sys/netinet/sctputil.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-3-Clause
   3  *
   4  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
   5  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   6  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions are met:
  10  *
  11  * a) Redistributions of source code must retain the above copyright notice,
  12  *    this list of conditions and the following disclaimer.
  13  *
  14  * b) Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in
  16  *    the documentation and/or other materials provided with the distribution.
  17  *
  18  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  19  *    contributors may be used to endorse or promote products derived
  20  *    from this software without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  24  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  26  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  32  * THE POSSIBILITY OF SUCH DAMAGE.
  33  */
  34
  35 #include <sys/cdefs.h>
  36 __FBSDID("$FreeBSD$");
  37
  38 #include <netinet/sctp_os.h>
  39 #include <netinet/sctp_pcb.h>
  40 #include <netinet/sctputil.h>
  41 #include <netinet/sctp_var.h>
  42 #include <netinet/sctp_sysctl.h>
  43 #ifdef INET6
  44 #include <netinet6/sctp6_var.h>
  45 #endif
  46 #include <netinet/sctp_header.h>
  47 #include <netinet/sctp_output.h>
  48 #include <netinet/sctp_uio.h>
  49 #include <netinet/sctp_timer.h>
  50 #include <netinet/sctp_indata.h>
  51 #include <netinet/sctp_auth.h>
  52 #include <netinet/sctp_asconf.h>
  53 #include <netinet/sctp_bsd_addr.h>
  54 #include <netinet/sctp_kdtrace.h>
  55 #if defined(INET6) || defined(INET)
  56 #include <netinet/tcp_var.h>
  57 #endif
  58 #include <netinet/udp.h>
  59 #include <netinet/udp_var.h>
  60 #include <sys/proc.h>
  61 #ifdef INET6
  62 #include <netinet/icmp6.h>
  63 #endif
  64
  65
  66 #ifndef KTR_SCTP
  67 #define KTR_SCTP KTR_SUBSYS
  68 #endif
  69
  70 extern const struct sctp_cc_functions sctp_cc_functions[];
  71 extern const struct sctp_ss_functions sctp_ss_functions[];
  72
  73 void
  74 sctp_sblog(struct sockbuf *sb, struct sctp_tcb *stcb, int from, int incr)
  75 {
  76 #if defined(SCTP_LOCAL_TRACE_BUF)
  77         struct sctp_cwnd_log sctp_clog;
  78
  79         sctp_clog.x.sb.stcb = stcb;
  80         sctp_clog.x.sb.so_sbcc = sb->sb_cc;
  81         if (stcb)
  82                 sctp_clog.x.sb.stcb_sbcc = stcb->asoc.sb_cc;
  83         else
  84                 sctp_clog.x.sb.stcb_sbcc = 0;
  85         sctp_clog.x.sb.incr = incr;
  86         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
  87             SCTP_LOG_EVENT_SB,
  88             from,
  89             sctp_clog.x.misc.log1,
  90             sctp_clog.x.misc.log2,
  91             sctp_clog.x.misc.log3,
  92             sctp_clog.x.misc.log4);
  93 #endif
  94 }
  95
  96 void
  97 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc)
  98 {
  99 #if defined(SCTP_LOCAL_TRACE_BUF)
 100         struct sctp_cwnd_log sctp_clog;
 101
 102         sctp_clog.x.close.inp = (void *)inp;
 103         sctp_clog.x.close.sctp_flags = inp->sctp_flags;
 104         if (stcb) {
 105                 sctp_clog.x.close.stcb = (void *)stcb;
 106                 sctp_clog.x.close.state = (uint16_t)stcb->asoc.state;
 107         } else {
 108                 sctp_clog.x.close.stcb = 0;
 109                 sctp_clog.x.close.state = 0;
 110         }
 111         sctp_clog.x.close.loc = loc;
 112         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 113             SCTP_LOG_EVENT_CLOSE,
 114             0,
 115             sctp_clog.x.misc.log1,
 116             sctp_clog.x.misc.log2,
 117             sctp_clog.x.misc.log3,
 118             sctp_clog.x.misc.log4);
 119 #endif
 120 }
 121
 122 void
 123 rto_logging(struct sctp_nets *net, int from)
 124 {
 125 #if defined(SCTP_LOCAL_TRACE_BUF)
 126         struct sctp_cwnd_log sctp_clog;
 127
 128         memset(&sctp_clog, 0, sizeof(sctp_clog));
 129         sctp_clog.x.rto.net = (void *)net;
 130         sctp_clog.x.rto.rtt = net->rtt / 1000;
 131         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 132             SCTP_LOG_EVENT_RTT,
 133             from,
 134             sctp_clog.x.misc.log1,
 135             sctp_clog.x.misc.log2,
 136             sctp_clog.x.misc.log3,
 137             sctp_clog.x.misc.log4);
 138 #endif
 139 }
 140
 141 void
 142 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from)
 143 {
 144 #if defined(SCTP_LOCAL_TRACE_BUF)
 145         struct sctp_cwnd_log sctp_clog;
 146
 147         sctp_clog.x.strlog.stcb = stcb;
 148         sctp_clog.x.strlog.n_tsn = tsn;
 149         sctp_clog.x.strlog.n_sseq = sseq;
 150         sctp_clog.x.strlog.e_tsn = 0;
 151         sctp_clog.x.strlog.e_sseq = 0;
 152         sctp_clog.x.strlog.strm = stream;
 153         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 154             SCTP_LOG_EVENT_STRM,
 155             from,
 156             sctp_clog.x.misc.log1,
 157             sctp_clog.x.misc.log2,
 158             sctp_clog.x.misc.log3,
 159             sctp_clog.x.misc.log4);
 160 #endif
 161 }
 162
 163 void
 164 sctp_log_nagle_event(struct sctp_tcb *stcb, int action)
 165 {
 166 #if defined(SCTP_LOCAL_TRACE_BUF)
 167         struct sctp_cwnd_log sctp_clog;
 168
 169         sctp_clog.x.nagle.stcb = (void *)stcb;
 170         sctp_clog.x.nagle.total_flight = stcb->asoc.total_flight;
 171         sctp_clog.x.nagle.total_in_queue = stcb->asoc.total_output_queue_size;
 172         sctp_clog.x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue;
 173         sctp_clog.x.nagle.count_in_flight = stcb->asoc.total_flight_count;
 174         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 175             SCTP_LOG_EVENT_NAGLE,
 176             action,
 177             sctp_clog.x.misc.log1,
 178             sctp_clog.x.misc.log2,
 179             sctp_clog.x.misc.log3,
 180             sctp_clog.x.misc.log4);
 181 #endif
 182 }
 183
 184 void
 185 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from)
 186 {
 187 #if defined(SCTP_LOCAL_TRACE_BUF)
 188         struct sctp_cwnd_log sctp_clog;
 189
 190         sctp_clog.x.sack.cumack = cumack;
 191         sctp_clog.x.sack.oldcumack = old_cumack;
 192         sctp_clog.x.sack.tsn = tsn;
 193         sctp_clog.x.sack.numGaps = gaps;
 194         sctp_clog.x.sack.numDups = dups;
 195         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 196             SCTP_LOG_EVENT_SACK,
 197             from,
 198             sctp_clog.x.misc.log1,
 199             sctp_clog.x.misc.log2,
 200             sctp_clog.x.misc.log3,
 201             sctp_clog.x.misc.log4);
 202 #endif
 203 }
 204
 205 void
 206 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from)
 207 {
 208 #if defined(SCTP_LOCAL_TRACE_BUF)
 209         struct sctp_cwnd_log sctp_clog;
 210
 211         memset(&sctp_clog, 0, sizeof(sctp_clog));
 212         sctp_clog.x.map.base = map;
 213         sctp_clog.x.map.cum = cum;
 214         sctp_clog.x.map.high = high;
 215         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 216             SCTP_LOG_EVENT_MAP,
 217             from,
 218             sctp_clog.x.misc.log1,
 219             sctp_clog.x.misc.log2,
 220             sctp_clog.x.misc.log3,
 221             sctp_clog.x.misc.log4);
 222 #endif
 223 }
 224
 225 void
 226 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn, int from)
 227 {
 228 #if defined(SCTP_LOCAL_TRACE_BUF)
 229         struct sctp_cwnd_log sctp_clog;
 230
 231         memset(&sctp_clog, 0, sizeof(sctp_clog));
 232         sctp_clog.x.fr.largest_tsn = biggest_tsn;
 233         sctp_clog.x.fr.largest_new_tsn = biggest_new_tsn;
 234         sctp_clog.x.fr.tsn = tsn;
 235         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 236             SCTP_LOG_EVENT_FR,
 237             from,
 238             sctp_clog.x.misc.log1,
 239             sctp_clog.x.misc.log2,
 240             sctp_clog.x.misc.log3,
 241             sctp_clog.x.misc.log4);
 242 #endif
 243 }
 244
 245 #ifdef SCTP_MBUF_LOGGING
 246 void
 247 sctp_log_mb(struct mbuf *m, int from)
 248 {
 249 #if defined(SCTP_LOCAL_TRACE_BUF)
 250         struct sctp_cwnd_log sctp_clog;
 251
 252         sctp_clog.x.mb.mp = m;
 253         sctp_clog.x.mb.mbuf_flags = (uint8_t)(SCTP_BUF_GET_FLAGS(m));
 254         sctp_clog.x.mb.size = (uint16_t)(SCTP_BUF_LEN(m));
 255         sctp_clog.x.mb.data = SCTP_BUF_AT(m, 0);
 256         if (SCTP_BUF_IS_EXTENDED(m)) {
 257                 sctp_clog.x.mb.ext = SCTP_BUF_EXTEND_BASE(m);
 258                 sctp_clog.x.mb.refcnt = (uint8_t)(SCTP_BUF_EXTEND_REFCNT(m));
 259         } else {
 260                 sctp_clog.x.mb.ext = 0;
 261                 sctp_clog.x.mb.refcnt = 0;
 262         }
 263         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 264             SCTP_LOG_EVENT_MBUF,
 265             from,
 266             sctp_clog.x.misc.log1,
 267             sctp_clog.x.misc.log2,
 268             sctp_clog.x.misc.log3,
 269             sctp_clog.x.misc.log4);
 270 #endif
 271 }
 272
 273 void
 274 sctp_log_mbc(struct mbuf *m, int from)
 275 {
 276         struct mbuf *mat;
 277
 278         for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) {
 279                 sctp_log_mb(mat, from);
 280         }
 281 }
 282 #endif
 283
 284 void
 285 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk, int from)
 286 {
 287 #if defined(SCTP_LOCAL_TRACE_BUF)
 288         struct sctp_cwnd_log sctp_clog;
 289
 290         if (control == NULL) {
 291                 SCTP_PRINTF("Gak log of NULL?\n");
 292                 return;
 293         }
 294         sctp_clog.x.strlog.stcb = control->stcb;
 295         sctp_clog.x.strlog.n_tsn = control->sinfo_tsn;
 296         sctp_clog.x.strlog.n_sseq = (uint16_t)control->mid;
 297         sctp_clog.x.strlog.strm = control->sinfo_stream;
 298         if (poschk != NULL) {
 299                 sctp_clog.x.strlog.e_tsn = poschk->sinfo_tsn;
 300                 sctp_clog.x.strlog.e_sseq = (uint16_t)poschk->mid;
 301         } else {
 302                 sctp_clog.x.strlog.e_tsn = 0;
 303                 sctp_clog.x.strlog.e_sseq = 0;
 304         }
 305         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 306             SCTP_LOG_EVENT_STRM,
 307             from,
 308             sctp_clog.x.misc.log1,
 309             sctp_clog.x.misc.log2,
 310             sctp_clog.x.misc.log3,
 311             sctp_clog.x.misc.log4);
 312 #endif
 313 }
 314
 315 void
 316 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from)
 317 {
 318 #if defined(SCTP_LOCAL_TRACE_BUF)
 319         struct sctp_cwnd_log sctp_clog;
 320
 321         sctp_clog.x.cwnd.net = net;
 322         if (stcb->asoc.send_queue_cnt > 255)
 323                 sctp_clog.x.cwnd.cnt_in_send = 255;
 324         else
 325                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 326         if (stcb->asoc.stream_queue_cnt > 255)
 327                 sctp_clog.x.cwnd.cnt_in_str = 255;
 328         else
 329                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 330
 331         if (net) {
 332                 sctp_clog.x.cwnd.cwnd_new_value = net->cwnd;
 333                 sctp_clog.x.cwnd.inflight = net->flight_size;
 334                 sctp_clog.x.cwnd.pseudo_cumack = net->pseudo_cumack;
 335                 sctp_clog.x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack;
 336                 sctp_clog.x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack;
 337         }
 338         if (SCTP_CWNDLOG_PRESEND == from) {
 339                 sctp_clog.x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd;
 340         }
 341         sctp_clog.x.cwnd.cwnd_augment = augment;
 342         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 343             SCTP_LOG_EVENT_CWND,
 344             from,
 345             sctp_clog.x.misc.log1,
 346             sctp_clog.x.misc.log2,
 347             sctp_clog.x.misc.log3,
 348             sctp_clog.x.misc.log4);
 349 #endif
 350 }
 351
 352 void
 353 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from)
 354 {
 355 #if defined(SCTP_LOCAL_TRACE_BUF)
 356         struct sctp_cwnd_log sctp_clog;
 357
 358         memset(&sctp_clog, 0, sizeof(sctp_clog));
 359         if (inp) {
 360                 sctp_clog.x.lock.sock = (void *)inp->sctp_socket;
 361
 362         } else {
 363                 sctp_clog.x.lock.sock = (void *)NULL;
 364         }
 365         sctp_clog.x.lock.inp = (void *)inp;
 366         if (stcb) {
 367                 sctp_clog.x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx);
 368         } else {
 369                 sctp_clog.x.lock.tcb_lock = SCTP_LOCK_UNKNOWN;
 370         }
 371         if (inp) {
 372                 sctp_clog.x.lock.inp_lock = mtx_owned(&inp->inp_mtx);
 373                 sctp_clog.x.lock.create_lock = mtx_owned(&inp->inp_create_mtx);
 374         } else {
 375                 sctp_clog.x.lock.inp_lock = SCTP_LOCK_UNKNOWN;
 376                 sctp_clog.x.lock.create_lock = SCTP_LOCK_UNKNOWN;
 377         }
 378         sctp_clog.x.lock.info_lock = rw_wowned(&SCTP_BASE_INFO(ipi_ep_mtx));
 379         if (inp && (inp->sctp_socket)) {
 380                 sctp_clog.x.lock.sock_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 381                 sctp_clog.x.lock.sockrcvbuf_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 382                 sctp_clog.x.lock.socksndbuf_lock = mtx_owned(&(inp->sctp_socket->so_snd.sb_mtx));
 383         } else {
 384                 sctp_clog.x.lock.sock_lock = SCTP_LOCK_UNKNOWN;
 385                 sctp_clog.x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN;
 386                 sctp_clog.x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN;
 387         }
 388         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 389             SCTP_LOG_LOCK_EVENT,
 390             from,
 391             sctp_clog.x.misc.log1,
 392             sctp_clog.x.misc.log2,
 393             sctp_clog.x.misc.log3,
 394             sctp_clog.x.misc.log4);
 395 #endif
 396 }
 397
 398 void
 399 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from)
 400 {
 401 #if defined(SCTP_LOCAL_TRACE_BUF)
 402         struct sctp_cwnd_log sctp_clog;
 403
 404         memset(&sctp_clog, 0, sizeof(sctp_clog));
 405         sctp_clog.x.cwnd.net = net;
 406         sctp_clog.x.cwnd.cwnd_new_value = error;
 407         sctp_clog.x.cwnd.inflight = net->flight_size;
 408         sctp_clog.x.cwnd.cwnd_augment = burst;
 409         if (stcb->asoc.send_queue_cnt > 255)
 410                 sctp_clog.x.cwnd.cnt_in_send = 255;
 411         else
 412                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 413         if (stcb->asoc.stream_queue_cnt > 255)
 414                 sctp_clog.x.cwnd.cnt_in_str = 255;
 415         else
 416                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 417         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 418             SCTP_LOG_EVENT_MAXBURST,
 419             from,
 420             sctp_clog.x.misc.log1,
 421             sctp_clog.x.misc.log2,
 422             sctp_clog.x.misc.log3,
 423             sctp_clog.x.misc.log4);
 424 #endif
 425 }
 426
 427 void
 428 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead)
 429 {
 430 #if defined(SCTP_LOCAL_TRACE_BUF)
 431         struct sctp_cwnd_log sctp_clog;
 432
 433         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 434         sctp_clog.x.rwnd.send_size = snd_size;
 435         sctp_clog.x.rwnd.overhead = overhead;
 436         sctp_clog.x.rwnd.new_rwnd = 0;
 437         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 438             SCTP_LOG_EVENT_RWND,
 439             from,
 440             sctp_clog.x.misc.log1,
 441             sctp_clog.x.misc.log2,
 442             sctp_clog.x.misc.log3,
 443             sctp_clog.x.misc.log4);
 444 #endif
 445 }
 446
 447 void
 448 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval)
 449 {
 450 #if defined(SCTP_LOCAL_TRACE_BUF)
 451         struct sctp_cwnd_log sctp_clog;
 452
 453         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 454         sctp_clog.x.rwnd.send_size = flight_size;
 455         sctp_clog.x.rwnd.overhead = overhead;
 456         sctp_clog.x.rwnd.new_rwnd = a_rwndval;
 457         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 458             SCTP_LOG_EVENT_RWND,
 459             from,
 460             sctp_clog.x.misc.log1,
 461             sctp_clog.x.misc.log2,
 462             sctp_clog.x.misc.log3,
 463             sctp_clog.x.misc.log4);
 464 #endif
 465 }
 466
 467 #ifdef SCTP_MBCNT_LOGGING
 468 static void
 469 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt)
 470 {
 471 #if defined(SCTP_LOCAL_TRACE_BUF)
 472         struct sctp_cwnd_log sctp_clog;
 473
 474         sctp_clog.x.mbcnt.total_queue_size = total_oq;
 475         sctp_clog.x.mbcnt.size_change = book;
 476         sctp_clog.x.mbcnt.total_queue_mb_size = total_mbcnt_q;
 477         sctp_clog.x.mbcnt.mbcnt_change = mbcnt;
 478         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 479             SCTP_LOG_EVENT_MBCNT,
 480             from,
 481             sctp_clog.x.misc.log1,
 482             sctp_clog.x.misc.log2,
 483             sctp_clog.x.misc.log3,
 484             sctp_clog.x.misc.log4);
 485 #endif
 486 }
 487 #endif
 488
 489 void
 490 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d)
 491 {
 492 #if defined(SCTP_LOCAL_TRACE_BUF)
 493         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 494             SCTP_LOG_MISC_EVENT,
 495             from,
 496             a, b, c, d);
 497 #endif
 498 }
 499
 500 void
 501 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t wake_cnt, int from)
 502 {
 503 #if defined(SCTP_LOCAL_TRACE_BUF)
 504         struct sctp_cwnd_log sctp_clog;
 505
 506         sctp_clog.x.wake.stcb = (void *)stcb;
 507         sctp_clog.x.wake.wake_cnt = wake_cnt;
 508         sctp_clog.x.wake.flight = stcb->asoc.total_flight_count;
 509         sctp_clog.x.wake.send_q = stcb->asoc.send_queue_cnt;
 510         sctp_clog.x.wake.sent_q = stcb->asoc.sent_queue_cnt;
 511
 512         if (stcb->asoc.stream_queue_cnt < 0xff)
 513                 sctp_clog.x.wake.stream_qcnt = (uint8_t)stcb->asoc.stream_queue_cnt;
 514         else
 515                 sctp_clog.x.wake.stream_qcnt = 0xff;
 516
 517         if (stcb->asoc.chunks_on_out_queue < 0xff)
 518                 sctp_clog.x.wake.chunks_on_oque = (uint8_t)stcb->asoc.chunks_on_out_queue;
 519         else
 520                 sctp_clog.x.wake.chunks_on_oque = 0xff;
 521
 522         sctp_clog.x.wake.sctpflags = 0;
 523         /* set in the defered mode stuff */
 524         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE)
 525                 sctp_clog.x.wake.sctpflags |= 1;
 526         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT)
 527                 sctp_clog.x.wake.sctpflags |= 2;
 528         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT)
 529                 sctp_clog.x.wake.sctpflags |= 4;
 530         /* what about the sb */
 531         if (stcb->sctp_socket) {
 532                 struct socket *so = stcb->sctp_socket;
 533
 534                 sctp_clog.x.wake.sbflags = (uint8_t)((so->so_snd.sb_flags & 0x00ff));
 535         } else {
 536                 sctp_clog.x.wake.sbflags = 0xff;
 537         }
 538         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 539             SCTP_LOG_EVENT_WAKE,
 540             from,
 541             sctp_clog.x.misc.log1,
 542             sctp_clog.x.misc.log2,
 543             sctp_clog.x.misc.log3,
 544             sctp_clog.x.misc.log4);
 545 #endif
 546 }
 547
 548 void
 549 sctp_log_block(uint8_t from, struct sctp_association *asoc, ssize_t sendlen)
 550 {
 551 #if defined(SCTP_LOCAL_TRACE_BUF)
 552         struct sctp_cwnd_log sctp_clog;
 553
 554         sctp_clog.x.blk.onsb = asoc->total_output_queue_size;
 555         sctp_clog.x.blk.send_sent_qcnt = (uint16_t)(asoc->send_queue_cnt + asoc->sent_queue_cnt);
 556         sctp_clog.x.blk.peer_rwnd = asoc->peers_rwnd;
 557         sctp_clog.x.blk.stream_qcnt = (uint16_t)asoc->stream_queue_cnt;
 558         sctp_clog.x.blk.chunks_on_oque = (uint16_t)asoc->chunks_on_out_queue;
 559         sctp_clog.x.blk.flight_size = (uint16_t)(asoc->total_flight / 1024);
 560         sctp_clog.x.blk.sndlen = (uint32_t)sendlen;
 561         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 562             SCTP_LOG_EVENT_BLOCK,
 563             from,
 564             sctp_clog.x.misc.log1,
 565             sctp_clog.x.misc.log2,
 566             sctp_clog.x.misc.log3,
 567             sctp_clog.x.misc.log4);
 568 #endif
 569 }
 570
 571 int
 572 sctp_fill_stat_log(void *optval SCTP_UNUSED, size_t *optsize SCTP_UNUSED)
 573 {
 574         /* May need to fix this if ktrdump does not work */
 575         return (0);
 576 }
 577
 578 #ifdef SCTP_AUDITING_ENABLED
 579 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2];
 580 static int sctp_audit_indx = 0;
 581
 582 static
 583 void
 584 sctp_print_audit_report(void)
 585 {
 586         int i;
 587         int cnt;
 588
 589         cnt = 0;
 590         for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) {
 591                 if ((sctp_audit_data[i][0] == 0xe0) &&
 592                     (sctp_audit_data[i][1] == 0x01)) {
 593                         cnt = 0;
 594                         SCTP_PRINTF("\n");
 595                 } else if (sctp_audit_data[i][0] == 0xf0) {
 596                         cnt = 0;
 597                         SCTP_PRINTF("\n");
 598                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 599                     (sctp_audit_data[i][1] == 0x01)) {
 600                         SCTP_PRINTF("\n");
 601                         cnt = 0;
 602                 }
 603                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0],
 604                     (uint32_t)sctp_audit_data[i][1]);
 605                 cnt++;
 606                 if ((cnt % 14) == 0)
 607                         SCTP_PRINTF("\n");
 608         }
 609         for (i = 0; i < sctp_audit_indx; i++) {
 610                 if ((sctp_audit_data[i][0] == 0xe0) &&
 611                     (sctp_audit_data[i][1] == 0x01)) {
 612                         cnt = 0;
 613                         SCTP_PRINTF("\n");
 614                 } else if (sctp_audit_data[i][0] == 0xf0) {
 615                         cnt = 0;
 616                         SCTP_PRINTF("\n");
 617                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 618                     (sctp_audit_data[i][1] == 0x01)) {
 619                         SCTP_PRINTF("\n");
 620                         cnt = 0;
 621                 }
 622                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0],
 623                     (uint32_t)sctp_audit_data[i][1]);
 624                 cnt++;
 625                 if ((cnt % 14) == 0)
 626                         SCTP_PRINTF("\n");
 627         }
 628         SCTP_PRINTF("\n");
 629 }
 630
 631 void
 632 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 633     struct sctp_nets *net)
 634 {
 635         int resend_cnt, tot_out, rep, tot_book_cnt;
 636         struct sctp_nets *lnet;
 637         struct sctp_tmit_chunk *chk;
 638
 639         sctp_audit_data[sctp_audit_indx][0] = 0xAA;
 640         sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from;
 641         sctp_audit_indx++;
 642         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 643                 sctp_audit_indx = 0;
 644         }
 645         if (inp == NULL) {
 646                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 647                 sctp_audit_data[sctp_audit_indx][1] = 0x01;
 648                 sctp_audit_indx++;
 649                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 650                         sctp_audit_indx = 0;
 651                 }
 652                 return;
 653         }
 654         if (stcb == NULL) {
 655                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 656                 sctp_audit_data[sctp_audit_indx][1] = 0x02;
 657                 sctp_audit_indx++;
 658                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 659                         sctp_audit_indx = 0;
 660                 }
 661                 return;
 662         }
 663         sctp_audit_data[sctp_audit_indx][0] = 0xA1;
 664         sctp_audit_data[sctp_audit_indx][1] =
 665             (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 666         sctp_audit_indx++;
 667         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 668                 sctp_audit_indx = 0;
 669         }
 670         rep = 0;
 671         tot_book_cnt = 0;
 672         resend_cnt = tot_out = 0;
 673         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 674                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 675                         resend_cnt++;
 676                 } else if (chk->sent < SCTP_DATAGRAM_RESEND) {
 677                         tot_out += chk->book_size;
 678                         tot_book_cnt++;
 679                 }
 680         }
 681         if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) {
 682                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 683                 sctp_audit_data[sctp_audit_indx][1] = 0xA1;
 684                 sctp_audit_indx++;
 685                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 686                         sctp_audit_indx = 0;
 687                 }
 688                 SCTP_PRINTF("resend_cnt:%d asoc-tot:%d\n",
 689                     resend_cnt, stcb->asoc.sent_queue_retran_cnt);
 690                 rep = 1;
 691                 stcb->asoc.sent_queue_retran_cnt = resend_cnt;
 692                 sctp_audit_data[sctp_audit_indx][0] = 0xA2;
 693                 sctp_audit_data[sctp_audit_indx][1] =
 694                     (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 695                 sctp_audit_indx++;
 696                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 697                         sctp_audit_indx = 0;
 698                 }
 699         }
 700         if (tot_out != stcb->asoc.total_flight) {
 701                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 702                 sctp_audit_data[sctp_audit_indx][1] = 0xA2;
 703                 sctp_audit_indx++;
 704                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 705                         sctp_audit_indx = 0;
 706                 }
 707                 rep = 1;
 708                 SCTP_PRINTF("tot_flt:%d asoc_tot:%d\n", tot_out,
 709                     (int)stcb->asoc.total_flight);
 710                 stcb->asoc.total_flight = tot_out;
 711         }
 712         if (tot_book_cnt != stcb->asoc.total_flight_count) {
 713                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 714                 sctp_audit_data[sctp_audit_indx][1] = 0xA5;
 715                 sctp_audit_indx++;
 716                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 717                         sctp_audit_indx = 0;
 718                 }
 719                 rep = 1;
 720                 SCTP_PRINTF("tot_flt_book:%d\n", tot_book_cnt);
 721
 722                 stcb->asoc.total_flight_count = tot_book_cnt;
 723         }
 724         tot_out = 0;
 725         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 726                 tot_out += lnet->flight_size;
 727         }
 728         if (tot_out != stcb->asoc.total_flight) {
 729                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 730                 sctp_audit_data[sctp_audit_indx][1] = 0xA3;
 731                 sctp_audit_indx++;
 732                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 733                         sctp_audit_indx = 0;
 734                 }
 735                 rep = 1;
 736                 SCTP_PRINTF("real flight:%d net total was %d\n",
 737                     stcb->asoc.total_flight, tot_out);
 738                 /* now corrective action */
 739                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 740
 741                         tot_out = 0;
 742                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 743                                 if ((chk->whoTo == lnet) &&
 744                                     (chk->sent < SCTP_DATAGRAM_RESEND)) {
 745                                         tot_out += chk->book_size;
 746                                 }
 747                         }
 748                         if (lnet->flight_size != tot_out) {
 749                                 SCTP_PRINTF("net:%p flight was %d corrected to %d\n",
 750                                     (void *)lnet, lnet->flight_size,
 751                                     tot_out);
 752                                 lnet->flight_size = tot_out;
 753                         }
 754                 }
 755         }
 756         if (rep) {
 757                 sctp_print_audit_report();
 758         }
 759 }
 760
 761 void
 762 sctp_audit_log(uint8_t ev, uint8_t fd)
 763 {
 764
 765         sctp_audit_data[sctp_audit_indx][0] = ev;
 766         sctp_audit_data[sctp_audit_indx][1] = fd;
 767         sctp_audit_indx++;
 768         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 769                 sctp_audit_indx = 0;
 770         }
 771 }
 772
 773 #endif
 774
 775 /*
 776  * sctp_stop_timers_for_shutdown() should be called
 777  * when entering the SHUTDOWN_SENT or SHUTDOWN_ACK_SENT
 778  * state to make sure that all timers are stopped.
 779  */
 780 void
 781 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb)
 782 {
 783         struct sctp_association *asoc;
 784         struct sctp_nets *net;
 785
 786         asoc = &stcb->asoc;
 787
 788         (void)SCTP_OS_TIMER_STOP(&asoc->dack_timer.timer);
 789         (void)SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
 790         (void)SCTP_OS_TIMER_STOP(&asoc->asconf_timer.timer);
 791         (void)SCTP_OS_TIMER_STOP(&asoc->autoclose_timer.timer);
 792         (void)SCTP_OS_TIMER_STOP(&asoc->delayed_event_timer.timer);
 793         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
 794                 (void)SCTP_OS_TIMER_STOP(&net->pmtu_timer.timer);
 795                 (void)SCTP_OS_TIMER_STOP(&net->hb_timer.timer);
 796         }
 797 }
 798
 799 /*
 800  * A list of sizes based on typical mtu's, used only if next hop size not
 801  * returned. These values MUST be multiples of 4 and MUST be ordered.
 802  */
 803 static uint32_t sctp_mtu_sizes[] = {
 804         68,
 805         296,
 806         508,
 807         512,
 808         544,
 809         576,
 810         1004,
 811         1492,
 812         1500,
 813         1536,
 814         2000,
 815         2048,
 816         4352,
 817         4464,
 818         8166,
 819         17912,
 820         32000,
 821         65532
 822 };
 823
 824 /*
 825  * Return the largest MTU in sctp_mtu_sizes smaller than val.
 826  * If val is smaller than the minimum, just return the largest
 827  * multiple of 4 smaller or equal to val.
 828  * Ensure that the result is a multiple of 4.
 829  */
 830 uint32_t
 831 sctp_get_prev_mtu(uint32_t val)
 832 {
 833         uint32_t i;
 834
 835         val &= 0xfffffffc;
 836         if (val <= sctp_mtu_sizes[0]) {
 837                 return (val);
 838         }
 839         for (i = 1; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 840                 if (val <= sctp_mtu_sizes[i]) {
 841                         break;
 842                 }
 843         }
 844         KASSERT((sctp_mtu_sizes[i - 1] & 0x00000003) == 0,
 845             ("sctp_mtu_sizes[%u] not a multiple of 4", i - 1));
 846         return (sctp_mtu_sizes[i - 1]);
 847 }
 848
 849 /*
 850  * Return the smallest MTU in sctp_mtu_sizes larger than val.
 851  * If val is larger than the maximum, just return the largest multiple of 4 smaller
 852  * or equal to val.
 853  * Ensure that the result is a multiple of 4.
 854  */
 855 uint32_t
 856 sctp_get_next_mtu(uint32_t val)
 857 {
 858         /* select another MTU that is just bigger than this one */
 859         uint32_t i;
 860
 861         val &= 0xfffffffc;
 862         for (i = 0; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 863                 if (val < sctp_mtu_sizes[i]) {
 864                         KASSERT((sctp_mtu_sizes[i] & 0x00000003) == 0,
 865                             ("sctp_mtu_sizes[%u] not a multiple of 4", i));
 866                         return (sctp_mtu_sizes[i]);
 867                 }
 868         }
 869         return (val);
 870 }
 871
 872 void
 873 sctp_fill_random_store(struct sctp_pcb *m)
 874 {
 875         /*
 876          * Here we use the MD5/SHA-1 to hash with our good randomNumbers and
 877          * our counter. The result becomes our good random numbers and we
 878          * then setup to give these out. Note that we do no locking to
 879          * protect this. This is ok, since if competing folks call this we
 880          * will get more gobbled gook in the random store which is what we
 881          * want. There is a danger that two guys will use the same random
 882          * numbers, but thats ok too since that is random as well :->
 883          */
 884         m->store_at = 0;
 885         (void)sctp_hmac(SCTP_HMAC, (uint8_t *)m->random_numbers,
 886             sizeof(m->random_numbers), (uint8_t *)&m->random_counter,
 887             sizeof(m->random_counter), (uint8_t *)m->random_store);
 888         m->random_counter++;
 889 }
 890
 891 uint32_t
 892 sctp_select_initial_TSN(struct sctp_pcb *inp)
 893 {
 894         /*
 895          * A true implementation should use random selection process to get
 896          * the initial stream sequence number, using RFC1750 as a good
 897          * guideline
 898          */
 899         uint32_t x, *xp;
 900         uint8_t *p;
 901         int store_at, new_store;
 902
 903         if (inp->initial_sequence_debug != 0) {
 904                 uint32_t ret;
 905
 906                 ret = inp->initial_sequence_debug;
 907                 inp->initial_sequence_debug++;
 908                 return (ret);
 909         }
 910 retry:
 911         store_at = inp->store_at;
 912         new_store = store_at + sizeof(uint32_t);
 913         if (new_store >= (SCTP_SIGNATURE_SIZE - 3)) {
 914                 new_store = 0;
 915         }
 916         if (!atomic_cmpset_int(&inp->store_at, store_at, new_store)) {
 917                 goto retry;
 918         }
 919         if (new_store == 0) {
 920                 /* Refill the random store */
 921                 sctp_fill_random_store(inp);
 922         }
 923         p = &inp->random_store[store_at];
 924         xp = (uint32_t *)p;
 925         x = *xp;
 926         return (x);
 927 }
 928
 929 uint32_t
 930 sctp_select_a_tag(struct sctp_inpcb *inp, uint16_t lport, uint16_t rport, int check)
 931 {
 932         uint32_t x;
 933         struct timeval now;
 934
 935         if (check) {
 936                 (void)SCTP_GETTIME_TIMEVAL(&now);
 937         }
 938         for (;;) {
 939                 x = sctp_select_initial_TSN(&inp->sctp_ep);
 940                 if (x == 0) {
 941                         /* we never use 0 */
 942                         continue;
 943                 }
 944                 if (!check || sctp_is_vtag_good(x, lport, rport, &now)) {
 945                         break;
 946                 }
 947         }
 948         return (x);
 949 }
 950
 951 int32_t
 952 sctp_map_assoc_state(int kernel_state)
 953 {
 954         int32_t user_state;
 955
 956         if (kernel_state & SCTP_STATE_WAS_ABORTED) {
 957                 user_state = SCTP_CLOSED;
 958         } else if (kernel_state & SCTP_STATE_SHUTDOWN_PENDING) {
 959                 user_state = SCTP_SHUTDOWN_PENDING;
 960         } else {
 961                 switch (kernel_state & SCTP_STATE_MASK) {
 962                 case SCTP_STATE_EMPTY:
 963                         user_state = SCTP_CLOSED;
 964                         break;
 965                 case SCTP_STATE_INUSE:
 966                         user_state = SCTP_CLOSED;
 967                         break;
 968                 case SCTP_STATE_COOKIE_WAIT:
 969                         user_state = SCTP_COOKIE_WAIT;
 970                         break;
 971                 case SCTP_STATE_COOKIE_ECHOED:
 972                         user_state = SCTP_COOKIE_ECHOED;
 973                         break;
 974                 case SCTP_STATE_OPEN:
 975                         user_state = SCTP_ESTABLISHED;
 976                         break;
 977                 case SCTP_STATE_SHUTDOWN_SENT:
 978                         user_state = SCTP_SHUTDOWN_SENT;
 979                         break;
 980                 case SCTP_STATE_SHUTDOWN_RECEIVED:
 981                         user_state = SCTP_SHUTDOWN_RECEIVED;
 982                         break;
 983                 case SCTP_STATE_SHUTDOWN_ACK_SENT:
 984                         user_state = SCTP_SHUTDOWN_ACK_SENT;
 985                         break;
 986                 default:
 987                         user_state = SCTP_CLOSED;
 988                         break;
 989                 }
 990         }
 991         return (user_state);
 992 }
 993
 994 int
 995 sctp_init_asoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 996     uint32_t override_tag, uint32_t vrf_id, uint16_t o_strms)
 997 {
 998         struct sctp_association *asoc;
 999
1000         /*
1001          * Anything set to zero is taken care of by the allocation routine's
1002          * bzero
1003          */
1004
1005         /*
1006          * Up front select what scoping to apply on addresses I tell my peer
1007          * Not sure what to do with these right now, we will need to come up
1008          * with a way to set them. We may need to pass them through from the
1009          * caller in the sctp_aloc_assoc() function.
1010          */
1011         int i;
1012 #if defined(SCTP_DETAILED_STR_STATS)
1013         int j;
1014 #endif
1015
1016         asoc = &stcb->asoc;
1017         /* init all variables to a known value. */
1018         SCTP_SET_STATE(stcb, SCTP_STATE_INUSE);
1019         asoc->max_burst = inp->sctp_ep.max_burst;
1020         asoc->fr_max_burst = inp->sctp_ep.fr_max_burst;
1021         asoc->heart_beat_delay = TICKS_TO_MSEC(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]);
1022         asoc->cookie_life = inp->sctp_ep.def_cookie_life;
1023         asoc->sctp_cmt_on_off = inp->sctp_cmt_on_off;
1024         asoc->ecn_supported = inp->ecn_supported;
1025         asoc->prsctp_supported = inp->prsctp_supported;
1026         asoc->idata_supported = inp->idata_supported;
1027         asoc->auth_supported = inp->auth_supported;
1028         asoc->asconf_supported = inp->asconf_supported;
1029         asoc->reconfig_supported = inp->reconfig_supported;
1030         asoc->nrsack_supported = inp->nrsack_supported;
1031         asoc->pktdrop_supported = inp->pktdrop_supported;
1032         asoc->idata_supported = inp->idata_supported;
1033         asoc->sctp_cmt_pf = (uint8_t)0;
1034         asoc->sctp_frag_point = inp->sctp_frag_point;
1035         asoc->sctp_features = inp->sctp_features;
1036         asoc->default_dscp = inp->sctp_ep.default_dscp;
1037         asoc->max_cwnd = inp->max_cwnd;
1038 #ifdef INET6
1039         if (inp->sctp_ep.default_flowlabel) {
1040                 asoc->default_flowlabel = inp->sctp_ep.default_flowlabel;
1041         } else {
1042                 if (inp->ip_inp.inp.inp_flags & IN6P_AUTOFLOWLABEL) {
1043                         asoc->default_flowlabel = sctp_select_initial_TSN(&inp->sctp_ep);
1044                         asoc->default_flowlabel &= 0x000fffff;
1045                         asoc->default_flowlabel |= 0x80000000;
1046                 } else {
1047                         asoc->default_flowlabel = 0;
1048                 }
1049         }
1050 #endif
1051         asoc->sb_send_resv = 0;
1052         if (override_tag) {
1053                 asoc->my_vtag = override_tag;
1054         } else {
1055                 asoc->my_vtag = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
1056         }
1057         /* Get the nonce tags */
1058         asoc->my_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
1059         asoc->peer_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
1060         asoc->vrf_id = vrf_id;
1061
1062 #ifdef SCTP_ASOCLOG_OF_TSNS
1063         asoc->tsn_in_at = 0;
1064         asoc->tsn_out_at = 0;
1065         asoc->tsn_in_wrapped = 0;
1066         asoc->tsn_out_wrapped = 0;
1067         asoc->cumack_log_at = 0;
1068         asoc->cumack_log_atsnt = 0;
1069 #endif
1070 #ifdef SCTP_FS_SPEC_LOG
1071         asoc->fs_index = 0;
1072 #endif
1073         asoc->refcnt = 0;
1074         asoc->assoc_up_sent = 0;
1075         asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number = asoc->sending_seq =
1076             sctp_select_initial_TSN(&inp->sctp_ep);
1077         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
1078         /* we are optimisitic here */
1079         asoc->peer_supports_nat = 0;
1080         asoc->sent_queue_retran_cnt = 0;
1081
1082         /* for CMT */
1083         asoc->last_net_cmt_send_started = NULL;
1084
1085         /* This will need to be adjusted */
1086         asoc->last_acked_seq = asoc->init_seq_number - 1;
1087         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1088         asoc->asconf_seq_in = asoc->last_acked_seq;
1089
1090         /* here we are different, we hold the next one we expect */
1091         asoc->str_reset_seq_in = asoc->last_acked_seq + 1;
1092
1093         asoc->initial_init_rto_max = inp->sctp_ep.initial_init_rto_max;
1094         asoc->initial_rto = inp->sctp_ep.initial_rto;
1095
1096         asoc->default_mtu = inp->sctp_ep.default_mtu;
1097         asoc->max_init_times = inp->sctp_ep.max_init_times;
1098         asoc->max_send_times = inp->sctp_ep.max_send_times;
1099         asoc->def_net_failure = inp->sctp_ep.def_net_failure;
1100         asoc->def_net_pf_threshold = inp->sctp_ep.def_net_pf_threshold;
1101         asoc->free_chunk_cnt = 0;
1102
1103         asoc->iam_blocking = 0;
1104         asoc->context = inp->sctp_context;
1105         asoc->local_strreset_support = inp->local_strreset_support;
1106         asoc->def_send = inp->def_send;
1107         asoc->delayed_ack = TICKS_TO_MSEC(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]);
1108         asoc->sack_freq = inp->sctp_ep.sctp_sack_freq;
1109         asoc->pr_sctp_cnt = 0;
1110         asoc->total_output_queue_size = 0;
1111
1112         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1113                 asoc->scope.ipv6_addr_legal = 1;
1114                 if (SCTP_IPV6_V6ONLY(inp) == 0) {
1115                         asoc->scope.ipv4_addr_legal = 1;
1116                 } else {
1117                         asoc->scope.ipv4_addr_legal = 0;
1118                 }
1119         } else {
1120                 asoc->scope.ipv6_addr_legal = 0;
1121                 asoc->scope.ipv4_addr_legal = 1;
1122         }
1123
1124         asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(inp->sctp_socket), SCTP_MINIMAL_RWND);
1125         asoc->peers_rwnd = SCTP_SB_LIMIT_RCV(inp->sctp_socket);
1126
1127         asoc->smallest_mtu = inp->sctp_frag_point;
1128         asoc->minrto = inp->sctp_ep.sctp_minrto;
1129         asoc->maxrto = inp->sctp_ep.sctp_maxrto;
1130
1131         asoc->stream_locked_on = 0;
1132         asoc->ecn_echo_cnt_onq = 0;
1133         asoc->stream_locked = 0;
1134
1135         asoc->send_sack = 1;
1136
1137         LIST_INIT(&asoc->sctp_restricted_addrs);
1138
1139         TAILQ_INIT(&asoc->nets);
1140         TAILQ_INIT(&asoc->pending_reply_queue);
1141         TAILQ_INIT(&asoc->asconf_ack_sent);
1142         /* Setup to fill the hb random cache at first HB */
1143         asoc->hb_random_idx = 4;
1144
1145         asoc->sctp_autoclose_ticks = inp->sctp_ep.auto_close_time;
1146
1147         stcb->asoc.congestion_control_module = inp->sctp_ep.sctp_default_cc_module;
1148         stcb->asoc.cc_functions = sctp_cc_functions[inp->sctp_ep.sctp_default_cc_module];
1149
1150         stcb->asoc.stream_scheduling_module = inp->sctp_ep.sctp_default_ss_module;
1151         stcb->asoc.ss_functions = sctp_ss_functions[inp->sctp_ep.sctp_default_ss_module];
1152
1153         /*
1154          * Now the stream parameters, here we allocate space for all streams
1155          * that we request by default.
1156          */
1157         asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams =
1158             o_strms;
1159         SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *,
1160             asoc->streamoutcnt * sizeof(struct sctp_stream_out),
1161             SCTP_M_STRMO);
1162         if (asoc->strmout == NULL) {
1163                 /* big trouble no memory */
1164                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1165                 return (ENOMEM);
1166         }
1167         for (i = 0; i < asoc->streamoutcnt; i++) {
1168                 /*
1169                  * inbound side must be set to 0xffff, also NOTE when we get
1170                  * the INIT-ACK back (for INIT sender) we MUST reduce the
1171                  * count (streamoutcnt) but first check if we sent to any of
1172                  * the upper streams that were dropped (if some were). Those
1173                  * that were dropped must be notified to the upper layer as
1174                  * failed to send.
1175                  */
1176                 asoc->strmout[i].next_mid_ordered = 0;
1177                 asoc->strmout[i].next_mid_unordered = 0;
1178                 TAILQ_INIT(&asoc->strmout[i].outqueue);
1179                 asoc->strmout[i].chunks_on_queues = 0;
1180 #if defined(SCTP_DETAILED_STR_STATS)
1181                 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) {
1182                         asoc->strmout[i].abandoned_sent[j] = 0;
1183                         asoc->strmout[i].abandoned_unsent[j] = 0;
1184                 }
1185 #else
1186                 asoc->strmout[i].abandoned_sent[0] = 0;
1187                 asoc->strmout[i].abandoned_unsent[0] = 0;
1188 #endif
1189                 asoc->strmout[i].sid = i;
1190                 asoc->strmout[i].last_msg_incomplete = 0;
1191                 asoc->strmout[i].state = SCTP_STREAM_OPENING;
1192                 asoc->ss_functions.sctp_ss_init_stream(stcb, &asoc->strmout[i], NULL);
1193         }
1194         asoc->ss_functions.sctp_ss_init(stcb, asoc, 0);
1195
1196         /* Now the mapping array */
1197         asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY;
1198         SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size,
1199             SCTP_M_MAP);
1200         if (asoc->mapping_array == NULL) {
1201                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1202                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1203                 return (ENOMEM);
1204         }
1205         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
1206         SCTP_MALLOC(asoc->nr_mapping_array, uint8_t *, asoc->mapping_array_size,
1207             SCTP_M_MAP);
1208         if (asoc->nr_mapping_array == NULL) {
1209                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1210                 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1211                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1212                 return (ENOMEM);
1213         }
1214         memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
1215
1216         /* Now the init of the other outqueues */
1217         TAILQ_INIT(&asoc->free_chunks);
1218         TAILQ_INIT(&asoc->control_send_queue);
1219         TAILQ_INIT(&asoc->asconf_send_queue);
1220         TAILQ_INIT(&asoc->send_queue);
1221         TAILQ_INIT(&asoc->sent_queue);
1222         TAILQ_INIT(&asoc->resetHead);
1223         asoc->max_inbound_streams = inp->sctp_ep.max_open_streams_intome;
1224         TAILQ_INIT(&asoc->asconf_queue);
1225         /* authentication fields */
1226         asoc->authinfo.random = NULL;
1227         asoc->authinfo.active_keyid = 0;
1228         asoc->authinfo.assoc_key = NULL;
1229         asoc->authinfo.assoc_keyid = 0;
1230         asoc->authinfo.recv_key = NULL;
1231         asoc->authinfo.recv_keyid = 0;
1232         LIST_INIT(&asoc->shared_keys);
1233         asoc->marked_retrans = 0;
1234         asoc->port = inp->sctp_ep.port;
1235         asoc->timoinit = 0;
1236         asoc->timodata = 0;
1237         asoc->timosack = 0;
1238         asoc->timoshutdown = 0;
1239         asoc->timoheartbeat = 0;
1240         asoc->timocookie = 0;
1241         asoc->timoshutdownack = 0;
1242         (void)SCTP_GETTIME_TIMEVAL(&asoc->start_time);
1243         asoc->discontinuity_time = asoc->start_time;
1244         for (i = 0; i < SCTP_PR_SCTP_MAX + 1; i++) {
1245                 asoc->abandoned_unsent[i] = 0;
1246                 asoc->abandoned_sent[i] = 0;
1247         }
1248         /*
1249          * sa_ignore MEMLEAK {memory is put in the assoc mapping array and
1250          * freed later when the association is freed.
1251          */
1252         return (0);
1253 }
1254
1255 void
1256 sctp_print_mapping_array(struct sctp_association *asoc)
1257 {
1258         unsigned int i, limit;
1259
1260         SCTP_PRINTF("Mapping array size: %d, baseTSN: %8.8x, cumAck: %8.8x, highestTSN: (%8.8x, %8.8x).\n",
1261             asoc->mapping_array_size,
1262             asoc->mapping_array_base_tsn,
1263             asoc->cumulative_tsn,
1264             asoc->highest_tsn_inside_map,
1265             asoc->highest_tsn_inside_nr_map);
1266         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1267                 if (asoc->mapping_array[limit - 1] != 0) {
1268                         break;
1269                 }
1270         }
1271         SCTP_PRINTF("Renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1272         for (i = 0; i < limit; i++) {
1273                 SCTP_PRINTF("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1274         }
1275         if (limit % 16)
1276                 SCTP_PRINTF("\n");
1277         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1278                 if (asoc->nr_mapping_array[limit - 1]) {
1279                         break;
1280                 }
1281         }
1282         SCTP_PRINTF("Non renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1283         for (i = 0; i < limit; i++) {
1284                 SCTP_PRINTF("%2.2x%c", asoc->nr_mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1285         }
1286         if (limit % 16)
1287                 SCTP_PRINTF("\n");
1288 }
1289
1290 int
1291 sctp_expand_mapping_array(struct sctp_association *asoc, uint32_t needed)
1292 {
1293         /* mapping array needs to grow */
1294         uint8_t *new_array1, *new_array2;
1295         uint32_t new_size;
1296
1297         new_size = asoc->mapping_array_size + ((needed + 7) / 8 + SCTP_MAPPING_ARRAY_INCR);
1298         SCTP_MALLOC(new_array1, uint8_t *, new_size, SCTP_M_MAP);
1299         SCTP_MALLOC(new_array2, uint8_t *, new_size, SCTP_M_MAP);
1300         if ((new_array1 == NULL) || (new_array2 == NULL)) {
1301                 /* can't get more, forget it */
1302                 SCTP_PRINTF("No memory for expansion of SCTP mapping array %d\n", new_size);
1303                 if (new_array1) {
1304                         SCTP_FREE(new_array1, SCTP_M_MAP);
1305                 }
1306                 if (new_array2) {
1307                         SCTP_FREE(new_array2, SCTP_M_MAP);
1308                 }
1309                 return (-1);
1310         }
1311         memset(new_array1, 0, new_size);
1312         memset(new_array2, 0, new_size);
1313         memcpy(new_array1, asoc->mapping_array, asoc->mapping_array_size);
1314         memcpy(new_array2, asoc->nr_mapping_array, asoc->mapping_array_size);
1315         SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1316         SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
1317         asoc->mapping_array = new_array1;
1318         asoc->nr_mapping_array = new_array2;
1319         asoc->mapping_array_size = new_size;
1320         return (0);
1321 }
1322
1323
1324 static void
1325 sctp_iterator_work(struct sctp_iterator *it)
1326 {
1327         int iteration_count = 0;
1328         int inp_skip = 0;
1329         int first_in = 1;
1330         struct sctp_inpcb *tinp;
1331
1332         SCTP_INP_INFO_RLOCK();
1333         SCTP_ITERATOR_LOCK();
1334         sctp_it_ctl.cur_it = it;
1335         if (it->inp) {
1336                 SCTP_INP_RLOCK(it->inp);
1337                 SCTP_INP_DECR_REF(it->inp);
1338         }
1339         if (it->inp == NULL) {
1340                 /* iterator is complete */
1341 done_with_iterator:
1342                 sctp_it_ctl.cur_it = NULL;
1343                 SCTP_ITERATOR_UNLOCK();
1344                 SCTP_INP_INFO_RUNLOCK();
1345                 if (it->function_atend != NULL) {
1346                         (*it->function_atend) (it->pointer, it->val);
1347                 }
1348                 SCTP_FREE(it, SCTP_M_ITER);
1349                 return;
1350         }
1351 select_a_new_ep:
1352         if (first_in) {
1353                 first_in = 0;
1354         } else {
1355                 SCTP_INP_RLOCK(it->inp);
1356         }
1357         while (((it->pcb_flags) &&
1358             ((it->inp->sctp_flags & it->pcb_flags) != it->pcb_flags)) ||
1359             ((it->pcb_features) &&
1360             ((it->inp->sctp_features & it->pcb_features) != it->pcb_features))) {
1361                 /* endpoint flags or features don't match, so keep looking */
1362                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1363                         SCTP_INP_RUNLOCK(it->inp);
1364                         goto done_with_iterator;
1365                 }
1366                 tinp = it->inp;
1367                 it->inp = LIST_NEXT(it->inp, sctp_list);
1368                 SCTP_INP_RUNLOCK(tinp);
1369                 if (it->inp == NULL) {
1370                         goto done_with_iterator;
1371                 }
1372                 SCTP_INP_RLOCK(it->inp);
1373         }
1374         /* now go through each assoc which is in the desired state */
1375         if (it->done_current_ep == 0) {
1376                 if (it->function_inp != NULL)
1377                         inp_skip = (*it->function_inp) (it->inp, it->pointer, it->val);
1378                 it->done_current_ep = 1;
1379         }
1380         if (it->stcb == NULL) {
1381                 /* run the per instance function */
1382                 it->stcb = LIST_FIRST(&it->inp->sctp_asoc_list);
1383         }
1384         if ((inp_skip) || it->stcb == NULL) {
1385                 if (it->function_inp_end != NULL) {
1386                         inp_skip = (*it->function_inp_end) (it->inp,
1387                             it->pointer,
1388                             it->val);
1389                 }
1390                 SCTP_INP_RUNLOCK(it->inp);
1391                 goto no_stcb;
1392         }
1393         while (it->stcb) {
1394                 SCTP_TCB_LOCK(it->stcb);
1395                 if (it->asoc_state && ((it->stcb->asoc.state & it->asoc_state) != it->asoc_state)) {
1396                         /* not in the right state... keep looking */
1397                         SCTP_TCB_UNLOCK(it->stcb);
1398                         goto next_assoc;
1399                 }
1400                 /* see if we have limited out the iterator loop */
1401                 iteration_count++;
1402                 if (iteration_count > SCTP_ITERATOR_MAX_AT_ONCE) {
1403                         /* Pause to let others grab the lock */
1404                         atomic_add_int(&it->stcb->asoc.refcnt, 1);
1405                         SCTP_TCB_UNLOCK(it->stcb);
1406                         SCTP_INP_INCR_REF(it->inp);
1407                         SCTP_INP_RUNLOCK(it->inp);
1408                         SCTP_ITERATOR_UNLOCK();
1409                         SCTP_INP_INFO_RUNLOCK();
1410                         SCTP_INP_INFO_RLOCK();
1411                         SCTP_ITERATOR_LOCK();
1412                         if (sctp_it_ctl.iterator_flags) {
1413                                 /* We won't be staying here */
1414                                 SCTP_INP_DECR_REF(it->inp);
1415                                 atomic_add_int(&it->stcb->asoc.refcnt, -1);
1416                                 if (sctp_it_ctl.iterator_flags &
1417                                     SCTP_ITERATOR_STOP_CUR_IT) {
1418                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_IT;
1419                                         goto done_with_iterator;
1420                                 }
1421                                 if (sctp_it_ctl.iterator_flags &
1422                                     SCTP_ITERATOR_STOP_CUR_INP) {
1423                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_INP;
1424                                         goto no_stcb;
1425                                 }
1426                                 /* If we reach here huh? */
1427                                 SCTP_PRINTF("Unknown it ctl flag %x\n",
1428                                     sctp_it_ctl.iterator_flags);
1429                                 sctp_it_ctl.iterator_flags = 0;
1430                         }
1431                         SCTP_INP_RLOCK(it->inp);
1432                         SCTP_INP_DECR_REF(it->inp);
1433                         SCTP_TCB_LOCK(it->stcb);
1434                         atomic_add_int(&it->stcb->asoc.refcnt, -1);
1435                         iteration_count = 0;
1436                 }
1437
1438                 /* run function on this one */
1439                 (*it->function_assoc) (it->inp, it->stcb, it->pointer, it->val);
1440
1441                 /*
1442                  * we lie here, it really needs to have its own type but
1443                  * first I must verify that this won't effect things :-0
1444                  */
1445                 if (it->no_chunk_output == 0)
1446                         sctp_chunk_output(it->inp, it->stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1447
1448                 SCTP_TCB_UNLOCK(it->stcb);
1449 next_assoc:
1450                 it->stcb = LIST_NEXT(it->stcb, sctp_tcblist);
1451                 if (it->stcb == NULL) {
1452                         /* Run last function */
1453                         if (it->function_inp_end != NULL) {
1454                                 inp_skip = (*it->function_inp_end) (it->inp,
1455                                     it->pointer,
1456                                     it->val);
1457                         }
1458                 }
1459         }
1460         SCTP_INP_RUNLOCK(it->inp);
1461 no_stcb:
1462         /* done with all assocs on this endpoint, move on to next endpoint */
1463         it->done_current_ep = 0;
1464         if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1465                 it->inp = NULL;
1466         } else {
1467                 it->inp = LIST_NEXT(it->inp, sctp_list);
1468         }
1469         if (it->inp == NULL) {
1470                 goto done_with_iterator;
1471         }
1472         goto select_a_new_ep;
1473 }
1474
1475 void
1476 sctp_iterator_worker(void)
1477 {
1478         struct sctp_iterator *it, *nit;
1479
1480         /* This function is called with the WQ lock in place */
1481
1482         sctp_it_ctl.iterator_running = 1;
1483         TAILQ_FOREACH_SAFE(it, &sctp_it_ctl.iteratorhead, sctp_nxt_itr, nit) {
1484                 /* now lets work on this one */
1485                 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
1486                 SCTP_IPI_ITERATOR_WQ_UNLOCK();
1487                 CURVNET_SET(it->vn);
1488                 sctp_iterator_work(it);
1489                 CURVNET_RESTORE();
1490                 SCTP_IPI_ITERATOR_WQ_LOCK();
1491                 /* sa_ignore FREED_MEMORY */
1492         }
1493         sctp_it_ctl.iterator_running = 0;
1494         return;
1495 }
1496
1497
1498 static void
1499 sctp_handle_addr_wq(void)
1500 {
1501         /* deal with the ADDR wq from the rtsock calls */
1502         struct sctp_laddr *wi, *nwi;
1503         struct sctp_asconf_iterator *asc;
1504
1505         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
1506             sizeof(struct sctp_asconf_iterator), SCTP_M_ASC_IT);
1507         if (asc == NULL) {
1508                 /* Try later, no memory */
1509                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
1510                     (struct sctp_inpcb *)NULL,
1511                     (struct sctp_tcb *)NULL,
1512                     (struct sctp_nets *)NULL);
1513                 return;
1514         }
1515         LIST_INIT(&asc->list_of_work);
1516         asc->cnt = 0;
1517
1518         LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) {
1519                 LIST_REMOVE(wi, sctp_nxt_addr);
1520                 LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
1521                 asc->cnt++;
1522         }
1523
1524         if (asc->cnt == 0) {
1525                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1526         } else {
1527                 int ret;
1528
1529                 ret = sctp_initiate_iterator(sctp_asconf_iterator_ep,
1530                     sctp_asconf_iterator_stcb,
1531                     NULL,       /* No ep end for boundall */
1532                     SCTP_PCB_FLAGS_BOUNDALL,
1533                     SCTP_PCB_ANY_FEATURES,
1534                     SCTP_ASOC_ANY_STATE,
1535                     (void *)asc, 0,
1536                     sctp_asconf_iterator_end, NULL, 0);
1537                 if (ret) {
1538                         SCTP_PRINTF("Failed to initiate iterator for handle_addr_wq\n");
1539                         /*
1540                          * Freeing if we are stopping or put back on the
1541                          * addr_wq.
1542                          */
1543                         if (SCTP_BASE_VAR(sctp_pcb_initialized) == 0) {
1544                                 sctp_asconf_iterator_end(asc, 0);
1545                         } else {
1546                                 LIST_FOREACH(wi, &asc->list_of_work, sctp_nxt_addr) {
1547                                         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
1548                                 }
1549                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1550                         }
1551                 }
1552         }
1553 }
1554
1555 void
1556 sctp_timeout_handler(void *t)
1557 {
1558         struct sctp_inpcb *inp;
1559         struct sctp_tcb *stcb;
1560         struct sctp_nets *net;
1561         struct sctp_timer *tmr;
1562         struct mbuf *op_err;
1563 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1564         struct socket *so;
1565 #endif
1566         int did_output;
1567         int type;
1568
1569         tmr = (struct sctp_timer *)t;
1570         inp = (struct sctp_inpcb *)tmr->ep;
1571         stcb = (struct sctp_tcb *)tmr->tcb;
1572         net = (struct sctp_nets *)tmr->net;
1573         CURVNET_SET((struct vnet *)tmr->vnet);
1574         did_output = 1;
1575
1576 #ifdef SCTP_AUDITING_ENABLED
1577         sctp_audit_log(0xF0, (uint8_t)tmr->type);
1578         sctp_auditing(3, inp, stcb, net);
1579 #endif
1580
1581         /* sanity checks... */
1582         if (tmr->self != (void *)tmr) {
1583                 /*
1584                  * SCTP_PRINTF("Stale SCTP timer fired (%p), ignoring...\n",
1585                  * (void *)tmr);
1586                  */
1587                 CURVNET_RESTORE();
1588                 return;
1589         }
1590         tmr->stopped_from = 0xa001;
1591         if (!SCTP_IS_TIMER_TYPE_VALID(tmr->type)) {
1592                 /*
1593                  * SCTP_PRINTF("SCTP timer fired with invalid type: 0x%x\n",
1594                  * tmr->type);
1595                  */
1596                 CURVNET_RESTORE();
1597                 return;
1598         }
1599         tmr->stopped_from = 0xa002;
1600         if ((tmr->type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL)) {
1601                 CURVNET_RESTORE();
1602                 return;
1603         }
1604         /* if this is an iterator timeout, get the struct and clear inp */
1605         tmr->stopped_from = 0xa003;
1606         if (inp) {
1607                 SCTP_INP_INCR_REF(inp);
1608                 if ((inp->sctp_socket == NULL) &&
1609                     ((tmr->type != SCTP_TIMER_TYPE_INPKILL) &&
1610                     (tmr->type != SCTP_TIMER_TYPE_INIT) &&
1611                     (tmr->type != SCTP_TIMER_TYPE_SEND) &&
1612                     (tmr->type != SCTP_TIMER_TYPE_RECV) &&
1613                     (tmr->type != SCTP_TIMER_TYPE_HEARTBEAT) &&
1614                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWN) &&
1615                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNACK) &&
1616                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNGUARD) &&
1617                     (tmr->type != SCTP_TIMER_TYPE_ASOCKILL))) {
1618                         SCTP_INP_DECR_REF(inp);
1619                         CURVNET_RESTORE();
1620                         return;
1621                 }
1622         }
1623         tmr->stopped_from = 0xa004;
1624         if (stcb) {
1625                 atomic_add_int(&stcb->asoc.refcnt, 1);
1626                 if (stcb->asoc.state == 0) {
1627                         atomic_add_int(&stcb->asoc.refcnt, -1);
1628                         if (inp) {
1629                                 SCTP_INP_DECR_REF(inp);
1630                         }
1631                         CURVNET_RESTORE();
1632                         return;
1633                 }
1634         }
1635         type = tmr->type;
1636         tmr->stopped_from = 0xa005;
1637         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer type %d goes off\n", type);
1638         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1639                 if (inp) {
1640                         SCTP_INP_DECR_REF(inp);
1641                 }
1642                 if (stcb) {
1643                         atomic_add_int(&stcb->asoc.refcnt, -1);
1644                 }
1645                 CURVNET_RESTORE();
1646                 return;
1647         }
1648         tmr->stopped_from = 0xa006;
1649
1650         if (stcb) {
1651                 SCTP_TCB_LOCK(stcb);
1652                 atomic_add_int(&stcb->asoc.refcnt, -1);
1653                 if ((type != SCTP_TIMER_TYPE_ASOCKILL) &&
1654                     ((stcb->asoc.state == 0) ||
1655                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED))) {
1656                         SCTP_TCB_UNLOCK(stcb);
1657                         if (inp) {
1658                                 SCTP_INP_DECR_REF(inp);
1659                         }
1660                         CURVNET_RESTORE();
1661                         return;
1662                 }
1663         } else if (inp != NULL) {
1664                 if (type != SCTP_TIMER_TYPE_INPKILL) {
1665                         SCTP_INP_WLOCK(inp);
1666                 }
1667         } else {
1668                 SCTP_WQ_ADDR_LOCK();
1669         }
1670         /* record in stopped what t-o occurred */
1671         tmr->stopped_from = type;
1672
1673         /* mark as being serviced now */
1674         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
1675                 /*
1676                  * Callout has been rescheduled.
1677                  */
1678                 goto get_out;
1679         }
1680         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1681                 /*
1682                  * Not active, so no action.
1683                  */
1684                 goto get_out;
1685         }
1686         SCTP_OS_TIMER_DEACTIVATE(&tmr->timer);
1687
1688         /* call the handler for the appropriate timer type */
1689         switch (type) {
1690         case SCTP_TIMER_TYPE_ADDR_WQ:
1691                 sctp_handle_addr_wq();
1692                 break;
1693         case SCTP_TIMER_TYPE_SEND:
1694                 if ((stcb == NULL) || (inp == NULL)) {
1695                         break;
1696                 }
1697                 SCTP_STAT_INCR(sctps_timodata);
1698                 stcb->asoc.timodata++;
1699                 stcb->asoc.num_send_timers_up--;
1700                 if (stcb->asoc.num_send_timers_up < 0) {
1701                         stcb->asoc.num_send_timers_up = 0;
1702                 }
1703                 SCTP_TCB_LOCK_ASSERT(stcb);
1704                 if (sctp_t3rxt_timer(inp, stcb, net)) {
1705                         /* no need to unlock on tcb its gone */
1706
1707                         goto out_decr;
1708                 }
1709                 SCTP_TCB_LOCK_ASSERT(stcb);
1710 #ifdef SCTP_AUDITING_ENABLED
1711                 sctp_auditing(4, inp, stcb, net);
1712 #endif
1713                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1714                 if ((stcb->asoc.num_send_timers_up == 0) &&
1715                     (stcb->asoc.sent_queue_cnt > 0)) {
1716                         struct sctp_tmit_chunk *chk;
1717
1718                         /*
1719                          * safeguard. If there on some on the sent queue
1720                          * somewhere but no timers running something is
1721                          * wrong... so we start a timer on the first chunk
1722                          * on the send queue on whatever net it is sent to.
1723                          */
1724                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1725                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb,
1726                             chk->whoTo);
1727                 }
1728                 break;
1729         case SCTP_TIMER_TYPE_INIT:
1730                 if ((stcb == NULL) || (inp == NULL)) {
1731                         break;
1732                 }
1733                 SCTP_STAT_INCR(sctps_timoinit);
1734                 stcb->asoc.timoinit++;
1735                 if (sctp_t1init_timer(inp, stcb, net)) {
1736                         /* no need to unlock on tcb its gone */
1737                         goto out_decr;
1738                 }
1739                 /* We do output but not here */
1740                 did_output = 0;
1741                 break;
1742         case SCTP_TIMER_TYPE_RECV:
1743                 if ((stcb == NULL) || (inp == NULL)) {
1744                         break;
1745                 }
1746                 SCTP_STAT_INCR(sctps_timosack);
1747                 stcb->asoc.timosack++;
1748                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
1749 #ifdef SCTP_AUDITING_ENABLED
1750                 sctp_auditing(4, inp, stcb, net);
1751 #endif
1752                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR, SCTP_SO_NOT_LOCKED);
1753                 break;
1754         case SCTP_TIMER_TYPE_SHUTDOWN:
1755                 if ((stcb == NULL) || (inp == NULL)) {
1756                         break;
1757                 }
1758                 if (sctp_shutdown_timer(inp, stcb, net)) {
1759                         /* no need to unlock on tcb its gone */
1760                         goto out_decr;
1761                 }
1762                 SCTP_STAT_INCR(sctps_timoshutdown);
1763                 stcb->asoc.timoshutdown++;
1764 #ifdef SCTP_AUDITING_ENABLED
1765                 sctp_auditing(4, inp, stcb, net);
1766 #endif
1767                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_NOT_LOCKED);
1768                 break;
1769         case SCTP_TIMER_TYPE_HEARTBEAT:
1770                 if ((stcb == NULL) || (inp == NULL) || (net == NULL)) {
1771                         break;
1772                 }
1773                 SCTP_STAT_INCR(sctps_timoheartbeat);
1774                 stcb->asoc.timoheartbeat++;
1775                 if (sctp_heartbeat_timer(inp, stcb, net)) {
1776                         /* no need to unlock on tcb its gone */
1777                         goto out_decr;
1778                 }
1779 #ifdef SCTP_AUDITING_ENABLED
1780                 sctp_auditing(4, inp, stcb, net);
1781 #endif
1782                 if (!(net->dest_state & SCTP_ADDR_NOHB)) {
1783                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net);
1784                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR, SCTP_SO_NOT_LOCKED);
1785                 }
1786                 break;
1787         case SCTP_TIMER_TYPE_COOKIE:
1788                 if ((stcb == NULL) || (inp == NULL)) {
1789                         break;
1790                 }
1791
1792                 if (sctp_cookie_timer(inp, stcb, net)) {
1793                         /* no need to unlock on tcb its gone */
1794                         goto out_decr;
1795                 }
1796                 SCTP_STAT_INCR(sctps_timocookie);
1797                 stcb->asoc.timocookie++;
1798 #ifdef SCTP_AUDITING_ENABLED
1799                 sctp_auditing(4, inp, stcb, net);
1800 #endif
1801                 /*
1802                  * We consider T3 and Cookie timer pretty much the same with
1803                  * respect to where from in chunk_output.
1804                  */
1805                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1806                 break;
1807         case SCTP_TIMER_TYPE_NEWCOOKIE:
1808                 {
1809                         struct timeval tv;
1810                         int i, secret;
1811
1812                         if (inp == NULL) {
1813                                 break;
1814                         }
1815                         SCTP_STAT_INCR(sctps_timosecret);
1816                         (void)SCTP_GETTIME_TIMEVAL(&tv);
1817                         inp->sctp_ep.time_of_secret_change = tv.tv_sec;
1818                         inp->sctp_ep.last_secret_number =
1819                             inp->sctp_ep.current_secret_number;
1820                         inp->sctp_ep.current_secret_number++;
1821                         if (inp->sctp_ep.current_secret_number >=
1822                             SCTP_HOW_MANY_SECRETS) {
1823                                 inp->sctp_ep.current_secret_number = 0;
1824                         }
1825                         secret = (int)inp->sctp_ep.current_secret_number;
1826                         for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1827                                 inp->sctp_ep.secret_key[secret][i] =
1828                                     sctp_select_initial_TSN(&inp->sctp_ep);
1829                         }
1830                         sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, stcb, net);
1831                 }
1832                 did_output = 0;
1833                 break;
1834         case SCTP_TIMER_TYPE_PATHMTURAISE:
1835                 if ((stcb == NULL) || (inp == NULL)) {
1836                         break;
1837                 }
1838                 SCTP_STAT_INCR(sctps_timopathmtu);
1839                 sctp_pathmtu_timer(inp, stcb, net);
1840                 did_output = 0;
1841                 break;
1842         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1843                 if ((stcb == NULL) || (inp == NULL)) {
1844                         break;
1845                 }
1846                 if (sctp_shutdownack_timer(inp, stcb, net)) {
1847                         /* no need to unlock on tcb its gone */
1848                         goto out_decr;
1849                 }
1850                 SCTP_STAT_INCR(sctps_timoshutdownack);
1851                 stcb->asoc.timoshutdownack++;
1852 #ifdef SCTP_AUDITING_ENABLED
1853                 sctp_auditing(4, inp, stcb, net);
1854 #endif
1855                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR, SCTP_SO_NOT_LOCKED);
1856                 break;
1857         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1858                 if ((stcb == NULL) || (inp == NULL)) {
1859                         break;
1860                 }
1861                 SCTP_STAT_INCR(sctps_timoshutdownguard);
1862                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
1863                     "Shutdown guard timer expired");
1864                 sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
1865                 /* no need to unlock on tcb its gone */
1866                 goto out_decr;
1867
1868         case SCTP_TIMER_TYPE_STRRESET:
1869                 if ((stcb == NULL) || (inp == NULL)) {
1870                         break;
1871                 }
1872                 if (sctp_strreset_timer(inp, stcb, net)) {
1873                         /* no need to unlock on tcb its gone */
1874                         goto out_decr;
1875                 }
1876                 SCTP_STAT_INCR(sctps_timostrmrst);
1877                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR, SCTP_SO_NOT_LOCKED);
1878                 break;
1879         case SCTP_TIMER_TYPE_ASCONF:
1880                 if ((stcb == NULL) || (inp == NULL)) {
1881                         break;
1882                 }
1883                 if (sctp_asconf_timer(inp, stcb, net)) {
1884                         /* no need to unlock on tcb its gone */
1885                         goto out_decr;
1886                 }
1887                 SCTP_STAT_INCR(sctps_timoasconf);
1888 #ifdef SCTP_AUDITING_ENABLED
1889                 sctp_auditing(4, inp, stcb, net);
1890 #endif
1891                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR, SCTP_SO_NOT_LOCKED);
1892                 break;
1893         case SCTP_TIMER_TYPE_PRIM_DELETED:
1894                 if ((stcb == NULL) || (inp == NULL)) {
1895                         break;
1896                 }
1897                 sctp_delete_prim_timer(inp, stcb, net);
1898                 SCTP_STAT_INCR(sctps_timodelprim);
1899                 break;
1900
1901         case SCTP_TIMER_TYPE_AUTOCLOSE:
1902                 if ((stcb == NULL) || (inp == NULL)) {
1903                         break;
1904                 }
1905                 SCTP_STAT_INCR(sctps_timoautoclose);
1906                 sctp_autoclose_timer(inp, stcb, net);
1907                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED);
1908                 did_output = 0;
1909                 break;
1910         case SCTP_TIMER_TYPE_ASOCKILL:
1911                 if ((stcb == NULL) || (inp == NULL)) {
1912                         break;
1913                 }
1914                 SCTP_STAT_INCR(sctps_timoassockill);
1915                 /* Can we free it yet? */
1916                 SCTP_INP_DECR_REF(inp);
1917                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL,
1918                     SCTP_FROM_SCTPUTIL + SCTP_LOC_1);
1919 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1920                 so = SCTP_INP_SO(inp);
1921                 atomic_add_int(&stcb->asoc.refcnt, 1);
1922                 SCTP_TCB_UNLOCK(stcb);
1923                 SCTP_SOCKET_LOCK(so, 1);
1924                 SCTP_TCB_LOCK(stcb);
1925                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1926 #endif
1927                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
1928                     SCTP_FROM_SCTPUTIL + SCTP_LOC_2);
1929 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1930                 SCTP_SOCKET_UNLOCK(so, 1);
1931 #endif
1932                 /*
1933                  * free asoc, always unlocks (or destroy's) so prevent
1934                  * duplicate unlock or unlock of a free mtx :-0
1935                  */
1936                 stcb = NULL;
1937                 goto out_no_decr;
1938         case SCTP_TIMER_TYPE_INPKILL:
1939                 SCTP_STAT_INCR(sctps_timoinpkill);
1940                 if (inp == NULL) {
1941                         break;
1942                 }
1943                 /*
1944                  * special case, take away our increment since WE are the
1945                  * killer
1946                  */
1947                 SCTP_INP_DECR_REF(inp);
1948                 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL,
1949                     SCTP_FROM_SCTPUTIL + SCTP_LOC_3);
1950                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
1951                     SCTP_CALLED_FROM_INPKILL_TIMER);
1952                 inp = NULL;
1953                 goto out_no_decr;
1954         default:
1955                 SCTPDBG(SCTP_DEBUG_TIMER1, "sctp_timeout_handler:unknown timer %d\n",
1956                     type);
1957                 break;
1958         }
1959 #ifdef SCTP_AUDITING_ENABLED
1960         sctp_audit_log(0xF1, (uint8_t)type);
1961         if (inp)
1962                 sctp_auditing(5, inp, stcb, net);
1963 #endif
1964         if ((did_output) && stcb) {
1965                 /*
1966                  * Now we need to clean up the control chunk chain if an
1967                  * ECNE is on it. It must be marked as UNSENT again so next
1968                  * call will continue to send it until such time that we get
1969                  * a CWR, to remove it. It is, however, less likely that we
1970                  * will find a ecn echo on the chain though.
1971                  */
1972                 sctp_fix_ecn_echo(&stcb->asoc);
1973         }
1974 get_out:
1975         if (stcb) {
1976                 SCTP_TCB_UNLOCK(stcb);
1977         } else if (inp != NULL) {
1978                 SCTP_INP_WUNLOCK(inp);
1979         } else {
1980                 SCTP_WQ_ADDR_UNLOCK();
1981         }
1982
1983 out_decr:
1984         if (inp) {
1985                 SCTP_INP_DECR_REF(inp);
1986         }
1987
1988 out_no_decr:
1989         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer now complete (type = %d)\n", type);
1990         CURVNET_RESTORE();
1991 }
1992
1993 void
1994 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1995     struct sctp_nets *net)
1996 {
1997         uint32_t to_ticks;
1998         struct sctp_timer *tmr;
1999
2000         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL))
2001                 return;
2002
2003         tmr = NULL;
2004         if (stcb) {
2005                 SCTP_TCB_LOCK_ASSERT(stcb);
2006         }
2007         switch (t_type) {
2008         case SCTP_TIMER_TYPE_ADDR_WQ:
2009                 /* Only 1 tick away :-) */
2010                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2011                 to_ticks = SCTP_ADDRESS_TICK_DELAY;
2012                 break;
2013         case SCTP_TIMER_TYPE_SEND:
2014                 /* Here we use the RTO timer */
2015                 {
2016                         int rto_val;
2017
2018                         if ((stcb == NULL) || (net == NULL)) {
2019                                 return;
2020                         }
2021                         tmr = &net->rxt_timer;
2022                         if (net->RTO == 0) {
2023                                 rto_val = stcb->asoc.initial_rto;
2024                         } else {
2025                                 rto_val = net->RTO;
2026                         }
2027                         to_ticks = MSEC_TO_TICKS(rto_val);
2028                 }
2029                 break;
2030         case SCTP_TIMER_TYPE_INIT:
2031                 /*
2032                  * Here we use the INIT timer default usually about 1
2033                  * minute.
2034                  */
2035                 if ((stcb == NULL) || (net == NULL)) {
2036                         return;
2037                 }
2038                 tmr = &net->rxt_timer;
2039                 if (net->RTO == 0) {
2040                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2041                 } else {
2042                         to_ticks = MSEC_TO_TICKS(net->RTO);
2043                 }
2044                 break;
2045         case SCTP_TIMER_TYPE_RECV:
2046                 /*
2047                  * Here we use the Delayed-Ack timer value from the inp
2048                  * ususually about 200ms.
2049                  */
2050                 if (stcb == NULL) {
2051                         return;
2052                 }
2053                 tmr = &stcb->asoc.dack_timer;
2054                 to_ticks = MSEC_TO_TICKS(stcb->asoc.delayed_ack);
2055                 break;
2056         case SCTP_TIMER_TYPE_SHUTDOWN:
2057                 /* Here we use the RTO of the destination. */
2058                 if ((stcb == NULL) || (net == NULL)) {
2059                         return;
2060                 }
2061                 if (net->RTO == 0) {
2062                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2063                 } else {
2064                         to_ticks = MSEC_TO_TICKS(net->RTO);
2065                 }
2066                 tmr = &net->rxt_timer;
2067                 break;
2068         case SCTP_TIMER_TYPE_HEARTBEAT:
2069                 /*
2070                  * the net is used here so that we can add in the RTO. Even
2071                  * though we use a different timer. We also add the HB timer
2072                  * PLUS a random jitter.
2073                  */
2074                 if ((stcb == NULL) || (net == NULL)) {
2075                         return;
2076                 } else {
2077                         uint32_t rndval;
2078                         uint32_t jitter;
2079
2080                         if ((net->dest_state & SCTP_ADDR_NOHB) &&
2081                             !(net->dest_state & SCTP_ADDR_UNCONFIRMED)) {
2082                                 return;
2083                         }
2084                         if (net->RTO == 0) {
2085                                 to_ticks = stcb->asoc.initial_rto;
2086                         } else {
2087                                 to_ticks = net->RTO;
2088                         }
2089                         rndval = sctp_select_initial_TSN(&inp->sctp_ep);
2090                         jitter = rndval % to_ticks;
2091                         if (jitter >= (to_ticks >> 1)) {
2092                                 to_ticks = to_ticks + (jitter - (to_ticks >> 1));
2093                         } else {
2094                                 to_ticks = to_ticks - jitter;
2095                         }
2096                         if (!(net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
2097                             !(net->dest_state & SCTP_ADDR_PF)) {
2098                                 to_ticks += net->heart_beat_delay;
2099                         }
2100                         /*
2101                          * Now we must convert the to_ticks that are now in
2102                          * ms to ticks.
2103                          */
2104                         to_ticks = MSEC_TO_TICKS(to_ticks);
2105                         tmr = &net->hb_timer;
2106                 }
2107                 break;
2108         case SCTP_TIMER_TYPE_COOKIE:
2109                 /*
2110                  * Here we can use the RTO timer from the network since one
2111                  * RTT was compelete. If a retran happened then we will be
2112                  * using the RTO initial value.
2113                  */
2114                 if ((stcb == NULL) || (net == NULL)) {
2115                         return;
2116                 }
2117                 if (net->RTO == 0) {
2118                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2119                 } else {
2120                         to_ticks = MSEC_TO_TICKS(net->RTO);
2121                 }
2122                 tmr = &net->rxt_timer;
2123                 break;
2124         case SCTP_TIMER_TYPE_NEWCOOKIE:
2125                 /*
2126                  * nothing needed but the endpoint here ususually about 60
2127                  * minutes.
2128                  */
2129                 tmr = &inp->sctp_ep.signature_change;
2130                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE];
2131                 break;
2132         case SCTP_TIMER_TYPE_ASOCKILL:
2133                 if (stcb == NULL) {
2134                         return;
2135                 }
2136                 tmr = &stcb->asoc.strreset_timer;
2137                 to_ticks = MSEC_TO_TICKS(SCTP_ASOC_KILL_TIMEOUT);
2138                 break;
2139         case SCTP_TIMER_TYPE_INPKILL:
2140                 /*
2141                  * The inp is setup to die. We re-use the signature_chage
2142                  * timer since that has stopped and we are in the GONE
2143                  * state.
2144                  */
2145                 tmr = &inp->sctp_ep.signature_change;
2146                 to_ticks = MSEC_TO_TICKS(SCTP_INP_KILL_TIMEOUT);
2147                 break;
2148         case SCTP_TIMER_TYPE_PATHMTURAISE:
2149                 /*
2150                  * Here we use the value found in the EP for PMTU ususually
2151                  * about 10 minutes.
2152                  */
2153                 if ((stcb == NULL) || (net == NULL)) {
2154                         return;
2155                 }
2156                 if (net->dest_state & SCTP_ADDR_NO_PMTUD) {
2157                         return;
2158                 }
2159                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU];
2160                 tmr = &net->pmtu_timer;
2161                 break;
2162         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2163                 /* Here we use the RTO of the destination */
2164                 if ((stcb == NULL) || (net == NULL)) {
2165                         return;
2166                 }
2167                 if (net->RTO == 0) {
2168                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2169                 } else {
2170                         to_ticks = MSEC_TO_TICKS(net->RTO);
2171                 }
2172                 tmr = &net->rxt_timer;
2173                 break;
2174         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2175                 /*
2176                  * Here we use the endpoints shutdown guard timer usually
2177                  * about 3 minutes.
2178                  */
2179                 if (stcb == NULL) {
2180                         return;
2181                 }
2182                 if (inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] == 0) {
2183                         to_ticks = 5 * MSEC_TO_TICKS(stcb->asoc.maxrto);
2184                 } else {
2185                         to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN];
2186                 }
2187                 tmr = &stcb->asoc.shut_guard_timer;
2188                 break;
2189         case SCTP_TIMER_TYPE_STRRESET:
2190                 /*
2191                  * Here the timer comes from the stcb but its value is from
2192                  * the net's RTO.
2193                  */
2194                 if ((stcb == NULL) || (net == NULL)) {
2195                         return;
2196                 }
2197                 if (net->RTO == 0) {
2198                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2199                 } else {
2200                         to_ticks = MSEC_TO_TICKS(net->RTO);
2201                 }
2202                 tmr = &stcb->asoc.strreset_timer;
2203                 break;
2204         case SCTP_TIMER_TYPE_ASCONF:
2205                 /*
2206                  * Here the timer comes from the stcb but its value is from
2207                  * the net's RTO.
2208                  */
2209                 if ((stcb == NULL) || (net == NULL)) {
2210                         return;
2211                 }
2212                 if (net->RTO == 0) {
2213                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2214                 } else {
2215                         to_ticks = MSEC_TO_TICKS(net->RTO);
2216                 }
2217                 tmr = &stcb->asoc.asconf_timer;
2218                 break;
2219         case SCTP_TIMER_TYPE_PRIM_DELETED:
2220                 if ((stcb == NULL) || (net != NULL)) {
2221                         return;
2222                 }
2223                 to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2224                 tmr = &stcb->asoc.delete_prim_timer;
2225                 break;
2226         case SCTP_TIMER_TYPE_AUTOCLOSE:
2227                 if (stcb == NULL) {
2228                         return;
2229                 }
2230                 if (stcb->asoc.sctp_autoclose_ticks == 0) {
2231                         /*
2232                          * Really an error since stcb is NOT set to
2233                          * autoclose
2234                          */
2235                         return;
2236                 }
2237                 to_ticks = stcb->asoc.sctp_autoclose_ticks;
2238                 tmr = &stcb->asoc.autoclose_timer;
2239                 break;
2240         default:
2241                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2242                     __func__, t_type);
2243                 return;
2244                 break;
2245         }
2246         if ((to_ticks <= 0) || (tmr == NULL)) {
2247                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: %d:software error to_ticks:%d tmr:%p not set ??\n",
2248                     __func__, t_type, to_ticks, (void *)tmr);
2249                 return;
2250         }
2251         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
2252                 /*
2253                  * we do NOT allow you to have it already running. if it is
2254                  * we leave the current one up unchanged
2255                  */
2256                 return;
2257         }
2258         /* At this point we can proceed */
2259         if (t_type == SCTP_TIMER_TYPE_SEND) {
2260                 stcb->asoc.num_send_timers_up++;
2261         }
2262         tmr->stopped_from = 0;
2263         tmr->type = t_type;
2264         tmr->ep = (void *)inp;
2265         tmr->tcb = (void *)stcb;
2266         tmr->net = (void *)net;
2267         tmr->self = (void *)tmr;
2268         tmr->vnet = (void *)curvnet;
2269         tmr->ticks = sctp_get_tick_count();
2270         (void)SCTP_OS_TIMER_START(&tmr->timer, to_ticks, sctp_timeout_handler, tmr);
2271         return;
2272 }
2273
2274 void
2275 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2276     struct sctp_nets *net, uint32_t from)
2277 {
2278         struct sctp_timer *tmr;
2279
2280         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) &&
2281             (inp == NULL))
2282                 return;
2283
2284         tmr = NULL;
2285         if (stcb) {
2286                 SCTP_TCB_LOCK_ASSERT(stcb);
2287         }
2288         switch (t_type) {
2289         case SCTP_TIMER_TYPE_ADDR_WQ:
2290                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2291                 break;
2292         case SCTP_TIMER_TYPE_SEND:
2293                 if ((stcb == NULL) || (net == NULL)) {
2294                         return;
2295                 }
2296                 tmr = &net->rxt_timer;
2297                 break;
2298         case SCTP_TIMER_TYPE_INIT:
2299                 if ((stcb == NULL) || (net == NULL)) {
2300                         return;
2301                 }
2302                 tmr = &net->rxt_timer;
2303                 break;
2304         case SCTP_TIMER_TYPE_RECV:
2305                 if (stcb == NULL) {
2306                         return;
2307                 }
2308                 tmr = &stcb->asoc.dack_timer;
2309                 break;
2310         case SCTP_TIMER_TYPE_SHUTDOWN:
2311                 if ((stcb == NULL) || (net == NULL)) {
2312                         return;
2313                 }
2314                 tmr = &net->rxt_timer;
2315                 break;
2316         case SCTP_TIMER_TYPE_HEARTBEAT:
2317                 if ((stcb == NULL) || (net == NULL)) {
2318                         return;
2319                 }
2320                 tmr = &net->hb_timer;
2321                 break;
2322         case SCTP_TIMER_TYPE_COOKIE:
2323                 if ((stcb == NULL) || (net == NULL)) {
2324                         return;
2325                 }
2326                 tmr = &net->rxt_timer;
2327                 break;
2328         case SCTP_TIMER_TYPE_NEWCOOKIE:
2329                 /* nothing needed but the endpoint here */
2330                 tmr = &inp->sctp_ep.signature_change;
2331                 /*
2332                  * We re-use the newcookie timer for the INP kill timer. We
2333                  * must assure that we do not kill it by accident.
2334                  */
2335                 break;
2336         case SCTP_TIMER_TYPE_ASOCKILL:
2337                 /*
2338                  * Stop the asoc kill timer.
2339                  */
2340                 if (stcb == NULL) {
2341                         return;
2342                 }
2343                 tmr = &stcb->asoc.strreset_timer;
2344                 break;
2345
2346         case SCTP_TIMER_TYPE_INPKILL:
2347                 /*
2348                  * The inp is setup to die. We re-use the signature_chage
2349                  * timer since that has stopped and we are in the GONE
2350                  * state.
2351                  */
2352                 tmr = &inp->sctp_ep.signature_change;
2353                 break;
2354         case SCTP_TIMER_TYPE_PATHMTURAISE:
2355                 if ((stcb == NULL) || (net == NULL)) {
2356                         return;
2357                 }
2358                 tmr = &net->pmtu_timer;
2359                 break;
2360         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2361                 if ((stcb == NULL) || (net == NULL)) {
2362                         return;
2363                 }
2364                 tmr = &net->rxt_timer;
2365                 break;
2366         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2367                 if (stcb == NULL) {
2368                         return;
2369                 }
2370                 tmr = &stcb->asoc.shut_guard_timer;
2371                 break;
2372         case SCTP_TIMER_TYPE_STRRESET:
2373                 if (stcb == NULL) {
2374                         return;
2375                 }
2376                 tmr = &stcb->asoc.strreset_timer;
2377                 break;
2378         case SCTP_TIMER_TYPE_ASCONF:
2379                 if (stcb == NULL) {
2380                         return;
2381                 }
2382                 tmr = &stcb->asoc.asconf_timer;
2383                 break;
2384         case SCTP_TIMER_TYPE_PRIM_DELETED:
2385                 if (stcb == NULL) {
2386                         return;
2387                 }
2388                 tmr = &stcb->asoc.delete_prim_timer;
2389                 break;
2390         case SCTP_TIMER_TYPE_AUTOCLOSE:
2391                 if (stcb == NULL) {
2392                         return;
2393                 }
2394                 tmr = &stcb->asoc.autoclose_timer;
2395                 break;
2396         default:
2397                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2398                     __func__, t_type);
2399                 break;
2400         }
2401         if (tmr == NULL) {
2402                 return;
2403         }
2404         if ((tmr->type != t_type) && tmr->type) {
2405                 /*
2406                  * Ok we have a timer that is under joint use. Cookie timer
2407                  * per chance with the SEND timer. We therefore are NOT
2408                  * running the timer that the caller wants stopped.  So just
2409                  * return.
2410                  */
2411                 return;
2412         }
2413         if ((t_type == SCTP_TIMER_TYPE_SEND) && (stcb != NULL)) {
2414                 stcb->asoc.num_send_timers_up--;
2415                 if (stcb->asoc.num_send_timers_up < 0) {
2416                         stcb->asoc.num_send_timers_up = 0;
2417                 }
2418         }
2419         tmr->self = NULL;
2420         tmr->stopped_from = from;
2421         (void)SCTP_OS_TIMER_STOP(&tmr->timer);
2422         return;
2423 }
2424
2425 uint32_t
2426 sctp_calculate_len(struct mbuf *m)
2427 {
2428         uint32_t tlen = 0;
2429         struct mbuf *at;
2430
2431         at = m;
2432         while (at) {
2433                 tlen += SCTP_BUF_LEN(at);
2434                 at = SCTP_BUF_NEXT(at);
2435         }
2436         return (tlen);
2437 }
2438
2439 void
2440 sctp_mtu_size_reset(struct sctp_inpcb *inp,
2441     struct sctp_association *asoc, uint32_t mtu)
2442 {
2443         /*
2444          * Reset the P-MTU size on this association, this involves changing
2445          * the asoc MTU, going through ANY chunk+overhead larger than mtu to
2446          * allow the DF flag to be cleared.
2447          */
2448         struct sctp_tmit_chunk *chk;
2449         unsigned int eff_mtu, ovh;
2450
2451         asoc->smallest_mtu = mtu;
2452         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2453                 ovh = SCTP_MIN_OVERHEAD;
2454         } else {
2455                 ovh = SCTP_MIN_V4_OVERHEAD;
2456         }
2457         eff_mtu = mtu - ovh;
2458         TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
2459                 if (chk->send_size > eff_mtu) {
2460                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2461                 }
2462         }
2463         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
2464                 if (chk->send_size > eff_mtu) {
2465                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2466                 }
2467         }
2468 }
2469
2470
2471 /*
2472  * Given an association and starting time of the current RTT period, update
2473  * RTO in number of msecs. net should point to the current network.
2474  * Return 1, if an RTO update was performed, return 0 if no update was
2475  * performed due to invalid starting point.
2476  */
2477
2478 int
2479 sctp_calculate_rto(struct sctp_tcb *stcb,
2480     struct sctp_association *asoc,
2481     struct sctp_nets *net,
2482     struct timeval *old,
2483     int rtt_from_sack)
2484 {
2485         struct timeval now;
2486         uint64_t rtt_us;        /* RTT in us */
2487         int32_t rtt;            /* RTT in ms */
2488         uint32_t new_rto;
2489         int first_measure = 0;
2490
2491         /************************/
2492         /* 1. calculate new RTT */
2493         /************************/
2494         /* get the current time */
2495         if (stcb->asoc.use_precise_time) {
2496                 (void)SCTP_GETPTIME_TIMEVAL(&now);
2497         } else {
2498                 (void)SCTP_GETTIME_TIMEVAL(&now);
2499         }
2500         if ((old->tv_sec > now.tv_sec) ||
2501             ((old->tv_sec == now.tv_sec) && (old->tv_sec > now.tv_sec))) {
2502                 /* The starting point is in the future. */
2503                 return (0);
2504         }
2505         timevalsub(&now, old);
2506         rtt_us = (uint64_t)1000000 * (uint64_t)now.tv_sec + (uint64_t)now.tv_usec;
2507         if (rtt_us > SCTP_RTO_UPPER_BOUND * 1000) {
2508                 /* The RTT is larger than a sane value. */
2509                 return (0);
2510         }
2511         /* store the current RTT in us */
2512         net->rtt = rtt_us;
2513         /* compute rtt in ms */
2514         rtt = (int32_t)(net->rtt / 1000);
2515         if ((asoc->cc_functions.sctp_rtt_calculated) && (rtt_from_sack == SCTP_RTT_FROM_DATA)) {
2516                 /*
2517                  * Tell the CC module that a new update has just occurred
2518                  * from a sack
2519                  */
2520                 (*asoc->cc_functions.sctp_rtt_calculated) (stcb, net, &now);
2521         }
2522         /*
2523          * Do we need to determine the lan? We do this only on sacks i.e.
2524          * RTT being determined from data not non-data (HB/INIT->INITACK).
2525          */
2526         if ((rtt_from_sack == SCTP_RTT_FROM_DATA) &&
2527             (net->lan_type == SCTP_LAN_UNKNOWN)) {
2528                 if (net->rtt > SCTP_LOCAL_LAN_RTT) {
2529                         net->lan_type = SCTP_LAN_INTERNET;
2530                 } else {
2531                         net->lan_type = SCTP_LAN_LOCAL;
2532                 }
2533         }
2534
2535         /***************************/
2536         /* 2. update RTTVAR & SRTT */
2537         /***************************/
2538         /*-
2539          * Compute the scaled average lastsa and the
2540          * scaled variance lastsv as described in van Jacobson
2541          * Paper "Congestion Avoidance and Control", Annex A.
2542          *
2543          * (net->lastsa >> SCTP_RTT_SHIFT) is the srtt
2544          * (net->lastsv >> SCTP_RTT_VAR_SHIFT) is the rttvar
2545          */
2546         if (net->RTO_measured) {
2547                 rtt -= (net->lastsa >> SCTP_RTT_SHIFT);
2548                 net->lastsa += rtt;
2549                 if (rtt < 0) {
2550                         rtt = -rtt;
2551                 }
2552                 rtt -= (net->lastsv >> SCTP_RTT_VAR_SHIFT);
2553                 net->lastsv += rtt;
2554                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2555                         rto_logging(net, SCTP_LOG_RTTVAR);
2556                 }
2557         } else {
2558                 /* First RTO measurment */
2559                 net->RTO_measured = 1;
2560                 first_measure = 1;
2561                 net->lastsa = rtt << SCTP_RTT_SHIFT;
2562                 net->lastsv = (rtt / 2) << SCTP_RTT_VAR_SHIFT;
2563                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2564                         rto_logging(net, SCTP_LOG_INITIAL_RTT);
2565                 }
2566         }
2567         if (net->lastsv == 0) {
2568                 net->lastsv = SCTP_CLOCK_GRANULARITY;
2569         }
2570         new_rto = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
2571         if ((new_rto > SCTP_SAT_NETWORK_MIN) &&
2572             (stcb->asoc.sat_network_lockout == 0)) {
2573                 stcb->asoc.sat_network = 1;
2574         } else if ((!first_measure) && stcb->asoc.sat_network) {
2575                 stcb->asoc.sat_network = 0;
2576                 stcb->asoc.sat_network_lockout = 1;
2577         }
2578         /* bound it, per C6/C7 in Section 5.3.1 */
2579         if (new_rto < stcb->asoc.minrto) {
2580                 new_rto = stcb->asoc.minrto;
2581         }
2582         if (new_rto > stcb->asoc.maxrto) {
2583                 new_rto = stcb->asoc.maxrto;
2584         }
2585         net->RTO = new_rto;
2586         return (1);
2587 }
2588
2589 /*
2590  * return a pointer to a contiguous piece of data from the given mbuf chain
2591  * starting at 'off' for 'len' bytes.  If the desired piece spans more than
2592  * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size
2593  * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain.
2594  */
2595 caddr_t
2596 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t *in_ptr)
2597 {
2598         uint32_t count;
2599         uint8_t *ptr;
2600
2601         ptr = in_ptr;
2602         if ((off < 0) || (len <= 0))
2603                 return (NULL);
2604
2605         /* find the desired start location */
2606         while ((m != NULL) && (off > 0)) {
2607                 if (off < SCTP_BUF_LEN(m))
2608                         break;
2609                 off -= SCTP_BUF_LEN(m);
2610                 m = SCTP_BUF_NEXT(m);
2611         }
2612         if (m == NULL)
2613                 return (NULL);
2614
2615         /* is the current mbuf large enough (eg. contiguous)? */
2616         if ((SCTP_BUF_LEN(m) - off) >= len) {
2617                 return (mtod(m, caddr_t)+off);
2618         } else {
2619                 /* else, it spans more than one mbuf, so save a temp copy... */
2620                 while ((m != NULL) && (len > 0)) {
2621                         count = min(SCTP_BUF_LEN(m) - off, len);
2622                         memcpy(ptr, mtod(m, caddr_t)+off, count);
2623                         len -= count;
2624                         ptr += count;
2625                         off = 0;
2626                         m = SCTP_BUF_NEXT(m);
2627                 }
2628                 if ((m == NULL) && (len > 0))
2629                         return (NULL);
2630                 else
2631                         return ((caddr_t)in_ptr);
2632         }
2633 }
2634
2635
2636
2637 struct sctp_paramhdr *
2638 sctp_get_next_param(struct mbuf *m,
2639     int offset,
2640     struct sctp_paramhdr *pull,
2641     int pull_limit)
2642 {
2643         /* This just provides a typed signature to Peter's Pull routine */
2644         return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit,
2645             (uint8_t *)pull));
2646 }
2647
2648
2649 struct mbuf *
2650 sctp_add_pad_tombuf(struct mbuf *m, int padlen)
2651 {
2652         struct mbuf *m_last;
2653         caddr_t dp;
2654
2655         if (padlen > 3) {
2656                 return (NULL);
2657         }
2658         if (padlen <= M_TRAILINGSPACE(m)) {
2659                 /*
2660                  * The easy way. We hope the majority of the time we hit
2661                  * here :)
2662                  */
2663                 m_last = m;
2664         } else {
2665                 /* Hard way we must grow the mbuf chain */
2666                 m_last = sctp_get_mbuf_for_msg(padlen, 0, M_NOWAIT, 1, MT_DATA);
2667                 if (m_last == NULL) {
2668                         return (NULL);
2669                 }
2670                 SCTP_BUF_LEN(m_last) = 0;
2671                 SCTP_BUF_NEXT(m_last) = NULL;
2672                 SCTP_BUF_NEXT(m) = m_last;
2673         }
2674         dp = mtod(m_last, caddr_t)+SCTP_BUF_LEN(m_last);
2675         SCTP_BUF_LEN(m_last) += padlen;
2676         memset(dp, 0, padlen);
2677         return (m_last);
2678 }
2679
2680 struct mbuf *
2681 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf)
2682 {
2683         /* find the last mbuf in chain and pad it */
2684         struct mbuf *m_at;
2685
2686         if (last_mbuf != NULL) {
2687                 return (sctp_add_pad_tombuf(last_mbuf, padval));
2688         } else {
2689                 for (m_at = m; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
2690                         if (SCTP_BUF_NEXT(m_at) == NULL) {
2691                                 return (sctp_add_pad_tombuf(m_at, padval));
2692                         }
2693                 }
2694         }
2695         return (NULL);
2696 }
2697
2698 static void
2699 sctp_notify_assoc_change(uint16_t state, struct sctp_tcb *stcb,
2700     uint16_t error, struct sctp_abort_chunk *abort, uint8_t from_peer, int so_locked
2701 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2702     SCTP_UNUSED
2703 #endif
2704 )
2705 {
2706         struct mbuf *m_notify;
2707         struct sctp_assoc_change *sac;
2708         struct sctp_queued_to_read *control;
2709         unsigned int notif_len;
2710         uint16_t abort_len;
2711         unsigned int i;
2712 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2713         struct socket *so;
2714 #endif
2715
2716         if (stcb == NULL) {
2717                 return;
2718         }
2719         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVASSOCEVNT)) {
2720                 notif_len = (unsigned int)sizeof(struct sctp_assoc_change);
2721                 if (abort != NULL) {
2722                         abort_len = ntohs(abort->ch.chunk_length);
2723                         /*
2724                          * Only SCTP_CHUNK_BUFFER_SIZE are guaranteed to be
2725                          * contiguous.
2726                          */
2727                         if (abort_len > SCTP_CHUNK_BUFFER_SIZE) {
2728                                 abort_len = SCTP_CHUNK_BUFFER_SIZE;
2729                         }
2730                 } else {
2731                         abort_len = 0;
2732                 }
2733                 if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
2734                         notif_len += SCTP_ASSOC_SUPPORTS_MAX;
2735                 } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
2736                         notif_len += abort_len;
2737                 }
2738                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
2739                 if (m_notify == NULL) {
2740                         /* Retry with smaller value. */
2741                         notif_len = (unsigned int)sizeof(struct sctp_assoc_change);
2742                         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
2743                         if (m_notify == NULL) {
2744                                 goto set_error;
2745                         }
2746                 }
2747                 SCTP_BUF_NEXT(m_notify) = NULL;
2748                 sac = mtod(m_notify, struct sctp_assoc_change *);
2749                 memset(sac, 0, notif_len);
2750                 sac->sac_type = SCTP_ASSOC_CHANGE;
2751                 sac->sac_flags = 0;
2752                 sac->sac_length = sizeof(struct sctp_assoc_change);
2753                 sac->sac_state = state;
2754                 sac->sac_error = error;
2755                 /* XXX verify these stream counts */
2756                 sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
2757                 sac->sac_inbound_streams = stcb->asoc.streamincnt;
2758                 sac->sac_assoc_id = sctp_get_associd(stcb);
2759                 if (notif_len > sizeof(struct sctp_assoc_change)) {
2760                         if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
2761                                 i = 0;
2762                                 if (stcb->asoc.prsctp_supported == 1) {
2763                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_PR;
2764                                 }
2765                                 if (stcb->asoc.auth_supported == 1) {
2766                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_AUTH;
2767                                 }
2768                                 if (stcb->asoc.asconf_supported == 1) {
2769                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_ASCONF;
2770                                 }
2771                                 if (stcb->asoc.idata_supported == 1) {
2772                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_INTERLEAVING;
2773                                 }
2774                                 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_MULTIBUF;
2775                                 if (stcb->asoc.reconfig_supported == 1) {
2776                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_RE_CONFIG;
2777                                 }
2778                                 sac->sac_length += i;
2779                         } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
2780                                 memcpy(sac->sac_info, abort, abort_len);
2781                                 sac->sac_length += abort_len;
2782                         }
2783                 }
2784                 SCTP_BUF_LEN(m_notify) = sac->sac_length;
2785                 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2786                     0, 0, stcb->asoc.context, 0, 0, 0,
2787                     m_notify);
2788                 if (control != NULL) {
2789                         control->length = SCTP_BUF_LEN(m_notify);
2790                         control->spec_flags = M_NOTIFICATION;
2791                         /* not that we need this */
2792                         control->tail_mbuf = m_notify;
2793                         sctp_add_to_readq(stcb->sctp_ep, stcb,
2794                             control,
2795                             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD,
2796                             so_locked);
2797                 } else {
2798                         sctp_m_freem(m_notify);
2799                 }
2800         }
2801         /*
2802          * For 1-to-1 style sockets, we send up and error when an ABORT
2803          * comes in.
2804          */
2805 set_error:
2806         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2807             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2808             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
2809                 SOCK_LOCK(stcb->sctp_socket);
2810                 if (from_peer) {
2811                         if (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) {
2812                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNREFUSED);
2813                                 stcb->sctp_socket->so_error = ECONNREFUSED;
2814                         } else {
2815                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
2816                                 stcb->sctp_socket->so_error = ECONNRESET;
2817                         }
2818                 } else {
2819                         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
2820                             (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
2821                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ETIMEDOUT);
2822                                 stcb->sctp_socket->so_error = ETIMEDOUT;
2823                         } else {
2824                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNABORTED);
2825                                 stcb->sctp_socket->so_error = ECONNABORTED;
2826                         }
2827                 }
2828                 SOCK_UNLOCK(stcb->sctp_socket);
2829         }
2830         /* Wake ANY sleepers */
2831 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2832         so = SCTP_INP_SO(stcb->sctp_ep);
2833         if (!so_locked) {
2834                 atomic_add_int(&stcb->asoc.refcnt, 1);
2835                 SCTP_TCB_UNLOCK(stcb);
2836                 SCTP_SOCKET_LOCK(so, 1);
2837                 SCTP_TCB_LOCK(stcb);
2838                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2839                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2840                         SCTP_SOCKET_UNLOCK(so, 1);
2841                         return;
2842                 }
2843         }
2844 #endif
2845         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2846             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2847             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
2848                 socantrcvmore(stcb->sctp_socket);
2849         }
2850         sorwakeup(stcb->sctp_socket);
2851         sowwakeup(stcb->sctp_socket);
2852 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2853         if (!so_locked) {
2854                 SCTP_SOCKET_UNLOCK(so, 1);
2855         }
2856 #endif
2857 }
2858
2859 static void
2860 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
2861     struct sockaddr *sa, uint32_t error, int so_locked
2862 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2863     SCTP_UNUSED
2864 #endif
2865 )
2866 {
2867         struct mbuf *m_notify;
2868         struct sctp_paddr_change *spc;
2869         struct sctp_queued_to_read *control;
2870
2871         if ((stcb == NULL) ||
2872             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPADDREVNT)) {
2873                 /* event not enabled */
2874                 return;
2875         }
2876         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 0, M_NOWAIT, 1, MT_DATA);
2877         if (m_notify == NULL)
2878                 return;
2879         SCTP_BUF_LEN(m_notify) = 0;
2880         spc = mtod(m_notify, struct sctp_paddr_change *);
2881         memset(spc, 0, sizeof(struct sctp_paddr_change));
2882         spc->spc_type = SCTP_PEER_ADDR_CHANGE;
2883         spc->spc_flags = 0;
2884         spc->spc_length = sizeof(struct sctp_paddr_change);
2885         switch (sa->sa_family) {
2886 #ifdef INET
2887         case AF_INET:
2888 #ifdef INET6
2889                 if (sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
2890                         in6_sin_2_v4mapsin6((struct sockaddr_in *)sa,
2891                             (struct sockaddr_in6 *)&spc->spc_aaddr);
2892                 } else {
2893                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2894                 }
2895 #else
2896                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2897 #endif
2898                 break;
2899 #endif
2900 #ifdef INET6
2901         case AF_INET6:
2902                 {
2903                         struct sockaddr_in6 *sin6;
2904
2905                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6));
2906
2907                         sin6 = (struct sockaddr_in6 *)&spc->spc_aaddr;
2908                         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2909                                 if (sin6->sin6_scope_id == 0) {
2910                                         /* recover scope_id for user */
2911                                         (void)sa6_recoverscope(sin6);
2912                                 } else {
2913                                         /* clear embedded scope_id for user */
2914                                         in6_clearscope(&sin6->sin6_addr);
2915                                 }
2916                         }
2917                         break;
2918                 }
2919 #endif
2920         default:
2921                 /* TSNH */
2922                 break;
2923         }
2924         spc->spc_state = state;
2925         spc->spc_error = error;
2926         spc->spc_assoc_id = sctp_get_associd(stcb);
2927
2928         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_paddr_change);
2929         SCTP_BUF_NEXT(m_notify) = NULL;
2930
2931         /* append to socket */
2932         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2933             0, 0, stcb->asoc.context, 0, 0, 0,
2934             m_notify);
2935         if (control == NULL) {
2936                 /* no memory */
2937                 sctp_m_freem(m_notify);
2938                 return;
2939         }
2940         control->length = SCTP_BUF_LEN(m_notify);
2941         control->spec_flags = M_NOTIFICATION;
2942         /* not that we need this */
2943         control->tail_mbuf = m_notify;
2944         sctp_add_to_readq(stcb->sctp_ep, stcb,
2945             control,
2946             &stcb->sctp_socket->so_rcv, 1,
2947             SCTP_READ_LOCK_NOT_HELD,
2948             so_locked);
2949 }
2950
2951
2952 static void
2953 sctp_notify_send_failed(struct sctp_tcb *stcb, uint8_t sent, uint32_t error,
2954     struct sctp_tmit_chunk *chk, int so_locked
2955 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2956     SCTP_UNUSED
2957 #endif
2958 )
2959 {
2960         struct mbuf *m_notify;
2961         struct sctp_send_failed *ssf;
2962         struct sctp_send_failed_event *ssfe;
2963         struct sctp_queued_to_read *control;
2964         struct sctp_chunkhdr *chkhdr;
2965         int notifhdr_len, chk_len, chkhdr_len, padding_len, payload_len;
2966
2967         if ((stcb == NULL) ||
2968             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
2969             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
2970                 /* event not enabled */
2971                 return;
2972         }
2973
2974         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2975                 notifhdr_len = sizeof(struct sctp_send_failed_event);
2976         } else {
2977                 notifhdr_len = sizeof(struct sctp_send_failed);
2978         }
2979         m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA);
2980         if (m_notify == NULL)
2981                 /* no space left */
2982                 return;
2983         SCTP_BUF_LEN(m_notify) = notifhdr_len;
2984         if (stcb->asoc.idata_supported) {
2985                 chkhdr_len = sizeof(struct sctp_idata_chunk);
2986         } else {
2987                 chkhdr_len = sizeof(struct sctp_data_chunk);
2988         }
2989         /* Use some defaults in case we can't access the chunk header */
2990         if (chk->send_size >= chkhdr_len) {
2991                 payload_len = chk->send_size - chkhdr_len;
2992         } else {
2993                 payload_len = 0;
2994         }
2995         padding_len = 0;
2996         if (chk->data != NULL) {
2997                 chkhdr = mtod(chk->data, struct sctp_chunkhdr *);
2998                 if (chkhdr != NULL) {
2999                         chk_len = ntohs(chkhdr->chunk_length);
3000                         if ((chk_len >= chkhdr_len) &&
3001                             (chk->send_size >= chk_len) &&
3002                             (chk->send_size - chk_len < 4)) {
3003                                 padding_len = chk->send_size - chk_len;
3004                                 payload_len = chk->send_size - chkhdr_len - padding_len;
3005                         }
3006                 }
3007         }
3008         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3009                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
3010                 memset(ssfe, 0, notifhdr_len);
3011                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
3012                 if (sent) {
3013                         ssfe->ssfe_flags = SCTP_DATA_SENT;
3014                 } else {
3015                         ssfe->ssfe_flags = SCTP_DATA_UNSENT;
3016                 }
3017                 ssfe->ssfe_length = (uint32_t)(notifhdr_len + payload_len);
3018                 ssfe->ssfe_error = error;
3019                 /* not exactly what the user sent in, but should be close :) */
3020                 ssfe->ssfe_info.snd_sid = chk->rec.data.sid;
3021                 ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags;
3022                 ssfe->ssfe_info.snd_ppid = chk->rec.data.ppid;
3023                 ssfe->ssfe_info.snd_context = chk->rec.data.context;
3024                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
3025                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
3026         } else {
3027                 ssf = mtod(m_notify, struct sctp_send_failed *);
3028                 memset(ssf, 0, notifhdr_len);
3029                 ssf->ssf_type = SCTP_SEND_FAILED;
3030                 if (sent) {
3031                         ssf->ssf_flags = SCTP_DATA_SENT;
3032                 } else {
3033                         ssf->ssf_flags = SCTP_DATA_UNSENT;
3034                 }
3035                 ssf->ssf_length = (uint32_t)(notifhdr_len + payload_len);
3036                 ssf->ssf_error = error;
3037                 /* not exactly what the user sent in, but should be close :) */
3038                 ssf->ssf_info.sinfo_stream = chk->rec.data.sid;
3039                 ssf->ssf_info.sinfo_ssn = (uint16_t)chk->rec.data.mid;
3040                 ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags;
3041                 ssf->ssf_info.sinfo_ppid = chk->rec.data.ppid;
3042                 ssf->ssf_info.sinfo_context = chk->rec.data.context;
3043                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
3044                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
3045         }
3046         if (chk->data != NULL) {
3047                 /* Trim off the sctp chunk header (it should be there) */
3048                 if (chk->send_size == chkhdr_len + payload_len + padding_len) {
3049                         m_adj(chk->data, chkhdr_len);
3050                         m_adj(chk->data, -padding_len);
3051                         sctp_mbuf_crush(chk->data);
3052                         chk->send_size -= (chkhdr_len + padding_len);
3053                 }
3054         }
3055         SCTP_BUF_NEXT(m_notify) = chk->data;
3056         /* Steal off the mbuf */
3057         chk->data = NULL;
3058         /*
3059          * For this case, we check the actual socket buffer, since the assoc
3060          * is going away we don't want to overfill the socket buffer for a
3061          * non-reader
3062          */
3063         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3064                 sctp_m_freem(m_notify);
3065                 return;
3066         }
3067         /* append to socket */
3068         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3069             0, 0, stcb->asoc.context, 0, 0, 0,
3070             m_notify);
3071         if (control == NULL) {
3072                 /* no memory */
3073                 sctp_m_freem(m_notify);
3074                 return;
3075         }
3076         control->length = SCTP_BUF_LEN(m_notify);
3077         control->spec_flags = M_NOTIFICATION;
3078         /* not that we need this */
3079         control->tail_mbuf = m_notify;
3080         sctp_add_to_readq(stcb->sctp_ep, stcb,
3081             control,
3082             &stcb->sctp_socket->so_rcv, 1,
3083             SCTP_READ_LOCK_NOT_HELD,
3084             so_locked);
3085 }
3086
3087
3088 static void
3089 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
3090     struct sctp_stream_queue_pending *sp, int so_locked
3091 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3092     SCTP_UNUSED
3093 #endif
3094 )
3095 {
3096         struct mbuf *m_notify;
3097         struct sctp_send_failed *ssf;
3098         struct sctp_send_failed_event *ssfe;
3099         struct sctp_queued_to_read *control;
3100         int notifhdr_len;
3101
3102         if ((stcb == NULL) ||
3103             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
3104             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
3105                 /* event not enabled */
3106                 return;
3107         }
3108         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3109                 notifhdr_len = sizeof(struct sctp_send_failed_event);
3110         } else {
3111                 notifhdr_len = sizeof(struct sctp_send_failed);
3112         }
3113         m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA);
3114         if (m_notify == NULL) {
3115                 /* no space left */
3116                 return;
3117         }
3118         SCTP_BUF_LEN(m_notify) = notifhdr_len;
3119         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3120                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
3121                 memset(ssfe, 0, notifhdr_len);
3122                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
3123                 ssfe->ssfe_flags = SCTP_DATA_UNSENT;
3124                 ssfe->ssfe_length = (uint32_t)(notifhdr_len + sp->length);
3125                 ssfe->ssfe_error = error;
3126                 /* not exactly what the user sent in, but should be close :) */
3127                 ssfe->ssfe_info.snd_sid = sp->sid;
3128                 if (sp->some_taken) {
3129                         ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG;
3130                 } else {
3131                         ssfe->ssfe_info.snd_flags = SCTP_DATA_NOT_FRAG;
3132                 }
3133                 ssfe->ssfe_info.snd_ppid = sp->ppid;
3134                 ssfe->ssfe_info.snd_context = sp->context;
3135                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
3136                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
3137         } else {
3138                 ssf = mtod(m_notify, struct sctp_send_failed *);
3139                 memset(ssf, 0, notifhdr_len);
3140                 ssf->ssf_type = SCTP_SEND_FAILED;
3141                 ssf->ssf_flags = SCTP_DATA_UNSENT;
3142                 ssf->ssf_length = (uint32_t)(notifhdr_len + sp->length);
3143                 ssf->ssf_error = error;
3144                 /* not exactly what the user sent in, but should be close :) */
3145                 ssf->ssf_info.sinfo_stream = sp->sid;
3146                 ssf->ssf_info.sinfo_ssn = 0;
3147                 if (sp->some_taken) {
3148                         ssf->ssf_info.sinfo_flags = SCTP_DATA_LAST_FRAG;
3149                 } else {
3150                         ssf->ssf_info.sinfo_flags = SCTP_DATA_NOT_FRAG;
3151                 }
3152                 ssf->ssf_info.sinfo_ppid = sp->ppid;
3153                 ssf->ssf_info.sinfo_context = sp->context;
3154                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
3155                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
3156         }
3157         SCTP_BUF_NEXT(m_notify) = sp->data;
3158
3159         /* Steal off the mbuf */
3160         sp->data = NULL;
3161         /*
3162          * For this case, we check the actual socket buffer, since the assoc
3163          * is going away we don't want to overfill the socket buffer for a
3164          * non-reader
3165          */
3166         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3167                 sctp_m_freem(m_notify);
3168                 return;
3169         }
3170         /* append to socket */
3171         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3172             0, 0, stcb->asoc.context, 0, 0, 0,
3173             m_notify);
3174         if (control == NULL) {
3175                 /* no memory */
3176                 sctp_m_freem(m_notify);
3177                 return;
3178         }
3179         control->length = SCTP_BUF_LEN(m_notify);
3180         control->spec_flags = M_NOTIFICATION;
3181         /* not that we need this */
3182         control->tail_mbuf = m_notify;
3183         sctp_add_to_readq(stcb->sctp_ep, stcb,
3184             control,
3185             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3186 }
3187
3188
3189
3190 static void
3191 sctp_notify_adaptation_layer(struct sctp_tcb *stcb)
3192 {
3193         struct mbuf *m_notify;
3194         struct sctp_adaptation_event *sai;
3195         struct sctp_queued_to_read *control;
3196
3197         if ((stcb == NULL) ||
3198             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ADAPTATIONEVNT)) {
3199                 /* event not enabled */
3200                 return;
3201         }
3202
3203         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_NOWAIT, 1, MT_DATA);
3204         if (m_notify == NULL)
3205                 /* no space left */
3206                 return;
3207         SCTP_BUF_LEN(m_notify) = 0;
3208         sai = mtod(m_notify, struct sctp_adaptation_event *);
3209         memset(sai, 0, sizeof(struct sctp_adaptation_event));
3210         sai->sai_type = SCTP_ADAPTATION_INDICATION;
3211         sai->sai_flags = 0;
3212         sai->sai_length = sizeof(struct sctp_adaptation_event);
3213         sai->sai_adaptation_ind = stcb->asoc.peers_adaptation;
3214         sai->sai_assoc_id = sctp_get_associd(stcb);
3215
3216         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_adaptation_event);
3217         SCTP_BUF_NEXT(m_notify) = NULL;
3218
3219         /* append to socket */
3220         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3221             0, 0, stcb->asoc.context, 0, 0, 0,
3222             m_notify);
3223         if (control == NULL) {
3224                 /* no memory */
3225                 sctp_m_freem(m_notify);
3226                 return;
3227         }
3228         control->length = SCTP_BUF_LEN(m_notify);
3229         control->spec_flags = M_NOTIFICATION;
3230         /* not that we need this */
3231         control->tail_mbuf = m_notify;
3232         sctp_add_to_readq(stcb->sctp_ep, stcb,
3233             control,
3234             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3235 }
3236
3237 /* This always must be called with the read-queue LOCKED in the INP */
3238 static void
3239 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb, uint32_t error,
3240     uint32_t val, int so_locked
3241 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3242     SCTP_UNUSED
3243 #endif
3244 )
3245 {
3246         struct mbuf *m_notify;
3247         struct sctp_pdapi_event *pdapi;
3248         struct sctp_queued_to_read *control;
3249         struct sockbuf *sb;
3250
3251         if ((stcb == NULL) ||
3252             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_PDAPIEVNT)) {
3253                 /* event not enabled */
3254                 return;
3255         }
3256         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
3257                 return;
3258         }
3259
3260         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 0, M_NOWAIT, 1, MT_DATA);
3261         if (m_notify == NULL)
3262                 /* no space left */
3263                 return;
3264         SCTP_BUF_LEN(m_notify) = 0;
3265         pdapi = mtod(m_notify, struct sctp_pdapi_event *);
3266         memset(pdapi, 0, sizeof(struct sctp_pdapi_event));
3267         pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
3268         pdapi->pdapi_flags = 0;
3269         pdapi->pdapi_length = sizeof(struct sctp_pdapi_event);
3270         pdapi->pdapi_indication = error;
3271         pdapi->pdapi_stream = (val >> 16);
3272         pdapi->pdapi_seq = (val & 0x0000ffff);
3273         pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
3274
3275         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_pdapi_event);
3276         SCTP_BUF_NEXT(m_notify) = NULL;
3277         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3278             0, 0, stcb->asoc.context, 0, 0, 0,
3279             m_notify);
3280         if (control == NULL) {
3281                 /* no memory */
3282                 sctp_m_freem(m_notify);
3283                 return;
3284         }
3285         control->length = SCTP_BUF_LEN(m_notify);
3286         control->spec_flags = M_NOTIFICATION;
3287         /* not that we need this */
3288         control->tail_mbuf = m_notify;
3289         sb = &stcb->sctp_socket->so_rcv;
3290         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3291                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m_notify));
3292         }
3293         sctp_sballoc(stcb, sb, m_notify);
3294         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3295                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3296         }
3297         control->end_added = 1;
3298         if (stcb->asoc.control_pdapi)
3299                 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next);
3300         else {
3301                 /* we really should not see this case */
3302                 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next);
3303         }
3304         if (stcb->sctp_ep && stcb->sctp_socket) {
3305                 /* This should always be the case */
3306 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3307                 struct socket *so;
3308
3309                 so = SCTP_INP_SO(stcb->sctp_ep);
3310                 if (!so_locked) {
3311                         atomic_add_int(&stcb->asoc.refcnt, 1);
3312                         SCTP_TCB_UNLOCK(stcb);
3313                         SCTP_SOCKET_LOCK(so, 1);
3314                         SCTP_TCB_LOCK(stcb);
3315                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
3316                         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3317                                 SCTP_SOCKET_UNLOCK(so, 1);
3318                                 return;
3319                         }
3320                 }
3321 #endif
3322                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
3323 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3324                 if (!so_locked) {
3325                         SCTP_SOCKET_UNLOCK(so, 1);
3326                 }
3327 #endif
3328         }
3329 }
3330
3331 static void
3332 sctp_notify_shutdown_event(struct sctp_tcb *stcb)
3333 {
3334         struct mbuf *m_notify;
3335         struct sctp_shutdown_event *sse;
3336         struct sctp_queued_to_read *control;
3337
3338         /*
3339          * For TCP model AND UDP connected sockets we will send an error up
3340          * when an SHUTDOWN completes
3341          */
3342         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3343             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
3344                 /* mark socket closed for read/write and wakeup! */
3345 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3346                 struct socket *so;
3347
3348                 so = SCTP_INP_SO(stcb->sctp_ep);
3349                 atomic_add_int(&stcb->asoc.refcnt, 1);
3350                 SCTP_TCB_UNLOCK(stcb);
3351                 SCTP_SOCKET_LOCK(so, 1);
3352                 SCTP_TCB_LOCK(stcb);
3353                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3354                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
3355                         SCTP_SOCKET_UNLOCK(so, 1);
3356                         return;
3357                 }
3358 #endif
3359                 socantsendmore(stcb->sctp_socket);
3360 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3361                 SCTP_SOCKET_UNLOCK(so, 1);
3362 #endif
3363         }
3364         if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT)) {
3365                 /* event not enabled */
3366                 return;
3367         }
3368
3369         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 0, M_NOWAIT, 1, MT_DATA);
3370         if (m_notify == NULL)
3371                 /* no space left */
3372                 return;
3373         sse = mtod(m_notify, struct sctp_shutdown_event *);
3374         memset(sse, 0, sizeof(struct sctp_shutdown_event));
3375         sse->sse_type = SCTP_SHUTDOWN_EVENT;
3376         sse->sse_flags = 0;
3377         sse->sse_length = sizeof(struct sctp_shutdown_event);
3378         sse->sse_assoc_id = sctp_get_associd(stcb);
3379
3380         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_shutdown_event);
3381         SCTP_BUF_NEXT(m_notify) = NULL;
3382
3383         /* append to socket */
3384         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3385             0, 0, stcb->asoc.context, 0, 0, 0,
3386             m_notify);
3387         if (control == NULL) {
3388                 /* no memory */
3389                 sctp_m_freem(m_notify);
3390                 return;
3391         }
3392         control->length = SCTP_BUF_LEN(m_notify);
3393         control->spec_flags = M_NOTIFICATION;
3394         /* not that we need this */
3395         control->tail_mbuf = m_notify;
3396         sctp_add_to_readq(stcb->sctp_ep, stcb,
3397             control,
3398             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3399 }
3400
3401 static void
3402 sctp_notify_sender_dry_event(struct sctp_tcb *stcb,
3403     int so_locked
3404 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3405     SCTP_UNUSED
3406 #endif
3407 )
3408 {
3409         struct mbuf *m_notify;
3410         struct sctp_sender_dry_event *event;
3411         struct sctp_queued_to_read *control;
3412
3413         if ((stcb == NULL) ||
3414             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DRYEVNT)) {
3415                 /* event not enabled */
3416                 return;
3417         }
3418
3419         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_sender_dry_event), 0, M_NOWAIT, 1, MT_DATA);
3420         if (m_notify == NULL) {
3421                 /* no space left */
3422                 return;
3423         }
3424         SCTP_BUF_LEN(m_notify) = 0;
3425         event = mtod(m_notify, struct sctp_sender_dry_event *);
3426         memset(event, 0, sizeof(struct sctp_sender_dry_event));
3427         event->sender_dry_type = SCTP_SENDER_DRY_EVENT;
3428         event->sender_dry_flags = 0;
3429         event->sender_dry_length = sizeof(struct sctp_sender_dry_event);
3430         event->sender_dry_assoc_id = sctp_get_associd(stcb);
3431
3432         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_sender_dry_event);
3433         SCTP_BUF_NEXT(m_notify) = NULL;
3434
3435         /* append to socket */
3436         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3437             0, 0, stcb->asoc.context, 0, 0, 0,
3438             m_notify);
3439         if (control == NULL) {
3440                 /* no memory */
3441                 sctp_m_freem(m_notify);
3442                 return;
3443         }
3444         control->length = SCTP_BUF_LEN(m_notify);
3445         control->spec_flags = M_NOTIFICATION;
3446         /* not that we need this */
3447         control->tail_mbuf = m_notify;
3448         sctp_add_to_readq(stcb->sctp_ep, stcb, control,
3449             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3450 }
3451
3452
3453 void
3454 sctp_notify_stream_reset_add(struct sctp_tcb *stcb, uint16_t numberin, uint16_t numberout, int flag)
3455 {
3456         struct mbuf *m_notify;
3457         struct sctp_queued_to_read *control;
3458         struct sctp_stream_change_event *stradd;
3459
3460         if ((stcb == NULL) ||
3461             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT))) {
3462                 /* event not enabled */
3463                 return;
3464         }
3465         if ((stcb->asoc.peer_req_out) && flag) {
3466                 /* Peer made the request, don't tell the local user */
3467                 stcb->asoc.peer_req_out = 0;
3468                 return;
3469         }
3470         stcb->asoc.peer_req_out = 0;
3471         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_stream_change_event), 0, M_NOWAIT, 1, MT_DATA);
3472         if (m_notify == NULL)
3473                 /* no space left */
3474                 return;
3475         SCTP_BUF_LEN(m_notify) = 0;
3476         stradd = mtod(m_notify, struct sctp_stream_change_event *);
3477         memset(stradd, 0, sizeof(struct sctp_stream_change_event));
3478         stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT;
3479         stradd->strchange_flags = flag;
3480         stradd->strchange_length = sizeof(struct sctp_stream_change_event);
3481         stradd->strchange_assoc_id = sctp_get_associd(stcb);
3482         stradd->strchange_instrms = numberin;
3483         stradd->strchange_outstrms = numberout;
3484         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_stream_change_event);
3485         SCTP_BUF_NEXT(m_notify) = NULL;
3486         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3487                 /* no space */
3488                 sctp_m_freem(m_notify);
3489                 return;
3490         }
3491         /* append to socket */
3492         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3493             0, 0, stcb->asoc.context, 0, 0, 0,
3494             m_notify);
3495         if (control == NULL) {
3496                 /* no memory */
3497                 sctp_m_freem(m_notify);
3498                 return;
3499         }
3500         control->length = SCTP_BUF_LEN(m_notify);
3501         control->spec_flags = M_NOTIFICATION;
3502         /* not that we need this */
3503         control->tail_mbuf = m_notify;
3504         sctp_add_to_readq(stcb->sctp_ep, stcb,
3505             control,
3506             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3507 }
3508
3509 void
3510 sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb, uint32_t sending_tsn, uint32_t recv_tsn, int flag)
3511 {
3512         struct mbuf *m_notify;
3513         struct sctp_queued_to_read *control;
3514         struct sctp_assoc_reset_event *strasoc;
3515
3516         if ((stcb == NULL) ||
3517             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT))) {
3518                 /* event not enabled */
3519                 return;
3520         }
3521         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_reset_event), 0, M_NOWAIT, 1, MT_DATA);
3522         if (m_notify == NULL)
3523                 /* no space left */
3524                 return;
3525         SCTP_BUF_LEN(m_notify) = 0;
3526         strasoc = mtod(m_notify, struct sctp_assoc_reset_event *);
3527         memset(strasoc, 0, sizeof(struct sctp_assoc_reset_event));
3528         strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT;
3529         strasoc->assocreset_flags = flag;
3530         strasoc->assocreset_length = sizeof(struct sctp_assoc_reset_event);
3531         strasoc->assocreset_assoc_id = sctp_get_associd(stcb);
3532         strasoc->assocreset_local_tsn = sending_tsn;
3533         strasoc->assocreset_remote_tsn = recv_tsn;
3534         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_reset_event);
3535         SCTP_BUF_NEXT(m_notify) = NULL;
3536         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3537                 /* no space */
3538                 sctp_m_freem(m_notify);
3539                 return;
3540         }
3541         /* append to socket */
3542         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3543             0, 0, stcb->asoc.context, 0, 0, 0,
3544             m_notify);
3545         if (control == NULL) {
3546                 /* no memory */
3547                 sctp_m_freem(m_notify);
3548                 return;
3549         }
3550         control->length = SCTP_BUF_LEN(m_notify);
3551         control->spec_flags = M_NOTIFICATION;
3552         /* not that we need this */
3553         control->tail_mbuf = m_notify;
3554         sctp_add_to_readq(stcb->sctp_ep, stcb,
3555             control,
3556             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3557 }
3558
3559
3560
3561 static void
3562 sctp_notify_stream_reset(struct sctp_tcb *stcb,
3563     int number_entries, uint16_t *list, int flag)
3564 {
3565         struct mbuf *m_notify;
3566         struct sctp_queued_to_read *control;
3567         struct sctp_stream_reset_event *strreset;
3568         int len;
3569
3570         if ((stcb == NULL) ||
3571             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_RESETEVNT))) {
3572                 /* event not enabled */
3573                 return;
3574         }
3575
3576         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
3577         if (m_notify == NULL)
3578                 /* no space left */
3579                 return;
3580         SCTP_BUF_LEN(m_notify) = 0;
3581         len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
3582         if (len > M_TRAILINGSPACE(m_notify)) {
3583                 /* never enough room */
3584                 sctp_m_freem(m_notify);
3585                 return;
3586         }
3587         strreset = mtod(m_notify, struct sctp_stream_reset_event *);
3588         memset(strreset, 0, len);
3589         strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
3590         strreset->strreset_flags = flag;
3591         strreset->strreset_length = len;
3592         strreset->strreset_assoc_id = sctp_get_associd(stcb);
3593         if (number_entries) {
3594                 int i;
3595
3596                 for (i = 0; i < number_entries; i++) {
3597                         strreset->strreset_stream_list[i] = ntohs(list[i]);
3598                 }
3599         }
3600         SCTP_BUF_LEN(m_notify) = len;
3601         SCTP_BUF_NEXT(m_notify) = NULL;
3602         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3603                 /* no space */
3604                 sctp_m_freem(m_notify);
3605                 return;
3606         }
3607         /* append to socket */
3608         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3609             0, 0, stcb->asoc.context, 0, 0, 0,
3610             m_notify);
3611         if (control == NULL) {
3612                 /* no memory */
3613                 sctp_m_freem(m_notify);
3614                 return;
3615         }
3616         control->length = SCTP_BUF_LEN(m_notify);
3617         control->spec_flags = M_NOTIFICATION;
3618         /* not that we need this */
3619         control->tail_mbuf = m_notify;
3620         sctp_add_to_readq(stcb->sctp_ep, stcb,
3621             control,
3622             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3623 }
3624
3625
3626 static void
3627 sctp_notify_remote_error(struct sctp_tcb *stcb, uint16_t error, struct sctp_error_chunk *chunk)
3628 {
3629         struct mbuf *m_notify;
3630         struct sctp_remote_error *sre;
3631         struct sctp_queued_to_read *control;
3632         unsigned int notif_len;
3633         uint16_t chunk_len;
3634
3635         if ((stcb == NULL) ||
3636             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPEERERR)) {
3637                 return;
3638         }
3639         if (chunk != NULL) {
3640                 chunk_len = ntohs(chunk->ch.chunk_length);
3641                 /*
3642                  * Only SCTP_CHUNK_BUFFER_SIZE are guaranteed to be
3643                  * contiguous.
3644                  */
3645                 if (chunk_len > SCTP_CHUNK_BUFFER_SIZE) {
3646                         chunk_len = SCTP_CHUNK_BUFFER_SIZE;
3647                 }
3648         } else {
3649                 chunk_len = 0;
3650         }
3651         notif_len = (unsigned int)(sizeof(struct sctp_remote_error) + chunk_len);
3652         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3653         if (m_notify == NULL) {
3654                 /* Retry with smaller value. */
3655                 notif_len = (unsigned int)sizeof(struct sctp_remote_error);
3656                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3657                 if (m_notify == NULL) {
3658                         return;
3659                 }
3660         }
3661         SCTP_BUF_NEXT(m_notify) = NULL;
3662         sre = mtod(m_notify, struct sctp_remote_error *);
3663         memset(sre, 0, notif_len);
3664         sre->sre_type = SCTP_REMOTE_ERROR;
3665         sre->sre_flags = 0;
3666         sre->sre_length = sizeof(struct sctp_remote_error);
3667         sre->sre_error = error;
3668         sre->sre_assoc_id = sctp_get_associd(stcb);
3669         if (notif_len > sizeof(struct sctp_remote_error)) {
3670                 memcpy(sre->sre_data, chunk, chunk_len);
3671                 sre->sre_length += chunk_len;
3672         }
3673         SCTP_BUF_LEN(m_notify) = sre->sre_length;
3674         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3675             0, 0, stcb->asoc.context, 0, 0, 0,
3676             m_notify);
3677         if (control != NULL) {
3678                 control->length = SCTP_BUF_LEN(m_notify);
3679                 control->spec_flags = M_NOTIFICATION;
3680                 /* not that we need this */
3681                 control->tail_mbuf = m_notify;
3682                 sctp_add_to_readq(stcb->sctp_ep, stcb,
3683                     control,
3684                     &stcb->sctp_socket->so_rcv, 1,
3685                     SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3686         } else {
3687                 sctp_m_freem(m_notify);
3688         }
3689 }
3690
3691
3692 void
3693 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb,
3694     uint32_t error, void *data, int so_locked
3695 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3696     SCTP_UNUSED
3697 #endif
3698 )
3699 {
3700         if ((stcb == NULL) ||
3701             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3702             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3703             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3704                 /* If the socket is gone we are out of here */
3705                 return;
3706         }
3707         if (stcb->sctp_socket->so_rcv.sb_state & SBS_CANTRCVMORE) {
3708                 return;
3709         }
3710         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
3711             (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
3712                 if ((notification == SCTP_NOTIFY_INTERFACE_DOWN) ||
3713                     (notification == SCTP_NOTIFY_INTERFACE_UP) ||
3714                     (notification == SCTP_NOTIFY_INTERFACE_CONFIRMED)) {
3715                         /* Don't report these in front states */
3716                         return;
3717                 }
3718         }
3719         switch (notification) {
3720         case SCTP_NOTIFY_ASSOC_UP:
3721                 if (stcb->asoc.assoc_up_sent == 0) {
3722                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, NULL, 0, so_locked);
3723                         stcb->asoc.assoc_up_sent = 1;
3724                 }
3725                 if (stcb->asoc.adaptation_needed && (stcb->asoc.adaptation_sent == 0)) {
3726                         sctp_notify_adaptation_layer(stcb);
3727                 }
3728                 if (stcb->asoc.auth_supported == 0) {
3729                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3730                             NULL, so_locked);
3731                 }
3732                 break;
3733         case SCTP_NOTIFY_ASSOC_DOWN:
3734                 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, NULL, 0, so_locked);
3735                 break;
3736         case SCTP_NOTIFY_INTERFACE_DOWN:
3737                 {
3738                         struct sctp_nets *net;
3739
3740                         net = (struct sctp_nets *)data;
3741                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE,
3742                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
3743                         break;
3744                 }
3745         case SCTP_NOTIFY_INTERFACE_UP:
3746                 {
3747                         struct sctp_nets *net;
3748
3749                         net = (struct sctp_nets *)data;
3750                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE,
3751                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
3752                         break;
3753                 }
3754         case SCTP_NOTIFY_INTERFACE_CONFIRMED:
3755                 {
3756                         struct sctp_nets *net;
3757
3758                         net = (struct sctp_nets *)data;
3759                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED,
3760                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
3761                         break;
3762                 }
3763         case SCTP_NOTIFY_SPECIAL_SP_FAIL:
3764                 sctp_notify_send_failed2(stcb, error,
3765                     (struct sctp_stream_queue_pending *)data, so_locked);
3766                 break;
3767         case SCTP_NOTIFY_SENT_DG_FAIL:
3768                 sctp_notify_send_failed(stcb, 1, error,
3769                     (struct sctp_tmit_chunk *)data, so_locked);
3770                 break;
3771         case SCTP_NOTIFY_UNSENT_DG_FAIL:
3772                 sctp_notify_send_failed(stcb, 0, error,
3773                     (struct sctp_tmit_chunk *)data, so_locked);
3774                 break;
3775         case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION:
3776                 {
3777                         uint32_t val;
3778
3779                         val = *((uint32_t *)data);
3780
3781                         sctp_notify_partial_delivery_indication(stcb, error, val, so_locked);
3782                         break;
3783                 }
3784         case SCTP_NOTIFY_ASSOC_LOC_ABORTED:
3785                 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
3786                     (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
3787                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 0, so_locked);
3788                 } else {
3789                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 0, so_locked);
3790                 }
3791                 break;
3792         case SCTP_NOTIFY_ASSOC_REM_ABORTED:
3793                 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_WAIT) ||
3794                     (SCTP_GET_STATE(stcb) == SCTP_STATE_COOKIE_ECHOED)) {
3795                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 1, so_locked);
3796                 } else {
3797                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 1, so_locked);
3798                 }
3799                 break;
3800         case SCTP_NOTIFY_ASSOC_RESTART:
3801                 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, NULL, 0, so_locked);
3802                 if (stcb->asoc.auth_supported == 0) {
3803                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3804                             NULL, so_locked);
3805                 }
3806                 break;
3807         case SCTP_NOTIFY_STR_RESET_SEND:
3808                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_OUTGOING_SSN);
3809                 break;
3810         case SCTP_NOTIFY_STR_RESET_RECV:
3811                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_INCOMING);
3812                 break;
3813         case SCTP_NOTIFY_STR_RESET_FAILED_OUT:
3814                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
3815                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_FAILED));
3816                 break;
3817         case SCTP_NOTIFY_STR_RESET_DENIED_OUT:
3818                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
3819                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_DENIED));
3820                 break;
3821         case SCTP_NOTIFY_STR_RESET_FAILED_IN:
3822                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
3823                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_FAILED));
3824                 break;
3825         case SCTP_NOTIFY_STR_RESET_DENIED_IN:
3826                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
3827                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_DENIED));
3828                 break;
3829         case SCTP_NOTIFY_ASCONF_ADD_IP:
3830                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data,
3831                     error, so_locked);
3832                 break;
3833         case SCTP_NOTIFY_ASCONF_DELETE_IP:
3834                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data,
3835                     error, so_locked);
3836                 break;
3837         case SCTP_NOTIFY_ASCONF_SET_PRIMARY:
3838                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data,
3839                     error, so_locked);
3840                 break;
3841         case SCTP_NOTIFY_PEER_SHUTDOWN:
3842                 sctp_notify_shutdown_event(stcb);
3843                 break;
3844         case SCTP_NOTIFY_AUTH_NEW_KEY:
3845                 sctp_notify_authentication(stcb, SCTP_AUTH_NEW_KEY, error,
3846                     (uint16_t)(uintptr_t)data,
3847                     so_locked);
3848                 break;
3849         case SCTP_NOTIFY_AUTH_FREE_KEY:
3850                 sctp_notify_authentication(stcb, SCTP_AUTH_FREE_KEY, error,
3851                     (uint16_t)(uintptr_t)data,
3852                     so_locked);
3853                 break;
3854         case SCTP_NOTIFY_NO_PEER_AUTH:
3855                 sctp_notify_authentication(stcb, SCTP_AUTH_NO_AUTH, error,
3856                     (uint16_t)(uintptr_t)data,
3857                     so_locked);
3858                 break;
3859         case SCTP_NOTIFY_SENDER_DRY:
3860                 sctp_notify_sender_dry_event(stcb, so_locked);
3861                 break;
3862         case SCTP_NOTIFY_REMOTE_ERROR:
3863                 sctp_notify_remote_error(stcb, error, data);
3864                 break;
3865         default:
3866                 SCTPDBG(SCTP_DEBUG_UTIL1, "%s: unknown notification %xh (%u)\n",
3867                     __func__, notification, notification);
3868                 break;
3869         }                       /* end switch */
3870 }
3871
3872 void
3873 sctp_report_all_outbound(struct sctp_tcb *stcb, uint16_t error, int holds_lock, int so_locked
3874 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3875     SCTP_UNUSED
3876 #endif
3877 )
3878 {
3879         struct sctp_association *asoc;
3880         struct sctp_stream_out *outs;
3881         struct sctp_tmit_chunk *chk, *nchk;
3882         struct sctp_stream_queue_pending *sp, *nsp;
3883         int i;
3884
3885         if (stcb == NULL) {
3886                 return;
3887         }
3888         asoc = &stcb->asoc;
3889         if (asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) {
3890                 /* already being freed */
3891                 return;
3892         }
3893         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3894             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3895             (asoc->state & SCTP_STATE_CLOSED_SOCKET)) {
3896                 return;
3897         }
3898         /* now through all the gunk freeing chunks */
3899         if (holds_lock == 0) {
3900                 SCTP_TCB_SEND_LOCK(stcb);
3901         }
3902         /* sent queue SHOULD be empty */
3903         TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) {
3904                 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
3905                 asoc->sent_queue_cnt--;
3906                 if (chk->sent != SCTP_DATAGRAM_NR_ACKED) {
3907                         if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
3908                                 asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
3909 #ifdef INVARIANTS
3910                         } else {
3911                                 panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
3912 #endif
3913                         }
3914                 }
3915                 if (chk->data != NULL) {
3916                         sctp_free_bufspace(stcb, asoc, chk, 1);
3917                         sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb,
3918                             error, chk, so_locked);
3919                         if (chk->data) {
3920                                 sctp_m_freem(chk->data);
3921                                 chk->data = NULL;
3922                         }
3923                 }
3924                 sctp_free_a_chunk(stcb, chk, so_locked);
3925                 /* sa_ignore FREED_MEMORY */
3926         }
3927         /* pending send queue SHOULD be empty */
3928         TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
3929                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
3930                 asoc->send_queue_cnt--;
3931                 if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
3932                         asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
3933 #ifdef INVARIANTS
3934                 } else {
3935                         panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
3936 #endif
3937                 }
3938                 if (chk->data != NULL) {
3939                         sctp_free_bufspace(stcb, asoc, chk, 1);
3940                         sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
3941                             error, chk, so_locked);
3942                         if (chk->data) {
3943                                 sctp_m_freem(chk->data);
3944                                 chk->data = NULL;
3945                         }
3946                 }
3947                 sctp_free_a_chunk(stcb, chk, so_locked);
3948                 /* sa_ignore FREED_MEMORY */
3949         }
3950         for (i = 0; i < asoc->streamoutcnt; i++) {
3951                 /* For each stream */
3952                 outs = &asoc->strmout[i];
3953                 /* clean up any sends there */
3954                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
3955                         atomic_subtract_int(&asoc->stream_queue_cnt, 1);
3956                         TAILQ_REMOVE(&outs->outqueue, sp, next);
3957                         stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, 1);
3958                         sctp_free_spbufspace(stcb, asoc, sp);
3959                         if (sp->data) {
3960                                 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
3961                                     error, (void *)sp, so_locked);
3962                                 if (sp->data) {
3963                                         sctp_m_freem(sp->data);
3964                                         sp->data = NULL;
3965                                         sp->tail_mbuf = NULL;
3966                                         sp->length = 0;
3967                                 }
3968                         }
3969                         if (sp->net) {
3970                                 sctp_free_remote_addr(sp->net);
3971                                 sp->net = NULL;
3972                         }
3973                         /* Free the chunk */
3974                         sctp_free_a_strmoq(stcb, sp, so_locked);
3975                         /* sa_ignore FREED_MEMORY */
3976                 }
3977         }
3978
3979         if (holds_lock == 0) {
3980                 SCTP_TCB_SEND_UNLOCK(stcb);
3981         }
3982 }
3983
3984 void
3985 sctp_abort_notification(struct sctp_tcb *stcb, uint8_t from_peer, uint16_t error,
3986     struct sctp_abort_chunk *abort, int so_locked
3987 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3988     SCTP_UNUSED
3989 #endif
3990 )
3991 {
3992         if (stcb == NULL) {
3993                 return;
3994         }
3995         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
3996             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
3997             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
3998                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED;
3999         }
4000         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
4001             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
4002             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
4003                 return;
4004         }
4005         /* Tell them we lost the asoc */
4006         sctp_report_all_outbound(stcb, error, 0, so_locked);
4007         if (from_peer) {
4008                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_REM_ABORTED, stcb, error, abort, so_locked);
4009         } else {
4010                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_LOC_ABORTED, stcb, error, abort, so_locked);
4011         }
4012 }
4013
4014 void
4015 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
4016     struct mbuf *m, int iphlen,
4017     struct sockaddr *src, struct sockaddr *dst,
4018     struct sctphdr *sh, struct mbuf *op_err,
4019     uint8_t mflowtype, uint32_t mflowid,
4020     uint32_t vrf_id, uint16_t port)
4021 {
4022         uint32_t vtag;
4023 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4024         struct socket *so;
4025 #endif
4026
4027         vtag = 0;
4028         if (stcb != NULL) {
4029                 vtag = stcb->asoc.peer_vtag;
4030                 vrf_id = stcb->asoc.vrf_id;
4031         }
4032         sctp_send_abort(m, iphlen, src, dst, sh, vtag, op_err,
4033             mflowtype, mflowid, inp->fibnum,
4034             vrf_id, port);
4035         if (stcb != NULL) {
4036                 /* We have a TCB to abort, send notification too */
4037                 sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED);
4038                 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_WAS_ABORTED);
4039                 /* Ok, now lets free it */
4040 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4041                 so = SCTP_INP_SO(inp);
4042                 atomic_add_int(&stcb->asoc.refcnt, 1);
4043                 SCTP_TCB_UNLOCK(stcb);
4044                 SCTP_SOCKET_LOCK(so, 1);
4045                 SCTP_TCB_LOCK(stcb);
4046                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4047 #endif
4048                 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4049                 if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
4050                     (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4051                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4052                 }
4053                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4054                     SCTP_FROM_SCTPUTIL + SCTP_LOC_4);
4055 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4056                 SCTP_SOCKET_UNLOCK(so, 1);
4057 #endif
4058         }
4059 }
4060 #ifdef SCTP_ASOCLOG_OF_TSNS
4061 void
4062 sctp_print_out_track_log(struct sctp_tcb *stcb)
4063 {
4064 #ifdef NOSIY_PRINTS
4065         int i;
4066
4067         SCTP_PRINTF("Last ep reason:%x\n", stcb->sctp_ep->last_abort_code);
4068         SCTP_PRINTF("IN bound TSN log-aaa\n");
4069         if ((stcb->asoc.tsn_in_at == 0) && (stcb->asoc.tsn_in_wrapped == 0)) {
4070                 SCTP_PRINTF("None rcvd\n");
4071                 goto none_in;
4072         }
4073         if (stcb->asoc.tsn_in_wrapped) {
4074                 for (i = stcb->asoc.tsn_in_at; i < SCTP_TSN_LOG_SIZE; i++) {
4075                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4076                             stcb->asoc.in_tsnlog[i].tsn,
4077                             stcb->asoc.in_tsnlog[i].strm,
4078                             stcb->asoc.in_tsnlog[i].seq,
4079                             stcb->asoc.in_tsnlog[i].flgs,
4080                             stcb->asoc.in_tsnlog[i].sz);
4081                 }
4082         }
4083         if (stcb->asoc.tsn_in_at) {
4084                 for (i = 0; i < stcb->asoc.tsn_in_at; i++) {
4085                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4086                             stcb->asoc.in_tsnlog[i].tsn,
4087                             stcb->asoc.in_tsnlog[i].strm,
4088                             stcb->asoc.in_tsnlog[i].seq,
4089                             stcb->asoc.in_tsnlog[i].flgs,
4090                             stcb->asoc.in_tsnlog[i].sz);
4091                 }
4092         }
4093 none_in:
4094         SCTP_PRINTF("OUT bound TSN log-aaa\n");
4095         if ((stcb->asoc.tsn_out_at == 0) &&
4096             (stcb->asoc.tsn_out_wrapped == 0)) {
4097                 SCTP_PRINTF("None sent\n");
4098         }
4099         if (stcb->asoc.tsn_out_wrapped) {
4100                 for (i = stcb->asoc.tsn_out_at; i < SCTP_TSN_LOG_SIZE; i++) {
4101                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4102                             stcb->asoc.out_tsnlog[i].tsn,
4103                             stcb->asoc.out_tsnlog[i].strm,
4104                             stcb->asoc.out_tsnlog[i].seq,
4105                             stcb->asoc.out_tsnlog[i].flgs,
4106                             stcb->asoc.out_tsnlog[i].sz);
4107                 }
4108         }
4109         if (stcb->asoc.tsn_out_at) {
4110                 for (i = 0; i < stcb->asoc.tsn_out_at; i++) {
4111                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4112                             stcb->asoc.out_tsnlog[i].tsn,
4113                             stcb->asoc.out_tsnlog[i].strm,
4114                             stcb->asoc.out_tsnlog[i].seq,
4115                             stcb->asoc.out_tsnlog[i].flgs,
4116                             stcb->asoc.out_tsnlog[i].sz);
4117                 }
4118         }
4119 #endif
4120 }
4121 #endif
4122
4123 void
4124 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
4125     struct mbuf *op_err,
4126     int so_locked
4127 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4128     SCTP_UNUSED
4129 #endif
4130 )
4131 {
4132 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4133         struct socket *so;
4134 #endif
4135
4136 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4137         so = SCTP_INP_SO(inp);
4138 #endif
4139         if (stcb == NULL) {
4140                 /* Got to have a TCB */
4141                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4142                         if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4143                                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4144                                     SCTP_CALLED_DIRECTLY_NOCMPSET);
4145                         }
4146                 }
4147                 return;
4148         } else {
4149                 SCTP_ADD_SUBSTATE(stcb, SCTP_STATE_WAS_ABORTED);
4150         }
4151         /* notify the peer */
4152         sctp_send_abort_tcb(stcb, op_err, so_locked);
4153         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4154         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_OPEN) ||
4155             (SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4156                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4157         }
4158         /* notify the ulp */
4159         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) {
4160                 sctp_abort_notification(stcb, 0, 0, NULL, so_locked);
4161         }
4162         /* now free the asoc */
4163 #ifdef SCTP_ASOCLOG_OF_TSNS
4164         sctp_print_out_track_log(stcb);
4165 #endif
4166 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4167         if (!so_locked) {
4168                 atomic_add_int(&stcb->asoc.refcnt, 1);
4169                 SCTP_TCB_UNLOCK(stcb);
4170                 SCTP_SOCKET_LOCK(so, 1);
4171                 SCTP_TCB_LOCK(stcb);
4172                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4173         }
4174 #endif
4175         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4176             SCTP_FROM_SCTPUTIL + SCTP_LOC_5);
4177 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4178         if (!so_locked) {
4179                 SCTP_SOCKET_UNLOCK(so, 1);
4180         }
4181 #endif
4182 }
4183
4184 void
4185 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset,
4186     struct sockaddr *src, struct sockaddr *dst,
4187     struct sctphdr *sh, struct sctp_inpcb *inp,
4188     struct mbuf *cause,
4189     uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
4190     uint32_t vrf_id, uint16_t port)
4191 {
4192         struct sctp_chunkhdr *ch, chunk_buf;
4193         unsigned int chk_length;
4194         int contains_init_chunk;
4195
4196         SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue);
4197         /* Generate a TO address for future reference */
4198         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
4199                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4200                         sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4201                             SCTP_CALLED_DIRECTLY_NOCMPSET);
4202                 }
4203         }
4204         contains_init_chunk = 0;
4205         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4206             sizeof(*ch), (uint8_t *)&chunk_buf);
4207         while (ch != NULL) {
4208                 chk_length = ntohs(ch->chunk_length);
4209                 if (chk_length < sizeof(*ch)) {
4210                         /* break to abort land */
4211                         break;
4212                 }
4213                 switch (ch->chunk_type) {
4214                 case SCTP_INIT:
4215                         contains_init_chunk = 1;
4216                         break;
4217                 case SCTP_PACKET_DROPPED:
4218                         /* we don't respond to pkt-dropped */
4219                         return;
4220                 case SCTP_ABORT_ASSOCIATION:
4221                         /* we don't respond with an ABORT to an ABORT */
4222                         return;
4223                 case SCTP_SHUTDOWN_COMPLETE:
4224                         /*
4225                          * we ignore it since we are not waiting for it and
4226                          * peer is gone
4227                          */
4228                         return;
4229                 case SCTP_SHUTDOWN_ACK:
4230                         sctp_send_shutdown_complete2(src, dst, sh,
4231                             mflowtype, mflowid, fibnum,
4232                             vrf_id, port);
4233                         return;
4234                 default:
4235                         break;
4236                 }
4237                 offset += SCTP_SIZE32(chk_length);
4238                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4239                     sizeof(*ch), (uint8_t *)&chunk_buf);
4240         }
4241         if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
4242             ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
4243             (contains_init_chunk == 0))) {
4244                 sctp_send_abort(m, iphlen, src, dst, sh, 0, cause,
4245                     mflowtype, mflowid, fibnum,
4246                     vrf_id, port);
4247         }
4248 }
4249
4250 /*
4251  * check the inbound datagram to make sure there is not an abort inside it,
4252  * if there is return 1, else return 0.
4253  */
4254 int
4255 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t *vtagfill)
4256 {
4257         struct sctp_chunkhdr *ch;
4258         struct sctp_init_chunk *init_chk, chunk_buf;
4259         int offset;
4260         unsigned int chk_length;
4261
4262         offset = iphlen + sizeof(struct sctphdr);
4263         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch),
4264             (uint8_t *)&chunk_buf);
4265         while (ch != NULL) {
4266                 chk_length = ntohs(ch->chunk_length);
4267                 if (chk_length < sizeof(*ch)) {
4268                         /* packet is probably corrupt */
4269                         break;
4270                 }
4271                 /* we seem to be ok, is it an abort? */
4272                 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) {
4273                         /* yep, tell them */
4274                         return (1);
4275                 }
4276                 if (ch->chunk_type == SCTP_INITIATION) {
4277                         /* need to update the Vtag */
4278                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
4279                             offset, sizeof(*init_chk), (uint8_t *)&chunk_buf);
4280                         if (init_chk != NULL) {
4281                                 *vtagfill = ntohl(init_chk->init.initiate_tag);
4282                         }
4283                 }
4284                 /* Nope, move to the next chunk */
4285                 offset += SCTP_SIZE32(chk_length);
4286                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4287                     sizeof(*ch), (uint8_t *)&chunk_buf);
4288         }
4289         return (0);
4290 }
4291
4292 /*
4293  * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id
4294  * set (i.e. it's 0) so, create this function to compare link local scopes
4295  */
4296 #ifdef INET6
4297 uint32_t
4298 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2)
4299 {
4300         struct sockaddr_in6 a, b;
4301
4302         /* save copies */
4303         a = *addr1;
4304         b = *addr2;
4305
4306         if (a.sin6_scope_id == 0)
4307                 if (sa6_recoverscope(&a)) {
4308                         /* can't get scope, so can't match */
4309                         return (0);
4310                 }
4311         if (b.sin6_scope_id == 0)
4312                 if (sa6_recoverscope(&b)) {
4313                         /* can't get scope, so can't match */
4314                         return (0);
4315                 }
4316         if (a.sin6_scope_id != b.sin6_scope_id)
4317                 return (0);
4318
4319         return (1);
4320 }
4321
4322 /*
4323  * returns a sockaddr_in6 with embedded scope recovered and removed
4324  */
4325 struct sockaddr_in6 *
4326 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store)
4327 {
4328         /* check and strip embedded scope junk */
4329         if (addr->sin6_family == AF_INET6) {
4330                 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) {
4331                         if (addr->sin6_scope_id == 0) {
4332                                 *store = *addr;
4333                                 if (!sa6_recoverscope(store)) {
4334                                         /* use the recovered scope */
4335                                         addr = store;
4336                                 }
4337                         } else {
4338                                 /* else, return the original "to" addr */
4339                                 in6_clearscope(&addr->sin6_addr);
4340                         }
4341                 }
4342         }
4343         return (addr);
4344 }
4345 #endif
4346
4347 /*
4348  * are the two addresses the same?  currently a "scopeless" check returns: 1
4349  * if same, 0 if not
4350  */
4351 int
4352 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2)
4353 {
4354
4355         /* must be valid */
4356         if (sa1 == NULL || sa2 == NULL)
4357                 return (0);
4358
4359         /* must be the same family */
4360         if (sa1->sa_family != sa2->sa_family)
4361                 return (0);
4362
4363         switch (sa1->sa_family) {
4364 #ifdef INET6
4365         case AF_INET6:
4366                 {
4367                         /* IPv6 addresses */
4368                         struct sockaddr_in6 *sin6_1, *sin6_2;
4369
4370                         sin6_1 = (struct sockaddr_in6 *)sa1;
4371                         sin6_2 = (struct sockaddr_in6 *)sa2;
4372                         return (SCTP6_ARE_ADDR_EQUAL(sin6_1,
4373                             sin6_2));
4374                 }
4375 #endif
4376 #ifdef INET
4377         case AF_INET:
4378                 {
4379                         /* IPv4 addresses */
4380                         struct sockaddr_in *sin_1, *sin_2;
4381
4382                         sin_1 = (struct sockaddr_in *)sa1;
4383                         sin_2 = (struct sockaddr_in *)sa2;
4384                         return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr);
4385                 }
4386 #endif
4387         default:
4388                 /* we don't do these... */
4389                 return (0);
4390         }
4391 }
4392
4393 void
4394 sctp_print_address(struct sockaddr *sa)
4395 {
4396 #ifdef INET6
4397         char ip6buf[INET6_ADDRSTRLEN];
4398 #endif
4399
4400         switch (sa->sa_family) {
4401 #ifdef INET6
4402         case AF_INET6:
4403                 {
4404                         struct sockaddr_in6 *sin6;
4405
4406                         sin6 = (struct sockaddr_in6 *)sa;
4407                         SCTP_PRINTF("IPv6 address: %s:port:%d scope:%u\n",
4408                             ip6_sprintf(ip6buf, &sin6->sin6_addr),
4409                             ntohs(sin6->sin6_port),
4410                             sin6->sin6_scope_id);
4411                         break;
4412                 }
4413 #endif
4414 #ifdef INET
4415         case AF_INET:
4416                 {
4417                         struct sockaddr_in *sin;
4418                         unsigned char *p;
4419
4420                         sin = (struct sockaddr_in *)sa;
4421                         p = (unsigned char *)&sin->sin_addr;
4422                         SCTP_PRINTF("IPv4 address: %u.%u.%u.%u:%d\n",
4423                             p[0], p[1], p[2], p[3], ntohs(sin->sin_port));
4424                         break;
4425                 }
4426 #endif
4427         default:
4428                 SCTP_PRINTF("?\n");
4429                 break;
4430         }
4431 }
4432
4433 void
4434 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
4435     struct sctp_inpcb *new_inp,
4436     struct sctp_tcb *stcb,
4437     int waitflags)
4438 {
4439         /*
4440          * go through our old INP and pull off any control structures that
4441          * belong to stcb and move then to the new inp.
4442          */
4443         struct socket *old_so, *new_so;
4444         struct sctp_queued_to_read *control, *nctl;
4445         struct sctp_readhead tmp_queue;
4446         struct mbuf *m;
4447         int error = 0;
4448
4449         old_so = old_inp->sctp_socket;
4450         new_so = new_inp->sctp_socket;
4451         TAILQ_INIT(&tmp_queue);
4452         error = sblock(&old_so->so_rcv, waitflags);
4453         if (error) {
4454                 /*
4455                  * Gak, can't get sblock, we have a problem. data will be
4456                  * left stranded.. and we don't dare look at it since the
4457                  * other thread may be reading something. Oh well, its a
4458                  * screwed up app that does a peeloff OR a accept while
4459                  * reading from the main socket... actually its only the
4460                  * peeloff() case, since I think read will fail on a
4461                  * listening socket..
4462                  */
4463                 return;
4464         }
4465         /* lock the socket buffers */
4466         SCTP_INP_READ_LOCK(old_inp);
4467         TAILQ_FOREACH_SAFE(control, &old_inp->read_queue, next, nctl) {
4468                 /* Pull off all for out target stcb */
4469                 if (control->stcb == stcb) {
4470                         /* remove it we want it */
4471                         TAILQ_REMOVE(&old_inp->read_queue, control, next);
4472                         TAILQ_INSERT_TAIL(&tmp_queue, control, next);
4473                         m = control->data;
4474                         while (m) {
4475                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4476                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
4477                                 }
4478                                 sctp_sbfree(control, stcb, &old_so->so_rcv, m);
4479                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4480                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4481                                 }
4482                                 m = SCTP_BUF_NEXT(m);
4483                         }
4484                 }
4485         }
4486         SCTP_INP_READ_UNLOCK(old_inp);
4487         /* Remove the sb-lock on the old socket */
4488
4489         sbunlock(&old_so->so_rcv);
4490         /* Now we move them over to the new socket buffer */
4491         SCTP_INP_READ_LOCK(new_inp);
4492         TAILQ_FOREACH_SAFE(control, &tmp_queue, next, nctl) {
4493                 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next);
4494                 m = control->data;
4495                 while (m) {
4496                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4497                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4498                         }
4499                         sctp_sballoc(stcb, &new_so->so_rcv, m);
4500                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4501                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4502                         }
4503                         m = SCTP_BUF_NEXT(m);
4504                 }
4505         }
4506         SCTP_INP_READ_UNLOCK(new_inp);
4507 }
4508
4509 void
4510 sctp_wakeup_the_read_socket(struct sctp_inpcb *inp,
4511     struct sctp_tcb *stcb,
4512     int so_locked
4513 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4514     SCTP_UNUSED
4515 #endif
4516 )
4517 {
4518         if ((inp != NULL) && (inp->sctp_socket != NULL)) {
4519 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4520                 struct socket *so;
4521
4522                 so = SCTP_INP_SO(inp);
4523                 if (!so_locked) {
4524                         if (stcb) {
4525                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4526                                 SCTP_TCB_UNLOCK(stcb);
4527                         }
4528                         SCTP_SOCKET_LOCK(so, 1);
4529                         if (stcb) {
4530                                 SCTP_TCB_LOCK(stcb);
4531                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4532                         }
4533                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4534                                 SCTP_SOCKET_UNLOCK(so, 1);
4535                                 return;
4536                         }
4537                 }
4538 #endif
4539                 sctp_sorwakeup(inp, inp->sctp_socket);
4540 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4541                 if (!so_locked) {
4542                         SCTP_SOCKET_UNLOCK(so, 1);
4543                 }
4544 #endif
4545         }
4546 }
4547
4548 void
4549 sctp_add_to_readq(struct sctp_inpcb *inp,
4550     struct sctp_tcb *stcb,
4551     struct sctp_queued_to_read *control,
4552     struct sockbuf *sb,
4553     int end,
4554     int inp_read_lock_held,
4555     int so_locked
4556 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4557     SCTP_UNUSED
4558 #endif
4559 )
4560 {
4561         /*
4562          * Here we must place the control on the end of the socket read
4563          * queue AND increment sb_cc so that select will work properly on
4564          * read.
4565          */
4566         struct mbuf *m, *prev = NULL;
4567
4568         if (inp == NULL) {
4569                 /* Gak, TSNH!! */
4570 #ifdef INVARIANTS
4571                 panic("Gak, inp NULL on add_to_readq");
4572 #endif
4573                 return;
4574         }
4575         if (inp_read_lock_held == 0)
4576                 SCTP_INP_READ_LOCK(inp);
4577         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
4578                 if (!control->on_strm_q) {
4579                         sctp_free_remote_addr(control->whoFrom);
4580                         if (control->data) {
4581                                 sctp_m_freem(control->data);
4582                                 control->data = NULL;
4583                         }
4584                         sctp_free_a_readq(stcb, control);
4585                 }
4586                 if (inp_read_lock_held == 0)
4587                         SCTP_INP_READ_UNLOCK(inp);
4588                 return;
4589         }
4590         if (!(control->spec_flags & M_NOTIFICATION)) {
4591                 atomic_add_int(&inp->total_recvs, 1);
4592                 if (!control->do_not_ref_stcb) {
4593                         atomic_add_int(&stcb->total_recvs, 1);
4594                 }
4595         }
4596         m = control->data;
4597         control->held_length = 0;
4598         control->length = 0;
4599         while (m) {
4600                 if (SCTP_BUF_LEN(m) == 0) {
4601                         /* Skip mbufs with NO length */
4602                         if (prev == NULL) {
4603                                 /* First one */
4604                                 control->data = sctp_m_free(m);
4605                                 m = control->data;
4606                         } else {
4607                                 SCTP_BUF_NEXT(prev) = sctp_m_free(m);
4608                                 m = SCTP_BUF_NEXT(prev);
4609                         }
4610                         if (m == NULL) {
4611                                 control->tail_mbuf = prev;
4612                         }
4613                         continue;
4614                 }
4615                 prev = m;
4616                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4617                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4618                 }
4619                 sctp_sballoc(stcb, sb, m);
4620                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4621                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4622                 }
4623                 atomic_add_int(&control->length, SCTP_BUF_LEN(m));
4624                 m = SCTP_BUF_NEXT(m);
4625         }
4626         if (prev != NULL) {
4627                 control->tail_mbuf = prev;
4628         } else {
4629                 /* Everything got collapsed out?? */
4630                 if (!control->on_strm_q) {
4631                         sctp_free_remote_addr(control->whoFrom);
4632                         sctp_free_a_readq(stcb, control);
4633                 }
4634                 if (inp_read_lock_held == 0)
4635                         SCTP_INP_READ_UNLOCK(inp);
4636                 return;
4637         }
4638         if (end) {
4639                 control->end_added = 1;
4640         }
4641         TAILQ_INSERT_TAIL(&inp->read_queue, control, next);
4642         control->on_read_q = 1;
4643         if (inp_read_lock_held == 0)
4644                 SCTP_INP_READ_UNLOCK(inp);
4645         if (inp && inp->sctp_socket) {
4646                 sctp_wakeup_the_read_socket(inp, stcb, so_locked);
4647         }
4648 }
4649
4650 /*************HOLD THIS COMMENT FOR PATCH FILE OF
4651  *************ALTERNATE ROUTING CODE
4652  */
4653
4654 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF
4655  *************ALTERNATE ROUTING CODE
4656  */
4657
4658 struct mbuf *
4659 sctp_generate_cause(uint16_t code, char *info)
4660 {
4661         struct mbuf *m;
4662         struct sctp_gen_error_cause *cause;
4663         size_t info_len;
4664         uint16_t len;
4665
4666         if ((code == 0) || (info == NULL)) {
4667                 return (NULL);
4668         }
4669         info_len = strlen(info);
4670         if (info_len > (SCTP_MAX_CAUSE_LENGTH - sizeof(struct sctp_paramhdr))) {
4671                 return (NULL);
4672         }
4673         len = (uint16_t)(sizeof(struct sctp_paramhdr) + info_len);
4674         m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
4675         if (m != NULL) {
4676                 SCTP_BUF_LEN(m) = len;
4677                 cause = mtod(m, struct sctp_gen_error_cause *);
4678                 cause->code = htons(code);
4679                 cause->length = htons(len);
4680                 memcpy(cause->info, info, info_len);
4681         }
4682         return (m);
4683 }
4684
4685 struct mbuf *
4686 sctp_generate_no_user_data_cause(uint32_t tsn)
4687 {
4688         struct mbuf *m;
4689         struct sctp_error_no_user_data *no_user_data_cause;
4690         uint16_t len;
4691
4692         len = (uint16_t)sizeof(struct sctp_error_no_user_data);
4693         m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
4694         if (m != NULL) {
4695                 SCTP_BUF_LEN(m) = len;
4696                 no_user_data_cause = mtod(m, struct sctp_error_no_user_data *);
4697                 no_user_data_cause->cause.code = htons(SCTP_CAUSE_NO_USER_DATA);
4698                 no_user_data_cause->cause.length = htons(len);
4699                 no_user_data_cause->tsn = htonl(tsn);
4700         }
4701         return (m);
4702 }
4703
4704 #ifdef SCTP_MBCNT_LOGGING
4705 void
4706 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc,
4707     struct sctp_tmit_chunk *tp1, int chk_cnt)
4708 {
4709         if (tp1->data == NULL) {
4710                 return;
4711         }
4712         asoc->chunks_on_out_queue -= chk_cnt;
4713         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBCNT_LOGGING_ENABLE) {
4714                 sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE,
4715                     asoc->total_output_queue_size,
4716                     tp1->book_size,
4717                     0,
4718                     tp1->mbcnt);
4719         }
4720         if (asoc->total_output_queue_size >= tp1->book_size) {
4721                 atomic_add_int(&asoc->total_output_queue_size, -tp1->book_size);
4722         } else {
4723                 asoc->total_output_queue_size = 0;
4724         }
4725
4726         if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) ||
4727             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) {
4728                 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) {
4729                         stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size;
4730                 } else {
4731                         stcb->sctp_socket->so_snd.sb_cc = 0;
4732
4733                 }
4734         }
4735 }
4736
4737 #endif
4738
4739 int
4740 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1,
4741     uint8_t sent, int so_locked
4742 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4743     SCTP_UNUSED
4744 #endif
4745 )
4746 {
4747         struct sctp_stream_out *strq;
4748         struct sctp_tmit_chunk *chk = NULL, *tp2;
4749         struct sctp_stream_queue_pending *sp;
4750         uint32_t mid;
4751         uint16_t sid;
4752         uint8_t foundeom = 0;
4753         int ret_sz = 0;
4754         int notdone;
4755         int do_wakeup_routine = 0;
4756
4757         sid = tp1->rec.data.sid;
4758         mid = tp1->rec.data.mid;
4759         if (sent || !(tp1->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG)) {
4760                 stcb->asoc.abandoned_sent[0]++;
4761                 stcb->asoc.abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
4762                 stcb->asoc.strmout[sid].abandoned_sent[0]++;
4763 #if defined(SCTP_DETAILED_STR_STATS)
4764                 stcb->asoc.strmout[sid].abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
4765 #endif
4766         } else {
4767                 stcb->asoc.abandoned_unsent[0]++;
4768                 stcb->asoc.abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
4769                 stcb->asoc.strmout[sid].abandoned_unsent[0]++;
4770 #if defined(SCTP_DETAILED_STR_STATS)
4771                 stcb->asoc.strmout[sid].abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
4772 #endif
4773         }
4774         do {
4775                 ret_sz += tp1->book_size;
4776                 if (tp1->data != NULL) {
4777                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4778                                 sctp_flight_size_decrease(tp1);
4779                                 sctp_total_flight_decrease(stcb, tp1);
4780                         }
4781                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4782                         stcb->asoc.peers_rwnd += tp1->send_size;
4783                         stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh);
4784                         if (sent) {
4785                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
4786                         } else {
4787                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
4788                         }
4789                         if (tp1->data) {
4790                                 sctp_m_freem(tp1->data);
4791                                 tp1->data = NULL;
4792                         }
4793                         do_wakeup_routine = 1;
4794                         if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
4795                                 stcb->asoc.sent_queue_cnt_removeable--;
4796                         }
4797                 }
4798                 tp1->sent = SCTP_FORWARD_TSN_SKIP;
4799                 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
4800                     SCTP_DATA_NOT_FRAG) {
4801                         /* not frag'ed we ae done   */
4802                         notdone = 0;
4803                         foundeom = 1;
4804                 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4805                         /* end of frag, we are done */
4806                         notdone = 0;
4807                         foundeom = 1;
4808                 } else {
4809                         /*
4810                          * Its a begin or middle piece, we must mark all of
4811                          * it
4812                          */
4813                         notdone = 1;
4814                         tp1 = TAILQ_NEXT(tp1, sctp_next);
4815                 }
4816         } while (tp1 && notdone);
4817         if (foundeom == 0) {
4818                 /*
4819                  * The multi-part message was scattered across the send and
4820                  * sent queue.
4821                  */
4822                 TAILQ_FOREACH_SAFE(tp1, &stcb->asoc.send_queue, sctp_next, tp2) {
4823                         if ((tp1->rec.data.sid != sid) ||
4824                             (!SCTP_MID_EQ(stcb->asoc.idata_supported, tp1->rec.data.mid, mid))) {
4825                                 break;
4826                         }
4827                         /*
4828                          * save to chk in case we have some on stream out
4829                          * queue. If so and we have an un-transmitted one we
4830                          * don't have to fudge the TSN.
4831                          */
4832                         chk = tp1;
4833                         ret_sz += tp1->book_size;
4834                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4835                         if (sent) {
4836                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
4837                         } else {
4838                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
4839                         }
4840                         if (tp1->data) {
4841                                 sctp_m_freem(tp1->data);
4842                                 tp1->data = NULL;
4843                         }
4844                         /* No flight involved here book the size to 0 */
4845                         tp1->book_size = 0;
4846                         if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4847                                 foundeom = 1;
4848                         }
4849                         do_wakeup_routine = 1;
4850                         tp1->sent = SCTP_FORWARD_TSN_SKIP;
4851                         TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next);
4852                         /*
4853                          * on to the sent queue so we can wait for it to be
4854                          * passed by.
4855                          */
4856                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1,
4857                             sctp_next);
4858                         stcb->asoc.send_queue_cnt--;
4859                         stcb->asoc.sent_queue_cnt++;
4860                 }
4861         }
4862         if (foundeom == 0) {
4863                 /*
4864                  * Still no eom found. That means there is stuff left on the
4865                  * stream out queue.. yuck.
4866                  */
4867                 SCTP_TCB_SEND_LOCK(stcb);
4868                 strq = &stcb->asoc.strmout[sid];
4869                 sp = TAILQ_FIRST(&strq->outqueue);
4870                 if (sp != NULL) {
4871                         sp->discard_rest = 1;
4872                         /*
4873                          * We may need to put a chunk on the queue that
4874                          * holds the TSN that would have been sent with the
4875                          * LAST bit.
4876                          */
4877                         if (chk == NULL) {
4878                                 /* Yep, we have to */
4879                                 sctp_alloc_a_chunk(stcb, chk);
4880                                 if (chk == NULL) {
4881                                         /*
4882                                          * we are hosed. All we can do is
4883                                          * nothing.. which will cause an
4884                                          * abort if the peer is paying
4885                                          * attention.
4886                                          */
4887                                         goto oh_well;
4888                                 }
4889                                 memset(chk, 0, sizeof(*chk));
4890                                 chk->rec.data.rcv_flags = 0;
4891                                 chk->sent = SCTP_FORWARD_TSN_SKIP;
4892                                 chk->asoc = &stcb->asoc;
4893                                 if (stcb->asoc.idata_supported == 0) {
4894                                         if (sp->sinfo_flags & SCTP_UNORDERED) {
4895                                                 chk->rec.data.mid = 0;
4896                                         } else {
4897                                                 chk->rec.data.mid = strq->next_mid_ordered;
4898                                         }
4899                                 } else {
4900                                         if (sp->sinfo_flags & SCTP_UNORDERED) {
4901                                                 chk->rec.data.mid = strq->next_mid_unordered;
4902                                         } else {
4903                                                 chk->rec.data.mid = strq->next_mid_ordered;
4904                                         }
4905                                 }
4906                                 chk->rec.data.sid = sp->sid;
4907                                 chk->rec.data.ppid = sp->ppid;
4908                                 chk->rec.data.context = sp->context;
4909                                 chk->flags = sp->act_flags;
4910                                 chk->whoTo = NULL;
4911                                 chk->rec.data.tsn = atomic_fetchadd_int(&stcb->asoc.sending_seq, 1);
4912                                 strq->chunks_on_queues++;
4913                                 TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, chk, sctp_next);
4914                                 stcb->asoc.sent_queue_cnt++;
4915                                 stcb->asoc.pr_sctp_cnt++;
4916                         }
4917                         chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
4918                         if (sp->sinfo_flags & SCTP_UNORDERED) {
4919                                 chk->rec.data.rcv_flags |= SCTP_DATA_UNORDERED;
4920                         }
4921                         if (stcb->asoc.idata_supported == 0) {
4922                                 if ((sp->sinfo_flags & SCTP_UNORDERED) == 0) {
4923                                         strq->next_mid_ordered++;
4924                                 }
4925                         } else {
4926                                 if (sp->sinfo_flags & SCTP_UNORDERED) {
4927                                         strq->next_mid_unordered++;
4928                                 } else {
4929                                         strq->next_mid_ordered++;
4930                                 }
4931                         }
4932         oh_well:
4933                         if (sp->data) {
4934                                 /*
4935                                  * Pull any data to free up the SB and allow
4936                                  * sender to "add more" while we will throw
4937                                  * away :-)
4938                                  */
4939                                 sctp_free_spbufspace(stcb, &stcb->asoc, sp);
4940                                 ret_sz += sp->length;
4941                                 do_wakeup_routine = 1;
4942                                 sp->some_taken = 1;
4943                                 sctp_m_freem(sp->data);
4944                                 sp->data = NULL;
4945                                 sp->tail_mbuf = NULL;
4946                                 sp->length = 0;
4947                         }
4948                 }
4949                 SCTP_TCB_SEND_UNLOCK(stcb);
4950         }
4951         if (do_wakeup_routine) {
4952 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4953                 struct socket *so;
4954
4955                 so = SCTP_INP_SO(stcb->sctp_ep);
4956                 if (!so_locked) {
4957                         atomic_add_int(&stcb->asoc.refcnt, 1);
4958                         SCTP_TCB_UNLOCK(stcb);
4959                         SCTP_SOCKET_LOCK(so, 1);
4960                         SCTP_TCB_LOCK(stcb);
4961                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
4962                         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
4963                                 /* assoc was freed while we were unlocked */
4964                                 SCTP_SOCKET_UNLOCK(so, 1);
4965                                 return (ret_sz);
4966                         }
4967                 }
4968 #endif
4969                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
4970 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4971                 if (!so_locked) {
4972                         SCTP_SOCKET_UNLOCK(so, 1);
4973                 }
4974 #endif
4975         }
4976         return (ret_sz);
4977 }
4978
4979 /*
4980  * checks to see if the given address, sa, is one that is currently known by
4981  * the kernel note: can't distinguish the same address on multiple interfaces
4982  * and doesn't handle multiple addresses with different zone/scope id's note:
4983  * ifa_ifwithaddr() compares the entire sockaddr struct
4984  */
4985 struct sctp_ifa *
4986 sctp_find_ifa_in_ep(struct sctp_inpcb *inp, struct sockaddr *addr,
4987     int holds_lock)
4988 {
4989         struct sctp_laddr *laddr;
4990
4991         if (holds_lock == 0) {
4992                 SCTP_INP_RLOCK(inp);
4993         }
4994
4995         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
4996                 if (laddr->ifa == NULL)
4997                         continue;
4998                 if (addr->sa_family != laddr->ifa->address.sa.sa_family)
4999                         continue;
5000 #ifdef INET
5001                 if (addr->sa_family == AF_INET) {
5002                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
5003                             laddr->ifa->address.sin.sin_addr.s_addr) {
5004                                 /* found him. */
5005                                 if (holds_lock == 0) {
5006                                         SCTP_INP_RUNLOCK(inp);
5007                                 }
5008                                 return (laddr->ifa);
5009                                 break;
5010                         }
5011                 }
5012 #endif
5013 #ifdef INET6
5014                 if (addr->sa_family == AF_INET6) {
5015                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5016                             &laddr->ifa->address.sin6)) {
5017                                 /* found him. */
5018                                 if (holds_lock == 0) {
5019                                         SCTP_INP_RUNLOCK(inp);
5020                                 }
5021                                 return (laddr->ifa);
5022                                 break;
5023                         }
5024                 }
5025 #endif
5026         }
5027         if (holds_lock == 0) {
5028                 SCTP_INP_RUNLOCK(inp);
5029         }
5030         return (NULL);
5031 }
5032
5033 uint32_t
5034 sctp_get_ifa_hash_val(struct sockaddr *addr)
5035 {
5036         switch (addr->sa_family) {
5037 #ifdef INET
5038         case AF_INET:
5039                 {
5040                         struct sockaddr_in *sin;
5041
5042                         sin = (struct sockaddr_in *)addr;
5043                         return (sin->sin_addr.s_addr ^ (sin->sin_addr.s_addr >> 16));
5044                 }
5045 #endif
5046 #ifdef INET6
5047         case AF_INET6:
5048                 {
5049                         struct sockaddr_in6 *sin6;
5050                         uint32_t hash_of_addr;
5051
5052                         sin6 = (struct sockaddr_in6 *)addr;
5053                         hash_of_addr = (sin6->sin6_addr.s6_addr32[0] +
5054                             sin6->sin6_addr.s6_addr32[1] +
5055                             sin6->sin6_addr.s6_addr32[2] +
5056                             sin6->sin6_addr.s6_addr32[3]);
5057                         hash_of_addr = (hash_of_addr ^ (hash_of_addr >> 16));
5058                         return (hash_of_addr);
5059                 }
5060 #endif
5061         default:
5062                 break;
5063         }
5064         return (0);
5065 }
5066
5067 struct sctp_ifa *
5068 sctp_find_ifa_by_addr(struct sockaddr *addr, uint32_t vrf_id, int holds_lock)
5069 {
5070         struct sctp_ifa *sctp_ifap;
5071         struct sctp_vrf *vrf;
5072         struct sctp_ifalist *hash_head;
5073         uint32_t hash_of_addr;
5074
5075         if (holds_lock == 0)
5076                 SCTP_IPI_ADDR_RLOCK();
5077
5078         vrf = sctp_find_vrf(vrf_id);
5079         if (vrf == NULL) {
5080                 if (holds_lock == 0)
5081                         SCTP_IPI_ADDR_RUNLOCK();
5082                 return (NULL);
5083         }
5084
5085         hash_of_addr = sctp_get_ifa_hash_val(addr);
5086
5087         hash_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)];
5088         if (hash_head == NULL) {
5089                 SCTP_PRINTF("hash_of_addr:%x mask:%x table:%x - ",
5090                     hash_of_addr, (uint32_t)vrf->vrf_addr_hashmark,
5091                     (uint32_t)(hash_of_addr & vrf->vrf_addr_hashmark));
5092                 sctp_print_address(addr);
5093                 SCTP_PRINTF("No such bucket for address\n");
5094                 if (holds_lock == 0)
5095                         SCTP_IPI_ADDR_RUNLOCK();
5096
5097                 return (NULL);
5098         }
5099         LIST_FOREACH(sctp_ifap, hash_head, next_bucket) {
5100                 if (addr->sa_family != sctp_ifap->address.sa.sa_family)
5101                         continue;
5102 #ifdef INET
5103                 if (addr->sa_family == AF_INET) {
5104                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
5105                             sctp_ifap->address.sin.sin_addr.s_addr) {
5106                                 /* found him. */
5107                                 if (holds_lock == 0)
5108                                         SCTP_IPI_ADDR_RUNLOCK();
5109                                 return (sctp_ifap);
5110                                 break;
5111                         }
5112                 }
5113 #endif
5114 #ifdef INET6
5115                 if (addr->sa_family == AF_INET6) {
5116                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5117                             &sctp_ifap->address.sin6)) {
5118                                 /* found him. */
5119                                 if (holds_lock == 0)
5120                                         SCTP_IPI_ADDR_RUNLOCK();
5121                                 return (sctp_ifap);
5122                                 break;
5123                         }
5124                 }
5125 #endif
5126         }
5127         if (holds_lock == 0)
5128                 SCTP_IPI_ADDR_RUNLOCK();
5129         return (NULL);
5130 }
5131
5132 static void
5133 sctp_user_rcvd(struct sctp_tcb *stcb, uint32_t *freed_so_far, int hold_rlock,
5134     uint32_t rwnd_req)
5135 {
5136         /* User pulled some data, do we need a rwnd update? */
5137         int r_unlocked = 0;
5138         uint32_t dif, rwnd;
5139         struct socket *so = NULL;
5140
5141         if (stcb == NULL)
5142                 return;
5143
5144         atomic_add_int(&stcb->asoc.refcnt, 1);
5145
5146         if ((SCTP_GET_STATE(stcb) == SCTP_STATE_SHUTDOWN_ACK_SENT) ||
5147             (stcb->asoc.state & (SCTP_STATE_ABOUT_TO_BE_FREED | SCTP_STATE_SHUTDOWN_RECEIVED))) {
5148                 /* Pre-check If we are freeing no update */
5149                 goto no_lock;
5150         }
5151         SCTP_INP_INCR_REF(stcb->sctp_ep);
5152         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5153             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5154                 goto out;
5155         }
5156         so = stcb->sctp_socket;
5157         if (so == NULL) {
5158                 goto out;
5159         }
5160         atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far);
5161         /* Have you have freed enough to look */
5162         *freed_so_far = 0;
5163         /* Yep, its worth a look and the lock overhead */
5164
5165         /* Figure out what the rwnd would be */
5166         rwnd = sctp_calc_rwnd(stcb, &stcb->asoc);
5167         if (rwnd >= stcb->asoc.my_last_reported_rwnd) {
5168                 dif = rwnd - stcb->asoc.my_last_reported_rwnd;
5169         } else {
5170                 dif = 0;
5171         }
5172         if (dif >= rwnd_req) {
5173                 if (hold_rlock) {
5174                         SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5175                         r_unlocked = 1;
5176                 }
5177                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5178                         /*
5179                          * One last check before we allow the guy possibly
5180                          * to get in. There is a race, where the guy has not
5181                          * reached the gate. In that case
5182                          */
5183                         goto out;
5184                 }
5185                 SCTP_TCB_LOCK(stcb);
5186                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5187                         /* No reports here */
5188                         SCTP_TCB_UNLOCK(stcb);
5189                         goto out;
5190                 }
5191                 SCTP_STAT_INCR(sctps_wu_sacks_sent);
5192                 sctp_send_sack(stcb, SCTP_SO_LOCKED);
5193
5194                 sctp_chunk_output(stcb->sctp_ep, stcb,
5195                     SCTP_OUTPUT_FROM_USR_RCVD, SCTP_SO_LOCKED);
5196                 /* make sure no timer is running */
5197                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL,
5198                     SCTP_FROM_SCTPUTIL + SCTP_LOC_6);
5199                 SCTP_TCB_UNLOCK(stcb);
5200         } else {
5201                 /* Update how much we have pending */
5202                 stcb->freed_by_sorcv_sincelast = dif;
5203         }
5204 out:
5205         if (so && r_unlocked && hold_rlock) {
5206                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
5207         }
5208
5209         SCTP_INP_DECR_REF(stcb->sctp_ep);
5210 no_lock:
5211         atomic_add_int(&stcb->asoc.refcnt, -1);
5212         return;
5213 }
5214
5215 int
5216 sctp_sorecvmsg(struct socket *so,
5217     struct uio *uio,
5218     struct mbuf **mp,
5219     struct sockaddr *from,
5220     int fromlen,
5221     int *msg_flags,
5222     struct sctp_sndrcvinfo *sinfo,
5223     int filling_sinfo)
5224 {
5225         /*
5226          * MSG flags we will look at MSG_DONTWAIT - non-blocking IO.
5227          * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy
5228          * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ??
5229          * On the way out we may send out any combination of:
5230          * MSG_NOTIFICATION MSG_EOR
5231          *
5232          */
5233         struct sctp_inpcb *inp = NULL;
5234         ssize_t my_len = 0;
5235         ssize_t cp_len = 0;
5236         int error = 0;
5237         struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
5238         struct mbuf *m = NULL;
5239         struct sctp_tcb *stcb = NULL;
5240         int wakeup_read_socket = 0;
5241         int freecnt_applied = 0;
5242         int out_flags = 0, in_flags = 0;
5243         int block_allowed = 1;
5244         uint32_t freed_so_far = 0;
5245         ssize_t copied_so_far = 0;
5246         int in_eeor_mode = 0;
5247         int no_rcv_needed = 0;
5248         uint32_t rwnd_req = 0;
5249         int hold_sblock = 0;
5250         int hold_rlock = 0;
5251         ssize_t slen = 0;
5252         uint32_t held_length = 0;
5253         int sockbuf_lock = 0;
5254
5255         if (uio == NULL) {
5256                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5257                 return (EINVAL);
5258         }
5259
5260         if (msg_flags) {
5261                 in_flags = *msg_flags;
5262                 if (in_flags & MSG_PEEK)
5263                         SCTP_STAT_INCR(sctps_read_peeks);
5264         } else {
5265                 in_flags = 0;
5266         }
5267         slen = uio->uio_resid;
5268
5269         /* Pull in and set up our int flags */
5270         if (in_flags & MSG_OOB) {
5271                 /* Out of band's NOT supported */
5272                 return (EOPNOTSUPP);
5273         }
5274         if ((in_flags & MSG_PEEK) && (mp != NULL)) {
5275                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5276                 return (EINVAL);
5277         }
5278         if ((in_flags & (MSG_DONTWAIT
5279             | MSG_NBIO
5280             )) ||
5281             SCTP_SO_IS_NBIO(so)) {
5282                 block_allowed = 0;
5283         }
5284         /* setup the endpoint */
5285         inp = (struct sctp_inpcb *)so->so_pcb;
5286         if (inp == NULL) {
5287                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
5288                 return (EFAULT);
5289         }
5290         rwnd_req = (SCTP_SB_LIMIT_RCV(so) >> SCTP_RWND_HIWAT_SHIFT);
5291         /* Must be at least a MTU's worth */
5292         if (rwnd_req < SCTP_MIN_RWND)
5293                 rwnd_req = SCTP_MIN_RWND;
5294         in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
5295         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5296                 sctp_misc_ints(SCTP_SORECV_ENTER,
5297                     rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, (uint32_t)uio->uio_resid);
5298         }
5299         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5300                 sctp_misc_ints(SCTP_SORECV_ENTERPL,
5301                     rwnd_req, block_allowed, so->so_rcv.sb_cc, (uint32_t)uio->uio_resid);
5302         }
5303
5304
5305         error = sblock(&so->so_rcv, (block_allowed ? SBL_WAIT : 0));
5306         if (error) {
5307                 goto release_unlocked;
5308         }
5309         sockbuf_lock = 1;
5310 restart:
5311
5312
5313 restart_nosblocks:
5314         if (hold_sblock == 0) {
5315                 SOCKBUF_LOCK(&so->so_rcv);
5316                 hold_sblock = 1;
5317         }
5318         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5319             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5320                 goto out;
5321         }
5322         if ((so->so_rcv.sb_state & SBS_CANTRCVMORE) && (so->so_rcv.sb_cc == 0)) {
5323                 if (so->so_error) {
5324                         error = so->so_error;
5325                         if ((in_flags & MSG_PEEK) == 0)
5326                                 so->so_error = 0;
5327                         goto out;
5328                 } else {
5329                         if (so->so_rcv.sb_cc == 0) {
5330                                 /* indicate EOF */
5331                                 error = 0;
5332                                 goto out;
5333                         }
5334                 }
5335         }
5336         if (so->so_rcv.sb_cc <= held_length) {
5337                 if (so->so_error) {
5338                         error = so->so_error;
5339                         if ((in_flags & MSG_PEEK) == 0) {
5340                                 so->so_error = 0;
5341                         }
5342                         goto out;
5343                 }
5344                 if ((so->so_rcv.sb_cc == 0) &&
5345                     ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5346                     (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) {
5347                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5348                                 /*
5349                                  * For active open side clear flags for
5350                                  * re-use passive open is blocked by
5351                                  * connect.
5352                                  */
5353                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5354                                         /*
5355                                          * You were aborted, passive side
5356                                          * always hits here
5357                                          */
5358                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5359                                         error = ECONNRESET;
5360                                 }
5361                                 so->so_state &= ~(SS_ISCONNECTING |
5362                                     SS_ISDISCONNECTING |
5363                                     SS_ISCONFIRMING |
5364                                     SS_ISCONNECTED);
5365                                 if (error == 0) {
5366                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5367                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5368                                                 error = ENOTCONN;
5369                                         }
5370                                 }
5371                                 goto out;
5372                         }
5373                 }
5374                 if (block_allowed) {
5375                         error = sbwait(&so->so_rcv);
5376                         if (error) {
5377                                 goto out;
5378                         }
5379                         held_length = 0;
5380                         goto restart_nosblocks;
5381                 } else {
5382                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EWOULDBLOCK);
5383                         error = EWOULDBLOCK;
5384                         goto out;
5385                 }
5386         }
5387         if (hold_sblock == 1) {
5388                 SOCKBUF_UNLOCK(&so->so_rcv);
5389                 hold_sblock = 0;
5390         }
5391         /* we possibly have data we can read */
5392         /* sa_ignore FREED_MEMORY */
5393         control = TAILQ_FIRST(&inp->read_queue);
5394         if (control == NULL) {
5395                 /*
5396                  * This could be happening since the appender did the
5397                  * increment but as not yet did the tailq insert onto the
5398                  * read_queue
5399                  */
5400                 if (hold_rlock == 0) {
5401                         SCTP_INP_READ_LOCK(inp);
5402                 }
5403                 control = TAILQ_FIRST(&inp->read_queue);
5404                 if ((control == NULL) && (so->so_rcv.sb_cc != 0)) {
5405 #ifdef INVARIANTS
5406                         panic("Huh, its non zero and nothing on control?");
5407 #endif
5408                         so->so_rcv.sb_cc = 0;
5409                 }
5410                 SCTP_INP_READ_UNLOCK(inp);
5411                 hold_rlock = 0;
5412                 goto restart;
5413         }
5414
5415         if ((control->length == 0) &&
5416             (control->do_not_ref_stcb)) {
5417                 /*
5418                  * Clean up code for freeing assoc that left behind a
5419                  * pdapi.. maybe a peer in EEOR that just closed after
5420                  * sending and never indicated a EOR.
5421                  */
5422                 if (hold_rlock == 0) {
5423                         hold_rlock = 1;
5424                         SCTP_INP_READ_LOCK(inp);
5425                 }
5426                 control->held_length = 0;
5427                 if (control->data) {
5428                         /* Hmm there is data here .. fix */
5429                         struct mbuf *m_tmp;
5430                         int cnt = 0;
5431
5432                         m_tmp = control->data;
5433                         while (m_tmp) {
5434                                 cnt += SCTP_BUF_LEN(m_tmp);
5435                                 if (SCTP_BUF_NEXT(m_tmp) == NULL) {
5436                                         control->tail_mbuf = m_tmp;
5437                                         control->end_added = 1;
5438                                 }
5439                                 m_tmp = SCTP_BUF_NEXT(m_tmp);
5440                         }
5441                         control->length = cnt;
5442                 } else {
5443                         /* remove it */
5444                         TAILQ_REMOVE(&inp->read_queue, control, next);
5445                         /* Add back any hiddend data */
5446                         sctp_free_remote_addr(control->whoFrom);
5447                         sctp_free_a_readq(stcb, control);
5448                 }
5449                 if (hold_rlock) {
5450                         hold_rlock = 0;
5451                         SCTP_INP_READ_UNLOCK(inp);
5452                 }
5453                 goto restart;
5454         }
5455         if ((control->length == 0) &&
5456             (control->end_added == 1)) {
5457                 /*
5458                  * Do we also need to check for (control->pdapi_aborted ==
5459                  * 1)?
5460                  */
5461                 if (hold_rlock == 0) {
5462                         hold_rlock = 1;
5463                         SCTP_INP_READ_LOCK(inp);
5464                 }
5465                 TAILQ_REMOVE(&inp->read_queue, control, next);
5466                 if (control->data) {
5467 #ifdef INVARIANTS
5468                         panic("control->data not null but control->length == 0");
5469 #else
5470                         SCTP_PRINTF("Strange, data left in the control buffer. Cleaning up.\n");
5471                         sctp_m_freem(control->data);
5472                         control->data = NULL;
5473 #endif
5474                 }
5475                 if (control->aux_data) {
5476                         sctp_m_free(control->aux_data);
5477                         control->aux_data = NULL;
5478                 }
5479 #ifdef INVARIANTS
5480                 if (control->on_strm_q) {
5481                         panic("About to free ctl:%p so:%p and its in %d",
5482                             control, so, control->on_strm_q);
5483                 }
5484 #endif
5485                 sctp_free_remote_addr(control->whoFrom);
5486                 sctp_free_a_readq(stcb, control);
5487                 if (hold_rlock) {
5488                         hold_rlock = 0;
5489                         SCTP_INP_READ_UNLOCK(inp);
5490                 }
5491                 goto restart;
5492         }
5493         if (control->length == 0) {
5494                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) &&
5495                     (filling_sinfo)) {
5496                         /* find a more suitable one then this */
5497                         ctl = TAILQ_NEXT(control, next);
5498                         while (ctl) {
5499                                 if ((ctl->stcb != control->stcb) && (ctl->length) &&
5500                                     (ctl->some_taken ||
5501                                     (ctl->spec_flags & M_NOTIFICATION) ||
5502                                     ((ctl->do_not_ref_stcb == 0) &&
5503                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))
5504                                     ) {
5505                                         /*-
5506                                          * If we have a different TCB next, and there is data
5507                                          * present. If we have already taken some (pdapi), OR we can
5508                                          * ref the tcb and no delivery as started on this stream, we
5509                                          * take it. Note we allow a notification on a different
5510                                          * assoc to be delivered..
5511                                          */
5512                                         control = ctl;
5513                                         goto found_one;
5514                                 } else if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS)) &&
5515                                             (ctl->length) &&
5516                                             ((ctl->some_taken) ||
5517                                             ((ctl->do_not_ref_stcb == 0) &&
5518                                             ((ctl->spec_flags & M_NOTIFICATION) == 0) &&
5519                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))) {
5520                                         /*-
5521                                          * If we have the same tcb, and there is data present, and we
5522                                          * have the strm interleave feature present. Then if we have
5523                                          * taken some (pdapi) or we can refer to tht tcb AND we have
5524                                          * not started a delivery for this stream, we can take it.
5525                                          * Note we do NOT allow a notificaiton on the same assoc to
5526                                          * be delivered.
5527                                          */
5528                                         control = ctl;
5529                                         goto found_one;
5530                                 }
5531                                 ctl = TAILQ_NEXT(ctl, next);
5532                         }
5533                 }
5534                 /*
5535                  * if we reach here, not suitable replacement is available
5536                  * <or> fragment interleave is NOT on. So stuff the sb_cc
5537                  * into the our held count, and its time to sleep again.
5538                  */
5539                 held_length = so->so_rcv.sb_cc;
5540                 control->held_length = so->so_rcv.sb_cc;
5541                 goto restart;
5542         }
5543         /* Clear the held length since there is something to read */
5544         control->held_length = 0;
5545 found_one:
5546         /*
5547          * If we reach here, control has a some data for us to read off.
5548          * Note that stcb COULD be NULL.
5549          */
5550         if (hold_rlock == 0) {
5551                 hold_rlock = 1;
5552                 SCTP_INP_READ_LOCK(inp);
5553         }
5554         control->some_taken++;
5555         stcb = control->stcb;
5556         if (stcb) {
5557                 if ((control->do_not_ref_stcb == 0) &&
5558                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5559                         if (freecnt_applied == 0)
5560                                 stcb = NULL;
5561                 } else if (control->do_not_ref_stcb == 0) {
5562                         /* you can't free it on me please */
5563                         /*
5564                          * The lock on the socket buffer protects us so the
5565                          * free code will stop. But since we used the
5566                          * socketbuf lock and the sender uses the tcb_lock
5567                          * to increment, we need to use the atomic add to
5568                          * the refcnt
5569                          */
5570                         if (freecnt_applied) {
5571 #ifdef INVARIANTS
5572                                 panic("refcnt already incremented");
5573 #else
5574                                 SCTP_PRINTF("refcnt already incremented?\n");
5575 #endif
5576                         } else {
5577                                 atomic_add_int(&stcb->asoc.refcnt, 1);
5578                                 freecnt_applied = 1;
5579                         }
5580                         /*
5581                          * Setup to remember how much we have not yet told
5582                          * the peer our rwnd has opened up. Note we grab the
5583                          * value from the tcb from last time. Note too that
5584                          * sack sending clears this when a sack is sent,
5585                          * which is fine. Once we hit the rwnd_req, we then
5586                          * will go to the sctp_user_rcvd() that will not
5587                          * lock until it KNOWs it MUST send a WUP-SACK.
5588                          */
5589                         freed_so_far = (uint32_t)stcb->freed_by_sorcv_sincelast;
5590                         stcb->freed_by_sorcv_sincelast = 0;
5591                 }
5592         }
5593         if (stcb &&
5594             ((control->spec_flags & M_NOTIFICATION) == 0) &&
5595             control->do_not_ref_stcb == 0) {
5596                 stcb->asoc.strmin[control->sinfo_stream].delivery_started = 1;
5597         }
5598
5599         /* First lets get off the sinfo and sockaddr info */
5600         if ((sinfo != NULL) && (filling_sinfo != 0)) {
5601                 sinfo->sinfo_stream = control->sinfo_stream;
5602                 sinfo->sinfo_ssn = (uint16_t)control->mid;
5603                 sinfo->sinfo_flags = control->sinfo_flags;
5604                 sinfo->sinfo_ppid = control->sinfo_ppid;
5605                 sinfo->sinfo_context = control->sinfo_context;
5606                 sinfo->sinfo_timetolive = control->sinfo_timetolive;
5607                 sinfo->sinfo_tsn = control->sinfo_tsn;
5608                 sinfo->sinfo_cumtsn = control->sinfo_cumtsn;
5609                 sinfo->sinfo_assoc_id = control->sinfo_assoc_id;
5610                 nxt = TAILQ_NEXT(control, next);
5611                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
5612                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) {
5613                         struct sctp_extrcvinfo *s_extra;
5614
5615                         s_extra = (struct sctp_extrcvinfo *)sinfo;
5616                         if ((nxt) &&
5617                             (nxt->length)) {
5618                                 s_extra->serinfo_next_flags = SCTP_NEXT_MSG_AVAIL;
5619                                 if (nxt->sinfo_flags & SCTP_UNORDERED) {
5620                                         s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_UNORDERED;
5621                                 }
5622                                 if (nxt->spec_flags & M_NOTIFICATION) {
5623                                         s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_NOTIFICATION;
5624                                 }
5625                                 s_extra->serinfo_next_aid = nxt->sinfo_assoc_id;
5626                                 s_extra->serinfo_next_length = nxt->length;
5627                                 s_extra->serinfo_next_ppid = nxt->sinfo_ppid;
5628                                 s_extra->serinfo_next_stream = nxt->sinfo_stream;
5629                                 if (nxt->tail_mbuf != NULL) {
5630                                         if (nxt->end_added) {
5631                                                 s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_ISCOMPLETE;
5632                                         }
5633                                 }
5634                         } else {
5635                                 /*
5636                                  * we explicitly 0 this, since the memcpy
5637                                  * got some other things beyond the older
5638                                  * sinfo_ that is on the control's structure
5639                                  * :-D
5640                                  */
5641                                 nxt = NULL;
5642                                 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG;
5643                                 s_extra->serinfo_next_aid = 0;
5644                                 s_extra->serinfo_next_length = 0;
5645                                 s_extra->serinfo_next_ppid = 0;
5646                                 s_extra->serinfo_next_stream = 0;
5647                         }
5648                 }
5649                 /*
5650                  * update off the real current cum-ack, if we have an stcb.
5651                  */
5652                 if ((control->do_not_ref_stcb == 0) && stcb)
5653                         sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
5654                 /*
5655                  * mask off the high bits, we keep the actual chunk bits in
5656                  * there.
5657                  */
5658                 sinfo->sinfo_flags &= 0x00ff;
5659                 if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) {
5660                         sinfo->sinfo_flags |= SCTP_UNORDERED;
5661                 }
5662         }
5663 #ifdef SCTP_ASOCLOG_OF_TSNS
5664         {
5665                 int index, newindex;
5666                 struct sctp_pcbtsn_rlog *entry;
5667
5668                 do {
5669                         index = inp->readlog_index;
5670                         newindex = index + 1;
5671                         if (newindex >= SCTP_READ_LOG_SIZE) {
5672                                 newindex = 0;
5673                         }
5674                 } while (atomic_cmpset_int(&inp->readlog_index, index, newindex) == 0);
5675                 entry = &inp->readlog[index];
5676                 entry->vtag = control->sinfo_assoc_id;
5677                 entry->strm = control->sinfo_stream;
5678                 entry->seq = (uint16_t)control->mid;
5679                 entry->sz = control->length;
5680                 entry->flgs = control->sinfo_flags;
5681         }
5682 #endif
5683         if ((fromlen > 0) && (from != NULL)) {
5684                 union sctp_sockstore store;
5685                 size_t len;
5686
5687                 switch (control->whoFrom->ro._l_addr.sa.sa_family) {
5688 #ifdef INET6
5689                 case AF_INET6:
5690                         len = sizeof(struct sockaddr_in6);
5691                         store.sin6 = control->whoFrom->ro._l_addr.sin6;
5692                         store.sin6.sin6_port = control->port_from;
5693                         break;
5694 #endif
5695 #ifdef INET
5696                 case AF_INET:
5697 #ifdef INET6
5698                         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
5699                                 len = sizeof(struct sockaddr_in6);
5700                                 in6_sin_2_v4mapsin6(&control->whoFrom->ro._l_addr.sin,
5701                                     &store.sin6);
5702                                 store.sin6.sin6_port = control->port_from;
5703                         } else {
5704                                 len = sizeof(struct sockaddr_in);
5705                                 store.sin = control->whoFrom->ro._l_addr.sin;
5706                                 store.sin.sin_port = control->port_from;
5707                         }
5708 #else
5709                         len = sizeof(struct sockaddr_in);
5710                         store.sin = control->whoFrom->ro._l_addr.sin;
5711                         store.sin.sin_port = control->port_from;
5712 #endif
5713                         break;
5714 #endif
5715                 default:
5716                         len = 0;
5717                         break;
5718                 }
5719                 memcpy(from, &store, min((size_t)fromlen, len));
5720 #ifdef INET6
5721                 {
5722                         struct sockaddr_in6 lsa6, *from6;
5723
5724                         from6 = (struct sockaddr_in6 *)from;
5725                         sctp_recover_scope_mac(from6, (&lsa6));
5726                 }
5727 #endif
5728         }
5729         if (hold_rlock) {
5730                 SCTP_INP_READ_UNLOCK(inp);
5731                 hold_rlock = 0;
5732         }
5733         if (hold_sblock) {
5734                 SOCKBUF_UNLOCK(&so->so_rcv);
5735                 hold_sblock = 0;
5736         }
5737         /* now copy out what data we can */
5738         if (mp == NULL) {
5739                 /* copy out each mbuf in the chain up to length */
5740 get_more_data:
5741                 m = control->data;
5742                 while (m) {
5743                         /* Move out all we can */
5744                         cp_len = uio->uio_resid;
5745                         my_len = SCTP_BUF_LEN(m);
5746                         if (cp_len > my_len) {
5747                                 /* not enough in this buf */
5748                                 cp_len = my_len;
5749                         }
5750                         if (hold_rlock) {
5751                                 SCTP_INP_READ_UNLOCK(inp);
5752                                 hold_rlock = 0;
5753                         }
5754                         if (cp_len > 0)
5755                                 error = uiomove(mtod(m, char *), (int)cp_len, uio);
5756                         /* re-read */
5757                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5758                                 goto release;
5759                         }
5760
5761                         if ((control->do_not_ref_stcb == 0) && stcb &&
5762                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5763                                 no_rcv_needed = 1;
5764                         }
5765                         if (error) {
5766                                 /* error we are out of here */
5767                                 goto release;
5768                         }
5769                         SCTP_INP_READ_LOCK(inp);
5770                         hold_rlock = 1;
5771                         if (cp_len == SCTP_BUF_LEN(m)) {
5772                                 if ((SCTP_BUF_NEXT(m) == NULL) &&
5773                                     (control->end_added)) {
5774                                         out_flags |= MSG_EOR;
5775                                         if ((control->do_not_ref_stcb == 0) &&
5776                                             (control->stcb != NULL) &&
5777                                             ((control->spec_flags & M_NOTIFICATION) == 0))
5778                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5779                                 }
5780                                 if (control->spec_flags & M_NOTIFICATION) {
5781                                         out_flags |= MSG_NOTIFICATION;
5782                                 }
5783                                 /* we ate up the mbuf */
5784                                 if (in_flags & MSG_PEEK) {
5785                                         /* just looking */
5786                                         m = SCTP_BUF_NEXT(m);
5787                                         copied_so_far += cp_len;
5788                                 } else {
5789                                         /* dispose of the mbuf */
5790                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5791                                                 sctp_sblog(&so->so_rcv,
5792                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
5793                                         }
5794                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
5795                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5796                                                 sctp_sblog(&so->so_rcv,
5797                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5798                                         }
5799                                         copied_so_far += cp_len;
5800                                         freed_so_far += (uint32_t)cp_len;
5801                                         freed_so_far += MSIZE;
5802                                         atomic_subtract_int(&control->length, cp_len);
5803                                         control->data = sctp_m_free(m);
5804                                         m = control->data;
5805                                         /*
5806                                          * been through it all, must hold sb
5807                                          * lock ok to null tail
5808                                          */
5809                                         if (control->data == NULL) {
5810 #ifdef INVARIANTS
5811                                                 if ((control->end_added == 0) ||
5812                                                     (TAILQ_NEXT(control, next) == NULL)) {
5813                                                         /*
5814                                                          * If the end is not
5815                                                          * added, OR the
5816                                                          * next is NOT null
5817                                                          * we MUST have the
5818                                                          * lock.
5819                                                          */
5820                                                         if (mtx_owned(&inp->inp_rdata_mtx) == 0) {
5821                                                                 panic("Hmm we don't own the lock?");
5822                                                         }
5823                                                 }
5824 #endif
5825                                                 control->tail_mbuf = NULL;
5826 #ifdef INVARIANTS
5827                                                 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) {
5828                                                         panic("end_added, nothing left and no MSG_EOR");
5829                                                 }
5830 #endif
5831                                         }
5832                                 }
5833                         } else {
5834                                 /* Do we need to trim the mbuf? */
5835                                 if (control->spec_flags & M_NOTIFICATION) {
5836                                         out_flags |= MSG_NOTIFICATION;
5837                                 }
5838                                 if ((in_flags & MSG_PEEK) == 0) {
5839                                         SCTP_BUF_RESV_UF(m, cp_len);
5840                                         SCTP_BUF_LEN(m) -= (int)cp_len;
5841                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5842                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, (int)cp_len);
5843                                         }
5844                                         atomic_subtract_int(&so->so_rcv.sb_cc, cp_len);
5845                                         if ((control->do_not_ref_stcb == 0) &&
5846                                             stcb) {
5847                                                 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len);
5848                                         }
5849                                         copied_so_far += cp_len;
5850                                         freed_so_far += (uint32_t)cp_len;
5851                                         freed_so_far += MSIZE;
5852                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5853                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
5854                                                     SCTP_LOG_SBRESULT, 0);
5855                                         }
5856                                         atomic_subtract_int(&control->length, cp_len);
5857                                 } else {
5858                                         copied_so_far += cp_len;
5859                                 }
5860                         }
5861                         if ((out_flags & MSG_EOR) || (uio->uio_resid == 0)) {
5862                                 break;
5863                         }
5864                         if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5865                             (control->do_not_ref_stcb == 0) &&
5866                             (freed_so_far >= rwnd_req)) {
5867                                 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5868                         }
5869                 }               /* end while(m) */
5870                 /*
5871                  * At this point we have looked at it all and we either have
5872                  * a MSG_EOR/or read all the user wants... <OR>
5873                  * control->length == 0.
5874                  */
5875                 if ((out_flags & MSG_EOR) && ((in_flags & MSG_PEEK) == 0)) {
5876                         /* we are done with this control */
5877                         if (control->length == 0) {
5878                                 if (control->data) {
5879 #ifdef INVARIANTS
5880                                         panic("control->data not null at read eor?");
5881 #else
5882                                         SCTP_PRINTF("Strange, data left in the control buffer .. invarients would panic?\n");
5883                                         sctp_m_freem(control->data);
5884                                         control->data = NULL;
5885 #endif
5886                                 }
5887                 done_with_control:
5888                                 if (hold_rlock == 0) {
5889                                         SCTP_INP_READ_LOCK(inp);
5890                                         hold_rlock = 1;
5891                                 }
5892                                 TAILQ_REMOVE(&inp->read_queue, control, next);
5893                                 /* Add back any hiddend data */
5894                                 if (control->held_length) {
5895                                         held_length = 0;
5896                                         control->held_length = 0;
5897                                         wakeup_read_socket = 1;
5898                                 }
5899                                 if (control->aux_data) {
5900                                         sctp_m_free(control->aux_data);
5901                                         control->aux_data = NULL;
5902                                 }
5903                                 no_rcv_needed = control->do_not_ref_stcb;
5904                                 sctp_free_remote_addr(control->whoFrom);
5905                                 control->data = NULL;
5906 #ifdef INVARIANTS
5907                                 if (control->on_strm_q) {
5908                                         panic("About to free ctl:%p so:%p and its in %d",
5909                                             control, so, control->on_strm_q);
5910                                 }
5911 #endif
5912                                 sctp_free_a_readq(stcb, control);
5913                                 control = NULL;
5914                                 if ((freed_so_far >= rwnd_req) &&
5915                                     (no_rcv_needed == 0))
5916                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5917
5918                         } else {
5919                                 /*
5920                                  * The user did not read all of this
5921                                  * message, turn off the returned MSG_EOR
5922                                  * since we are leaving more behind on the
5923                                  * control to read.
5924                                  */
5925 #ifdef INVARIANTS
5926                                 if (control->end_added &&
5927                                     (control->data == NULL) &&
5928                                     (control->tail_mbuf == NULL)) {
5929                                         panic("Gak, control->length is corrupt?");
5930                                 }
5931 #endif
5932                                 no_rcv_needed = control->do_not_ref_stcb;
5933                                 out_flags &= ~MSG_EOR;
5934                         }
5935                 }
5936                 if (out_flags & MSG_EOR) {
5937                         goto release;
5938                 }
5939                 if ((uio->uio_resid == 0) ||
5940                     ((in_eeor_mode) &&
5941                     (copied_so_far >= max(so->so_rcv.sb_lowat, 1)))) {
5942                         goto release;
5943                 }
5944                 /*
5945                  * If I hit here the receiver wants more and this message is
5946                  * NOT done (pd-api). So two questions. Can we block? if not
5947                  * we are done. Did the user NOT set MSG_WAITALL?
5948                  */
5949                 if (block_allowed == 0) {
5950                         goto release;
5951                 }
5952                 /*
5953                  * We need to wait for more data a few things: - We don't
5954                  * sbunlock() so we don't get someone else reading. - We
5955                  * must be sure to account for the case where what is added
5956                  * is NOT to our control when we wakeup.
5957                  */
5958
5959                 /*
5960                  * Do we need to tell the transport a rwnd update might be
5961                  * needed before we go to sleep?
5962                  */
5963                 if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5964                     ((freed_so_far >= rwnd_req) &&
5965                     (control->do_not_ref_stcb == 0) &&
5966                     (no_rcv_needed == 0))) {
5967                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5968                 }
5969 wait_some_more:
5970                 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
5971                         goto release;
5972                 }
5973
5974                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
5975                         goto release;
5976
5977                 if (hold_rlock == 1) {
5978                         SCTP_INP_READ_UNLOCK(inp);
5979                         hold_rlock = 0;
5980                 }
5981                 if (hold_sblock == 0) {
5982                         SOCKBUF_LOCK(&so->so_rcv);
5983                         hold_sblock = 1;
5984                 }
5985                 if ((copied_so_far) && (control->length == 0) &&
5986                     (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE))) {
5987                         goto release;
5988                 }
5989                 if (so->so_rcv.sb_cc <= control->held_length) {
5990                         error = sbwait(&so->so_rcv);
5991                         if (error) {
5992                                 goto release;
5993                         }
5994                         control->held_length = 0;
5995                 }
5996                 if (hold_sblock) {
5997                         SOCKBUF_UNLOCK(&so->so_rcv);
5998                         hold_sblock = 0;
5999                 }
6000                 if (control->length == 0) {
6001                         /* still nothing here */
6002                         if (control->end_added == 1) {
6003                                 /* he aborted, or is done i.e.did a shutdown */
6004                                 out_flags |= MSG_EOR;
6005                                 if (control->pdapi_aborted) {
6006                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
6007                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6008
6009                                         out_flags |= MSG_TRUNC;
6010                                 } else {
6011                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
6012                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6013                                 }
6014                                 goto done_with_control;
6015                         }
6016                         if (so->so_rcv.sb_cc > held_length) {
6017                                 control->held_length = so->so_rcv.sb_cc;
6018                                 held_length = 0;
6019                         }
6020                         goto wait_some_more;
6021                 } else if (control->data == NULL) {
6022                         /*
6023                          * we must re-sync since data is probably being
6024                          * added
6025                          */
6026                         SCTP_INP_READ_LOCK(inp);
6027                         if ((control->length > 0) && (control->data == NULL)) {
6028                                 /*
6029                                  * big trouble.. we have the lock and its
6030                                  * corrupt?
6031                                  */
6032 #ifdef INVARIANTS
6033                                 panic("Impossible data==NULL length !=0");
6034 #endif
6035                                 out_flags |= MSG_EOR;
6036                                 out_flags |= MSG_TRUNC;
6037                                 control->length = 0;
6038                                 SCTP_INP_READ_UNLOCK(inp);
6039                                 goto done_with_control;
6040                         }
6041                         SCTP_INP_READ_UNLOCK(inp);
6042                         /* We will fall around to get more data */
6043                 }
6044                 goto get_more_data;
6045         } else {
6046                 /*-
6047                  * Give caller back the mbuf chain,
6048                  * store in uio_resid the length
6049                  */
6050                 wakeup_read_socket = 0;
6051                 if ((control->end_added == 0) ||
6052                     (TAILQ_NEXT(control, next) == NULL)) {
6053                         /* Need to get rlock */
6054                         if (hold_rlock == 0) {
6055                                 SCTP_INP_READ_LOCK(inp);
6056                                 hold_rlock = 1;
6057                         }
6058                 }
6059                 if (control->end_added) {
6060                         out_flags |= MSG_EOR;
6061                         if ((control->do_not_ref_stcb == 0) &&
6062                             (control->stcb != NULL) &&
6063                             ((control->spec_flags & M_NOTIFICATION) == 0))
6064                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6065                 }
6066                 if (control->spec_flags & M_NOTIFICATION) {
6067                         out_flags |= MSG_NOTIFICATION;
6068                 }
6069                 uio->uio_resid = control->length;
6070                 *mp = control->data;
6071                 m = control->data;
6072                 while (m) {
6073                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6074                                 sctp_sblog(&so->so_rcv,
6075                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
6076                         }
6077                         sctp_sbfree(control, stcb, &so->so_rcv, m);
6078                         freed_so_far += (uint32_t)SCTP_BUF_LEN(m);
6079                         freed_so_far += MSIZE;
6080                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6081                                 sctp_sblog(&so->so_rcv,
6082                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
6083                         }
6084                         m = SCTP_BUF_NEXT(m);
6085                 }
6086                 control->data = control->tail_mbuf = NULL;
6087                 control->length = 0;
6088                 if (out_flags & MSG_EOR) {
6089                         /* Done with this control */
6090                         goto done_with_control;
6091                 }
6092         }
6093 release:
6094         if (hold_rlock == 1) {
6095                 SCTP_INP_READ_UNLOCK(inp);
6096                 hold_rlock = 0;
6097         }
6098         if (hold_sblock == 1) {
6099                 SOCKBUF_UNLOCK(&so->so_rcv);
6100                 hold_sblock = 0;
6101         }
6102
6103         sbunlock(&so->so_rcv);
6104         sockbuf_lock = 0;
6105
6106 release_unlocked:
6107         if (hold_sblock) {
6108                 SOCKBUF_UNLOCK(&so->so_rcv);
6109                 hold_sblock = 0;
6110         }
6111         if ((stcb) && (in_flags & MSG_PEEK) == 0) {
6112                 if ((freed_so_far >= rwnd_req) &&
6113                     (control && (control->do_not_ref_stcb == 0)) &&
6114                     (no_rcv_needed == 0))
6115                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6116         }
6117 out:
6118         if (msg_flags) {
6119                 *msg_flags = out_flags;
6120         }
6121         if (((out_flags & MSG_EOR) == 0) &&
6122             ((in_flags & MSG_PEEK) == 0) &&
6123             (sinfo) &&
6124             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
6125             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO))) {
6126                 struct sctp_extrcvinfo *s_extra;
6127
6128                 s_extra = (struct sctp_extrcvinfo *)sinfo;
6129                 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG;
6130         }
6131         if (hold_rlock == 1) {
6132                 SCTP_INP_READ_UNLOCK(inp);
6133         }
6134         if (hold_sblock) {
6135                 SOCKBUF_UNLOCK(&so->so_rcv);
6136         }
6137         if (sockbuf_lock) {
6138                 sbunlock(&so->so_rcv);
6139         }
6140
6141         if (freecnt_applied) {
6142                 /*
6143                  * The lock on the socket buffer protects us so the free
6144                  * code will stop. But since we used the socketbuf lock and
6145                  * the sender uses the tcb_lock to increment, we need to use
6146                  * the atomic add to the refcnt.
6147                  */
6148                 if (stcb == NULL) {
6149 #ifdef INVARIANTS
6150                         panic("stcb for refcnt has gone NULL?");
6151                         goto stage_left;
6152 #else
6153                         goto stage_left;
6154 #endif
6155                 }
6156                 /* Save the value back for next time */
6157                 stcb->freed_by_sorcv_sincelast = freed_so_far;
6158                 atomic_add_int(&stcb->asoc.refcnt, -1);
6159         }
6160         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
6161                 if (stcb) {
6162                         sctp_misc_ints(SCTP_SORECV_DONE,
6163                             freed_so_far,
6164                             (uint32_t)((uio) ? (slen - uio->uio_resid) : slen),
6165                             stcb->asoc.my_rwnd,
6166                             so->so_rcv.sb_cc);
6167                 } else {
6168                         sctp_misc_ints(SCTP_SORECV_DONE,
6169                             freed_so_far,
6170                             (uint32_t)((uio) ? (slen - uio->uio_resid) : slen),
6171                             0,
6172                             so->so_rcv.sb_cc);
6173                 }
6174         }
6175 stage_left:
6176         if (wakeup_read_socket) {
6177                 sctp_sorwakeup(inp, so);
6178         }
6179         return (error);
6180 }
6181
6182
6183 #ifdef SCTP_MBUF_LOGGING
6184 struct mbuf *
6185 sctp_m_free(struct mbuf *m)
6186 {
6187         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
6188                 sctp_log_mb(m, SCTP_MBUF_IFREE);
6189         }
6190         return (m_free(m));
6191 }
6192
6193 void
6194 sctp_m_freem(struct mbuf *mb)
6195 {
6196         while (mb != NULL)
6197                 mb = sctp_m_free(mb);
6198 }
6199
6200 #endif
6201
6202 int
6203 sctp_dynamic_set_primary(struct sockaddr *sa, uint32_t vrf_id)
6204 {
6205         /*
6206          * Given a local address. For all associations that holds the
6207          * address, request a peer-set-primary.
6208          */
6209         struct sctp_ifa *ifa;
6210         struct sctp_laddr *wi;
6211
6212         ifa = sctp_find_ifa_by_addr(sa, vrf_id, 0);
6213         if (ifa == NULL) {
6214                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EADDRNOTAVAIL);
6215                 return (EADDRNOTAVAIL);
6216         }
6217         /*
6218          * Now that we have the ifa we must awaken the iterator with this
6219          * message.
6220          */
6221         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
6222         if (wi == NULL) {
6223                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
6224                 return (ENOMEM);
6225         }
6226         /* Now incr the count and int wi structure */
6227         SCTP_INCR_LADDR_COUNT();
6228         memset(wi, 0, sizeof(*wi));
6229         (void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
6230         wi->ifa = ifa;
6231         wi->action = SCTP_SET_PRIM_ADDR;
6232         atomic_add_int(&ifa->refcount, 1);
6233
6234         /* Now add it to the work queue */
6235         SCTP_WQ_ADDR_LOCK();
6236         /*
6237          * Should this really be a tailq? As it is we will process the
6238          * newest first :-0
6239          */
6240         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
6241         sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
6242             (struct sctp_inpcb *)NULL,
6243             (struct sctp_tcb *)NULL,
6244             (struct sctp_nets *)NULL);
6245         SCTP_WQ_ADDR_UNLOCK();
6246         return (0);
6247 }
6248
6249
6250 int
6251 sctp_soreceive(struct socket *so,
6252     struct sockaddr **psa,
6253     struct uio *uio,
6254     struct mbuf **mp0,
6255     struct mbuf **controlp,
6256     int *flagsp)
6257 {
6258         int error, fromlen;
6259         uint8_t sockbuf[256];
6260         struct sockaddr *from;
6261         struct sctp_extrcvinfo sinfo;
6262         int filling_sinfo = 1;
6263         int flags;
6264         struct sctp_inpcb *inp;
6265
6266         inp = (struct sctp_inpcb *)so->so_pcb;
6267         /* pickup the assoc we are reading from */
6268         if (inp == NULL) {
6269                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6270                 return (EINVAL);
6271         }
6272         if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) &&
6273             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) &&
6274             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) ||
6275             (controlp == NULL)) {
6276                 /* user does not want the sndrcv ctl */
6277                 filling_sinfo = 0;
6278         }
6279         if (psa) {
6280                 from = (struct sockaddr *)sockbuf;
6281                 fromlen = sizeof(sockbuf);
6282                 from->sa_len = 0;
6283         } else {
6284                 from = NULL;
6285                 fromlen = 0;
6286         }
6287
6288         if (filling_sinfo) {
6289                 memset(&sinfo, 0, sizeof(struct sctp_extrcvinfo));
6290         }
6291         if (flagsp != NULL) {
6292                 flags = *flagsp;
6293         } else {
6294                 flags = 0;
6295         }
6296         error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, &flags,
6297             (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo);
6298         if (flagsp != NULL) {
6299                 *flagsp = flags;
6300         }
6301         if (controlp != NULL) {
6302                 /* copy back the sinfo in a CMSG format */
6303                 if (filling_sinfo && ((flags & MSG_NOTIFICATION) == 0)) {
6304                         *controlp = sctp_build_ctl_nchunk(inp,
6305                             (struct sctp_sndrcvinfo *)&sinfo);
6306                 } else {
6307                         *controlp = NULL;
6308                 }
6309         }
6310         if (psa) {
6311                 /* copy back the address info */
6312                 if (from && from->sa_len) {
6313                         *psa = sodupsockaddr(from, M_NOWAIT);
6314                 } else {
6315                         *psa = NULL;
6316                 }
6317         }
6318         return (error);
6319 }
6320
6321
6322
6323
6324
6325 int
6326 sctp_connectx_helper_add(struct sctp_tcb *stcb, struct sockaddr *addr,
6327     int totaddr, int *error)
6328 {
6329         int added = 0;
6330         int i;
6331         struct sctp_inpcb *inp;
6332         struct sockaddr *sa;
6333         size_t incr = 0;
6334 #ifdef INET
6335         struct sockaddr_in *sin;
6336 #endif
6337 #ifdef INET6
6338         struct sockaddr_in6 *sin6;
6339 #endif
6340
6341         sa = addr;
6342         inp = stcb->sctp_ep;
6343         *error = 0;
6344         for (i = 0; i < totaddr; i++) {
6345                 switch (sa->sa_family) {
6346 #ifdef INET
6347                 case AF_INET:
6348                         incr = sizeof(struct sockaddr_in);
6349                         sin = (struct sockaddr_in *)sa;
6350                         if ((sin->sin_addr.s_addr == INADDR_ANY) ||
6351                             (sin->sin_addr.s_addr == INADDR_BROADCAST) ||
6352                             IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
6353                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6354                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6355                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_7);
6356                                 *error = EINVAL;
6357                                 goto out_now;
6358                         }
6359                         if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port,
6360                             SCTP_DONOT_SETSCOPE,
6361                             SCTP_ADDR_IS_CONFIRMED)) {
6362                                 /* assoc gone no un-lock */
6363                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6364                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6365                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_8);
6366                                 *error = ENOBUFS;
6367                                 goto out_now;
6368                         }
6369                         added++;
6370                         break;
6371 #endif
6372 #ifdef INET6
6373                 case AF_INET6:
6374                         incr = sizeof(struct sockaddr_in6);
6375                         sin6 = (struct sockaddr_in6 *)sa;
6376                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
6377                             IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
6378                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6379                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6380                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_9);
6381                                 *error = EINVAL;
6382                                 goto out_now;
6383                         }
6384                         if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port,
6385                             SCTP_DONOT_SETSCOPE,
6386                             SCTP_ADDR_IS_CONFIRMED)) {
6387                                 /* assoc gone no un-lock */
6388                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6389                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6390                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_10);
6391                                 *error = ENOBUFS;
6392                                 goto out_now;
6393                         }
6394                         added++;
6395                         break;
6396 #endif
6397                 default:
6398                         break;
6399                 }
6400                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6401         }
6402 out_now:
6403         return (added);
6404 }
6405
6406 int
6407 sctp_connectx_helper_find(struct sctp_inpcb *inp, struct sockaddr *addr,
6408     unsigned int totaddr,
6409     unsigned int *num_v4, unsigned int *num_v6,
6410     unsigned int limit)
6411 {
6412         struct sockaddr *sa;
6413         struct sctp_tcb *stcb;
6414         unsigned int incr, at, i;
6415
6416         at = 0;
6417         sa = addr;
6418         *num_v6 = *num_v4 = 0;
6419         /* account and validate addresses */
6420         if (totaddr == 0) {
6421                 return (EINVAL);
6422         }
6423         for (i = 0; i < totaddr; i++) {
6424                 if (at + sizeof(struct sockaddr) > limit) {
6425                         return (EINVAL);
6426                 }
6427                 switch (sa->sa_family) {
6428 #ifdef INET
6429                 case AF_INET:
6430                         incr = (unsigned int)sizeof(struct sockaddr_in);
6431                         if (sa->sa_len != incr) {
6432                                 return (EINVAL);
6433                         }
6434                         (*num_v4) += 1;
6435                         break;
6436 #endif
6437 #ifdef INET6
6438                 case AF_INET6:
6439                         {
6440                                 struct sockaddr_in6 *sin6;
6441
6442                                 sin6 = (struct sockaddr_in6 *)sa;
6443                                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6444                                         /* Must be non-mapped for connectx */
6445                                         return (EINVAL);
6446                                 }
6447                                 incr = (unsigned int)sizeof(struct sockaddr_in6);
6448                                 if (sa->sa_len != incr) {
6449                                         return (EINVAL);
6450                                 }
6451                                 (*num_v6) += 1;
6452                                 break;
6453                         }
6454 #endif
6455                 default:
6456                         return (EINVAL);
6457                 }
6458                 if ((at + incr) > limit) {
6459                         return (EINVAL);
6460                 }
6461                 SCTP_INP_INCR_REF(inp);
6462                 stcb = sctp_findassociation_ep_addr(&inp, sa, NULL, NULL, NULL);
6463                 if (stcb != NULL) {
6464                         SCTP_TCB_UNLOCK(stcb);
6465                         return (EALREADY);
6466                 } else {
6467                         SCTP_INP_DECR_REF(inp);
6468                 }
6469                 at += incr;
6470                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6471         }
6472         return (0);
6473 }
6474
6475 /*
6476  * sctp_bindx(ADD) for one address.
6477  * assumes all arguments are valid/checked by caller.
6478  */
6479 void
6480 sctp_bindx_add_address(struct socket *so, struct sctp_inpcb *inp,
6481     struct sockaddr *sa, sctp_assoc_t assoc_id,
6482     uint32_t vrf_id, int *error, void *p)
6483 {
6484         struct sockaddr *addr_touse;
6485 #if defined(INET) && defined(INET6)
6486         struct sockaddr_in sin;
6487 #endif
6488
6489         /* see if we're bound all already! */
6490         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6491                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6492                 *error = EINVAL;
6493                 return;
6494         }
6495         addr_touse = sa;
6496 #ifdef INET6
6497         if (sa->sa_family == AF_INET6) {
6498 #ifdef INET
6499                 struct sockaddr_in6 *sin6;
6500
6501 #endif
6502                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6503                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6504                         *error = EINVAL;
6505                         return;
6506                 }
6507                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6508                         /* can only bind v6 on PF_INET6 sockets */
6509                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6510                         *error = EINVAL;
6511                         return;
6512                 }
6513 #ifdef INET
6514                 sin6 = (struct sockaddr_in6 *)addr_touse;
6515                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6516                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6517                             SCTP_IPV6_V6ONLY(inp)) {
6518                                 /* can't bind v4-mapped on PF_INET sockets */
6519                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6520                                 *error = EINVAL;
6521                                 return;
6522                         }
6523                         in6_sin6_2_sin(&sin, sin6);
6524                         addr_touse = (struct sockaddr *)&sin;
6525                 }
6526 #endif
6527         }
6528 #endif
6529 #ifdef INET
6530         if (sa->sa_family == AF_INET) {
6531                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6532                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6533                         *error = EINVAL;
6534                         return;
6535                 }
6536                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6537                     SCTP_IPV6_V6ONLY(inp)) {
6538                         /* can't bind v4 on PF_INET sockets */
6539                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6540                         *error = EINVAL;
6541                         return;
6542                 }
6543         }
6544 #endif
6545         if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
6546                 if (p == NULL) {
6547                         /* Can't get proc for Net/Open BSD */
6548                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6549                         *error = EINVAL;
6550                         return;
6551                 }
6552                 *error = sctp_inpcb_bind(so, addr_touse, NULL, p);
6553                 return;
6554         }
6555         /*
6556          * No locks required here since bind and mgmt_ep_sa all do their own
6557          * locking. If we do something for the FIX: below we may need to
6558          * lock in that case.
6559          */
6560         if (assoc_id == 0) {
6561                 /* add the address */
6562                 struct sctp_inpcb *lep;
6563                 struct sockaddr_in *lsin = (struct sockaddr_in *)addr_touse;
6564
6565                 /* validate the incoming port */
6566                 if ((lsin->sin_port != 0) &&
6567                     (lsin->sin_port != inp->sctp_lport)) {
6568                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6569                         *error = EINVAL;
6570                         return;
6571                 } else {
6572                         /* user specified 0 port, set it to existing port */
6573                         lsin->sin_port = inp->sctp_lport;
6574                 }
6575
6576                 lep = sctp_pcb_findep(addr_touse, 1, 0, vrf_id);
6577                 if (lep != NULL) {
6578                         /*
6579                          * We must decrement the refcount since we have the
6580                          * ep already and are binding. No remove going on
6581                          * here.
6582                          */
6583                         SCTP_INP_DECR_REF(lep);
6584                 }
6585                 if (lep == inp) {
6586                         /* already bound to it.. ok */
6587                         return;
6588                 } else if (lep == NULL) {
6589                         ((struct sockaddr_in *)addr_touse)->sin_port = 0;
6590                         *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6591                             SCTP_ADD_IP_ADDRESS,
6592                             vrf_id, NULL);
6593                 } else {
6594                         *error = EADDRINUSE;
6595                 }
6596                 if (*error)
6597                         return;
6598         } else {
6599                 /*
6600                  * FIX: decide whether we allow assoc based bindx
6601                  */
6602         }
6603 }
6604
6605 /*
6606  * sctp_bindx(DELETE) for one address.
6607  * assumes all arguments are valid/checked by caller.
6608  */
6609 void
6610 sctp_bindx_delete_address(struct sctp_inpcb *inp,
6611     struct sockaddr *sa, sctp_assoc_t assoc_id,
6612     uint32_t vrf_id, int *error)
6613 {
6614         struct sockaddr *addr_touse;
6615 #if defined(INET) && defined(INET6)
6616         struct sockaddr_in sin;
6617 #endif
6618
6619         /* see if we're bound all already! */
6620         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6621                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6622                 *error = EINVAL;
6623                 return;
6624         }
6625         addr_touse = sa;
6626 #ifdef INET6
6627         if (sa->sa_family == AF_INET6) {
6628 #ifdef INET
6629                 struct sockaddr_in6 *sin6;
6630 #endif
6631
6632                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6633                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6634                         *error = EINVAL;
6635                         return;
6636                 }
6637                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6638                         /* can only bind v6 on PF_INET6 sockets */
6639                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6640                         *error = EINVAL;
6641                         return;
6642                 }
6643 #ifdef INET
6644                 sin6 = (struct sockaddr_in6 *)addr_touse;
6645                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6646                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6647                             SCTP_IPV6_V6ONLY(inp)) {
6648                                 /* can't bind mapped-v4 on PF_INET sockets */
6649                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6650                                 *error = EINVAL;
6651                                 return;
6652                         }
6653                         in6_sin6_2_sin(&sin, sin6);
6654                         addr_touse = (struct sockaddr *)&sin;
6655                 }
6656 #endif
6657         }
6658 #endif
6659 #ifdef INET
6660         if (sa->sa_family == AF_INET) {
6661                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6662                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6663                         *error = EINVAL;
6664                         return;
6665                 }
6666                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6667                     SCTP_IPV6_V6ONLY(inp)) {
6668                         /* can't bind v4 on PF_INET sockets */
6669                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6670                         *error = EINVAL;
6671                         return;
6672                 }
6673         }
6674 #endif
6675         /*
6676          * No lock required mgmt_ep_sa does its own locking. If the FIX:
6677          * below is ever changed we may need to lock before calling
6678          * association level binding.
6679          */
6680         if (assoc_id == 0) {
6681                 /* delete the address */
6682                 *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6683                     SCTP_DEL_IP_ADDRESS,
6684                     vrf_id, NULL);
6685         } else {
6686                 /*
6687                  * FIX: decide whether we allow assoc based bindx
6688                  */
6689         }
6690 }
6691
6692 /*
6693  * returns the valid local address count for an assoc, taking into account
6694  * all scoping rules
6695  */
6696 int
6697 sctp_local_addr_count(struct sctp_tcb *stcb)
6698 {
6699         int loopback_scope;
6700 #if defined(INET)
6701         int ipv4_local_scope, ipv4_addr_legal;
6702 #endif
6703 #if defined (INET6)
6704         int local_scope, site_scope, ipv6_addr_legal;
6705 #endif
6706         struct sctp_vrf *vrf;
6707         struct sctp_ifn *sctp_ifn;
6708         struct sctp_ifa *sctp_ifa;
6709         int count = 0;
6710
6711         /* Turn on all the appropriate scopes */
6712         loopback_scope = stcb->asoc.scope.loopback_scope;
6713 #if defined(INET)
6714         ipv4_local_scope = stcb->asoc.scope.ipv4_local_scope;
6715         ipv4_addr_legal = stcb->asoc.scope.ipv4_addr_legal;
6716 #endif
6717 #if defined(INET6)
6718         local_scope = stcb->asoc.scope.local_scope;
6719         site_scope = stcb->asoc.scope.site_scope;
6720         ipv6_addr_legal = stcb->asoc.scope.ipv6_addr_legal;
6721 #endif
6722         SCTP_IPI_ADDR_RLOCK();
6723         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
6724         if (vrf == NULL) {
6725                 /* no vrf, no addresses */
6726                 SCTP_IPI_ADDR_RUNLOCK();
6727                 return (0);
6728         }
6729
6730         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6731                 /*
6732                  * bound all case: go through all ifns on the vrf
6733                  */
6734                 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
6735                         if ((loopback_scope == 0) &&
6736                             SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
6737                                 continue;
6738                         }
6739                         LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
6740                                 if (sctp_is_addr_restricted(stcb, sctp_ifa))
6741                                         continue;
6742                                 switch (sctp_ifa->address.sa.sa_family) {
6743 #ifdef INET
6744                                 case AF_INET:
6745                                         if (ipv4_addr_legal) {
6746                                                 struct sockaddr_in *sin;
6747
6748                                                 sin = &sctp_ifa->address.sin;
6749                                                 if (sin->sin_addr.s_addr == 0) {
6750                                                         /*
6751                                                          * skip unspecified
6752                                                          * addrs
6753                                                          */
6754                                                         continue;
6755                                                 }
6756                                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
6757                                                     &sin->sin_addr) != 0) {
6758                                                         continue;
6759                                                 }
6760                                                 if ((ipv4_local_scope == 0) &&
6761                                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
6762                                                         continue;
6763                                                 }
6764                                                 /* count this one */
6765                                                 count++;
6766                                         } else {
6767                                                 continue;
6768                                         }
6769                                         break;
6770 #endif
6771 #ifdef INET6
6772                                 case AF_INET6:
6773                                         if (ipv6_addr_legal) {
6774                                                 struct sockaddr_in6 *sin6;
6775
6776                                                 sin6 = &sctp_ifa->address.sin6;
6777                                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
6778                                                         continue;
6779                                                 }
6780                                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
6781                                                     &sin6->sin6_addr) != 0) {
6782                                                         continue;
6783                                                 }
6784                                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
6785                                                         if (local_scope == 0)
6786                                                                 continue;
6787                                                         if (sin6->sin6_scope_id == 0) {
6788                                                                 if (sa6_recoverscope(sin6) != 0)
6789                                                                         /*
6790                                                                          *
6791                                                                          * bad
6792                                                                          * link
6793                                                                          *
6794                                                                          * local
6795                                                                          *
6796                                                                          * address
6797                                                                          */
6798                                                                         continue;
6799                                                         }
6800                                                 }
6801                                                 if ((site_scope == 0) &&
6802                                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
6803                                                         continue;
6804                                                 }
6805                                                 /* count this one */
6806                                                 count++;
6807                                         }
6808                                         break;
6809 #endif
6810                                 default:
6811                                         /* TSNH */
6812                                         break;
6813                                 }
6814                         }
6815                 }
6816         } else {
6817                 /*
6818                  * subset bound case
6819                  */
6820                 struct sctp_laddr *laddr;
6821
6822                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list,
6823                     sctp_nxt_addr) {
6824                         if (sctp_is_addr_restricted(stcb, laddr->ifa)) {
6825                                 continue;
6826                         }
6827                         /* count this one */
6828                         count++;
6829                 }
6830         }
6831         SCTP_IPI_ADDR_RUNLOCK();
6832         return (count);
6833 }
6834
6835 #if defined(SCTP_LOCAL_TRACE_BUF)
6836
6837 void
6838 sctp_log_trace(uint32_t subsys, const char *str SCTP_UNUSED, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f)
6839 {
6840         uint32_t saveindex, newindex;
6841
6842         do {
6843                 saveindex = SCTP_BASE_SYSCTL(sctp_log).index;
6844                 if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6845                         newindex = 1;
6846                 } else {
6847                         newindex = saveindex + 1;
6848                 }
6849         } while (atomic_cmpset_int(&SCTP_BASE_SYSCTL(sctp_log).index, saveindex, newindex) == 0);
6850         if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6851                 saveindex = 0;
6852         }
6853         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].timestamp = SCTP_GET_CYCLECOUNT;
6854         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].subsys = subsys;
6855         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[0] = a;
6856         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[1] = b;
6857         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[2] = c;
6858         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[3] = d;
6859         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[4] = e;
6860         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[5] = f;
6861 }
6862
6863 #endif
6864 static void
6865 sctp_recv_udp_tunneled_packet(struct mbuf *m, int off, struct inpcb *inp,
6866     const struct sockaddr *sa SCTP_UNUSED, void *ctx SCTP_UNUSED)
6867 {
6868         struct ip *iph;
6869 #ifdef INET6
6870         struct ip6_hdr *ip6;
6871 #endif
6872         struct mbuf *sp, *last;
6873         struct udphdr *uhdr;
6874         uint16_t port;
6875
6876         if ((m->m_flags & M_PKTHDR) == 0) {
6877                 /* Can't handle one that is not a pkt hdr */
6878                 goto out;
6879         }
6880         /* Pull the src port */
6881         iph = mtod(m, struct ip *);
6882         uhdr = (struct udphdr *)((caddr_t)iph + off);
6883         port = uhdr->uh_sport;
6884         /*
6885          * Split out the mbuf chain. Leave the IP header in m, place the
6886          * rest in the sp.
6887          */
6888         sp = m_split(m, off, M_NOWAIT);
6889         if (sp == NULL) {
6890                 /* Gak, drop packet, we can't do a split */
6891                 goto out;
6892         }
6893         if (sp->m_pkthdr.len < sizeof(struct udphdr) + sizeof(struct sctphdr)) {
6894                 /* Gak, packet can't have an SCTP header in it - too small */
6895                 m_freem(sp);
6896                 goto out;
6897         }
6898         /* Now pull up the UDP header and SCTP header together */
6899         sp = m_pullup(sp, sizeof(struct udphdr) + sizeof(struct sctphdr));
6900         if (sp == NULL) {
6901                 /* Gak pullup failed */
6902                 goto out;
6903         }
6904         /* Trim out the UDP header */
6905         m_adj(sp, sizeof(struct udphdr));
6906
6907         /* Now reconstruct the mbuf chain */
6908         for (last = m; last->m_next; last = last->m_next);
6909         last->m_next = sp;
6910         m->m_pkthdr.len += sp->m_pkthdr.len;
6911         /*
6912          * The CSUM_DATA_VALID flags indicates that the HW checked the UDP
6913          * checksum and it was valid. Since CSUM_DATA_VALID ==
6914          * CSUM_SCTP_VALID this would imply that the HW also verified the
6915          * SCTP checksum. Therefore, clear the bit.
6916          */
6917         SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
6918             "sctp_recv_udp_tunneled_packet(): Packet of length %d received on %s with csum_flags 0x%b.\n",
6919             m->m_pkthdr.len,
6920             if_name(m->m_pkthdr.rcvif),
6921             (int)m->m_pkthdr.csum_flags, CSUM_BITS);
6922         m->m_pkthdr.csum_flags &= ~CSUM_DATA_VALID;
6923         iph = mtod(m, struct ip *);
6924         switch (iph->ip_v) {
6925 #ifdef INET
6926         case IPVERSION:
6927                 iph->ip_len = htons(ntohs(iph->ip_len) - sizeof(struct udphdr));
6928                 sctp_input_with_port(m, off, port);
6929                 break;
6930 #endif
6931 #ifdef INET6
6932         case IPV6_VERSION >> 4:
6933                 ip6 = mtod(m, struct ip6_hdr *);
6934                 ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - sizeof(struct udphdr));
6935                 sctp6_input_with_port(&m, &off, port);
6936                 break;
6937 #endif
6938         default:
6939                 goto out;
6940                 break;
6941         }
6942         return;
6943 out:
6944         m_freem(m);
6945 }
6946
6947 #ifdef INET
6948 static void
6949 sctp_recv_icmp_tunneled_packet(int cmd, struct sockaddr *sa, void *vip, void *ctx SCTP_UNUSED)
6950 {
6951         struct ip *outer_ip, *inner_ip;
6952         struct sctphdr *sh;
6953         struct icmp *icmp;
6954         struct udphdr *udp;
6955         struct sctp_inpcb *inp;
6956         struct sctp_tcb *stcb;
6957         struct sctp_nets *net;
6958         struct sctp_init_chunk *ch;
6959         struct sockaddr_in src, dst;
6960         uint8_t type, code;
6961
6962         inner_ip = (struct ip *)vip;
6963         icmp = (struct icmp *)((caddr_t)inner_ip -
6964             (sizeof(struct icmp) - sizeof(struct ip)));
6965         outer_ip = (struct ip *)((caddr_t)icmp - sizeof(struct ip));
6966         if (ntohs(outer_ip->ip_len) <
6967             sizeof(struct ip) + 8 + (inner_ip->ip_hl << 2) + sizeof(struct udphdr) + 8) {
6968                 return;
6969         }
6970         udp = (struct udphdr *)((caddr_t)inner_ip + (inner_ip->ip_hl << 2));
6971         sh = (struct sctphdr *)(udp + 1);
6972         memset(&src, 0, sizeof(struct sockaddr_in));
6973         src.sin_family = AF_INET;
6974         src.sin_len = sizeof(struct sockaddr_in);
6975         src.sin_port = sh->src_port;
6976         src.sin_addr = inner_ip->ip_src;
6977         memset(&dst, 0, sizeof(struct sockaddr_in));
6978         dst.sin_family = AF_INET;
6979         dst.sin_len = sizeof(struct sockaddr_in);
6980         dst.sin_port = sh->dest_port;
6981         dst.sin_addr = inner_ip->ip_dst;
6982         /*
6983          * 'dst' holds the dest of the packet that failed to be sent. 'src'
6984          * holds our local endpoint address. Thus we reverse the dst and the
6985          * src in the lookup.
6986          */
6987         inp = NULL;
6988         net = NULL;
6989         stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst,
6990             (struct sockaddr *)&src,
6991             &inp, &net, 1,
6992             SCTP_DEFAULT_VRFID);
6993         if ((stcb != NULL) &&
6994             (net != NULL) &&
6995             (inp != NULL)) {
6996                 /* Check the UDP port numbers */
6997                 if ((udp->uh_dport != net->port) ||
6998                     (udp->uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) {
6999                         SCTP_TCB_UNLOCK(stcb);
7000                         return;
7001                 }
7002                 /* Check the verification tag */
7003                 if (ntohl(sh->v_tag) != 0) {
7004                         /*
7005                          * This must be the verification tag used for
7006                          * sending out packets. We don't consider packets
7007                          * reflecting the verification tag.
7008                          */
7009                         if (ntohl(sh->v_tag) != stcb->asoc.peer_vtag) {
7010                                 SCTP_TCB_UNLOCK(stcb);
7011                                 return;
7012                         }
7013                 } else {
7014                         if (ntohs(outer_ip->ip_len) >=
7015                             sizeof(struct ip) +
7016                             8 + (inner_ip->ip_hl << 2) + 8 + 20) {
7017                                 /*
7018                                  * In this case we can check if we got an
7019                                  * INIT chunk and if the initiate tag
7020                                  * matches.
7021                                  */
7022                                 ch = (struct sctp_init_chunk *)(sh + 1);
7023                                 if ((ch->ch.chunk_type != SCTP_INITIATION) ||
7024                                     (ntohl(ch->init.initiate_tag) != stcb->asoc.my_vtag)) {
7025                                         SCTP_TCB_UNLOCK(stcb);
7026                                         return;
7027                                 }
7028                         } else {
7029                                 SCTP_TCB_UNLOCK(stcb);
7030                                 return;
7031                         }
7032                 }
7033                 type = icmp->icmp_type;
7034                 code = icmp->icmp_code;
7035                 if ((type == ICMP_UNREACH) &&
7036                     (code == ICMP_UNREACH_PORT)) {
7037                         code = ICMP_UNREACH_PROTOCOL;
7038                 }
7039                 sctp_notify(inp, stcb, net, type, code,
7040                     ntohs(inner_ip->ip_len),
7041                     (uint32_t)ntohs(icmp->icmp_nextmtu));
7042         } else {
7043                 if ((stcb == NULL) && (inp != NULL)) {
7044                         /* reduce ref-count */
7045                         SCTP_INP_WLOCK(inp);
7046                         SCTP_INP_DECR_REF(inp);
7047                         SCTP_INP_WUNLOCK(inp);
7048                 }
7049                 if (stcb) {
7050                         SCTP_TCB_UNLOCK(stcb);
7051                 }
7052         }
7053         return;
7054 }
7055 #endif
7056
7057 #ifdef INET6
7058 static void
7059 sctp_recv_icmp6_tunneled_packet(int cmd, struct sockaddr *sa, void *d, void *ctx SCTP_UNUSED)
7060 {
7061         struct ip6ctlparam *ip6cp;
7062         struct sctp_inpcb *inp;
7063         struct sctp_tcb *stcb;
7064         struct sctp_nets *net;
7065         struct sctphdr sh;
7066         struct udphdr udp;
7067         struct sockaddr_in6 src, dst;
7068         uint8_t type, code;
7069
7070         ip6cp = (struct ip6ctlparam *)d;
7071         /*
7072          * XXX: We assume that when IPV6 is non NULL, M and OFF are valid.
7073          */
7074         if (ip6cp->ip6c_m == NULL) {
7075                 return;
7076         }
7077         /*
7078          * Check if we can safely examine the ports and the verification tag
7079          * of the SCTP common header.
7080          */
7081         if (ip6cp->ip6c_m->m_pkthdr.len <
7082             ip6cp->ip6c_off + sizeof(struct udphdr) + offsetof(struct sctphdr, checksum)) {
7083                 return;
7084         }
7085         /* Copy out the UDP header. */
7086         memset(&udp, 0, sizeof(struct udphdr));
7087         m_copydata(ip6cp->ip6c_m,
7088             ip6cp->ip6c_off,
7089             sizeof(struct udphdr),
7090             (caddr_t)&udp);
7091         /* Copy out the port numbers and the verification tag. */
7092         memset(&sh, 0, sizeof(struct sctphdr));
7093         m_copydata(ip6cp->ip6c_m,
7094             ip6cp->ip6c_off + sizeof(struct udphdr),
7095             sizeof(uint16_t) + sizeof(uint16_t) + sizeof(uint32_t),
7096             (caddr_t)&sh);
7097         memset(&src, 0, sizeof(struct sockaddr_in6));
7098         src.sin6_family = AF_INET6;
7099         src.sin6_len = sizeof(struct sockaddr_in6);
7100         src.sin6_port = sh.src_port;
7101         src.sin6_addr = ip6cp->ip6c_ip6->ip6_src;
7102         if (in6_setscope(&src.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) {
7103                 return;
7104         }
7105         memset(&dst, 0, sizeof(struct sockaddr_in6));
7106         dst.sin6_family = AF_INET6;
7107         dst.sin6_len = sizeof(struct sockaddr_in6);
7108         dst.sin6_port = sh.dest_port;
7109         dst.sin6_addr = ip6cp->ip6c_ip6->ip6_dst;
7110         if (in6_setscope(&dst.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) {
7111                 return;
7112         }
7113         inp = NULL;
7114         net = NULL;
7115         stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst,
7116             (struct sockaddr *)&src,
7117             &inp, &net, 1, SCTP_DEFAULT_VRFID);
7118         if ((stcb != NULL) &&
7119             (net != NULL) &&
7120             (inp != NULL)) {
7121                 /* Check the UDP port numbers */
7122                 if ((udp.uh_dport != net->port) ||
7123                     (udp.uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) {
7124                         SCTP_TCB_UNLOCK(stcb);
7125                         return;
7126                 }
7127                 /* Check the verification tag */
7128                 if (ntohl(sh.v_tag) != 0) {
7129                         /*
7130                          * This must be the verification tag used for
7131                          * sending out packets. We don't consider packets
7132                          * reflecting the verification tag.
7133                          */
7134                         if (ntohl(sh.v_tag) != stcb->asoc.peer_vtag) {
7135                                 SCTP_TCB_UNLOCK(stcb);
7136                                 return;
7137                         }
7138                 } else {
7139                         if (ip6cp->ip6c_m->m_pkthdr.len >=
7140                             ip6cp->ip6c_off + sizeof(struct udphdr) +
7141                             sizeof(struct sctphdr) +
7142                             sizeof(struct sctp_chunkhdr) +
7143                             offsetof(struct sctp_init, a_rwnd)) {
7144                                 /*
7145                                  * In this case we can check if we got an
7146                                  * INIT chunk and if the initiate tag
7147                                  * matches.
7148                                  */
7149                                 uint32_t initiate_tag;
7150                                 uint8_t chunk_type;
7151
7152                                 m_copydata(ip6cp->ip6c_m,
7153                                     ip6cp->ip6c_off +
7154                                     sizeof(struct udphdr) +
7155                                     sizeof(struct sctphdr),
7156                                     sizeof(uint8_t),
7157                                     (caddr_t)&chunk_type);
7158                                 m_copydata(ip6cp->ip6c_m,
7159                                     ip6cp->ip6c_off +
7160                                     sizeof(struct udphdr) +
7161                                     sizeof(struct sctphdr) +
7162                                     sizeof(struct sctp_chunkhdr),
7163                                     sizeof(uint32_t),
7164                                     (caddr_t)&initiate_tag);
7165                                 if ((chunk_type != SCTP_INITIATION) ||
7166                                     (ntohl(initiate_tag) != stcb->asoc.my_vtag)) {
7167                                         SCTP_TCB_UNLOCK(stcb);
7168                                         return;
7169                                 }
7170                         } else {
7171                                 SCTP_TCB_UNLOCK(stcb);
7172                                 return;
7173                         }
7174                 }
7175                 type = ip6cp->ip6c_icmp6->icmp6_type;
7176                 code = ip6cp->ip6c_icmp6->icmp6_code;
7177                 if ((type == ICMP6_DST_UNREACH) &&
7178                     (code == ICMP6_DST_UNREACH_NOPORT)) {
7179                         type = ICMP6_PARAM_PROB;
7180                         code = ICMP6_PARAMPROB_NEXTHEADER;
7181                 }
7182                 sctp6_notify(inp, stcb, net, type, code,
7183                     ntohl(ip6cp->ip6c_icmp6->icmp6_mtu));
7184         } else {
7185                 if ((stcb == NULL) && (inp != NULL)) {
7186                         /* reduce inp's ref-count */
7187                         SCTP_INP_WLOCK(inp);
7188                         SCTP_INP_DECR_REF(inp);
7189                         SCTP_INP_WUNLOCK(inp);
7190                 }
7191                 if (stcb) {
7192                         SCTP_TCB_UNLOCK(stcb);
7193                 }
7194         }
7195 }
7196 #endif
7197
7198 void
7199 sctp_over_udp_stop(void)
7200 {
7201         /*
7202          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
7203          * for writting!
7204          */
7205 #ifdef INET
7206         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
7207                 soclose(SCTP_BASE_INFO(udp4_tun_socket));
7208                 SCTP_BASE_INFO(udp4_tun_socket) = NULL;
7209         }
7210 #endif
7211 #ifdef INET6
7212         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
7213                 soclose(SCTP_BASE_INFO(udp6_tun_socket));
7214                 SCTP_BASE_INFO(udp6_tun_socket) = NULL;
7215         }
7216 #endif
7217 }
7218
7219 int
7220 sctp_over_udp_start(void)
7221 {
7222         uint16_t port;
7223         int ret;
7224 #ifdef INET
7225         struct sockaddr_in sin;
7226 #endif
7227 #ifdef INET6
7228         struct sockaddr_in6 sin6;
7229 #endif
7230         /*
7231          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
7232          * for writting!
7233          */
7234         port = SCTP_BASE_SYSCTL(sctp_udp_tunneling_port);
7235         if (ntohs(port) == 0) {
7236                 /* Must have a port set */
7237                 return (EINVAL);
7238         }
7239 #ifdef INET
7240         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
7241                 /* Already running -- must stop first */
7242                 return (EALREADY);
7243         }
7244 #endif
7245 #ifdef INET6
7246         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
7247                 /* Already running -- must stop first */
7248                 return (EALREADY);
7249         }
7250 #endif
7251 #ifdef INET
7252         if ((ret = socreate(PF_INET, &SCTP_BASE_INFO(udp4_tun_socket),
7253             SOCK_DGRAM, IPPROTO_UDP,
7254             curthread->td_ucred, curthread))) {
7255                 sctp_over_udp_stop();
7256                 return (ret);
7257         }
7258         /* Call the special UDP hook. */
7259         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp4_tun_socket),
7260             sctp_recv_udp_tunneled_packet,
7261             sctp_recv_icmp_tunneled_packet,
7262             NULL))) {
7263                 sctp_over_udp_stop();
7264                 return (ret);
7265         }
7266         /* Ok, we have a socket, bind it to the port. */
7267         memset(&sin, 0, sizeof(struct sockaddr_in));
7268         sin.sin_len = sizeof(struct sockaddr_in);
7269         sin.sin_family = AF_INET;
7270         sin.sin_port = htons(port);
7271         if ((ret = sobind(SCTP_BASE_INFO(udp4_tun_socket),
7272             (struct sockaddr *)&sin, curthread))) {
7273                 sctp_over_udp_stop();
7274                 return (ret);
7275         }
7276 #endif
7277 #ifdef INET6
7278         if ((ret = socreate(PF_INET6, &SCTP_BASE_INFO(udp6_tun_socket),
7279             SOCK_DGRAM, IPPROTO_UDP,
7280             curthread->td_ucred, curthread))) {
7281                 sctp_over_udp_stop();
7282                 return (ret);
7283         }
7284         /* Call the special UDP hook. */
7285         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp6_tun_socket),
7286             sctp_recv_udp_tunneled_packet,
7287             sctp_recv_icmp6_tunneled_packet,
7288             NULL))) {
7289                 sctp_over_udp_stop();
7290                 return (ret);
7291         }
7292         /* Ok, we have a socket, bind it to the port. */
7293         memset(&sin6, 0, sizeof(struct sockaddr_in6));
7294         sin6.sin6_len = sizeof(struct sockaddr_in6);
7295         sin6.sin6_family = AF_INET6;
7296         sin6.sin6_port = htons(port);
7297         if ((ret = sobind(SCTP_BASE_INFO(udp6_tun_socket),
7298             (struct sockaddr *)&sin6, curthread))) {
7299                 sctp_over_udp_stop();
7300                 return (ret);
7301         }
7302 #endif
7303         return (0);
7304 }
7305
7306 /*
7307  * sctp_min_mtu ()returns the minimum of all non-zero arguments.
7308  * If all arguments are zero, zero is returned.
7309  */
7310 uint32_t
7311 sctp_min_mtu(uint32_t mtu1, uint32_t mtu2, uint32_t mtu3)
7312 {
7313         if (mtu1 > 0) {
7314                 if (mtu2 > 0) {
7315                         if (mtu3 > 0) {
7316                                 return (min(mtu1, min(mtu2, mtu3)));
7317                         } else {
7318                                 return (min(mtu1, mtu2));
7319                         }
7320                 } else {
7321                         if (mtu3 > 0) {
7322                                 return (min(mtu1, mtu3));
7323                         } else {
7324                                 return (mtu1);
7325                         }
7326                 }
7327         } else {
7328                 if (mtu2 > 0) {
7329                         if (mtu3 > 0) {
7330                                 return (min(mtu2, mtu3));
7331                         } else {
7332                                 return (mtu2);
7333                         }
7334                 } else {
7335                         return (mtu3);
7336                 }
7337         }
7338 }
7339
7340 void
7341 sctp_hc_set_mtu(union sctp_sockstore *addr, uint16_t fibnum, uint32_t mtu)
7342 {
7343         struct in_conninfo inc;
7344
7345         memset(&inc, 0, sizeof(struct in_conninfo));
7346         inc.inc_fibnum = fibnum;
7347         switch (addr->sa.sa_family) {
7348 #ifdef INET
7349         case AF_INET:
7350                 inc.inc_faddr = addr->sin.sin_addr;
7351                 break;
7352 #endif
7353 #ifdef INET6
7354         case AF_INET6:
7355                 inc.inc_flags |= INC_ISIPV6;
7356                 inc.inc6_faddr = addr->sin6.sin6_addr;
7357                 break;
7358 #endif
7359         default:
7360                 return;
7361         }
7362         tcp_hc_updatemtu(&inc, (u_long)mtu);
7363 }
7364
7365 uint32_t
7366 sctp_hc_get_mtu(union sctp_sockstore *addr, uint16_t fibnum)
7367 {
7368         struct in_conninfo inc;
7369
7370         memset(&inc, 0, sizeof(struct in_conninfo));
7371         inc.inc_fibnum = fibnum;
7372         switch (addr->sa.sa_family) {
7373 #ifdef INET
7374         case AF_INET:
7375                 inc.inc_faddr = addr->sin.sin_addr;
7376                 break;
7377 #endif
7378 #ifdef INET6
7379         case AF_INET6:
7380                 inc.inc_flags |= INC_ISIPV6;
7381                 inc.inc6_faddr = addr->sin6.sin6_addr;
7382                 break;
7383 #endif
7384         default:
7385                 return (0);
7386         }
7387         return ((uint32_t)tcp_hc_getmtu(&inc));
7388 }
7389
7390 void
7391 sctp_set_state(struct sctp_tcb *stcb, int new_state)
7392 {
7393 #if defined(KDTRACE_HOOKS)
7394         int old_state = stcb->asoc.state;
7395 #endif
7396
7397         KASSERT((new_state & ~SCTP_STATE_MASK) == 0,
7398             ("sctp_set_state: Can't set substate (new_state = %x)",
7399             new_state));
7400         stcb->asoc.state = (stcb->asoc.state & ~SCTP_STATE_MASK) | new_state;
7401         if ((new_state == SCTP_STATE_SHUTDOWN_RECEIVED) ||
7402             (new_state == SCTP_STATE_SHUTDOWN_SENT) ||
7403             (new_state == SCTP_STATE_SHUTDOWN_ACK_SENT)) {
7404                 SCTP_CLEAR_SUBSTATE(stcb, SCTP_STATE_SHUTDOWN_PENDING);
7405         }
7406 #if defined(KDTRACE_HOOKS)
7407         if (((old_state & SCTP_STATE_MASK) != new_state) &&
7408             !(((old_state & SCTP_STATE_MASK) == SCTP_STATE_EMPTY) &&
7409             (new_state == SCTP_STATE_INUSE))) {
7410                 SCTP_PROBE6(state__change, NULL, stcb, NULL, stcb, NULL, old_state);
7411         }
7412 #endif
7413 }
7414
7415 void
7416 sctp_add_substate(struct sctp_tcb *stcb, int substate)
7417 {
7418 #if defined(KDTRACE_HOOKS)
7419         int old_state = stcb->asoc.state;
7420 #endif
7421
7422         KASSERT((substate & SCTP_STATE_MASK) == 0,
7423             ("sctp_add_substate: Can't set state (substate = %x)",
7424             substate));
7425         stcb->asoc.state |= substate;
7426 #if defined(KDTRACE_HOOKS)
7427         if (((substate & SCTP_STATE_ABOUT_TO_BE_FREED) &&
7428             ((old_state & SCTP_STATE_ABOUT_TO_BE_FREED) == 0)) ||
7429             ((substate & SCTP_STATE_SHUTDOWN_PENDING) &&
7430             ((old_state & SCTP_STATE_SHUTDOWN_PENDING) == 0))) {
7431                 SCTP_PROBE6(state__change, NULL, stcb, NULL, stcb, NULL, old_state);
7432         }
7433 #endif
7434 }