Return the adler32 of the bytes buf[0..len-1] */
2135         return ((s2 << 16) + s1);
2136 }
2137
2138 #endif
2139
2140
2141 uint32_t
2142 sctp_calculate_len(struct mbuf *m)
2143 {
2144         uint32_t tlen = 0;
2145         struct mbuf *at;
2146
2147         at = m;
2148         while (at) {
2149                 tlen += at->m_len;
2150                 at = at->m_next;
2151         }
2152         return (tlen);
2153 }
2154
2155 #if defined(SCTP_WITH_NO_CSUM)
2156
2157 uint32_t
2158 sctp_calculate_sum(struct mbuf *m, int32_t * pktlen, uint32_t offset)
2159 {
2160         /*
2161          * given a mbuf chain with a packetheader offset by 'offset'
2162          * pointing at a sctphdr (with csum set to 0) go through the chain
2163          * of m_next's and calculate the SCTP checksum. This is currently
2164          * Adler32 but will change to CRC32x soon. Also has a side bonus
2165          * calculate the total length of the mbuf chain. Note: if offset is
2166          * greater than the total mbuf length, checksum=1, pktlen=0 is
2167          * returned (ie. no real error code)
2168          */
2169         if (pktlen == NULL)
2170                 return (0);
2171         *pktlen = sctp_calculate_len(m);
2172         return (0);
2173 }
2174
2175 #elif defined(SCTP_USE_INCHKSUM)
2176
2177 #include <machine/in_cksum.h>
2178
2179 uint32_t
2180 sctp_calculate_sum(struct mbuf *m, int32_t * pktlen, uint32_t offset)
2181 {
2182         /*
2183          * given a mbuf chain with a packetheader offset by 'offset'
2184          * pointing at a sctphdr (with csum set to 0) go through the chain
2185          * of m_next's and calculate the SCTP checksum. This is currently
2186          * Adler32 but will change to CRC32x soon. Also has a side bonus
2187          * calculate the total length of the mbuf chain. Note: if offset is
2188          * greater than the total mbuf length, checksum=1, pktlen=0 is
2189          * returned (ie. no real error code)
2190          */
2191         int32_t tlen = 0;
2192         struct mbuf *at;
2193         uint32_t the_sum, retsum;
2194
2195         at = m;
2196         while (at) {
2197                 tlen += at->m_len;
2198                 at = at->m_next;
2199         }
2200         the_sum = (uint32_t) (in_cksum_skip(m, tlen, offset));
2201         if (pktlen != NULL)
2202                 *pktlen = (tlen - offset);
2203         retsum = htons(the_sum);
2204         return (the_sum);
2205 }
2206
2207 #else
2208
2209 uint32_t
2210 sctp_calculate_sum(struct mbuf *m, int32_t * pktlen, uint32_t offset)
2211 {
2212         /*
2213          * given a mbuf chain with a packetheader offset by 'offset'
2214          * pointing at a sctphdr (with csum set to 0) go through the chain
2215          * of m_next's and calculate the SCTP checksum. This is currently
2216          * Adler32 but will change to CRC32x soon. Also has a side bonus
2217          * calculate the total length of the mbuf chain. Note: if offset is
2218          * greater than the total mbuf length, checksum=1, pktlen=0 is
2219          * returned (ie. no real error code)
2220          */
2221         int32_t tlen = 0;
2222
2223 #ifdef SCTP_USE_ADLER32
2224         uint32_t base = 1L;
2225
2226 #else
2227         uint32_t base = 0xffffffff;
2228
2229 #endif                          /* SCTP_USE_ADLER32 */
2230         struct mbuf *at;
2231
2232         at = m;
2233         /* find the correct mbuf and offset into mbuf */
2234         while ((at != NULL) && (offset > (uint32_t) at->m_len)) {
2235                 offset -= at->m_len;    /* update remaining offset left */
2236                 at = at->m_next;
2237         }
2238         while (at != NULL) {
2239                 if ((at->m_len - offset) > 0) {
2240 #ifdef SCTP_USE_ADLER32
2241                         base = update_adler32(base,
2242                             (unsigned char *)(at->m_data + offset),
2243                             (unsigned int)(at->m_len - offset));
2244 #else
2245                         if ((at->m_len - offset) < 4) {
2246                                 /* Use old method if less than 4 bytes */
2247                                 base = old_update_crc32(base,
2248                                     (unsigned char *)(at->m_data + offset),
2249                                     (unsigned int)(at->m_len - offset));
2250                         } else {
2251                                 base = update_crc32(base,
2252                                     (unsigned char *)(at->m_data + offset),
2253                                     (unsigned int)(at->m_len - offset));
2254                         }
2255 #endif                          /* SCTP_USE_ADLER32 */
2256                         tlen += at->m_len - offset;
2257                         /* we only offset once into the first mbuf */
2258                 }
2259                 if (offset) {
2260                         if (offset < at->m_len)
2261                                 offset = 0;
2262                         else
2263                                 offset -= at->m_len;
2264                 }
2265                 at = at->m_next;
2266         }
2267         if (pktlen != NULL) {
2268                 *pktlen = tlen;
2269         }
2270 #ifdef SCTP_USE_ADLER32
2271         /* Adler32 */
2272         base = htonl(base);
2273 #else
2274         /* CRC-32c */
2275         base = sctp_csum_finalize(base);
2276 #endif
2277         return (base);
2278 }
2279
2280
2281 #endif
2282
2283 void
2284 sctp_mtu_size_reset(struct sctp_inpcb *inp,
2285     struct sctp_association *asoc, u_long mtu)
2286 {
2287         /*
2288          * Reset the P-MTU size on this association, this involves changing
2289          * the asoc MTU, going through ANY chunk+overhead larger than mtu to
2290          * allow the DF flag to be cleared.
2291          */
2292         struct sctp_tmit_chunk *chk;
2293         unsigned int eff_mtu, ovh;
2294
2295         asoc->smallest_mtu = mtu;
2296         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2297                 ovh = SCTP_MIN_OVERHEAD;
2298         } else {
2299                 ovh = SCTP_MIN_V4_OVERHEAD;
2300         }
2301         eff_mtu = mtu - ovh;
2302         TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
2303
2304                 if (chk->send_size > eff_mtu) {
2305                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2306                 }
2307         }
2308         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
2309                 if (chk->send_size > eff_mtu) {
2310                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2311                 }
2312         }
2313 }
2314
2315
2316 /*
2317  * given an association and starting time of the current RTT period return
2318  * RTO in number of usecs net should point to the current network
2319  */
2320 uint32_t
2321 sctp_calculate_rto(struct sctp_tcb *stcb,
2322     struct sctp_association *asoc,
2323     struct sctp_nets *net,
2324     struct timeval *old)
2325 {
2326         /*
2327          * given an association and the starting time of the current RTT
2328          * period (in value1/value2) return RTO in number of usecs.
2329          */
2330         int calc_time = 0;
2331         int o_calctime;
2332         unsigned int new_rto = 0;
2333         int first_measure = 0;
2334         struct timeval now;
2335
2336         /************************/
2337         /* 1. calculate new RTT */
2338         /************************/
2339         /* get the current time */
2340         SCTP_GETTIME_TIMEVAL(&now);
2341         /* compute the RTT value */
2342         if ((u_long)now.tv_sec > (u_long)old->tv_sec) {
2343                 calc_time = ((u_long)now.tv_sec - (u_long)old->tv_sec) * 1000;
2344                 if ((u_long)now.tv_usec > (u_long)old->tv_usec) {
2345                         calc_time += (((u_long)now.tv_usec -
2346                             (u_long)old->tv_usec) / 1000);
2347                 } else if ((u_long)now.tv_usec < (u_long)old->tv_usec) {
2348                         /* Borrow 1,000ms from current calculation */
2349                         calc_time -= 1000;
2350                         /* Add in the slop over */
2351                         calc_time += ((int)now.tv_usec / 1000);
2352                         /* Add in the pre-second ms's */
2353                         calc_time += (((int)1000000 - (int)old->tv_usec) / 1000);
2354                 }
2355         } else if ((u_long)now.tv_sec == (u_long)old->tv_sec) {
2356                 if ((u_long)now.tv_usec > (u_long)old->tv_usec) {
2357                         calc_time = ((u_long)now.tv_usec -
2358                             (u_long)old->tv_usec) / 1000;
2359                 } else if ((u_long)now.tv_usec < (u_long)old->tv_usec) {
2360                         /* impossible .. garbage in nothing out */
2361                         return (((net->lastsa >> 2) + net->lastsv) >> 1);
2362                 } else {
2363                         /* impossible .. garbage in nothing out */
2364                         return (((net->lastsa >> 2) + net->lastsv) >> 1);
2365                 }
2366         } else {
2367                 /* Clock wrapped? */
2368                 return (((net->lastsa >> 2) + net->lastsv) >> 1);
2369         }
2370         /***************************/
2371         /* 2. update RTTVAR & SRTT */
2372         /***************************/
2373 #if 0
2374         /* if (net->lastsv || net->lastsa) { */
2375         /* per Section 5.3.1 C3 in SCTP */
2376         /* net->lastsv = (int)   *//* RTTVAR */
2377         /*
2378          * (((double)(1.0 - 0.25) * (double)net->lastsv) + (double)(0.25 *
2379          * (double)abs(net->lastsa - calc_time))); net->lastsa = (int)
2380 *//* SRTT */
2381         /*
2382          * (((double)(1.0 - 0.125) * (double)net->lastsa) + (double)(0.125 *
2383          * (double)calc_time)); } else {
2384 *//* the first RTT calculation, per C2 Section 5.3.1 */
2385         /* net->lastsa = calc_time;      *//* SRTT */
2386         /* net->lastsv = calc_time / 2;  *//* RTTVAR */
2387         /* } */
2388         /* if RTTVAR goes to 0 you set to clock grainularity */
2389         /*
2390          * if (net->lastsv == 0) { net->lastsv = SCTP_CLOCK_GRANULARITY; }
2391          * new_rto = net->lastsa + 4 * net->lastsv;
2392          */
2393 #endif
2394         o_calctime = calc_time;
2395         /* this is Van Jacobson's integer version */
2396         if (net->RTO) {
2397                 calc_time -= (net->lastsa >> 3);
2398                 if ((int)net->prev_rtt > o_calctime) {
2399                         net->rtt_variance = net->prev_rtt - o_calctime;
2400                         /* decreasing */
2401                         net->rto_variance_dir = 0;
2402                 } else {
2403                         /* increasing */
2404                         net->rtt_variance = o_calctime - net->prev_rtt;
2405                         net->rto_variance_dir = 1;
2406                 }
2407 #ifdef SCTP_RTTVAR_LOGGING
2408                 rto_logging(net, SCTP_LOG_RTTVAR);
2409 #endif
2410                 net->prev_rtt = o_calctime;
2411                 net->lastsa += calc_time;
2412                 if (calc_time < 0) {
2413                         calc_time = -calc_time;
2414                 }
2415                 calc_time -= (net->lastsv >> 2);
2416                 net->lastsv += calc_time;
2417                 if (net->lastsv == 0) {
2418                         net->lastsv = SCTP_CLOCK_GRANULARITY;
2419                 }
2420         } else {
2421                 /* First RTO measurment */
2422                 net->lastsa = calc_time;
2423                 net->lastsv = calc_time >> 1;
2424                 first_measure = 1;
2425                 net->rto_variance_dir = 1;
2426                 net->prev_rtt = o_calctime;
2427                 net->rtt_variance = 0;
2428 #ifdef SCTP_RTTVAR_LOGGING
2429                 rto_logging(net, SCTP_LOG_INITIAL_RTT);
2430 #endif
2431         }
2432         new_rto = ((net->lastsa >> 2) + net->lastsv) >> 1;
2433         if ((new_rto > SCTP_SAT_NETWORK_MIN) &&
2434             (stcb->asoc.sat_network_lockout == 0)) {
2435                 stcb->asoc.sat_network = 1;
2436         } else if ((!first_measure) && stcb->asoc.sat_network) {
2437                 stcb->asoc.sat_network = 0;
2438                 stcb->asoc.sat_network_lockout = 1;
2439         }
2440         /* bound it, per C6/C7 in Section 5.3.1 */
2441         if (new_rto < stcb->asoc.minrto) {
2442                 new_rto = stcb->asoc.minrto;
2443         }
2444         if (new_rto > stcb->asoc.maxrto) {
2445                 new_rto = stcb->asoc.maxrto;
2446         }
2447         /* we are now returning the RTT Smoothed */
2448         return ((uint32_t) new_rto);
2449 }
2450
2451
2452 /*
2453  * return a pointer to a contiguous piece of data from the given mbuf chain
2454  * starting at 'off' for 'len' bytes.  If the desired piece spans more than
2455  * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size
2456  * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain.
2457  */
2458 __inline caddr_t
2459 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t * in_ptr)
2460 {
2461         uint32_t count;
2462         uint8_t *ptr;
2463
2464         ptr = in_ptr;
2465         if ((off < 0) || (len <= 0))
2466                 return (NULL);
2467
2468         /* find the desired start location */
2469         while ((m != NULL) && (off > 0)) {
2470                 if (off < m->m_len)
2471                         break;
2472                 off -= m->m_len;
2473                 m = m->m_next;
2474         }
2475         if (m == NULL)
2476                 return (NULL);
2477
2478         /* is the current mbuf large enough (eg. contiguous)? */
2479         if ((m->m_len - off) >= len) {
2480                 return (mtod(m, caddr_t)+off);
2481         } else {
2482                 /* else, it spans more than one mbuf, so save a temp copy... */
2483                 while ((m != NULL) && (len > 0)) {
2484                         count = min(m->m_len - off, len);
2485                         bcopy(mtod(m, caddr_t)+off, ptr, count);
2486                         len -= count;
2487                         ptr += count;
2488                         off = 0;
2489                         m = m->m_next;
2490                 }
2491                 if ((m == NULL) && (len > 0))
2492                         return (NULL);
2493                 else
2494                         return ((caddr_t)in_ptr);
2495         }
2496 }
2497
2498
2499 struct sctp_paramhdr *
2500 sctp_get_next_param(struct mbuf *m,
2501     int offset,
2502     struct sctp_paramhdr *pull,
2503     int pull_limit)
2504 {
2505         /* This just provides a typed signature to Peter's Pull routine */
2506         return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit,
2507             (uint8_t *) pull));
2508 }
2509
2510
2511 int
2512 sctp_add_pad_tombuf(struct mbuf *m, int padlen)
2513 {
2514         /*
2515          * add padlen bytes of 0 filled padding to the end of the mbuf. If
2516          * padlen is > 3 this routine will fail.
2517          */
2518         uint8_t *dp;
2519         int i;
2520
2521         if (padlen > 3) {
2522                 return (ENOBUFS);
2523         }
2524         if (M_TRAILINGSPACE(m)) {
2525                 /*
2526                  * The easy way. We hope the majority of the time we hit
2527                  * here :)
2528                  */
2529                 dp = (uint8_t *) (mtod(m, caddr_t)+m->m_len);
2530                 m->m_len += padlen;
2531         } else {
2532                 /* Hard way we must grow the mbuf */
2533                 struct mbuf *tmp;
2534
2535                 tmp = sctp_get_mbuf_for_msg(padlen, 0, M_DONTWAIT, 1, MT_DATA);
2536                 if (tmp == NULL) {
2537                         /* Out of space GAK! we are in big trouble. */
2538                         return (ENOSPC);
2539                 }
2540                 /* setup and insert in middle */
2541                 tmp->m_next = m->m_next;
2542                 tmp->m_len = padlen;
2543                 m->m_next = tmp;
2544                 dp = mtod(tmp, uint8_t *);
2545         }
2546         /* zero out the pad */
2547         for (i = 0; i < padlen; i++) {
2548                 *dp = 0;
2549                 dp++;
2550         }
2551         return (0);
2552 }
2553
2554 int
2555 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf)
2556 {
2557         /* find the last mbuf in chain and pad it */
2558         struct mbuf *m_at;
2559
2560         m_at = m;
2561         if (last_mbuf) {
2562                 return (sctp_add_pad_tombuf(last_mbuf, padval));
2563         } else {
2564                 while (m_at) {
2565                         if (m_at->m_next == NULL) {
2566                                 return (sctp_add_pad_tombuf(m_at, padval));
2567                         }
2568                         m_at = m_at->m_next;
2569                 }
2570         }
2571         return (EFAULT);
2572 }
2573
2574 int sctp_asoc_change_wake = 0;
2575
2576 static void
2577 sctp_notify_assoc_change(uint32_t event, struct sctp_tcb *stcb,
2578     uint32_t error, void *data)
2579 {
2580         struct mbuf *m_notify;
2581         struct sctp_assoc_change *sac;
2582         struct sctp_queued_to_read *control;
2583
2584         /*
2585          * First if we are are going down dump everything we can to the
2586          * socket rcv queue.
2587          */
2588
2589         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
2590             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
2591             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)
2592             ) {
2593                 /* If the socket is gone we are out of here */
2594                 return;
2595         }
2596         /*
2597          * For TCP model AND UDP connected sockets we will send an error up
2598          * when an ABORT comes in.
2599          */
2600         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2601             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2602             (event == SCTP_COMM_LOST)) {
2603                 if (TAILQ_EMPTY(&stcb->sctp_ep->read_queue)) {
2604                         stcb->sctp_socket->so_error = ECONNRESET;
2605                 }
2606                 /* Wake ANY sleepers */
2607                 sorwakeup(stcb->sctp_socket);
2608                 sowwakeup(stcb->sctp_socket);
2609                 sctp_asoc_change_wake++;
2610         }
2611         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_RECVASSOCEVNT)) {
2612                 /* event not enabled */
2613                 return;
2614         }
2615         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_change), 1, M_DONTWAIT, 1, MT_DATA);
2616         if (m_notify == NULL)
2617                 /* no space left */
2618                 return;
2619         m_notify->m_len = 0;
2620
2621         sac = mtod(m_notify, struct sctp_assoc_change *);
2622         sac->sac_type = SCTP_ASSOC_CHANGE;
2623         sac->sac_flags = 0;
2624         sac->sac_length = sizeof(struct sctp_assoc_change);
2625         sac->sac_state = event;
2626         sac->sac_error = error;
2627         /* XXX verify these stream counts */
2628         sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
2629         sac->sac_inbound_streams = stcb->asoc.streamincnt;
2630         sac->sac_assoc_id = sctp_get_associd(stcb);
2631         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
2632         m_notify->m_pkthdr.len = sizeof(struct sctp_assoc_change);
2633         m_notify->m_pkthdr.rcvif = 0;
2634         m_notify->m_len = sizeof(struct sctp_assoc_change);
2635         m_notify->m_next = NULL;
2636         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2637             0, 0, 0, 0, 0, 0,
2638             m_notify);
2639         if (control == NULL) {
2640                 /* no memory */
2641                 sctp_m_freem(m_notify);
2642                 return;
2643         }
2644         control->length = m_notify->m_len;
2645         /* not that we need this */
2646         control->tail_mbuf = m_notify;
2647         sctp_add_to_readq(stcb->sctp_ep, stcb,
2648             control,
2649             &stcb->sctp_socket->so_rcv, 1);
2650         if (event == SCTP_COMM_LOST) {
2651                 /* Wake up any sleeper */
2652                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
2653         }
2654 }
2655
2656 static void
2657 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
2658     struct sockaddr *sa, uint32_t error)
2659 {
2660         struct mbuf *m_notify;
2661         struct sctp_paddr_change *spc;
2662         struct sctp_queued_to_read *control;
2663
2664         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_RECVPADDREVNT))
2665                 /* event not enabled */
2666                 return;
2667
2668         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 1, M_DONTWAIT, 1, MT_DATA);
2669         if (m_notify == NULL)
2670                 return;
2671         m_notify->m_len = 0;
2672         spc = mtod(m_notify, struct sctp_paddr_change *);
2673         spc->spc_type = SCTP_PEER_ADDR_CHANGE;
2674         spc->spc_flags = 0;
2675         spc->spc_length = sizeof(struct sctp_paddr_change);
2676         if (sa->sa_family == AF_INET) {
2677                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2678         } else {
2679                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6));
2680         }
2681         spc->spc_state = state;
2682         spc->spc_error = error;
2683         spc->spc_assoc_id = sctp_get_associd(stcb);
2684
2685         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
2686         m_notify->m_pkthdr.len = sizeof(struct sctp_paddr_change);
2687         m_notify->m_pkthdr.rcvif = 0;
2688         m_notify->m_len = sizeof(struct sctp_paddr_change);
2689         m_notify->m_next = NULL;
2690
2691         /* append to socket */
2692         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2693             0, 0, 0, 0, 0, 0,
2694             m_notify);
2695         if (control == NULL) {
2696                 /* no memory */
2697                 sctp_m_freem(m_notify);
2698                 return;
2699         }
2700         control->length = m_notify->m_len;
2701         /* not that we need this */
2702         control->tail_mbuf = m_notify;
2703         sctp_add_to_readq(stcb->sctp_ep, stcb,
2704             control,
2705             &stcb->sctp_socket->so_rcv, 1);
2706 }
2707
2708
2709 static void
2710 sctp_notify_send_failed(struct sctp_tcb *stcb, uint32_t error,
2711     struct sctp_tmit_chunk *chk)
2712 {
2713         struct mbuf *m_notify;
2714         struct sctp_send_failed *ssf;
2715         struct sctp_queued_to_read *control;
2716         int length;
2717
2718         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_RECVSENDFAILEVNT))
2719                 /* event not enabled */
2720                 return;
2721
2722         length = sizeof(struct sctp_send_failed) + chk->send_size;
2723         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_send_failed), 1, M_DONTWAIT, 1, MT_DATA);
2724         if (m_notify == NULL)
2725                 /* no space left */
2726                 return;
2727         m_notify->m_len = 0;
2728         ssf = mtod(m_notify, struct sctp_send_failed *);
2729         ssf->ssf_type = SCTP_SEND_FAILED;
2730         if (error == SCTP_NOTIFY_DATAGRAM_UNSENT)
2731                 ssf->ssf_flags = SCTP_DATA_UNSENT;
2732         else
2733                 ssf->ssf_flags = SCTP_DATA_SENT;
2734         ssf->ssf_length = length;
2735         ssf->ssf_error = error;
2736         /* not exactly what the user sent in, but should be close :) */
2737         ssf->ssf_info.sinfo_stream = chk->rec.data.stream_number;
2738         ssf->ssf_info.sinfo_ssn = chk->rec.data.stream_seq;
2739         ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags;
2740         ssf->ssf_info.sinfo_ppid = chk->rec.data.payloadtype;
2741         ssf->ssf_info.sinfo_context = chk->rec.data.context;
2742         ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
2743         ssf->ssf_assoc_id = sctp_get_associd(stcb);
2744         m_notify->m_next = chk->data;
2745         m_notify->m_flags |= M_NOTIFICATION;
2746         m_notify->m_pkthdr.len = length;
2747         m_notify->m_pkthdr.rcvif = 0;
2748         m_notify->m_len = sizeof(struct sctp_send_failed);
2749
2750         /* Steal off the mbuf */
2751         chk->data = NULL;
2752         /*
2753          * For this case, we check the actual socket buffer, since the assoc
2754          * is going away we don't want to overfill the socket buffer for a
2755          * non-reader
2756          */
2757         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < m_notify->m_len) {
2758                 sctp_m_freem(m_notify);
2759                 return;
2760         }
2761         /* append to socket */
2762         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2763             0, 0, 0, 0, 0, 0,
2764             m_notify);
2765         if (control == NULL) {
2766                 /* no memory */
2767                 sctp_m_freem(m_notify);
2768                 return;
2769         }
2770         sctp_add_to_readq(stcb->sctp_ep, stcb,
2771             control,
2772             &stcb->sctp_socket->so_rcv, 1);
2773 }
2774
2775
2776 static void
2777 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
2778     struct sctp_stream_queue_pending *sp)
2779 {
2780         struct mbuf *m_notify;
2781         struct sctp_send_failed *ssf;
2782         struct sctp_queued_to_read *control;
2783         int length;
2784
2785         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_RECVSENDFAILEVNT))
2786                 /* event not enabled */
2787                 return;
2788
2789         length = sizeof(struct sctp_send_failed) + sp->length;
2790         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 1, M_DONTWAIT, 1, MT_DATA);
2791         if (m_notify == NULL)
2792                 /* no space left */
2793                 return;
2794         m_notify->m_len = 0;
2795         ssf = mtod(m_notify, struct sctp_send_failed *);
2796         ssf->ssf_type = SCTP_SEND_FAILED;
2797         if (error == SCTP_NOTIFY_DATAGRAM_UNSENT)
2798                 ssf->ssf_flags = SCTP_DATA_UNSENT;
2799         else
2800                 ssf->ssf_flags = SCTP_DATA_SENT;
2801         ssf->ssf_length = length;
2802         ssf->ssf_error = error;
2803         /* not exactly what the user sent in, but should be close :) */
2804         ssf->ssf_info.sinfo_stream = sp->stream;
2805         ssf->ssf_info.sinfo_ssn = sp->strseq;
2806         ssf->ssf_info.sinfo_flags = sp->sinfo_flags;
2807         ssf->ssf_info.sinfo_ppid = sp->ppid;
2808         ssf->ssf_info.sinfo_context = sp->context;
2809         ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
2810         ssf->ssf_assoc_id = sctp_get_associd(stcb);
2811         m_notify->m_next = sp->data;
2812         m_notify->m_flags |= M_NOTIFICATION;
2813         m_notify->m_pkthdr.len = length;
2814         m_notify->m_pkthdr.rcvif = 0;
2815         m_notify->m_len = sizeof(struct sctp_send_failed);
2816
2817         /* Steal off the mbuf */
2818         sp->data = NULL;
2819         /*
2820          * For this case, we check the actual socket buffer, since the assoc
2821          * is going away we don't want to overfill the socket buffer for a
2822          * non-reader
2823          */
2824         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < m_notify->m_len) {
2825                 sctp_m_freem(m_notify);
2826                 return;
2827         }
2828         /* append to socket */
2829         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2830             0, 0, 0, 0, 0, 0,
2831             m_notify);
2832         if (control == NULL) {
2833                 /* no memory */
2834                 sctp_m_freem(m_notify);
2835                 return;
2836         }
2837         sctp_add_to_readq(stcb->sctp_ep, stcb,
2838             control,
2839             &stcb->sctp_socket->so_rcv, 1);
2840 }
2841
2842
2843
2844 static void
2845 sctp_notify_adaptation_layer(struct sctp_tcb *stcb,
2846     uint32_t error)
2847 {
2848         struct mbuf *m_notify;
2849         struct sctp_adaptation_event *sai;
2850         struct sctp_queued_to_read *control;
2851
2852         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_ADAPTATIONEVNT))
2853                 /* event not enabled */
2854                 return;
2855
2856         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 1, M_DONTWAIT, 1, MT_DATA);
2857         if (m_notify == NULL)
2858                 /* no space left */
2859                 return;
2860         m_notify->m_len = 0;
2861         sai = mtod(m_notify, struct sctp_adaptation_event *);
2862         sai->sai_type = SCTP_ADAPTATION_INDICATION;
2863         sai->sai_flags = 0;
2864         sai->sai_length = sizeof(struct sctp_adaptation_event);
2865         sai->sai_adaptation_ind = error;
2866         sai->sai_assoc_id = sctp_get_associd(stcb);
2867
2868         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
2869         m_notify->m_pkthdr.len = sizeof(struct sctp_adaptation_event);
2870         m_notify->m_pkthdr.rcvif = 0;
2871         m_notify->m_len = sizeof(struct sctp_adaptation_event);
2872         m_notify->m_next = NULL;
2873
2874         /* append to socket */
2875         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2876             0, 0, 0, 0, 0, 0,
2877             m_notify);
2878         if (control == NULL) {
2879                 /* no memory */
2880                 sctp_m_freem(m_notify);
2881                 return;
2882         }
2883         control->length = m_notify->m_len;
2884         /* not that we need this */
2885         control->tail_mbuf = m_notify;
2886         sctp_add_to_readq(stcb->sctp_ep, stcb,
2887             control,
2888             &stcb->sctp_socket->so_rcv, 1);
2889 }
2890
2891 /* This always must be called with the read-queue LOCKED in the INP */
2892 void
2893 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb,
2894     uint32_t error, int nolock)
2895 {
2896         struct mbuf *m_notify;
2897         struct sctp_pdapi_event *pdapi;
2898         struct sctp_queued_to_read *control;
2899         struct sockbuf *sb;
2900
2901         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_PDAPIEVNT))
2902                 /* event not enabled */
2903                 return;
2904
2905         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 1, M_DONTWAIT, 1, MT_DATA);
2906         if (m_notify == NULL)
2907                 /* no space left */
2908                 return;
2909         m_notify->m_len = 0;
2910         pdapi = mtod(m_notify, struct sctp_pdapi_event *);
2911         pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
2912         pdapi->pdapi_flags = 0;
2913         pdapi->pdapi_length = sizeof(struct sctp_pdapi_event);
2914         pdapi->pdapi_indication = error;
2915         pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
2916
2917         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
2918         m_notify->m_pkthdr.len = sizeof(struct sctp_pdapi_event);
2919         m_notify->m_pkthdr.rcvif = 0;
2920         m_notify->m_len = sizeof(struct sctp_pdapi_event);
2921         m_notify->m_next = NULL;
2922         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2923             0, 0, 0, 0, 0, 0,
2924             m_notify);
2925         if (control == NULL) {
2926                 /* no memory */
2927                 sctp_m_freem(m_notify);
2928                 return;
2929         }
2930         control->length = m_notify->m_len;
2931         /* not that we need this */
2932         control->tail_mbuf = m_notify;
2933         control->held_length = 0;
2934         control->length = 0;
2935         if (nolock == 0) {
2936                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
2937         }
2938         sb = &stcb->sctp_socket->so_rcv;
2939 #ifdef SCTP_SB_LOGGING
2940         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, m_notify->m_len);
2941 #endif
2942         sctp_sballoc(stcb, sb, m_notify);
2943 #ifdef SCTP_SB_LOGGING
2944         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
2945 #endif
2946         atomic_add_int(&control->length, m_notify->m_len);
2947         control->end_added = 1;
2948         if (stcb->asoc.control_pdapi)
2949                 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next);
2950         else {
2951                 /* we really should not see this case */
2952                 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next);
2953         }
2954         if (nolock == 0) {
2955                 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
2956         }
2957         if (stcb->sctp_ep && stcb->sctp_socket) {
2958                 /* This should always be the case */
2959                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2960         }
2961 }
2962
2963 static void
2964 sctp_notify_shutdown_event(struct sctp_tcb *stcb)
2965 {
2966         struct mbuf *m_notify;
2967         struct sctp_shutdown_event *sse;
2968         struct sctp_queued_to_read *control;
2969
2970         /*
2971          * For TCP model AND UDP connected sockets we will send an error up
2972          * when an SHUTDOWN completes
2973          */
2974         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2975             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
2976                 /* mark socket closed for read/write and wakeup! */
2977                 socantsendmore(stcb->sctp_socket);
2978         }
2979         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT))
2980                 /* event not enabled */
2981                 return;
2982
2983         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 1, M_DONTWAIT, 1, MT_DATA);
2984         if (m_notify == NULL)
2985                 /* no space left */
2986                 return;
2987         m_notify->m_len = 0;
2988         sse = mtod(m_notify, struct sctp_shutdown_event *);
2989         sse->sse_type = SCTP_SHUTDOWN_EVENT;
2990         sse->sse_flags = 0;
2991         sse->sse_length = sizeof(struct sctp_shutdown_event);
2992         sse->sse_assoc_id = sctp_get_associd(stcb);
2993
2994         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
2995         m_notify->m_pkthdr.len = sizeof(struct sctp_shutdown_event);
2996         m_notify->m_pkthdr.rcvif = 0;
2997         m_notify->m_len = sizeof(struct sctp_shutdown_event);
2998         m_notify->m_next = NULL;
2999
3000         /* append to socket */
3001         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3002             0, 0, 0, 0, 0, 0,
3003             m_notify);
3004         if (control == NULL) {
3005                 /* no memory */
3006                 sctp_m_freem(m_notify);
3007                 return;
3008         }
3009         control->length = m_notify->m_len;
3010         /* not that we need this */
3011         control->tail_mbuf = m_notify;
3012         sctp_add_to_readq(stcb->sctp_ep, stcb,
3013             control,
3014             &stcb->sctp_socket->so_rcv, 1);
3015 }
3016
3017 static void
3018 sctp_notify_stream_reset(struct sctp_tcb *stcb,
3019     int number_entries, uint16_t * list, int flag)
3020 {
3021         struct mbuf *m_notify;
3022         struct sctp_queued_to_read *control;
3023         struct sctp_stream_reset_event *strreset;
3024         int len;
3025
3026         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_STREAM_RESETEVNT))
3027                 /* event not enabled */
3028                 return;
3029
3030         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 1, M_DONTWAIT, 1, MT_DATA);
3031         if (m_notify == NULL)
3032                 /* no space left */
3033                 return;
3034         m_notify->m_len = 0;
3035         len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
3036         if (len > M_TRAILINGSPACE(m_notify)) {
3037                 /* never enough room */
3038                 sctp_m_freem(m_notify);
3039                 return;
3040         }
3041         strreset = mtod(m_notify, struct sctp_stream_reset_event *);
3042         strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
3043         if (number_entries == 0) {
3044                 strreset->strreset_flags = flag | SCTP_STRRESET_ALL_STREAMS;
3045         } else {
3046                 strreset->strreset_flags = flag | SCTP_STRRESET_STREAM_LIST;
3047         }
3048         strreset->strreset_length = len;
3049         strreset->strreset_assoc_id = sctp_get_associd(stcb);
3050         if (number_entries) {
3051                 int i;
3052
3053                 for (i = 0; i < number_entries; i++) {
3054                         strreset->strreset_list[i] = ntohs(list[i]);
3055                 }
3056         }
3057         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
3058         m_notify->m_pkthdr.len = len;
3059         m_notify->m_pkthdr.rcvif = 0;
3060         m_notify->m_len = len;
3061         m_notify->m_next = NULL;
3062         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < m_notify->m_len) {
3063                 /* no space */
3064                 sctp_m_freem(m_notify);
3065                 return;
3066         }
3067         /* append to socket */
3068         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3069             0, 0, 0, 0, 0, 0,
3070             m_notify);
3071         if (control == NULL) {
3072                 /* no memory */
3073                 sctp_m_freem(m_notify);
3074                 return;
3075         }
3076         control->length = m_notify->m_len;
3077         /* not that we need this */
3078         control->tail_mbuf = m_notify;
3079         sctp_add_to_readq(stcb->sctp_ep, stcb,
3080             control,
3081             &stcb->sctp_socket->so_rcv, 1);
3082 }
3083
3084
3085 void
3086 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb,
3087     uint32_t error, void *data)
3088 {
3089         if (stcb == NULL) {
3090                 /* unlikely but */
3091                 return;
3092         }
3093         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3094             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3095             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)
3096             ) {
3097                 /* No notifications up when we are in a no socket state */
3098                 return;
3099         }
3100         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
3101                 /* Can't send up to a closed socket any notifications */
3102                 return;
3103         }
3104         if (stcb && (stcb->asoc.assoc_up_sent == 0) && (notification != SCTP_NOTIFY_ASSOC_UP)) {
3105                 if ((notification != SCTP_NOTIFY_ASSOC_DOWN) &&
3106                     (notification != SCTP_NOTIFY_ASSOC_ABORTED) &&
3107                     (notification != SCTP_NOTIFY_SPECIAL_SP_FAIL) &&
3108                     (notification != SCTP_NOTIFY_DG_FAIL) &&
3109                     (notification != SCTP_NOTIFY_PEER_SHUTDOWN)) {
3110                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, 0, NULL);
3111                         stcb->asoc.assoc_up_sent = 1;
3112                 }
3113         }
3114         switch (notification) {
3115         case SCTP_NOTIFY_ASSOC_UP:
3116                 if (stcb->asoc.assoc_up_sent == 0) {
3117                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, NULL);
3118                         stcb->asoc.assoc_up_sent = 1;
3119                 }
3120                 break;
3121         case SCTP_NOTIFY_ASSOC_DOWN:
3122                 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, NULL);
3123                 break;
3124         case SCTP_NOTIFY_INTERFACE_DOWN:
3125                 {
3126                         struct sctp_nets *net;
3127
3128                         net = (struct sctp_nets *)data;
3129                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE,
3130                             (struct sockaddr *)&net->ro._l_addr, error);
3131                         break;
3132                 }
3133         case SCTP_NOTIFY_INTERFACE_UP:
3134                 {
3135                         struct sctp_nets *net;
3136
3137                         net = (struct sctp_nets *)data;
3138                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE,
3139                             (struct sockaddr *)&net->ro._l_addr, error);
3140                         break;
3141                 }
3142         case SCTP_NOTIFY_INTERFACE_CONFIRMED:
3143                 {
3144                         struct sctp_nets *net;
3145
3146                         net = (struct sctp_nets *)data;
3147                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED,
3148                             (struct sockaddr *)&net->ro._l_addr, error);
3149                         break;
3150                 }
3151         case SCTP_NOTIFY_SPECIAL_SP_FAIL:
3152                 sctp_notify_send_failed2(stcb, error,
3153                     (struct sctp_stream_queue_pending *)data);
3154                 break;
3155         case SCTP_NOTIFY_DG_FAIL:
3156                 sctp_notify_send_failed(stcb, error,
3157                     (struct sctp_tmit_chunk *)data);
3158                 break;
3159         case SCTP_NOTIFY_ADAPTATION_INDICATION:
3160                 /* Here the error is the adaptation indication */
3161                 sctp_notify_adaptation_layer(stcb, error);
3162                 break;
3163         case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION:
3164                 sctp_notify_partial_delivery_indication(stcb, error, 0);
3165                 break;
3166         case SCTP_NOTIFY_STRDATA_ERR:
3167                 break;
3168         case SCTP_NOTIFY_ASSOC_ABORTED:
3169                 sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, NULL);
3170                 break;
3171         case SCTP_NOTIFY_PEER_OPENED_STREAM:
3172                 break;
3173         case SCTP_NOTIFY_STREAM_OPENED_OK:
3174                 break;
3175         case SCTP_NOTIFY_ASSOC_RESTART:
3176                 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, data);
3177                 break;
3178         case SCTP_NOTIFY_HB_RESP:
3179                 break;
3180         case SCTP_NOTIFY_STR_RESET_SEND:
3181                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STRRESET_OUTBOUND_STR);
3182                 break;
3183         case SCTP_NOTIFY_STR_RESET_RECV:
3184                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STRRESET_INBOUND_STR);
3185                 break;
3186         case SCTP_NOTIFY_STR_RESET_FAILED_OUT:
3187                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), (SCTP_STRRESET_OUTBOUND_STR | SCTP_STRRESET_INBOUND_STR));
3188                 break;
3189
3190         case SCTP_NOTIFY_STR_RESET_FAILED_IN:
3191                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), (SCTP_STRRESET_INBOUND_STR | SCTP_STRRESET_INBOUND_STR));
3192                 break;
3193
3194         case SCTP_NOTIFY_ASCONF_ADD_IP:
3195                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data,
3196                     error);
3197                 break;
3198         case SCTP_NOTIFY_ASCONF_DELETE_IP:
3199                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data,
3200                     error);
3201                 break;
3202         case SCTP_NOTIFY_ASCONF_SET_PRIMARY:
3203                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data,
3204                     error);
3205                 break;
3206         case SCTP_NOTIFY_ASCONF_SUCCESS:
3207                 break;
3208         case SCTP_NOTIFY_ASCONF_FAILED:
3209                 break;
3210         case SCTP_NOTIFY_PEER_SHUTDOWN:
3211                 sctp_notify_shutdown_event(stcb);
3212                 break;
3213         case SCTP_NOTIFY_AUTH_NEW_KEY:
3214                 sctp_notify_authentication(stcb, SCTP_AUTH_NEWKEY, error,
3215                     (uint16_t) (uintptr_t) data);
3216                 break;
3217 #if 0
3218         case SCTP_NOTIFY_AUTH_KEY_CONFLICT:
3219                 sctp_notify_authentication(stcb, SCTP_AUTH_KEY_CONFLICT,
3220                     error, (uint16_t) (uintptr_t) data);
3221                 break;
3222 #endif                          /* not yet? remove? */
3223
3224
3225         default:
3226 #ifdef SCTP_DEBUG
3227                 if (sctp_debug_on & SCTP_DEBUG_UTIL1) {
3228                         printf("NOTIFY: unknown notification %xh (%u)\n",
3229                             notification, notification);
3230                 }
3231 #endif                          /* SCTP_DEBUG */
3232                 break;
3233         }                       /* end switch */
3234 }
3235
3236 void
3237 sctp_report_all_outbound(struct sctp_tcb *stcb)
3238 {
3239         struct sctp_association *asoc;
3240         struct sctp_stream_out *outs;
3241         struct sctp_tmit_chunk *chk;
3242         struct sctp_stream_queue_pending *sp;
3243
3244         asoc = &stcb->asoc;
3245
3246         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3247             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3248             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3249                 return;
3250         }
3251         /* now through all the gunk freeing chunks */
3252
3253         TAILQ_FOREACH(outs, &asoc->out_wheel, next_spoke) {
3254                 /* now clean up any chunks here */
3255                 stcb->asoc.locked_on_sending = NULL;
3256                 sp = TAILQ_FIRST(&outs->outqueue);
3257                 while (sp) {
3258                         stcb->asoc.stream_queue_cnt--;
3259                         TAILQ_REMOVE(&outs->outqueue, sp, next);
3260                         sctp_free_spbufspace(stcb, asoc, sp);
3261                         sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
3262                             SCTP_NOTIFY_DATAGRAM_UNSENT, (void *)sp);
3263                         if (sp->data) {
3264                                 sctp_m_freem(sp->data);
3265                                 sp->data = NULL;
3266                         }
3267                         if (sp->net)
3268                                 sctp_free_remote_addr(sp->net);
3269                         sp->net = NULL;
3270                         /* Free the chunk */
3271                         sctp_free_a_strmoq(stcb, sp);
3272                         sp = TAILQ_FIRST(&outs->outqueue);
3273                 }
3274         }
3275
3276         /* pending send queue SHOULD be empty */
3277         if (!TAILQ_EMPTY(&asoc->send_queue)) {
3278                 chk = TAILQ_FIRST(&asoc->send_queue);
3279                 while (chk) {
3280                         TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
3281                         if (chk->data) {
3282                                 /*
3283                                  * trim off the sctp chunk header(it should
3284                                  * be there)
3285                                  */
3286                                 if (chk->send_size >= sizeof(struct sctp_data_chunk)) {
3287                                         m_adj(chk->data, sizeof(struct sctp_data_chunk));
3288                                         sctp_mbuf_crush(chk->data);
3289                                 }
3290                         }
3291                         sctp_free_bufspace(stcb, asoc, chk, 1);
3292                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, SCTP_NOTIFY_DATAGRAM_UNSENT, chk);
3293                         if (chk->data) {
3294                                 sctp_m_freem(chk->data);
3295                                 chk->data = NULL;
3296                         }
3297                         if (chk->whoTo)
3298                                 sctp_free_remote_addr(chk->whoTo);
3299                         chk->whoTo = NULL;
3300                         sctp_free_a_chunk(stcb, chk);
3301                         chk = TAILQ_FIRST(&asoc->send_queue);
3302                 }
3303         }
3304         /* sent queue SHOULD be empty */
3305         if (!TAILQ_EMPTY(&asoc->sent_queue)) {
3306                 chk = TAILQ_FIRST(&asoc->sent_queue);
3307                 while (chk) {
3308                         TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
3309                         if (chk->data) {
3310                                 /*
3311                                  * trim off the sctp chunk header(it should
3312                                  * be there)
3313                                  */
3314                                 if (chk->send_size >= sizeof(struct sctp_data_chunk)) {
3315                                         m_adj(chk->data, sizeof(struct sctp_data_chunk));
3316                                         sctp_mbuf_crush(chk->data);
3317                                 }
3318                         }
3319                         sctp_free_bufspace(stcb, asoc, chk, 1);
3320                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
3321                             SCTP_NOTIFY_DATAGRAM_SENT, chk);
3322                         if (chk->data) {
3323                                 sctp_m_freem(chk->data);
3324                                 chk->data = NULL;
3325                         }
3326                         if (chk->whoTo)
3327                                 sctp_free_remote_addr(chk->whoTo);
3328                         chk->whoTo = NULL;
3329                         sctp_free_a_chunk(stcb, chk);
3330                         chk = TAILQ_FIRST(&asoc->sent_queue);
3331                 }
3332         }
3333 }
3334
3335 void
3336 sctp_abort_notification(struct sctp_tcb *stcb, int error)
3337 {
3338
3339         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3340             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3341             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3342                 return;
3343         }
3344         /* Tell them we lost the asoc */
3345         sctp_report_all_outbound(stcb);
3346         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
3347             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
3348             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
3349                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED;
3350         }
3351         sctp_ulp_notify(SCTP_NOTIFY_ASSOC_ABORTED, stcb, error, NULL);
3352 }
3353
3354 void
3355 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3356     struct mbuf *m, int iphlen, struct sctphdr *sh, struct mbuf *op_err)
3357 {
3358         uint32_t vtag;
3359
3360         vtag = 0;
3361         if (stcb != NULL) {
3362                 /* We have a TCB to abort, send notification too */
3363                 vtag = stcb->asoc.peer_vtag;
3364                 sctp_abort_notification(stcb, 0);
3365         }
3366         sctp_send_abort(m, iphlen, sh, vtag, op_err);
3367         if (stcb != NULL) {
3368                 /* Ok, now lets free it */
3369                 sctp_free_assoc(inp, stcb, 0);
3370         } else {
3371                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3372                         if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
3373                                 sctp_inpcb_free(inp, 1, 0);
3374                         }
3375                 }
3376         }
3377 }
3378
3379 void
3380 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3381     int error, struct mbuf *op_err)
3382 {
3383         uint32_t vtag;
3384
3385         if (stcb == NULL) {
3386                 /* Got to have a TCB */
3387                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3388                         if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
3389                                 sctp_inpcb_free(inp, 1, 0);
3390                         }
3391                 }
3392                 return;
3393         }
3394         vtag = stcb->asoc.peer_vtag;
3395         /* notify the ulp */
3396         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0)
3397                 sctp_abort_notification(stcb, error);
3398         /* notify the peer */
3399         sctp_send_abort_tcb(stcb, op_err);
3400         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3401         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
3402             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3403                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3404         }
3405         /* now free the asoc */
3406         sctp_free_assoc(inp, stcb, 0);
3407 }
3408
3409 void
3410 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh,
3411     struct sctp_inpcb *inp, struct mbuf *op_err)
3412 {
3413         struct sctp_chunkhdr *ch, chunk_buf;
3414         unsigned int chk_length;
3415
3416         SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue);
3417         /* Generate a TO address for future reference */
3418         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
3419                 if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
3420                         sctp_inpcb_free(inp, 1, 0);
3421                 }
3422         }
3423         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
3424             sizeof(*ch), (uint8_t *) & chunk_buf);
3425         while (ch != NULL) {
3426                 chk_length = ntohs(ch->chunk_length);
3427                 if (chk_length < sizeof(*ch)) {
3428                         /* break to abort land */
3429                         break;
3430                 }
3431                 switch (ch->chunk_type) {
3432                 case SCTP_PACKET_DROPPED:
3433                         /* we don't respond to pkt-dropped */
3434                         return;
3435                 case SCTP_ABORT_ASSOCIATION:
3436                         /* we don't respond with an ABORT to an ABORT */
3437                         return;
3438                 case SCTP_SHUTDOWN_COMPLETE:
3439                         /*
3440                          * we ignore it since we are not waiting for it and
3441                          * peer is gone
3442                          */
3443                         return;
3444                 case SCTP_SHUTDOWN_ACK:
3445                         sctp_send_shutdown_complete2(m, iphlen, sh);
3446                         return;
3447                 default:
3448                         break;
3449                 }
3450                 offset += SCTP_SIZE32(chk_length);
3451                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
3452                     sizeof(*ch), (uint8_t *) & chunk_buf);
3453         }
3454         sctp_send_abort(m, iphlen, sh, 0, op_err);
3455 }
3456
3457 /*
3458  * check the inbound datagram to make sure there is not an abort inside it,
3459  * if there is return 1, else return 0.
3460  */
3461 int
3462 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t * vtagfill)
3463 {
3464         struct sctp_chunkhdr *ch;
3465         struct sctp_init_chunk *init_chk, chunk_buf;
3466         int offset;
3467         unsigned int chk_length;
3468
3469         offset = iphlen + sizeof(struct sctphdr);
3470         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch),
3471             (uint8_t *) & chunk_buf);
3472         while (ch != NULL) {
3473                 chk_length = ntohs(ch->chunk_length);
3474                 if (chk_length < sizeof(*ch)) {
3475                         /* packet is probably corrupt */
3476                         break;
3477                 }
3478                 /* we seem to be ok, is it an abort? */
3479                 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) {
3480                         /* yep, tell them */
3481                         return (1);
3482                 }
3483                 if (ch->chunk_type == SCTP_INITIATION) {
3484                         /* need to update the Vtag */
3485                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
3486                             offset, sizeof(*init_chk), (uint8_t *) & chunk_buf);
3487                         if (init_chk != NULL) {
3488                                 *vtagfill = ntohl(init_chk->init.initiate_tag);
3489                         }
3490                 }
3491                 /* Nope, move to the next chunk */
3492                 offset += SCTP_SIZE32(chk_length);
3493                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
3494                     sizeof(*ch), (uint8_t *) & chunk_buf);
3495         }
3496         return (0);
3497 }
3498
3499 /*
3500  * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id
3501  * set (i.e. it's 0) so, create this function to compare link local scopes
3502  */
3503 uint32_t
3504 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2)
3505 {
3506         struct sockaddr_in6 a, b;
3507
3508         /* save copies */
3509         a = *addr1;
3510         b = *addr2;
3511
3512         if (a.sin6_scope_id == 0)
3513                 if (sa6_recoverscope(&a)) {
3514                         /* can't get scope, so can't match */
3515                         return (0);
3516                 }
3517         if (b.sin6_scope_id == 0)
3518                 if (sa6_recoverscope(&b)) {
3519                         /* can't get scope, so can't match */
3520                         return (0);
3521                 }
3522         if (a.sin6_scope_id != b.sin6_scope_id)
3523                 return (0);
3524
3525         return (1);
3526 }
3527
3528 /*
3529  * returns a sockaddr_in6 with embedded scope recovered and removed
3530  */
3531 struct sockaddr_in6 *
3532 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store)
3533 {
3534
3535         /* check and strip embedded scope junk */
3536         if (addr->sin6_family == AF_INET6) {
3537                 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) {
3538                         if (addr->sin6_scope_id == 0) {
3539                                 *store = *addr;
3540                                 if (!sa6_recoverscope(store)) {
3541                                         /* use the recovered scope */
3542                                         addr = store;
3543                                 }
3544                                 /* else, return the original "to" addr */
3545                         }
3546                 }
3547         }
3548         return (addr);
3549 }
3550
3551 /*
3552  * are the two addresses the same?  currently a "scopeless" check returns: 1
3553  * if same, 0 if not
3554  */
3555 __inline int
3556 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2)
3557 {
3558
3559         /* must be valid */
3560         if (sa1 == NULL || sa2 == NULL)
3561                 return (0);
3562
3563         /* must be the same family */
3564         if (sa1->sa_family != sa2->sa_family)
3565                 return (0);
3566
3567         if (sa1->sa_family == AF_INET6) {
3568                 /* IPv6 addresses */
3569                 struct sockaddr_in6 *sin6_1, *sin6_2;
3570
3571                 sin6_1 = (struct sockaddr_in6 *)sa1;
3572                 sin6_2 = (struct sockaddr_in6 *)sa2;
3573                 return (SCTP6_ARE_ADDR_EQUAL(&sin6_1->sin6_addr,
3574                     &sin6_2->sin6_addr));
3575         } else if (sa1->sa_family == AF_INET) {
3576                 /* IPv4 addresses */
3577                 struct sockaddr_in *sin_1, *sin_2;
3578
3579                 sin_1 = (struct sockaddr_in *)sa1;
3580                 sin_2 = (struct sockaddr_in *)sa2;
3581                 return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr);
3582         } else {
3583                 /* we don't do these... */
3584                 return (0);
3585         }
3586 }
3587
3588 void
3589 sctp_print_address(struct sockaddr *sa)
3590 {
3591
3592         if (sa->sa_family == AF_INET6) {
3593                 struct sockaddr_in6 *sin6;
3594
3595                 sin6 = (struct sockaddr_in6 *)sa;
3596                 printf("IPv6 address: %s:%d scope:%u\n",
3597                     ip6_sprintf(&sin6->sin6_addr), ntohs(sin6->sin6_port),
3598                     sin6->sin6_scope_id);
3599         } else if (sa->sa_family == AF_INET) {
3600                 struct sockaddr_in *sin;
3601                 unsigned char *p;
3602
3603                 sin = (struct sockaddr_in *)sa;
3604                 p = (unsigned char *)&sin->sin_addr;
3605                 printf("IPv4 address: %u.%u.%u.%u:%d\n",
3606                     p[0], p[1], p[2], p[3], ntohs(sin->sin_port));
3607         } else {
3608                 printf("?\n");
3609         }
3610 }
3611
3612 void
3613 sctp_print_address_pkt(struct ip *iph, struct sctphdr *sh)
3614 {
3615         if (iph->ip_v == IPVERSION) {
3616                 struct sockaddr_in lsa, fsa;
3617
3618                 bzero(&lsa, sizeof(lsa));
3619                 lsa.sin_len = sizeof(lsa);
3620                 lsa.sin_family = AF_INET;
3621                 lsa.sin_addr = iph->ip_src;
3622                 lsa.sin_port = sh->src_port;
3623                 bzero(&fsa, sizeof(fsa));
3624                 fsa.sin_len = sizeof(fsa);
3625                 fsa.sin_family = AF_INET;
3626                 fsa.sin_addr = iph->ip_dst;
3627                 fsa.sin_port = sh->dest_port;
3628                 printf("src: ");
3629                 sctp_print_address((struct sockaddr *)&lsa);
3630                 printf("dest: ");
3631                 sctp_print_address((struct sockaddr *)&fsa);
3632         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
3633                 struct ip6_hdr *ip6;
3634                 struct sockaddr_in6 lsa6, fsa6;
3635
3636                 ip6 = (struct ip6_hdr *)iph;
3637                 bzero(&lsa6, sizeof(lsa6));
3638                 lsa6.sin6_len = sizeof(lsa6);
3639                 lsa6.sin6_family = AF_INET6;
3640                 lsa6.sin6_addr = ip6->ip6_src;
3641                 lsa6.sin6_port = sh->src_port;
3642                 bzero(&fsa6, sizeof(fsa6));
3643                 fsa6.sin6_len = sizeof(fsa6);
3644                 fsa6.sin6_family = AF_INET6;
3645                 fsa6.sin6_addr = ip6->ip6_dst;
3646                 fsa6.sin6_port = sh->dest_port;
3647                 printf("src: ");
3648                 sctp_print_address((struct sockaddr *)&lsa6);
3649                 printf("dest: ");
3650                 sctp_print_address((struct sockaddr *)&fsa6);
3651         }
3652 }
3653
3654 #if defined(HAVE_SCTP_SO_LASTRECORD)
3655
3656 /* cloned from uipc_socket.c */
3657
3658 #define SCTP_SBLINKRECORD(sb, m0) do {                                  \
3659         if ((sb)->sb_lastrecord != NULL)                                \
3660                 (sb)->sb_lastrecord->m_nextpkt = (m0);                  \
3661         else                                                            \
3662                 (sb)->sb_mb = (m0);                                     \
3663         (sb)->sb_lastrecord = (m0);                                     \
3664 } while (/*CONSTCOND*/0)
3665 #endif
3666
3667 void
3668 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
3669     struct sctp_inpcb *new_inp,
3670     struct sctp_tcb *stcb)
3671 {
3672         /*
3673          * go through our old INP and pull off any control structures that
3674          * belong to stcb and move then to the new inp.
3675          */
3676         struct socket *old_so, *new_so;
3677         struct sctp_queued_to_read *control, *nctl;
3678         struct sctp_readhead tmp_queue;
3679         struct mbuf *m;
3680         int error;
3681
3682         old_so = old_inp->sctp_socket;
3683         new_so = new_inp->sctp_socket;
3684         TAILQ_INIT(&tmp_queue);
3685
3686         SOCKBUF_LOCK(&(old_so->so_rcv));
3687
3688         error = sblock(&old_so->so_rcv, 0);
3689
3690         SOCKBUF_UNLOCK(&(old_so->so_rcv));
3691         if (error) {
3692                 /*
3693                  * Gak, can't get sblock, we have a problem. data will be
3694                  * left stranded.. and we don't dare look at it since the
3695                  * other thread may be reading something. Oh well, its a
3696                  * screwed up app that does a peeloff OR a accept while
3697                  * reading from the main socket... actually its only the
3698                  * peeloff() case, since I think read will fail on a
3699                  * listening socket..
3700                  */
3701                 return;
3702         }
3703         /* lock the socket buffers */
3704         SCTP_INP_READ_LOCK(old_inp);
3705         control = TAILQ_FIRST(&old_inp->read_queue);
3706         /* Pull off all for out target stcb */
3707         while (control) {
3708                 nctl = TAILQ_NEXT(control, next);
3709                 if (control->stcb == stcb) {
3710                         /* remove it we want it */
3711                         TAILQ_REMOVE(&old_inp->read_queue, control, next);
3712                         TAILQ_INSERT_TAIL(&tmp_queue, control, next);
3713                         m = control->data;
3714                         while (m) {
3715 #ifdef SCTP_SB_LOGGING
3716                                 sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, m->m_len);
3717 #endif
3718                                 sctp_sbfree(control, stcb, &old_so->so_rcv, m);
3719 #ifdef SCTP_SB_LOGGING
3720                                 sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3721 #endif
3722                                 m = m->m_next;
3723                         }
3724                 }
3725                 control = nctl;
3726         }
3727         SCTP_INP_READ_UNLOCK(old_inp);
3728
3729         /* Remove the sb-lock on the old socket */
3730         SOCKBUF_LOCK(&(old_so->so_rcv));
3731
3732         sbunlock(&old_so->so_rcv);
3733         SOCKBUF_UNLOCK(&(old_so->so_rcv));
3734
3735         /* Now we move them over to the new socket buffer */
3736         control = TAILQ_FIRST(&tmp_queue);
3737         SCTP_INP_READ_LOCK(new_inp);
3738         while (control) {
3739                 nctl = TAILQ_NEXT(control, next);
3740                 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next);
3741                 m = control->data;
3742                 while (m) {
3743 #ifdef SCTP_SB_LOGGING
3744                         sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, m->m_len);
3745 #endif
3746                         sctp_sballoc(stcb, &new_so->so_rcv, m);
3747 #ifdef SCTP_SB_LOGGING
3748                         sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3749 #endif
3750                         m = m->m_next;
3751                 }
3752                 control = nctl;
3753         }
3754         SCTP_INP_READ_UNLOCK(new_inp);
3755 }
3756
3757
3758 void
3759 sctp_add_to_readq(struct sctp_inpcb *inp,
3760     struct sctp_tcb *stcb,
3761     struct sctp_queued_to_read *control,
3762     struct sockbuf *sb,
3763     int end)
3764 {
3765         /*
3766          * Here we must place the control on the end of the socket read
3767          * queue AND increment sb_cc so that select will work properly on
3768          * read.
3769          */
3770         struct mbuf *m, *prev = NULL;
3771
3772         if (inp == NULL) {
3773                 /* Gak, TSNH!! */
3774 #ifdef INVARIENTS
3775                 panic("Gak, inp NULL on add_to_readq");
3776 #endif
3777                 return;
3778         }
3779         SCTP_INP_READ_LOCK(inp);
3780         m = control->data;
3781         control->held_length = 0;
3782         control->length = 0;
3783         while (m) {
3784                 if (m->m_len == 0) {
3785                         /* Skip mbufs with NO length */
3786                         if (prev == NULL) {
3787                                 /* First one */
3788                                 control->data = sctp_m_free(m);
3789                                 m = control->data;
3790                         } else {
3791                                 prev->m_next = sctp_m_free(m);
3792                                 m = prev->m_next;
3793                         }
3794                         if (m == NULL) {
3795                                 control->tail_mbuf = prev;;
3796                         }
3797                         continue;
3798                 }
3799                 prev = m;
3800 #ifdef SCTP_SB_LOGGING
3801                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, m->m_len);
3802 #endif
3803                 sctp_sballoc(stcb, sb, m);
3804 #ifdef SCTP_SB_LOGGING
3805                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3806 #endif
3807                 atomic_add_int(&control->length, m->m_len);
3808                 m = m->m_next;
3809         }
3810         if (prev != NULL) {
3811                 control->tail_mbuf = prev;
3812                 if (end) {
3813                         prev->m_flags |= M_EOR;
3814                 }
3815         } else {
3816                 return;
3817         }
3818         if (end) {
3819                 control->end_added = 1;
3820         }
3821         TAILQ_INSERT_TAIL(&inp->read_queue, control, next);
3822         SCTP_INP_READ_UNLOCK(inp);
3823         if (inp && inp->sctp_socket) {
3824                 sctp_sorwakeup(inp, inp->sctp_socket);
3825         }
3826 }
3827
3828
3829 int
3830 sctp_append_to_readq(struct sctp_inpcb *inp,
3831     struct sctp_tcb *stcb,
3832     struct sctp_queued_to_read *control,
3833     struct mbuf *m,
3834     int end,
3835     int ctls_cumack,
3836     struct sockbuf *sb)
3837 {
3838         /*
3839          * A partial delivery API event is underway. OR we are appending on
3840          * the reassembly queue.
3841          *
3842          * If PDAPI this means we need to add m to the end of the data.
3843          * Increase the length in the control AND increment the sb_cc.
3844          * Otherwise sb is NULL and all we need to do is put it at the end
3845          * of the mbuf chain.
3846          */
3847         int len = 0;
3848         struct mbuf *mm, *tail = NULL, *prev = NULL;
3849
3850         if (inp) {
3851                 SCTP_INP_READ_LOCK(inp);
3852         }
3853         if (control == NULL) {
3854 get_out:
3855                 if (inp) {
3856                         SCTP_INP_READ_UNLOCK(inp);
3857                 }
3858                 return (-1);
3859         }
3860         if ((control->tail_mbuf) &&
3861             (control->tail_mbuf->m_flags & M_EOR)) {
3862                 /* huh this one is complete? */
3863                 goto get_out;
3864         }
3865         mm = m;
3866         if (mm == NULL) {
3867                 goto get_out;
3868         }
3869         while (mm) {
3870                 if (mm->m_len == 0) {
3871                         /* Skip mbufs with NO lenght */
3872                         if (prev == NULL) {
3873                                 /* First one */
3874                                 m = sctp_m_free(mm);
3875                                 mm = m;
3876                         } else {
3877                                 prev->m_next = sctp_m_free(mm);
3878                                 mm = prev->m_next;
3879                         }
3880                         continue;
3881                 }
3882                 prev = mm;
3883                 len += mm->m_len;
3884                 if (sb) {
3885 #ifdef SCTP_SB_LOGGING
3886                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, mm->m_len);
3887 #endif
3888                         sctp_sballoc(stcb, sb, mm);
3889 #ifdef SCTP_SB_LOGGING
3890                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3891 #endif
3892                 }
3893                 mm = mm->m_next;
3894         }
3895         if (prev) {
3896                 tail = prev;
3897         } else {
3898                 /* Really there should always be a prev */
3899                 if (m == NULL) {
3900                         /* Huh nothing left? */
3901 #ifdef INVARIENTS
3902                         panic("Nothing left to add?");
3903 #else
3904                         goto get_out;
3905 #endif
3906                 }
3907                 tail = m;
3908         }
3909         if (end) {
3910                 /* message is complete */
3911                 tail->m_flags |= M_EOR;
3912                 if (control == stcb->asoc.control_pdapi) {
3913                         stcb->asoc.control_pdapi = NULL;
3914                 }
3915                 control->held_length = 0;
3916                 control->end_added = 1;
3917         }
3918         atomic_add_int(&control->length, len);
3919         if (control->tail_mbuf) {
3920                 /* append */
3921                 control->tail_mbuf->m_next = m;
3922                 control->tail_mbuf = tail;
3923         } else {
3924                 /* nothing there */
3925 #ifdef INVARIENTS
3926                 if (control->data != NULL) {
3927                         panic("This should NOT happen");
3928                 }
3929 #endif
3930                 control->data = m;
3931                 control->tail_mbuf = tail;
3932         }
3933         /*
3934          * When we are appending in partial delivery, the cum-ack is used
3935          * for the actual pd-api highest tsn on this mbuf. The true cum-ack
3936          * is populated in the outbound sinfo structure from the true cumack
3937          * if the association exists...
3938          */
3939         control->sinfo_tsn = control->sinfo_cumtsn = ctls_cumack;
3940         if (inp) {
3941                 SCTP_INP_READ_UNLOCK(inp);
3942         }
3943         if (inp && inp->sctp_socket) {
3944                 sctp_sorwakeup(inp, inp->sctp_socket);
3945         }
3946         return (0);
3947 }
3948
3949
3950
3951 /*************HOLD THIS COMMENT FOR PATCH FILE OF
3952  *************ALTERNATE ROUTING CODE
3953  */
3954
3955 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF
3956  *************ALTERNATE ROUTING CODE
3957  */
3958
3959 struct mbuf *
3960 sctp_generate_invmanparam(int err)
3961 {
3962         /* Return a MBUF with a invalid mandatory parameter */
3963         struct mbuf *m;
3964
3965         m = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_DONTWAIT, 1, MT_DATA);
3966         if (m) {
3967                 struct sctp_paramhdr *ph;
3968
3969                 m->m_len = sizeof(struct sctp_paramhdr);
3970                 ph = mtod(m, struct sctp_paramhdr *);
3971                 ph->param_length = htons(sizeof(struct sctp_paramhdr));
3972                 ph->param_type = htons(err);
3973         }
3974         return (m);
3975 }
3976
3977 #ifdef SCTP_MBCNT_LOGGING
3978 void
3979 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc,
3980     struct sctp_tmit_chunk *tp1, int chk_cnt)
3981 {
3982         if (tp1->data == NULL) {
3983                 return;
3984         }
3985         asoc->chunks_on_out_queue -= chk_cnt;
3986         sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE,
3987             asoc->total_output_queue_size,
3988             tp1->book_size,
3989             0,
3990             tp1->mbcnt);
3991         if (asoc->total_output_queue_size >= tp1->book_size) {
3992                 asoc->total_output_queue_size -= tp1->book_size;
3993         } else {
3994                 asoc->total_output_queue_size = 0;
3995         }
3996
3997         if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) ||
3998             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) {
3999                 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) {
4000                         stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size;
4001                 } else {
4002                         stcb->sctp_socket->so_snd.sb_cc = 0;
4003
4004                 }
4005         }
4006 }
4007
4008 #endif
4009
4010 int
4011 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1,
4012     int reason, struct sctpchunk_listhead *queue)
4013 {
4014         int ret_sz = 0;
4015         int notdone;
4016         uint8_t foundeom = 0;
4017
4018         do {
4019                 ret_sz += tp1->book_size;
4020                 tp1->sent = SCTP_FORWARD_TSN_SKIP;
4021                 if (tp1->data) {
4022                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4023                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, reason, tp1);
4024                         sctp_m_freem(tp1->data);
4025                         tp1->data = NULL;
4026                         sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
4027                 }
4028                 if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
4029                         stcb->asoc.sent_queue_cnt_removeable--;
4030                 }
4031                 if (queue == &stcb->asoc.send_queue) {
4032                         TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next);
4033                         /* on to the sent queue */
4034                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1,
4035                             sctp_next);
4036                         stcb->asoc.sent_queue_cnt++;
4037                 }
4038                 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
4039                     SCTP_DATA_NOT_FRAG) {
4040                         /* not frag'ed we ae done   */
4041                         notdone = 0;
4042                         foundeom = 1;
4043                 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4044                         /* end of frag, we are done */
4045                         notdone = 0;
4046                         foundeom = 1;
4047                 } else {
4048                         /*
4049                          * Its a begin or middle piece, we must mark all of
4050                          * it
4051                          */
4052                         notdone = 1;
4053                         tp1 = TAILQ_NEXT(tp1, sctp_next);
4054                 }
4055         } while (tp1 && notdone);
4056         if ((foundeom == 0) && (queue == &stcb->asoc.sent_queue)) {
4057                 /*
4058                  * The multi-part message was scattered across the send and
4059                  * sent queue.
4060                  */
4061                 tp1 = TAILQ_FIRST(&stcb->asoc.send_queue);
4062                 /*
4063                  * recurse throught the send_queue too, starting at the
4064                  * beginning.
4065                  */
4066                 if (tp1) {
4067                         ret_sz += sctp_release_pr_sctp_chunk(stcb, tp1, reason,
4068                             &stcb->asoc.send_queue);
4069                 } else {
4070                         printf("hmm, nothing on the send queue and no EOM?\n");
4071                 }
4072         }
4073         return (ret_sz);
4074 }
4075
4076 /*
4077  * checks to see if the given address, sa, is one that is currently known by
4078  * the kernel note: can't distinguish the same address on multiple interfaces
4079  * and doesn't handle multiple addresses with different zone/scope id's note:
4080  * ifa_ifwithaddr() compares the entire sockaddr struct
4081  */
4082 struct ifaddr *
4083 sctp_find_ifa_by_addr(struct sockaddr *sa)
4084 {
4085         struct ifnet *ifn;
4086         struct ifaddr *ifa;
4087
4088         /* go through all our known interfaces */
4089         TAILQ_FOREACH(ifn, &ifnet, if_list) {
4090                 /* go through each interface addresses */
4091                 TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
4092                         /* correct family? */
4093                         if (ifa->ifa_addr->sa_family != sa->sa_family)
4094                                 continue;
4095
4096 #ifdef INET6
4097                         if (ifa->ifa_addr->sa_family == AF_INET6) {
4098                                 /* IPv6 address */
4099                                 struct sockaddr_in6 *sin1, *sin2, sin6_tmp;
4100
4101                                 sin1 = (struct sockaddr_in6 *)ifa->ifa_addr;
4102                                 if (IN6_IS_SCOPE_LINKLOCAL(&sin1->sin6_addr)) {
4103                                         /* create a copy and clear scope */
4104                                         memcpy(&sin6_tmp, sin1,
4105                                             sizeof(struct sockaddr_in6));
4106                                         sin1 = &sin6_tmp;
4107                                         in6_clearscope(&sin1->sin6_addr);
4108                                 }
4109                                 sin2 = (struct sockaddr_in6 *)sa;
4110                                 if (memcmp(&sin1->sin6_addr, &sin2->sin6_addr,
4111                                     sizeof(struct in6_addr)) == 0) {
4112                                         /* found it */
4113                                         return (ifa);
4114                                 }
4115                         } else
4116 #endif
4117                         if (ifa->ifa_addr->sa_family == AF_INET) {
4118                                 /* IPv4 address */
4119                                 struct sockaddr_in *sin1, *sin2;
4120
4121                                 sin1 = (struct sockaddr_in *)ifa->ifa_addr;
4122                                 sin2 = (struct sockaddr_in *)sa;
4123                                 if (sin1->sin_addr.s_addr ==
4124                                     sin2->sin_addr.s_addr) {
4125                                         /* found it */
4126                                         return (ifa);
4127                                 }
4128                         }
4129                         /* else, not AF_INET or AF_INET6, so skip */
4130                 }               /* end foreach ifa */
4131         }                       /* end foreach ifn */
4132         /* not found! */
4133         return (NULL);
4134 }
4135
4136
4137
4138
4139
4140
4141
4142
4143 static void
4144 sctp_user_rcvd(struct sctp_tcb *stcb, int *freed_so_far, int hold_rlock,
4145     uint32_t rwnd_req)
4146 {
4147         /* User pulled some data, do we need a rwnd update? */
4148         int r_unlocked = 0;
4149         uint32_t dif, rwnd;
4150         struct socket *so = NULL;
4151
4152         if (stcb == NULL)
4153                 return;
4154
4155         atomic_add_int(&stcb->asoc.refcnt, 1);
4156
4157         if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
4158                 /* Pre-check If we are freeing no update */
4159                 goto no_lock;
4160         }
4161         SCTP_INP_INCR_REF(stcb->sctp_ep);
4162         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
4163             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
4164                 goto out;
4165         }
4166         so = stcb->sctp_socket;
4167         if (so == NULL) {
4168                 goto out;
4169         }
4170         atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far);
4171         /* Have you have freed enough to look */
4172 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4173         sctp_misc_ints(SCTP_ENTER_USER_RECV,
4174             (stcb->asoc.my_rwnd - stcb->asoc.my_last_reported_rwnd),
4175             *freed_so_far,
4176             stcb->freed_by_sorcv_sincelast,
4177             rwnd_req);
4178 #endif
4179         *freed_so_far = 0;
4180         /* Yep, its worth a look and the lock overhead */
4181
4182         /* Figure out what the rwnd would be */
4183         rwnd = sctp_calc_rwnd(stcb, &stcb->asoc);
4184         if (rwnd >= stcb->asoc.my_last_reported_rwnd) {
4185                 dif = rwnd - stcb->asoc.my_last_reported_rwnd;
4186         } else {
4187                 dif = 0;
4188         }
4189         if (dif >= rwnd_req) {
4190                 if (hold_rlock) {
4191                         SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
4192                         r_unlocked = 1;
4193                 }
4194                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
4195                         /*
4196                          * One last check before we allow the guy possibly
4197                          * to get in. There is a race, where the guy has not
4198                          * reached the gate. In that case
4199                          */
4200                         goto out;
4201                 }
4202                 SCTP_TCB_LOCK(stcb);
4203                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
4204                         /* No reports here */
4205                         SCTP_TCB_UNLOCK(stcb);
4206                         goto out;
4207                 }
4208 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4209                 sctp_misc_ints(SCTP_USER_RECV_SACKS,
4210                     stcb->asoc.my_rwnd,
4211                     stcb->asoc.my_last_reported_rwnd,
4212                     stcb->freed_by_sorcv_sincelast,
4213                     dif);
4214 #endif
4215                 SCTP_STAT_INCR(sctps_wu_sacks_sent);
4216                 sctp_send_sack(stcb);
4217                 sctp_chunk_output(stcb->sctp_ep, stcb,
4218                     SCTP_OUTPUT_FROM_USR_RCVD);
4219                 /* make sure no timer is running */
4220                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL);
4221                 SCTP_TCB_UNLOCK(stcb);
4222         } else {
4223                 /* Update how much we have pending */
4224                 stcb->freed_by_sorcv_sincelast = dif;
4225 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4226                 sctp_misc_ints(SCTP_USER_RECV_SACKS,
4227                     stcb->asoc.my_rwnd,
4228                     stcb->asoc.my_last_reported_rwnd,
4229                     stcb->freed_by_sorcv_sincelast,
4230                     0);
4231 #endif
4232         }
4233 out:
4234         if (so && r_unlocked && hold_rlock) {
4235                 SCTP_STAT_INCR(sctps_locks_in_rcv);
4236                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
4237         }
4238         SCTP_INP_DECR_REF(stcb->sctp_ep);
4239 no_lock:
4240         atomic_add_int(&stcb->asoc.refcnt, -1);
4241         return;
4242 }
4243
4244 int
4245 sctp_sorecvmsg(struct socket *so,
4246     struct uio *uio,
4247     struct mbuf **mp,
4248     struct sockaddr *from,
4249     int fromlen,
4250     int *msg_flags,
4251     struct sctp_sndrcvinfo *sinfo,
4252     int filling_sinfo)
4253 {
4254         /*
4255          * MSG flags we will look at MSG_DONTWAIT - non-blocking IO.
4256          * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy
4257          * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ??
4258          * On the way out we may send out any combination of:
4259          * MSG_NOTIFICATION MSG_EOR
4260          *
4261          */
4262         struct sctp_inpcb *inp = NULL;
4263         int my_len = 0;
4264         int cp_len = 0, error = 0;
4265         struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
4266         struct mbuf *m = NULL, *embuf = NULL;
4267         struct sctp_tcb *stcb = NULL;
4268         int wakeup_read_socket = 0;
4269         int freecnt_applied = 0;
4270         int out_flags = 0, in_flags = 0;
4271         int block_allowed = 1;
4272         int freed_so_far = 0;
4273         int copied_so_far = 0;
4274         int s, in_eeor_mode = 0;
4275         int no_rcv_needed = 0;
4276         uint32_t rwnd_req = 0;
4277         int hold_sblock = 0;
4278         int hold_rlock = 0;
4279         int alen = 0, slen = 0;
4280         int held_length = 0;
4281
4282         if (msg_flags) {
4283                 in_flags = *msg_flags;
4284         } else {
4285                 in_flags = 0;
4286         }
4287         slen = uio->uio_resid;
4288         /* Pull in and set up our int flags */
4289         if (in_flags & MSG_OOB) {
4290                 /* Out of band's NOT supported */
4291                 return (EOPNOTSUPP);
4292         }
4293         if ((in_flags & MSG_PEEK) && (mp != NULL)) {
4294                 return (EINVAL);
4295         }
4296         if ((in_flags & (MSG_DONTWAIT
4297             | MSG_NBIO
4298             )) ||
4299             (so->so_state & SS_NBIO)) {
4300                 block_allowed = 0;
4301         }
4302         /* setup the endpoint */
4303         inp = (struct sctp_inpcb *)so->so_pcb;
4304         if (inp == NULL) {
4305                 return (EFAULT);
4306         }
4307         s = splnet();
4308         rwnd_req = (so->so_rcv.sb_hiwat >> SCTP_RWND_HIWAT_SHIFT);
4309         /* Must be at least a MTU's worth */
4310         if (rwnd_req < SCTP_MIN_RWND)
4311                 rwnd_req = SCTP_MIN_RWND;
4312         in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
4313 #ifdef SCTP_RECV_RWND_LOGGING
4314         sctp_misc_ints(SCTP_SORECV_ENTER,
4315             rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, uio->uio_resid);
4316 #endif
4317         SOCKBUF_LOCK(&so->so_rcv);
4318         hold_sblock = 1;
4319 #ifdef SCTP_RECV_RWND_LOGGING
4320         sctp_misc_ints(SCTP_SORECV_ENTERPL,
4321             rwnd_req, block_allowed, so->so_rcv.sb_cc, uio->uio_resid);
4322 #endif
4323
4324
4325         error = sblock(&so->so_rcv, (block_allowed ? M_WAITOK : 0));
4326         if (error) {
4327                 goto release_unlocked;
4328         }
4329 restart:
4330         if (hold_sblock == 0) {
4331                 SOCKBUF_LOCK(&so->so_rcv);
4332                 hold_sblock = 1;
4333         }
4334         sbunlock(&so->so_rcv);
4335
4336 restart_nosblocks:
4337         if (hold_sblock == 0) {
4338                 SOCKBUF_LOCK(&so->so_rcv);
4339                 hold_sblock = 1;
4340         }
4341         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
4342             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
4343                 goto out;
4344         }
4345         if (so->so_error || so->so_rcv.sb_state & SBS_CANTRCVMORE) {
4346                 if (so->so_error) {
4347                         error = so->so_error;
4348                 } else {
4349                         error = ENOTCONN;
4350                 }
4351                 goto out;
4352         }
4353         if ((so->so_rcv.sb_cc <= held_length) && block_allowed) {
4354                 /* we need to wait for data */
4355 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4356                 sctp_misc_ints(SCTP_SORECV_BLOCKSA,
4357                     0, 0, so->so_rcv.sb_cc, uio->uio_resid);
4358 #endif
4359                 if ((so->so_rcv.sb_cc == 0) &&
4360                     ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
4361                     (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) {
4362                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
4363                                 /*
4364                                  * For active open side clear flags for
4365                                  * re-use passive open is blocked by
4366                                  * connect.
4367                                  */
4368                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
4369                                         /*
4370                                          * You were aborted, passive side
4371                                          * always hits here
4372                                          */
4373                                         error = ECONNRESET;
4374                                         /*
4375                                          * You get this once if you are
4376                                          * active open side
4377                                          */
4378                                         if (!(inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
4379                                                 /*
4380                                                  * Remove flag if on the
4381                                                  * active open side
4382                                                  */
4383                                                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_WAS_ABORTED;
4384                                         }
4385                                 }
4386                                 so->so_state &= ~(SS_ISCONNECTING |
4387                                     SS_ISDISCONNECTING |
4388                                     SS_ISCONFIRMING |
4389                                     SS_ISCONNECTED);
4390                                 if (error == 0) {
4391                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
4392                                                 error = ENOTCONN;
4393                                         } else {
4394                                                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_WAS_CONNECTED;
4395                                         }
4396                                 }
4397                                 goto out;
4398                         }
4399                 }
4400                 error = sbwait(&so->so_rcv);
4401                 if (error) {
4402                         goto out;
4403                 }
4404                 held_length = 0;
4405                 goto restart_nosblocks;
4406         } else if (so->so_rcv.sb_cc == 0) {
4407                 error = EWOULDBLOCK;
4408                 goto out;
4409         }
4410         error = sblock(&so->so_rcv, (block_allowed ? M_WAITOK : 0));
4411         /* we possibly have data we can read */
4412         control = TAILQ_FIRST(&inp->read_queue);
4413         if (control == NULL) {
4414                 /*
4415                  * This could be happening since the appender did the
4416                  * increment but as not yet did the tailq insert onto the
4417                  * read_queue
4418                  */
4419                 if (hold_rlock == 0) {
4420                         SCTP_INP_READ_LOCK(inp);
4421                         hold_rlock = 1;
4422                 }
4423                 control = TAILQ_FIRST(&inp->read_queue);
4424                 if ((control == NULL) && (so->so_rcv.sb_cc != 0)) {
4425 #ifdef INVARIENTS
4426                         panic("Huh, its non zero and nothing on control?");
4427 #endif
4428                         so->so_rcv.sb_cc = 0;
4429                 }
4430                 SCTP_INP_READ_UNLOCK(inp);
4431                 hold_rlock = 0;
4432                 goto restart;
4433         }
4434         if ((control->length == 0) &&
4435             (control->do_not_ref_stcb)) {
4436                 /*
4437                  * Clean up code for freeing assoc that left behind a
4438                  * pdapi.. maybe a peer in EEOR that just closed after
4439                  * sending and never indicated a EOR.
4440                  */
4441                 SCTP_STAT_INCR(sctps_locks_in_rcva);
4442                 if (hold_rlock == 0) {
4443                         hold_rlock = 1;
4444                         SCTP_INP_READ_LOCK(inp);
4445                 }
4446                 control->held_length = 0;
4447                 if (control->data) {
4448                         /* Hmm there is data here .. fix */
4449                         struct mbuf *m;
4450                         int cnt = 0;
4451
4452                         m = control->data;
4453                         while (m) {
4454                                 cnt += m->m_len;
4455                                 if (m->m_next == NULL) {
4456                                         control->tail_mbuf = m;
4457                                         m->m_flags |= M_EOR;
4458                                         control->end_added = 1;
4459                                 }
4460                                 m = m->m_next;
4461                         }
4462                         control->length = cnt;
4463                 } else {
4464                         /* remove it */
4465                         TAILQ_REMOVE(&inp->read_queue, control, next);
4466                         /* Add back any hiddend data */
4467                         sctp_free_remote_addr(control->whoFrom);
4468                         sctp_free_a_readq(stcb, control);
4469                 }
4470                 if (hold_rlock) {
4471                         hold_rlock = 0;
4472                         SCTP_INP_READ_UNLOCK(inp);
4473                 }
4474                 goto restart;
4475         }
4476         if (control->length == 0) {
4477                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) &&
4478                     (filling_sinfo)) {
4479                         /* find a more suitable one then this */
4480                         ctl = TAILQ_NEXT(control, next);
4481                         while (ctl) {
4482                                 if ((ctl->stcb != control->stcb) && (ctl->length)) {
4483                                         /* found one */
4484                                         control = ctl;
4485                                         goto found_one;
4486                                 }
4487                                 ctl = TAILQ_NEXT(ctl, next);
4488                         }
4489                 }
4490                 /*
4491                  * if we reach here, not suitable replacement is available
4492                  * <or> fragment interleave is NOT on. So stuff the sb_cc
4493                  * into the our held count, and its time to sleep again.
4494                  */
4495                 held_length = so->so_rcv.sb_cc;
4496                 control->held_length = so->so_rcv.sb_cc;
4497                 goto restart;
4498         }
4499         /* Clear the held length since there is something to read */
4500         control->held_length = 0;
4501         if (hold_rlock) {
4502                 SCTP_INP_READ_UNLOCK(inp);
4503                 hold_rlock = 0;
4504         }
4505 found_one:
4506         /*
4507          * If we reach here, control has a some data for us to read off.
4508          * Note that stcb COULD be NULL.
4509          */
4510         if (hold_sblock) {
4511                 SOCKBUF_UNLOCK(&so->so_rcv);
4512                 hold_sblock = 0;
4513         }
4514         stcb = control->stcb;
4515         if (stcb) {
4516                 if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) &&
4517                     (control->do_not_ref_stcb == 0)) {
4518                         if (freecnt_applied == 0)
4519                                 stcb = NULL;
4520                 } else if (control->do_not_ref_stcb == 0) {
4521                         /* you can't free it on me please */
4522                         /*
4523                          * The lock on the socket buffer protects us so the
4524                          * free code will stop. But since we used the
4525                          * socketbuf lock and the sender uses the tcb_lock
4526                          * to increment, we need to use the atomic add to
4527                          * the refcnt
4528                          */
4529                         atomic_add_int(&stcb->asoc.refcnt, 1);
4530                         freecnt_applied = 1;
4531                         /*
4532                          * Setup to remember how much we have not yet told
4533                          * the peer our rwnd has opened up. Note we grab the
4534                          * value from the tcb from last time. Note too that
4535                          * sack sending clears this when a sack is sent..
4536                          * which is fine. Once we hit the rwnd_req, we then
4537                          * will go to the sctp_user_rcvd() that will not
4538                          * lock until it KNOWs it MUST send a WUP-SACK.
4539                          *
4540                          */
4541                         freed_so_far = stcb->freed_by_sorcv_sincelast;
4542                         stcb->freed_by_sorcv_sincelast = 0;
4543                 }
4544         }
4545         /* First lets get off the sinfo and sockaddr info */
4546         if ((sinfo) && filling_sinfo) {
4547                 memcpy(sinfo, control, sizeof(struct sctp_nonpad_sndrcvinfo));
4548                 nxt = TAILQ_NEXT(control, next);
4549                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO)) {
4550                         struct sctp_extrcvinfo *s_extra;
4551
4552                         s_extra = (struct sctp_extrcvinfo *)sinfo;
4553                         if (nxt) {
4554                                 s_extra->next_flags = SCTP_NEXT_MSG_AVAIL;
4555                                 if (nxt->sinfo_flags & SCTP_UNORDERED) {
4556                                         s_extra->next_flags |= SCTP_NEXT_MSG_IS_UNORDERED;
4557                                 }
4558                                 s_extra->next_asocid = nxt->sinfo_assoc_id;
4559                                 s_extra->next_length = nxt->length;
4560                                 s_extra->next_ppid = nxt->sinfo_ppid;
4561                                 s_extra->next_stream = nxt->sinfo_stream;
4562                                 if (nxt->tail_mbuf != NULL) {
4563                                         if (nxt->tail_mbuf->m_flags & M_EOR) {
4564                                                 s_extra->next_flags |= SCTP_NEXT_MSG_ISCOMPLETE;
4565                                         }
4566                                 }
4567                         } else {
4568                                 /*
4569                                  * we explicitly 0 this, since the memcpy
4570                                  * got some other things beyond the older
4571                                  * sinfo_ that is on the control's structure
4572                                  * :-D
4573                                  */
4574                                 s_extra->next_flags = SCTP_NO_NEXT_MSG;
4575                                 s_extra->next_asocid = 0;
4576                                 s_extra->next_length = 0;
4577                                 s_extra->next_ppid = 0;
4578                                 s_extra->next_stream = 0;
4579                         }
4580                 }
4581                 /*
4582                  * update off the real current cum-ack, if we have an stcb.
4583                  */
4584                 if (stcb)
4585                         sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
4586                 /*
4587                  * mask off the high bits, we keep the actual chunk bits in
4588                  * there.
4589                  */
4590                 sinfo->sinfo_flags &= 0x00ff;
4591         }
4592         if (fromlen && from) {
4593                 struct sockaddr *to;
4594
4595 #ifdef AF_INET
4596                 cp_len = min(fromlen, control->whoFrom->ro._l_addr.sin.sin_len);
4597                 memcpy(from, &control->whoFrom->ro._l_addr, cp_len);
4598                 ((struct sockaddr_in *)from)->sin_port = control->port_from;
4599 #else
4600                 /* No AF_INET use AF_INET6 */
4601                 cp_len = min(fromlen, control->whoFrom->ro._l_addr.sin6.sin6_len);
4602                 memcpy(from, &control->whoFrom->ro._l_addr, cp_len);
4603                 ((struct sockaddr_in6 *)from)->sin6_port = control->port_from;
4604 #endif
4605
4606                 to = from;
4607 #if defined(AF_INET) && defined(AF_INET6)
4608                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) &&
4609                     (to->sa_family == AF_INET) &&
4610                     ((size_t)fromlen >= sizeof(struct sockaddr_in6))) {
4611                         struct sockaddr_in *sin;
4612                         struct sockaddr_in6 sin6;
4613
4614                         sin = (struct sockaddr_in *)to;
4615                         bzero(&sin6, sizeof(sin6));
4616                         sin6.sin6_family = AF_INET6;
4617                         sin6.sin6_len = sizeof(struct sockaddr_in6);
4618                         sin6.sin6_addr.s6_addr16[2] = 0xffff;
4619                         bcopy(&sin->sin_addr,
4620                             &sin6.sin6_addr.s6_addr16[3],
4621                             sizeof(sin6.sin6_addr.s6_addr16[3]));
4622                         sin6.sin6_port = sin->sin_port;
4623                         memcpy(from, (caddr_t)&sin6, sizeof(sin6));
4624                 }
4625 #endif
4626 #if defined(AF_INET6)
4627                 {
4628                         struct sockaddr_in6 lsa6, *to6;
4629
4630                         to6 = (struct sockaddr_in6 *)to;
4631                         sctp_recover_scope_mac(to6, (&lsa6));
4632
4633                 }
4634 #endif
4635         }
4636         /* now copy out what data we can */
4637         if (mp == NULL) {
4638                 /* copy out each mbuf in the chain up to length */
4639 get_more_data:
4640                 m = control->data;
4641                 while (m) {
4642                         /* Move out all we can */
4643                         cp_len = (int)uio->uio_resid;
4644                         my_len = (int)m->m_len;
4645                         if (cp_len > my_len) {
4646                                 /* not enough in this buf */
4647                                 cp_len = my_len;
4648                         }
4649                         if (hold_rlock) {
4650                                 SCTP_INP_READ_UNLOCK(inp);
4651                                 hold_rlock = 0;
4652                         }
4653                         splx(s);
4654                         if (cp_len > 0)
4655                                 error = uiomove(mtod(m, char *), cp_len, uio);
4656                         s = splnet();
4657 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4658                         sctp_misc_ints(SCTP_SORCV_DOESCPY,
4659                             so->so_rcv.sb_cc,
4660                             cp_len,
4661                             0,
4662                             0);
4663 #endif
4664                         /* re-read */
4665                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4666                                 goto release;
4667                         }
4668                         if (stcb &&
4669                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
4670                                 no_rcv_needed = 1;
4671                         }
4672                         if (error) {
4673                                 /* error we are out of here */
4674                                 goto release;
4675                         }
4676                         if ((m->m_next == NULL) &&
4677                             (cp_len >= m->m_len) &&
4678                             ((control->end_added == 0) ||
4679                             (control->end_added && (TAILQ_NEXT(control, next) == NULL)))
4680                             ) {
4681 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4682                                 sctp_misc_ints(SCTP_SORCV_DOESLCK,
4683                                     so->so_rcv.sb_cc,
4684                                     cp_len,
4685                                     m->m_len,
4686                                     control->length);
4687 #endif
4688                                 SCTP_STAT_INCR(sctps_locks_in_rcvb);
4689                                 SCTP_INP_READ_LOCK(inp);
4690                                 hold_rlock = 1;
4691                         }
4692                         if (cp_len == m->m_len) {
4693 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4694                                 sctp_misc_ints(SCTP_SORCV_DOESADJ,
4695                                     so->so_rcv.sb_cc,
4696                                     control->length,
4697                                     cp_len,
4698                                     0);
4699 #endif
4700                                 if (m->m_flags & M_EOR) {
4701                                         out_flags |= MSG_EOR;
4702                                 }
4703                                 if (m->m_flags & M_NOTIFICATION) {
4704                                         out_flags |= MSG_NOTIFICATION;
4705                                 }
4706                                 /* we ate up the mbuf */
4707                                 if (in_flags & MSG_PEEK) {
4708                                         /* just looking */
4709                                         m = m->m_next;
4710                                         copied_so_far += cp_len;
4711                                 } else {
4712                                         /* dispose of the mbuf */
4713 #ifdef SCTP_SB_LOGGING
4714                                         sctp_sblog(&so->so_rcv,
4715                                             control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, m->m_len);
4716 #endif
4717                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
4718 #ifdef SCTP_SB_LOGGING
4719                                         sctp_sblog(&so->so_rcv,
4720                                             control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4721 #endif
4722                                         embuf = m;
4723                                         copied_so_far += cp_len;
4724                                         freed_so_far += cp_len;
4725                                         alen = atomic_fetchadd_int(&control->length, -(cp_len));
4726                                         if (alen < cp_len) {
4727                                                 panic("Control length goes negative?");
4728                                         }
4729 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4730                                         sctp_misc_ints(SCTP_SORCV_PASSBF,
4731                                             so->so_rcv.sb_cc,
4732                                             control->length,
4733                                             0,
4734                                             0);
4735 #endif
4736                                         control->data = sctp_m_free(m);
4737                                         m = control->data;
4738                                         /*
4739                                          * been through it all, must hold sb
4740                                          * lock ok to null tail
4741                                          */
4742                                         if (control->data == NULL) {
4743 #ifdef INVARIENTS
4744                                                 if ((control->end_added == 0) ||
4745                                                     (TAILQ_NEXT(control, next) == NULL)) {
4746                                                         /*
4747                                                          * If the end is not
4748                                                          * added, OR the
4749                                                          * next is NOT null
4750                                                          * we MUST have the
4751                                                          * lock.
4752                                                          */
4753                                                         if (mtx_owned(&inp->inp_rdata_mtx) == 0) {
4754                                                                 panic("Hmm we don't own the lock?");
4755                                                         }
4756                                                 }
4757 #endif
4758                                                 control->tail_mbuf = NULL;
4759 #ifdef INVARIENTS
4760                                                 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) {
4761                                                         panic("end_added, nothing left and no MSG_EOR");
4762                                                 }
4763 #endif
4764                                         }
4765 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4766                                         sctp_misc_ints(SCTP_SORCV_ADJD,
4767                                             so->so_rcv.sb_cc,
4768                                             control->length,
4769                                             0,
4770                                             0);
4771 #endif
4772                                 }
4773                         } else {
4774                                 /* Do we need to trim the mbuf? */
4775                                 if (m->m_flags & M_NOTIFICATION) {
4776                                         out_flags |= MSG_NOTIFICATION;
4777                                 }
4778                                 if ((in_flags & MSG_PEEK) == 0) {
4779                                         if (out_flags & MSG_NOTIFICATION) {
4780                                                 /*
4781                                                  * remark this one with the
4782                                                  * notify flag, they read
4783                                                  * only part of the
4784                                                  * notification.
4785                                                  */
4786                                                 m->m_flags |= M_NOTIFICATION;
4787                                         }
4788                                         m->m_data += cp_len;
4789                                         m->m_len -= cp_len;
4790 #ifdef SCTP_SB_LOGGING
4791                                         sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, cp_len);
4792 #endif
4793                                         atomic_subtract_int(&so->so_rcv.sb_cc, cp_len);
4794                                         if (stcb) {
4795                                                 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len);
4796                                         }
4797                                         copied_so_far += cp_len;
4798                                         embuf = m;
4799                                         freed_so_far += cp_len;
4800 #ifdef SCTP_SB_LOGGING
4801                                         sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
4802                                             SCTP_LOG_SBRESULT, 0);
4803 #endif
4804                                         alen = atomic_fetchadd_int(&control->length, -(cp_len));
4805                                         if (alen < cp_len) {
4806                                                 panic("Control length goes negative2?");
4807                                         }
4808                                 } else {
4809                                         copied_so_far += cp_len;
4810                                 }
4811                         }
4812                         if ((out_flags & MSG_EOR) ||
4813                             (uio->uio_resid == 0)
4814                             ) {
4815                                 break;
4816                         }
4817                         if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
4818                             (control->do_not_ref_stcb == 0) &&
4819                             (freed_so_far >= rwnd_req)) {
4820                                 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
4821                         }
4822 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4823                         sctp_misc_ints(SCTP_SORCV_BOTWHILE,
4824                             so->so_rcv.sb_cc,
4825                             control->length,
4826                             0,
4827                             0);
4828 #endif
4829
4830                 }               /* end while(m) */
4831                 /*
4832                  * At this point we have looked at it all and we either have
4833                  * a MSG_EOR/or read all the user wants... <OR>
4834                  * control->length == 0.
4835                  */
4836                 if ((out_flags & MSG_EOR) &&
4837                     ((in_flags & MSG_PEEK) == 0)) {
4838                         /* we are done with this control */
4839                         if (control->length == 0) {
4840                                 if (control->data) {
4841 #ifdef INVARIENTS
4842                                         panic("control->data not null at read eor?");
4843 #else
4844                                         printf("Strange, data left in the control buffer .. invarients would panic?\n");
4845                                         sctp_m_freem(control->data);
4846                                         control->data = NULL;
4847 #endif
4848                                 }
4849                 done_with_control:
4850 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4851                                 sctp_misc_ints(SCTP_SORCV_FREECTL,
4852                                     so->so_rcv.sb_cc,
4853                                     0,
4854                                     0,
4855                                     0);
4856 #endif
4857                                 if (TAILQ_NEXT(control, next) == NULL) {
4858                                         /*
4859                                          * If we don't have a next we need a
4860                                          * lock, if there is a next interupt
4861                                          * is filling ahead of us and we
4862                                          * don't need a lock to remove this
4863                                          * guy (which is the head of the
4864                                          * queue).
4865                                          */
4866                                         if (hold_rlock == 0) {
4867                                                 SCTP_STAT_INCR(sctps_locks_in_rcvc);
4868                                                 SCTP_INP_READ_LOCK(inp);
4869                                                 hold_rlock = 1;
4870                                         }
4871                                 }
4872                                 TAILQ_REMOVE(&inp->read_queue, control, next);
4873                                 /* Add back any hiddend data */
4874                                 if (control->held_length) {
4875                                         held_length = 0;
4876                                         control->held_length = 0;
4877                                         wakeup_read_socket = 1;
4878                                 }
4879                                 no_rcv_needed = control->do_not_ref_stcb;
4880                                 sctp_free_remote_addr(control->whoFrom);
4881                                 control->data = NULL;
4882                                 sctp_free_a_readq(stcb, control);
4883                                 control = NULL;
4884                                 if ((freed_so_far >= rwnd_req) && (no_rcv_needed == 0))
4885                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
4886
4887                         } else {
4888                                 /*
4889                                  * The user did not read all of this
4890                                  * message, turn off the returned MSG_EOR
4891                                  * since we are leaving more behind on the
4892                                  * control to read.
4893                                  */
4894 #ifdef INVARIENTS
4895                                 if (control->end_added && (control->data == NULL) &&
4896                                     (control->tail_mbuf == NULL)) {
4897                                         panic("Gak, control->length is corrupt?");
4898                                 }
4899 #endif
4900                                 no_rcv_needed = control->do_not_ref_stcb;
4901                                 out_flags &= ~MSG_EOR;
4902                         }
4903                 }
4904                 if (out_flags & MSG_EOR) {
4905                         goto release;
4906                 }
4907                 if ((uio->uio_resid == 0) ||
4908                     ((in_eeor_mode) && (copied_so_far >= max(so->so_rcv.sb_lowat, 1)))
4909                     ) {
4910                         goto release;
4911                 }
4912                 /*
4913                  * If I hit here the receiver wants more and this message is
4914                  * NOT done (pd-api). So two questions. Can we block? if not
4915                  * we are done. Did the user NOT set MSG_WAITALL?
4916                  */
4917                 if (block_allowed == 0) {
4918                         goto release;
4919                 }
4920                 /*
4921                  * We need to wait for more data a few things: - We don't
4922                  * sbunlock() so we don't get someone else reading. - We
4923                  * must be sure to account for the case where what is added
4924                  * is NOT to our control when we wakeup.
4925                  */
4926
4927                 /*
4928                  * Do we need to tell the transport a rwnd update might be
4929                  * needed before we go to sleep?
4930                  */
4931                 if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
4932                     ((freed_so_far >= rwnd_req) &&
4933                     (control->do_not_ref_stcb == 0) &&
4934                     (no_rcv_needed == 0))) {
4935                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
4936                 }
4937 wait_some_more:
4938                 if (so->so_error || so->so_rcv.sb_state & SBS_CANTRCVMORE) {
4939                         goto release;
4940                 }
4941                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
4942                         goto release;
4943
4944                 if (hold_rlock == 1) {
4945                         SCTP_INP_READ_UNLOCK(inp);
4946                         hold_rlock = 0;
4947                 }
4948                 if (hold_sblock == 0) {
4949                         SOCKBUF_LOCK(&so->so_rcv);
4950                         hold_sblock = 1;
4951                 }
4952 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4953                 if (stcb)
4954                         sctp_misc_ints(SCTP_SORECV_BLOCKSB,
4955                             freed_so_far,
4956                             stcb->asoc.my_rwnd,
4957                             so->so_rcv.sb_cc,
4958                             uio->uio_resid);
4959                 else
4960                         sctp_misc_ints(SCTP_SORECV_BLOCKSB,
4961                             freed_so_far,
4962                             0,
4963                             so->so_rcv.sb_cc,
4964                             uio->uio_resid);
4965 #endif
4966                 if (so->so_rcv.sb_cc <= control->held_length) {
4967                         error = sbwait(&so->so_rcv);
4968                         if (error) {
4969                                 goto release;
4970                         }
4971                         control->held_length = 0;
4972                 }
4973                 if (hold_sblock) {
4974                         SOCKBUF_UNLOCK(&so->so_rcv);
4975                         hold_sblock = 0;
4976                 }
4977                 if (control->length == 0) {
4978                         /* still nothing here */
4979                         if (control->end_added == 1) {
4980                                 /* he aborted, or is done i.e.did a shutdown */
4981                                 out_flags |= MSG_EOR;
4982                                 if (control->pdapi_aborted)
4983                                         out_flags |= MSG_TRUNC;
4984                                 goto done_with_control;
4985                         }
4986                         if (so->so_rcv.sb_cc > held_length) {
4987                                 SCTP_STAT_INCR(sctps_locks_in_rcvf);
4988                                 control->held_length = so->so_rcv.sb_cc;
4989                                 held_length = 0;
4990                         }
4991                         goto wait_some_more;
4992                 } else if (control->data == NULL) {
4993                         /*
4994                          * we must re-sync since data is probably being
4995                          * added
4996                          */
4997                         SCTP_INP_READ_LOCK(inp);
4998                         if ((control->length > 0) && (control->data == NULL)) {
4999                                 /*
5000                                  * big trouble.. we have the lock and its
5001                                  * corrupt?
5002                                  */
5003                                 panic("Impossible data==NULL length !=0");
5004                         }
5005                         SCTP_INP_READ_UNLOCK(inp);
5006                         /* We will fall around to get more data */
5007                 }
5008                 goto get_more_data;
5009         } else {
5010                 /* copy out the mbuf chain */
5011 get_more_data2:
5012                 /*
5013                  * Do we have a uio, I doubt it if so we grab the size from
5014                  * it, if not you get it all
5015                  */
5016                 if (uio)
5017                         cp_len = uio->uio_resid;
5018                 else
5019                         cp_len = control->length;
5020
5021                 if ((uint32_t) cp_len >= control->length) {
5022                         /* easy way */
5023                         if ((control->end_added == 0) ||
5024                             (TAILQ_NEXT(control, next) == NULL)) {
5025                                 /* Need to get rlock */
5026                                 if (hold_rlock == 0) {
5027                                         SCTP_INP_READ_LOCK(inp);
5028                                         hold_rlock = 1;
5029                                 }
5030                         }
5031                         if (control->tail_mbuf->m_flags & M_EOR) {
5032                                 out_flags |= MSG_EOR;
5033                         }
5034                         if (control->data->m_flags & M_NOTIFICATION) {
5035                                 out_flags |= MSG_NOTIFICATION;
5036                         }
5037                         if (uio)
5038                                 uio->uio_resid -= control->length;
5039                         *mp = control->data;
5040                         m = control->data;
5041                         while (m) {
5042 #ifdef SCTP_SB_LOGGING
5043                                 sctp_sblog(&so->so_rcv,
5044                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, m->m_len);
5045 #endif
5046                                 sctp_sbfree(control, stcb, &so->so_rcv, m);
5047                                 freed_so_far += m->m_len;
5048 #ifdef SCTP_SB_LOGGING
5049                                 sctp_sblog(&so->so_rcv,
5050                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5051 #endif
5052                                 m = m->m_next;
5053                         }
5054                         control->data = control->tail_mbuf = NULL;
5055                         control->length = 0;
5056                         if (out_flags & MSG_EOR) {
5057                                 /* Done with this control */
5058                                 goto done_with_control;
5059                         }
5060                         /* still more to do with this conntrol */
5061                         /* do we really support msg_waitall here? */
5062                         if ((block_allowed == 0) ||
5063                             ((in_flags & MSG_WAITALL) == 0)) {
5064                                 goto release;
5065                         }
5066         wait_some_more2:
5067                         if (so->so_error || so->so_rcv.sb_state & SBS_CANTRCVMORE)
5068                                 goto release;
5069                         if (hold_rlock == 1) {
5070                                 SCTP_INP_READ_UNLOCK(inp);
5071                                 hold_rlock = 0;
5072                         }
5073                         if (hold_sblock == 0) {
5074                                 SOCKBUF_LOCK(&so->so_rcv);
5075                                 hold_sblock = 1;
5076                         }
5077                         if (so->so_rcv.sb_cc <= control->held_length) {
5078                                 error = sbwait(&so->so_rcv);
5079                                 if (error) {
5080                                         goto release;
5081                                 }
5082                         }
5083                         if (hold_sblock) {
5084                                 SOCKBUF_UNLOCK(&so->so_rcv);
5085                                 hold_sblock = 0;
5086                         }
5087                         if (control->length == 0) {
5088                                 /* still nothing here */
5089                                 if (control->end_added == 1) {
5090                                         /*
5091                                          * he aborted, or is done i.e.
5092                                          * shutdown
5093                                          */
5094                                         out_flags |= MSG_EOR;
5095                                         if (control->pdapi_aborted)
5096                                                 out_flags |= MSG_TRUNC;
5097                                         goto done_with_control;
5098                                 }
5099                                 if (so->so_rcv.sb_cc > held_length) {
5100                                         control->held_length = so->so_rcv.sb_cc;
5101                                         /*
5102                                          * We don't use held_length while
5103                                          * getting a message
5104                                          */
5105                                         held_length = 0;
5106                                 }
5107                                 goto wait_some_more2;
5108                         }
5109                         goto get_more_data2;
5110                 } else {
5111                         /* hard way mbuf by mbuf */
5112                         m = control->data;
5113                         if (control->end_added == 0) {
5114                                 /* need the rlock */
5115                                 if (hold_rlock == 0) {
5116                                         SCTP_INP_READ_LOCK(inp);
5117                                         hold_rlock = 1;
5118                                 }
5119                         }
5120                         if (m->m_flags & M_NOTIFICATION) {
5121                                 out_flags |= MSG_NOTIFICATION;
5122                         }
5123                         while ((m) && (cp_len > 0)) {
5124                                 if (cp_len >= m->m_len) {
5125                                         *mp = m;
5126                                         atomic_subtract_int(&control->length, m->m_len);
5127                                         if (uio)
5128                                                 uio->uio_resid -= m->m_len;
5129                                         cp_len -= m->m_len;
5130                                         control->data = m->m_next;
5131                                         m->m_next = NULL;
5132 #ifdef SCTP_SB_LOGGING
5133                                         sctp_sblog(&so->so_rcv,
5134                                             control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, m->m_len);
5135 #endif
5136                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
5137                                         freed_so_far += m->m_len;
5138 #ifdef SCTP_SB_LOGGING
5139                                         sctp_sblog(&so->so_rcv,
5140                                             control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5141 #endif
5142                                         mp = &m->m_next;
5143                                         m = control->data;
5144                                 } else {
5145                                         /*
5146                                          * got all he wants and its part of
5147                                          * this mbuf only.
5148                                          */
5149                                         if (uio)
5150                                                 uio->uio_resid -= m->m_len;
5151                                         cp_len -= m->m_len;
5152                                         if (hold_rlock) {
5153                                                 SCTP_INP_READ_UNLOCK(inp);
5154                                                 hold_rlock = 0;
5155                                         }
5156                                         if (hold_sblock) {
5157                                                 SOCKBUF_UNLOCK(&so->so_rcv);
5158                                                 hold_sblock = 0;
5159                                         }
5160                                         splx(s);
5161                                         *mp = sctp_m_copym(m, 0, cp_len,
5162                                             M_TRYWAIT
5163                                             );
5164                                         s = splnet();
5165 #ifdef SCTP_LOCK_LOGGING
5166                                         sctp_log_lock(inp, stcb, SCTP_LOG_LOCK_SOCKBUF_R);
5167 #endif
5168                                         if (hold_sblock == 0) {
5169                                                 SOCKBUF_LOCK(&so->so_rcv);
5170                                                 hold_sblock = 1;
5171                                         }
5172                                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
5173                                                 goto release;
5174
5175                                         if (stcb &&
5176                                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5177                                                 no_rcv_needed = 1;
5178                                         }
5179                                         m->m_data += cp_len;
5180                                         m->m_len -= cp_len;
5181 #ifdef SCTP_SB_LOGGING
5182                                         sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, cp_len);
5183 #endif
5184                                         freed_so_far += cp_len;
5185                                         atomic_subtract_int(&so->so_rcv.sb_cc, cp_len);
5186                                         if (stcb) {
5187                                                 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len);
5188                                                 if ((freed_so_far >= rwnd_req) &&
5189                                                     (control->do_not_ref_stcb == 0) &&
5190                                                     (no_rcv_needed == 0))
5191                                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5192                                         }
5193 #ifdef SCTP_SB_LOGGING
5194                                         sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
5195                                             SCTP_LOG_SBRESULT, 0);
5196 #endif
5197                                         if (out_flags & MSG_NOTIFICATION) {
5198                                                 /*
5199                                                  * remark the first mbuf if
5200                                                  * they took a partial read.
5201                                                  */
5202                                                 control->data->m_flags |= M_NOTIFICATION;
5203                                         }
5204                                         goto release;
5205                                 }
5206                         }
5207                 }
5208         }
5209 release:
5210         if (hold_rlock == 1) {
5211                 SCTP_INP_READ_UNLOCK(inp);
5212                 hold_rlock = 0;
5213         }
5214         if (hold_sblock == 0) {
5215                 SOCKBUF_LOCK(&so->so_rcv);
5216                 hold_sblock = 1;
5217         }
5218         sbunlock(&so->so_rcv);
5219
5220 release_unlocked:
5221         if (hold_sblock) {
5222                 SOCKBUF_UNLOCK(&so->so_rcv);
5223                 hold_sblock = 0;
5224         }
5225         if ((stcb) && (in_flags & MSG_PEEK) == 0) {
5226                 if ((freed_so_far >= rwnd_req) &&
5227                     (control && (control->do_not_ref_stcb == 0)) &&
5228                     (no_rcv_needed == 0))
5229                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5230         }
5231         if (msg_flags)
5232                 *msg_flags |= out_flags;
5233 out:
5234         if (hold_rlock == 1) {
5235                 SCTP_INP_READ_UNLOCK(inp);
5236                 hold_rlock = 0;
5237         }
5238         if (hold_sblock) {
5239                 SOCKBUF_UNLOCK(&so->so_rcv);
5240                 hold_sblock = 0;
5241         }
5242         if (freecnt_applied) {
5243                 /*
5244                  * The lock on the socket buffer protects us so the free
5245                  * code will stop. But since we used the socketbuf lock and
5246                  * the sender uses the tcb_lock to increment, we need to use
5247                  * the atomic add to the refcnt.
5248                  */
5249                 if (stcb == NULL) {
5250                         panic("stcb for refcnt has gone NULL?");
5251                 }
5252                 atomic_add_int(&stcb->asoc.refcnt, -1);
5253                 freecnt_applied = 0;
5254                 /* Save the value back for next time */
5255                 stcb->freed_by_sorcv_sincelast = freed_so_far;
5256         }
5257         splx(s);
5258 #ifdef SCTP_RECV_RWND_LOGGING
5259         if (stcb) {
5260                 sctp_misc_ints(SCTP_SORECV_DONE,
5261                     freed_so_far,
5262                     ((uio) ? (slen - uio->uio_resid) : slen),
5263                     stcb->asoc.my_rwnd,
5264                     so->so_rcv.sb_cc);
5265         } else {
5266                 sctp_misc_ints(SCTP_SORECV_DONE,
5267                     freed_so_far,
5268                     ((uio) ? (slen - uio->uio_resid) : slen),
5269                     0,
5270                     so->so_rcv.sb_cc);
5271         }
5272 #endif
5273         if (wakeup_read_socket) {
5274                 sctp_sorwakeup(inp, so);
5275         }
5276         return (error);
5277 }
5278
5279
5280 #ifdef SCTP_MBUF_LOGGING
5281 struct mbuf *
5282 sctp_m_free(struct mbuf *m)
5283 {
5284         if (m->m_flags & M_EXT) {
5285                 sctp_log_mb(m, SCTP_MBUF_IFREE);
5286         }
5287         return (m_free(m));
5288 }
5289
5290 void
5291 sctp_m_freem(struct mbuf *mb)
5292 {
5293         while (mb != NULL)
5294                 mb = sctp_m_free(mb);
5295 }
5296
5297 #endif
5298
5299
5300 int
5301 sctp_soreceive(so, psa, uio, mp0, controlp, flagsp)
5302         struct socket *so;
5303         struct sockaddr **psa;
5304         struct uio *uio;
5305         struct mbuf **mp0;
5306         struct mbuf **controlp;
5307         int *flagsp;
5308 {
5309         int error, fromlen;
5310         uint8_t sockbuf[256];
5311         struct sockaddr *from;
5312         struct sctp_extrcvinfo sinfo;
5313         int filling_sinfo = 1;
5314         struct sctp_inpcb *inp;
5315
5316         inp = (struct sctp_inpcb *)so->so_pcb;
5317         /* pickup the assoc we are reading from */
5318         if (inp == NULL) {
5319                 return (EINVAL);
5320         }
5321         if ((sctp_is_feature_off(inp,
5322             SCTP_PCB_FLAGS_RECVDATAIOEVNT)) ||
5323             (controlp == NULL)) {
5324                 /* user does not want the sndrcv ctl */
5325                 filling_sinfo = 0;
5326         }
5327         if (psa) {
5328                 from = (struct sockaddr *)sockbuf;
5329                 fromlen = sizeof(sockbuf);
5330                 from->sa_len = 0;
5331         } else {
5332                 from = NULL;
5333                 fromlen = 0;
5334         }
5335
5336         error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, flagsp,
5337             (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo);
5338         if ((controlp) && (filling_sinfo)) {
5339                 /* copy back the sinfo in a CMSG format */
5340                 if (filling_sinfo)
5341                         *controlp = sctp_build_ctl_nchunk(inp,
5342                             (struct sctp_sndrcvinfo *)&sinfo);
5343                 else
5344                         *controlp = NULL;
5345         }
5346         if (psa) {
5347                 /* copy back the address info */
5348                 if (from && from->sa_len) {
5349                         *psa = sodupsockaddr(from, M_NOWAIT);
5350                 } else {
5351                         *psa = NULL;
5352                 }
5353         }
5354         return (error);
5355 }