sys/netinet/sctputil.c

   1 /*-
   2  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36 #include <netinet/sctp_os.h>
  37 #include <netinet/sctp_pcb.h>
  38 #include <netinet/sctputil.h>
  39 #include <netinet/sctp_var.h>
  40 #include <netinet/sctp_sysctl.h>
  41 #ifdef INET6
  42 #include <netinet6/sctp6_var.h>
  43 #endif
  44 #include <netinet/sctp_header.h>
  45 #include <netinet/sctp_output.h>
  46 #include <netinet/sctp_uio.h>
  47 #include <netinet/sctp_timer.h>
  48 #include <netinet/sctp_indata.h>/* for sctp_deliver_data() */
  49 #include <netinet/sctp_auth.h>
  50 #include <netinet/sctp_asconf.h>
  51 #include <netinet/sctp_bsd_addr.h>
  52 #if defined(INET6) || defined(INET)
  53 #include <netinet/tcp_var.h>
  54 #endif
  55 #include <netinet/udp.h>
  56 #include <netinet/udp_var.h>
  57 #include <sys/proc.h>
  58 #ifdef INET6
  59 #include <netinet/icmp6.h>
  60 #endif
  61
  62
  63 #ifndef KTR_SCTP
  64 #define KTR_SCTP KTR_SUBSYS
  65 #endif
  66
  67 extern const struct sctp_cc_functions sctp_cc_functions[];
  68 extern const struct sctp_ss_functions sctp_ss_functions[];
  69
  70 void
  71 sctp_sblog(struct sockbuf *sb, struct sctp_tcb *stcb, int from, int incr)
  72 {
  73         struct sctp_cwnd_log sctp_clog;
  74
  75         sctp_clog.x.sb.stcb = stcb;
  76         sctp_clog.x.sb.so_sbcc = sb->sb_cc;
  77         if (stcb)
  78                 sctp_clog.x.sb.stcb_sbcc = stcb->asoc.sb_cc;
  79         else
  80                 sctp_clog.x.sb.stcb_sbcc = 0;
  81         sctp_clog.x.sb.incr = incr;
  82         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
  83             SCTP_LOG_EVENT_SB,
  84             from,
  85             sctp_clog.x.misc.log1,
  86             sctp_clog.x.misc.log2,
  87             sctp_clog.x.misc.log3,
  88             sctp_clog.x.misc.log4);
  89 }
  90
  91 void
  92 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc)
  93 {
  94         struct sctp_cwnd_log sctp_clog;
  95
  96         sctp_clog.x.close.inp = (void *)inp;
  97         sctp_clog.x.close.sctp_flags = inp->sctp_flags;
  98         if (stcb) {
  99                 sctp_clog.x.close.stcb = (void *)stcb;
 100                 sctp_clog.x.close.state = (uint16_t)stcb->asoc.state;
 101         } else {
 102                 sctp_clog.x.close.stcb = 0;
 103                 sctp_clog.x.close.state = 0;
 104         }
 105         sctp_clog.x.close.loc = loc;
 106         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 107             SCTP_LOG_EVENT_CLOSE,
 108             0,
 109             sctp_clog.x.misc.log1,
 110             sctp_clog.x.misc.log2,
 111             sctp_clog.x.misc.log3,
 112             sctp_clog.x.misc.log4);
 113 }
 114
 115 void
 116 rto_logging(struct sctp_nets *net, int from)
 117 {
 118         struct sctp_cwnd_log sctp_clog;
 119
 120         memset(&sctp_clog, 0, sizeof(sctp_clog));
 121         sctp_clog.x.rto.net = (void *)net;
 122         sctp_clog.x.rto.rtt = net->rtt / 1000;
 123         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 124             SCTP_LOG_EVENT_RTT,
 125             from,
 126             sctp_clog.x.misc.log1,
 127             sctp_clog.x.misc.log2,
 128             sctp_clog.x.misc.log3,
 129             sctp_clog.x.misc.log4);
 130 }
 131
 132 void
 133 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from)
 134 {
 135         struct sctp_cwnd_log sctp_clog;
 136
 137         sctp_clog.x.strlog.stcb = stcb;
 138         sctp_clog.x.strlog.n_tsn = tsn;
 139         sctp_clog.x.strlog.n_sseq = sseq;
 140         sctp_clog.x.strlog.e_tsn = 0;
 141         sctp_clog.x.strlog.e_sseq = 0;
 142         sctp_clog.x.strlog.strm = stream;
 143         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 144             SCTP_LOG_EVENT_STRM,
 145             from,
 146             sctp_clog.x.misc.log1,
 147             sctp_clog.x.misc.log2,
 148             sctp_clog.x.misc.log3,
 149             sctp_clog.x.misc.log4);
 150 }
 151
 152 void
 153 sctp_log_nagle_event(struct sctp_tcb *stcb, int action)
 154 {
 155         struct sctp_cwnd_log sctp_clog;
 156
 157         sctp_clog.x.nagle.stcb = (void *)stcb;
 158         sctp_clog.x.nagle.total_flight = stcb->asoc.total_flight;
 159         sctp_clog.x.nagle.total_in_queue = stcb->asoc.total_output_queue_size;
 160         sctp_clog.x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue;
 161         sctp_clog.x.nagle.count_in_flight = stcb->asoc.total_flight_count;
 162         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 163             SCTP_LOG_EVENT_NAGLE,
 164             action,
 165             sctp_clog.x.misc.log1,
 166             sctp_clog.x.misc.log2,
 167             sctp_clog.x.misc.log3,
 168             sctp_clog.x.misc.log4);
 169 }
 170
 171 void
 172 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from)
 173 {
 174         struct sctp_cwnd_log sctp_clog;
 175
 176         sctp_clog.x.sack.cumack = cumack;
 177         sctp_clog.x.sack.oldcumack = old_cumack;
 178         sctp_clog.x.sack.tsn = tsn;
 179         sctp_clog.x.sack.numGaps = gaps;
 180         sctp_clog.x.sack.numDups = dups;
 181         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 182             SCTP_LOG_EVENT_SACK,
 183             from,
 184             sctp_clog.x.misc.log1,
 185             sctp_clog.x.misc.log2,
 186             sctp_clog.x.misc.log3,
 187             sctp_clog.x.misc.log4);
 188 }
 189
 190 void
 191 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from)
 192 {
 193         struct sctp_cwnd_log sctp_clog;
 194
 195         memset(&sctp_clog, 0, sizeof(sctp_clog));
 196         sctp_clog.x.map.base = map;
 197         sctp_clog.x.map.cum = cum;
 198         sctp_clog.x.map.high = high;
 199         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 200             SCTP_LOG_EVENT_MAP,
 201             from,
 202             sctp_clog.x.misc.log1,
 203             sctp_clog.x.misc.log2,
 204             sctp_clog.x.misc.log3,
 205             sctp_clog.x.misc.log4);
 206 }
 207
 208 void
 209 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn, int from)
 210 {
 211         struct sctp_cwnd_log sctp_clog;
 212
 213         memset(&sctp_clog, 0, sizeof(sctp_clog));
 214         sctp_clog.x.fr.largest_tsn = biggest_tsn;
 215         sctp_clog.x.fr.largest_new_tsn = biggest_new_tsn;
 216         sctp_clog.x.fr.tsn = tsn;
 217         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 218             SCTP_LOG_EVENT_FR,
 219             from,
 220             sctp_clog.x.misc.log1,
 221             sctp_clog.x.misc.log2,
 222             sctp_clog.x.misc.log3,
 223             sctp_clog.x.misc.log4);
 224 }
 225
 226 #ifdef SCTP_MBUF_LOGGING
 227 void
 228 sctp_log_mb(struct mbuf *m, int from)
 229 {
 230         struct sctp_cwnd_log sctp_clog;
 231
 232         sctp_clog.x.mb.mp = m;
 233         sctp_clog.x.mb.mbuf_flags = (uint8_t)(SCTP_BUF_GET_FLAGS(m));
 234         sctp_clog.x.mb.size = (uint16_t)(SCTP_BUF_LEN(m));
 235         sctp_clog.x.mb.data = SCTP_BUF_AT(m, 0);
 236         if (SCTP_BUF_IS_EXTENDED(m)) {
 237                 sctp_clog.x.mb.ext = SCTP_BUF_EXTEND_BASE(m);
 238                 sctp_clog.x.mb.refcnt = (uint8_t)(SCTP_BUF_EXTEND_REFCNT(m));
 239         } else {
 240                 sctp_clog.x.mb.ext = 0;
 241                 sctp_clog.x.mb.refcnt = 0;
 242         }
 243         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 244             SCTP_LOG_EVENT_MBUF,
 245             from,
 246             sctp_clog.x.misc.log1,
 247             sctp_clog.x.misc.log2,
 248             sctp_clog.x.misc.log3,
 249             sctp_clog.x.misc.log4);
 250 }
 251
 252 void
 253 sctp_log_mbc(struct mbuf *m, int from)
 254 {
 255         struct mbuf *mat;
 256
 257         for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) {
 258                 sctp_log_mb(mat, from);
 259         }
 260 }
 261 #endif
 262
 263 void
 264 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk, int from)
 265 {
 266         struct sctp_cwnd_log sctp_clog;
 267
 268         if (control == NULL) {
 269                 SCTP_PRINTF("Gak log of NULL?\n");
 270                 return;
 271         }
 272         sctp_clog.x.strlog.stcb = control->stcb;
 273         sctp_clog.x.strlog.n_tsn = control->sinfo_tsn;
 274         sctp_clog.x.strlog.n_sseq = (uint16_t)control->mid;
 275         sctp_clog.x.strlog.strm = control->sinfo_stream;
 276         if (poschk != NULL) {
 277                 sctp_clog.x.strlog.e_tsn = poschk->sinfo_tsn;
 278                 sctp_clog.x.strlog.e_sseq = (uint16_t)poschk->mid;
 279         } else {
 280                 sctp_clog.x.strlog.e_tsn = 0;
 281                 sctp_clog.x.strlog.e_sseq = 0;
 282         }
 283         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 284             SCTP_LOG_EVENT_STRM,
 285             from,
 286             sctp_clog.x.misc.log1,
 287             sctp_clog.x.misc.log2,
 288             sctp_clog.x.misc.log3,
 289             sctp_clog.x.misc.log4);
 290 }
 291
 292 void
 293 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from)
 294 {
 295         struct sctp_cwnd_log sctp_clog;
 296
 297         sctp_clog.x.cwnd.net = net;
 298         if (stcb->asoc.send_queue_cnt > 255)
 299                 sctp_clog.x.cwnd.cnt_in_send = 255;
 300         else
 301                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 302         if (stcb->asoc.stream_queue_cnt > 255)
 303                 sctp_clog.x.cwnd.cnt_in_str = 255;
 304         else
 305                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 306
 307         if (net) {
 308                 sctp_clog.x.cwnd.cwnd_new_value = net->cwnd;
 309                 sctp_clog.x.cwnd.inflight = net->flight_size;
 310                 sctp_clog.x.cwnd.pseudo_cumack = net->pseudo_cumack;
 311                 sctp_clog.x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack;
 312                 sctp_clog.x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack;
 313         }
 314         if (SCTP_CWNDLOG_PRESEND == from) {
 315                 sctp_clog.x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd;
 316         }
 317         sctp_clog.x.cwnd.cwnd_augment = augment;
 318         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 319             SCTP_LOG_EVENT_CWND,
 320             from,
 321             sctp_clog.x.misc.log1,
 322             sctp_clog.x.misc.log2,
 323             sctp_clog.x.misc.log3,
 324             sctp_clog.x.misc.log4);
 325 }
 326
 327 void
 328 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from)
 329 {
 330         struct sctp_cwnd_log sctp_clog;
 331
 332         memset(&sctp_clog, 0, sizeof(sctp_clog));
 333         if (inp) {
 334                 sctp_clog.x.lock.sock = (void *)inp->sctp_socket;
 335
 336         } else {
 337                 sctp_clog.x.lock.sock = (void *)NULL;
 338         }
 339         sctp_clog.x.lock.inp = (void *)inp;
 340         if (stcb) {
 341                 sctp_clog.x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx);
 342         } else {
 343                 sctp_clog.x.lock.tcb_lock = SCTP_LOCK_UNKNOWN;
 344         }
 345         if (inp) {
 346                 sctp_clog.x.lock.inp_lock = mtx_owned(&inp->inp_mtx);
 347                 sctp_clog.x.lock.create_lock = mtx_owned(&inp->inp_create_mtx);
 348         } else {
 349                 sctp_clog.x.lock.inp_lock = SCTP_LOCK_UNKNOWN;
 350                 sctp_clog.x.lock.create_lock = SCTP_LOCK_UNKNOWN;
 351         }
 352         sctp_clog.x.lock.info_lock = rw_wowned(&SCTP_BASE_INFO(ipi_ep_mtx));
 353         if (inp && (inp->sctp_socket)) {
 354                 sctp_clog.x.lock.sock_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 355                 sctp_clog.x.lock.sockrcvbuf_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 356                 sctp_clog.x.lock.socksndbuf_lock = mtx_owned(&(inp->sctp_socket->so_snd.sb_mtx));
 357         } else {
 358                 sctp_clog.x.lock.sock_lock = SCTP_LOCK_UNKNOWN;
 359                 sctp_clog.x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN;
 360                 sctp_clog.x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN;
 361         }
 362         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 363             SCTP_LOG_LOCK_EVENT,
 364             from,
 365             sctp_clog.x.misc.log1,
 366             sctp_clog.x.misc.log2,
 367             sctp_clog.x.misc.log3,
 368             sctp_clog.x.misc.log4);
 369 }
 370
 371 void
 372 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from)
 373 {
 374         struct sctp_cwnd_log sctp_clog;
 375
 376         memset(&sctp_clog, 0, sizeof(sctp_clog));
 377         sctp_clog.x.cwnd.net = net;
 378         sctp_clog.x.cwnd.cwnd_new_value = error;
 379         sctp_clog.x.cwnd.inflight = net->flight_size;
 380         sctp_clog.x.cwnd.cwnd_augment = burst;
 381         if (stcb->asoc.send_queue_cnt > 255)
 382                 sctp_clog.x.cwnd.cnt_in_send = 255;
 383         else
 384                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 385         if (stcb->asoc.stream_queue_cnt > 255)
 386                 sctp_clog.x.cwnd.cnt_in_str = 255;
 387         else
 388                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 389         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 390             SCTP_LOG_EVENT_MAXBURST,
 391             from,
 392             sctp_clog.x.misc.log1,
 393             sctp_clog.x.misc.log2,
 394             sctp_clog.x.misc.log3,
 395             sctp_clog.x.misc.log4);
 396 }
 397
 398 void
 399 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead)
 400 {
 401         struct sctp_cwnd_log sctp_clog;
 402
 403         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 404         sctp_clog.x.rwnd.send_size = snd_size;
 405         sctp_clog.x.rwnd.overhead = overhead;
 406         sctp_clog.x.rwnd.new_rwnd = 0;
 407         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 408             SCTP_LOG_EVENT_RWND,
 409             from,
 410             sctp_clog.x.misc.log1,
 411             sctp_clog.x.misc.log2,
 412             sctp_clog.x.misc.log3,
 413             sctp_clog.x.misc.log4);
 414 }
 415
 416 void
 417 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval)
 418 {
 419         struct sctp_cwnd_log sctp_clog;
 420
 421         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 422         sctp_clog.x.rwnd.send_size = flight_size;
 423         sctp_clog.x.rwnd.overhead = overhead;
 424         sctp_clog.x.rwnd.new_rwnd = a_rwndval;
 425         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 426             SCTP_LOG_EVENT_RWND,
 427             from,
 428             sctp_clog.x.misc.log1,
 429             sctp_clog.x.misc.log2,
 430             sctp_clog.x.misc.log3,
 431             sctp_clog.x.misc.log4);
 432 }
 433
 434 #ifdef SCTP_MBCNT_LOGGING
 435 static void
 436 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt)
 437 {
 438         struct sctp_cwnd_log sctp_clog;
 439
 440         sctp_clog.x.mbcnt.total_queue_size = total_oq;
 441         sctp_clog.x.mbcnt.size_change = book;
 442         sctp_clog.x.mbcnt.total_queue_mb_size = total_mbcnt_q;
 443         sctp_clog.x.mbcnt.mbcnt_change = mbcnt;
 444         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 445             SCTP_LOG_EVENT_MBCNT,
 446             from,
 447             sctp_clog.x.misc.log1,
 448             sctp_clog.x.misc.log2,
 449             sctp_clog.x.misc.log3,
 450             sctp_clog.x.misc.log4);
 451 }
 452 #endif
 453
 454 void
 455 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d)
 456 {
 457         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 458             SCTP_LOG_MISC_EVENT,
 459             from,
 460             a, b, c, d);
 461 }
 462
 463 void
 464 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t wake_cnt, int from)
 465 {
 466         struct sctp_cwnd_log sctp_clog;
 467
 468         sctp_clog.x.wake.stcb = (void *)stcb;
 469         sctp_clog.x.wake.wake_cnt = wake_cnt;
 470         sctp_clog.x.wake.flight = stcb->asoc.total_flight_count;
 471         sctp_clog.x.wake.send_q = stcb->asoc.send_queue_cnt;
 472         sctp_clog.x.wake.sent_q = stcb->asoc.sent_queue_cnt;
 473
 474         if (stcb->asoc.stream_queue_cnt < 0xff)
 475                 sctp_clog.x.wake.stream_qcnt = (uint8_t)stcb->asoc.stream_queue_cnt;
 476         else
 477                 sctp_clog.x.wake.stream_qcnt = 0xff;
 478
 479         if (stcb->asoc.chunks_on_out_queue < 0xff)
 480                 sctp_clog.x.wake.chunks_on_oque = (uint8_t)stcb->asoc.chunks_on_out_queue;
 481         else
 482                 sctp_clog.x.wake.chunks_on_oque = 0xff;
 483
 484         sctp_clog.x.wake.sctpflags = 0;
 485         /* set in the defered mode stuff */
 486         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE)
 487                 sctp_clog.x.wake.sctpflags |= 1;
 488         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT)
 489                 sctp_clog.x.wake.sctpflags |= 2;
 490         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT)
 491                 sctp_clog.x.wake.sctpflags |= 4;
 492         /* what about the sb */
 493         if (stcb->sctp_socket) {
 494                 struct socket *so = stcb->sctp_socket;
 495
 496                 sctp_clog.x.wake.sbflags = (uint8_t)((so->so_snd.sb_flags & 0x00ff));
 497         } else {
 498                 sctp_clog.x.wake.sbflags = 0xff;
 499         }
 500         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 501             SCTP_LOG_EVENT_WAKE,
 502             from,
 503             sctp_clog.x.misc.log1,
 504             sctp_clog.x.misc.log2,
 505             sctp_clog.x.misc.log3,
 506             sctp_clog.x.misc.log4);
 507 }
 508
 509 void
 510 sctp_log_block(uint8_t from, struct sctp_association *asoc, size_t sendlen)
 511 {
 512         struct sctp_cwnd_log sctp_clog;
 513
 514         sctp_clog.x.blk.onsb = asoc->total_output_queue_size;
 515         sctp_clog.x.blk.send_sent_qcnt = (uint16_t)(asoc->send_queue_cnt + asoc->sent_queue_cnt);
 516         sctp_clog.x.blk.peer_rwnd = asoc->peers_rwnd;
 517         sctp_clog.x.blk.stream_qcnt = (uint16_t)asoc->stream_queue_cnt;
 518         sctp_clog.x.blk.chunks_on_oque = (uint16_t)asoc->chunks_on_out_queue;
 519         sctp_clog.x.blk.flight_size = (uint16_t)(asoc->total_flight / 1024);
 520         sctp_clog.x.blk.sndlen = (uint32_t)sendlen;
 521         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 522             SCTP_LOG_EVENT_BLOCK,
 523             from,
 524             sctp_clog.x.misc.log1,
 525             sctp_clog.x.misc.log2,
 526             sctp_clog.x.misc.log3,
 527             sctp_clog.x.misc.log4);
 528 }
 529
 530 int
 531 sctp_fill_stat_log(void *optval SCTP_UNUSED, size_t *optsize SCTP_UNUSED)
 532 {
 533         /* May need to fix this if ktrdump does not work */
 534         return (0);
 535 }
 536
 537 #ifdef SCTP_AUDITING_ENABLED
 538 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2];
 539 static int sctp_audit_indx = 0;
 540
 541 static
 542 void
 543 sctp_print_audit_report(void)
 544 {
 545         int i;
 546         int cnt;
 547
 548         cnt = 0;
 549         for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) {
 550                 if ((sctp_audit_data[i][0] == 0xe0) &&
 551                     (sctp_audit_data[i][1] == 0x01)) {
 552                         cnt = 0;
 553                         SCTP_PRINTF("\n");
 554                 } else if (sctp_audit_data[i][0] == 0xf0) {
 555                         cnt = 0;
 556                         SCTP_PRINTF("\n");
 557                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 558                     (sctp_audit_data[i][1] == 0x01)) {
 559                         SCTP_PRINTF("\n");
 560                         cnt = 0;
 561                 }
 562                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0],
 563                     (uint32_t)sctp_audit_data[i][1]);
 564                 cnt++;
 565                 if ((cnt % 14) == 0)
 566                         SCTP_PRINTF("\n");
 567         }
 568         for (i = 0; i < sctp_audit_indx; i++) {
 569                 if ((sctp_audit_data[i][0] == 0xe0) &&
 570                     (sctp_audit_data[i][1] == 0x01)) {
 571                         cnt = 0;
 572                         SCTP_PRINTF("\n");
 573                 } else if (sctp_audit_data[i][0] == 0xf0) {
 574                         cnt = 0;
 575                         SCTP_PRINTF("\n");
 576                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 577                     (sctp_audit_data[i][1] == 0x01)) {
 578                         SCTP_PRINTF("\n");
 579                         cnt = 0;
 580                 }
 581                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t)sctp_audit_data[i][0],
 582                     (uint32_t)sctp_audit_data[i][1]);
 583                 cnt++;
 584                 if ((cnt % 14) == 0)
 585                         SCTP_PRINTF("\n");
 586         }
 587         SCTP_PRINTF("\n");
 588 }
 589
 590 void
 591 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 592     struct sctp_nets *net)
 593 {
 594         int resend_cnt, tot_out, rep, tot_book_cnt;
 595         struct sctp_nets *lnet;
 596         struct sctp_tmit_chunk *chk;
 597
 598         sctp_audit_data[sctp_audit_indx][0] = 0xAA;
 599         sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from;
 600         sctp_audit_indx++;
 601         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 602                 sctp_audit_indx = 0;
 603         }
 604         if (inp == NULL) {
 605                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 606                 sctp_audit_data[sctp_audit_indx][1] = 0x01;
 607                 sctp_audit_indx++;
 608                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 609                         sctp_audit_indx = 0;
 610                 }
 611                 return;
 612         }
 613         if (stcb == NULL) {
 614                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 615                 sctp_audit_data[sctp_audit_indx][1] = 0x02;
 616                 sctp_audit_indx++;
 617                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 618                         sctp_audit_indx = 0;
 619                 }
 620                 return;
 621         }
 622         sctp_audit_data[sctp_audit_indx][0] = 0xA1;
 623         sctp_audit_data[sctp_audit_indx][1] =
 624             (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 625         sctp_audit_indx++;
 626         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 627                 sctp_audit_indx = 0;
 628         }
 629         rep = 0;
 630         tot_book_cnt = 0;
 631         resend_cnt = tot_out = 0;
 632         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 633                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 634                         resend_cnt++;
 635                 } else if (chk->sent < SCTP_DATAGRAM_RESEND) {
 636                         tot_out += chk->book_size;
 637                         tot_book_cnt++;
 638                 }
 639         }
 640         if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) {
 641                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 642                 sctp_audit_data[sctp_audit_indx][1] = 0xA1;
 643                 sctp_audit_indx++;
 644                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 645                         sctp_audit_indx = 0;
 646                 }
 647                 SCTP_PRINTF("resend_cnt:%d asoc-tot:%d\n",
 648                     resend_cnt, stcb->asoc.sent_queue_retran_cnt);
 649                 rep = 1;
 650                 stcb->asoc.sent_queue_retran_cnt = resend_cnt;
 651                 sctp_audit_data[sctp_audit_indx][0] = 0xA2;
 652                 sctp_audit_data[sctp_audit_indx][1] =
 653                     (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 654                 sctp_audit_indx++;
 655                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 656                         sctp_audit_indx = 0;
 657                 }
 658         }
 659         if (tot_out != stcb->asoc.total_flight) {
 660                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 661                 sctp_audit_data[sctp_audit_indx][1] = 0xA2;
 662                 sctp_audit_indx++;
 663                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 664                         sctp_audit_indx = 0;
 665                 }
 666                 rep = 1;
 667                 SCTP_PRINTF("tot_flt:%d asoc_tot:%d\n", tot_out,
 668                     (int)stcb->asoc.total_flight);
 669                 stcb->asoc.total_flight = tot_out;
 670         }
 671         if (tot_book_cnt != stcb->asoc.total_flight_count) {
 672                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 673                 sctp_audit_data[sctp_audit_indx][1] = 0xA5;
 674                 sctp_audit_indx++;
 675                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 676                         sctp_audit_indx = 0;
 677                 }
 678                 rep = 1;
 679                 SCTP_PRINTF("tot_flt_book:%d\n", tot_book_cnt);
 680
 681                 stcb->asoc.total_flight_count = tot_book_cnt;
 682         }
 683         tot_out = 0;
 684         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 685                 tot_out += lnet->flight_size;
 686         }
 687         if (tot_out != stcb->asoc.total_flight) {
 688                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 689                 sctp_audit_data[sctp_audit_indx][1] = 0xA3;
 690                 sctp_audit_indx++;
 691                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 692                         sctp_audit_indx = 0;
 693                 }
 694                 rep = 1;
 695                 SCTP_PRINTF("real flight:%d net total was %d\n",
 696                     stcb->asoc.total_flight, tot_out);
 697                 /* now corrective action */
 698                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 699
 700                         tot_out = 0;
 701                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 702                                 if ((chk->whoTo == lnet) &&
 703                                     (chk->sent < SCTP_DATAGRAM_RESEND)) {
 704                                         tot_out += chk->book_size;
 705                                 }
 706                         }
 707                         if (lnet->flight_size != tot_out) {
 708                                 SCTP_PRINTF("net:%p flight was %d corrected to %d\n",
 709                                     (void *)lnet, lnet->flight_size,
 710                                     tot_out);
 711                                 lnet->flight_size = tot_out;
 712                         }
 713                 }
 714         }
 715         if (rep) {
 716                 sctp_print_audit_report();
 717         }
 718 }
 719
 720 void
 721 sctp_audit_log(uint8_t ev, uint8_t fd)
 722 {
 723
 724         sctp_audit_data[sctp_audit_indx][0] = ev;
 725         sctp_audit_data[sctp_audit_indx][1] = fd;
 726         sctp_audit_indx++;
 727         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 728                 sctp_audit_indx = 0;
 729         }
 730 }
 731
 732 #endif
 733
 734 /*
 735  * sctp_stop_timers_for_shutdown() should be called
 736  * when entering the SHUTDOWN_SENT or SHUTDOWN_ACK_SENT
 737  * state to make sure that all timers are stopped.
 738  */
 739 void
 740 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb)
 741 {
 742         struct sctp_association *asoc;
 743         struct sctp_nets *net;
 744
 745         asoc = &stcb->asoc;
 746
 747         (void)SCTP_OS_TIMER_STOP(&asoc->dack_timer.timer);
 748         (void)SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
 749         (void)SCTP_OS_TIMER_STOP(&asoc->asconf_timer.timer);
 750         (void)SCTP_OS_TIMER_STOP(&asoc->autoclose_timer.timer);
 751         (void)SCTP_OS_TIMER_STOP(&asoc->delayed_event_timer.timer);
 752         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
 753                 (void)SCTP_OS_TIMER_STOP(&net->pmtu_timer.timer);
 754                 (void)SCTP_OS_TIMER_STOP(&net->hb_timer.timer);
 755         }
 756 }
 757
 758 /*
 759  * a list of sizes based on typical mtu's, used only if next hop size not
 760  * returned.
 761  */
 762 static uint32_t sctp_mtu_sizes[] = {
 763         68,
 764         296,
 765         508,
 766         512,
 767         544,
 768         576,
 769         1006,
 770         1492,
 771         1500,
 772         1536,
 773         2002,
 774         2048,
 775         4352,
 776         4464,
 777         8166,
 778         17914,
 779         32000,
 780         65535
 781 };
 782
 783 /*
 784  * Return the largest MTU smaller than val. If there is no
 785  * entry, just return val.
 786  */
 787 uint32_t
 788 sctp_get_prev_mtu(uint32_t val)
 789 {
 790         uint32_t i;
 791
 792         if (val <= sctp_mtu_sizes[0]) {
 793                 return (val);
 794         }
 795         for (i = 1; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 796                 if (val <= sctp_mtu_sizes[i]) {
 797                         break;
 798                 }
 799         }
 800         return (sctp_mtu_sizes[i - 1]);
 801 }
 802
 803 /*
 804  * Return the smallest MTU larger than val. If there is no
 805  * entry, just return val.
 806  */
 807 uint32_t
 808 sctp_get_next_mtu(uint32_t val)
 809 {
 810         /* select another MTU that is just bigger than this one */
 811         uint32_t i;
 812
 813         for (i = 0; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 814                 if (val < sctp_mtu_sizes[i]) {
 815                         return (sctp_mtu_sizes[i]);
 816                 }
 817         }
 818         return (val);
 819 }
 820
 821 void
 822 sctp_fill_random_store(struct sctp_pcb *m)
 823 {
 824         /*
 825          * Here we use the MD5/SHA-1 to hash with our good randomNumbers and
 826          * our counter. The result becomes our good random numbers and we
 827          * then setup to give these out. Note that we do no locking to
 828          * protect this. This is ok, since if competing folks call this we
 829          * will get more gobbled gook in the random store which is what we
 830          * want. There is a danger that two guys will use the same random
 831          * numbers, but thats ok too since that is random as well :->
 832          */
 833         m->store_at = 0;
 834         (void)sctp_hmac(SCTP_HMAC, (uint8_t *)m->random_numbers,
 835             sizeof(m->random_numbers), (uint8_t *)&m->random_counter,
 836             sizeof(m->random_counter), (uint8_t *)m->random_store);
 837         m->random_counter++;
 838 }
 839
 840 uint32_t
 841 sctp_select_initial_TSN(struct sctp_pcb *inp)
 842 {
 843         /*
 844          * A true implementation should use random selection process to get
 845          * the initial stream sequence number, using RFC1750 as a good
 846          * guideline
 847          */
 848         uint32_t x, *xp;
 849         uint8_t *p;
 850         int store_at, new_store;
 851
 852         if (inp->initial_sequence_debug != 0) {
 853                 uint32_t ret;
 854
 855                 ret = inp->initial_sequence_debug;
 856                 inp->initial_sequence_debug++;
 857                 return (ret);
 858         }
 859 retry:
 860         store_at = inp->store_at;
 861         new_store = store_at + sizeof(uint32_t);
 862         if (new_store >= (SCTP_SIGNATURE_SIZE - 3)) {
 863                 new_store = 0;
 864         }
 865         if (!atomic_cmpset_int(&inp->store_at, store_at, new_store)) {
 866                 goto retry;
 867         }
 868         if (new_store == 0) {
 869                 /* Refill the random store */
 870                 sctp_fill_random_store(inp);
 871         }
 872         p = &inp->random_store[store_at];
 873         xp = (uint32_t *)p;
 874         x = *xp;
 875         return (x);
 876 }
 877
 878 uint32_t
 879 sctp_select_a_tag(struct sctp_inpcb *inp, uint16_t lport, uint16_t rport, int check)
 880 {
 881         uint32_t x;
 882         struct timeval now;
 883
 884         if (check) {
 885                 (void)SCTP_GETTIME_TIMEVAL(&now);
 886         }
 887         for (;;) {
 888                 x = sctp_select_initial_TSN(&inp->sctp_ep);
 889                 if (x == 0) {
 890                         /* we never use 0 */
 891                         continue;
 892                 }
 893                 if (!check || sctp_is_vtag_good(x, lport, rport, &now)) {
 894                         break;
 895                 }
 896         }
 897         return (x);
 898 }
 899
 900 int32_t
 901 sctp_map_assoc_state(int kernel_state)
 902 {
 903         int32_t user_state;
 904
 905         if (kernel_state & SCTP_STATE_WAS_ABORTED) {
 906                 user_state = SCTP_CLOSED;
 907         } else if (kernel_state & SCTP_STATE_SHUTDOWN_PENDING) {
 908                 user_state = SCTP_SHUTDOWN_PENDING;
 909         } else {
 910                 switch (kernel_state & SCTP_STATE_MASK) {
 911                 case SCTP_STATE_EMPTY:
 912                         user_state = SCTP_CLOSED;
 913                         break;
 914                 case SCTP_STATE_INUSE:
 915                         user_state = SCTP_CLOSED;
 916                         break;
 917                 case SCTP_STATE_COOKIE_WAIT:
 918                         user_state = SCTP_COOKIE_WAIT;
 919                         break;
 920                 case SCTP_STATE_COOKIE_ECHOED:
 921                         user_state = SCTP_COOKIE_ECHOED;
 922                         break;
 923                 case SCTP_STATE_OPEN:
 924                         user_state = SCTP_ESTABLISHED;
 925                         break;
 926                 case SCTP_STATE_SHUTDOWN_SENT:
 927                         user_state = SCTP_SHUTDOWN_SENT;
 928                         break;
 929                 case SCTP_STATE_SHUTDOWN_RECEIVED:
 930                         user_state = SCTP_SHUTDOWN_RECEIVED;
 931                         break;
 932                 case SCTP_STATE_SHUTDOWN_ACK_SENT:
 933                         user_state = SCTP_SHUTDOWN_ACK_SENT;
 934                         break;
 935                 default:
 936                         user_state = SCTP_CLOSED;
 937                         break;
 938                 }
 939         }
 940         return (user_state);
 941 }
 942
 943 int
 944 sctp_init_asoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 945     uint32_t override_tag, uint32_t vrf_id, uint16_t o_strms)
 946 {
 947         struct sctp_association *asoc;
 948
 949         /*
 950          * Anything set to zero is taken care of by the allocation routine's
 951          * bzero
 952          */
 953
 954         /*
 955          * Up front select what scoping to apply on addresses I tell my peer
 956          * Not sure what to do with these right now, we will need to come up
 957          * with a way to set them. We may need to pass them through from the
 958          * caller in the sctp_aloc_assoc() function.
 959          */
 960         int i;
 961 #if defined(SCTP_DETAILED_STR_STATS)
 962         int j;
 963 #endif
 964
 965         asoc = &stcb->asoc;
 966         /* init all variables to a known value. */
 967         SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_INUSE);
 968         asoc->max_burst = inp->sctp_ep.max_burst;
 969         asoc->fr_max_burst = inp->sctp_ep.fr_max_burst;
 970         asoc->heart_beat_delay = TICKS_TO_MSEC(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]);
 971         asoc->cookie_life = inp->sctp_ep.def_cookie_life;
 972         asoc->sctp_cmt_on_off = inp->sctp_cmt_on_off;
 973         asoc->ecn_supported = inp->ecn_supported;
 974         asoc->prsctp_supported = inp->prsctp_supported;
 975         asoc->idata_supported = inp->idata_supported;
 976         asoc->auth_supported = inp->auth_supported;
 977         asoc->asconf_supported = inp->asconf_supported;
 978         asoc->reconfig_supported = inp->reconfig_supported;
 979         asoc->nrsack_supported = inp->nrsack_supported;
 980         asoc->pktdrop_supported = inp->pktdrop_supported;
 981         asoc->idata_supported = inp->idata_supported;
 982         asoc->sctp_cmt_pf = (uint8_t)0;
 983         asoc->sctp_frag_point = inp->sctp_frag_point;
 984         asoc->sctp_features = inp->sctp_features;
 985         asoc->default_dscp = inp->sctp_ep.default_dscp;
 986         asoc->max_cwnd = inp->max_cwnd;
 987 #ifdef INET6
 988         if (inp->sctp_ep.default_flowlabel) {
 989                 asoc->default_flowlabel = inp->sctp_ep.default_flowlabel;
 990         } else {
 991                 if (inp->ip_inp.inp.inp_flags & IN6P_AUTOFLOWLABEL) {
 992                         asoc->default_flowlabel = sctp_select_initial_TSN(&inp->sctp_ep);
 993                         asoc->default_flowlabel &= 0x000fffff;
 994                         asoc->default_flowlabel |= 0x80000000;
 995                 } else {
 996                         asoc->default_flowlabel = 0;
 997                 }
 998         }
 999 #endif
1000         asoc->sb_send_resv = 0;
1001         if (override_tag) {
1002                 asoc->my_vtag = override_tag;
1003         } else {
1004                 asoc->my_vtag = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
1005         }
1006         /* Get the nonce tags */
1007         asoc->my_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
1008         asoc->peer_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
1009         asoc->vrf_id = vrf_id;
1010
1011 #ifdef SCTP_ASOCLOG_OF_TSNS
1012         asoc->tsn_in_at = 0;
1013         asoc->tsn_out_at = 0;
1014         asoc->tsn_in_wrapped = 0;
1015         asoc->tsn_out_wrapped = 0;
1016         asoc->cumack_log_at = 0;
1017         asoc->cumack_log_atsnt = 0;
1018 #endif
1019 #ifdef SCTP_FS_SPEC_LOG
1020         asoc->fs_index = 0;
1021 #endif
1022         asoc->refcnt = 0;
1023         asoc->assoc_up_sent = 0;
1024         asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number = asoc->sending_seq =
1025             sctp_select_initial_TSN(&inp->sctp_ep);
1026         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
1027         /* we are optimisitic here */
1028         asoc->peer_supports_nat = 0;
1029         asoc->sent_queue_retran_cnt = 0;
1030
1031         /* for CMT */
1032         asoc->last_net_cmt_send_started = NULL;
1033
1034         /* This will need to be adjusted */
1035         asoc->last_acked_seq = asoc->init_seq_number - 1;
1036         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1037         asoc->asconf_seq_in = asoc->last_acked_seq;
1038
1039         /* here we are different, we hold the next one we expect */
1040         asoc->str_reset_seq_in = asoc->last_acked_seq + 1;
1041
1042         asoc->initial_init_rto_max = inp->sctp_ep.initial_init_rto_max;
1043         asoc->initial_rto = inp->sctp_ep.initial_rto;
1044
1045         asoc->max_init_times = inp->sctp_ep.max_init_times;
1046         asoc->max_send_times = inp->sctp_ep.max_send_times;
1047         asoc->def_net_failure = inp->sctp_ep.def_net_failure;
1048         asoc->def_net_pf_threshold = inp->sctp_ep.def_net_pf_threshold;
1049         asoc->free_chunk_cnt = 0;
1050
1051         asoc->iam_blocking = 0;
1052         asoc->context = inp->sctp_context;
1053         asoc->local_strreset_support = inp->local_strreset_support;
1054         asoc->def_send = inp->def_send;
1055         asoc->delayed_ack = TICKS_TO_MSEC(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]);
1056         asoc->sack_freq = inp->sctp_ep.sctp_sack_freq;
1057         asoc->pr_sctp_cnt = 0;
1058         asoc->total_output_queue_size = 0;
1059
1060         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1061                 asoc->scope.ipv6_addr_legal = 1;
1062                 if (SCTP_IPV6_V6ONLY(inp) == 0) {
1063                         asoc->scope.ipv4_addr_legal = 1;
1064                 } else {
1065                         asoc->scope.ipv4_addr_legal = 0;
1066                 }
1067         } else {
1068                 asoc->scope.ipv6_addr_legal = 0;
1069                 asoc->scope.ipv4_addr_legal = 1;
1070         }
1071
1072         asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(inp->sctp_socket), SCTP_MINIMAL_RWND);
1073         asoc->peers_rwnd = SCTP_SB_LIMIT_RCV(inp->sctp_socket);
1074
1075         asoc->smallest_mtu = inp->sctp_frag_point;
1076         asoc->minrto = inp->sctp_ep.sctp_minrto;
1077         asoc->maxrto = inp->sctp_ep.sctp_maxrto;
1078
1079         asoc->stream_locked_on = 0;
1080         asoc->ecn_echo_cnt_onq = 0;
1081         asoc->stream_locked = 0;
1082
1083         asoc->send_sack = 1;
1084
1085         LIST_INIT(&asoc->sctp_restricted_addrs);
1086
1087         TAILQ_INIT(&asoc->nets);
1088         TAILQ_INIT(&asoc->pending_reply_queue);
1089         TAILQ_INIT(&asoc->asconf_ack_sent);
1090         /* Setup to fill the hb random cache at first HB */
1091         asoc->hb_random_idx = 4;
1092
1093         asoc->sctp_autoclose_ticks = inp->sctp_ep.auto_close_time;
1094
1095         stcb->asoc.congestion_control_module = inp->sctp_ep.sctp_default_cc_module;
1096         stcb->asoc.cc_functions = sctp_cc_functions[inp->sctp_ep.sctp_default_cc_module];
1097
1098         stcb->asoc.stream_scheduling_module = inp->sctp_ep.sctp_default_ss_module;
1099         stcb->asoc.ss_functions = sctp_ss_functions[inp->sctp_ep.sctp_default_ss_module];
1100
1101         /*
1102          * Now the stream parameters, here we allocate space for all streams
1103          * that we request by default.
1104          */
1105         asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams =
1106             o_strms;
1107         SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *,
1108             asoc->streamoutcnt * sizeof(struct sctp_stream_out),
1109             SCTP_M_STRMO);
1110         if (asoc->strmout == NULL) {
1111                 /* big trouble no memory */
1112                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1113                 return (ENOMEM);
1114         }
1115         for (i = 0; i < asoc->streamoutcnt; i++) {
1116                 /*
1117                  * inbound side must be set to 0xffff, also NOTE when we get
1118                  * the INIT-ACK back (for INIT sender) we MUST reduce the
1119                  * count (streamoutcnt) but first check if we sent to any of
1120                  * the upper streams that were dropped (if some were). Those
1121                  * that were dropped must be notified to the upper layer as
1122                  * failed to send.
1123                  */
1124                 asoc->strmout[i].next_mid_ordered = 0;
1125                 asoc->strmout[i].next_mid_unordered = 0;
1126                 TAILQ_INIT(&asoc->strmout[i].outqueue);
1127                 asoc->strmout[i].chunks_on_queues = 0;
1128 #if defined(SCTP_DETAILED_STR_STATS)
1129                 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) {
1130                         asoc->strmout[i].abandoned_sent[j] = 0;
1131                         asoc->strmout[i].abandoned_unsent[j] = 0;
1132                 }
1133 #else
1134                 asoc->strmout[i].abandoned_sent[0] = 0;
1135                 asoc->strmout[i].abandoned_unsent[0] = 0;
1136 #endif
1137                 asoc->strmout[i].sid = i;
1138                 asoc->strmout[i].last_msg_incomplete = 0;
1139                 asoc->strmout[i].state = SCTP_STREAM_OPENING;
1140                 asoc->ss_functions.sctp_ss_init_stream(stcb, &asoc->strmout[i], NULL);
1141         }
1142         asoc->ss_functions.sctp_ss_init(stcb, asoc, 0);
1143
1144         /* Now the mapping array */
1145         asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY;
1146         SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size,
1147             SCTP_M_MAP);
1148         if (asoc->mapping_array == NULL) {
1149                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1150                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1151                 return (ENOMEM);
1152         }
1153         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
1154         SCTP_MALLOC(asoc->nr_mapping_array, uint8_t *, asoc->mapping_array_size,
1155             SCTP_M_MAP);
1156         if (asoc->nr_mapping_array == NULL) {
1157                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1158                 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1159                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1160                 return (ENOMEM);
1161         }
1162         memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
1163
1164         /* Now the init of the other outqueues */
1165         TAILQ_INIT(&asoc->free_chunks);
1166         TAILQ_INIT(&asoc->control_send_queue);
1167         TAILQ_INIT(&asoc->asconf_send_queue);
1168         TAILQ_INIT(&asoc->send_queue);
1169         TAILQ_INIT(&asoc->sent_queue);
1170         TAILQ_INIT(&asoc->resetHead);
1171         asoc->max_inbound_streams = inp->sctp_ep.max_open_streams_intome;
1172         TAILQ_INIT(&asoc->asconf_queue);
1173         /* authentication fields */
1174         asoc->authinfo.random = NULL;
1175         asoc->authinfo.active_keyid = 0;
1176         asoc->authinfo.assoc_key = NULL;
1177         asoc->authinfo.assoc_keyid = 0;
1178         asoc->authinfo.recv_key = NULL;
1179         asoc->authinfo.recv_keyid = 0;
1180         LIST_INIT(&asoc->shared_keys);
1181         asoc->marked_retrans = 0;
1182         asoc->port = inp->sctp_ep.port;
1183         asoc->timoinit = 0;
1184         asoc->timodata = 0;
1185         asoc->timosack = 0;
1186         asoc->timoshutdown = 0;
1187         asoc->timoheartbeat = 0;
1188         asoc->timocookie = 0;
1189         asoc->timoshutdownack = 0;
1190         (void)SCTP_GETTIME_TIMEVAL(&asoc->start_time);
1191         asoc->discontinuity_time = asoc->start_time;
1192         for (i = 0; i < SCTP_PR_SCTP_MAX + 1; i++) {
1193                 asoc->abandoned_unsent[i] = 0;
1194                 asoc->abandoned_sent[i] = 0;
1195         }
1196         /*
1197          * sa_ignore MEMLEAK {memory is put in the assoc mapping array and
1198          * freed later when the association is freed.
1199          */
1200         return (0);
1201 }
1202
1203 void
1204 sctp_print_mapping_array(struct sctp_association *asoc)
1205 {
1206         unsigned int i, limit;
1207
1208         SCTP_PRINTF("Mapping array size: %d, baseTSN: %8.8x, cumAck: %8.8x, highestTSN: (%8.8x, %8.8x).\n",
1209             asoc->mapping_array_size,
1210             asoc->mapping_array_base_tsn,
1211             asoc->cumulative_tsn,
1212             asoc->highest_tsn_inside_map,
1213             asoc->highest_tsn_inside_nr_map);
1214         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1215                 if (asoc->mapping_array[limit - 1] != 0) {
1216                         break;
1217                 }
1218         }
1219         SCTP_PRINTF("Renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1220         for (i = 0; i < limit; i++) {
1221                 SCTP_PRINTF("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1222         }
1223         if (limit % 16)
1224                 SCTP_PRINTF("\n");
1225         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1226                 if (asoc->nr_mapping_array[limit - 1]) {
1227                         break;
1228                 }
1229         }
1230         SCTP_PRINTF("Non renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1231         for (i = 0; i < limit; i++) {
1232                 SCTP_PRINTF("%2.2x%c", asoc->nr_mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1233         }
1234         if (limit % 16)
1235                 SCTP_PRINTF("\n");
1236 }
1237
1238 int
1239 sctp_expand_mapping_array(struct sctp_association *asoc, uint32_t needed)
1240 {
1241         /* mapping array needs to grow */
1242         uint8_t *new_array1, *new_array2;
1243         uint32_t new_size;
1244
1245         new_size = asoc->mapping_array_size + ((needed + 7) / 8 + SCTP_MAPPING_ARRAY_INCR);
1246         SCTP_MALLOC(new_array1, uint8_t *, new_size, SCTP_M_MAP);
1247         SCTP_MALLOC(new_array2, uint8_t *, new_size, SCTP_M_MAP);
1248         if ((new_array1 == NULL) || (new_array2 == NULL)) {
1249                 /* can't get more, forget it */
1250                 SCTP_PRINTF("No memory for expansion of SCTP mapping array %d\n", new_size);
1251                 if (new_array1) {
1252                         SCTP_FREE(new_array1, SCTP_M_MAP);
1253                 }
1254                 if (new_array2) {
1255                         SCTP_FREE(new_array2, SCTP_M_MAP);
1256                 }
1257                 return (-1);
1258         }
1259         memset(new_array1, 0, new_size);
1260         memset(new_array2, 0, new_size);
1261         memcpy(new_array1, asoc->mapping_array, asoc->mapping_array_size);
1262         memcpy(new_array2, asoc->nr_mapping_array, asoc->mapping_array_size);
1263         SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1264         SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
1265         asoc->mapping_array = new_array1;
1266         asoc->nr_mapping_array = new_array2;
1267         asoc->mapping_array_size = new_size;
1268         return (0);
1269 }
1270
1271
1272 static void
1273 sctp_iterator_work(struct sctp_iterator *it)
1274 {
1275         int iteration_count = 0;
1276         int inp_skip = 0;
1277         int first_in = 1;
1278         struct sctp_inpcb *tinp;
1279
1280         SCTP_INP_INFO_RLOCK();
1281         SCTP_ITERATOR_LOCK();
1282         sctp_it_ctl.cur_it = it;
1283         if (it->inp) {
1284                 SCTP_INP_RLOCK(it->inp);
1285                 SCTP_INP_DECR_REF(it->inp);
1286         }
1287         if (it->inp == NULL) {
1288                 /* iterator is complete */
1289 done_with_iterator:
1290                 sctp_it_ctl.cur_it = NULL;
1291                 SCTP_ITERATOR_UNLOCK();
1292                 SCTP_INP_INFO_RUNLOCK();
1293                 if (it->function_atend != NULL) {
1294                         (*it->function_atend) (it->pointer, it->val);
1295                 }
1296                 SCTP_FREE(it, SCTP_M_ITER);
1297                 return;
1298         }
1299 select_a_new_ep:
1300         if (first_in) {
1301                 first_in = 0;
1302         } else {
1303                 SCTP_INP_RLOCK(it->inp);
1304         }
1305         while (((it->pcb_flags) &&
1306             ((it->inp->sctp_flags & it->pcb_flags) != it->pcb_flags)) ||
1307             ((it->pcb_features) &&
1308             ((it->inp->sctp_features & it->pcb_features) != it->pcb_features))) {
1309                 /* endpoint flags or features don't match, so keep looking */
1310                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1311                         SCTP_INP_RUNLOCK(it->inp);
1312                         goto done_with_iterator;
1313                 }
1314                 tinp = it->inp;
1315                 it->inp = LIST_NEXT(it->inp, sctp_list);
1316                 SCTP_INP_RUNLOCK(tinp);
1317                 if (it->inp == NULL) {
1318                         goto done_with_iterator;
1319                 }
1320                 SCTP_INP_RLOCK(it->inp);
1321         }
1322         /* now go through each assoc which is in the desired state */
1323         if (it->done_current_ep == 0) {
1324                 if (it->function_inp != NULL)
1325                         inp_skip = (*it->function_inp) (it->inp, it->pointer, it->val);
1326                 it->done_current_ep = 1;
1327         }
1328         if (it->stcb == NULL) {
1329                 /* run the per instance function */
1330                 it->stcb = LIST_FIRST(&it->inp->sctp_asoc_list);
1331         }
1332         if ((inp_skip) || it->stcb == NULL) {
1333                 if (it->function_inp_end != NULL) {
1334                         inp_skip = (*it->function_inp_end) (it->inp,
1335                             it->pointer,
1336                             it->val);
1337                 }
1338                 SCTP_INP_RUNLOCK(it->inp);
1339                 goto no_stcb;
1340         }
1341         while (it->stcb) {
1342                 SCTP_TCB_LOCK(it->stcb);
1343                 if (it->asoc_state && ((it->stcb->asoc.state & it->asoc_state) != it->asoc_state)) {
1344                         /* not in the right state... keep looking */
1345                         SCTP_TCB_UNLOCK(it->stcb);
1346                         goto next_assoc;
1347                 }
1348                 /* see if we have limited out the iterator loop */
1349                 iteration_count++;
1350                 if (iteration_count > SCTP_ITERATOR_MAX_AT_ONCE) {
1351                         /* Pause to let others grab the lock */
1352                         atomic_add_int(&it->stcb->asoc.refcnt, 1);
1353                         SCTP_TCB_UNLOCK(it->stcb);
1354                         SCTP_INP_INCR_REF(it->inp);
1355                         SCTP_INP_RUNLOCK(it->inp);
1356                         SCTP_ITERATOR_UNLOCK();
1357                         SCTP_INP_INFO_RUNLOCK();
1358                         SCTP_INP_INFO_RLOCK();
1359                         SCTP_ITERATOR_LOCK();
1360                         if (sctp_it_ctl.iterator_flags) {
1361                                 /* We won't be staying here */
1362                                 SCTP_INP_DECR_REF(it->inp);
1363                                 atomic_add_int(&it->stcb->asoc.refcnt, -1);
1364                                 if (sctp_it_ctl.iterator_flags &
1365                                     SCTP_ITERATOR_STOP_CUR_IT) {
1366                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_IT;
1367                                         goto done_with_iterator;
1368                                 }
1369                                 if (sctp_it_ctl.iterator_flags &
1370                                     SCTP_ITERATOR_STOP_CUR_INP) {
1371                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_INP;
1372                                         goto no_stcb;
1373                                 }
1374                                 /* If we reach here huh? */
1375                                 SCTP_PRINTF("Unknown it ctl flag %x\n",
1376                                     sctp_it_ctl.iterator_flags);
1377                                 sctp_it_ctl.iterator_flags = 0;
1378                         }
1379                         SCTP_INP_RLOCK(it->inp);
1380                         SCTP_INP_DECR_REF(it->inp);
1381                         SCTP_TCB_LOCK(it->stcb);
1382                         atomic_add_int(&it->stcb->asoc.refcnt, -1);
1383                         iteration_count = 0;
1384                 }
1385                 /* run function on this one */
1386                 (*it->function_assoc) (it->inp, it->stcb, it->pointer, it->val);
1387
1388                 /*
1389                  * we lie here, it really needs to have its own type but
1390                  * first I must verify that this won't effect things :-0
1391                  */
1392                 if (it->no_chunk_output == 0)
1393                         sctp_chunk_output(it->inp, it->stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1394
1395                 SCTP_TCB_UNLOCK(it->stcb);
1396 next_assoc:
1397                 it->stcb = LIST_NEXT(it->stcb, sctp_tcblist);
1398                 if (it->stcb == NULL) {
1399                         /* Run last function */
1400                         if (it->function_inp_end != NULL) {
1401                                 inp_skip = (*it->function_inp_end) (it->inp,
1402                                     it->pointer,
1403                                     it->val);
1404                         }
1405                 }
1406         }
1407         SCTP_INP_RUNLOCK(it->inp);
1408 no_stcb:
1409         /* done with all assocs on this endpoint, move on to next endpoint */
1410         it->done_current_ep = 0;
1411         if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1412                 it->inp = NULL;
1413         } else {
1414                 it->inp = LIST_NEXT(it->inp, sctp_list);
1415         }
1416         if (it->inp == NULL) {
1417                 goto done_with_iterator;
1418         }
1419         goto select_a_new_ep;
1420 }
1421
1422 void
1423 sctp_iterator_worker(void)
1424 {
1425         struct sctp_iterator *it, *nit;
1426
1427         /* This function is called with the WQ lock in place */
1428
1429         sctp_it_ctl.iterator_running = 1;
1430         TAILQ_FOREACH_SAFE(it, &sctp_it_ctl.iteratorhead, sctp_nxt_itr, nit) {
1431                 /* now lets work on this one */
1432                 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
1433                 SCTP_IPI_ITERATOR_WQ_UNLOCK();
1434                 CURVNET_SET(it->vn);
1435                 sctp_iterator_work(it);
1436                 CURVNET_RESTORE();
1437                 SCTP_IPI_ITERATOR_WQ_LOCK();
1438                 /* sa_ignore FREED_MEMORY */
1439         }
1440         sctp_it_ctl.iterator_running = 0;
1441         return;
1442 }
1443
1444
1445 static void
1446 sctp_handle_addr_wq(void)
1447 {
1448         /* deal with the ADDR wq from the rtsock calls */
1449         struct sctp_laddr *wi, *nwi;
1450         struct sctp_asconf_iterator *asc;
1451
1452         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
1453             sizeof(struct sctp_asconf_iterator), SCTP_M_ASC_IT);
1454         if (asc == NULL) {
1455                 /* Try later, no memory */
1456                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
1457                     (struct sctp_inpcb *)NULL,
1458                     (struct sctp_tcb *)NULL,
1459                     (struct sctp_nets *)NULL);
1460                 return;
1461         }
1462         LIST_INIT(&asc->list_of_work);
1463         asc->cnt = 0;
1464
1465         LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) {
1466                 LIST_REMOVE(wi, sctp_nxt_addr);
1467                 LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
1468                 asc->cnt++;
1469         }
1470
1471         if (asc->cnt == 0) {
1472                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1473         } else {
1474                 int ret;
1475
1476                 ret = sctp_initiate_iterator(sctp_asconf_iterator_ep,
1477                     sctp_asconf_iterator_stcb,
1478                     NULL,       /* No ep end for boundall */
1479                     SCTP_PCB_FLAGS_BOUNDALL,
1480                     SCTP_PCB_ANY_FEATURES,
1481                     SCTP_ASOC_ANY_STATE,
1482                     (void *)asc, 0,
1483                     sctp_asconf_iterator_end, NULL, 0);
1484                 if (ret) {
1485                         SCTP_PRINTF("Failed to initiate iterator for handle_addr_wq\n");
1486                         /*
1487                          * Freeing if we are stopping or put back on the
1488                          * addr_wq.
1489                          */
1490                         if (SCTP_BASE_VAR(sctp_pcb_initialized) == 0) {
1491                                 sctp_asconf_iterator_end(asc, 0);
1492                         } else {
1493                                 LIST_FOREACH(wi, &asc->list_of_work, sctp_nxt_addr) {
1494                                         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
1495                                 }
1496                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1497                         }
1498                 }
1499         }
1500 }
1501
1502 void
1503 sctp_timeout_handler(void *t)
1504 {
1505         struct sctp_inpcb *inp;
1506         struct sctp_tcb *stcb;
1507         struct sctp_nets *net;
1508         struct sctp_timer *tmr;
1509         struct mbuf *op_err;
1510 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1511         struct socket *so;
1512 #endif
1513         int did_output;
1514         int type;
1515
1516         tmr = (struct sctp_timer *)t;
1517         inp = (struct sctp_inpcb *)tmr->ep;
1518         stcb = (struct sctp_tcb *)tmr->tcb;
1519         net = (struct sctp_nets *)tmr->net;
1520         CURVNET_SET((struct vnet *)tmr->vnet);
1521         did_output = 1;
1522
1523 #ifdef SCTP_AUDITING_ENABLED
1524         sctp_audit_log(0xF0, (uint8_t)tmr->type);
1525         sctp_auditing(3, inp, stcb, net);
1526 #endif
1527
1528         /* sanity checks... */
1529         if (tmr->self != (void *)tmr) {
1530                 /*
1531                  * SCTP_PRINTF("Stale SCTP timer fired (%p), ignoring...\n",
1532                  * (void *)tmr);
1533                  */
1534                 CURVNET_RESTORE();
1535                 return;
1536         }
1537         tmr->stopped_from = 0xa001;
1538         if (!SCTP_IS_TIMER_TYPE_VALID(tmr->type)) {
1539                 /*
1540                  * SCTP_PRINTF("SCTP timer fired with invalid type: 0x%x\n",
1541                  * tmr->type);
1542                  */
1543                 CURVNET_RESTORE();
1544                 return;
1545         }
1546         tmr->stopped_from = 0xa002;
1547         if ((tmr->type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL)) {
1548                 CURVNET_RESTORE();
1549                 return;
1550         }
1551         /* if this is an iterator timeout, get the struct and clear inp */
1552         tmr->stopped_from = 0xa003;
1553         if (inp) {
1554                 SCTP_INP_INCR_REF(inp);
1555                 if ((inp->sctp_socket == NULL) &&
1556                     ((tmr->type != SCTP_TIMER_TYPE_INPKILL) &&
1557                     (tmr->type != SCTP_TIMER_TYPE_INIT) &&
1558                     (tmr->type != SCTP_TIMER_TYPE_SEND) &&
1559                     (tmr->type != SCTP_TIMER_TYPE_RECV) &&
1560                     (tmr->type != SCTP_TIMER_TYPE_HEARTBEAT) &&
1561                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWN) &&
1562                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNACK) &&
1563                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNGUARD) &&
1564                     (tmr->type != SCTP_TIMER_TYPE_ASOCKILL))) {
1565                         SCTP_INP_DECR_REF(inp);
1566                         CURVNET_RESTORE();
1567                         return;
1568                 }
1569         }
1570         tmr->stopped_from = 0xa004;
1571         if (stcb) {
1572                 atomic_add_int(&stcb->asoc.refcnt, 1);
1573                 if (stcb->asoc.state == 0) {
1574                         atomic_add_int(&stcb->asoc.refcnt, -1);
1575                         if (inp) {
1576                                 SCTP_INP_DECR_REF(inp);
1577                         }
1578                         CURVNET_RESTORE();
1579                         return;
1580                 }
1581         }
1582         type = tmr->type;
1583         tmr->stopped_from = 0xa005;
1584         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer type %d goes off\n", type);
1585         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1586                 if (inp) {
1587                         SCTP_INP_DECR_REF(inp);
1588                 }
1589                 if (stcb) {
1590                         atomic_add_int(&stcb->asoc.refcnt, -1);
1591                 }
1592                 CURVNET_RESTORE();
1593                 return;
1594         }
1595         tmr->stopped_from = 0xa006;
1596
1597         if (stcb) {
1598                 SCTP_TCB_LOCK(stcb);
1599                 atomic_add_int(&stcb->asoc.refcnt, -1);
1600                 if ((type != SCTP_TIMER_TYPE_ASOCKILL) &&
1601                     ((stcb->asoc.state == 0) ||
1602                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED))) {
1603                         SCTP_TCB_UNLOCK(stcb);
1604                         if (inp) {
1605                                 SCTP_INP_DECR_REF(inp);
1606                         }
1607                         CURVNET_RESTORE();
1608                         return;
1609                 }
1610         } else if (inp != NULL) {
1611                 if (type != SCTP_TIMER_TYPE_INPKILL) {
1612                         SCTP_INP_WLOCK(inp);
1613                 }
1614         } else {
1615                 SCTP_WQ_ADDR_LOCK();
1616         }
1617         /* record in stopped what t-o occurred */
1618         tmr->stopped_from = type;
1619
1620         /* mark as being serviced now */
1621         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
1622                 /*
1623                  * Callout has been rescheduled.
1624                  */
1625                 goto get_out;
1626         }
1627         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1628                 /*
1629                  * Not active, so no action.
1630                  */
1631                 goto get_out;
1632         }
1633         SCTP_OS_TIMER_DEACTIVATE(&tmr->timer);
1634
1635         /* call the handler for the appropriate timer type */
1636         switch (type) {
1637         case SCTP_TIMER_TYPE_ADDR_WQ:
1638                 sctp_handle_addr_wq();
1639                 break;
1640         case SCTP_TIMER_TYPE_SEND:
1641                 if ((stcb == NULL) || (inp == NULL)) {
1642                         break;
1643                 }
1644                 SCTP_STAT_INCR(sctps_timodata);
1645                 stcb->asoc.timodata++;
1646                 stcb->asoc.num_send_timers_up--;
1647                 if (stcb->asoc.num_send_timers_up < 0) {
1648                         stcb->asoc.num_send_timers_up = 0;
1649                 }
1650                 SCTP_TCB_LOCK_ASSERT(stcb);
1651                 if (sctp_t3rxt_timer(inp, stcb, net)) {
1652                         /* no need to unlock on tcb its gone */
1653
1654                         goto out_decr;
1655                 }
1656                 SCTP_TCB_LOCK_ASSERT(stcb);
1657 #ifdef SCTP_AUDITING_ENABLED
1658                 sctp_auditing(4, inp, stcb, net);
1659 #endif
1660                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1661                 if ((stcb->asoc.num_send_timers_up == 0) &&
1662                     (stcb->asoc.sent_queue_cnt > 0)) {
1663                         struct sctp_tmit_chunk *chk;
1664
1665                         /*
1666                          * safeguard. If there on some on the sent queue
1667                          * somewhere but no timers running something is
1668                          * wrong... so we start a timer on the first chunk
1669                          * on the send queue on whatever net it is sent to.
1670                          */
1671                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1672                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb,
1673                             chk->whoTo);
1674                 }
1675                 break;
1676         case SCTP_TIMER_TYPE_INIT:
1677                 if ((stcb == NULL) || (inp == NULL)) {
1678                         break;
1679                 }
1680                 SCTP_STAT_INCR(sctps_timoinit);
1681                 stcb->asoc.timoinit++;
1682                 if (sctp_t1init_timer(inp, stcb, net)) {
1683                         /* no need to unlock on tcb its gone */
1684                         goto out_decr;
1685                 }
1686                 /* We do output but not here */
1687                 did_output = 0;
1688                 break;
1689         case SCTP_TIMER_TYPE_RECV:
1690                 if ((stcb == NULL) || (inp == NULL)) {
1691                         break;
1692                 }
1693                 SCTP_STAT_INCR(sctps_timosack);
1694                 stcb->asoc.timosack++;
1695                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
1696 #ifdef SCTP_AUDITING_ENABLED
1697                 sctp_auditing(4, inp, stcb, net);
1698 #endif
1699                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR, SCTP_SO_NOT_LOCKED);
1700                 break;
1701         case SCTP_TIMER_TYPE_SHUTDOWN:
1702                 if ((stcb == NULL) || (inp == NULL)) {
1703                         break;
1704                 }
1705                 if (sctp_shutdown_timer(inp, stcb, net)) {
1706                         /* no need to unlock on tcb its gone */
1707                         goto out_decr;
1708                 }
1709                 SCTP_STAT_INCR(sctps_timoshutdown);
1710                 stcb->asoc.timoshutdown++;
1711 #ifdef SCTP_AUDITING_ENABLED
1712                 sctp_auditing(4, inp, stcb, net);
1713 #endif
1714                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_NOT_LOCKED);
1715                 break;
1716         case SCTP_TIMER_TYPE_HEARTBEAT:
1717                 if ((stcb == NULL) || (inp == NULL) || (net == NULL)) {
1718                         break;
1719                 }
1720                 SCTP_STAT_INCR(sctps_timoheartbeat);
1721                 stcb->asoc.timoheartbeat++;
1722                 if (sctp_heartbeat_timer(inp, stcb, net)) {
1723                         /* no need to unlock on tcb its gone */
1724                         goto out_decr;
1725                 }
1726 #ifdef SCTP_AUDITING_ENABLED
1727                 sctp_auditing(4, inp, stcb, net);
1728 #endif
1729                 if (!(net->dest_state & SCTP_ADDR_NOHB)) {
1730                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net);
1731                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR, SCTP_SO_NOT_LOCKED);
1732                 }
1733                 break;
1734         case SCTP_TIMER_TYPE_COOKIE:
1735                 if ((stcb == NULL) || (inp == NULL)) {
1736                         break;
1737                 }
1738                 if (sctp_cookie_timer(inp, stcb, net)) {
1739                         /* no need to unlock on tcb its gone */
1740                         goto out_decr;
1741                 }
1742                 SCTP_STAT_INCR(sctps_timocookie);
1743                 stcb->asoc.timocookie++;
1744 #ifdef SCTP_AUDITING_ENABLED
1745                 sctp_auditing(4, inp, stcb, net);
1746 #endif
1747                 /*
1748                  * We consider T3 and Cookie timer pretty much the same with
1749                  * respect to where from in chunk_output.
1750                  */
1751                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1752                 break;
1753         case SCTP_TIMER_TYPE_NEWCOOKIE:
1754                 {
1755                         struct timeval tv;
1756                         int i, secret;
1757
1758                         if (inp == NULL) {
1759                                 break;
1760                         }
1761                         SCTP_STAT_INCR(sctps_timosecret);
1762                         (void)SCTP_GETTIME_TIMEVAL(&tv);
1763                         inp->sctp_ep.time_of_secret_change = tv.tv_sec;
1764                         inp->sctp_ep.last_secret_number =
1765                             inp->sctp_ep.current_secret_number;
1766                         inp->sctp_ep.current_secret_number++;
1767                         if (inp->sctp_ep.current_secret_number >=
1768                             SCTP_HOW_MANY_SECRETS) {
1769                                 inp->sctp_ep.current_secret_number = 0;
1770                         }
1771                         secret = (int)inp->sctp_ep.current_secret_number;
1772                         for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1773                                 inp->sctp_ep.secret_key[secret][i] =
1774                                     sctp_select_initial_TSN(&inp->sctp_ep);
1775                         }
1776                         sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, stcb, net);
1777                 }
1778                 did_output = 0;
1779                 break;
1780         case SCTP_TIMER_TYPE_PATHMTURAISE:
1781                 if ((stcb == NULL) || (inp == NULL)) {
1782                         break;
1783                 }
1784                 SCTP_STAT_INCR(sctps_timopathmtu);
1785                 sctp_pathmtu_timer(inp, stcb, net);
1786                 did_output = 0;
1787                 break;
1788         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1789                 if ((stcb == NULL) || (inp == NULL)) {
1790                         break;
1791                 }
1792                 if (sctp_shutdownack_timer(inp, stcb, net)) {
1793                         /* no need to unlock on tcb its gone */
1794                         goto out_decr;
1795                 }
1796                 SCTP_STAT_INCR(sctps_timoshutdownack);
1797                 stcb->asoc.timoshutdownack++;
1798 #ifdef SCTP_AUDITING_ENABLED
1799                 sctp_auditing(4, inp, stcb, net);
1800 #endif
1801                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR, SCTP_SO_NOT_LOCKED);
1802                 break;
1803         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1804                 if ((stcb == NULL) || (inp == NULL)) {
1805                         break;
1806                 }
1807                 SCTP_STAT_INCR(sctps_timoshutdownguard);
1808                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
1809                     "Shutdown guard timer expired");
1810                 sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
1811                 /* no need to unlock on tcb its gone */
1812                 goto out_decr;
1813
1814         case SCTP_TIMER_TYPE_STRRESET:
1815                 if ((stcb == NULL) || (inp == NULL)) {
1816                         break;
1817                 }
1818                 if (sctp_strreset_timer(inp, stcb, net)) {
1819                         /* no need to unlock on tcb its gone */
1820                         goto out_decr;
1821                 }
1822                 SCTP_STAT_INCR(sctps_timostrmrst);
1823                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR, SCTP_SO_NOT_LOCKED);
1824                 break;
1825         case SCTP_TIMER_TYPE_ASCONF:
1826                 if ((stcb == NULL) || (inp == NULL)) {
1827                         break;
1828                 }
1829                 if (sctp_asconf_timer(inp, stcb, net)) {
1830                         /* no need to unlock on tcb its gone */
1831                         goto out_decr;
1832                 }
1833                 SCTP_STAT_INCR(sctps_timoasconf);
1834 #ifdef SCTP_AUDITING_ENABLED
1835                 sctp_auditing(4, inp, stcb, net);
1836 #endif
1837                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR, SCTP_SO_NOT_LOCKED);
1838                 break;
1839         case SCTP_TIMER_TYPE_PRIM_DELETED:
1840                 if ((stcb == NULL) || (inp == NULL)) {
1841                         break;
1842                 }
1843                 sctp_delete_prim_timer(inp, stcb, net);
1844                 SCTP_STAT_INCR(sctps_timodelprim);
1845                 break;
1846
1847         case SCTP_TIMER_TYPE_AUTOCLOSE:
1848                 if ((stcb == NULL) || (inp == NULL)) {
1849                         break;
1850                 }
1851                 SCTP_STAT_INCR(sctps_timoautoclose);
1852                 sctp_autoclose_timer(inp, stcb, net);
1853                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED);
1854                 did_output = 0;
1855                 break;
1856         case SCTP_TIMER_TYPE_ASOCKILL:
1857                 if ((stcb == NULL) || (inp == NULL)) {
1858                         break;
1859                 }
1860                 SCTP_STAT_INCR(sctps_timoassockill);
1861                 /* Can we free it yet? */
1862                 SCTP_INP_DECR_REF(inp);
1863                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL,
1864                     SCTP_FROM_SCTPUTIL + SCTP_LOC_1);
1865 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1866                 so = SCTP_INP_SO(inp);
1867                 atomic_add_int(&stcb->asoc.refcnt, 1);
1868                 SCTP_TCB_UNLOCK(stcb);
1869                 SCTP_SOCKET_LOCK(so, 1);
1870                 SCTP_TCB_LOCK(stcb);
1871                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1872 #endif
1873                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
1874                     SCTP_FROM_SCTPUTIL + SCTP_LOC_2);
1875 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1876                 SCTP_SOCKET_UNLOCK(so, 1);
1877 #endif
1878                 /*
1879                  * free asoc, always unlocks (or destroy's) so prevent
1880                  * duplicate unlock or unlock of a free mtx :-0
1881                  */
1882                 stcb = NULL;
1883                 goto out_no_decr;
1884         case SCTP_TIMER_TYPE_INPKILL:
1885                 SCTP_STAT_INCR(sctps_timoinpkill);
1886                 if (inp == NULL) {
1887                         break;
1888                 }
1889                 /*
1890                  * special case, take away our increment since WE are the
1891                  * killer
1892                  */
1893                 SCTP_INP_DECR_REF(inp);
1894                 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL,
1895                     SCTP_FROM_SCTPUTIL + SCTP_LOC_3);
1896                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
1897                     SCTP_CALLED_FROM_INPKILL_TIMER);
1898                 inp = NULL;
1899                 goto out_no_decr;
1900         default:
1901                 SCTPDBG(SCTP_DEBUG_TIMER1, "sctp_timeout_handler:unknown timer %d\n",
1902                     type);
1903                 break;
1904         }
1905 #ifdef SCTP_AUDITING_ENABLED
1906         sctp_audit_log(0xF1, (uint8_t)type);
1907         if (inp)
1908                 sctp_auditing(5, inp, stcb, net);
1909 #endif
1910         if ((did_output) && stcb) {
1911                 /*
1912                  * Now we need to clean up the control chunk chain if an
1913                  * ECNE is on it. It must be marked as UNSENT again so next
1914                  * call will continue to send it until such time that we get
1915                  * a CWR, to remove it. It is, however, less likely that we
1916                  * will find a ecn echo on the chain though.
1917                  */
1918                 sctp_fix_ecn_echo(&stcb->asoc);
1919         }
1920 get_out:
1921         if (stcb) {
1922                 SCTP_TCB_UNLOCK(stcb);
1923         } else if (inp != NULL) {
1924                 SCTP_INP_WUNLOCK(inp);
1925         } else {
1926                 SCTP_WQ_ADDR_UNLOCK();
1927         }
1928
1929 out_decr:
1930         if (inp) {
1931                 SCTP_INP_DECR_REF(inp);
1932         }
1933 out_no_decr:
1934         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer now complete (type = %d)\n", type);
1935         CURVNET_RESTORE();
1936 }
1937
1938 void
1939 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1940     struct sctp_nets *net)
1941 {
1942         uint32_t to_ticks;
1943         struct sctp_timer *tmr;
1944
1945         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL))
1946                 return;
1947
1948         tmr = NULL;
1949         if (stcb) {
1950                 SCTP_TCB_LOCK_ASSERT(stcb);
1951         }
1952         switch (t_type) {
1953         case SCTP_TIMER_TYPE_ADDR_WQ:
1954                 /* Only 1 tick away :-) */
1955                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
1956                 to_ticks = SCTP_ADDRESS_TICK_DELAY;
1957                 break;
1958         case SCTP_TIMER_TYPE_SEND:
1959                 /* Here we use the RTO timer */
1960                 {
1961                         int rto_val;
1962
1963                         if ((stcb == NULL) || (net == NULL)) {
1964                                 return;
1965                         }
1966                         tmr = &net->rxt_timer;
1967                         if (net->RTO == 0) {
1968                                 rto_val = stcb->asoc.initial_rto;
1969                         } else {
1970                                 rto_val = net->RTO;
1971                         }
1972                         to_ticks = MSEC_TO_TICKS(rto_val);
1973                 }
1974                 break;
1975         case SCTP_TIMER_TYPE_INIT:
1976                 /*
1977                  * Here we use the INIT timer default usually about 1
1978                  * minute.
1979                  */
1980                 if ((stcb == NULL) || (net == NULL)) {
1981                         return;
1982                 }
1983                 tmr = &net->rxt_timer;
1984                 if (net->RTO == 0) {
1985                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1986                 } else {
1987                         to_ticks = MSEC_TO_TICKS(net->RTO);
1988                 }
1989                 break;
1990         case SCTP_TIMER_TYPE_RECV:
1991                 /*
1992                  * Here we use the Delayed-Ack timer value from the inp
1993                  * ususually about 200ms.
1994                  */
1995                 if (stcb == NULL) {
1996                         return;
1997                 }
1998                 tmr = &stcb->asoc.dack_timer;
1999                 to_ticks = MSEC_TO_TICKS(stcb->asoc.delayed_ack);
2000                 break;
2001         case SCTP_TIMER_TYPE_SHUTDOWN:
2002                 /* Here we use the RTO of the destination. */
2003                 if ((stcb == NULL) || (net == NULL)) {
2004                         return;
2005                 }
2006                 if (net->RTO == 0) {
2007                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2008                 } else {
2009                         to_ticks = MSEC_TO_TICKS(net->RTO);
2010                 }
2011                 tmr = &net->rxt_timer;
2012                 break;
2013         case SCTP_TIMER_TYPE_HEARTBEAT:
2014                 /*
2015                  * the net is used here so that we can add in the RTO. Even
2016                  * though we use a different timer. We also add the HB timer
2017                  * PLUS a random jitter.
2018                  */
2019                 if ((stcb == NULL) || (net == NULL)) {
2020                         return;
2021                 } else {
2022                         uint32_t rndval;
2023                         uint32_t jitter;
2024
2025                         if ((net->dest_state & SCTP_ADDR_NOHB) &&
2026                             !(net->dest_state & SCTP_ADDR_UNCONFIRMED)) {
2027                                 return;
2028                         }
2029                         if (net->RTO == 0) {
2030                                 to_ticks = stcb->asoc.initial_rto;
2031                         } else {
2032                                 to_ticks = net->RTO;
2033                         }
2034                         rndval = sctp_select_initial_TSN(&inp->sctp_ep);
2035                         jitter = rndval % to_ticks;
2036                         if (jitter >= (to_ticks >> 1)) {
2037                                 to_ticks = to_ticks + (jitter - (to_ticks >> 1));
2038                         } else {
2039                                 to_ticks = to_ticks - jitter;
2040                         }
2041                         if (!(net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
2042                             !(net->dest_state & SCTP_ADDR_PF)) {
2043                                 to_ticks += net->heart_beat_delay;
2044                         }
2045                         /*
2046                          * Now we must convert the to_ticks that are now in
2047                          * ms to ticks.
2048                          */
2049                         to_ticks = MSEC_TO_TICKS(to_ticks);
2050                         tmr = &net->hb_timer;
2051                 }
2052                 break;
2053         case SCTP_TIMER_TYPE_COOKIE:
2054                 /*
2055                  * Here we can use the RTO timer from the network since one
2056                  * RTT was compelete. If a retran happened then we will be
2057                  * using the RTO initial value.
2058                  */
2059                 if ((stcb == NULL) || (net == NULL)) {
2060                         return;
2061                 }
2062                 if (net->RTO == 0) {
2063                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2064                 } else {
2065                         to_ticks = MSEC_TO_TICKS(net->RTO);
2066                 }
2067                 tmr = &net->rxt_timer;
2068                 break;
2069         case SCTP_TIMER_TYPE_NEWCOOKIE:
2070                 /*
2071                  * nothing needed but the endpoint here ususually about 60
2072                  * minutes.
2073                  */
2074                 tmr = &inp->sctp_ep.signature_change;
2075                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE];
2076                 break;
2077         case SCTP_TIMER_TYPE_ASOCKILL:
2078                 if (stcb == NULL) {
2079                         return;
2080                 }
2081                 tmr = &stcb->asoc.strreset_timer;
2082                 to_ticks = MSEC_TO_TICKS(SCTP_ASOC_KILL_TIMEOUT);
2083                 break;
2084         case SCTP_TIMER_TYPE_INPKILL:
2085                 /*
2086                  * The inp is setup to die. We re-use the signature_chage
2087                  * timer since that has stopped and we are in the GONE
2088                  * state.
2089                  */
2090                 tmr = &inp->sctp_ep.signature_change;
2091                 to_ticks = MSEC_TO_TICKS(SCTP_INP_KILL_TIMEOUT);
2092                 break;
2093         case SCTP_TIMER_TYPE_PATHMTURAISE:
2094                 /*
2095                  * Here we use the value found in the EP for PMTU ususually
2096                  * about 10 minutes.
2097                  */
2098                 if ((stcb == NULL) || (net == NULL)) {
2099                         return;
2100                 }
2101                 if (net->dest_state & SCTP_ADDR_NO_PMTUD) {
2102                         return;
2103                 }
2104                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU];
2105                 tmr = &net->pmtu_timer;
2106                 break;
2107         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2108                 /* Here we use the RTO of the destination */
2109                 if ((stcb == NULL) || (net == NULL)) {
2110                         return;
2111                 }
2112                 if (net->RTO == 0) {
2113                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2114                 } else {
2115                         to_ticks = MSEC_TO_TICKS(net->RTO);
2116                 }
2117                 tmr = &net->rxt_timer;
2118                 break;
2119         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2120                 /*
2121                  * Here we use the endpoints shutdown guard timer usually
2122                  * about 3 minutes.
2123                  */
2124                 if (stcb == NULL) {
2125                         return;
2126                 }
2127                 if (inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] == 0) {
2128                         to_ticks = 5 * MSEC_TO_TICKS(stcb->asoc.maxrto);
2129                 } else {
2130                         to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN];
2131                 }
2132                 tmr = &stcb->asoc.shut_guard_timer;
2133                 break;
2134         case SCTP_TIMER_TYPE_STRRESET:
2135                 /*
2136                  * Here the timer comes from the stcb but its value is from
2137                  * the net's RTO.
2138                  */
2139                 if ((stcb == NULL) || (net == NULL)) {
2140                         return;
2141                 }
2142                 if (net->RTO == 0) {
2143                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2144                 } else {
2145                         to_ticks = MSEC_TO_TICKS(net->RTO);
2146                 }
2147                 tmr = &stcb->asoc.strreset_timer;
2148                 break;
2149         case SCTP_TIMER_TYPE_ASCONF:
2150                 /*
2151                  * Here the timer comes from the stcb but its value is from
2152                  * the net's RTO.
2153                  */
2154                 if ((stcb == NULL) || (net == NULL)) {
2155                         return;
2156                 }
2157                 if (net->RTO == 0) {
2158                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2159                 } else {
2160                         to_ticks = MSEC_TO_TICKS(net->RTO);
2161                 }
2162                 tmr = &stcb->asoc.asconf_timer;
2163                 break;
2164         case SCTP_TIMER_TYPE_PRIM_DELETED:
2165                 if ((stcb == NULL) || (net != NULL)) {
2166                         return;
2167                 }
2168                 to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2169                 tmr = &stcb->asoc.delete_prim_timer;
2170                 break;
2171         case SCTP_TIMER_TYPE_AUTOCLOSE:
2172                 if (stcb == NULL) {
2173                         return;
2174                 }
2175                 if (stcb->asoc.sctp_autoclose_ticks == 0) {
2176                         /*
2177                          * Really an error since stcb is NOT set to
2178                          * autoclose
2179                          */
2180                         return;
2181                 }
2182                 to_ticks = stcb->asoc.sctp_autoclose_ticks;
2183                 tmr = &stcb->asoc.autoclose_timer;
2184                 break;
2185         default:
2186                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2187                     __func__, t_type);
2188                 return;
2189                 break;
2190         }
2191         if ((to_ticks <= 0) || (tmr == NULL)) {
2192                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: %d:software error to_ticks:%d tmr:%p not set ??\n",
2193                     __func__, t_type, to_ticks, (void *)tmr);
2194                 return;
2195         }
2196         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
2197                 /*
2198                  * we do NOT allow you to have it already running. if it is
2199                  * we leave the current one up unchanged
2200                  */
2201                 return;
2202         }
2203         /* At this point we can proceed */
2204         if (t_type == SCTP_TIMER_TYPE_SEND) {
2205                 stcb->asoc.num_send_timers_up++;
2206         }
2207         tmr->stopped_from = 0;
2208         tmr->type = t_type;
2209         tmr->ep = (void *)inp;
2210         tmr->tcb = (void *)stcb;
2211         tmr->net = (void *)net;
2212         tmr->self = (void *)tmr;
2213         tmr->vnet = (void *)curvnet;
2214         tmr->ticks = sctp_get_tick_count();
2215         (void)SCTP_OS_TIMER_START(&tmr->timer, to_ticks, sctp_timeout_handler, tmr);
2216         return;
2217 }
2218
2219 void
2220 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2221     struct sctp_nets *net, uint32_t from)
2222 {
2223         struct sctp_timer *tmr;
2224
2225         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) &&
2226             (inp == NULL))
2227                 return;
2228
2229         tmr = NULL;
2230         if (stcb) {
2231                 SCTP_TCB_LOCK_ASSERT(stcb);
2232         }
2233         switch (t_type) {
2234         case SCTP_TIMER_TYPE_ADDR_WQ:
2235                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2236                 break;
2237         case SCTP_TIMER_TYPE_SEND:
2238                 if ((stcb == NULL) || (net == NULL)) {
2239                         return;
2240                 }
2241                 tmr = &net->rxt_timer;
2242                 break;
2243         case SCTP_TIMER_TYPE_INIT:
2244                 if ((stcb == NULL) || (net == NULL)) {
2245                         return;
2246                 }
2247                 tmr = &net->rxt_timer;
2248                 break;
2249         case SCTP_TIMER_TYPE_RECV:
2250                 if (stcb == NULL) {
2251                         return;
2252                 }
2253                 tmr = &stcb->asoc.dack_timer;
2254                 break;
2255         case SCTP_TIMER_TYPE_SHUTDOWN:
2256                 if ((stcb == NULL) || (net == NULL)) {
2257                         return;
2258                 }
2259                 tmr = &net->rxt_timer;
2260                 break;
2261         case SCTP_TIMER_TYPE_HEARTBEAT:
2262                 if ((stcb == NULL) || (net == NULL)) {
2263                         return;
2264                 }
2265                 tmr = &net->hb_timer;
2266                 break;
2267         case SCTP_TIMER_TYPE_COOKIE:
2268                 if ((stcb == NULL) || (net == NULL)) {
2269                         return;
2270                 }
2271                 tmr = &net->rxt_timer;
2272                 break;
2273         case SCTP_TIMER_TYPE_NEWCOOKIE:
2274                 /* nothing needed but the endpoint here */
2275                 tmr = &inp->sctp_ep.signature_change;
2276                 /*
2277                  * We re-use the newcookie timer for the INP kill timer. We
2278                  * must assure that we do not kill it by accident.
2279                  */
2280                 break;
2281         case SCTP_TIMER_TYPE_ASOCKILL:
2282                 /*
2283                  * Stop the asoc kill timer.
2284                  */
2285                 if (stcb == NULL) {
2286                         return;
2287                 }
2288                 tmr = &stcb->asoc.strreset_timer;
2289                 break;
2290
2291         case SCTP_TIMER_TYPE_INPKILL:
2292                 /*
2293                  * The inp is setup to die. We re-use the signature_chage
2294                  * timer since that has stopped and we are in the GONE
2295                  * state.
2296                  */
2297                 tmr = &inp->sctp_ep.signature_change;
2298                 break;
2299         case SCTP_TIMER_TYPE_PATHMTURAISE:
2300                 if ((stcb == NULL) || (net == NULL)) {
2301                         return;
2302                 }
2303                 tmr = &net->pmtu_timer;
2304                 break;
2305         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2306                 if ((stcb == NULL) || (net == NULL)) {
2307                         return;
2308                 }
2309                 tmr = &net->rxt_timer;
2310                 break;
2311         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2312                 if (stcb == NULL) {
2313                         return;
2314                 }
2315                 tmr = &stcb->asoc.shut_guard_timer;
2316                 break;
2317         case SCTP_TIMER_TYPE_STRRESET:
2318                 if (stcb == NULL) {
2319                         return;
2320                 }
2321                 tmr = &stcb->asoc.strreset_timer;
2322                 break;
2323         case SCTP_TIMER_TYPE_ASCONF:
2324                 if (stcb == NULL) {
2325                         return;
2326                 }
2327                 tmr = &stcb->asoc.asconf_timer;
2328                 break;
2329         case SCTP_TIMER_TYPE_PRIM_DELETED:
2330                 if (stcb == NULL) {
2331                         return;
2332                 }
2333                 tmr = &stcb->asoc.delete_prim_timer;
2334                 break;
2335         case SCTP_TIMER_TYPE_AUTOCLOSE:
2336                 if (stcb == NULL) {
2337                         return;
2338                 }
2339                 tmr = &stcb->asoc.autoclose_timer;
2340                 break;
2341         default:
2342                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2343                     __func__, t_type);
2344                 break;
2345         }
2346         if (tmr == NULL) {
2347                 return;
2348         }
2349         if ((tmr->type != t_type) && tmr->type) {
2350                 /*
2351                  * Ok we have a timer that is under joint use. Cookie timer
2352                  * per chance with the SEND timer. We therefore are NOT
2353                  * running the timer that the caller wants stopped.  So just
2354                  * return.
2355                  */
2356                 return;
2357         }
2358         if ((t_type == SCTP_TIMER_TYPE_SEND) && (stcb != NULL)) {
2359                 stcb->asoc.num_send_timers_up--;
2360                 if (stcb->asoc.num_send_timers_up < 0) {
2361                         stcb->asoc.num_send_timers_up = 0;
2362                 }
2363         }
2364         tmr->self = NULL;
2365         tmr->stopped_from = from;
2366         (void)SCTP_OS_TIMER_STOP(&tmr->timer);
2367         return;
2368 }
2369
2370 uint32_t
2371 sctp_calculate_len(struct mbuf *m)
2372 {
2373         uint32_t tlen = 0;
2374         struct mbuf *at;
2375
2376         at = m;
2377         while (at) {
2378                 tlen += SCTP_BUF_LEN(at);
2379                 at = SCTP_BUF_NEXT(at);
2380         }
2381         return (tlen);
2382 }
2383
2384 void
2385 sctp_mtu_size_reset(struct sctp_inpcb *inp,
2386     struct sctp_association *asoc, uint32_t mtu)
2387 {
2388         /*
2389          * Reset the P-MTU size on this association, this involves changing
2390          * the asoc MTU, going through ANY chunk+overhead larger than mtu to
2391          * allow the DF flag to be cleared.
2392          */
2393         struct sctp_tmit_chunk *chk;
2394         unsigned int eff_mtu, ovh;
2395
2396         asoc->smallest_mtu = mtu;
2397         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2398                 ovh = SCTP_MIN_OVERHEAD;
2399         } else {
2400                 ovh = SCTP_MIN_V4_OVERHEAD;
2401         }
2402         eff_mtu = mtu - ovh;
2403         TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
2404                 if (chk->send_size > eff_mtu) {
2405                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2406                 }
2407         }
2408         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
2409                 if (chk->send_size > eff_mtu) {
2410                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2411                 }
2412         }
2413 }
2414
2415
2416 /*
2417  * given an association and starting time of the current RTT period return
2418  * RTO in number of msecs net should point to the current network
2419  */
2420
2421 uint32_t
2422 sctp_calculate_rto(struct sctp_tcb *stcb,
2423     struct sctp_association *asoc,
2424     struct sctp_nets *net,
2425     struct timeval *old,
2426     int rtt_from_sack)
2427 {
2428         /*-
2429          * given an association and the starting time of the current RTT
2430          * period (in value1/value2) return RTO in number of msecs.
2431          */
2432         int32_t rtt;            /* RTT in ms */
2433         uint32_t new_rto;
2434         int first_measure = 0;
2435         struct timeval now;
2436
2437         /************************/
2438         /* 1. calculate new RTT */
2439         /************************/
2440         /* get the current time */
2441         if (stcb->asoc.use_precise_time) {
2442                 (void)SCTP_GETPTIME_TIMEVAL(&now);
2443         } else {
2444                 (void)SCTP_GETTIME_TIMEVAL(&now);
2445         }
2446         timevalsub(&now, old);
2447         /* store the current RTT in us */
2448         net->rtt = (uint64_t)1000000 *(uint64_t)now.tv_sec +
2449                 (uint64_t)now.tv_usec;
2450
2451         /* compute rtt in ms */
2452         rtt = (int32_t)(net->rtt / 1000);
2453         if ((asoc->cc_functions.sctp_rtt_calculated) && (rtt_from_sack == SCTP_RTT_FROM_DATA)) {
2454                 /*
2455                  * Tell the CC module that a new update has just occurred
2456                  * from a sack
2457                  */
2458                 (*asoc->cc_functions.sctp_rtt_calculated) (stcb, net, &now);
2459         }
2460         /*
2461          * Do we need to determine the lan? We do this only on sacks i.e.
2462          * RTT being determined from data not non-data (HB/INIT->INITACK).
2463          */
2464         if ((rtt_from_sack == SCTP_RTT_FROM_DATA) &&
2465             (net->lan_type == SCTP_LAN_UNKNOWN)) {
2466                 if (net->rtt > SCTP_LOCAL_LAN_RTT) {
2467                         net->lan_type = SCTP_LAN_INTERNET;
2468                 } else {
2469                         net->lan_type = SCTP_LAN_LOCAL;
2470                 }
2471         }
2472         /***************************/
2473         /* 2. update RTTVAR & SRTT */
2474         /***************************/
2475         /*-
2476          * Compute the scaled average lastsa and the
2477          * scaled variance lastsv as described in van Jacobson
2478          * Paper "Congestion Avoidance and Control", Annex A.
2479          *
2480          * (net->lastsa >> SCTP_RTT_SHIFT) is the srtt
2481          * (net->lastsa >> SCTP_RTT_VAR_SHIFT) is the rttvar
2482          */
2483         if (net->RTO_measured) {
2484                 rtt -= (net->lastsa >> SCTP_RTT_SHIFT);
2485                 net->lastsa += rtt;
2486                 if (rtt < 0) {
2487                         rtt = -rtt;
2488                 }
2489                 rtt -= (net->lastsv >> SCTP_RTT_VAR_SHIFT);
2490                 net->lastsv += rtt;
2491                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2492                         rto_logging(net, SCTP_LOG_RTTVAR);
2493                 }
2494         } else {
2495                 /* First RTO measurment */
2496                 net->RTO_measured = 1;
2497                 first_measure = 1;
2498                 net->lastsa = rtt << SCTP_RTT_SHIFT;
2499                 net->lastsv = (rtt / 2) << SCTP_RTT_VAR_SHIFT;
2500                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2501                         rto_logging(net, SCTP_LOG_INITIAL_RTT);
2502                 }
2503         }
2504         if (net->lastsv == 0) {
2505                 net->lastsv = SCTP_CLOCK_GRANULARITY;
2506         }
2507         new_rto = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
2508         if ((new_rto > SCTP_SAT_NETWORK_MIN) &&
2509             (stcb->asoc.sat_network_lockout == 0)) {
2510                 stcb->asoc.sat_network = 1;
2511         } else if ((!first_measure) && stcb->asoc.sat_network) {
2512                 stcb->asoc.sat_network = 0;
2513                 stcb->asoc.sat_network_lockout = 1;
2514         }
2515         /* bound it, per C6/C7 in Section 5.3.1 */
2516         if (new_rto < stcb->asoc.minrto) {
2517                 new_rto = stcb->asoc.minrto;
2518         }
2519         if (new_rto > stcb->asoc.maxrto) {
2520                 new_rto = stcb->asoc.maxrto;
2521         }
2522         /* we are now returning the RTO */
2523         return (new_rto);
2524 }
2525
2526 /*
2527  * return a pointer to a contiguous piece of data from the given mbuf chain
2528  * starting at 'off' for 'len' bytes.  If the desired piece spans more than
2529  * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size
2530  * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain.
2531  */
2532 caddr_t
2533 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t *in_ptr)
2534 {
2535         uint32_t count;
2536         uint8_t *ptr;
2537
2538         ptr = in_ptr;
2539         if ((off < 0) || (len <= 0))
2540                 return (NULL);
2541
2542         /* find the desired start location */
2543         while ((m != NULL) && (off > 0)) {
2544                 if (off < SCTP_BUF_LEN(m))
2545                         break;
2546                 off -= SCTP_BUF_LEN(m);
2547                 m = SCTP_BUF_NEXT(m);
2548         }
2549         if (m == NULL)
2550                 return (NULL);
2551
2552         /* is the current mbuf large enough (eg. contiguous)? */
2553         if ((SCTP_BUF_LEN(m) - off) >= len) {
2554                 return (mtod(m, caddr_t)+off);
2555         } else {
2556                 /* else, it spans more than one mbuf, so save a temp copy... */
2557                 while ((m != NULL) && (len > 0)) {
2558                         count = min(SCTP_BUF_LEN(m) - off, len);
2559                         memcpy(ptr, mtod(m, caddr_t)+off, count);
2560                         len -= count;
2561                         ptr += count;
2562                         off = 0;
2563                         m = SCTP_BUF_NEXT(m);
2564                 }
2565                 if ((m == NULL) && (len > 0))
2566                         return (NULL);
2567                 else
2568                         return ((caddr_t)in_ptr);
2569         }
2570 }
2571
2572
2573
2574 struct sctp_paramhdr *
2575 sctp_get_next_param(struct mbuf *m,
2576     int offset,
2577     struct sctp_paramhdr *pull,
2578     int pull_limit)
2579 {
2580         /* This just provides a typed signature to Peter's Pull routine */
2581         return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit,
2582             (uint8_t *)pull));
2583 }
2584
2585
2586 struct mbuf *
2587 sctp_add_pad_tombuf(struct mbuf *m, int padlen)
2588 {
2589         struct mbuf *m_last;
2590         caddr_t dp;
2591
2592         if (padlen > 3) {
2593                 return (NULL);
2594         }
2595         if (padlen <= M_TRAILINGSPACE(m)) {
2596                 /*
2597                  * The easy way. We hope the majority of the time we hit
2598                  * here :)
2599                  */
2600                 m_last = m;
2601         } else {
2602                 /* Hard way we must grow the mbuf chain */
2603                 m_last = sctp_get_mbuf_for_msg(padlen, 0, M_NOWAIT, 1, MT_DATA);
2604                 if (m_last == NULL) {
2605                         return (NULL);
2606                 }
2607                 SCTP_BUF_LEN(m_last) = 0;
2608                 SCTP_BUF_NEXT(m_last) = NULL;
2609                 SCTP_BUF_NEXT(m) = m_last;
2610         }
2611         dp = mtod(m_last, caddr_t)+SCTP_BUF_LEN(m_last);
2612         SCTP_BUF_LEN(m_last) += padlen;
2613         memset(dp, 0, padlen);
2614         return (m_last);
2615 }
2616
2617 struct mbuf *
2618 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf)
2619 {
2620         /* find the last mbuf in chain and pad it */
2621         struct mbuf *m_at;
2622
2623         if (last_mbuf != NULL) {
2624                 return (sctp_add_pad_tombuf(last_mbuf, padval));
2625         } else {
2626                 for (m_at = m; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
2627                         if (SCTP_BUF_NEXT(m_at) == NULL) {
2628                                 return (sctp_add_pad_tombuf(m_at, padval));
2629                         }
2630                 }
2631         }
2632         return (NULL);
2633 }
2634
2635 static void
2636 sctp_notify_assoc_change(uint16_t state, struct sctp_tcb *stcb,
2637     uint16_t error, struct sctp_abort_chunk *abort, uint8_t from_peer, int so_locked
2638 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2639     SCTP_UNUSED
2640 #endif
2641 )
2642 {
2643         struct mbuf *m_notify;
2644         struct sctp_assoc_change *sac;
2645         struct sctp_queued_to_read *control;
2646         unsigned int notif_len;
2647         uint16_t abort_len;
2648         unsigned int i;
2649 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2650         struct socket *so;
2651 #endif
2652
2653         if (stcb == NULL) {
2654                 return;
2655         }
2656         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVASSOCEVNT)) {
2657                 notif_len = (unsigned int)sizeof(struct sctp_assoc_change);
2658                 if (abort != NULL) {
2659                         abort_len = ntohs(abort->ch.chunk_length);
2660                 } else {
2661                         abort_len = 0;
2662                 }
2663                 if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
2664                         notif_len += SCTP_ASSOC_SUPPORTS_MAX;
2665                 } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
2666                         notif_len += abort_len;
2667                 }
2668                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
2669                 if (m_notify == NULL) {
2670                         /* Retry with smaller value. */
2671                         notif_len = (unsigned int)sizeof(struct sctp_assoc_change);
2672                         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
2673                         if (m_notify == NULL) {
2674                                 goto set_error;
2675                         }
2676                 }
2677                 SCTP_BUF_NEXT(m_notify) = NULL;
2678                 sac = mtod(m_notify, struct sctp_assoc_change *);
2679                 memset(sac, 0, notif_len);
2680                 sac->sac_type = SCTP_ASSOC_CHANGE;
2681                 sac->sac_flags = 0;
2682                 sac->sac_length = sizeof(struct sctp_assoc_change);
2683                 sac->sac_state = state;
2684                 sac->sac_error = error;
2685                 /* XXX verify these stream counts */
2686                 sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
2687                 sac->sac_inbound_streams = stcb->asoc.streamincnt;
2688                 sac->sac_assoc_id = sctp_get_associd(stcb);
2689                 if (notif_len > sizeof(struct sctp_assoc_change)) {
2690                         if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
2691                                 i = 0;
2692                                 if (stcb->asoc.prsctp_supported == 1) {
2693                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_PR;
2694                                 }
2695                                 if (stcb->asoc.auth_supported == 1) {
2696                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_AUTH;
2697                                 }
2698                                 if (stcb->asoc.asconf_supported == 1) {
2699                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_ASCONF;
2700                                 }
2701                                 if (stcb->asoc.idata_supported == 1) {
2702                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_INTERLEAVING;
2703                                 }
2704                                 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_MULTIBUF;
2705                                 if (stcb->asoc.reconfig_supported == 1) {
2706                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_RE_CONFIG;
2707                                 }
2708                                 sac->sac_length += i;
2709                         } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
2710                                 memcpy(sac->sac_info, abort, abort_len);
2711                                 sac->sac_length += abort_len;
2712                         }
2713                 }
2714                 SCTP_BUF_LEN(m_notify) = sac->sac_length;
2715                 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2716                     0, 0, stcb->asoc.context, 0, 0, 0,
2717                     m_notify);
2718                 if (control != NULL) {
2719                         control->length = SCTP_BUF_LEN(m_notify);
2720                         control->spec_flags = M_NOTIFICATION;
2721                         /* not that we need this */
2722                         control->tail_mbuf = m_notify;
2723                         sctp_add_to_readq(stcb->sctp_ep, stcb,
2724                             control,
2725                             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD,
2726                             so_locked);
2727                 } else {
2728                         sctp_m_freem(m_notify);
2729                 }
2730         }
2731         /*
2732          * For 1-to-1 style sockets, we send up and error when an ABORT
2733          * comes in.
2734          */
2735 set_error:
2736         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2737             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2738             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
2739                 SOCK_LOCK(stcb->sctp_socket);
2740                 if (from_peer) {
2741                         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) {
2742                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNREFUSED);
2743                                 stcb->sctp_socket->so_error = ECONNREFUSED;
2744                         } else {
2745                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
2746                                 stcb->sctp_socket->so_error = ECONNRESET;
2747                         }
2748                 } else {
2749                         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) ||
2750                             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) {
2751                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ETIMEDOUT);
2752                                 stcb->sctp_socket->so_error = ETIMEDOUT;
2753                         } else {
2754                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNABORTED);
2755                                 stcb->sctp_socket->so_error = ECONNABORTED;
2756                         }
2757                 }
2758         }
2759         /* Wake ANY sleepers */
2760 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2761         so = SCTP_INP_SO(stcb->sctp_ep);
2762         if (!so_locked) {
2763                 atomic_add_int(&stcb->asoc.refcnt, 1);
2764                 SCTP_TCB_UNLOCK(stcb);
2765                 SCTP_SOCKET_LOCK(so, 1);
2766                 SCTP_TCB_LOCK(stcb);
2767                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2768                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2769                         SCTP_SOCKET_UNLOCK(so, 1);
2770                         return;
2771                 }
2772         }
2773 #endif
2774         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2775             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2776             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
2777                 socantrcvmore_locked(stcb->sctp_socket);
2778         }
2779         sorwakeup(stcb->sctp_socket);
2780         sowwakeup(stcb->sctp_socket);
2781 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2782         if (!so_locked) {
2783                 SCTP_SOCKET_UNLOCK(so, 1);
2784         }
2785 #endif
2786 }
2787
2788 static void
2789 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
2790     struct sockaddr *sa, uint32_t error, int so_locked
2791 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2792     SCTP_UNUSED
2793 #endif
2794 )
2795 {
2796         struct mbuf *m_notify;
2797         struct sctp_paddr_change *spc;
2798         struct sctp_queued_to_read *control;
2799
2800         if ((stcb == NULL) ||
2801             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPADDREVNT)) {
2802                 /* event not enabled */
2803                 return;
2804         }
2805         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 0, M_NOWAIT, 1, MT_DATA);
2806         if (m_notify == NULL)
2807                 return;
2808         SCTP_BUF_LEN(m_notify) = 0;
2809         spc = mtod(m_notify, struct sctp_paddr_change *);
2810         memset(spc, 0, sizeof(struct sctp_paddr_change));
2811         spc->spc_type = SCTP_PEER_ADDR_CHANGE;
2812         spc->spc_flags = 0;
2813         spc->spc_length = sizeof(struct sctp_paddr_change);
2814         switch (sa->sa_family) {
2815 #ifdef INET
2816         case AF_INET:
2817 #ifdef INET6
2818                 if (sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
2819                         in6_sin_2_v4mapsin6((struct sockaddr_in *)sa,
2820                             (struct sockaddr_in6 *)&spc->spc_aaddr);
2821                 } else {
2822                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2823                 }
2824 #else
2825                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2826 #endif
2827                 break;
2828 #endif
2829 #ifdef INET6
2830         case AF_INET6:
2831                 {
2832                         struct sockaddr_in6 *sin6;
2833
2834                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6));
2835
2836                         sin6 = (struct sockaddr_in6 *)&spc->spc_aaddr;
2837                         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2838                                 if (sin6->sin6_scope_id == 0) {
2839                                         /* recover scope_id for user */
2840                                         (void)sa6_recoverscope(sin6);
2841                                 } else {
2842                                         /* clear embedded scope_id for user */
2843                                         in6_clearscope(&sin6->sin6_addr);
2844                                 }
2845                         }
2846                         break;
2847                 }
2848 #endif
2849         default:
2850                 /* TSNH */
2851                 break;
2852         }
2853         spc->spc_state = state;
2854         spc->spc_error = error;
2855         spc->spc_assoc_id = sctp_get_associd(stcb);
2856
2857         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_paddr_change);
2858         SCTP_BUF_NEXT(m_notify) = NULL;
2859
2860         /* append to socket */
2861         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2862             0, 0, stcb->asoc.context, 0, 0, 0,
2863             m_notify);
2864         if (control == NULL) {
2865                 /* no memory */
2866                 sctp_m_freem(m_notify);
2867                 return;
2868         }
2869         control->length = SCTP_BUF_LEN(m_notify);
2870         control->spec_flags = M_NOTIFICATION;
2871         /* not that we need this */
2872         control->tail_mbuf = m_notify;
2873         sctp_add_to_readq(stcb->sctp_ep, stcb,
2874             control,
2875             &stcb->sctp_socket->so_rcv, 1,
2876             SCTP_READ_LOCK_NOT_HELD,
2877             so_locked);
2878 }
2879
2880
2881 static void
2882 sctp_notify_send_failed(struct sctp_tcb *stcb, uint8_t sent, uint32_t error,
2883     struct sctp_tmit_chunk *chk, int so_locked
2884 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2885     SCTP_UNUSED
2886 #endif
2887 )
2888 {
2889         struct mbuf *m_notify;
2890         struct sctp_send_failed *ssf;
2891         struct sctp_send_failed_event *ssfe;
2892         struct sctp_queued_to_read *control;
2893         struct sctp_chunkhdr *chkhdr;
2894         int notifhdr_len, chk_len, chkhdr_len, padding_len, payload_len;
2895
2896         if ((stcb == NULL) ||
2897             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
2898             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
2899                 /* event not enabled */
2900                 return;
2901         }
2902         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2903                 notifhdr_len = sizeof(struct sctp_send_failed_event);
2904         } else {
2905                 notifhdr_len = sizeof(struct sctp_send_failed);
2906         }
2907         m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA);
2908         if (m_notify == NULL)
2909                 /* no space left */
2910                 return;
2911         SCTP_BUF_LEN(m_notify) = notifhdr_len;
2912         if (stcb->asoc.idata_supported) {
2913                 chkhdr_len = sizeof(struct sctp_idata_chunk);
2914         } else {
2915                 chkhdr_len = sizeof(struct sctp_data_chunk);
2916         }
2917         /* Use some defaults in case we can't access the chunk header */
2918         if (chk->send_size >= chkhdr_len) {
2919                 payload_len = chk->send_size - chkhdr_len;
2920         } else {
2921                 payload_len = 0;
2922         }
2923         padding_len = 0;
2924         if (chk->data != NULL) {
2925                 chkhdr = mtod(chk->data, struct sctp_chunkhdr *);
2926                 if (chkhdr != NULL) {
2927                         chk_len = ntohs(chkhdr->chunk_length);
2928                         if ((chk_len >= chkhdr_len) &&
2929                             (chk->send_size >= chk_len) &&
2930                             (chk->send_size - chk_len < 4)) {
2931                                 padding_len = chk->send_size - chk_len;
2932                                 payload_len = chk->send_size - chkhdr_len - padding_len;
2933                         }
2934                 }
2935         }
2936         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2937                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
2938                 memset(ssfe, 0, notifhdr_len);
2939                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
2940                 if (sent) {
2941                         ssfe->ssfe_flags = SCTP_DATA_SENT;
2942                 } else {
2943                         ssfe->ssfe_flags = SCTP_DATA_UNSENT;
2944                 }
2945                 ssfe->ssfe_length = (uint32_t)(notifhdr_len + payload_len);
2946                 ssfe->ssfe_error = error;
2947                 /* not exactly what the user sent in, but should be close :) */
2948                 ssfe->ssfe_info.snd_sid = chk->rec.data.sid;
2949                 ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags;
2950                 ssfe->ssfe_info.snd_ppid = chk->rec.data.ppid;
2951                 ssfe->ssfe_info.snd_context = chk->rec.data.context;
2952                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
2953                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
2954         } else {
2955                 ssf = mtod(m_notify, struct sctp_send_failed *);
2956                 memset(ssf, 0, notifhdr_len);
2957                 ssf->ssf_type = SCTP_SEND_FAILED;
2958                 if (sent) {
2959                         ssf->ssf_flags = SCTP_DATA_SENT;
2960                 } else {
2961                         ssf->ssf_flags = SCTP_DATA_UNSENT;
2962                 }
2963                 ssf->ssf_length = (uint32_t)(notifhdr_len + payload_len);
2964                 ssf->ssf_error = error;
2965                 /* not exactly what the user sent in, but should be close :) */
2966                 ssf->ssf_info.sinfo_stream = chk->rec.data.sid;
2967                 ssf->ssf_info.sinfo_ssn = (uint16_t)chk->rec.data.mid;
2968                 ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags;
2969                 ssf->ssf_info.sinfo_ppid = chk->rec.data.ppid;
2970                 ssf->ssf_info.sinfo_context = chk->rec.data.context;
2971                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
2972                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
2973         }
2974         if (chk->data != NULL) {
2975                 /* Trim off the sctp chunk header (it should be there) */
2976                 if (chk->send_size == chkhdr_len + payload_len + padding_len) {
2977                         m_adj(chk->data, chkhdr_len);
2978                         m_adj(chk->data, -padding_len);
2979                         sctp_mbuf_crush(chk->data);
2980                         chk->send_size -= (chkhdr_len + padding_len);
2981                 }
2982         }
2983         SCTP_BUF_NEXT(m_notify) = chk->data;
2984         /* Steal off the mbuf */
2985         chk->data = NULL;
2986         /*
2987          * For this case, we check the actual socket buffer, since the assoc
2988          * is going away we don't want to overfill the socket buffer for a
2989          * non-reader
2990          */
2991         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
2992                 sctp_m_freem(m_notify);
2993                 return;
2994         }
2995         /* append to socket */
2996         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2997             0, 0, stcb->asoc.context, 0, 0, 0,
2998             m_notify);
2999         if (control == NULL) {
3000                 /* no memory */
3001                 sctp_m_freem(m_notify);
3002                 return;
3003         }
3004         control->length = SCTP_BUF_LEN(m_notify);
3005         control->spec_flags = M_NOTIFICATION;
3006         /* not that we need this */
3007         control->tail_mbuf = m_notify;
3008         sctp_add_to_readq(stcb->sctp_ep, stcb,
3009             control,
3010             &stcb->sctp_socket->so_rcv, 1,
3011             SCTP_READ_LOCK_NOT_HELD,
3012             so_locked);
3013 }
3014
3015
3016 static void
3017 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
3018     struct sctp_stream_queue_pending *sp, int so_locked
3019 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3020     SCTP_UNUSED
3021 #endif
3022 )
3023 {
3024         struct mbuf *m_notify;
3025         struct sctp_send_failed *ssf;
3026         struct sctp_send_failed_event *ssfe;
3027         struct sctp_queued_to_read *control;
3028         int notifhdr_len;
3029
3030         if ((stcb == NULL) ||
3031             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
3032             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
3033                 /* event not enabled */
3034                 return;
3035         }
3036         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3037                 notifhdr_len = sizeof(struct sctp_send_failed_event);
3038         } else {
3039                 notifhdr_len = sizeof(struct sctp_send_failed);
3040         }
3041         m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA);
3042         if (m_notify == NULL) {
3043                 /* no space left */
3044                 return;
3045         }
3046         SCTP_BUF_LEN(m_notify) = notifhdr_len;
3047         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3048                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
3049                 memset(ssfe, 0, notifhdr_len);
3050                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
3051                 ssfe->ssfe_flags = SCTP_DATA_UNSENT;
3052                 ssfe->ssfe_length = (uint32_t)(notifhdr_len + sp->length);
3053                 ssfe->ssfe_error = error;
3054                 /* not exactly what the user sent in, but should be close :) */
3055                 ssfe->ssfe_info.snd_sid = sp->sid;
3056                 if (sp->some_taken) {
3057                         ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG;
3058                 } else {
3059                         ssfe->ssfe_info.snd_flags = SCTP_DATA_NOT_FRAG;
3060                 }
3061                 ssfe->ssfe_info.snd_ppid = sp->ppid;
3062                 ssfe->ssfe_info.snd_context = sp->context;
3063                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
3064                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
3065         } else {
3066                 ssf = mtod(m_notify, struct sctp_send_failed *);
3067                 memset(ssf, 0, notifhdr_len);
3068                 ssf->ssf_type = SCTP_SEND_FAILED;
3069                 ssf->ssf_flags = SCTP_DATA_UNSENT;
3070                 ssf->ssf_length = (uint32_t)(notifhdr_len + sp->length);
3071                 ssf->ssf_error = error;
3072                 /* not exactly what the user sent in, but should be close :) */
3073                 ssf->ssf_info.sinfo_stream = sp->sid;
3074                 ssf->ssf_info.sinfo_ssn = 0;
3075                 if (sp->some_taken) {
3076                         ssf->ssf_info.sinfo_flags = SCTP_DATA_LAST_FRAG;
3077                 } else {
3078                         ssf->ssf_info.sinfo_flags = SCTP_DATA_NOT_FRAG;
3079                 }
3080                 ssf->ssf_info.sinfo_ppid = sp->ppid;
3081                 ssf->ssf_info.sinfo_context = sp->context;
3082                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
3083                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
3084         }
3085         SCTP_BUF_NEXT(m_notify) = sp->data;
3086
3087         /* Steal off the mbuf */
3088         sp->data = NULL;
3089         /*
3090          * For this case, we check the actual socket buffer, since the assoc
3091          * is going away we don't want to overfill the socket buffer for a
3092          * non-reader
3093          */
3094         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3095                 sctp_m_freem(m_notify);
3096                 return;
3097         }
3098         /* append to socket */
3099         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3100             0, 0, stcb->asoc.context, 0, 0, 0,
3101             m_notify);
3102         if (control == NULL) {
3103                 /* no memory */
3104                 sctp_m_freem(m_notify);
3105                 return;
3106         }
3107         control->length = SCTP_BUF_LEN(m_notify);
3108         control->spec_flags = M_NOTIFICATION;
3109         /* not that we need this */
3110         control->tail_mbuf = m_notify;
3111         sctp_add_to_readq(stcb->sctp_ep, stcb,
3112             control,
3113             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3114 }
3115
3116
3117
3118 static void
3119 sctp_notify_adaptation_layer(struct sctp_tcb *stcb)
3120 {
3121         struct mbuf *m_notify;
3122         struct sctp_adaptation_event *sai;
3123         struct sctp_queued_to_read *control;
3124
3125         if ((stcb == NULL) ||
3126             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ADAPTATIONEVNT)) {
3127                 /* event not enabled */
3128                 return;
3129         }
3130         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_NOWAIT, 1, MT_DATA);
3131         if (m_notify == NULL)
3132                 /* no space left */
3133                 return;
3134         SCTP_BUF_LEN(m_notify) = 0;
3135         sai = mtod(m_notify, struct sctp_adaptation_event *);
3136         memset(sai, 0, sizeof(struct sctp_adaptation_event));
3137         sai->sai_type = SCTP_ADAPTATION_INDICATION;
3138         sai->sai_flags = 0;
3139         sai->sai_length = sizeof(struct sctp_adaptation_event);
3140         sai->sai_adaptation_ind = stcb->asoc.peers_adaptation;
3141         sai->sai_assoc_id = sctp_get_associd(stcb);
3142
3143         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_adaptation_event);
3144         SCTP_BUF_NEXT(m_notify) = NULL;
3145
3146         /* append to socket */
3147         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3148             0, 0, stcb->asoc.context, 0, 0, 0,
3149             m_notify);
3150         if (control == NULL) {
3151                 /* no memory */
3152                 sctp_m_freem(m_notify);
3153                 return;
3154         }
3155         control->length = SCTP_BUF_LEN(m_notify);
3156         control->spec_flags = M_NOTIFICATION;
3157         /* not that we need this */
3158         control->tail_mbuf = m_notify;
3159         sctp_add_to_readq(stcb->sctp_ep, stcb,
3160             control,
3161             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3162 }
3163
3164 /* This always must be called with the read-queue LOCKED in the INP */
3165 static void
3166 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb, uint32_t error,
3167     uint32_t val, int so_locked
3168 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3169     SCTP_UNUSED
3170 #endif
3171 )
3172 {
3173         struct mbuf *m_notify;
3174         struct sctp_pdapi_event *pdapi;
3175         struct sctp_queued_to_read *control;
3176         struct sockbuf *sb;
3177
3178         if ((stcb == NULL) ||
3179             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_PDAPIEVNT)) {
3180                 /* event not enabled */
3181                 return;
3182         }
3183         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
3184                 return;
3185         }
3186         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 0, M_NOWAIT, 1, MT_DATA);
3187         if (m_notify == NULL)
3188                 /* no space left */
3189                 return;
3190         SCTP_BUF_LEN(m_notify) = 0;
3191         pdapi = mtod(m_notify, struct sctp_pdapi_event *);
3192         memset(pdapi, 0, sizeof(struct sctp_pdapi_event));
3193         pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
3194         pdapi->pdapi_flags = 0;
3195         pdapi->pdapi_length = sizeof(struct sctp_pdapi_event);
3196         pdapi->pdapi_indication = error;
3197         pdapi->pdapi_stream = (val >> 16);
3198         pdapi->pdapi_seq = (val & 0x0000ffff);
3199         pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
3200
3201         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_pdapi_event);
3202         SCTP_BUF_NEXT(m_notify) = NULL;
3203         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3204             0, 0, stcb->asoc.context, 0, 0, 0,
3205             m_notify);
3206         if (control == NULL) {
3207                 /* no memory */
3208                 sctp_m_freem(m_notify);
3209                 return;
3210         }
3211         control->length = SCTP_BUF_LEN(m_notify);
3212         control->spec_flags = M_NOTIFICATION;
3213         /* not that we need this */
3214         control->tail_mbuf = m_notify;
3215         sb = &stcb->sctp_socket->so_rcv;
3216         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3217                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m_notify));
3218         }
3219         sctp_sballoc(stcb, sb, m_notify);
3220         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3221                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3222         }
3223         control->end_added = 1;
3224         if (stcb->asoc.control_pdapi)
3225                 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next);
3226         else {
3227                 /* we really should not see this case */
3228                 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next);
3229         }
3230         if (stcb->sctp_ep && stcb->sctp_socket) {
3231                 /* This should always be the case */
3232 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3233                 struct socket *so;
3234
3235                 so = SCTP_INP_SO(stcb->sctp_ep);
3236                 if (!so_locked) {
3237                         atomic_add_int(&stcb->asoc.refcnt, 1);
3238                         SCTP_TCB_UNLOCK(stcb);
3239                         SCTP_SOCKET_LOCK(so, 1);
3240                         SCTP_TCB_LOCK(stcb);
3241                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
3242                         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3243                                 SCTP_SOCKET_UNLOCK(so, 1);
3244                                 return;
3245                         }
3246                 }
3247 #endif
3248                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
3249 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3250                 if (!so_locked) {
3251                         SCTP_SOCKET_UNLOCK(so, 1);
3252                 }
3253 #endif
3254         }
3255 }
3256
3257 static void
3258 sctp_notify_shutdown_event(struct sctp_tcb *stcb)
3259 {
3260         struct mbuf *m_notify;
3261         struct sctp_shutdown_event *sse;
3262         struct sctp_queued_to_read *control;
3263
3264         /*
3265          * For TCP model AND UDP connected sockets we will send an error up
3266          * when an SHUTDOWN completes
3267          */
3268         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3269             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
3270                 /* mark socket closed for read/write and wakeup! */
3271 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3272                 struct socket *so;
3273
3274                 so = SCTP_INP_SO(stcb->sctp_ep);
3275                 atomic_add_int(&stcb->asoc.refcnt, 1);
3276                 SCTP_TCB_UNLOCK(stcb);
3277                 SCTP_SOCKET_LOCK(so, 1);
3278                 SCTP_TCB_LOCK(stcb);
3279                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3280                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
3281                         SCTP_SOCKET_UNLOCK(so, 1);
3282                         return;
3283                 }
3284 #endif
3285                 socantsendmore(stcb->sctp_socket);
3286 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3287                 SCTP_SOCKET_UNLOCK(so, 1);
3288 #endif
3289         }
3290         if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT)) {
3291                 /* event not enabled */
3292                 return;
3293         }
3294         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 0, M_NOWAIT, 1, MT_DATA);
3295         if (m_notify == NULL)
3296                 /* no space left */
3297                 return;
3298         sse = mtod(m_notify, struct sctp_shutdown_event *);
3299         memset(sse, 0, sizeof(struct sctp_shutdown_event));
3300         sse->sse_type = SCTP_SHUTDOWN_EVENT;
3301         sse->sse_flags = 0;
3302         sse->sse_length = sizeof(struct sctp_shutdown_event);
3303         sse->sse_assoc_id = sctp_get_associd(stcb);
3304
3305         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_shutdown_event);
3306         SCTP_BUF_NEXT(m_notify) = NULL;
3307
3308         /* append to socket */
3309         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3310             0, 0, stcb->asoc.context, 0, 0, 0,
3311             m_notify);
3312         if (control == NULL) {
3313                 /* no memory */
3314                 sctp_m_freem(m_notify);
3315                 return;
3316         }
3317         control->length = SCTP_BUF_LEN(m_notify);
3318         control->spec_flags = M_NOTIFICATION;
3319         /* not that we need this */
3320         control->tail_mbuf = m_notify;
3321         sctp_add_to_readq(stcb->sctp_ep, stcb,
3322             control,
3323             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3324 }
3325
3326 static void
3327 sctp_notify_sender_dry_event(struct sctp_tcb *stcb,
3328     int so_locked
3329 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3330     SCTP_UNUSED
3331 #endif
3332 )
3333 {
3334         struct mbuf *m_notify;
3335         struct sctp_sender_dry_event *event;
3336         struct sctp_queued_to_read *control;
3337
3338         if ((stcb == NULL) ||
3339             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DRYEVNT)) {
3340                 /* event not enabled */
3341                 return;
3342         }
3343         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_sender_dry_event), 0, M_NOWAIT, 1, MT_DATA);
3344         if (m_notify == NULL) {
3345                 /* no space left */
3346                 return;
3347         }
3348         SCTP_BUF_LEN(m_notify) = 0;
3349         event = mtod(m_notify, struct sctp_sender_dry_event *);
3350         memset(event, 0, sizeof(struct sctp_sender_dry_event));
3351         event->sender_dry_type = SCTP_SENDER_DRY_EVENT;
3352         event->sender_dry_flags = 0;
3353         event->sender_dry_length = sizeof(struct sctp_sender_dry_event);
3354         event->sender_dry_assoc_id = sctp_get_associd(stcb);
3355
3356         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_sender_dry_event);
3357         SCTP_BUF_NEXT(m_notify) = NULL;
3358
3359         /* append to socket */
3360         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3361             0, 0, stcb->asoc.context, 0, 0, 0,
3362             m_notify);
3363         if (control == NULL) {
3364                 /* no memory */
3365                 sctp_m_freem(m_notify);
3366                 return;
3367         }
3368         control->length = SCTP_BUF_LEN(m_notify);
3369         control->spec_flags = M_NOTIFICATION;
3370         /* not that we need this */
3371         control->tail_mbuf = m_notify;
3372         sctp_add_to_readq(stcb->sctp_ep, stcb, control,
3373             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3374 }
3375
3376
3377 void
3378 sctp_notify_stream_reset_add(struct sctp_tcb *stcb, uint16_t numberin, uint16_t numberout, int flag)
3379 {
3380         struct mbuf *m_notify;
3381         struct sctp_queued_to_read *control;
3382         struct sctp_stream_change_event *stradd;
3383
3384         if ((stcb == NULL) ||
3385             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT))) {
3386                 /* event not enabled */
3387                 return;
3388         }
3389         if ((stcb->asoc.peer_req_out) && flag) {
3390                 /* Peer made the request, don't tell the local user */
3391                 stcb->asoc.peer_req_out = 0;
3392                 return;
3393         }
3394         stcb->asoc.peer_req_out = 0;
3395         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_stream_change_event), 0, M_NOWAIT, 1, MT_DATA);
3396         if (m_notify == NULL)
3397                 /* no space left */
3398                 return;
3399         SCTP_BUF_LEN(m_notify) = 0;
3400         stradd = mtod(m_notify, struct sctp_stream_change_event *);
3401         memset(stradd, 0, sizeof(struct sctp_stream_change_event));
3402         stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT;
3403         stradd->strchange_flags = flag;
3404         stradd->strchange_length = sizeof(struct sctp_stream_change_event);
3405         stradd->strchange_assoc_id = sctp_get_associd(stcb);
3406         stradd->strchange_instrms = numberin;
3407         stradd->strchange_outstrms = numberout;
3408         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_stream_change_event);
3409         SCTP_BUF_NEXT(m_notify) = NULL;
3410         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3411                 /* no space */
3412                 sctp_m_freem(m_notify);
3413                 return;
3414         }
3415         /* append to socket */
3416         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3417             0, 0, stcb->asoc.context, 0, 0, 0,
3418             m_notify);
3419         if (control == NULL) {
3420                 /* no memory */
3421                 sctp_m_freem(m_notify);
3422                 return;
3423         }
3424         control->length = SCTP_BUF_LEN(m_notify);
3425         control->spec_flags = M_NOTIFICATION;
3426         /* not that we need this */
3427         control->tail_mbuf = m_notify;
3428         sctp_add_to_readq(stcb->sctp_ep, stcb,
3429             control,
3430             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3431 }
3432
3433 void
3434 sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb, uint32_t sending_tsn, uint32_t recv_tsn, int flag)
3435 {
3436         struct mbuf *m_notify;
3437         struct sctp_queued_to_read *control;
3438         struct sctp_assoc_reset_event *strasoc;
3439
3440         if ((stcb == NULL) ||
3441             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT))) {
3442                 /* event not enabled */
3443                 return;
3444         }
3445         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_reset_event), 0, M_NOWAIT, 1, MT_DATA);
3446         if (m_notify == NULL)
3447                 /* no space left */
3448                 return;
3449         SCTP_BUF_LEN(m_notify) = 0;
3450         strasoc = mtod(m_notify, struct sctp_assoc_reset_event *);
3451         memset(strasoc, 0, sizeof(struct sctp_assoc_reset_event));
3452         strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT;
3453         strasoc->assocreset_flags = flag;
3454         strasoc->assocreset_length = sizeof(struct sctp_assoc_reset_event);
3455         strasoc->assocreset_assoc_id = sctp_get_associd(stcb);
3456         strasoc->assocreset_local_tsn = sending_tsn;
3457         strasoc->assocreset_remote_tsn = recv_tsn;
3458         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_reset_event);
3459         SCTP_BUF_NEXT(m_notify) = NULL;
3460         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3461                 /* no space */
3462                 sctp_m_freem(m_notify);
3463                 return;
3464         }
3465         /* append to socket */
3466         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3467             0, 0, stcb->asoc.context, 0, 0, 0,
3468             m_notify);
3469         if (control == NULL) {
3470                 /* no memory */
3471                 sctp_m_freem(m_notify);
3472                 return;
3473         }
3474         control->length = SCTP_BUF_LEN(m_notify);
3475         control->spec_flags = M_NOTIFICATION;
3476         /* not that we need this */
3477         control->tail_mbuf = m_notify;
3478         sctp_add_to_readq(stcb->sctp_ep, stcb,
3479             control,
3480             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3481 }
3482
3483
3484
3485 static void
3486 sctp_notify_stream_reset(struct sctp_tcb *stcb,
3487     int number_entries, uint16_t *list, int flag)
3488 {
3489         struct mbuf *m_notify;
3490         struct sctp_queued_to_read *control;
3491         struct sctp_stream_reset_event *strreset;
3492         int len;
3493
3494         if ((stcb == NULL) ||
3495             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_RESETEVNT))) {
3496                 /* event not enabled */
3497                 return;
3498         }
3499         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
3500         if (m_notify == NULL)
3501                 /* no space left */
3502                 return;
3503         SCTP_BUF_LEN(m_notify) = 0;
3504         len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
3505         if (len > M_TRAILINGSPACE(m_notify)) {
3506                 /* never enough room */
3507                 sctp_m_freem(m_notify);
3508                 return;
3509         }
3510         strreset = mtod(m_notify, struct sctp_stream_reset_event *);
3511         memset(strreset, 0, len);
3512         strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
3513         strreset->strreset_flags = flag;
3514         strreset->strreset_length = len;
3515         strreset->strreset_assoc_id = sctp_get_associd(stcb);
3516         if (number_entries) {
3517                 int i;
3518
3519                 for (i = 0; i < number_entries; i++) {
3520                         strreset->strreset_stream_list[i] = ntohs(list[i]);
3521                 }
3522         }
3523         SCTP_BUF_LEN(m_notify) = len;
3524         SCTP_BUF_NEXT(m_notify) = NULL;
3525         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3526                 /* no space */
3527                 sctp_m_freem(m_notify);
3528                 return;
3529         }
3530         /* append to socket */
3531         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3532             0, 0, stcb->asoc.context, 0, 0, 0,
3533             m_notify);
3534         if (control == NULL) {
3535                 /* no memory */
3536                 sctp_m_freem(m_notify);
3537                 return;
3538         }
3539         control->length = SCTP_BUF_LEN(m_notify);
3540         control->spec_flags = M_NOTIFICATION;
3541         /* not that we need this */
3542         control->tail_mbuf = m_notify;
3543         sctp_add_to_readq(stcb->sctp_ep, stcb,
3544             control,
3545             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3546 }
3547
3548
3549 static void
3550 sctp_notify_remote_error(struct sctp_tcb *stcb, uint16_t error, struct sctp_error_chunk *chunk)
3551 {
3552         struct mbuf *m_notify;
3553         struct sctp_remote_error *sre;
3554         struct sctp_queued_to_read *control;
3555         unsigned int notif_len;
3556         uint16_t chunk_len;
3557
3558         if ((stcb == NULL) ||
3559             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPEERERR)) {
3560                 return;
3561         }
3562         if (chunk != NULL) {
3563                 chunk_len = ntohs(chunk->ch.chunk_length);
3564         } else {
3565                 chunk_len = 0;
3566         }
3567         notif_len = (unsigned int)(sizeof(struct sctp_remote_error) + chunk_len);
3568         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3569         if (m_notify == NULL) {
3570                 /* Retry with smaller value. */
3571                 notif_len = (unsigned int)sizeof(struct sctp_remote_error);
3572                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3573                 if (m_notify == NULL) {
3574                         return;
3575                 }
3576         }
3577         SCTP_BUF_NEXT(m_notify) = NULL;
3578         sre = mtod(m_notify, struct sctp_remote_error *);
3579         memset(sre, 0, notif_len);
3580         sre->sre_type = SCTP_REMOTE_ERROR;
3581         sre->sre_flags = 0;
3582         sre->sre_length = sizeof(struct sctp_remote_error);
3583         sre->sre_error = error;
3584         sre->sre_assoc_id = sctp_get_associd(stcb);
3585         if (notif_len > sizeof(struct sctp_remote_error)) {
3586                 memcpy(sre->sre_data, chunk, chunk_len);
3587                 sre->sre_length += chunk_len;
3588         }
3589         SCTP_BUF_LEN(m_notify) = sre->sre_length;
3590         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3591             0, 0, stcb->asoc.context, 0, 0, 0,
3592             m_notify);
3593         if (control != NULL) {
3594                 control->length = SCTP_BUF_LEN(m_notify);
3595                 control->spec_flags = M_NOTIFICATION;
3596                 /* not that we need this */
3597                 control->tail_mbuf = m_notify;
3598                 sctp_add_to_readq(stcb->sctp_ep, stcb,
3599                     control,
3600                     &stcb->sctp_socket->so_rcv, 1,
3601                     SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3602         } else {
3603                 sctp_m_freem(m_notify);
3604         }
3605 }
3606
3607
3608 void
3609 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb,
3610     uint32_t error, void *data, int so_locked
3611 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3612     SCTP_UNUSED
3613 #endif
3614 )
3615 {
3616         if ((stcb == NULL) ||
3617             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3618             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3619             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3620                 /* If the socket is gone we are out of here */
3621                 return;
3622         }
3623         if (stcb->sctp_socket->so_rcv.sb_state & SBS_CANTRCVMORE) {
3624                 return;
3625         }
3626         if ((stcb->asoc.state & SCTP_STATE_COOKIE_WAIT) ||
3627             (stcb->asoc.state & SCTP_STATE_COOKIE_ECHOED)) {
3628                 if ((notification == SCTP_NOTIFY_INTERFACE_DOWN) ||
3629                     (notification == SCTP_NOTIFY_INTERFACE_UP) ||
3630                     (notification == SCTP_NOTIFY_INTERFACE_CONFIRMED)) {
3631                         /* Don't report these in front states */
3632                         return;
3633                 }
3634         }
3635         switch (notification) {
3636         case SCTP_NOTIFY_ASSOC_UP:
3637                 if (stcb->asoc.assoc_up_sent == 0) {
3638                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, NULL, 0, so_locked);
3639                         stcb->asoc.assoc_up_sent = 1;
3640                 }
3641                 if (stcb->asoc.adaptation_needed && (stcb->asoc.adaptation_sent == 0)) {
3642                         sctp_notify_adaptation_layer(stcb);
3643                 }
3644                 if (stcb->asoc.auth_supported == 0) {
3645                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3646                             NULL, so_locked);
3647                 }
3648                 break;
3649         case SCTP_NOTIFY_ASSOC_DOWN:
3650                 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, NULL, 0, so_locked);
3651                 break;
3652         case SCTP_NOTIFY_INTERFACE_DOWN:
3653                 {
3654                         struct sctp_nets *net;
3655
3656                         net = (struct sctp_nets *)data;
3657                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE,
3658                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
3659                         break;
3660                 }
3661         case SCTP_NOTIFY_INTERFACE_UP:
3662                 {
3663                         struct sctp_nets *net;
3664
3665                         net = (struct sctp_nets *)data;
3666                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE,
3667                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
3668                         break;
3669                 }
3670         case SCTP_NOTIFY_INTERFACE_CONFIRMED:
3671                 {
3672                         struct sctp_nets *net;
3673
3674                         net = (struct sctp_nets *)data;
3675                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED,
3676                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
3677                         break;
3678                 }
3679         case SCTP_NOTIFY_SPECIAL_SP_FAIL:
3680                 sctp_notify_send_failed2(stcb, error,
3681                     (struct sctp_stream_queue_pending *)data, so_locked);
3682                 break;
3683         case SCTP_NOTIFY_SENT_DG_FAIL:
3684                 sctp_notify_send_failed(stcb, 1, error,
3685                     (struct sctp_tmit_chunk *)data, so_locked);
3686                 break;
3687         case SCTP_NOTIFY_UNSENT_DG_FAIL:
3688                 sctp_notify_send_failed(stcb, 0, error,
3689                     (struct sctp_tmit_chunk *)data, so_locked);
3690                 break;
3691         case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION:
3692                 {
3693                         uint32_t val;
3694
3695                         val = *((uint32_t *)data);
3696
3697                         sctp_notify_partial_delivery_indication(stcb, error, val, so_locked);
3698                         break;
3699                 }
3700         case SCTP_NOTIFY_ASSOC_LOC_ABORTED:
3701                 if (((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_WAIT) ||
3702                     ((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_ECHOED)) {
3703                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 0, so_locked);
3704                 } else {
3705                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 0, so_locked);
3706                 }
3707                 break;
3708         case SCTP_NOTIFY_ASSOC_REM_ABORTED:
3709                 if (((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_WAIT) ||
3710                     ((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_ECHOED)) {
3711                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 1, so_locked);
3712                 } else {
3713                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 1, so_locked);
3714                 }
3715                 break;
3716         case SCTP_NOTIFY_ASSOC_RESTART:
3717                 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, NULL, 0, so_locked);
3718                 if (stcb->asoc.auth_supported == 0) {
3719                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3720                             NULL, so_locked);
3721                 }
3722                 break;
3723         case SCTP_NOTIFY_STR_RESET_SEND:
3724                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_OUTGOING_SSN);
3725                 break;
3726         case SCTP_NOTIFY_STR_RESET_RECV:
3727                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data), SCTP_STREAM_RESET_INCOMING);
3728                 break;
3729         case SCTP_NOTIFY_STR_RESET_FAILED_OUT:
3730                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
3731                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_FAILED));
3732                 break;
3733         case SCTP_NOTIFY_STR_RESET_DENIED_OUT:
3734                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
3735                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_DENIED));
3736                 break;
3737         case SCTP_NOTIFY_STR_RESET_FAILED_IN:
3738                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
3739                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_FAILED));
3740                 break;
3741         case SCTP_NOTIFY_STR_RESET_DENIED_IN:
3742                 sctp_notify_stream_reset(stcb, error, ((uint16_t *)data),
3743                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_DENIED));
3744                 break;
3745         case SCTP_NOTIFY_ASCONF_ADD_IP:
3746                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data,
3747                     error, so_locked);
3748                 break;
3749         case SCTP_NOTIFY_ASCONF_DELETE_IP:
3750                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data,
3751                     error, so_locked);
3752                 break;
3753         case SCTP_NOTIFY_ASCONF_SET_PRIMARY:
3754                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data,
3755                     error, so_locked);
3756                 break;
3757         case SCTP_NOTIFY_PEER_SHUTDOWN:
3758                 sctp_notify_shutdown_event(stcb);
3759                 break;
3760         case SCTP_NOTIFY_AUTH_NEW_KEY:
3761                 sctp_notify_authentication(stcb, SCTP_AUTH_NEW_KEY, error,
3762                     (uint16_t)(uintptr_t)data,
3763                     so_locked);
3764                 break;
3765         case SCTP_NOTIFY_AUTH_FREE_KEY:
3766                 sctp_notify_authentication(stcb, SCTP_AUTH_FREE_KEY, error,
3767                     (uint16_t)(uintptr_t)data,
3768                     so_locked);
3769                 break;
3770         case SCTP_NOTIFY_NO_PEER_AUTH:
3771                 sctp_notify_authentication(stcb, SCTP_AUTH_NO_AUTH, error,
3772                     (uint16_t)(uintptr_t)data,
3773                     so_locked);
3774                 break;
3775         case SCTP_NOTIFY_SENDER_DRY:
3776                 sctp_notify_sender_dry_event(stcb, so_locked);
3777                 break;
3778         case SCTP_NOTIFY_REMOTE_ERROR:
3779                 sctp_notify_remote_error(stcb, error, data);
3780                 break;
3781         default:
3782                 SCTPDBG(SCTP_DEBUG_UTIL1, "%s: unknown notification %xh (%u)\n",
3783                     __func__, notification, notification);
3784                 break;
3785         }                       /* end switch */
3786 }
3787
3788 void
3789 sctp_report_all_outbound(struct sctp_tcb *stcb, uint16_t error, int holds_lock, int so_locked
3790 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3791     SCTP_UNUSED
3792 #endif
3793 )
3794 {
3795         struct sctp_association *asoc;
3796         struct sctp_stream_out *outs;
3797         struct sctp_tmit_chunk *chk, *nchk;
3798         struct sctp_stream_queue_pending *sp, *nsp;
3799         int i;
3800
3801         if (stcb == NULL) {
3802                 return;
3803         }
3804         asoc = &stcb->asoc;
3805         if (asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) {
3806                 /* already being freed */
3807                 return;
3808         }
3809         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3810             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3811             (asoc->state & SCTP_STATE_CLOSED_SOCKET)) {
3812                 return;
3813         }
3814         /* now through all the gunk freeing chunks */
3815         if (holds_lock == 0) {
3816                 SCTP_TCB_SEND_LOCK(stcb);
3817         }
3818         /* sent queue SHOULD be empty */
3819         TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) {
3820                 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
3821                 asoc->sent_queue_cnt--;
3822                 if (chk->sent != SCTP_DATAGRAM_NR_ACKED) {
3823                         if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
3824                                 asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
3825 #ifdef INVARIANTS
3826                         } else {
3827                                 panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
3828 #endif
3829                         }
3830                 }
3831                 if (chk->data != NULL) {
3832                         sctp_free_bufspace(stcb, asoc, chk, 1);
3833                         sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb,
3834                             error, chk, so_locked);
3835                         if (chk->data) {
3836                                 sctp_m_freem(chk->data);
3837                                 chk->data = NULL;
3838                         }
3839                 }
3840                 sctp_free_a_chunk(stcb, chk, so_locked);
3841                 /* sa_ignore FREED_MEMORY */
3842         }
3843         /* pending send queue SHOULD be empty */
3844         TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
3845                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
3846                 asoc->send_queue_cnt--;
3847                 if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
3848                         asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
3849 #ifdef INVARIANTS
3850                 } else {
3851                         panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
3852 #endif
3853                 }
3854                 if (chk->data != NULL) {
3855                         sctp_free_bufspace(stcb, asoc, chk, 1);
3856                         sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
3857                             error, chk, so_locked);
3858                         if (chk->data) {
3859                                 sctp_m_freem(chk->data);
3860                                 chk->data = NULL;
3861                         }
3862                 }
3863                 sctp_free_a_chunk(stcb, chk, so_locked);
3864                 /* sa_ignore FREED_MEMORY */
3865         }
3866         for (i = 0; i < asoc->streamoutcnt; i++) {
3867                 /* For each stream */
3868                 outs = &asoc->strmout[i];
3869                 /* clean up any sends there */
3870                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
3871                         atomic_subtract_int(&asoc->stream_queue_cnt, 1);
3872                         TAILQ_REMOVE(&outs->outqueue, sp, next);
3873                         stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, holds_lock);
3874                         sctp_free_spbufspace(stcb, asoc, sp);
3875                         if (sp->data) {
3876                                 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
3877                                     error, (void *)sp, so_locked);
3878                                 if (sp->data) {
3879                                         sctp_m_freem(sp->data);
3880                                         sp->data = NULL;
3881                                         sp->tail_mbuf = NULL;
3882                                         sp->length = 0;
3883                                 }
3884                         }
3885                         if (sp->net) {
3886                                 sctp_free_remote_addr(sp->net);
3887                                 sp->net = NULL;
3888                         }
3889                         /* Free the chunk */
3890                         sctp_free_a_strmoq(stcb, sp, so_locked);
3891                         /* sa_ignore FREED_MEMORY */
3892                 }
3893         }
3894
3895         if (holds_lock == 0) {
3896                 SCTP_TCB_SEND_UNLOCK(stcb);
3897         }
3898 }
3899
3900 void
3901 sctp_abort_notification(struct sctp_tcb *stcb, uint8_t from_peer, uint16_t error,
3902     struct sctp_abort_chunk *abort, int so_locked
3903 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3904     SCTP_UNUSED
3905 #endif
3906 )
3907 {
3908         if (stcb == NULL) {
3909                 return;
3910         }
3911         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
3912             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
3913             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
3914                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED;
3915         }
3916         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3917             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3918             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3919                 return;
3920         }
3921         /* Tell them we lost the asoc */
3922         sctp_report_all_outbound(stcb, error, 1, so_locked);
3923         if (from_peer) {
3924                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_REM_ABORTED, stcb, error, abort, so_locked);
3925         } else {
3926                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_LOC_ABORTED, stcb, error, abort, so_locked);
3927         }
3928 }
3929
3930 void
3931 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3932     struct mbuf *m, int iphlen,
3933     struct sockaddr *src, struct sockaddr *dst,
3934     struct sctphdr *sh, struct mbuf *op_err,
3935     uint8_t mflowtype, uint32_t mflowid,
3936     uint32_t vrf_id, uint16_t port)
3937 {
3938         uint32_t vtag;
3939 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3940         struct socket *so;
3941 #endif
3942
3943         vtag = 0;
3944         if (stcb != NULL) {
3945                 vtag = stcb->asoc.peer_vtag;
3946                 vrf_id = stcb->asoc.vrf_id;
3947         }
3948         sctp_send_abort(m, iphlen, src, dst, sh, vtag, op_err,
3949             mflowtype, mflowid, inp->fibnum,
3950             vrf_id, port);
3951         if (stcb != NULL) {
3952                 /* We have a TCB to abort, send notification too */
3953                 sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED);
3954                 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
3955                 /* Ok, now lets free it */
3956 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3957                 so = SCTP_INP_SO(inp);
3958                 atomic_add_int(&stcb->asoc.refcnt, 1);
3959                 SCTP_TCB_UNLOCK(stcb);
3960                 SCTP_SOCKET_LOCK(so, 1);
3961                 SCTP_TCB_LOCK(stcb);
3962                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3963 #endif
3964                 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3965                 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
3966                     (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3967                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3968                 }
3969                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
3970                     SCTP_FROM_SCTPUTIL + SCTP_LOC_4);
3971 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3972                 SCTP_SOCKET_UNLOCK(so, 1);
3973 #endif
3974         }
3975 }
3976 #ifdef SCTP_ASOCLOG_OF_TSNS
3977 void
3978 sctp_print_out_track_log(struct sctp_tcb *stcb)
3979 {
3980 #ifdef NOSIY_PRINTS
3981         int i;
3982
3983         SCTP_PRINTF("Last ep reason:%x\n", stcb->sctp_ep->last_abort_code);
3984         SCTP_PRINTF("IN bound TSN log-aaa\n");
3985         if ((stcb->asoc.tsn_in_at == 0) && (stcb->asoc.tsn_in_wrapped == 0)) {
3986                 SCTP_PRINTF("None rcvd\n");
3987                 goto none_in;
3988         }
3989         if (stcb->asoc.tsn_in_wrapped) {
3990                 for (i = stcb->asoc.tsn_in_at; i < SCTP_TSN_LOG_SIZE; i++) {
3991                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3992                             stcb->asoc.in_tsnlog[i].tsn,
3993                             stcb->asoc.in_tsnlog[i].strm,
3994                             stcb->asoc.in_tsnlog[i].seq,
3995                             stcb->asoc.in_tsnlog[i].flgs,
3996                             stcb->asoc.in_tsnlog[i].sz);
3997                 }
3998         }
3999         if (stcb->asoc.tsn_in_at) {
4000                 for (i = 0; i < stcb->asoc.tsn_in_at; i++) {
4001                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4002                             stcb->asoc.in_tsnlog[i].tsn,
4003                             stcb->asoc.in_tsnlog[i].strm,
4004                             stcb->asoc.in_tsnlog[i].seq,
4005                             stcb->asoc.in_tsnlog[i].flgs,
4006                             stcb->asoc.in_tsnlog[i].sz);
4007                 }
4008         }
4009 none_in:
4010         SCTP_PRINTF("OUT bound TSN log-aaa\n");
4011         if ((stcb->asoc.tsn_out_at == 0) &&
4012             (stcb->asoc.tsn_out_wrapped == 0)) {
4013                 SCTP_PRINTF("None sent\n");
4014         }
4015         if (stcb->asoc.tsn_out_wrapped) {
4016                 for (i = stcb->asoc.tsn_out_at; i < SCTP_TSN_LOG_SIZE; i++) {
4017                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4018                             stcb->asoc.out_tsnlog[i].tsn,
4019                             stcb->asoc.out_tsnlog[i].strm,
4020                             stcb->asoc.out_tsnlog[i].seq,
4021                             stcb->asoc.out_tsnlog[i].flgs,
4022                             stcb->asoc.out_tsnlog[i].sz);
4023                 }
4024         }
4025         if (stcb->asoc.tsn_out_at) {
4026                 for (i = 0; i < stcb->asoc.tsn_out_at; i++) {
4027                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4028                             stcb->asoc.out_tsnlog[i].tsn,
4029                             stcb->asoc.out_tsnlog[i].strm,
4030                             stcb->asoc.out_tsnlog[i].seq,
4031                             stcb->asoc.out_tsnlog[i].flgs,
4032                             stcb->asoc.out_tsnlog[i].sz);
4033                 }
4034         }
4035 #endif
4036 }
4037 #endif
4038
4039 void
4040 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
4041     struct mbuf *op_err,
4042     int so_locked
4043 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4044     SCTP_UNUSED
4045 #endif
4046 )
4047 {
4048 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4049         struct socket *so;
4050 #endif
4051
4052 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4053         so = SCTP_INP_SO(inp);
4054 #endif
4055         if (stcb == NULL) {
4056                 /* Got to have a TCB */
4057                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4058                         if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4059                                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4060                                     SCTP_CALLED_DIRECTLY_NOCMPSET);
4061                         }
4062                 }
4063                 return;
4064         } else {
4065                 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
4066         }
4067         /* notify the peer */
4068         sctp_send_abort_tcb(stcb, op_err, so_locked);
4069         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4070         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
4071             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4072                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4073         }
4074         /* notify the ulp */
4075         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) {
4076                 sctp_abort_notification(stcb, 0, 0, NULL, so_locked);
4077         }
4078         /* now free the asoc */
4079 #ifdef SCTP_ASOCLOG_OF_TSNS
4080         sctp_print_out_track_log(stcb);
4081 #endif
4082 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4083         if (!so_locked) {
4084                 atomic_add_int(&stcb->asoc.refcnt, 1);
4085                 SCTP_TCB_UNLOCK(stcb);
4086                 SCTP_SOCKET_LOCK(so, 1);
4087                 SCTP_TCB_LOCK(stcb);
4088                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4089         }
4090 #endif
4091         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4092             SCTP_FROM_SCTPUTIL + SCTP_LOC_5);
4093 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4094         if (!so_locked) {
4095                 SCTP_SOCKET_UNLOCK(so, 1);
4096         }
4097 #endif
4098 }
4099
4100 void
4101 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset,
4102     struct sockaddr *src, struct sockaddr *dst,
4103     struct sctphdr *sh, struct sctp_inpcb *inp,
4104     struct mbuf *cause,
4105     uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
4106     uint32_t vrf_id, uint16_t port)
4107 {
4108         struct sctp_chunkhdr *ch, chunk_buf;
4109         unsigned int chk_length;
4110         int contains_init_chunk;
4111
4112         SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue);
4113         /* Generate a TO address for future reference */
4114         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
4115                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4116                         sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4117                             SCTP_CALLED_DIRECTLY_NOCMPSET);
4118                 }
4119         }
4120         contains_init_chunk = 0;
4121         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4122             sizeof(*ch), (uint8_t *)&chunk_buf);
4123         while (ch != NULL) {
4124                 chk_length = ntohs(ch->chunk_length);
4125                 if (chk_length < sizeof(*ch)) {
4126                         /* break to abort land */
4127                         break;
4128                 }
4129                 switch (ch->chunk_type) {
4130                 case SCTP_INIT:
4131                         contains_init_chunk = 1;
4132                         break;
4133                 case SCTP_PACKET_DROPPED:
4134                         /* we don't respond to pkt-dropped */
4135                         return;
4136                 case SCTP_ABORT_ASSOCIATION:
4137                         /* we don't respond with an ABORT to an ABORT */
4138                         return;
4139                 case SCTP_SHUTDOWN_COMPLETE:
4140                         /*
4141                          * we ignore it since we are not waiting for it and
4142                          * peer is gone
4143                          */
4144                         return;
4145                 case SCTP_SHUTDOWN_ACK:
4146                         sctp_send_shutdown_complete2(src, dst, sh,
4147                             mflowtype, mflowid, fibnum,
4148                             vrf_id, port);
4149                         return;
4150                 default:
4151                         break;
4152                 }
4153                 offset += SCTP_SIZE32(chk_length);
4154                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4155                     sizeof(*ch), (uint8_t *)&chunk_buf);
4156         }
4157         if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
4158             ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
4159             (contains_init_chunk == 0))) {
4160                 sctp_send_abort(m, iphlen, src, dst, sh, 0, cause,
4161                     mflowtype, mflowid, fibnum,
4162                     vrf_id, port);
4163         }
4164 }
4165
4166 /*
4167  * check the inbound datagram to make sure there is not an abort inside it,
4168  * if there is return 1, else return 0.
4169  */
4170 int
4171 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t *vtagfill)
4172 {
4173         struct sctp_chunkhdr *ch;
4174         struct sctp_init_chunk *init_chk, chunk_buf;
4175         int offset;
4176         unsigned int chk_length;
4177
4178         offset = iphlen + sizeof(struct sctphdr);
4179         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch),
4180             (uint8_t *)&chunk_buf);
4181         while (ch != NULL) {
4182                 chk_length = ntohs(ch->chunk_length);
4183                 if (chk_length < sizeof(*ch)) {
4184                         /* packet is probably corrupt */
4185                         break;
4186                 }
4187                 /* we seem to be ok, is it an abort? */
4188                 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) {
4189                         /* yep, tell them */
4190                         return (1);
4191                 }
4192                 if (ch->chunk_type == SCTP_INITIATION) {
4193                         /* need to update the Vtag */
4194                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
4195                             offset, sizeof(*init_chk), (uint8_t *)&chunk_buf);
4196                         if (init_chk != NULL) {
4197                                 *vtagfill = ntohl(init_chk->init.initiate_tag);
4198                         }
4199                 }
4200                 /* Nope, move to the next chunk */
4201                 offset += SCTP_SIZE32(chk_length);
4202                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4203                     sizeof(*ch), (uint8_t *)&chunk_buf);
4204         }
4205         return (0);
4206 }
4207
4208 /*
4209  * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id
4210  * set (i.e. it's 0) so, create this function to compare link local scopes
4211  */
4212 #ifdef INET6
4213 uint32_t
4214 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2)
4215 {
4216         struct sockaddr_in6 a, b;
4217
4218         /* save copies */
4219         a = *addr1;
4220         b = *addr2;
4221
4222         if (a.sin6_scope_id == 0)
4223                 if (sa6_recoverscope(&a)) {
4224                         /* can't get scope, so can't match */
4225                         return (0);
4226                 }
4227         if (b.sin6_scope_id == 0)
4228                 if (sa6_recoverscope(&b)) {
4229                         /* can't get scope, so can't match */
4230                         return (0);
4231                 }
4232         if (a.sin6_scope_id != b.sin6_scope_id)
4233                 return (0);
4234
4235         return (1);
4236 }
4237
4238 /*
4239  * returns a sockaddr_in6 with embedded scope recovered and removed
4240  */
4241 struct sockaddr_in6 *
4242 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store)
4243 {
4244         /* check and strip embedded scope junk */
4245         if (addr->sin6_family == AF_INET6) {
4246                 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) {
4247                         if (addr->sin6_scope_id == 0) {
4248                                 *store = *addr;
4249                                 if (!sa6_recoverscope(store)) {
4250                                         /* use the recovered scope */
4251                                         addr = store;
4252                                 }
4253                         } else {
4254                                 /* else, return the original "to" addr */
4255                                 in6_clearscope(&addr->sin6_addr);
4256                         }
4257                 }
4258         }
4259         return (addr);
4260 }
4261 #endif
4262
4263 /*
4264  * are the two addresses the same?  currently a "scopeless" check returns: 1
4265  * if same, 0 if not
4266  */
4267 int
4268 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2)
4269 {
4270
4271         /* must be valid */
4272         if (sa1 == NULL || sa2 == NULL)
4273                 return (0);
4274
4275         /* must be the same family */
4276         if (sa1->sa_family != sa2->sa_family)
4277                 return (0);
4278
4279         switch (sa1->sa_family) {
4280 #ifdef INET6
4281         case AF_INET6:
4282                 {
4283                         /* IPv6 addresses */
4284                         struct sockaddr_in6 *sin6_1, *sin6_2;
4285
4286                         sin6_1 = (struct sockaddr_in6 *)sa1;
4287                         sin6_2 = (struct sockaddr_in6 *)sa2;
4288                         return (SCTP6_ARE_ADDR_EQUAL(sin6_1,
4289                             sin6_2));
4290                 }
4291 #endif
4292 #ifdef INET
4293         case AF_INET:
4294                 {
4295                         /* IPv4 addresses */
4296                         struct sockaddr_in *sin_1, *sin_2;
4297
4298                         sin_1 = (struct sockaddr_in *)sa1;
4299                         sin_2 = (struct sockaddr_in *)sa2;
4300                         return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr);
4301                 }
4302 #endif
4303         default:
4304                 /* we don't do these... */
4305                 return (0);
4306         }
4307 }
4308
4309 void
4310 sctp_print_address(struct sockaddr *sa)
4311 {
4312 #ifdef INET6
4313         char ip6buf[INET6_ADDRSTRLEN];
4314 #endif
4315
4316         switch (sa->sa_family) {
4317 #ifdef INET6
4318         case AF_INET6:
4319                 {
4320                         struct sockaddr_in6 *sin6;
4321
4322                         sin6 = (struct sockaddr_in6 *)sa;
4323                         SCTP_PRINTF("IPv6 address: %s:port:%d scope:%u\n",
4324                             ip6_sprintf(ip6buf, &sin6->sin6_addr),
4325                             ntohs(sin6->sin6_port),
4326                             sin6->sin6_scope_id);
4327                         break;
4328                 }
4329 #endif
4330 #ifdef INET
4331         case AF_INET:
4332                 {
4333                         struct sockaddr_in *sin;
4334                         unsigned char *p;
4335
4336                         sin = (struct sockaddr_in *)sa;
4337                         p = (unsigned char *)&sin->sin_addr;
4338                         SCTP_PRINTF("IPv4 address: %u.%u.%u.%u:%d\n",
4339                             p[0], p[1], p[2], p[3], ntohs(sin->sin_port));
4340                         break;
4341                 }
4342 #endif
4343         default:
4344                 SCTP_PRINTF("?\n");
4345                 break;
4346         }
4347 }
4348
4349 void
4350 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
4351     struct sctp_inpcb *new_inp,
4352     struct sctp_tcb *stcb,
4353     int waitflags)
4354 {
4355         /*
4356          * go through our old INP and pull off any control structures that
4357          * belong to stcb and move then to the new inp.
4358          */
4359         struct socket *old_so, *new_so;
4360         struct sctp_queued_to_read *control, *nctl;
4361         struct sctp_readhead tmp_queue;
4362         struct mbuf *m;
4363         int error = 0;
4364
4365         old_so = old_inp->sctp_socket;
4366         new_so = new_inp->sctp_socket;
4367         TAILQ_INIT(&tmp_queue);
4368         error = sblock(&old_so->so_rcv, waitflags);
4369         if (error) {
4370                 /*
4371                  * Gak, can't get sblock, we have a problem. data will be
4372                  * left stranded.. and we don't dare look at it since the
4373                  * other thread may be reading something. Oh well, its a
4374                  * screwed up app that does a peeloff OR a accept while
4375                  * reading from the main socket... actually its only the
4376                  * peeloff() case, since I think read will fail on a
4377                  * listening socket..
4378                  */
4379                 return;
4380         }
4381         /* lock the socket buffers */
4382         SCTP_INP_READ_LOCK(old_inp);
4383         TAILQ_FOREACH_SAFE(control, &old_inp->read_queue, next, nctl) {
4384                 /* Pull off all for out target stcb */
4385                 if (control->stcb == stcb) {
4386                         /* remove it we want it */
4387                         TAILQ_REMOVE(&old_inp->read_queue, control, next);
4388                         TAILQ_INSERT_TAIL(&tmp_queue, control, next);
4389                         m = control->data;
4390                         while (m) {
4391                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4392                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
4393                                 }
4394                                 sctp_sbfree(control, stcb, &old_so->so_rcv, m);
4395                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4396                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4397                                 }
4398                                 m = SCTP_BUF_NEXT(m);
4399                         }
4400                 }
4401         }
4402         SCTP_INP_READ_UNLOCK(old_inp);
4403         /* Remove the sb-lock on the old socket */
4404
4405         sbunlock(&old_so->so_rcv);
4406         /* Now we move them over to the new socket buffer */
4407         SCTP_INP_READ_LOCK(new_inp);
4408         TAILQ_FOREACH_SAFE(control, &tmp_queue, next, nctl) {
4409                 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next);
4410                 m = control->data;
4411                 while (m) {
4412                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4413                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4414                         }
4415                         sctp_sballoc(stcb, &new_so->so_rcv, m);
4416                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4417                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4418                         }
4419                         m = SCTP_BUF_NEXT(m);
4420                 }
4421         }
4422         SCTP_INP_READ_UNLOCK(new_inp);
4423 }
4424
4425 void
4426 sctp_wakeup_the_read_socket(struct sctp_inpcb *inp,
4427     struct sctp_tcb *stcb,
4428     int so_locked
4429 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4430     SCTP_UNUSED
4431 #endif
4432 )
4433 {
4434         if ((inp != NULL) && (inp->sctp_socket != NULL)) {
4435 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4436                 struct socket *so;
4437
4438                 so = SCTP_INP_SO(inp);
4439                 if (!so_locked) {
4440                         if (stcb) {
4441                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4442                                 SCTP_TCB_UNLOCK(stcb);
4443                         }
4444                         SCTP_SOCKET_LOCK(so, 1);
4445                         if (stcb) {
4446                                 SCTP_TCB_LOCK(stcb);
4447                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4448                         }
4449                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4450                                 SCTP_SOCKET_UNLOCK(so, 1);
4451                                 return;
4452                         }
4453                 }
4454 #endif
4455                 sctp_sorwakeup(inp, inp->sctp_socket);
4456 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4457                 if (!so_locked) {
4458                         SCTP_SOCKET_UNLOCK(so, 1);
4459                 }
4460 #endif
4461         }
4462 }
4463
4464 void
4465 sctp_add_to_readq(struct sctp_inpcb *inp,
4466     struct sctp_tcb *stcb,
4467     struct sctp_queued_to_read *control,
4468     struct sockbuf *sb,
4469     int end,
4470     int inp_read_lock_held,
4471     int so_locked
4472 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4473     SCTP_UNUSED
4474 #endif
4475 )
4476 {
4477         /*
4478          * Here we must place the control on the end of the socket read
4479          * queue AND increment sb_cc so that select will work properly on
4480          * read.
4481          */
4482         struct mbuf *m, *prev = NULL;
4483
4484         if (inp == NULL) {
4485                 /* Gak, TSNH!! */
4486 #ifdef INVARIANTS
4487                 panic("Gak, inp NULL on add_to_readq");
4488 #endif
4489                 return;
4490         }
4491         if (inp_read_lock_held == 0)
4492                 SCTP_INP_READ_LOCK(inp);
4493         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
4494                 sctp_free_remote_addr(control->whoFrom);
4495                 if (control->data) {
4496                         sctp_m_freem(control->data);
4497                         control->data = NULL;
4498                 }
4499                 sctp_free_a_readq(stcb, control);
4500                 if (inp_read_lock_held == 0)
4501                         SCTP_INP_READ_UNLOCK(inp);
4502                 return;
4503         }
4504         if (!(control->spec_flags & M_NOTIFICATION)) {
4505                 atomic_add_int(&inp->total_recvs, 1);
4506                 if (!control->do_not_ref_stcb) {
4507                         atomic_add_int(&stcb->total_recvs, 1);
4508                 }
4509         }
4510         m = control->data;
4511         control->held_length = 0;
4512         control->length = 0;
4513         while (m) {
4514                 if (SCTP_BUF_LEN(m) == 0) {
4515                         /* Skip mbufs with NO length */
4516                         if (prev == NULL) {
4517                                 /* First one */
4518                                 control->data = sctp_m_free(m);
4519                                 m = control->data;
4520                         } else {
4521                                 SCTP_BUF_NEXT(prev) = sctp_m_free(m);
4522                                 m = SCTP_BUF_NEXT(prev);
4523                         }
4524                         if (m == NULL) {
4525                                 control->tail_mbuf = prev;
4526                         }
4527                         continue;
4528                 }
4529                 prev = m;
4530                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4531                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4532                 }
4533                 sctp_sballoc(stcb, sb, m);
4534                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4535                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4536                 }
4537                 atomic_add_int(&control->length, SCTP_BUF_LEN(m));
4538                 m = SCTP_BUF_NEXT(m);
4539         }
4540         if (prev != NULL) {
4541                 control->tail_mbuf = prev;
4542         } else {
4543                 /* Everything got collapsed out?? */
4544                 sctp_free_remote_addr(control->whoFrom);
4545                 sctp_free_a_readq(stcb, control);
4546                 if (inp_read_lock_held == 0)
4547                         SCTP_INP_READ_UNLOCK(inp);
4548                 return;
4549         }
4550         if (end) {
4551                 control->end_added = 1;
4552         }
4553         TAILQ_INSERT_TAIL(&inp->read_queue, control, next);
4554         control->on_read_q = 1;
4555         if (inp_read_lock_held == 0)
4556                 SCTP_INP_READ_UNLOCK(inp);
4557         if (inp && inp->sctp_socket) {
4558                 sctp_wakeup_the_read_socket(inp, stcb, so_locked);
4559         }
4560 }
4561
4562 /*************HOLD THIS COMMENT FOR PATCH FILE OF
4563  *************ALTERNATE ROUTING CODE
4564  */
4565
4566 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF
4567  *************ALTERNATE ROUTING CODE
4568  */
4569
4570 struct mbuf *
4571 sctp_generate_cause(uint16_t code, char *info)
4572 {
4573         struct mbuf *m;
4574         struct sctp_gen_error_cause *cause;
4575         size_t info_len;
4576         uint16_t len;
4577
4578         if ((code == 0) || (info == NULL)) {
4579                 return (NULL);
4580         }
4581         info_len = strlen(info);
4582         if (info_len > (SCTP_MAX_CAUSE_LENGTH - sizeof(struct sctp_paramhdr))) {
4583                 return (NULL);
4584         }
4585         len = (uint16_t)(sizeof(struct sctp_paramhdr) + info_len);
4586         m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
4587         if (m != NULL) {
4588                 SCTP_BUF_LEN(m) = len;
4589                 cause = mtod(m, struct sctp_gen_error_cause *);
4590                 cause->code = htons(code);
4591                 cause->length = htons(len);
4592                 memcpy(cause->info, info, info_len);
4593         }
4594         return (m);
4595 }
4596
4597 struct mbuf *
4598 sctp_generate_no_user_data_cause(uint32_t tsn)
4599 {
4600         struct mbuf *m;
4601         struct sctp_error_no_user_data *no_user_data_cause;
4602         uint16_t len;
4603
4604         len = (uint16_t)sizeof(struct sctp_error_no_user_data);
4605         m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
4606         if (m != NULL) {
4607                 SCTP_BUF_LEN(m) = len;
4608                 no_user_data_cause = mtod(m, struct sctp_error_no_user_data *);
4609                 no_user_data_cause->cause.code = htons(SCTP_CAUSE_NO_USER_DATA);
4610                 no_user_data_cause->cause.length = htons(len);
4611                 no_user_data_cause->tsn = htonl(tsn);
4612         }
4613         return (m);
4614 }
4615
4616 #ifdef SCTP_MBCNT_LOGGING
4617 void
4618 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc,
4619     struct sctp_tmit_chunk *tp1, int chk_cnt)
4620 {
4621         if (tp1->data == NULL) {
4622                 return;
4623         }
4624         asoc->chunks_on_out_queue -= chk_cnt;
4625         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBCNT_LOGGING_ENABLE) {
4626                 sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE,
4627                     asoc->total_output_queue_size,
4628                     tp1->book_size,
4629                     0,
4630                     tp1->mbcnt);
4631         }
4632         if (asoc->total_output_queue_size >= tp1->book_size) {
4633                 atomic_add_int(&asoc->total_output_queue_size, -tp1->book_size);
4634         } else {
4635                 asoc->total_output_queue_size = 0;
4636         }
4637
4638         if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) ||
4639             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) {
4640                 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) {
4641                         stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size;
4642                 } else {
4643                         stcb->sctp_socket->so_snd.sb_cc = 0;
4644
4645                 }
4646         }
4647 }
4648
4649 #endif
4650
4651 int
4652 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1,
4653     uint8_t sent, int so_locked
4654 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4655     SCTP_UNUSED
4656 #endif
4657 )
4658 {
4659         struct sctp_stream_out *strq;
4660         struct sctp_tmit_chunk *chk = NULL, *tp2;
4661         struct sctp_stream_queue_pending *sp;
4662         uint32_t mid;
4663         uint16_t sid;
4664         uint8_t foundeom = 0;
4665         int ret_sz = 0;
4666         int notdone;
4667         int do_wakeup_routine = 0;
4668
4669         sid = tp1->rec.data.sid;
4670         mid = tp1->rec.data.mid;
4671         if (sent || !(tp1->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG)) {
4672                 stcb->asoc.abandoned_sent[0]++;
4673                 stcb->asoc.abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
4674                 stcb->asoc.strmout[sid].abandoned_sent[0]++;
4675 #if defined(SCTP_DETAILED_STR_STATS)
4676                 stcb->asoc.strmout[stream].abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
4677 #endif
4678         } else {
4679                 stcb->asoc.abandoned_unsent[0]++;
4680                 stcb->asoc.abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
4681                 stcb->asoc.strmout[sid].abandoned_unsent[0]++;
4682 #if defined(SCTP_DETAILED_STR_STATS)
4683                 stcb->asoc.strmout[stream].abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
4684 #endif
4685         }
4686         do {
4687                 ret_sz += tp1->book_size;
4688                 if (tp1->data != NULL) {
4689                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4690                                 sctp_flight_size_decrease(tp1);
4691                                 sctp_total_flight_decrease(stcb, tp1);
4692                         }
4693                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4694                         stcb->asoc.peers_rwnd += tp1->send_size;
4695                         stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh);
4696                         if (sent) {
4697                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
4698                         } else {
4699                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
4700                         }
4701                         if (tp1->data) {
4702                                 sctp_m_freem(tp1->data);
4703                                 tp1->data = NULL;
4704                         }
4705                         do_wakeup_routine = 1;
4706                         if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
4707                                 stcb->asoc.sent_queue_cnt_removeable--;
4708                         }
4709                 }
4710                 tp1->sent = SCTP_FORWARD_TSN_SKIP;
4711                 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
4712                     SCTP_DATA_NOT_FRAG) {
4713                         /* not frag'ed we ae done   */
4714                         notdone = 0;
4715                         foundeom = 1;
4716                 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4717                         /* end of frag, we are done */
4718                         notdone = 0;
4719                         foundeom = 1;
4720                 } else {
4721                         /*
4722                          * Its a begin or middle piece, we must mark all of
4723                          * it
4724                          */
4725                         notdone = 1;
4726                         tp1 = TAILQ_NEXT(tp1, sctp_next);
4727                 }
4728         } while (tp1 && notdone);
4729         if (foundeom == 0) {
4730                 /*
4731                  * The multi-part message was scattered across the send and
4732                  * sent queue.
4733                  */
4734                 TAILQ_FOREACH_SAFE(tp1, &stcb->asoc.send_queue, sctp_next, tp2) {
4735                         if ((tp1->rec.data.sid != sid) ||
4736                             (!SCTP_MID_EQ(stcb->asoc.idata_supported, tp1->rec.data.mid, mid))) {
4737                                 break;
4738                         }
4739                         /*
4740                          * save to chk in case we have some on stream out
4741                          * queue. If so and we have an un-transmitted one we
4742                          * don't have to fudge the TSN.
4743                          */
4744                         chk = tp1;
4745                         ret_sz += tp1->book_size;
4746                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4747                         if (sent) {
4748                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
4749                         } else {
4750                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
4751                         }
4752                         if (tp1->data) {
4753                                 sctp_m_freem(tp1->data);
4754                                 tp1->data = NULL;
4755                         }
4756                         /* No flight involved here book the size to 0 */
4757                         tp1->book_size = 0;
4758                         if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4759                                 foundeom = 1;
4760                         }
4761                         do_wakeup_routine = 1;
4762                         tp1->sent = SCTP_FORWARD_TSN_SKIP;
4763                         TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next);
4764                         /*
4765                          * on to the sent queue so we can wait for it to be
4766                          * passed by.
4767                          */
4768                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1,
4769                             sctp_next);
4770                         stcb->asoc.send_queue_cnt--;
4771                         stcb->asoc.sent_queue_cnt++;
4772                 }
4773         }
4774         if (foundeom == 0) {
4775                 /*
4776                  * Still no eom found. That means there is stuff left on the
4777                  * stream out queue.. yuck.
4778                  */
4779                 SCTP_TCB_SEND_LOCK(stcb);
4780                 strq = &stcb->asoc.strmout[sid];
4781                 sp = TAILQ_FIRST(&strq->outqueue);
4782                 if (sp != NULL) {
4783                         sp->discard_rest = 1;
4784                         /*
4785                          * We may need to put a chunk on the queue that
4786                          * holds the TSN that would have been sent with the
4787                          * LAST bit.
4788                          */
4789                         if (chk == NULL) {
4790                                 /* Yep, we have to */
4791                                 sctp_alloc_a_chunk(stcb, chk);
4792                                 if (chk == NULL) {
4793                                         /*
4794                                          * we are hosed. All we can do is
4795                                          * nothing.. which will cause an
4796                                          * abort if the peer is paying
4797                                          * attention.
4798                                          */
4799                                         goto oh_well;
4800                                 }
4801                                 memset(chk, 0, sizeof(*chk));
4802                                 chk->rec.data.rcv_flags = 0;
4803                                 chk->sent = SCTP_FORWARD_TSN_SKIP;
4804                                 chk->asoc = &stcb->asoc;
4805                                 if (stcb->asoc.idata_supported == 0) {
4806                                         if (sp->sinfo_flags & SCTP_UNORDERED) {
4807                                                 chk->rec.data.mid = 0;
4808                                         } else {
4809                                                 chk->rec.data.mid = strq->next_mid_ordered;
4810                                         }
4811                                 } else {
4812                                         if (sp->sinfo_flags & SCTP_UNORDERED) {
4813                                                 chk->rec.data.mid = strq->next_mid_unordered;
4814                                         } else {
4815                                                 chk->rec.data.mid = strq->next_mid_ordered;
4816                                         }
4817                                 }
4818                                 chk->rec.data.sid = sp->sid;
4819                                 chk->rec.data.ppid = sp->ppid;
4820                                 chk->rec.data.context = sp->context;
4821                                 chk->flags = sp->act_flags;
4822                                 chk->whoTo = NULL;
4823                                 chk->rec.data.tsn = atomic_fetchadd_int(&stcb->asoc.sending_seq, 1);
4824                                 strq->chunks_on_queues++;
4825                                 TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, chk, sctp_next);
4826                                 stcb->asoc.sent_queue_cnt++;
4827                                 stcb->asoc.pr_sctp_cnt++;
4828                         }
4829                         chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
4830                         if (sp->sinfo_flags & SCTP_UNORDERED) {
4831                                 chk->rec.data.rcv_flags |= SCTP_DATA_UNORDERED;
4832                         }
4833                         if (stcb->asoc.idata_supported == 0) {
4834                                 if ((sp->sinfo_flags & SCTP_UNORDERED) == 0) {
4835                                         strq->next_mid_ordered++;
4836                                 }
4837                         } else {
4838                                 if (sp->sinfo_flags & SCTP_UNORDERED) {
4839                                         strq->next_mid_unordered++;
4840                                 } else {
4841                                         strq->next_mid_ordered++;
4842                                 }
4843                         }
4844         oh_well:
4845                         if (sp->data) {
4846                                 /*
4847                                  * Pull any data to free up the SB and allow
4848                                  * sender to "add more" while we will throw
4849                                  * away :-)
4850                                  */
4851                                 sctp_free_spbufspace(stcb, &stcb->asoc, sp);
4852                                 ret_sz += sp->length;
4853                                 do_wakeup_routine = 1;
4854                                 sp->some_taken = 1;
4855                                 sctp_m_freem(sp->data);
4856                                 sp->data = NULL;
4857                                 sp->tail_mbuf = NULL;
4858                                 sp->length = 0;
4859                         }
4860                 }
4861                 SCTP_TCB_SEND_UNLOCK(stcb);
4862         }
4863         if (do_wakeup_routine) {
4864 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4865                 struct socket *so;
4866
4867                 so = SCTP_INP_SO(stcb->sctp_ep);
4868                 if (!so_locked) {
4869                         atomic_add_int(&stcb->asoc.refcnt, 1);
4870                         SCTP_TCB_UNLOCK(stcb);
4871                         SCTP_SOCKET_LOCK(so, 1);
4872                         SCTP_TCB_LOCK(stcb);
4873                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
4874                         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
4875                                 /* assoc was freed while we were unlocked */
4876                                 SCTP_SOCKET_UNLOCK(so, 1);
4877                                 return (ret_sz);
4878                         }
4879                 }
4880 #endif
4881                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
4882 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4883                 if (!so_locked) {
4884                         SCTP_SOCKET_UNLOCK(so, 1);
4885                 }
4886 #endif
4887         }
4888         return (ret_sz);
4889 }
4890
4891 /*
4892  * checks to see if the given address, sa, is one that is currently known by
4893  * the kernel note: can't distinguish the same address on multiple interfaces
4894  * and doesn't handle multiple addresses with different zone/scope id's note:
4895  * ifa_ifwithaddr() compares the entire sockaddr struct
4896  */
4897 struct sctp_ifa *
4898 sctp_find_ifa_in_ep(struct sctp_inpcb *inp, struct sockaddr *addr,
4899     int holds_lock)
4900 {
4901         struct sctp_laddr *laddr;
4902
4903         if (holds_lock == 0) {
4904                 SCTP_INP_RLOCK(inp);
4905         }
4906         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
4907                 if (laddr->ifa == NULL)
4908                         continue;
4909                 if (addr->sa_family != laddr->ifa->address.sa.sa_family)
4910                         continue;
4911 #ifdef INET
4912                 if (addr->sa_family == AF_INET) {
4913                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
4914                             laddr->ifa->address.sin.sin_addr.s_addr) {
4915                                 /* found him. */
4916                                 if (holds_lock == 0) {
4917                                         SCTP_INP_RUNLOCK(inp);
4918                                 }
4919                                 return (laddr->ifa);
4920                                 break;
4921                         }
4922                 }
4923 #endif
4924 #ifdef INET6
4925                 if (addr->sa_family == AF_INET6) {
4926                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
4927                             &laddr->ifa->address.sin6)) {
4928                                 /* found him. */
4929                                 if (holds_lock == 0) {
4930                                         SCTP_INP_RUNLOCK(inp);
4931                                 }
4932                                 return (laddr->ifa);
4933                                 break;
4934                         }
4935                 }
4936 #endif
4937         }
4938         if (holds_lock == 0) {
4939                 SCTP_INP_RUNLOCK(inp);
4940         }
4941         return (NULL);
4942 }
4943
4944 uint32_t
4945 sctp_get_ifa_hash_val(struct sockaddr *addr)
4946 {
4947         switch (addr->sa_family) {
4948 #ifdef INET
4949         case AF_INET:
4950                 {
4951                         struct sockaddr_in *sin;
4952
4953                         sin = (struct sockaddr_in *)addr;
4954                         return (sin->sin_addr.s_addr ^ (sin->sin_addr.s_addr >> 16));
4955                 }
4956 #endif
4957 #ifdef INET6
4958         case AF_INET6:
4959                 {
4960                         struct sockaddr_in6 *sin6;
4961                         uint32_t hash_of_addr;
4962
4963                         sin6 = (struct sockaddr_in6 *)addr;
4964                         hash_of_addr = (sin6->sin6_addr.s6_addr32[0] +
4965                             sin6->sin6_addr.s6_addr32[1] +
4966                             sin6->sin6_addr.s6_addr32[2] +
4967                             sin6->sin6_addr.s6_addr32[3]);
4968                         hash_of_addr = (hash_of_addr ^ (hash_of_addr >> 16));
4969                         return (hash_of_addr);
4970                 }
4971 #endif
4972         default:
4973                 break;
4974         }
4975         return (0);
4976 }
4977
4978 struct sctp_ifa *
4979 sctp_find_ifa_by_addr(struct sockaddr *addr, uint32_t vrf_id, int holds_lock)
4980 {
4981         struct sctp_ifa *sctp_ifap;
4982         struct sctp_vrf *vrf;
4983         struct sctp_ifalist *hash_head;
4984         uint32_t hash_of_addr;
4985
4986         if (holds_lock == 0)
4987                 SCTP_IPI_ADDR_RLOCK();
4988
4989         vrf = sctp_find_vrf(vrf_id);
4990         if (vrf == NULL) {
4991                 if (holds_lock == 0)
4992                         SCTP_IPI_ADDR_RUNLOCK();
4993                 return (NULL);
4994         }
4995         hash_of_addr = sctp_get_ifa_hash_val(addr);
4996
4997         hash_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)];
4998         if (hash_head == NULL) {
4999                 SCTP_PRINTF("hash_of_addr:%x mask:%x table:%x - ",
5000                     hash_of_addr, (uint32_t)vrf->vrf_addr_hashmark,
5001                     (uint32_t)(hash_of_addr & vrf->vrf_addr_hashmark));
5002                 sctp_print_address(addr);
5003                 SCTP_PRINTF("No such bucket for address\n");
5004                 if (holds_lock == 0)
5005                         SCTP_IPI_ADDR_RUNLOCK();
5006
5007                 return (NULL);
5008         }
5009         LIST_FOREACH(sctp_ifap, hash_head, next_bucket) {
5010                 if (addr->sa_family != sctp_ifap->address.sa.sa_family)
5011                         continue;
5012 #ifdef INET
5013                 if (addr->sa_family == AF_INET) {
5014                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
5015                             sctp_ifap->address.sin.sin_addr.s_addr) {
5016                                 /* found him. */
5017                                 if (holds_lock == 0)
5018                                         SCTP_IPI_ADDR_RUNLOCK();
5019                                 return (sctp_ifap);
5020                                 break;
5021                         }
5022                 }
5023 #endif
5024 #ifdef INET6
5025                 if (addr->sa_family == AF_INET6) {
5026                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5027                             &sctp_ifap->address.sin6)) {
5028                                 /* found him. */
5029                                 if (holds_lock == 0)
5030                                         SCTP_IPI_ADDR_RUNLOCK();
5031                                 return (sctp_ifap);
5032                                 break;
5033                         }
5034                 }
5035 #endif
5036         }
5037         if (holds_lock == 0)
5038                 SCTP_IPI_ADDR_RUNLOCK();
5039         return (NULL);
5040 }
5041
5042 static void
5043 sctp_user_rcvd(struct sctp_tcb *stcb, uint32_t *freed_so_far, int hold_rlock,
5044     uint32_t rwnd_req)
5045 {
5046         /* User pulled some data, do we need a rwnd update? */
5047         int r_unlocked = 0;
5048         uint32_t dif, rwnd;
5049         struct socket *so = NULL;
5050
5051         if (stcb == NULL)
5052                 return;
5053
5054         atomic_add_int(&stcb->asoc.refcnt, 1);
5055
5056         if (stcb->asoc.state & (SCTP_STATE_ABOUT_TO_BE_FREED |
5057             SCTP_STATE_SHUTDOWN_RECEIVED |
5058             SCTP_STATE_SHUTDOWN_ACK_SENT)) {
5059                 /* Pre-check If we are freeing no update */
5060                 goto no_lock;
5061         }
5062         SCTP_INP_INCR_REF(stcb->sctp_ep);
5063         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5064             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5065                 goto out;
5066         }
5067         so = stcb->sctp_socket;
5068         if (so == NULL) {
5069                 goto out;
5070         }
5071         atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far);
5072         /* Have you have freed enough to look */
5073         *freed_so_far = 0;
5074         /* Yep, its worth a look and the lock overhead */
5075
5076         /* Figure out what the rwnd would be */
5077         rwnd = sctp_calc_rwnd(stcb, &stcb->asoc);
5078         if (rwnd >= stcb->asoc.my_last_reported_rwnd) {
5079                 dif = rwnd - stcb->asoc.my_last_reported_rwnd;
5080         } else {
5081                 dif = 0;
5082         }
5083         if (dif >= rwnd_req) {
5084                 if (hold_rlock) {
5085                         SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5086                         r_unlocked = 1;
5087                 }
5088                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5089                         /*
5090                          * One last check before we allow the guy possibly
5091                          * to get in. There is a race, where the guy has not
5092                          * reached the gate. In that case
5093                          */
5094                         goto out;
5095                 }
5096                 SCTP_TCB_LOCK(stcb);
5097                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5098                         /* No reports here */
5099                         SCTP_TCB_UNLOCK(stcb);
5100                         goto out;
5101                 }
5102                 SCTP_STAT_INCR(sctps_wu_sacks_sent);
5103                 sctp_send_sack(stcb, SCTP_SO_LOCKED);
5104
5105                 sctp_chunk_output(stcb->sctp_ep, stcb,
5106                     SCTP_OUTPUT_FROM_USR_RCVD, SCTP_SO_LOCKED);
5107                 /* make sure no timer is running */
5108                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL,
5109                     SCTP_FROM_SCTPUTIL + SCTP_LOC_6);
5110                 SCTP_TCB_UNLOCK(stcb);
5111         } else {
5112                 /* Update how much we have pending */
5113                 stcb->freed_by_sorcv_sincelast = dif;
5114         }
5115 out:
5116         if (so && r_unlocked && hold_rlock) {
5117                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
5118         }
5119         SCTP_INP_DECR_REF(stcb->sctp_ep);
5120 no_lock:
5121         atomic_add_int(&stcb->asoc.refcnt, -1);
5122         return;
5123 }
5124
5125 int
5126 sctp_sorecvmsg(struct socket *so,
5127     struct uio *uio,
5128     struct mbuf **mp,
5129     struct sockaddr *from,
5130     int fromlen,
5131     int *msg_flags,
5132     struct sctp_sndrcvinfo *sinfo,
5133     int filling_sinfo)
5134 {
5135         /*
5136          * MSG flags we will look at MSG_DONTWAIT - non-blocking IO.
5137          * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy
5138          * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ??
5139          * On the way out we may send out any combination of:
5140          * MSG_NOTIFICATION MSG_EOR
5141          *
5142          */
5143         struct sctp_inpcb *inp = NULL;
5144         int my_len = 0;
5145         int cp_len = 0, error = 0;
5146         struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
5147         struct mbuf *m = NULL;
5148         struct sctp_tcb *stcb = NULL;
5149         int wakeup_read_socket = 0;
5150         int freecnt_applied = 0;
5151         int out_flags = 0, in_flags = 0;
5152         int block_allowed = 1;
5153         uint32_t freed_so_far = 0;
5154         uint32_t copied_so_far = 0;
5155         int in_eeor_mode = 0;
5156         int no_rcv_needed = 0;
5157         uint32_t rwnd_req = 0;
5158         int hold_sblock = 0;
5159         int hold_rlock = 0;
5160         ssize_t slen = 0;
5161         uint32_t held_length = 0;
5162         int sockbuf_lock = 0;
5163
5164         if (uio == NULL) {
5165                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5166                 return (EINVAL);
5167         }
5168         if (msg_flags) {
5169                 in_flags = *msg_flags;
5170                 if (in_flags & MSG_PEEK)
5171                         SCTP_STAT_INCR(sctps_read_peeks);
5172         } else {
5173                 in_flags = 0;
5174         }
5175         slen = uio->uio_resid;
5176
5177         /* Pull in and set up our int flags */
5178         if (in_flags & MSG_OOB) {
5179                 /* Out of band's NOT supported */
5180                 return (EOPNOTSUPP);
5181         }
5182         if ((in_flags & MSG_PEEK) && (mp != NULL)) {
5183                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5184                 return (EINVAL);
5185         }
5186         if ((in_flags & (MSG_DONTWAIT
5187             | MSG_NBIO
5188             )) ||
5189             SCTP_SO_IS_NBIO(so)) {
5190                 block_allowed = 0;
5191         }
5192         /* setup the endpoint */
5193         inp = (struct sctp_inpcb *)so->so_pcb;
5194         if (inp == NULL) {
5195                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
5196                 return (EFAULT);
5197         }
5198         rwnd_req = (SCTP_SB_LIMIT_RCV(so) >> SCTP_RWND_HIWAT_SHIFT);
5199         /* Must be at least a MTU's worth */
5200         if (rwnd_req < SCTP_MIN_RWND)
5201                 rwnd_req = SCTP_MIN_RWND;
5202         in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
5203         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5204                 sctp_misc_ints(SCTP_SORECV_ENTER,
5205                     rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, (uint32_t)uio->uio_resid);
5206         }
5207         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5208                 sctp_misc_ints(SCTP_SORECV_ENTERPL,
5209                     rwnd_req, block_allowed, so->so_rcv.sb_cc, (uint32_t)uio->uio_resid);
5210         }
5211         error = sblock(&so->so_rcv, (block_allowed ? SBL_WAIT : 0));
5212         if (error) {
5213                 goto release_unlocked;
5214         }
5215         sockbuf_lock = 1;
5216 restart:
5217
5218
5219 restart_nosblocks:
5220         if (hold_sblock == 0) {
5221                 SOCKBUF_LOCK(&so->so_rcv);
5222                 hold_sblock = 1;
5223         }
5224         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5225             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5226                 goto out;
5227         }
5228         if ((so->so_rcv.sb_state & SBS_CANTRCVMORE) && (so->so_rcv.sb_cc == 0)) {
5229                 if (so->so_error) {
5230                         error = so->so_error;
5231                         if ((in_flags & MSG_PEEK) == 0)
5232                                 so->so_error = 0;
5233                         goto out;
5234                 } else {
5235                         if (so->so_rcv.sb_cc == 0) {
5236                                 /* indicate EOF */
5237                                 error = 0;
5238                                 goto out;
5239                         }
5240                 }
5241         }
5242         if (so->so_rcv.sb_cc <= held_length) {
5243                 if (so->so_error) {
5244                         error = so->so_error;
5245                         if ((in_flags & MSG_PEEK) == 0) {
5246                                 so->so_error = 0;
5247                         }
5248                         goto out;
5249                 }
5250                 if ((so->so_rcv.sb_cc == 0) &&
5251                     ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5252                     (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) {
5253                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5254                                 /*
5255                                  * For active open side clear flags for
5256                                  * re-use passive open is blocked by
5257                                  * connect.
5258                                  */
5259                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5260                                         /*
5261                                          * You were aborted, passive side
5262                                          * always hits here
5263                                          */
5264                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5265                                         error = ECONNRESET;
5266                                 }
5267                                 so->so_state &= ~(SS_ISCONNECTING |
5268                                     SS_ISDISCONNECTING |
5269                                     SS_ISCONFIRMING |
5270                                     SS_ISCONNECTED);
5271                                 if (error == 0) {
5272                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5273                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5274                                                 error = ENOTCONN;
5275                                         }
5276                                 }
5277                                 goto out;
5278                         }
5279                 }
5280                 if (block_allowed) {
5281                         error = sbwait(&so->so_rcv);
5282                         if (error) {
5283                                 goto out;
5284                         }
5285                         held_length = 0;
5286                         goto restart_nosblocks;
5287                 } else {
5288                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EWOULDBLOCK);
5289                         error = EWOULDBLOCK;
5290                         goto out;
5291                 }
5292         }
5293         if (hold_sblock == 1) {
5294                 SOCKBUF_UNLOCK(&so->so_rcv);
5295                 hold_sblock = 0;
5296         }
5297         /* we possibly have data we can read */
5298         /* sa_ignore FREED_MEMORY */
5299         control = TAILQ_FIRST(&inp->read_queue);
5300         if (control == NULL) {
5301                 /*
5302                  * This could be happening since the appender did the
5303                  * increment but as not yet did the tailq insert onto the
5304                  * read_queue
5305                  */
5306                 if (hold_rlock == 0) {
5307                         SCTP_INP_READ_LOCK(inp);
5308                 }
5309                 control = TAILQ_FIRST(&inp->read_queue);
5310                 if ((control == NULL) && (so->so_rcv.sb_cc != 0)) {
5311 #ifdef INVARIANTS
5312                         panic("Huh, its non zero and nothing on control?");
5313 #endif
5314                         so->so_rcv.sb_cc = 0;
5315                 }
5316                 SCTP_INP_READ_UNLOCK(inp);
5317                 hold_rlock = 0;
5318                 goto restart;
5319         }
5320         if ((control->length == 0) &&
5321             (control->do_not_ref_stcb)) {
5322                 /*
5323                  * Clean up code for freeing assoc that left behind a
5324                  * pdapi.. maybe a peer in EEOR that just closed after
5325                  * sending and never indicated a EOR.
5326                  */
5327                 if (hold_rlock == 0) {
5328                         hold_rlock = 1;
5329                         SCTP_INP_READ_LOCK(inp);
5330                 }
5331                 control->held_length = 0;
5332                 if (control->data) {
5333                         /* Hmm there is data here .. fix */
5334                         struct mbuf *m_tmp;
5335                         int cnt = 0;
5336
5337                         m_tmp = control->data;
5338                         while (m_tmp) {
5339                                 cnt += SCTP_BUF_LEN(m_tmp);
5340                                 if (SCTP_BUF_NEXT(m_tmp) == NULL) {
5341                                         control->tail_mbuf = m_tmp;
5342                                         control->end_added = 1;
5343                                 }
5344                                 m_tmp = SCTP_BUF_NEXT(m_tmp);
5345                         }
5346                         control->length = cnt;
5347                 } else {
5348                         /* remove it */
5349                         TAILQ_REMOVE(&inp->read_queue, control, next);
5350                         /* Add back any hiddend data */
5351                         sctp_free_remote_addr(control->whoFrom);
5352                         sctp_free_a_readq(stcb, control);
5353                 }
5354                 if (hold_rlock) {
5355                         hold_rlock = 0;
5356                         SCTP_INP_READ_UNLOCK(inp);
5357                 }
5358                 goto restart;
5359         }
5360         if ((control->length == 0) &&
5361             (control->end_added == 1)) {
5362                 /*
5363                  * Do we also need to check for (control->pdapi_aborted ==
5364                  * 1)?
5365                  */
5366                 if (hold_rlock == 0) {
5367                         hold_rlock = 1;
5368                         SCTP_INP_READ_LOCK(inp);
5369                 }
5370                 TAILQ_REMOVE(&inp->read_queue, control, next);
5371                 if (control->data) {
5372 #ifdef INVARIANTS
5373                         panic("control->data not null but control->length == 0");
5374 #else
5375                         SCTP_PRINTF("Strange, data left in the control buffer. Cleaning up.\n");
5376                         sctp_m_freem(control->data);
5377                         control->data = NULL;
5378 #endif
5379                 }
5380                 if (control->aux_data) {
5381                         sctp_m_free(control->aux_data);
5382                         control->aux_data = NULL;
5383                 }
5384 #ifdef INVARIANTS
5385                 if (control->on_strm_q) {
5386                         panic("About to free ctl:%p so:%p and its in %d",
5387                             control, so, control->on_strm_q);
5388                 }
5389 #endif
5390                 sctp_free_remote_addr(control->whoFrom);
5391                 sctp_free_a_readq(stcb, control);
5392                 if (hold_rlock) {
5393                         hold_rlock = 0;
5394                         SCTP_INP_READ_UNLOCK(inp);
5395                 }
5396                 goto restart;
5397         }
5398         if (control->length == 0) {
5399                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) &&
5400                     (filling_sinfo)) {
5401                         /* find a more suitable one then this */
5402                         ctl = TAILQ_NEXT(control, next);
5403                         while (ctl) {
5404                                 if ((ctl->stcb != control->stcb) && (ctl->length) &&
5405                                     (ctl->some_taken ||
5406                                     (ctl->spec_flags & M_NOTIFICATION) ||
5407                                     ((ctl->do_not_ref_stcb == 0) &&
5408                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))
5409                                     ) {
5410                                         /*-
5411                                          * If we have a different TCB next, and there is data
5412                                          * present. If we have already taken some (pdapi), OR we can
5413                                          * ref the tcb and no delivery as started on this stream, we
5414                                          * take it. Note we allow a notification on a different
5415                                          * assoc to be delivered..
5416                                          */
5417                                         control = ctl;
5418                                         goto found_one;
5419                                 } else if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS)) &&
5420                                             (ctl->length) &&
5421                                             ((ctl->some_taken) ||
5422                                             ((ctl->do_not_ref_stcb == 0) &&
5423                                             ((ctl->spec_flags & M_NOTIFICATION) == 0) &&
5424                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))) {
5425                                         /*-
5426                                          * If we have the same tcb, and there is data present, and we
5427                                          * have the strm interleave feature present. Then if we have
5428                                          * taken some (pdapi) or we can refer to tht tcb AND we have
5429                                          * not started a delivery for this stream, we can take it.
5430                                          * Note we do NOT allow a notificaiton on the same assoc to
5431                                          * be delivered.
5432                                          */
5433                                         control = ctl;
5434                                         goto found_one;
5435                                 }
5436                                 ctl = TAILQ_NEXT(ctl, next);
5437                         }
5438                 }
5439                 /*
5440                  * if we reach here, not suitable replacement is available
5441                  * <or> fragment interleave is NOT on. So stuff the sb_cc
5442                  * into the our held count, and its time to sleep again.
5443                  */
5444                 held_length = so->so_rcv.sb_cc;
5445                 control->held_length = so->so_rcv.sb_cc;
5446                 goto restart;
5447         }
5448         /* Clear the held length since there is something to read */
5449         control->held_length = 0;
5450 found_one:
5451         /*
5452          * If we reach here, control has a some data for us to read off.
5453          * Note that stcb COULD be NULL.
5454          */
5455         if (hold_rlock == 0) {
5456                 hold_rlock = 1;
5457                 SCTP_INP_READ_LOCK(inp);
5458         }
5459         control->some_taken++;
5460         stcb = control->stcb;
5461         if (stcb) {
5462                 if ((control->do_not_ref_stcb == 0) &&
5463                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5464                         if (freecnt_applied == 0)
5465                                 stcb = NULL;
5466                 } else if (control->do_not_ref_stcb == 0) {
5467                         /* you can't free it on me please */
5468                         /*
5469                          * The lock on the socket buffer protects us so the
5470                          * free code will stop. But since we used the
5471                          * socketbuf lock and the sender uses the tcb_lock
5472                          * to increment, we need to use the atomic add to
5473                          * the refcnt
5474                          */
5475                         if (freecnt_applied) {
5476 #ifdef INVARIANTS
5477                                 panic("refcnt already incremented");
5478 #else
5479                                 SCTP_PRINTF("refcnt already incremented?\n");
5480 #endif
5481                         } else {
5482                                 atomic_add_int(&stcb->asoc.refcnt, 1);
5483                                 freecnt_applied = 1;
5484                         }
5485                         /*
5486                          * Setup to remember how much we have not yet told
5487                          * the peer our rwnd has opened up. Note we grab the
5488                          * value from the tcb from last time. Note too that
5489                          * sack sending clears this when a sack is sent,
5490                          * which is fine. Once we hit the rwnd_req, we then
5491                          * will go to the sctp_user_rcvd() that will not
5492                          * lock until it KNOWs it MUST send a WUP-SACK.
5493                          */
5494                         freed_so_far = stcb->freed_by_sorcv_sincelast;
5495                         stcb->freed_by_sorcv_sincelast = 0;
5496                 }
5497         }
5498         if (stcb &&
5499             ((control->spec_flags & M_NOTIFICATION) == 0) &&
5500             control->do_not_ref_stcb == 0) {
5501                 stcb->asoc.strmin[control->sinfo_stream].delivery_started = 1;
5502         }
5503         /* First lets get off the sinfo and sockaddr info */
5504         if ((sinfo != NULL) && (filling_sinfo != 0)) {
5505                 sinfo->sinfo_stream = control->sinfo_stream;
5506                 sinfo->sinfo_ssn = (uint16_t)control->mid;
5507                 sinfo->sinfo_flags = control->sinfo_flags;
5508                 sinfo->sinfo_ppid = control->sinfo_ppid;
5509                 sinfo->sinfo_context = control->sinfo_context;
5510                 sinfo->sinfo_timetolive = control->sinfo_timetolive;
5511                 sinfo->sinfo_tsn = control->sinfo_tsn;
5512                 sinfo->sinfo_cumtsn = control->sinfo_cumtsn;
5513                 sinfo->sinfo_assoc_id = control->sinfo_assoc_id;
5514                 nxt = TAILQ_NEXT(control, next);
5515                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
5516                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) {
5517                         struct sctp_extrcvinfo *s_extra;
5518
5519                         s_extra = (struct sctp_extrcvinfo *)sinfo;
5520                         if ((nxt) &&
5521                             (nxt->length)) {
5522                                 s_extra->serinfo_next_flags = SCTP_NEXT_MSG_AVAIL;
5523                                 if (nxt->sinfo_flags & SCTP_UNORDERED) {
5524                                         s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_UNORDERED;
5525                                 }
5526                                 if (nxt->spec_flags & M_NOTIFICATION) {
5527                                         s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_NOTIFICATION;
5528                                 }
5529                                 s_extra->serinfo_next_aid = nxt->sinfo_assoc_id;
5530                                 s_extra->serinfo_next_length = nxt->length;
5531                                 s_extra->serinfo_next_ppid = nxt->sinfo_ppid;
5532                                 s_extra->serinfo_next_stream = nxt->sinfo_stream;
5533                                 if (nxt->tail_mbuf != NULL) {
5534                                         if (nxt->end_added) {
5535                                                 s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_ISCOMPLETE;
5536                                         }
5537                                 }
5538                         } else {
5539                                 /*
5540                                  * we explicitly 0 this, since the memcpy
5541                                  * got some other things beyond the older
5542                                  * sinfo_ that is on the control's structure
5543                                  * :-D
5544                                  */
5545                                 nxt = NULL;
5546                                 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG;
5547                                 s_extra->serinfo_next_aid = 0;
5548                                 s_extra->serinfo_next_length = 0;
5549                                 s_extra->serinfo_next_ppid = 0;
5550                                 s_extra->serinfo_next_stream = 0;
5551                         }
5552                 }
5553                 /*
5554                  * update off the real current cum-ack, if we have an stcb.
5555                  */
5556                 if ((control->do_not_ref_stcb == 0) && stcb)
5557                         sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
5558                 /*
5559                  * mask off the high bits, we keep the actual chunk bits in
5560                  * there.
5561                  */
5562                 sinfo->sinfo_flags &= 0x00ff;
5563                 if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) {
5564                         sinfo->sinfo_flags |= SCTP_UNORDERED;
5565                 }
5566         }
5567 #ifdef SCTP_ASOCLOG_OF_TSNS
5568         {
5569                 int index, newindex;
5570                 struct sctp_pcbtsn_rlog *entry;
5571
5572                 do {
5573                         index = inp->readlog_index;
5574                         newindex = index + 1;
5575                         if (newindex >= SCTP_READ_LOG_SIZE) {
5576                                 newindex = 0;
5577                         }
5578                 } while (atomic_cmpset_int(&inp->readlog_index, index, newindex) == 0);
5579                 entry = &inp->readlog[index];
5580                 entry->vtag = control->sinfo_assoc_id;
5581                 entry->strm = control->sinfo_stream;
5582                 entry->seq = (uint16_t)control->mid;
5583                 entry->sz = control->length;
5584                 entry->flgs = control->sinfo_flags;
5585         }
5586 #endif
5587         if ((fromlen > 0) && (from != NULL)) {
5588                 union sctp_sockstore store;
5589                 size_t len;
5590
5591                 switch (control->whoFrom->ro._l_addr.sa.sa_family) {
5592 #ifdef INET6
5593                 case AF_INET6:
5594                         len = sizeof(struct sockaddr_in6);
5595                         store.sin6 = control->whoFrom->ro._l_addr.sin6;
5596                         store.sin6.sin6_port = control->port_from;
5597                         break;
5598 #endif
5599 #ifdef INET
5600                 case AF_INET:
5601 #ifdef INET6
5602                         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
5603                                 len = sizeof(struct sockaddr_in6);
5604                                 in6_sin_2_v4mapsin6(&control->whoFrom->ro._l_addr.sin,
5605                                     &store.sin6);
5606                                 store.sin6.sin6_port = control->port_from;
5607                         } else {
5608                                 len = sizeof(struct sockaddr_in);
5609                                 store.sin = control->whoFrom->ro._l_addr.sin;
5610                                 store.sin.sin_port = control->port_from;
5611                         }
5612 #else
5613                         len = sizeof(struct sockaddr_in);
5614                         store.sin = control->whoFrom->ro._l_addr.sin;
5615                         store.sin.sin_port = control->port_from;
5616 #endif
5617                         break;
5618 #endif
5619                 default:
5620                         len = 0;
5621                         break;
5622                 }
5623                 memcpy(from, &store, min((size_t)fromlen, len));
5624 #ifdef INET6
5625                 {
5626                         struct sockaddr_in6 lsa6, *from6;
5627
5628                         from6 = (struct sockaddr_in6 *)from;
5629                         sctp_recover_scope_mac(from6, (&lsa6));
5630                 }
5631 #endif
5632         }
5633         if (hold_rlock) {
5634                 SCTP_INP_READ_UNLOCK(inp);
5635                 hold_rlock = 0;
5636         }
5637         if (hold_sblock) {
5638                 SOCKBUF_UNLOCK(&so->so_rcv);
5639                 hold_sblock = 0;
5640         }
5641         /* now copy out what data we can */
5642         if (mp == NULL) {
5643                 /* copy out each mbuf in the chain up to length */
5644 get_more_data:
5645                 m = control->data;
5646                 while (m) {
5647                         /* Move out all we can */
5648                         cp_len = (int)uio->uio_resid;
5649                         my_len = (int)SCTP_BUF_LEN(m);
5650                         if (cp_len > my_len) {
5651                                 /* not enough in this buf */
5652                                 cp_len = my_len;
5653                         }
5654                         if (hold_rlock) {
5655                                 SCTP_INP_READ_UNLOCK(inp);
5656                                 hold_rlock = 0;
5657                         }
5658                         if (cp_len > 0)
5659                                 error = uiomove(mtod(m, char *), cp_len, uio);
5660                         /* re-read */
5661                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5662                                 goto release;
5663                         }
5664                         if ((control->do_not_ref_stcb == 0) && stcb &&
5665                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5666                                 no_rcv_needed = 1;
5667                         }
5668                         if (error) {
5669                                 /* error we are out of here */
5670                                 goto release;
5671                         }
5672                         SCTP_INP_READ_LOCK(inp);
5673                         hold_rlock = 1;
5674                         if (cp_len == SCTP_BUF_LEN(m)) {
5675                                 if ((SCTP_BUF_NEXT(m) == NULL) &&
5676                                     (control->end_added)) {
5677                                         out_flags |= MSG_EOR;
5678                                         if ((control->do_not_ref_stcb == 0) &&
5679                                             (control->stcb != NULL) &&
5680                                             ((control->spec_flags & M_NOTIFICATION) == 0))
5681                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5682                                 }
5683                                 if (control->spec_flags & M_NOTIFICATION) {
5684                                         out_flags |= MSG_NOTIFICATION;
5685                                 }
5686                                 /* we ate up the mbuf */
5687                                 if (in_flags & MSG_PEEK) {
5688                                         /* just looking */
5689                                         m = SCTP_BUF_NEXT(m);
5690                                         copied_so_far += cp_len;
5691                                 } else {
5692                                         /* dispose of the mbuf */
5693                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5694                                                 sctp_sblog(&so->so_rcv,
5695                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
5696                                         }
5697                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
5698                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5699                                                 sctp_sblog(&so->so_rcv,
5700                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5701                                         }
5702                                         copied_so_far += cp_len;
5703                                         freed_so_far += cp_len;
5704                                         freed_so_far += MSIZE;
5705                                         atomic_subtract_int(&control->length, cp_len);
5706                                         control->data = sctp_m_free(m);
5707                                         m = control->data;
5708                                         /*
5709                                          * been through it all, must hold sb
5710                                          * lock ok to null tail
5711                                          */
5712                                         if (control->data == NULL) {
5713 #ifdef INVARIANTS
5714                                                 if ((control->end_added == 0) ||
5715                                                     (TAILQ_NEXT(control, next) == NULL)) {
5716                                                         /*
5717                                                          * If the end is not
5718                                                          * added, OR the
5719                                                          * next is NOT null
5720                                                          * we MUST have the
5721                                                          * lock.
5722                                                          */
5723                                                         if (mtx_owned(&inp->inp_rdata_mtx) == 0) {
5724                                                                 panic("Hmm we don't own the lock?");
5725                                                         }
5726                                                 }
5727 #endif
5728                                                 control->tail_mbuf = NULL;
5729 #ifdef INVARIANTS
5730                                                 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) {
5731                                                         panic("end_added, nothing left and no MSG_EOR");
5732                                                 }
5733 #endif
5734                                         }
5735                                 }
5736                         } else {
5737                                 /* Do we need to trim the mbuf? */
5738                                 if (control->spec_flags & M_NOTIFICATION) {
5739                                         out_flags |= MSG_NOTIFICATION;
5740                                 }
5741                                 if ((in_flags & MSG_PEEK) == 0) {
5742                                         SCTP_BUF_RESV_UF(m, cp_len);
5743                                         SCTP_BUF_LEN(m) -= cp_len;
5744                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5745                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, cp_len);
5746                                         }
5747                                         atomic_subtract_int(&so->so_rcv.sb_cc, cp_len);
5748                                         if ((control->do_not_ref_stcb == 0) &&
5749                                             stcb) {
5750                                                 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len);
5751                                         }
5752                                         copied_so_far += cp_len;
5753                                         freed_so_far += cp_len;
5754                                         freed_so_far += MSIZE;
5755                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5756                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
5757                                                     SCTP_LOG_SBRESULT, 0);
5758                                         }
5759                                         atomic_subtract_int(&control->length, cp_len);
5760                                 } else {
5761                                         copied_so_far += cp_len;
5762                                 }
5763                         }
5764                         if ((out_flags & MSG_EOR) || (uio->uio_resid == 0)) {
5765                                 break;
5766                         }
5767                         if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5768                             (control->do_not_ref_stcb == 0) &&
5769                             (freed_so_far >= rwnd_req)) {
5770                                 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5771                         }
5772                 }               /* end while(m) */
5773                 /*
5774                  * At this point we have looked at it all and we either have
5775                  * a MSG_EOR/or read all the user wants... <OR>
5776                  * control->length == 0.
5777                  */
5778                 if ((out_flags & MSG_EOR) && ((in_flags & MSG_PEEK) == 0)) {
5779                         /* we are done with this control */
5780                         if (control->length == 0) {
5781                                 if (control->data) {
5782 #ifdef INVARIANTS
5783                                         panic("control->data not null at read eor?");
5784 #else
5785                                         SCTP_PRINTF("Strange, data left in the control buffer .. invarients would panic?\n");
5786                                         sctp_m_freem(control->data);
5787                                         control->data = NULL;
5788 #endif
5789                                 }
5790                 done_with_control:
5791                                 if (hold_rlock == 0) {
5792                                         SCTP_INP_READ_LOCK(inp);
5793                                         hold_rlock = 1;
5794                                 }
5795                                 TAILQ_REMOVE(&inp->read_queue, control, next);
5796                                 /* Add back any hiddend data */
5797                                 if (control->held_length) {
5798                                         held_length = 0;
5799                                         control->held_length = 0;
5800                                         wakeup_read_socket = 1;
5801                                 }
5802                                 if (control->aux_data) {
5803                                         sctp_m_free(control->aux_data);
5804                                         control->aux_data = NULL;
5805                                 }
5806                                 no_rcv_needed = control->do_not_ref_stcb;
5807                                 sctp_free_remote_addr(control->whoFrom);
5808                                 control->data = NULL;
5809 #ifdef INVARIANTS
5810                                 if (control->on_strm_q) {
5811                                         panic("About to free ctl:%p so:%p and its in %d",
5812                                             control, so, control->on_strm_q);
5813                                 }
5814 #endif
5815                                 sctp_free_a_readq(stcb, control);
5816                                 control = NULL;
5817                                 if ((freed_so_far >= rwnd_req) &&
5818                                     (no_rcv_needed == 0))
5819                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5820
5821                         } else {
5822                                 /*
5823                                  * The user did not read all of this
5824                                  * message, turn off the returned MSG_EOR
5825                                  * since we are leaving more behind on the
5826                                  * control to read.
5827                                  */
5828 #ifdef INVARIANTS
5829                                 if (control->end_added &&
5830                                     (control->data == NULL) &&
5831                                     (control->tail_mbuf == NULL)) {
5832                                         panic("Gak, control->length is corrupt?");
5833                                 }
5834 #endif
5835                                 no_rcv_needed = control->do_not_ref_stcb;
5836                                 out_flags &= ~MSG_EOR;
5837                         }
5838                 }
5839                 if (out_flags & MSG_EOR) {
5840                         goto release;
5841                 }
5842                 if ((uio->uio_resid == 0) ||
5843                     ((in_eeor_mode) &&
5844                     (copied_so_far >= (uint32_t)max(so->so_rcv.sb_lowat, 1)))) {
5845                         goto release;
5846                 }
5847                 /*
5848                  * If I hit here the receiver wants more and this message is
5849                  * NOT done (pd-api). So two questions. Can we block? if not
5850                  * we are done. Did the user NOT set MSG_WAITALL?
5851                  */
5852                 if (block_allowed == 0) {
5853                         goto release;
5854                 }
5855                 /*
5856                  * We need to wait for more data a few things: - We don't
5857                  * sbunlock() so we don't get someone else reading. - We
5858                  * must be sure to account for the case where what is added
5859                  * is NOT to our control when we wakeup.
5860                  */
5861
5862                 /*
5863                  * Do we need to tell the transport a rwnd update might be
5864                  * needed before we go to sleep?
5865                  */
5866                 if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5867                     ((freed_so_far >= rwnd_req) &&
5868                     (control->do_not_ref_stcb == 0) &&
5869                     (no_rcv_needed == 0))) {
5870                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5871                 }
5872 wait_some_more:
5873                 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
5874                         goto release;
5875                 }
5876                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
5877                         goto release;
5878
5879                 if (hold_rlock == 1) {
5880                         SCTP_INP_READ_UNLOCK(inp);
5881                         hold_rlock = 0;
5882                 }
5883                 if (hold_sblock == 0) {
5884                         SOCKBUF_LOCK(&so->so_rcv);
5885                         hold_sblock = 1;
5886                 }
5887                 if ((copied_so_far) && (control->length == 0) &&
5888                     (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE))) {
5889                         goto release;
5890                 }
5891                 if (so->so_rcv.sb_cc <= control->held_length) {
5892                         error = sbwait(&so->so_rcv);
5893                         if (error) {
5894                                 goto release;
5895                         }
5896                         control->held_length = 0;
5897                 }
5898                 if (hold_sblock) {
5899                         SOCKBUF_UNLOCK(&so->so_rcv);
5900                         hold_sblock = 0;
5901                 }
5902                 if (control->length == 0) {
5903                         /* still nothing here */
5904                         if (control->end_added == 1) {
5905                                 /* he aborted, or is done i.e.did a shutdown */
5906                                 out_flags |= MSG_EOR;
5907                                 if (control->pdapi_aborted) {
5908                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5909                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5910
5911                                         out_flags |= MSG_TRUNC;
5912                                 } else {
5913                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5914                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5915                                 }
5916                                 goto done_with_control;
5917                         }
5918                         if (so->so_rcv.sb_cc > held_length) {
5919                                 control->held_length = so->so_rcv.sb_cc;
5920                                 held_length = 0;
5921                         }
5922                         goto wait_some_more;
5923                 } else if (control->data == NULL) {
5924                         /*
5925                          * we must re-sync since data is probably being
5926                          * added
5927                          */
5928                         SCTP_INP_READ_LOCK(inp);
5929                         if ((control->length > 0) && (control->data == NULL)) {
5930                                 /*
5931                                  * big trouble.. we have the lock and its
5932                                  * corrupt?
5933                                  */
5934 #ifdef INVARIANTS
5935                                 panic("Impossible data==NULL length !=0");
5936 #endif
5937                                 out_flags |= MSG_EOR;
5938                                 out_flags |= MSG_TRUNC;
5939                                 control->length = 0;
5940                                 SCTP_INP_READ_UNLOCK(inp);
5941                                 goto done_with_control;
5942                         }
5943                         SCTP_INP_READ_UNLOCK(inp);
5944                         /* We will fall around to get more data */
5945                 }
5946                 goto get_more_data;
5947         } else {
5948                 /*-
5949                  * Give caller back the mbuf chain,
5950                  * store in uio_resid the length
5951                  */
5952                 wakeup_read_socket = 0;
5953                 if ((control->end_added == 0) ||
5954                     (TAILQ_NEXT(control, next) == NULL)) {
5955                         /* Need to get rlock */
5956                         if (hold_rlock == 0) {
5957                                 SCTP_INP_READ_LOCK(inp);
5958                                 hold_rlock = 1;
5959                         }
5960                 }
5961                 if (control->end_added) {
5962                         out_flags |= MSG_EOR;
5963                         if ((control->do_not_ref_stcb == 0) &&
5964                             (control->stcb != NULL) &&
5965                             ((control->spec_flags & M_NOTIFICATION) == 0))
5966                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5967                 }
5968                 if (control->spec_flags & M_NOTIFICATION) {
5969                         out_flags |= MSG_NOTIFICATION;
5970                 }
5971                 uio->uio_resid = control->length;
5972                 *mp = control->data;
5973                 m = control->data;
5974                 while (m) {
5975                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5976                                 sctp_sblog(&so->so_rcv,
5977                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
5978                         }
5979                         sctp_sbfree(control, stcb, &so->so_rcv, m);
5980                         freed_so_far += SCTP_BUF_LEN(m);
5981                         freed_so_far += MSIZE;
5982                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5983                                 sctp_sblog(&so->so_rcv,
5984                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5985                         }
5986                         m = SCTP_BUF_NEXT(m);
5987                 }
5988                 control->data = control->tail_mbuf = NULL;
5989                 control->length = 0;
5990                 if (out_flags & MSG_EOR) {
5991                         /* Done with this control */
5992                         goto done_with_control;
5993                 }
5994         }
5995 release:
5996         if (hold_rlock == 1) {
5997                 SCTP_INP_READ_UNLOCK(inp);
5998                 hold_rlock = 0;
5999         }
6000         if (hold_sblock == 1) {
6001                 SOCKBUF_UNLOCK(&so->so_rcv);
6002                 hold_sblock = 0;
6003         }
6004         sbunlock(&so->so_rcv);
6005         sockbuf_lock = 0;
6006
6007 release_unlocked:
6008         if (hold_sblock) {
6009                 SOCKBUF_UNLOCK(&so->so_rcv);
6010                 hold_sblock = 0;
6011         }
6012         if ((stcb) && (in_flags & MSG_PEEK) == 0) {
6013                 if ((freed_so_far >= rwnd_req) &&
6014                     (control && (control->do_not_ref_stcb == 0)) &&
6015                     (no_rcv_needed == 0))
6016                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6017         }
6018 out:
6019         if (msg_flags) {
6020                 *msg_flags = out_flags;
6021         }
6022         if (((out_flags & MSG_EOR) == 0) &&
6023             ((in_flags & MSG_PEEK) == 0) &&
6024             (sinfo) &&
6025             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
6026             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO))) {
6027                 struct sctp_extrcvinfo *s_extra;
6028
6029                 s_extra = (struct sctp_extrcvinfo *)sinfo;
6030                 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG;
6031         }
6032         if (hold_rlock == 1) {
6033                 SCTP_INP_READ_UNLOCK(inp);
6034         }
6035         if (hold_sblock) {
6036                 SOCKBUF_UNLOCK(&so->so_rcv);
6037         }
6038         if (sockbuf_lock) {
6039                 sbunlock(&so->so_rcv);
6040         }
6041         if (freecnt_applied) {
6042                 /*
6043                  * The lock on the socket buffer protects us so the free
6044                  * code will stop. But since we used the socketbuf lock and
6045                  * the sender uses the tcb_lock to increment, we need to use
6046                  * the atomic add to the refcnt.
6047                  */
6048                 if (stcb == NULL) {
6049 #ifdef INVARIANTS
6050                         panic("stcb for refcnt has gone NULL?");
6051                         goto stage_left;
6052 #else
6053                         goto stage_left;
6054 #endif
6055                 }
6056                 /* Save the value back for next time */
6057                 stcb->freed_by_sorcv_sincelast = freed_so_far;
6058                 atomic_add_int(&stcb->asoc.refcnt, -1);
6059         }
6060         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
6061                 if (stcb) {
6062                         sctp_misc_ints(SCTP_SORECV_DONE,
6063                             freed_so_far,
6064                             (uint32_t)((uio) ? (slen - uio->uio_resid) : slen),
6065                             stcb->asoc.my_rwnd,
6066                             so->so_rcv.sb_cc);
6067                 } else {
6068                         sctp_misc_ints(SCTP_SORECV_DONE,
6069                             freed_so_far,
6070                             (uint32_t)((uio) ? (slen - uio->uio_resid) : slen),
6071                             0,
6072                             so->so_rcv.sb_cc);
6073                 }
6074         }
6075 stage_left:
6076         if (wakeup_read_socket) {
6077                 sctp_sorwakeup(inp, so);
6078         }
6079         return (error);
6080 }
6081
6082
6083 #ifdef SCTP_MBUF_LOGGING
6084 struct mbuf *
6085 sctp_m_free(struct mbuf *m)
6086 {
6087         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
6088                 sctp_log_mb(m, SCTP_MBUF_IFREE);
6089         }
6090         return (m_free(m));
6091 }
6092
6093 void
6094 sctp_m_freem(struct mbuf *mb)
6095 {
6096         while (mb != NULL)
6097                 mb = sctp_m_free(mb);
6098 }
6099
6100 #endif
6101
6102 int
6103 sctp_dynamic_set_primary(struct sockaddr *sa, uint32_t vrf_id)
6104 {
6105         /*
6106          * Given a local address. For all associations that holds the
6107          * address, request a peer-set-primary.
6108          */
6109         struct sctp_ifa *ifa;
6110         struct sctp_laddr *wi;
6111
6112         ifa = sctp_find_ifa_by_addr(sa, vrf_id, 0);
6113         if (ifa == NULL) {
6114                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EADDRNOTAVAIL);
6115                 return (EADDRNOTAVAIL);
6116         }
6117         /*
6118          * Now that we have the ifa we must awaken the iterator with this
6119          * message.
6120          */
6121         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
6122         if (wi == NULL) {
6123                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
6124                 return (ENOMEM);
6125         }
6126         /* Now incr the count and int wi structure */
6127         SCTP_INCR_LADDR_COUNT();
6128         memset(wi, 0, sizeof(*wi));
6129         (void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
6130         wi->ifa = ifa;
6131         wi->action = SCTP_SET_PRIM_ADDR;
6132         atomic_add_int(&ifa->refcount, 1);
6133
6134         /* Now add it to the work queue */
6135         SCTP_WQ_ADDR_LOCK();
6136         /*
6137          * Should this really be a tailq? As it is we will process the
6138          * newest first :-0
6139          */
6140         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
6141         sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
6142             (struct sctp_inpcb *)NULL,
6143             (struct sctp_tcb *)NULL,
6144             (struct sctp_nets *)NULL);
6145         SCTP_WQ_ADDR_UNLOCK();
6146         return (0);
6147 }
6148
6149
6150 int
6151 sctp_soreceive(struct socket *so,
6152     struct sockaddr **psa,
6153     struct uio *uio,
6154     struct mbuf **mp0,
6155     struct mbuf **controlp,
6156     int *flagsp)
6157 {
6158         int error, fromlen;
6159         uint8_t sockbuf[256];
6160         struct sockaddr *from;
6161         struct sctp_extrcvinfo sinfo;
6162         int filling_sinfo = 1;
6163         struct sctp_inpcb *inp;
6164
6165         inp = (struct sctp_inpcb *)so->so_pcb;
6166         /* pickup the assoc we are reading from */
6167         if (inp == NULL) {
6168                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6169                 return (EINVAL);
6170         }
6171         if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) &&
6172             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) &&
6173             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) ||
6174             (controlp == NULL)) {
6175                 /* user does not want the sndrcv ctl */
6176                 filling_sinfo = 0;
6177         }
6178         if (psa) {
6179                 from = (struct sockaddr *)sockbuf;
6180                 fromlen = sizeof(sockbuf);
6181                 from->sa_len = 0;
6182         } else {
6183                 from = NULL;
6184                 fromlen = 0;
6185         }
6186
6187         if (filling_sinfo) {
6188                 memset(&sinfo, 0, sizeof(struct sctp_extrcvinfo));
6189         }
6190         error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, flagsp,
6191             (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo);
6192         if (controlp != NULL) {
6193                 /* copy back the sinfo in a CMSG format */
6194                 if (filling_sinfo)
6195                         *controlp = sctp_build_ctl_nchunk(inp,
6196                             (struct sctp_sndrcvinfo *)&sinfo);
6197                 else
6198                         *controlp = NULL;
6199         }
6200         if (psa) {
6201                 /* copy back the address info */
6202                 if (from && from->sa_len) {
6203                         *psa = sodupsockaddr(from, M_NOWAIT);
6204                 } else {
6205                         *psa = NULL;
6206                 }
6207         }
6208         return (error);
6209 }
6210
6211
6212
6213
6214
6215 int
6216 sctp_connectx_helper_add(struct sctp_tcb *stcb, struct sockaddr *addr,
6217     int totaddr, int *error)
6218 {
6219         int added = 0;
6220         int i;
6221         struct sctp_inpcb *inp;
6222         struct sockaddr *sa;
6223         size_t incr = 0;
6224 #ifdef INET
6225         struct sockaddr_in *sin;
6226 #endif
6227 #ifdef INET6
6228         struct sockaddr_in6 *sin6;
6229 #endif
6230
6231         sa = addr;
6232         inp = stcb->sctp_ep;
6233         *error = 0;
6234         for (i = 0; i < totaddr; i++) {
6235                 switch (sa->sa_family) {
6236 #ifdef INET
6237                 case AF_INET:
6238                         incr = sizeof(struct sockaddr_in);
6239                         sin = (struct sockaddr_in *)sa;
6240                         if ((sin->sin_addr.s_addr == INADDR_ANY) ||
6241                             (sin->sin_addr.s_addr == INADDR_BROADCAST) ||
6242                             IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
6243                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6244                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6245                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_7);
6246                                 *error = EINVAL;
6247                                 goto out_now;
6248                         }
6249                         if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port,
6250                             SCTP_DONOT_SETSCOPE,
6251                             SCTP_ADDR_IS_CONFIRMED)) {
6252                                 /* assoc gone no un-lock */
6253                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6254                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6255                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_8);
6256                                 *error = ENOBUFS;
6257                                 goto out_now;
6258                         }
6259                         added++;
6260                         break;
6261 #endif
6262 #ifdef INET6
6263                 case AF_INET6:
6264                         incr = sizeof(struct sockaddr_in6);
6265                         sin6 = (struct sockaddr_in6 *)sa;
6266                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
6267                             IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
6268                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6269                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6270                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_9);
6271                                 *error = EINVAL;
6272                                 goto out_now;
6273                         }
6274                         if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port,
6275                             SCTP_DONOT_SETSCOPE,
6276                             SCTP_ADDR_IS_CONFIRMED)) {
6277                                 /* assoc gone no un-lock */
6278                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6279                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6280                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_10);
6281                                 *error = ENOBUFS;
6282                                 goto out_now;
6283                         }
6284                         added++;
6285                         break;
6286 #endif
6287                 default:
6288                         break;
6289                 }
6290                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6291         }
6292 out_now:
6293         return (added);
6294 }
6295
6296 struct sctp_tcb *
6297 sctp_connectx_helper_find(struct sctp_inpcb *inp, struct sockaddr *addr,
6298     unsigned int *totaddr,
6299     unsigned int *num_v4, unsigned int *num_v6, int *error,
6300     unsigned int limit, int *bad_addr)
6301 {
6302         struct sockaddr *sa;
6303         struct sctp_tcb *stcb = NULL;
6304         unsigned int incr, at, i;
6305
6306         at = 0;
6307         sa = addr;
6308         *error = *num_v6 = *num_v4 = 0;
6309         /* account and validate addresses */
6310         for (i = 0; i < *totaddr; i++) {
6311                 switch (sa->sa_family) {
6312 #ifdef INET
6313                 case AF_INET:
6314                         incr = (unsigned int)sizeof(struct sockaddr_in);
6315                         if (sa->sa_len != incr) {
6316                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6317                                 *error = EINVAL;
6318                                 *bad_addr = 1;
6319                                 return (NULL);
6320                         }
6321                         (*num_v4) += 1;
6322                         break;
6323 #endif
6324 #ifdef INET6
6325                 case AF_INET6:
6326                         {
6327                                 struct sockaddr_in6 *sin6;
6328
6329                                 sin6 = (struct sockaddr_in6 *)sa;
6330                                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6331                                         /* Must be non-mapped for connectx */
6332                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6333                                         *error = EINVAL;
6334                                         *bad_addr = 1;
6335                                         return (NULL);
6336                                 }
6337                                 incr = (unsigned int)sizeof(struct sockaddr_in6);
6338                                 if (sa->sa_len != incr) {
6339                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6340                                         *error = EINVAL;
6341                                         *bad_addr = 1;
6342                                         return (NULL);
6343                                 }
6344                                 (*num_v6) += 1;
6345                                 break;
6346                         }
6347 #endif
6348                 default:
6349                         *totaddr = i;
6350                         incr = 0;
6351                         /* we are done */
6352                         break;
6353                 }
6354                 if (i == *totaddr) {
6355                         break;
6356                 }
6357                 SCTP_INP_INCR_REF(inp);
6358                 stcb = sctp_findassociation_ep_addr(&inp, sa, NULL, NULL, NULL);
6359                 if (stcb != NULL) {
6360                         /* Already have or am bring up an association */
6361                         return (stcb);
6362                 } else {
6363                         SCTP_INP_DECR_REF(inp);
6364                 }
6365                 if ((at + incr) > limit) {
6366                         *totaddr = i;
6367                         break;
6368                 }
6369                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6370         }
6371         return ((struct sctp_tcb *)NULL);
6372 }
6373
6374 /*
6375  * sctp_bindx(ADD) for one address.
6376  * assumes all arguments are valid/checked by caller.
6377  */
6378 void
6379 sctp_bindx_add_address(struct socket *so, struct sctp_inpcb *inp,
6380     struct sockaddr *sa, sctp_assoc_t assoc_id,
6381     uint32_t vrf_id, int *error, void *p)
6382 {
6383         struct sockaddr *addr_touse;
6384 #if defined(INET) && defined(INET6)
6385         struct sockaddr_in sin;
6386 #endif
6387
6388         /* see if we're bound all already! */
6389         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6390                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6391                 *error = EINVAL;
6392                 return;
6393         }
6394         addr_touse = sa;
6395 #ifdef INET6
6396         if (sa->sa_family == AF_INET6) {
6397 #ifdef INET
6398                 struct sockaddr_in6 *sin6;
6399
6400 #endif
6401                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6402                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6403                         *error = EINVAL;
6404                         return;
6405                 }
6406                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6407                         /* can only bind v6 on PF_INET6 sockets */
6408                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6409                         *error = EINVAL;
6410                         return;
6411                 }
6412 #ifdef INET
6413                 sin6 = (struct sockaddr_in6 *)addr_touse;
6414                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6415                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6416                             SCTP_IPV6_V6ONLY(inp)) {
6417                                 /* can't bind v4-mapped on PF_INET sockets */
6418                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6419                                 *error = EINVAL;
6420                                 return;
6421                         }
6422                         in6_sin6_2_sin(&sin, sin6);
6423                         addr_touse = (struct sockaddr *)&sin;
6424                 }
6425 #endif
6426         }
6427 #endif
6428 #ifdef INET
6429         if (sa->sa_family == AF_INET) {
6430                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6431                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6432                         *error = EINVAL;
6433                         return;
6434                 }
6435                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6436                     SCTP_IPV6_V6ONLY(inp)) {
6437                         /* can't bind v4 on PF_INET sockets */
6438                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6439                         *error = EINVAL;
6440                         return;
6441                 }
6442         }
6443 #endif
6444         if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
6445                 if (p == NULL) {
6446                         /* Can't get proc for Net/Open BSD */
6447                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6448                         *error = EINVAL;
6449                         return;
6450                 }
6451                 *error = sctp_inpcb_bind(so, addr_touse, NULL, p);
6452                 return;
6453         }
6454         /*
6455          * No locks required here since bind and mgmt_ep_sa all do their own
6456          * locking. If we do something for the FIX: below we may need to
6457          * lock in that case.
6458          */
6459         if (assoc_id == 0) {
6460                 /* add the address */
6461                 struct sctp_inpcb *lep;
6462                 struct sockaddr_in *lsin = (struct sockaddr_in *)addr_touse;
6463
6464                 /* validate the incoming port */
6465                 if ((lsin->sin_port != 0) &&
6466                     (lsin->sin_port != inp->sctp_lport)) {
6467                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6468                         *error = EINVAL;
6469                         return;
6470                 } else {
6471                         /* user specified 0 port, set it to existing port */
6472                         lsin->sin_port = inp->sctp_lport;
6473                 }
6474
6475                 lep = sctp_pcb_findep(addr_touse, 1, 0, vrf_id);
6476                 if (lep != NULL) {
6477                         /*
6478                          * We must decrement the refcount since we have the
6479                          * ep already and are binding. No remove going on
6480                          * here.
6481                          */
6482                         SCTP_INP_DECR_REF(lep);
6483                 }
6484                 if (lep == inp) {
6485                         /* already bound to it.. ok */
6486                         return;
6487                 } else if (lep == NULL) {
6488                         ((struct sockaddr_in *)addr_touse)->sin_port = 0;
6489                         *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6490                             SCTP_ADD_IP_ADDRESS,
6491                             vrf_id, NULL);
6492                 } else {
6493                         *error = EADDRINUSE;
6494                 }
6495                 if (*error)
6496                         return;
6497         } else {
6498                 /*
6499                  * FIX: decide whether we allow assoc based bindx
6500                  */
6501         }
6502 }
6503
6504 /*
6505  * sctp_bindx(DELETE) for one address.
6506  * assumes all arguments are valid/checked by caller.
6507  */
6508 void
6509 sctp_bindx_delete_address(struct sctp_inpcb *inp,
6510     struct sockaddr *sa, sctp_assoc_t assoc_id,
6511     uint32_t vrf_id, int *error)
6512 {
6513         struct sockaddr *addr_touse;
6514 #if defined(INET) && defined(INET6)
6515         struct sockaddr_in sin;
6516 #endif
6517
6518         /* see if we're bound all already! */
6519         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6520                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6521                 *error = EINVAL;
6522                 return;
6523         }
6524         addr_touse = sa;
6525 #ifdef INET6
6526         if (sa->sa_family == AF_INET6) {
6527 #ifdef INET
6528                 struct sockaddr_in6 *sin6;
6529 #endif
6530
6531                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6532                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6533                         *error = EINVAL;
6534                         return;
6535                 }
6536                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6537                         /* can only bind v6 on PF_INET6 sockets */
6538                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6539                         *error = EINVAL;
6540                         return;
6541                 }
6542 #ifdef INET
6543                 sin6 = (struct sockaddr_in6 *)addr_touse;
6544                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6545                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6546                             SCTP_IPV6_V6ONLY(inp)) {
6547                                 /* can't bind mapped-v4 on PF_INET sockets */
6548                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6549                                 *error = EINVAL;
6550                                 return;
6551                         }
6552                         in6_sin6_2_sin(&sin, sin6);
6553                         addr_touse = (struct sockaddr *)&sin;
6554                 }
6555 #endif
6556         }
6557 #endif
6558 #ifdef INET
6559         if (sa->sa_family == AF_INET) {
6560                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6561                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6562                         *error = EINVAL;
6563                         return;
6564                 }
6565                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6566                     SCTP_IPV6_V6ONLY(inp)) {
6567                         /* can't bind v4 on PF_INET sockets */
6568                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6569                         *error = EINVAL;
6570                         return;
6571                 }
6572         }
6573 #endif
6574         /*
6575          * No lock required mgmt_ep_sa does its own locking. If the FIX:
6576          * below is ever changed we may need to lock before calling
6577          * association level binding.
6578          */
6579         if (assoc_id == 0) {
6580                 /* delete the address */
6581                 *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6582                     SCTP_DEL_IP_ADDRESS,
6583                     vrf_id, NULL);
6584         } else {
6585                 /*
6586                  * FIX: decide whether we allow assoc based bindx
6587                  */
6588         }
6589 }
6590
6591 /*
6592  * returns the valid local address count for an assoc, taking into account
6593  * all scoping rules
6594  */
6595 int
6596 sctp_local_addr_count(struct sctp_tcb *stcb)
6597 {
6598         int loopback_scope;
6599 #if defined(INET)
6600         int ipv4_local_scope, ipv4_addr_legal;
6601 #endif
6602 #if defined (INET6)
6603         int local_scope, site_scope, ipv6_addr_legal;
6604 #endif
6605         struct sctp_vrf *vrf;
6606         struct sctp_ifn *sctp_ifn;
6607         struct sctp_ifa *sctp_ifa;
6608         int count = 0;
6609
6610         /* Turn on all the appropriate scopes */
6611         loopback_scope = stcb->asoc.scope.loopback_scope;
6612 #if defined(INET)
6613         ipv4_local_scope = stcb->asoc.scope.ipv4_local_scope;
6614         ipv4_addr_legal = stcb->asoc.scope.ipv4_addr_legal;
6615 #endif
6616 #if defined(INET6)
6617         local_scope = stcb->asoc.scope.local_scope;
6618         site_scope = stcb->asoc.scope.site_scope;
6619         ipv6_addr_legal = stcb->asoc.scope.ipv6_addr_legal;
6620 #endif
6621         SCTP_IPI_ADDR_RLOCK();
6622         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
6623         if (vrf == NULL) {
6624                 /* no vrf, no addresses */
6625                 SCTP_IPI_ADDR_RUNLOCK();
6626                 return (0);
6627         }
6628         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6629                 /*
6630                  * bound all case: go through all ifns on the vrf
6631                  */
6632                 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
6633                         if ((loopback_scope == 0) &&
6634                             SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
6635                                 continue;
6636                         }
6637                         LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
6638                                 if (sctp_is_addr_restricted(stcb, sctp_ifa))
6639                                         continue;
6640                                 switch (sctp_ifa->address.sa.sa_family) {
6641 #ifdef INET
6642                                 case AF_INET:
6643                                         if (ipv4_addr_legal) {
6644                                                 struct sockaddr_in *sin;
6645
6646                                                 sin = &sctp_ifa->address.sin;
6647                                                 if (sin->sin_addr.s_addr == 0) {
6648                                                         /*
6649                                                          * skip unspecified
6650                                                          * addrs
6651                                                          */
6652                                                         continue;
6653                                                 }
6654                                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
6655                                                     &sin->sin_addr) != 0) {
6656                                                         continue;
6657                                                 }
6658                                                 if ((ipv4_local_scope == 0) &&
6659                                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
6660                                                         continue;
6661                                                 }
6662                                                 /* count this one */
6663                                                 count++;
6664                                         } else {
6665                                                 continue;
6666                                         }
6667                                         break;
6668 #endif
6669 #ifdef INET6
6670                                 case AF_INET6:
6671                                         if (ipv6_addr_legal) {
6672                                                 struct sockaddr_in6 *sin6;
6673
6674                                                 sin6 = &sctp_ifa->address.sin6;
6675                                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
6676                                                         continue;
6677                                                 }
6678                                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
6679                                                     &sin6->sin6_addr) != 0) {
6680                                                         continue;
6681                                                 }
6682                                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
6683                                                         if (local_scope == 0)
6684                                                                 continue;
6685                                                         if (sin6->sin6_scope_id == 0) {
6686                                                                 if (sa6_recoverscope(sin6) != 0)
6687                                                                         /*
6688                                                                          *
6689                                                                          * bad
6690                                                                          * link
6691                                                                          *
6692                                                                          * local
6693                                                                          *
6694                                                                          * address
6695                                                                          */
6696                                                                         continue;
6697                                                         }
6698                                                 }
6699                                                 if ((site_scope == 0) &&
6700                                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
6701                                                         continue;
6702                                                 }
6703                                                 /* count this one */
6704                                                 count++;
6705                                         }
6706                                         break;
6707 #endif
6708                                 default:
6709                                         /* TSNH */
6710                                         break;
6711                                 }
6712                         }
6713                 }
6714         } else {
6715                 /*
6716                  * subset bound case
6717                  */
6718                 struct sctp_laddr *laddr;
6719
6720                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list,
6721                     sctp_nxt_addr) {
6722                         if (sctp_is_addr_restricted(stcb, laddr->ifa)) {
6723                                 continue;
6724                         }
6725                         /* count this one */
6726                         count++;
6727                 }
6728         }
6729         SCTP_IPI_ADDR_RUNLOCK();
6730         return (count);
6731 }
6732
6733 #if defined(SCTP_LOCAL_TRACE_BUF)
6734
6735 void
6736 sctp_log_trace(uint32_t subsys, const char *str SCTP_UNUSED, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f)
6737 {
6738         uint32_t saveindex, newindex;
6739
6740         do {
6741                 saveindex = SCTP_BASE_SYSCTL(sctp_log).index;
6742                 if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6743                         newindex = 1;
6744                 } else {
6745                         newindex = saveindex + 1;
6746                 }
6747         } while (atomic_cmpset_int(&SCTP_BASE_SYSCTL(sctp_log).index, saveindex, newindex) == 0);
6748         if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6749                 saveindex = 0;
6750         }
6751         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].timestamp = SCTP_GET_CYCLECOUNT;
6752         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].subsys = subsys;
6753         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[0] = a;
6754         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[1] = b;
6755         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[2] = c;
6756         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[3] = d;
6757         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[4] = e;
6758         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[5] = f;
6759 }
6760
6761 #endif
6762 static void
6763 sctp_recv_udp_tunneled_packet(struct mbuf *m, int off, struct inpcb *inp,
6764     const struct sockaddr *sa SCTP_UNUSED, void *ctx SCTP_UNUSED)
6765 {
6766         struct ip *iph;
6767 #ifdef INET6
6768         struct ip6_hdr *ip6;
6769 #endif
6770         struct mbuf *sp, *last;
6771         struct udphdr *uhdr;
6772         uint16_t port;
6773
6774         if ((m->m_flags & M_PKTHDR) == 0) {
6775                 /* Can't handle one that is not a pkt hdr */
6776                 goto out;
6777         }
6778         /* Pull the src port */
6779         iph = mtod(m, struct ip *);
6780         uhdr = (struct udphdr *)((caddr_t)iph + off);
6781         port = uhdr->uh_sport;
6782         /*
6783          * Split out the mbuf chain. Leave the IP header in m, place the
6784          * rest in the sp.
6785          */
6786         sp = m_split(m, off, M_NOWAIT);
6787         if (sp == NULL) {
6788                 /* Gak, drop packet, we can't do a split */
6789                 goto out;
6790         }
6791         if (sp->m_pkthdr.len < sizeof(struct udphdr) + sizeof(struct sctphdr)) {
6792                 /* Gak, packet can't have an SCTP header in it - too small */
6793                 m_freem(sp);
6794                 goto out;
6795         }
6796         /* Now pull up the UDP header and SCTP header together */
6797         sp = m_pullup(sp, sizeof(struct udphdr) + sizeof(struct sctphdr));
6798         if (sp == NULL) {
6799                 /* Gak pullup failed */
6800                 goto out;
6801         }
6802         /* Trim out the UDP header */
6803         m_adj(sp, sizeof(struct udphdr));
6804
6805         /* Now reconstruct the mbuf chain */
6806         for (last = m; last->m_next; last = last->m_next);
6807         last->m_next = sp;
6808         m->m_pkthdr.len += sp->m_pkthdr.len;
6809         /*
6810          * The CSUM_DATA_VALID flags indicates that the HW checked the UDP
6811          * checksum and it was valid. Since CSUM_DATA_VALID ==
6812          * CSUM_SCTP_VALID this would imply that the HW also verified the
6813          * SCTP checksum. Therefore, clear the bit.
6814          */
6815         SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
6816             "sctp_recv_udp_tunneled_packet(): Packet of length %d received on %s with csum_flags 0x%b.\n",
6817             m->m_pkthdr.len,
6818             if_name(m->m_pkthdr.rcvif),
6819             (int)m->m_pkthdr.csum_flags, CSUM_BITS);
6820         m->m_pkthdr.csum_flags &= ~CSUM_DATA_VALID;
6821         iph = mtod(m, struct ip *);
6822         switch (iph->ip_v) {
6823 #ifdef INET
6824         case IPVERSION:
6825                 iph->ip_len = htons(ntohs(iph->ip_len) - sizeof(struct udphdr));
6826                 sctp_input_with_port(m, off, port);
6827                 break;
6828 #endif
6829 #ifdef INET6
6830         case IPV6_VERSION >> 4:
6831                 ip6 = mtod(m, struct ip6_hdr *);
6832                 ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - sizeof(struct udphdr));
6833                 sctp6_input_with_port(&m, &off, port);
6834                 break;
6835 #endif
6836         default:
6837                 goto out;
6838                 break;
6839         }
6840         return;
6841 out:
6842         m_freem(m);
6843 }
6844
6845 #ifdef INET
6846 static void
6847 sctp_recv_icmp_tunneled_packet(int cmd, struct sockaddr *sa, void *vip, void *ctx SCTP_UNUSED)
6848 {
6849         struct ip *outer_ip, *inner_ip;
6850         struct sctphdr *sh;
6851         struct icmp *icmp;
6852         struct udphdr *udp;
6853         struct sctp_inpcb *inp;
6854         struct sctp_tcb *stcb;
6855         struct sctp_nets *net;
6856         struct sctp_init_chunk *ch;
6857         struct sockaddr_in src, dst;
6858         uint8_t type, code;
6859
6860         inner_ip = (struct ip *)vip;
6861         icmp = (struct icmp *)((caddr_t)inner_ip -
6862             (sizeof(struct icmp) - sizeof(struct ip)));
6863         outer_ip = (struct ip *)((caddr_t)icmp - sizeof(struct ip));
6864         if (ntohs(outer_ip->ip_len) <
6865             sizeof(struct ip) + 8 + (inner_ip->ip_hl << 2) + sizeof(struct udphdr) + 8) {
6866                 return;
6867         }
6868         udp = (struct udphdr *)((caddr_t)inner_ip + (inner_ip->ip_hl << 2));
6869         sh = (struct sctphdr *)(udp + 1);
6870         memset(&src, 0, sizeof(struct sockaddr_in));
6871         src.sin_family = AF_INET;
6872         src.sin_len = sizeof(struct sockaddr_in);
6873         src.sin_port = sh->src_port;
6874         src.sin_addr = inner_ip->ip_src;
6875         memset(&dst, 0, sizeof(struct sockaddr_in));
6876         dst.sin_family = AF_INET;
6877         dst.sin_len = sizeof(struct sockaddr_in);
6878         dst.sin_port = sh->dest_port;
6879         dst.sin_addr = inner_ip->ip_dst;
6880         /*
6881          * 'dst' holds the dest of the packet that failed to be sent. 'src'
6882          * holds our local endpoint address. Thus we reverse the dst and the
6883          * src in the lookup.
6884          */
6885         inp = NULL;
6886         net = NULL;
6887         stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst,
6888             (struct sockaddr *)&src,
6889             &inp, &net, 1,
6890             SCTP_DEFAULT_VRFID);
6891         if ((stcb != NULL) &&
6892             (net != NULL) &&
6893             (inp != NULL)) {
6894                 /* Check the UDP port numbers */
6895                 if ((udp->uh_dport != net->port) ||
6896                     (udp->uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) {
6897                         SCTP_TCB_UNLOCK(stcb);
6898                         return;
6899                 }
6900                 /* Check the verification tag */
6901                 if (ntohl(sh->v_tag) != 0) {
6902                         /*
6903                          * This must be the verification tag used for
6904                          * sending out packets. We don't consider packets
6905                          * reflecting the verification tag.
6906                          */
6907                         if (ntohl(sh->v_tag) != stcb->asoc.peer_vtag) {
6908                                 SCTP_TCB_UNLOCK(stcb);
6909                                 return;
6910                         }
6911                 } else {
6912                         if (ntohs(outer_ip->ip_len) >=
6913                             sizeof(struct ip) +
6914                             8 + (inner_ip->ip_hl << 2) + 8 + 20) {
6915                                 /*
6916                                  * In this case we can check if we got an
6917                                  * INIT chunk and if the initiate tag
6918                                  * matches.
6919                                  */
6920                                 ch = (struct sctp_init_chunk *)(sh + 1);
6921                                 if ((ch->ch.chunk_type != SCTP_INITIATION) ||
6922                                     (ntohl(ch->init.initiate_tag) != stcb->asoc.my_vtag)) {
6923                                         SCTP_TCB_UNLOCK(stcb);
6924                                         return;
6925                                 }
6926                         } else {
6927                                 SCTP_TCB_UNLOCK(stcb);
6928                                 return;
6929                         }
6930                 }
6931                 type = icmp->icmp_type;
6932                 code = icmp->icmp_code;
6933                 if ((type == ICMP_UNREACH) &&
6934                     (code == ICMP_UNREACH_PORT)) {
6935                         code = ICMP_UNREACH_PROTOCOL;
6936                 }
6937                 sctp_notify(inp, stcb, net, type, code,
6938                     ntohs(inner_ip->ip_len),
6939                     (uint32_t)ntohs(icmp->icmp_nextmtu));
6940         } else {
6941                 if ((stcb == NULL) && (inp != NULL)) {
6942                         /* reduce ref-count */
6943                         SCTP_INP_WLOCK(inp);
6944                         SCTP_INP_DECR_REF(inp);
6945                         SCTP_INP_WUNLOCK(inp);
6946                 }
6947                 if (stcb) {
6948                         SCTP_TCB_UNLOCK(stcb);
6949                 }
6950         }
6951         return;
6952 }
6953 #endif
6954
6955 #ifdef INET6
6956 static void
6957 sctp_recv_icmp6_tunneled_packet(int cmd, struct sockaddr *sa, void *d, void *ctx SCTP_UNUSED)
6958 {
6959         struct ip6ctlparam *ip6cp;
6960         struct sctp_inpcb *inp;
6961         struct sctp_tcb *stcb;
6962         struct sctp_nets *net;
6963         struct sctphdr sh;
6964         struct udphdr udp;
6965         struct sockaddr_in6 src, dst;
6966         uint8_t type, code;
6967
6968         ip6cp = (struct ip6ctlparam *)d;
6969         /*
6970          * XXX: We assume that when IPV6 is non NULL, M and OFF are valid.
6971          */
6972         if (ip6cp->ip6c_m == NULL) {
6973                 return;
6974         }
6975         /*
6976          * Check if we can safely examine the ports and the verification tag
6977          * of the SCTP common header.
6978          */
6979         if (ip6cp->ip6c_m->m_pkthdr.len <
6980             ip6cp->ip6c_off + sizeof(struct udphdr) + offsetof(struct sctphdr, checksum)) {
6981                 return;
6982         }
6983         /* Copy out the UDP header. */
6984         memset(&udp, 0, sizeof(struct udphdr));
6985         m_copydata(ip6cp->ip6c_m,
6986             ip6cp->ip6c_off,
6987             sizeof(struct udphdr),
6988             (caddr_t)&udp);
6989         /* Copy out the port numbers and the verification tag. */
6990         memset(&sh, 0, sizeof(struct sctphdr));
6991         m_copydata(ip6cp->ip6c_m,
6992             ip6cp->ip6c_off + sizeof(struct udphdr),
6993             sizeof(uint16_t) + sizeof(uint16_t) + sizeof(uint32_t),
6994             (caddr_t)&sh);
6995         memset(&src, 0, sizeof(struct sockaddr_in6));
6996         src.sin6_family = AF_INET6;
6997         src.sin6_len = sizeof(struct sockaddr_in6);
6998         src.sin6_port = sh.src_port;
6999         src.sin6_addr = ip6cp->ip6c_ip6->ip6_src;
7000         if (in6_setscope(&src.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) {
7001                 return;
7002         }
7003         memset(&dst, 0, sizeof(struct sockaddr_in6));
7004         dst.sin6_family = AF_INET6;
7005         dst.sin6_len = sizeof(struct sockaddr_in6);
7006         dst.sin6_port = sh.dest_port;
7007         dst.sin6_addr = ip6cp->ip6c_ip6->ip6_dst;
7008         if (in6_setscope(&dst.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) {
7009                 return;
7010         }
7011         inp = NULL;
7012         net = NULL;
7013         stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst,
7014             (struct sockaddr *)&src,
7015             &inp, &net, 1, SCTP_DEFAULT_VRFID);
7016         if ((stcb != NULL) &&
7017             (net != NULL) &&
7018             (inp != NULL)) {
7019                 /* Check the UDP port numbers */
7020                 if ((udp.uh_dport != net->port) ||
7021                     (udp.uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) {
7022                         SCTP_TCB_UNLOCK(stcb);
7023                         return;
7024                 }
7025                 /* Check the verification tag */
7026                 if (ntohl(sh.v_tag) != 0) {
7027                         /*
7028                          * This must be the verification tag used for
7029                          * sending out packets. We don't consider packets
7030                          * reflecting the verification tag.
7031                          */
7032                         if (ntohl(sh.v_tag) != stcb->asoc.peer_vtag) {
7033                                 SCTP_TCB_UNLOCK(stcb);
7034                                 return;
7035                         }
7036                 } else {
7037                         if (ip6cp->ip6c_m->m_pkthdr.len >=
7038                             ip6cp->ip6c_off + sizeof(struct udphdr) +
7039                             sizeof(struct sctphdr) +
7040                             sizeof(struct sctp_chunkhdr) +
7041                             offsetof(struct sctp_init, a_rwnd)) {
7042                                 /*
7043                                  * In this case we can check if we got an
7044                                  * INIT chunk and if the initiate tag
7045                                  * matches.
7046                                  */
7047                                 uint32_t initiate_tag;
7048                                 uint8_t chunk_type;
7049
7050                                 m_copydata(ip6cp->ip6c_m,
7051                                     ip6cp->ip6c_off +
7052                                     sizeof(struct udphdr) +
7053                                     sizeof(struct sctphdr),
7054                                     sizeof(uint8_t),
7055                                     (caddr_t)&chunk_type);
7056                                 m_copydata(ip6cp->ip6c_m,
7057                                     ip6cp->ip6c_off +
7058                                     sizeof(struct udphdr) +
7059                                     sizeof(struct sctphdr) +
7060                                     sizeof(struct sctp_chunkhdr),
7061                                     sizeof(uint32_t),
7062                                     (caddr_t)&initiate_tag);
7063                                 if ((chunk_type != SCTP_INITIATION) ||
7064                                     (ntohl(initiate_tag) != stcb->asoc.my_vtag)) {
7065                                         SCTP_TCB_UNLOCK(stcb);
7066                                         return;
7067                                 }
7068                         } else {
7069                                 SCTP_TCB_UNLOCK(stcb);
7070                                 return;
7071                         }
7072                 }
7073                 type = ip6cp->ip6c_icmp6->icmp6_type;
7074                 code = ip6cp->ip6c_icmp6->icmp6_code;
7075                 if ((type == ICMP6_DST_UNREACH) &&
7076                     (code == ICMP6_DST_UNREACH_NOPORT)) {
7077                         type = ICMP6_PARAM_PROB;
7078                         code = ICMP6_PARAMPROB_NEXTHEADER;
7079                 }
7080                 sctp6_notify(inp, stcb, net, type, code,
7081                     ntohl(ip6cp->ip6c_icmp6->icmp6_mtu));
7082         } else {
7083                 if ((stcb == NULL) && (inp != NULL)) {
7084                         /* reduce inp's ref-count */
7085                         SCTP_INP_WLOCK(inp);
7086                         SCTP_INP_DECR_REF(inp);
7087                         SCTP_INP_WUNLOCK(inp);
7088                 }
7089                 if (stcb) {
7090                         SCTP_TCB_UNLOCK(stcb);
7091                 }
7092         }
7093 }
7094 #endif
7095
7096 void
7097 sctp_over_udp_stop(void)
7098 {
7099         /*
7100          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
7101          * for writting!
7102          */
7103 #ifdef INET
7104         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
7105                 soclose(SCTP_BASE_INFO(udp4_tun_socket));
7106                 SCTP_BASE_INFO(udp4_tun_socket) = NULL;
7107         }
7108 #endif
7109 #ifdef INET6
7110         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
7111                 soclose(SCTP_BASE_INFO(udp6_tun_socket));
7112                 SCTP_BASE_INFO(udp6_tun_socket) = NULL;
7113         }
7114 #endif
7115 }
7116
7117 int
7118 sctp_over_udp_start(void)
7119 {
7120         uint16_t port;
7121         int ret;
7122 #ifdef INET
7123         struct sockaddr_in sin;
7124 #endif
7125 #ifdef INET6
7126         struct sockaddr_in6 sin6;
7127 #endif
7128         /*
7129          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
7130          * for writting!
7131          */
7132         port = SCTP_BASE_SYSCTL(sctp_udp_tunneling_port);
7133         if (ntohs(port) == 0) {
7134                 /* Must have a port set */
7135                 return (EINVAL);
7136         }
7137 #ifdef INET
7138         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
7139                 /* Already running -- must stop first */
7140                 return (EALREADY);
7141         }
7142 #endif
7143 #ifdef INET6
7144         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
7145                 /* Already running -- must stop first */
7146                 return (EALREADY);
7147         }
7148 #endif
7149 #ifdef INET
7150         if ((ret = socreate(PF_INET, &SCTP_BASE_INFO(udp4_tun_socket),
7151             SOCK_DGRAM, IPPROTO_UDP,
7152             curthread->td_ucred, curthread))) {
7153                 sctp_over_udp_stop();
7154                 return (ret);
7155         }
7156         /* Call the special UDP hook. */
7157         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp4_tun_socket),
7158             sctp_recv_udp_tunneled_packet,
7159             sctp_recv_icmp_tunneled_packet,
7160             NULL))) {
7161                 sctp_over_udp_stop();
7162                 return (ret);
7163         }
7164         /* Ok, we have a socket, bind it to the port. */
7165         memset(&sin, 0, sizeof(struct sockaddr_in));
7166         sin.sin_len = sizeof(struct sockaddr_in);
7167         sin.sin_family = AF_INET;
7168         sin.sin_port = htons(port);
7169         if ((ret = sobind(SCTP_BASE_INFO(udp4_tun_socket),
7170             (struct sockaddr *)&sin, curthread))) {
7171                 sctp_over_udp_stop();
7172                 return (ret);
7173         }
7174 #endif
7175 #ifdef INET6
7176         if ((ret = socreate(PF_INET6, &SCTP_BASE_INFO(udp6_tun_socket),
7177             SOCK_DGRAM, IPPROTO_UDP,
7178             curthread->td_ucred, curthread))) {
7179                 sctp_over_udp_stop();
7180                 return (ret);
7181         }
7182         /* Call the special UDP hook. */
7183         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp6_tun_socket),
7184             sctp_recv_udp_tunneled_packet,
7185             sctp_recv_icmp6_tunneled_packet,
7186             NULL))) {
7187                 sctp_over_udp_stop();
7188                 return (ret);
7189         }
7190         /* Ok, we have a socket, bind it to the port. */
7191         memset(&sin6, 0, sizeof(struct sockaddr_in6));
7192         sin6.sin6_len = sizeof(struct sockaddr_in6);
7193         sin6.sin6_family = AF_INET6;
7194         sin6.sin6_port = htons(port);
7195         if ((ret = sobind(SCTP_BASE_INFO(udp6_tun_socket),
7196             (struct sockaddr *)&sin6, curthread))) {
7197                 sctp_over_udp_stop();
7198                 return (ret);
7199         }
7200 #endif
7201         return (0);
7202 }
7203
7204 #if defined(INET6) || defined(INET)
7205
7206 /*
7207  * sctp_min_mtu ()returns the minimum of all non-zero arguments.
7208  * If all arguments are zero, zero is returned.
7209  */
7210 uint32_t
7211 sctp_min_mtu(uint32_t mtu1, uint32_t mtu2, uint32_t mtu3)
7212 {
7213         if (mtu1 > 0) {
7214                 if (mtu2 > 0) {
7215                         if (mtu3 > 0) {
7216                                 return (min(mtu1, min(mtu2, mtu3)));
7217                         } else {
7218                                 return (min(mtu1, mtu2));
7219                         }
7220                 } else {
7221                         if (mtu3 > 0) {
7222                                 return (min(mtu1, mtu3));
7223                         } else {
7224                                 return (mtu1);
7225                         }
7226                 }
7227         } else {
7228                 if (mtu2 > 0) {
7229                         if (mtu3 > 0) {
7230                                 return (min(mtu2, mtu3));
7231                         } else {
7232                                 return (mtu2);
7233                         }
7234                 } else {
7235                         return (mtu3);
7236                 }
7237         }
7238 }
7239
7240 void
7241 sctp_hc_set_mtu(union sctp_sockstore *addr, uint16_t fibnum, uint32_t mtu)
7242 {
7243         struct in_conninfo inc;
7244
7245         memset(&inc, 0, sizeof(struct in_conninfo));
7246         inc.inc_fibnum = fibnum;
7247         switch (addr->sa.sa_family) {
7248 #ifdef INET
7249         case AF_INET:
7250                 inc.inc_faddr = addr->sin.sin_addr;
7251                 break;
7252 #endif
7253 #ifdef INET6
7254         case AF_INET6:
7255                 inc.inc_flags |= INC_ISIPV6;
7256                 inc.inc6_faddr = addr->sin6.sin6_addr;
7257                 break;
7258 #endif
7259         default:
7260                 return;
7261         }
7262         tcp_hc_updatemtu(&inc, (u_long)mtu);
7263 }
7264
7265 uint32_t
7266 sctp_hc_get_mtu(union sctp_sockstore *addr, uint16_t fibnum)
7267 {
7268         struct in_conninfo inc;
7269
7270         memset(&inc, 0, sizeof(struct in_conninfo));
7271         inc.inc_fibnum = fibnum;
7272         switch (addr->sa.sa_family) {
7273 #ifdef INET
7274         case AF_INET:
7275                 inc.inc_faddr = addr->sin.sin_addr;
7276                 break;
7277 #endif
7278 #ifdef INET6
7279         case AF_INET6:
7280                 inc.inc_flags |= INC_ISIPV6;
7281                 inc.inc6_faddr = addr->sin6.sin6_addr;
7282                 break;
7283 #endif
7284         default:
7285                 return (0);
7286         }
7287         return ((uint32_t)tcp_hc_getmtu(&inc));
7288 }
7289 #endif