sys/netinet/sctputil.c

   1 /*-
   2  * SPDX-License-Identifier: BSD-3-Clause
   3  *
   4  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
   5  * Copyright (c) 2008-2012, by Randall Stewart. All rights reserved.
   6  * Copyright (c) 2008-2012, by Michael Tuexen. All rights reserved.
   7  *
   8  * Redistribution and use in source and binary forms, with or without
   9  * modification, are permitted provided that the following conditions are met:
  10  *
  11  * a) Redistributions of source code must retain the above copyright notice,
  12  *    this list of conditions and the following disclaimer.
  13  *
  14  * b) Redistributions in binary form must reproduce the above copyright
  15  *    notice, this list of conditions and the following disclaimer in
  16  *    the documentation and/or other materials provided with the distribution.
  17  *
  18  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  19  *    contributors may be used to endorse or promote products derived
  20  *    from this software without specific prior written permission.
  21  *
  22  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  23  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  24  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  25  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  26  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  27  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  28  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  29  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  30  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  31  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  32  * THE POSSIBILITY OF SUCH DAMAGE.
  33  */
  34
  35 #include <sys/cdefs.h>
  36 __FBSDID("$FreeBSD$");
  37
  38 #include <netinet/sctp_os.h>
  39 #include <netinet/sctp_pcb.h>
  40 #include <netinet/sctputil.h>
  41 #include <netinet/sctp_var.h>
  42 #include <netinet/sctp_sysctl.h>
  43 #ifdef INET6
  44 #include <netinet6/sctp6_var.h>
  45 #endif
  46 #include <netinet/sctp_header.h>
  47 #include <netinet/sctp_output.h>
  48 #include <netinet/sctp_uio.h>
  49 #include <netinet/sctp_timer.h>
  50 #include <netinet/sctp_indata.h>
  51 #include <netinet/sctp_auth.h>
  52 #include <netinet/sctp_asconf.h>
  53 #include <netinet/sctp_bsd_addr.h>
  54 #if defined(INET6) || defined(INET)
  55 #include <netinet/tcp_var.h>
  56 #endif
  57 #include <netinet/udp.h>
  58 #include <netinet/udp_var.h>
  59 #include <sys/proc.h>
  60 #ifdef INET6
  61 #include <netinet/icmp6.h>
  62 #endif
  63
  64
  65 #ifndef KTR_SCTP
  66 #define KTR_SCTP KTR_SUBSYS
  67 #endif
  68
  69 extern const struct sctp_cc_functions sctp_cc_functions[];
  70 extern const struct sctp_ss_functions sctp_ss_functions[];
  71
  72 void
  73 sctp_sblog(struct sockbuf *sb, struct sctp_tcb *stcb, int from, int incr)
  74 {
  75 #if defined(SCTP_LOCAL_TRACE_BUF)
  76         struct sctp_cwnd_log sctp_clog;
  77
  78         sctp_clog.x.sb.stcb = stcb;
  79         sctp_clog.x.sb.so_sbcc = sb->sb_cc;
  80         if (stcb)
  81                 sctp_clog.x.sb.stcb_sbcc = stcb->asoc.sb_cc;
  82         else
  83                 sctp_clog.x.sb.stcb_sbcc = 0;
  84         sctp_clog.x.sb.incr = incr;
  85         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
  86             SCTP_LOG_EVENT_SB,
  87             from,
  88             sctp_clog.x.misc.log1,
  89             sctp_clog.x.misc.log2,
  90             sctp_clog.x.misc.log3,
  91             sctp_clog.x.misc.log4);
  92 #endif
  93 }
  94
  95 void
  96 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc)
  97 {
  98 #if defined(SCTP_LOCAL_TRACE_BUF)
  99         struct sctp_cwnd_log sctp_clog;
 100
 101         sctp_clog.x.close.inp = (void *)inp;
 102         sctp_clog.x.close.sctp_flags = inp->sctp_flags;
 103         if (stcb) {
 104                 sctp_clog.x.close.stcb = (void *)stcb;
 105                 sctp_clog.x.close.state = (uint16_t) stcb->asoc.state;
 106         } else {
 107                 sctp_clog.x.close.stcb = 0;
 108                 sctp_clog.x.close.state = 0;
 109         }
 110         sctp_clog.x.close.loc = loc;
 111         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 112             SCTP_LOG_EVENT_CLOSE,
 113             0,
 114             sctp_clog.x.misc.log1,
 115             sctp_clog.x.misc.log2,
 116             sctp_clog.x.misc.log3,
 117             sctp_clog.x.misc.log4);
 118 #endif
 119 }
 120
 121 void
 122 rto_logging(struct sctp_nets *net, int from)
 123 {
 124 #if defined(SCTP_LOCAL_TRACE_BUF)
 125         struct sctp_cwnd_log sctp_clog;
 126
 127         memset(&sctp_clog, 0, sizeof(sctp_clog));
 128         sctp_clog.x.rto.net = (void *)net;
 129         sctp_clog.x.rto.rtt = net->rtt / 1000;
 130         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 131             SCTP_LOG_EVENT_RTT,
 132             from,
 133             sctp_clog.x.misc.log1,
 134             sctp_clog.x.misc.log2,
 135             sctp_clog.x.misc.log3,
 136             sctp_clog.x.misc.log4);
 137 #endif
 138 }
 139
 140 void
 141 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from)
 142 {
 143 #if defined(SCTP_LOCAL_TRACE_BUF)
 144         struct sctp_cwnd_log sctp_clog;
 145
 146         sctp_clog.x.strlog.stcb = stcb;
 147         sctp_clog.x.strlog.n_tsn = tsn;
 148         sctp_clog.x.strlog.n_sseq = sseq;
 149         sctp_clog.x.strlog.e_tsn = 0;
 150         sctp_clog.x.strlog.e_sseq = 0;
 151         sctp_clog.x.strlog.strm = stream;
 152         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 153             SCTP_LOG_EVENT_STRM,
 154             from,
 155             sctp_clog.x.misc.log1,
 156             sctp_clog.x.misc.log2,
 157             sctp_clog.x.misc.log3,
 158             sctp_clog.x.misc.log4);
 159 #endif
 160 }
 161
 162 void
 163 sctp_log_nagle_event(struct sctp_tcb *stcb, int action)
 164 {
 165 #if defined(SCTP_LOCAL_TRACE_BUF)
 166         struct sctp_cwnd_log sctp_clog;
 167
 168         sctp_clog.x.nagle.stcb = (void *)stcb;
 169         sctp_clog.x.nagle.total_flight = stcb->asoc.total_flight;
 170         sctp_clog.x.nagle.total_in_queue = stcb->asoc.total_output_queue_size;
 171         sctp_clog.x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue;
 172         sctp_clog.x.nagle.count_in_flight = stcb->asoc.total_flight_count;
 173         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 174             SCTP_LOG_EVENT_NAGLE,
 175             action,
 176             sctp_clog.x.misc.log1,
 177             sctp_clog.x.misc.log2,
 178             sctp_clog.x.misc.log3,
 179             sctp_clog.x.misc.log4);
 180 #endif
 181 }
 182
 183 void
 184 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from)
 185 {
 186 #if defined(SCTP_LOCAL_TRACE_BUF)
 187         struct sctp_cwnd_log sctp_clog;
 188
 189         sctp_clog.x.sack.cumack = cumack;
 190         sctp_clog.x.sack.oldcumack = old_cumack;
 191         sctp_clog.x.sack.tsn = tsn;
 192         sctp_clog.x.sack.numGaps = gaps;
 193         sctp_clog.x.sack.numDups = dups;
 194         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 195             SCTP_LOG_EVENT_SACK,
 196             from,
 197             sctp_clog.x.misc.log1,
 198             sctp_clog.x.misc.log2,
 199             sctp_clog.x.misc.log3,
 200             sctp_clog.x.misc.log4);
 201 #endif
 202 }
 203
 204 void
 205 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from)
 206 {
 207 #if defined(SCTP_LOCAL_TRACE_BUF)
 208         struct sctp_cwnd_log sctp_clog;
 209
 210         memset(&sctp_clog, 0, sizeof(sctp_clog));
 211         sctp_clog.x.map.base = map;
 212         sctp_clog.x.map.cum = cum;
 213         sctp_clog.x.map.high = high;
 214         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 215             SCTP_LOG_EVENT_MAP,
 216             from,
 217             sctp_clog.x.misc.log1,
 218             sctp_clog.x.misc.log2,
 219             sctp_clog.x.misc.log3,
 220             sctp_clog.x.misc.log4);
 221 #endif
 222 }
 223
 224 void
 225 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn, int from)
 226 {
 227 #if defined(SCTP_LOCAL_TRACE_BUF)
 228         struct sctp_cwnd_log sctp_clog;
 229
 230         memset(&sctp_clog, 0, sizeof(sctp_clog));
 231         sctp_clog.x.fr.largest_tsn = biggest_tsn;
 232         sctp_clog.x.fr.largest_new_tsn = biggest_new_tsn;
 233         sctp_clog.x.fr.tsn = tsn;
 234         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 235             SCTP_LOG_EVENT_FR,
 236             from,
 237             sctp_clog.x.misc.log1,
 238             sctp_clog.x.misc.log2,
 239             sctp_clog.x.misc.log3,
 240             sctp_clog.x.misc.log4);
 241 #endif
 242 }
 243
 244 #ifdef SCTP_MBUF_LOGGING
 245 void
 246 sctp_log_mb(struct mbuf *m, int from)
 247 {
 248 #if defined(SCTP_LOCAL_TRACE_BUF)
 249         struct sctp_cwnd_log sctp_clog;
 250
 251         sctp_clog.x.mb.mp = m;
 252         sctp_clog.x.mb.mbuf_flags = (uint8_t) (SCTP_BUF_GET_FLAGS(m));
 253         sctp_clog.x.mb.size = (uint16_t) (SCTP_BUF_LEN(m));
 254         sctp_clog.x.mb.data = SCTP_BUF_AT(m, 0);
 255         if (SCTP_BUF_IS_EXTENDED(m)) {
 256                 sctp_clog.x.mb.ext = SCTP_BUF_EXTEND_BASE(m);
 257                 sctp_clog.x.mb.refcnt = (uint8_t) (SCTP_BUF_EXTEND_REFCNT(m));
 258         } else {
 259                 sctp_clog.x.mb.ext = 0;
 260                 sctp_clog.x.mb.refcnt = 0;
 261         }
 262         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 263             SCTP_LOG_EVENT_MBUF,
 264             from,
 265             sctp_clog.x.misc.log1,
 266             sctp_clog.x.misc.log2,
 267             sctp_clog.x.misc.log3,
 268             sctp_clog.x.misc.log4);
 269 #endif
 270 }
 271
 272 void
 273 sctp_log_mbc(struct mbuf *m, int from)
 274 {
 275         struct mbuf *mat;
 276
 277         for (mat = m; mat; mat = SCTP_BUF_NEXT(mat)) {
 278                 sctp_log_mb(mat, from);
 279         }
 280 }
 281 #endif
 282
 283 void
 284 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk, int from)
 285 {
 286 #if defined(SCTP_LOCAL_TRACE_BUF)
 287         struct sctp_cwnd_log sctp_clog;
 288
 289         if (control == NULL) {
 290                 SCTP_PRINTF("Gak log of NULL?\n");
 291                 return;
 292         }
 293         sctp_clog.x.strlog.stcb = control->stcb;
 294         sctp_clog.x.strlog.n_tsn = control->sinfo_tsn;
 295         sctp_clog.x.strlog.n_sseq = (uint16_t) control->mid;
 296         sctp_clog.x.strlog.strm = control->sinfo_stream;
 297         if (poschk != NULL) {
 298                 sctp_clog.x.strlog.e_tsn = poschk->sinfo_tsn;
 299                 sctp_clog.x.strlog.e_sseq = (uint16_t) poschk->mid;
 300         } else {
 301                 sctp_clog.x.strlog.e_tsn = 0;
 302                 sctp_clog.x.strlog.e_sseq = 0;
 303         }
 304         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 305             SCTP_LOG_EVENT_STRM,
 306             from,
 307             sctp_clog.x.misc.log1,
 308             sctp_clog.x.misc.log2,
 309             sctp_clog.x.misc.log3,
 310             sctp_clog.x.misc.log4);
 311 #endif
 312 }
 313
 314 void
 315 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from)
 316 {
 317 #if defined(SCTP_LOCAL_TRACE_BUF)
 318         struct sctp_cwnd_log sctp_clog;
 319
 320         sctp_clog.x.cwnd.net = net;
 321         if (stcb->asoc.send_queue_cnt > 255)
 322                 sctp_clog.x.cwnd.cnt_in_send = 255;
 323         else
 324                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 325         if (stcb->asoc.stream_queue_cnt > 255)
 326                 sctp_clog.x.cwnd.cnt_in_str = 255;
 327         else
 328                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 329
 330         if (net) {
 331                 sctp_clog.x.cwnd.cwnd_new_value = net->cwnd;
 332                 sctp_clog.x.cwnd.inflight = net->flight_size;
 333                 sctp_clog.x.cwnd.pseudo_cumack = net->pseudo_cumack;
 334                 sctp_clog.x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack;
 335                 sctp_clog.x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack;
 336         }
 337         if (SCTP_CWNDLOG_PRESEND == from) {
 338                 sctp_clog.x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd;
 339         }
 340         sctp_clog.x.cwnd.cwnd_augment = augment;
 341         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 342             SCTP_LOG_EVENT_CWND,
 343             from,
 344             sctp_clog.x.misc.log1,
 345             sctp_clog.x.misc.log2,
 346             sctp_clog.x.misc.log3,
 347             sctp_clog.x.misc.log4);
 348 #endif
 349 }
 350
 351 void
 352 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from)
 353 {
 354 #if defined(SCTP_LOCAL_TRACE_BUF)
 355         struct sctp_cwnd_log sctp_clog;
 356
 357         memset(&sctp_clog, 0, sizeof(sctp_clog));
 358         if (inp) {
 359                 sctp_clog.x.lock.sock = (void *)inp->sctp_socket;
 360
 361         } else {
 362                 sctp_clog.x.lock.sock = (void *)NULL;
 363         }
 364         sctp_clog.x.lock.inp = (void *)inp;
 365         if (stcb) {
 366                 sctp_clog.x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx);
 367         } else {
 368                 sctp_clog.x.lock.tcb_lock = SCTP_LOCK_UNKNOWN;
 369         }
 370         if (inp) {
 371                 sctp_clog.x.lock.inp_lock = mtx_owned(&inp->inp_mtx);
 372                 sctp_clog.x.lock.create_lock = mtx_owned(&inp->inp_create_mtx);
 373         } else {
 374                 sctp_clog.x.lock.inp_lock = SCTP_LOCK_UNKNOWN;
 375                 sctp_clog.x.lock.create_lock = SCTP_LOCK_UNKNOWN;
 376         }
 377         sctp_clog.x.lock.info_lock = rw_wowned(&SCTP_BASE_INFO(ipi_ep_mtx));
 378         if (inp && (inp->sctp_socket)) {
 379                 sctp_clog.x.lock.sock_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 380                 sctp_clog.x.lock.sockrcvbuf_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 381                 sctp_clog.x.lock.socksndbuf_lock = mtx_owned(&(inp->sctp_socket->so_snd.sb_mtx));
 382         } else {
 383                 sctp_clog.x.lock.sock_lock = SCTP_LOCK_UNKNOWN;
 384                 sctp_clog.x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN;
 385                 sctp_clog.x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN;
 386         }
 387         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 388             SCTP_LOG_LOCK_EVENT,
 389             from,
 390             sctp_clog.x.misc.log1,
 391             sctp_clog.x.misc.log2,
 392             sctp_clog.x.misc.log3,
 393             sctp_clog.x.misc.log4);
 394 #endif
 395 }
 396
 397 void
 398 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from)
 399 {
 400 #if defined(SCTP_LOCAL_TRACE_BUF)
 401         struct sctp_cwnd_log sctp_clog;
 402
 403         memset(&sctp_clog, 0, sizeof(sctp_clog));
 404         sctp_clog.x.cwnd.net = net;
 405         sctp_clog.x.cwnd.cwnd_new_value = error;
 406         sctp_clog.x.cwnd.inflight = net->flight_size;
 407         sctp_clog.x.cwnd.cwnd_augment = burst;
 408         if (stcb->asoc.send_queue_cnt > 255)
 409                 sctp_clog.x.cwnd.cnt_in_send = 255;
 410         else
 411                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 412         if (stcb->asoc.stream_queue_cnt > 255)
 413                 sctp_clog.x.cwnd.cnt_in_str = 255;
 414         else
 415                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 416         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 417             SCTP_LOG_EVENT_MAXBURST,
 418             from,
 419             sctp_clog.x.misc.log1,
 420             sctp_clog.x.misc.log2,
 421             sctp_clog.x.misc.log3,
 422             sctp_clog.x.misc.log4);
 423 #endif
 424 }
 425
 426 void
 427 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead)
 428 {
 429 #if defined(SCTP_LOCAL_TRACE_BUF)
 430         struct sctp_cwnd_log sctp_clog;
 431
 432         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 433         sctp_clog.x.rwnd.send_size = snd_size;
 434         sctp_clog.x.rwnd.overhead = overhead;
 435         sctp_clog.x.rwnd.new_rwnd = 0;
 436         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 437             SCTP_LOG_EVENT_RWND,
 438             from,
 439             sctp_clog.x.misc.log1,
 440             sctp_clog.x.misc.log2,
 441             sctp_clog.x.misc.log3,
 442             sctp_clog.x.misc.log4);
 443 #endif
 444 }
 445
 446 void
 447 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval)
 448 {
 449 #if defined(SCTP_LOCAL_TRACE_BUF)
 450         struct sctp_cwnd_log sctp_clog;
 451
 452         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 453         sctp_clog.x.rwnd.send_size = flight_size;
 454         sctp_clog.x.rwnd.overhead = overhead;
 455         sctp_clog.x.rwnd.new_rwnd = a_rwndval;
 456         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 457             SCTP_LOG_EVENT_RWND,
 458             from,
 459             sctp_clog.x.misc.log1,
 460             sctp_clog.x.misc.log2,
 461             sctp_clog.x.misc.log3,
 462             sctp_clog.x.misc.log4);
 463 #endif
 464 }
 465
 466 #ifdef SCTP_MBCNT_LOGGING
 467 static void
 468 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt)
 469 {
 470 #if defined(SCTP_LOCAL_TRACE_BUF)
 471         struct sctp_cwnd_log sctp_clog;
 472
 473         sctp_clog.x.mbcnt.total_queue_size = total_oq;
 474         sctp_clog.x.mbcnt.size_change = book;
 475         sctp_clog.x.mbcnt.total_queue_mb_size = total_mbcnt_q;
 476         sctp_clog.x.mbcnt.mbcnt_change = mbcnt;
 477         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 478             SCTP_LOG_EVENT_MBCNT,
 479             from,
 480             sctp_clog.x.misc.log1,
 481             sctp_clog.x.misc.log2,
 482             sctp_clog.x.misc.log3,
 483             sctp_clog.x.misc.log4);
 484 #endif
 485 }
 486 #endif
 487
 488 void
 489 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d)
 490 {
 491 #if defined(SCTP_LOCAL_TRACE_BUF)
 492         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 493             SCTP_LOG_MISC_EVENT,
 494             from,
 495             a, b, c, d);
 496 #endif
 497 }
 498
 499 void
 500 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t wake_cnt, int from)
 501 {
 502 #if defined(SCTP_LOCAL_TRACE_BUF)
 503         struct sctp_cwnd_log sctp_clog;
 504
 505         sctp_clog.x.wake.stcb = (void *)stcb;
 506         sctp_clog.x.wake.wake_cnt = wake_cnt;
 507         sctp_clog.x.wake.flight = stcb->asoc.total_flight_count;
 508         sctp_clog.x.wake.send_q = stcb->asoc.send_queue_cnt;
 509         sctp_clog.x.wake.sent_q = stcb->asoc.sent_queue_cnt;
 510
 511         if (stcb->asoc.stream_queue_cnt < 0xff)
 512                 sctp_clog.x.wake.stream_qcnt = (uint8_t) stcb->asoc.stream_queue_cnt;
 513         else
 514                 sctp_clog.x.wake.stream_qcnt = 0xff;
 515
 516         if (stcb->asoc.chunks_on_out_queue < 0xff)
 517                 sctp_clog.x.wake.chunks_on_oque = (uint8_t) stcb->asoc.chunks_on_out_queue;
 518         else
 519                 sctp_clog.x.wake.chunks_on_oque = 0xff;
 520
 521         sctp_clog.x.wake.sctpflags = 0;
 522         /* set in the defered mode stuff */
 523         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE)
 524                 sctp_clog.x.wake.sctpflags |= 1;
 525         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT)
 526                 sctp_clog.x.wake.sctpflags |= 2;
 527         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT)
 528                 sctp_clog.x.wake.sctpflags |= 4;
 529         /* what about the sb */
 530         if (stcb->sctp_socket) {
 531                 struct socket *so = stcb->sctp_socket;
 532
 533                 sctp_clog.x.wake.sbflags = (uint8_t) ((so->so_snd.sb_flags & 0x00ff));
 534         } else {
 535                 sctp_clog.x.wake.sbflags = 0xff;
 536         }
 537         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 538             SCTP_LOG_EVENT_WAKE,
 539             from,
 540             sctp_clog.x.misc.log1,
 541             sctp_clog.x.misc.log2,
 542             sctp_clog.x.misc.log3,
 543             sctp_clog.x.misc.log4);
 544 #endif
 545 }
 546
 547 void
 548 sctp_log_block(uint8_t from, struct sctp_association *asoc, size_t sendlen)
 549 {
 550 #if defined(SCTP_LOCAL_TRACE_BUF)
 551         struct sctp_cwnd_log sctp_clog;
 552
 553         sctp_clog.x.blk.onsb = asoc->total_output_queue_size;
 554         sctp_clog.x.blk.send_sent_qcnt = (uint16_t) (asoc->send_queue_cnt + asoc->sent_queue_cnt);
 555         sctp_clog.x.blk.peer_rwnd = asoc->peers_rwnd;
 556         sctp_clog.x.blk.stream_qcnt = (uint16_t) asoc->stream_queue_cnt;
 557         sctp_clog.x.blk.chunks_on_oque = (uint16_t) asoc->chunks_on_out_queue;
 558         sctp_clog.x.blk.flight_size = (uint16_t) (asoc->total_flight / 1024);
 559         sctp_clog.x.blk.sndlen = (uint32_t) sendlen;
 560         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 561             SCTP_LOG_EVENT_BLOCK,
 562             from,
 563             sctp_clog.x.misc.log1,
 564             sctp_clog.x.misc.log2,
 565             sctp_clog.x.misc.log3,
 566             sctp_clog.x.misc.log4);
 567 #endif
 568 }
 569
 570 int
 571 sctp_fill_stat_log(void *optval SCTP_UNUSED, size_t *optsize SCTP_UNUSED)
 572 {
 573         /* May need to fix this if ktrdump does not work */
 574         return (0);
 575 }
 576
 577 #ifdef SCTP_AUDITING_ENABLED
 578 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2];
 579 static int sctp_audit_indx = 0;
 580
 581 static
 582 void
 583 sctp_print_audit_report(void)
 584 {
 585         int i;
 586         int cnt;
 587
 588         cnt = 0;
 589         for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) {
 590                 if ((sctp_audit_data[i][0] == 0xe0) &&
 591                     (sctp_audit_data[i][1] == 0x01)) {
 592                         cnt = 0;
 593                         SCTP_PRINTF("\n");
 594                 } else if (sctp_audit_data[i][0] == 0xf0) {
 595                         cnt = 0;
 596                         SCTP_PRINTF("\n");
 597                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 598                     (sctp_audit_data[i][1] == 0x01)) {
 599                         SCTP_PRINTF("\n");
 600                         cnt = 0;
 601                 }
 602                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0],
 603                     (uint32_t) sctp_audit_data[i][1]);
 604                 cnt++;
 605                 if ((cnt % 14) == 0)
 606                         SCTP_PRINTF("\n");
 607         }
 608         for (i = 0; i < sctp_audit_indx; i++) {
 609                 if ((sctp_audit_data[i][0] == 0xe0) &&
 610                     (sctp_audit_data[i][1] == 0x01)) {
 611                         cnt = 0;
 612                         SCTP_PRINTF("\n");
 613                 } else if (sctp_audit_data[i][0] == 0xf0) {
 614                         cnt = 0;
 615                         SCTP_PRINTF("\n");
 616                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 617                     (sctp_audit_data[i][1] == 0x01)) {
 618                         SCTP_PRINTF("\n");
 619                         cnt = 0;
 620                 }
 621                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0],
 622                     (uint32_t) sctp_audit_data[i][1]);
 623                 cnt++;
 624                 if ((cnt % 14) == 0)
 625                         SCTP_PRINTF("\n");
 626         }
 627         SCTP_PRINTF("\n");
 628 }
 629
 630 void
 631 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 632     struct sctp_nets *net)
 633 {
 634         int resend_cnt, tot_out, rep, tot_book_cnt;
 635         struct sctp_nets *lnet;
 636         struct sctp_tmit_chunk *chk;
 637
 638         sctp_audit_data[sctp_audit_indx][0] = 0xAA;
 639         sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from;
 640         sctp_audit_indx++;
 641         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 642                 sctp_audit_indx = 0;
 643         }
 644         if (inp == NULL) {
 645                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 646                 sctp_audit_data[sctp_audit_indx][1] = 0x01;
 647                 sctp_audit_indx++;
 648                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 649                         sctp_audit_indx = 0;
 650                 }
 651                 return;
 652         }
 653         if (stcb == NULL) {
 654                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 655                 sctp_audit_data[sctp_audit_indx][1] = 0x02;
 656                 sctp_audit_indx++;
 657                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 658                         sctp_audit_indx = 0;
 659                 }
 660                 return;
 661         }
 662         sctp_audit_data[sctp_audit_indx][0] = 0xA1;
 663         sctp_audit_data[sctp_audit_indx][1] =
 664             (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 665         sctp_audit_indx++;
 666         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 667                 sctp_audit_indx = 0;
 668         }
 669         rep = 0;
 670         tot_book_cnt = 0;
 671         resend_cnt = tot_out = 0;
 672         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 673                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 674                         resend_cnt++;
 675                 } else if (chk->sent < SCTP_DATAGRAM_RESEND) {
 676                         tot_out += chk->book_size;
 677                         tot_book_cnt++;
 678                 }
 679         }
 680         if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) {
 681                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 682                 sctp_audit_data[sctp_audit_indx][1] = 0xA1;
 683                 sctp_audit_indx++;
 684                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 685                         sctp_audit_indx = 0;
 686                 }
 687                 SCTP_PRINTF("resend_cnt:%d asoc-tot:%d\n",
 688                     resend_cnt, stcb->asoc.sent_queue_retran_cnt);
 689                 rep = 1;
 690                 stcb->asoc.sent_queue_retran_cnt = resend_cnt;
 691                 sctp_audit_data[sctp_audit_indx][0] = 0xA2;
 692                 sctp_audit_data[sctp_audit_indx][1] =
 693                     (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 694                 sctp_audit_indx++;
 695                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 696                         sctp_audit_indx = 0;
 697                 }
 698         }
 699         if (tot_out != stcb->asoc.total_flight) {
 700                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 701                 sctp_audit_data[sctp_audit_indx][1] = 0xA2;
 702                 sctp_audit_indx++;
 703                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 704                         sctp_audit_indx = 0;
 705                 }
 706                 rep = 1;
 707                 SCTP_PRINTF("tot_flt:%d asoc_tot:%d\n", tot_out,
 708                     (int)stcb->asoc.total_flight);
 709                 stcb->asoc.total_flight = tot_out;
 710         }
 711         if (tot_book_cnt != stcb->asoc.total_flight_count) {
 712                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 713                 sctp_audit_data[sctp_audit_indx][1] = 0xA5;
 714                 sctp_audit_indx++;
 715                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 716                         sctp_audit_indx = 0;
 717                 }
 718                 rep = 1;
 719                 SCTP_PRINTF("tot_flt_book:%d\n", tot_book_cnt);
 720
 721                 stcb->asoc.total_flight_count = tot_book_cnt;
 722         }
 723         tot_out = 0;
 724         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 725                 tot_out += lnet->flight_size;
 726         }
 727         if (tot_out != stcb->asoc.total_flight) {
 728                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 729                 sctp_audit_data[sctp_audit_indx][1] = 0xA3;
 730                 sctp_audit_indx++;
 731                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 732                         sctp_audit_indx = 0;
 733                 }
 734                 rep = 1;
 735                 SCTP_PRINTF("real flight:%d net total was %d\n",
 736                     stcb->asoc.total_flight, tot_out);
 737                 /* now corrective action */
 738                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 739
 740                         tot_out = 0;
 741                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 742                                 if ((chk->whoTo == lnet) &&
 743                                     (chk->sent < SCTP_DATAGRAM_RESEND)) {
 744                                         tot_out += chk->book_size;
 745                                 }
 746                         }
 747                         if (lnet->flight_size != tot_out) {
 748                                 SCTP_PRINTF("net:%p flight was %d corrected to %d\n",
 749                                     (void *)lnet, lnet->flight_size,
 750                                     tot_out);
 751                                 lnet->flight_size = tot_out;
 752                         }
 753                 }
 754         }
 755         if (rep) {
 756                 sctp_print_audit_report();
 757         }
 758 }
 759
 760 void
 761 sctp_audit_log(uint8_t ev, uint8_t fd)
 762 {
 763
 764         sctp_audit_data[sctp_audit_indx][0] = ev;
 765         sctp_audit_data[sctp_audit_indx][1] = fd;
 766         sctp_audit_indx++;
 767         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 768                 sctp_audit_indx = 0;
 769         }
 770 }
 771
 772 #endif
 773
 774 /*
 775  * sctp_stop_timers_for_shutdown() should be called
 776  * when entering the SHUTDOWN_SENT or SHUTDOWN_ACK_SENT
 777  * state to make sure that all timers are stopped.
 778  */
 779 void
 780 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb)
 781 {
 782         struct sctp_association *asoc;
 783         struct sctp_nets *net;
 784
 785         asoc = &stcb->asoc;
 786
 787         (void)SCTP_OS_TIMER_STOP(&asoc->dack_timer.timer);
 788         (void)SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
 789         (void)SCTP_OS_TIMER_STOP(&asoc->asconf_timer.timer);
 790         (void)SCTP_OS_TIMER_STOP(&asoc->autoclose_timer.timer);
 791         (void)SCTP_OS_TIMER_STOP(&asoc->delayed_event_timer.timer);
 792         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
 793                 (void)SCTP_OS_TIMER_STOP(&net->pmtu_timer.timer);
 794                 (void)SCTP_OS_TIMER_STOP(&net->hb_timer.timer);
 795         }
 796 }
 797
 798 /*
 799  * A list of sizes based on typical mtu's, used only if next hop size not
 800  * returned. These values MUST be multiples of 4 and MUST be ordered.
 801  */
 802 static uint32_t sctp_mtu_sizes[] = {
 803         68,
 804             296,
 805             508,
 806             512,
 807             544,
 808             576,
 809             1004,
 810             1492,
 811             1500,
 812             1536,
 813             2000,
 814             2048,
 815             4352,
 816             4464,
 817             8166,
 818             17912,
 819             32000,
 820             65532
 821 };
 822
 823 /*
 824  * Return the largest MTU in sctp_mtu_sizes smaller than val.
 825  * If val is smaller than the minimum, just return the largest
 826  * multiple of 4 smaller or equal to val.
 827  * Ensure that the result is a multiple of 4.
 828  */
 829 uint32_t
 830 sctp_get_prev_mtu(uint32_t val) {
 831         uint32_t i;
 832
 833         val &= 0xfffffffc;
 834         if (val <= sctp_mtu_sizes[0]) {
 835                 return (val);
 836         }
 837         for (i = 1; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 838                 if (val <= sctp_mtu_sizes[i]) {
 839                         break;
 840                 }
 841         }
 842         KASSERT((sctp_mtu_sizes[i - 1] & 0x00000003) == 0,
 843             ("sctp_mtu_sizes[%u] not a multiple of 4", i - 1));
 844         return (sctp_mtu_sizes[i - 1]);
 845 }
 846
 847 /*
 848  * Return the smallest MTU in sctp_mtu_sizes larger than val.
 849  * If val is larger than the maximum, just return the largest multiple of 4 smaller
 850  * or equal to val.
 851  * Ensure that the result is a multiple of 4.
 852  */
 853 uint32_t
 854 sctp_get_next_mtu(uint32_t val) {
 855         /* select another MTU that is just bigger than this one */
 856         uint32_t i;
 857
 858         val &= 0xfffffffc;
 859         for (i = 0; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 860                 if (val < sctp_mtu_sizes[i]) {
 861                         KASSERT((sctp_mtu_sizes[i] & 0x00000003) == 0,
 862                             ("sctp_mtu_sizes[%u] not a multiple of 4", i));
 863                         return (sctp_mtu_sizes[i]);
 864                 }
 865         }
 866         return (val);
 867 }
 868
 869 void
 870 sctp_fill_random_store(struct sctp_pcb *m)
 871 {
 872         /*
 873          * Here we use the MD5/SHA-1 to hash with our good randomNumbers and
 874          * our counter. The result becomes our good random numbers and we
 875          * then setup to give these out. Note that we do no locking to
 876          * protect this. This is ok, since if competing folks call this we
 877          * will get more gobbled gook in the random store which is what we
 878          * want. There is a danger that two guys will use the same random
 879          * numbers, but thats ok too since that is random as well :->
 880          */
 881         m->store_at = 0;
 882         (void)sctp_hmac(SCTP_HMAC, (uint8_t *) m->random_numbers,
 883             sizeof(m->random_numbers), (uint8_t *) & m->random_counter,
 884             sizeof(m->random_counter), (uint8_t *) m->random_store);
 885         m->random_counter++;
 886 }
 887
 888 uint32_t
 889 sctp_select_initial_TSN(struct sctp_pcb *inp){
 890         /*
 891          * A true implementation should use random selection process to get
 892          * the initial stream sequence number, using RFC1750 as a good
 893          * guideline
 894          */
 895         uint32_t x, *xp;
 896         uint8_t *p;
 897         int store_at, new_store;
 898
 899         if (inp->initial_sequence_debug != 0) {
 900                 uint32_t ret;
 901
 902                 ret = inp->initial_sequence_debug;
 903                 inp->initial_sequence_debug++;
 904                 return (ret);
 905         }
 906 retry:
 907         store_at = inp->store_at;
 908         new_store = store_at + sizeof(uint32_t);
 909         if (new_store >= (SCTP_SIGNATURE_SIZE - 3)) {
 910                 new_store = 0;
 911         }
 912         if (!atomic_cmpset_int(&inp->store_at, store_at, new_store)) {
 913                 goto retry;
 914         }
 915         if (new_store == 0) {
 916                 /* Refill the random store */
 917                 sctp_fill_random_store(inp);
 918         }
 919         p = &inp->random_store[store_at];
 920         xp = (uint32_t *) p;
 921         x = *xp;
 922         return (x);
 923 }
 924
 925 uint32_t
 926 sctp_select_a_tag(struct sctp_inpcb *inp, uint16_t lport, uint16_t rport, int check){
 927         uint32_t x;
 928         struct timeval now;
 929
 930         if (check) {
 931                 (void)SCTP_GETTIME_TIMEVAL(&now);
 932         }
 933         for (;;) {
 934                 x = sctp_select_initial_TSN(&inp->sctp_ep);
 935                 if (x == 0) {
 936                         /* we never use 0 */
 937                         continue;
 938                 }
 939                 if (!check || sctp_is_vtag_good(x, lport, rport, &now)) {
 940                         break;
 941                 }
 942         }
 943         return (x);
 944 }
 945
 946 int32_t
 947 sctp_map_assoc_state(int kernel_state){
 948         int32_t user_state;
 949
 950         if (kernel_state & SCTP_STATE_WAS_ABORTED) {
 951                 user_state = SCTP_CLOSED;
 952         } else if (kernel_state & SCTP_STATE_SHUTDOWN_PENDING) {
 953                 user_state = SCTP_SHUTDOWN_PENDING;
 954         } else {
 955                 switch (kernel_state & SCTP_STATE_MASK) {
 956                 case SCTP_STATE_EMPTY:
 957                         user_state = SCTP_CLOSED;
 958                         break;
 959                 case SCTP_STATE_INUSE:
 960                         user_state = SCTP_CLOSED;
 961                         break;
 962                 case SCTP_STATE_COOKIE_WAIT:
 963                         user_state = SCTP_COOKIE_WAIT;
 964                         break;
 965                 case SCTP_STATE_COOKIE_ECHOED:
 966                         user_state = SCTP_COOKIE_ECHOED;
 967                         break;
 968                 case SCTP_STATE_OPEN:
 969                         user_state = SCTP_ESTABLISHED;
 970                         break;
 971                 case SCTP_STATE_SHUTDOWN_SENT:
 972                         user_state = SCTP_SHUTDOWN_SENT;
 973                         break;
 974                 case SCTP_STATE_SHUTDOWN_RECEIVED:
 975                         user_state = SCTP_SHUTDOWN_RECEIVED;
 976                         break;
 977                 case SCTP_STATE_SHUTDOWN_ACK_SENT:
 978                         user_state = SCTP_SHUTDOWN_ACK_SENT;
 979                         break;
 980                 default:
 981                         user_state = SCTP_CLOSED;
 982                         break;
 983                 }
 984         }
 985         return (user_state);
 986 }
 987
 988 int
 989 sctp_init_asoc(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 990     uint32_t override_tag, uint32_t vrf_id, uint16_t o_strms)
 991 {
 992         struct sctp_association *asoc;
 993
 994         /*
 995          * Anything set to zero is taken care of by the allocation routine's
 996          * bzero
 997          */
 998
 999         /*
1000          * Up front select what scoping to apply on addresses I tell my peer
1001          * Not sure what to do with these right now, we will need to come up
1002          * with a way to set them. We may need to pass them through from the
1003          * caller in the sctp_aloc_assoc() function.
1004          */
1005         int i;
1006 #if defined(SCTP_DETAILED_STR_STATS)
1007         int j;
1008 #endif
1009
1010         asoc = &stcb->asoc;
1011         /* init all variables to a known value. */
1012         SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_INUSE);
1013         asoc->max_burst = inp->sctp_ep.max_burst;
1014         asoc->fr_max_burst = inp->sctp_ep.fr_max_burst;
1015         asoc->heart_beat_delay = TICKS_TO_MSEC(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]);
1016         asoc->cookie_life = inp->sctp_ep.def_cookie_life;
1017         asoc->sctp_cmt_on_off = inp->sctp_cmt_on_off;
1018         asoc->ecn_supported = inp->ecn_supported;
1019         asoc->prsctp_supported = inp->prsctp_supported;
1020         asoc->idata_supported = inp->idata_supported;
1021         asoc->auth_supported = inp->auth_supported;
1022         asoc->asconf_supported = inp->asconf_supported;
1023         asoc->reconfig_supported = inp->reconfig_supported;
1024         asoc->nrsack_supported = inp->nrsack_supported;
1025         asoc->pktdrop_supported = inp->pktdrop_supported;
1026         asoc->idata_supported = inp->idata_supported;
1027         asoc->sctp_cmt_pf = (uint8_t) 0;
1028         asoc->sctp_frag_point = inp->sctp_frag_point;
1029         asoc->sctp_features = inp->sctp_features;
1030         asoc->default_dscp = inp->sctp_ep.default_dscp;
1031         asoc->max_cwnd = inp->max_cwnd;
1032 #ifdef INET6
1033         if (inp->sctp_ep.default_flowlabel) {
1034                 asoc->default_flowlabel = inp->sctp_ep.default_flowlabel;
1035         } else {
1036                 if (inp->ip_inp.inp.inp_flags & IN6P_AUTOFLOWLABEL) {
1037                         asoc->default_flowlabel = sctp_select_initial_TSN(&inp->sctp_ep);
1038                         asoc->default_flowlabel &= 0x000fffff;
1039                         asoc->default_flowlabel |= 0x80000000;
1040                 } else {
1041                         asoc->default_flowlabel = 0;
1042                 }
1043         }
1044 #endif
1045         asoc->sb_send_resv = 0;
1046         if (override_tag) {
1047                 asoc->my_vtag = override_tag;
1048         } else {
1049                 asoc->my_vtag = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
1050         }
1051         /* Get the nonce tags */
1052         asoc->my_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
1053         asoc->peer_vtag_nonce = sctp_select_a_tag(inp, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
1054         asoc->vrf_id = vrf_id;
1055
1056 #ifdef SCTP_ASOCLOG_OF_TSNS
1057         asoc->tsn_in_at = 0;
1058         asoc->tsn_out_at = 0;
1059         asoc->tsn_in_wrapped = 0;
1060         asoc->tsn_out_wrapped = 0;
1061         asoc->cumack_log_at = 0;
1062         asoc->cumack_log_atsnt = 0;
1063 #endif
1064 #ifdef SCTP_FS_SPEC_LOG
1065         asoc->fs_index = 0;
1066 #endif
1067         asoc->refcnt = 0;
1068         asoc->assoc_up_sent = 0;
1069         asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number = asoc->sending_seq =
1070             sctp_select_initial_TSN(&inp->sctp_ep);
1071         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
1072         /* we are optimisitic here */
1073         asoc->peer_supports_nat = 0;
1074         asoc->sent_queue_retran_cnt = 0;
1075
1076         /* for CMT */
1077         asoc->last_net_cmt_send_started = NULL;
1078
1079         /* This will need to be adjusted */
1080         asoc->last_acked_seq = asoc->init_seq_number - 1;
1081         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1082         asoc->asconf_seq_in = asoc->last_acked_seq;
1083
1084         /* here we are different, we hold the next one we expect */
1085         asoc->str_reset_seq_in = asoc->last_acked_seq + 1;
1086
1087         asoc->initial_init_rto_max = inp->sctp_ep.initial_init_rto_max;
1088         asoc->initial_rto = inp->sctp_ep.initial_rto;
1089
1090         asoc->default_mtu = inp->sctp_ep.default_mtu;
1091         asoc->max_init_times = inp->sctp_ep.max_init_times;
1092         asoc->max_send_times = inp->sctp_ep.max_send_times;
1093         asoc->def_net_failure = inp->sctp_ep.def_net_failure;
1094         asoc->def_net_pf_threshold = inp->sctp_ep.def_net_pf_threshold;
1095         asoc->free_chunk_cnt = 0;
1096
1097         asoc->iam_blocking = 0;
1098         asoc->context = inp->sctp_context;
1099         asoc->local_strreset_support = inp->local_strreset_support;
1100         asoc->def_send = inp->def_send;
1101         asoc->delayed_ack = TICKS_TO_MSEC(inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]);
1102         asoc->sack_freq = inp->sctp_ep.sctp_sack_freq;
1103         asoc->pr_sctp_cnt = 0;
1104         asoc->total_output_queue_size = 0;
1105
1106         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1107                 asoc->scope.ipv6_addr_legal = 1;
1108                 if (SCTP_IPV6_V6ONLY(inp) == 0) {
1109                         asoc->scope.ipv4_addr_legal = 1;
1110                 } else {
1111                         asoc->scope.ipv4_addr_legal = 0;
1112                 }
1113         } else {
1114                 asoc->scope.ipv6_addr_legal = 0;
1115                 asoc->scope.ipv4_addr_legal = 1;
1116         }
1117
1118         asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(inp->sctp_socket), SCTP_MINIMAL_RWND);
1119         asoc->peers_rwnd = SCTP_SB_LIMIT_RCV(inp->sctp_socket);
1120
1121         asoc->smallest_mtu = inp->sctp_frag_point;
1122         asoc->minrto = inp->sctp_ep.sctp_minrto;
1123         asoc->maxrto = inp->sctp_ep.sctp_maxrto;
1124
1125         asoc->stream_locked_on = 0;
1126         asoc->ecn_echo_cnt_onq = 0;
1127         asoc->stream_locked = 0;
1128
1129         asoc->send_sack = 1;
1130
1131         LIST_INIT(&asoc->sctp_restricted_addrs);
1132
1133         TAILQ_INIT(&asoc->nets);
1134         TAILQ_INIT(&asoc->pending_reply_queue);
1135         TAILQ_INIT(&asoc->asconf_ack_sent);
1136         /* Setup to fill the hb random cache at first HB */
1137         asoc->hb_random_idx = 4;
1138
1139         asoc->sctp_autoclose_ticks = inp->sctp_ep.auto_close_time;
1140
1141         stcb->asoc.congestion_control_module = inp->sctp_ep.sctp_default_cc_module;
1142         stcb->asoc.cc_functions = sctp_cc_functions[inp->sctp_ep.sctp_default_cc_module];
1143
1144         stcb->asoc.stream_scheduling_module = inp->sctp_ep.sctp_default_ss_module;
1145         stcb->asoc.ss_functions = sctp_ss_functions[inp->sctp_ep.sctp_default_ss_module];
1146
1147         /*
1148          * Now the stream parameters, here we allocate space for all streams
1149          * that we request by default.
1150          */
1151         asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams =
1152             o_strms;
1153         SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *,
1154             asoc->streamoutcnt * sizeof(struct sctp_stream_out),
1155             SCTP_M_STRMO);
1156         if (asoc->strmout == NULL) {
1157                 /* big trouble no memory */
1158                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1159                 return (ENOMEM);
1160         }
1161         for (i = 0; i < asoc->streamoutcnt; i++) {
1162                 /*
1163                  * inbound side must be set to 0xffff, also NOTE when we get
1164                  * the INIT-ACK back (for INIT sender) we MUST reduce the
1165                  * count (streamoutcnt) but first check if we sent to any of
1166                  * the upper streams that were dropped (if some were). Those
1167                  * that were dropped must be notified to the upper layer as
1168                  * failed to send.
1169                  */
1170                 asoc->strmout[i].next_mid_ordered = 0;
1171                 asoc->strmout[i].next_mid_unordered = 0;
1172                 TAILQ_INIT(&asoc->strmout[i].outqueue);
1173                 asoc->strmout[i].chunks_on_queues = 0;
1174 #if defined(SCTP_DETAILED_STR_STATS)
1175                 for (j = 0; j < SCTP_PR_SCTP_MAX + 1; j++) {
1176                         asoc->strmout[i].abandoned_sent[j] = 0;
1177                         asoc->strmout[i].abandoned_unsent[j] = 0;
1178                 }
1179 #else
1180                 asoc->strmout[i].abandoned_sent[0] = 0;
1181                 asoc->strmout[i].abandoned_unsent[0] = 0;
1182 #endif
1183                 asoc->strmout[i].sid = i;
1184                 asoc->strmout[i].last_msg_incomplete = 0;
1185                 asoc->strmout[i].state = SCTP_STREAM_OPENING;
1186                 asoc->ss_functions.sctp_ss_init_stream(stcb, &asoc->strmout[i], NULL);
1187         }
1188         asoc->ss_functions.sctp_ss_init(stcb, asoc, 0);
1189
1190         /* Now the mapping array */
1191         asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY;
1192         SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size,
1193             SCTP_M_MAP);
1194         if (asoc->mapping_array == NULL) {
1195                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1196                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1197                 return (ENOMEM);
1198         }
1199         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
1200         SCTP_MALLOC(asoc->nr_mapping_array, uint8_t *, asoc->mapping_array_size,
1201             SCTP_M_MAP);
1202         if (asoc->nr_mapping_array == NULL) {
1203                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1204                 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1205                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1206                 return (ENOMEM);
1207         }
1208         memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
1209
1210         /* Now the init of the other outqueues */
1211         TAILQ_INIT(&asoc->free_chunks);
1212         TAILQ_INIT(&asoc->control_send_queue);
1213         TAILQ_INIT(&asoc->asconf_send_queue);
1214         TAILQ_INIT(&asoc->send_queue);
1215         TAILQ_INIT(&asoc->sent_queue);
1216         TAILQ_INIT(&asoc->resetHead);
1217         asoc->max_inbound_streams = inp->sctp_ep.max_open_streams_intome;
1218         TAILQ_INIT(&asoc->asconf_queue);
1219         /* authentication fields */
1220         asoc->authinfo.random = NULL;
1221         asoc->authinfo.active_keyid = 0;
1222         asoc->authinfo.assoc_key = NULL;
1223         asoc->authinfo.assoc_keyid = 0;
1224         asoc->authinfo.recv_key = NULL;
1225         asoc->authinfo.recv_keyid = 0;
1226         LIST_INIT(&asoc->shared_keys);
1227         asoc->marked_retrans = 0;
1228         asoc->port = inp->sctp_ep.port;
1229         asoc->timoinit = 0;
1230         asoc->timodata = 0;
1231         asoc->timosack = 0;
1232         asoc->timoshutdown = 0;
1233         asoc->timoheartbeat = 0;
1234         asoc->timocookie = 0;
1235         asoc->timoshutdownack = 0;
1236         (void)SCTP_GETTIME_TIMEVAL(&asoc->start_time);
1237         asoc->discontinuity_time = asoc->start_time;
1238         for (i = 0; i < SCTP_PR_SCTP_MAX + 1; i++) {
1239                 asoc->abandoned_unsent[i] = 0;
1240                 asoc->abandoned_sent[i] = 0;
1241         }
1242         /*
1243          * sa_ignore MEMLEAK {memory is put in the assoc mapping array and
1244          * freed later when the association is freed.
1245          */
1246         return (0);
1247 }
1248
1249 void
1250 sctp_print_mapping_array(struct sctp_association *asoc)
1251 {
1252         unsigned int i, limit;
1253
1254         SCTP_PRINTF("Mapping array size: %d, baseTSN: %8.8x, cumAck: %8.8x, highestTSN: (%8.8x, %8.8x).\n",
1255             asoc->mapping_array_size,
1256             asoc->mapping_array_base_tsn,
1257             asoc->cumulative_tsn,
1258             asoc->highest_tsn_inside_map,
1259             asoc->highest_tsn_inside_nr_map);
1260         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1261                 if (asoc->mapping_array[limit - 1] != 0) {
1262                         break;
1263                 }
1264         }
1265         SCTP_PRINTF("Renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1266         for (i = 0; i < limit; i++) {
1267                 SCTP_PRINTF("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1268         }
1269         if (limit % 16)
1270                 SCTP_PRINTF("\n");
1271         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1272                 if (asoc->nr_mapping_array[limit - 1]) {
1273                         break;
1274                 }
1275         }
1276         SCTP_PRINTF("Non renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1277         for (i = 0; i < limit; i++) {
1278                 SCTP_PRINTF("%2.2x%c", asoc->nr_mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1279         }
1280         if (limit % 16)
1281                 SCTP_PRINTF("\n");
1282 }
1283
1284 int
1285 sctp_expand_mapping_array(struct sctp_association *asoc, uint32_t needed)
1286 {
1287         /* mapping array needs to grow */
1288         uint8_t *new_array1, *new_array2;
1289         uint32_t new_size;
1290
1291         new_size = asoc->mapping_array_size + ((needed + 7) / 8 + SCTP_MAPPING_ARRAY_INCR);
1292         SCTP_MALLOC(new_array1, uint8_t *, new_size, SCTP_M_MAP);
1293         SCTP_MALLOC(new_array2, uint8_t *, new_size, SCTP_M_MAP);
1294         if ((new_array1 == NULL) || (new_array2 == NULL)) {
1295                 /* can't get more, forget it */
1296                 SCTP_PRINTF("No memory for expansion of SCTP mapping array %d\n", new_size);
1297                 if (new_array1) {
1298                         SCTP_FREE(new_array1, SCTP_M_MAP);
1299                 }
1300                 if (new_array2) {
1301                         SCTP_FREE(new_array2, SCTP_M_MAP);
1302                 }
1303                 return (-1);
1304         }
1305         memset(new_array1, 0, new_size);
1306         memset(new_array2, 0, new_size);
1307         memcpy(new_array1, asoc->mapping_array, asoc->mapping_array_size);
1308         memcpy(new_array2, asoc->nr_mapping_array, asoc->mapping_array_size);
1309         SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1310         SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
1311         asoc->mapping_array = new_array1;
1312         asoc->nr_mapping_array = new_array2;
1313         asoc->mapping_array_size = new_size;
1314         return (0);
1315 }
1316
1317
1318 static void
1319 sctp_iterator_work(struct sctp_iterator *it)
1320 {
1321         int iteration_count = 0;
1322         int inp_skip = 0;
1323         int first_in = 1;
1324         struct sctp_inpcb *tinp;
1325
1326         SCTP_INP_INFO_RLOCK();
1327         SCTP_ITERATOR_LOCK();
1328         sctp_it_ctl.cur_it = it;
1329         if (it->inp) {
1330                 SCTP_INP_RLOCK(it->inp);
1331                 SCTP_INP_DECR_REF(it->inp);
1332         }
1333         if (it->inp == NULL) {
1334                 /* iterator is complete */
1335 done_with_iterator:
1336                 sctp_it_ctl.cur_it = NULL;
1337                 SCTP_ITERATOR_UNLOCK();
1338                 SCTP_INP_INFO_RUNLOCK();
1339                 if (it->function_atend != NULL) {
1340                         (*it->function_atend) (it->pointer, it->val);
1341                 }
1342                 SCTP_FREE(it, SCTP_M_ITER);
1343                 return;
1344         }
1345 select_a_new_ep:
1346         if (first_in) {
1347                 first_in = 0;
1348         } else {
1349                 SCTP_INP_RLOCK(it->inp);
1350         }
1351         while (((it->pcb_flags) &&
1352             ((it->inp->sctp_flags & it->pcb_flags) != it->pcb_flags)) ||
1353             ((it->pcb_features) &&
1354             ((it->inp->sctp_features & it->pcb_features) != it->pcb_features))) {
1355                 /* endpoint flags or features don't match, so keep looking */
1356                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1357                         SCTP_INP_RUNLOCK(it->inp);
1358                         goto done_with_iterator;
1359                 }
1360                 tinp = it->inp;
1361                 it->inp = LIST_NEXT(it->inp, sctp_list);
1362                 SCTP_INP_RUNLOCK(tinp);
1363                 if (it->inp == NULL) {
1364                         goto done_with_iterator;
1365                 }
1366                 SCTP_INP_RLOCK(it->inp);
1367         }
1368         /* now go through each assoc which is in the desired state */
1369         if (it->done_current_ep == 0) {
1370                 if (it->function_inp != NULL)
1371                         inp_skip = (*it->function_inp) (it->inp, it->pointer, it->val);
1372                 it->done_current_ep = 1;
1373         }
1374         if (it->stcb == NULL) {
1375                 /* run the per instance function */
1376                 it->stcb = LIST_FIRST(&it->inp->sctp_asoc_list);
1377         }
1378         if ((inp_skip) || it->stcb == NULL) {
1379                 if (it->function_inp_end != NULL) {
1380                         inp_skip = (*it->function_inp_end) (it->inp,
1381                             it->pointer,
1382                             it->val);
1383                 }
1384                 SCTP_INP_RUNLOCK(it->inp);
1385                 goto no_stcb;
1386         }
1387         while (it->stcb) {
1388                 SCTP_TCB_LOCK(it->stcb);
1389                 if (it->asoc_state && ((it->stcb->asoc.state & it->asoc_state) != it->asoc_state)) {
1390                         /* not in the right state... keep looking */
1391                         SCTP_TCB_UNLOCK(it->stcb);
1392                         goto next_assoc;
1393                 }
1394                 /* see if we have limited out the iterator loop */
1395                 iteration_count++;
1396                 if (iteration_count > SCTP_ITERATOR_MAX_AT_ONCE) {
1397                         /* Pause to let others grab the lock */
1398                         atomic_add_int(&it->stcb->asoc.refcnt, 1);
1399                         SCTP_TCB_UNLOCK(it->stcb);
1400                         SCTP_INP_INCR_REF(it->inp);
1401                         SCTP_INP_RUNLOCK(it->inp);
1402                         SCTP_ITERATOR_UNLOCK();
1403                         SCTP_INP_INFO_RUNLOCK();
1404                         SCTP_INP_INFO_RLOCK();
1405                         SCTP_ITERATOR_LOCK();
1406                         if (sctp_it_ctl.iterator_flags) {
1407                                 /* We won't be staying here */
1408                                 SCTP_INP_DECR_REF(it->inp);
1409                                 atomic_add_int(&it->stcb->asoc.refcnt, -1);
1410                                 if (sctp_it_ctl.iterator_flags &
1411                                     SCTP_ITERATOR_STOP_CUR_IT) {
1412                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_IT;
1413                                         goto done_with_iterator;
1414                                 }
1415                                 if (sctp_it_ctl.iterator_flags &
1416                                     SCTP_ITERATOR_STOP_CUR_INP) {
1417                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_INP;
1418                                         goto no_stcb;
1419                                 }
1420                                 /* If we reach here huh? */
1421                                 SCTP_PRINTF("Unknown it ctl flag %x\n",
1422                                     sctp_it_ctl.iterator_flags);
1423                                 sctp_it_ctl.iterator_flags = 0;
1424                         }
1425                         SCTP_INP_RLOCK(it->inp);
1426                         SCTP_INP_DECR_REF(it->inp);
1427                         SCTP_TCB_LOCK(it->stcb);
1428                         atomic_add_int(&it->stcb->asoc.refcnt, -1);
1429                         iteration_count = 0;
1430                 }
1431
1432                 /* run function on this one */
1433                 (*it->function_assoc) (it->inp, it->stcb, it->pointer, it->val);
1434
1435                 /*
1436                  * we lie here, it really needs to have its own type but
1437                  * first I must verify that this won't effect things :-0
1438                  */
1439                 if (it->no_chunk_output == 0)
1440                         sctp_chunk_output(it->inp, it->stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1441
1442                 SCTP_TCB_UNLOCK(it->stcb);
1443 next_assoc:
1444                 it->stcb = LIST_NEXT(it->stcb, sctp_tcblist);
1445                 if (it->stcb == NULL) {
1446                         /* Run last function */
1447                         if (it->function_inp_end != NULL) {
1448                                 inp_skip = (*it->function_inp_end) (it->inp,
1449                                     it->pointer,
1450                                     it->val);
1451                         }
1452                 }
1453         }
1454         SCTP_INP_RUNLOCK(it->inp);
1455 no_stcb:
1456         /* done with all assocs on this endpoint, move on to next endpoint */
1457         it->done_current_ep = 0;
1458         if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1459                 it->inp = NULL;
1460         } else {
1461                 it->inp = LIST_NEXT(it->inp, sctp_list);
1462         }
1463         if (it->inp == NULL) {
1464                 goto done_with_iterator;
1465         }
1466         goto select_a_new_ep;
1467 }
1468
1469 void
1470 sctp_iterator_worker(void)
1471 {
1472         struct sctp_iterator *it, *nit;
1473
1474         /* This function is called with the WQ lock in place */
1475
1476         sctp_it_ctl.iterator_running = 1;
1477         TAILQ_FOREACH_SAFE(it, &sctp_it_ctl.iteratorhead, sctp_nxt_itr, nit) {
1478                 /* now lets work on this one */
1479                 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
1480                 SCTP_IPI_ITERATOR_WQ_UNLOCK();
1481                 CURVNET_SET(it->vn);
1482                 sctp_iterator_work(it);
1483                 CURVNET_RESTORE();
1484                 SCTP_IPI_ITERATOR_WQ_LOCK();
1485                 /* sa_ignore FREED_MEMORY */
1486         }
1487         sctp_it_ctl.iterator_running = 0;
1488         return;
1489 }
1490
1491
1492 static void
1493 sctp_handle_addr_wq(void)
1494 {
1495         /* deal with the ADDR wq from the rtsock calls */
1496         struct sctp_laddr *wi, *nwi;
1497         struct sctp_asconf_iterator *asc;
1498
1499         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
1500             sizeof(struct sctp_asconf_iterator), SCTP_M_ASC_IT);
1501         if (asc == NULL) {
1502                 /* Try later, no memory */
1503                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
1504                     (struct sctp_inpcb *)NULL,
1505                     (struct sctp_tcb *)NULL,
1506                     (struct sctp_nets *)NULL);
1507                 return;
1508         }
1509         LIST_INIT(&asc->list_of_work);
1510         asc->cnt = 0;
1511
1512         LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) {
1513                 LIST_REMOVE(wi, sctp_nxt_addr);
1514                 LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
1515                 asc->cnt++;
1516         }
1517
1518         if (asc->cnt == 0) {
1519                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1520         } else {
1521                 int ret;
1522
1523                 ret = sctp_initiate_iterator(sctp_asconf_iterator_ep,
1524                     sctp_asconf_iterator_stcb,
1525                     NULL,       /* No ep end for boundall */
1526                     SCTP_PCB_FLAGS_BOUNDALL,
1527                     SCTP_PCB_ANY_FEATURES,
1528                     SCTP_ASOC_ANY_STATE,
1529                     (void *)asc, 0,
1530                     sctp_asconf_iterator_end, NULL, 0);
1531                 if (ret) {
1532                         SCTP_PRINTF("Failed to initiate iterator for handle_addr_wq\n");
1533                         /*
1534                          * Freeing if we are stopping or put back on the
1535                          * addr_wq.
1536                          */
1537                         if (SCTP_BASE_VAR(sctp_pcb_initialized) == 0) {
1538                                 sctp_asconf_iterator_end(asc, 0);
1539                         } else {
1540                                 LIST_FOREACH(wi, &asc->list_of_work, sctp_nxt_addr) {
1541                                         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
1542                                 }
1543                                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1544                         }
1545                 }
1546         }
1547 }
1548
1549 void
1550 sctp_timeout_handler(void *t)
1551 {
1552         struct sctp_inpcb *inp;
1553         struct sctp_tcb *stcb;
1554         struct sctp_nets *net;
1555         struct sctp_timer *tmr;
1556         struct mbuf *op_err;
1557 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1558         struct socket *so;
1559 #endif
1560         int did_output;
1561         int type;
1562
1563         tmr = (struct sctp_timer *)t;
1564         inp = (struct sctp_inpcb *)tmr->ep;
1565         stcb = (struct sctp_tcb *)tmr->tcb;
1566         net = (struct sctp_nets *)tmr->net;
1567         CURVNET_SET((struct vnet *)tmr->vnet);
1568         did_output = 1;
1569
1570 #ifdef SCTP_AUDITING_ENABLED
1571         sctp_audit_log(0xF0, (uint8_t) tmr->type);
1572         sctp_auditing(3, inp, stcb, net);
1573 #endif
1574
1575         /* sanity checks... */
1576         if (tmr->self != (void *)tmr) {
1577                 /*
1578                  * SCTP_PRINTF("Stale SCTP timer fired (%p), ignoring...\n",
1579                  * (void *)tmr);
1580                  */
1581                 CURVNET_RESTORE();
1582                 return;
1583         }
1584         tmr->stopped_from = 0xa001;
1585         if (!SCTP_IS_TIMER_TYPE_VALID(tmr->type)) {
1586                 /*
1587                  * SCTP_PRINTF("SCTP timer fired with invalid type: 0x%x\n",
1588                  * tmr->type);
1589                  */
1590                 CURVNET_RESTORE();
1591                 return;
1592         }
1593         tmr->stopped_from = 0xa002;
1594         if ((tmr->type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL)) {
1595                 CURVNET_RESTORE();
1596                 return;
1597         }
1598         /* if this is an iterator timeout, get the struct and clear inp */
1599         tmr->stopped_from = 0xa003;
1600         if (inp) {
1601                 SCTP_INP_INCR_REF(inp);
1602                 if ((inp->sctp_socket == NULL) &&
1603                     ((tmr->type != SCTP_TIMER_TYPE_INPKILL) &&
1604                     (tmr->type != SCTP_TIMER_TYPE_INIT) &&
1605                     (tmr->type != SCTP_TIMER_TYPE_SEND) &&
1606                     (tmr->type != SCTP_TIMER_TYPE_RECV) &&
1607                     (tmr->type != SCTP_TIMER_TYPE_HEARTBEAT) &&
1608                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWN) &&
1609                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNACK) &&
1610                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNGUARD) &&
1611                     (tmr->type != SCTP_TIMER_TYPE_ASOCKILL))) {
1612                         SCTP_INP_DECR_REF(inp);
1613                         CURVNET_RESTORE();
1614                         return;
1615                 }
1616         }
1617         tmr->stopped_from = 0xa004;
1618         if (stcb) {
1619                 atomic_add_int(&stcb->asoc.refcnt, 1);
1620                 if (stcb->asoc.state == 0) {
1621                         atomic_add_int(&stcb->asoc.refcnt, -1);
1622                         if (inp) {
1623                                 SCTP_INP_DECR_REF(inp);
1624                         }
1625                         CURVNET_RESTORE();
1626                         return;
1627                 }
1628         }
1629         type = tmr->type;
1630         tmr->stopped_from = 0xa005;
1631         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer type %d goes off\n", type);
1632         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1633                 if (inp) {
1634                         SCTP_INP_DECR_REF(inp);
1635                 }
1636                 if (stcb) {
1637                         atomic_add_int(&stcb->asoc.refcnt, -1);
1638                 }
1639                 CURVNET_RESTORE();
1640                 return;
1641         }
1642         tmr->stopped_from = 0xa006;
1643
1644         if (stcb) {
1645                 SCTP_TCB_LOCK(stcb);
1646                 atomic_add_int(&stcb->asoc.refcnt, -1);
1647                 if ((type != SCTP_TIMER_TYPE_ASOCKILL) &&
1648                     ((stcb->asoc.state == 0) ||
1649                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED))) {
1650                         SCTP_TCB_UNLOCK(stcb);
1651                         if (inp) {
1652                                 SCTP_INP_DECR_REF(inp);
1653                         }
1654                         CURVNET_RESTORE();
1655                         return;
1656                 }
1657         } else if (inp != NULL) {
1658                 if (type != SCTP_TIMER_TYPE_INPKILL) {
1659                         SCTP_INP_WLOCK(inp);
1660                 }
1661         } else {
1662                 SCTP_WQ_ADDR_LOCK();
1663         }
1664         /* record in stopped what t-o occurred */
1665         tmr->stopped_from = type;
1666
1667         /* mark as being serviced now */
1668         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
1669                 /*
1670                  * Callout has been rescheduled.
1671                  */
1672                 goto get_out;
1673         }
1674         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1675                 /*
1676                  * Not active, so no action.
1677                  */
1678                 goto get_out;
1679         }
1680         SCTP_OS_TIMER_DEACTIVATE(&tmr->timer);
1681
1682         /* call the handler for the appropriate timer type */
1683         switch (type) {
1684         case SCTP_TIMER_TYPE_ADDR_WQ:
1685                 sctp_handle_addr_wq();
1686                 break;
1687         case SCTP_TIMER_TYPE_SEND:
1688                 if ((stcb == NULL) || (inp == NULL)) {
1689                         break;
1690                 }
1691                 SCTP_STAT_INCR(sctps_timodata);
1692                 stcb->asoc.timodata++;
1693                 stcb->asoc.num_send_timers_up--;
1694                 if (stcb->asoc.num_send_timers_up < 0) {
1695                         stcb->asoc.num_send_timers_up = 0;
1696                 }
1697                 SCTP_TCB_LOCK_ASSERT(stcb);
1698                 if (sctp_t3rxt_timer(inp, stcb, net)) {
1699                         /* no need to unlock on tcb its gone */
1700
1701                         goto out_decr;
1702                 }
1703                 SCTP_TCB_LOCK_ASSERT(stcb);
1704 #ifdef SCTP_AUDITING_ENABLED
1705                 sctp_auditing(4, inp, stcb, net);
1706 #endif
1707                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1708                 if ((stcb->asoc.num_send_timers_up == 0) &&
1709                     (stcb->asoc.sent_queue_cnt > 0)) {
1710                         struct sctp_tmit_chunk *chk;
1711
1712                         /*
1713                          * safeguard. If there on some on the sent queue
1714                          * somewhere but no timers running something is
1715                          * wrong... so we start a timer on the first chunk
1716                          * on the send queue on whatever net it is sent to.
1717                          */
1718                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1719                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb,
1720                             chk->whoTo);
1721                 }
1722                 break;
1723         case SCTP_TIMER_TYPE_INIT:
1724                 if ((stcb == NULL) || (inp == NULL)) {
1725                         break;
1726                 }
1727                 SCTP_STAT_INCR(sctps_timoinit);
1728                 stcb->asoc.timoinit++;
1729                 if (sctp_t1init_timer(inp, stcb, net)) {
1730                         /* no need to unlock on tcb its gone */
1731                         goto out_decr;
1732                 }
1733                 /* We do output but not here */
1734                 did_output = 0;
1735                 break;
1736         case SCTP_TIMER_TYPE_RECV:
1737                 if ((stcb == NULL) || (inp == NULL)) {
1738                         break;
1739                 }
1740                 SCTP_STAT_INCR(sctps_timosack);
1741                 stcb->asoc.timosack++;
1742                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
1743 #ifdef SCTP_AUDITING_ENABLED
1744                 sctp_auditing(4, inp, stcb, net);
1745 #endif
1746                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR, SCTP_SO_NOT_LOCKED);
1747                 break;
1748         case SCTP_TIMER_TYPE_SHUTDOWN:
1749                 if ((stcb == NULL) || (inp == NULL)) {
1750                         break;
1751                 }
1752                 if (sctp_shutdown_timer(inp, stcb, net)) {
1753                         /* no need to unlock on tcb its gone */
1754                         goto out_decr;
1755                 }
1756                 SCTP_STAT_INCR(sctps_timoshutdown);
1757                 stcb->asoc.timoshutdown++;
1758 #ifdef SCTP_AUDITING_ENABLED
1759                 sctp_auditing(4, inp, stcb, net);
1760 #endif
1761                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_NOT_LOCKED);
1762                 break;
1763         case SCTP_TIMER_TYPE_HEARTBEAT:
1764                 if ((stcb == NULL) || (inp == NULL) || (net == NULL)) {
1765                         break;
1766                 }
1767                 SCTP_STAT_INCR(sctps_timoheartbeat);
1768                 stcb->asoc.timoheartbeat++;
1769                 if (sctp_heartbeat_timer(inp, stcb, net)) {
1770                         /* no need to unlock on tcb its gone */
1771                         goto out_decr;
1772                 }
1773 #ifdef SCTP_AUDITING_ENABLED
1774                 sctp_auditing(4, inp, stcb, net);
1775 #endif
1776                 if (!(net->dest_state & SCTP_ADDR_NOHB)) {
1777                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net);
1778                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR, SCTP_SO_NOT_LOCKED);
1779                 }
1780                 break;
1781         case SCTP_TIMER_TYPE_COOKIE:
1782                 if ((stcb == NULL) || (inp == NULL)) {
1783                         break;
1784                 }
1785
1786                 if (sctp_cookie_timer(inp, stcb, net)) {
1787                         /* no need to unlock on tcb its gone */
1788                         goto out_decr;
1789                 }
1790                 SCTP_STAT_INCR(sctps_timocookie);
1791                 stcb->asoc.timocookie++;
1792 #ifdef SCTP_AUDITING_ENABLED
1793                 sctp_auditing(4, inp, stcb, net);
1794 #endif
1795                 /*
1796                  * We consider T3 and Cookie timer pretty much the same with
1797                  * respect to where from in chunk_output.
1798                  */
1799                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1800                 break;
1801         case SCTP_TIMER_TYPE_NEWCOOKIE:
1802                 {
1803                         struct timeval tv;
1804                         int i, secret;
1805
1806                         if (inp == NULL) {
1807                                 break;
1808                         }
1809                         SCTP_STAT_INCR(sctps_timosecret);
1810                         (void)SCTP_GETTIME_TIMEVAL(&tv);
1811                         inp->sctp_ep.time_of_secret_change = tv.tv_sec;
1812                         inp->sctp_ep.last_secret_number =
1813                             inp->sctp_ep.current_secret_number;
1814                         inp->sctp_ep.current_secret_number++;
1815                         if (inp->sctp_ep.current_secret_number >=
1816                             SCTP_HOW_MANY_SECRETS) {
1817                                 inp->sctp_ep.current_secret_number = 0;
1818                         }
1819                         secret = (int)inp->sctp_ep.current_secret_number;
1820                         for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1821                                 inp->sctp_ep.secret_key[secret][i] =
1822                                     sctp_select_initial_TSN(&inp->sctp_ep);
1823                         }
1824                         sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, stcb, net);
1825                 }
1826                 did_output = 0;
1827                 break;
1828         case SCTP_TIMER_TYPE_PATHMTURAISE:
1829                 if ((stcb == NULL) || (inp == NULL)) {
1830                         break;
1831                 }
1832                 SCTP_STAT_INCR(sctps_timopathmtu);
1833                 sctp_pathmtu_timer(inp, stcb, net);
1834                 did_output = 0;
1835                 break;
1836         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1837                 if ((stcb == NULL) || (inp == NULL)) {
1838                         break;
1839                 }
1840                 if (sctp_shutdownack_timer(inp, stcb, net)) {
1841                         /* no need to unlock on tcb its gone */
1842                         goto out_decr;
1843                 }
1844                 SCTP_STAT_INCR(sctps_timoshutdownack);
1845                 stcb->asoc.timoshutdownack++;
1846 #ifdef SCTP_AUDITING_ENABLED
1847                 sctp_auditing(4, inp, stcb, net);
1848 #endif
1849                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR, SCTP_SO_NOT_LOCKED);
1850                 break;
1851         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1852                 if ((stcb == NULL) || (inp == NULL)) {
1853                         break;
1854                 }
1855                 SCTP_STAT_INCR(sctps_timoshutdownguard);
1856                 op_err = sctp_generate_cause(SCTP_BASE_SYSCTL(sctp_diag_info_code),
1857                     "Shutdown guard timer expired");
1858                 sctp_abort_an_association(inp, stcb, op_err, SCTP_SO_NOT_LOCKED);
1859                 /* no need to unlock on tcb its gone */
1860                 goto out_decr;
1861
1862         case SCTP_TIMER_TYPE_STRRESET:
1863                 if ((stcb == NULL) || (inp == NULL)) {
1864                         break;
1865                 }
1866                 if (sctp_strreset_timer(inp, stcb, net)) {
1867                         /* no need to unlock on tcb its gone */
1868                         goto out_decr;
1869                 }
1870                 SCTP_STAT_INCR(sctps_timostrmrst);
1871                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR, SCTP_SO_NOT_LOCKED);
1872                 break;
1873         case SCTP_TIMER_TYPE_ASCONF:
1874                 if ((stcb == NULL) || (inp == NULL)) {
1875                         break;
1876                 }
1877                 if (sctp_asconf_timer(inp, stcb, net)) {
1878                         /* no need to unlock on tcb its gone */
1879                         goto out_decr;
1880                 }
1881                 SCTP_STAT_INCR(sctps_timoasconf);
1882 #ifdef SCTP_AUDITING_ENABLED
1883                 sctp_auditing(4, inp, stcb, net);
1884 #endif
1885                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR, SCTP_SO_NOT_LOCKED);
1886                 break;
1887         case SCTP_TIMER_TYPE_PRIM_DELETED:
1888                 if ((stcb == NULL) || (inp == NULL)) {
1889                         break;
1890                 }
1891                 sctp_delete_prim_timer(inp, stcb, net);
1892                 SCTP_STAT_INCR(sctps_timodelprim);
1893                 break;
1894
1895         case SCTP_TIMER_TYPE_AUTOCLOSE:
1896                 if ((stcb == NULL) || (inp == NULL)) {
1897                         break;
1898                 }
1899                 SCTP_STAT_INCR(sctps_timoautoclose);
1900                 sctp_autoclose_timer(inp, stcb, net);
1901                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED);
1902                 did_output = 0;
1903                 break;
1904         case SCTP_TIMER_TYPE_ASOCKILL:
1905                 if ((stcb == NULL) || (inp == NULL)) {
1906                         break;
1907                 }
1908                 SCTP_STAT_INCR(sctps_timoassockill);
1909                 /* Can we free it yet? */
1910                 SCTP_INP_DECR_REF(inp);
1911                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL,
1912                     SCTP_FROM_SCTPUTIL + SCTP_LOC_1);
1913 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1914                 so = SCTP_INP_SO(inp);
1915                 atomic_add_int(&stcb->asoc.refcnt, 1);
1916                 SCTP_TCB_UNLOCK(stcb);
1917                 SCTP_SOCKET_LOCK(so, 1);
1918                 SCTP_TCB_LOCK(stcb);
1919                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1920 #endif
1921                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
1922                     SCTP_FROM_SCTPUTIL + SCTP_LOC_2);
1923 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1924                 SCTP_SOCKET_UNLOCK(so, 1);
1925 #endif
1926                 /*
1927                  * free asoc, always unlocks (or destroy's) so prevent
1928                  * duplicate unlock or unlock of a free mtx :-0
1929                  */
1930                 stcb = NULL;
1931                 goto out_no_decr;
1932         case SCTP_TIMER_TYPE_INPKILL:
1933                 SCTP_STAT_INCR(sctps_timoinpkill);
1934                 if (inp == NULL) {
1935                         break;
1936                 }
1937                 /*
1938                  * special case, take away our increment since WE are the
1939                  * killer
1940                  */
1941                 SCTP_INP_DECR_REF(inp);
1942                 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL,
1943                     SCTP_FROM_SCTPUTIL + SCTP_LOC_3);
1944                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
1945                     SCTP_CALLED_FROM_INPKILL_TIMER);
1946                 inp = NULL;
1947                 goto out_no_decr;
1948         default:
1949                 SCTPDBG(SCTP_DEBUG_TIMER1, "sctp_timeout_handler:unknown timer %d\n",
1950                     type);
1951                 break;
1952         }
1953 #ifdef SCTP_AUDITING_ENABLED
1954         sctp_audit_log(0xF1, (uint8_t) type);
1955         if (inp)
1956                 sctp_auditing(5, inp, stcb, net);
1957 #endif
1958         if ((did_output) && stcb) {
1959                 /*
1960                  * Now we need to clean up the control chunk chain if an
1961                  * ECNE is on it. It must be marked as UNSENT again so next
1962                  * call will continue to send it until such time that we get
1963                  * a CWR, to remove it. It is, however, less likely that we
1964                  * will find a ecn echo on the chain though.
1965                  */
1966                 sctp_fix_ecn_echo(&stcb->asoc);
1967         }
1968 get_out:
1969         if (stcb) {
1970                 SCTP_TCB_UNLOCK(stcb);
1971         } else if (inp != NULL) {
1972                 SCTP_INP_WUNLOCK(inp);
1973         } else {
1974                 SCTP_WQ_ADDR_UNLOCK();
1975         }
1976
1977 out_decr:
1978         if (inp) {
1979                 SCTP_INP_DECR_REF(inp);
1980         }
1981
1982 out_no_decr:
1983         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer now complete (type = %d)\n", type);
1984         CURVNET_RESTORE();
1985 }
1986
1987 void
1988 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1989     struct sctp_nets *net)
1990 {
1991         uint32_t to_ticks;
1992         struct sctp_timer *tmr;
1993
1994         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL))
1995                 return;
1996
1997         tmr = NULL;
1998         if (stcb) {
1999                 SCTP_TCB_LOCK_ASSERT(stcb);
2000         }
2001         switch (t_type) {
2002         case SCTP_TIMER_TYPE_ADDR_WQ:
2003                 /* Only 1 tick away :-) */
2004                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2005                 to_ticks = SCTP_ADDRESS_TICK_DELAY;
2006                 break;
2007         case SCTP_TIMER_TYPE_SEND:
2008                 /* Here we use the RTO timer */
2009                 {
2010                         int rto_val;
2011
2012                         if ((stcb == NULL) || (net == NULL)) {
2013                                 return;
2014                         }
2015                         tmr = &net->rxt_timer;
2016                         if (net->RTO == 0) {
2017                                 rto_val = stcb->asoc.initial_rto;
2018                         } else {
2019                                 rto_val = net->RTO;
2020                         }
2021                         to_ticks = MSEC_TO_TICKS(rto_val);
2022                 }
2023                 break;
2024         case SCTP_TIMER_TYPE_INIT:
2025                 /*
2026                  * Here we use the INIT timer default usually about 1
2027                  * minute.
2028                  */
2029                 if ((stcb == NULL) || (net == NULL)) {
2030                         return;
2031                 }
2032                 tmr = &net->rxt_timer;
2033                 if (net->RTO == 0) {
2034                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2035                 } else {
2036                         to_ticks = MSEC_TO_TICKS(net->RTO);
2037                 }
2038                 break;
2039         case SCTP_TIMER_TYPE_RECV:
2040                 /*
2041                  * Here we use the Delayed-Ack timer value from the inp
2042                  * ususually about 200ms.
2043                  */
2044                 if (stcb == NULL) {
2045                         return;
2046                 }
2047                 tmr = &stcb->asoc.dack_timer;
2048                 to_ticks = MSEC_TO_TICKS(stcb->asoc.delayed_ack);
2049                 break;
2050         case SCTP_TIMER_TYPE_SHUTDOWN:
2051                 /* Here we use the RTO of the destination. */
2052                 if ((stcb == NULL) || (net == NULL)) {
2053                         return;
2054                 }
2055                 if (net->RTO == 0) {
2056                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2057                 } else {
2058                         to_ticks = MSEC_TO_TICKS(net->RTO);
2059                 }
2060                 tmr = &net->rxt_timer;
2061                 break;
2062         case SCTP_TIMER_TYPE_HEARTBEAT:
2063                 /*
2064                  * the net is used here so that we can add in the RTO. Even
2065                  * though we use a different timer. We also add the HB timer
2066                  * PLUS a random jitter.
2067                  */
2068                 if ((stcb == NULL) || (net == NULL)) {
2069                         return;
2070                 } else {
2071                         uint32_t rndval;
2072                         uint32_t jitter;
2073
2074                         if ((net->dest_state & SCTP_ADDR_NOHB) &&
2075                             !(net->dest_state & SCTP_ADDR_UNCONFIRMED)) {
2076                                 return;
2077                         }
2078                         if (net->RTO == 0) {
2079                                 to_ticks = stcb->asoc.initial_rto;
2080                         } else {
2081                                 to_ticks = net->RTO;
2082                         }
2083                         rndval = sctp_select_initial_TSN(&inp->sctp_ep);
2084                         jitter = rndval % to_ticks;
2085                         if (jitter >= (to_ticks >> 1)) {
2086                                 to_ticks = to_ticks + (jitter - (to_ticks >> 1));
2087                         } else {
2088                                 to_ticks = to_ticks - jitter;
2089                         }
2090                         if (!(net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
2091                             !(net->dest_state & SCTP_ADDR_PF)) {
2092                                 to_ticks += net->heart_beat_delay;
2093                         }
2094                         /*
2095                          * Now we must convert the to_ticks that are now in
2096                          * ms to ticks.
2097                          */
2098                         to_ticks = MSEC_TO_TICKS(to_ticks);
2099                         tmr = &net->hb_timer;
2100                 }
2101                 break;
2102         case SCTP_TIMER_TYPE_COOKIE:
2103                 /*
2104                  * Here we can use the RTO timer from the network since one
2105                  * RTT was compelete. If a retran happened then we will be
2106                  * using the RTO initial value.
2107                  */
2108                 if ((stcb == NULL) || (net == NULL)) {
2109                         return;
2110                 }
2111                 if (net->RTO == 0) {
2112                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2113                 } else {
2114                         to_ticks = MSEC_TO_TICKS(net->RTO);
2115                 }
2116                 tmr = &net->rxt_timer;
2117                 break;
2118         case SCTP_TIMER_TYPE_NEWCOOKIE:
2119                 /*
2120                  * nothing needed but the endpoint here ususually about 60
2121                  * minutes.
2122                  */
2123                 tmr = &inp->sctp_ep.signature_change;
2124                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE];
2125                 break;
2126         case SCTP_TIMER_TYPE_ASOCKILL:
2127                 if (stcb == NULL) {
2128                         return;
2129                 }
2130                 tmr = &stcb->asoc.strreset_timer;
2131                 to_ticks = MSEC_TO_TICKS(SCTP_ASOC_KILL_TIMEOUT);
2132                 break;
2133         case SCTP_TIMER_TYPE_INPKILL:
2134                 /*
2135                  * The inp is setup to die. We re-use the signature_chage
2136                  * timer since that has stopped and we are in the GONE
2137                  * state.
2138                  */
2139                 tmr = &inp->sctp_ep.signature_change;
2140                 to_ticks = MSEC_TO_TICKS(SCTP_INP_KILL_TIMEOUT);
2141                 break;
2142         case SCTP_TIMER_TYPE_PATHMTURAISE:
2143                 /*
2144                  * Here we use the value found in the EP for PMTU ususually
2145                  * about 10 minutes.
2146                  */
2147                 if ((stcb == NULL) || (net == NULL)) {
2148                         return;
2149                 }
2150                 if (net->dest_state & SCTP_ADDR_NO_PMTUD) {
2151                         return;
2152                 }
2153                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU];
2154                 tmr = &net->pmtu_timer;
2155                 break;
2156         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2157                 /* Here we use the RTO of the destination */
2158                 if ((stcb == NULL) || (net == NULL)) {
2159                         return;
2160                 }
2161                 if (net->RTO == 0) {
2162                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2163                 } else {
2164                         to_ticks = MSEC_TO_TICKS(net->RTO);
2165                 }
2166                 tmr = &net->rxt_timer;
2167                 break;
2168         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2169                 /*
2170                  * Here we use the endpoints shutdown guard timer usually
2171                  * about 3 minutes.
2172                  */
2173                 if (stcb == NULL) {
2174                         return;
2175                 }
2176                 if (inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN] == 0) {
2177                         to_ticks = 5 * MSEC_TO_TICKS(stcb->asoc.maxrto);
2178                 } else {
2179                         to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN];
2180                 }
2181                 tmr = &stcb->asoc.shut_guard_timer;
2182                 break;
2183         case SCTP_TIMER_TYPE_STRRESET:
2184                 /*
2185                  * Here the timer comes from the stcb but its value is from
2186                  * the net's RTO.
2187                  */
2188                 if ((stcb == NULL) || (net == NULL)) {
2189                         return;
2190                 }
2191                 if (net->RTO == 0) {
2192                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2193                 } else {
2194                         to_ticks = MSEC_TO_TICKS(net->RTO);
2195                 }
2196                 tmr = &stcb->asoc.strreset_timer;
2197                 break;
2198         case SCTP_TIMER_TYPE_ASCONF:
2199                 /*
2200                  * Here the timer comes from the stcb but its value is from
2201                  * the net's RTO.
2202                  */
2203                 if ((stcb == NULL) || (net == NULL)) {
2204                         return;
2205                 }
2206                 if (net->RTO == 0) {
2207                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2208                 } else {
2209                         to_ticks = MSEC_TO_TICKS(net->RTO);
2210                 }
2211                 tmr = &stcb->asoc.asconf_timer;
2212                 break;
2213         case SCTP_TIMER_TYPE_PRIM_DELETED:
2214                 if ((stcb == NULL) || (net != NULL)) {
2215                         return;
2216                 }
2217                 to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2218                 tmr = &stcb->asoc.delete_prim_timer;
2219                 break;
2220         case SCTP_TIMER_TYPE_AUTOCLOSE:
2221                 if (stcb == NULL) {
2222                         return;
2223                 }
2224                 if (stcb->asoc.sctp_autoclose_ticks == 0) {
2225                         /*
2226                          * Really an error since stcb is NOT set to
2227                          * autoclose
2228                          */
2229                         return;
2230                 }
2231                 to_ticks = stcb->asoc.sctp_autoclose_ticks;
2232                 tmr = &stcb->asoc.autoclose_timer;
2233                 break;
2234         default:
2235                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2236                     __func__, t_type);
2237                 return;
2238                 break;
2239         }
2240         if ((to_ticks <= 0) || (tmr == NULL)) {
2241                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: %d:software error to_ticks:%d tmr:%p not set ??\n",
2242                     __func__, t_type, to_ticks, (void *)tmr);
2243                 return;
2244         }
2245         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
2246                 /*
2247                  * we do NOT allow you to have it already running. if it is
2248                  * we leave the current one up unchanged
2249                  */
2250                 return;
2251         }
2252         /* At this point we can proceed */
2253         if (t_type == SCTP_TIMER_TYPE_SEND) {
2254                 stcb->asoc.num_send_timers_up++;
2255         }
2256         tmr->stopped_from = 0;
2257         tmr->type = t_type;
2258         tmr->ep = (void *)inp;
2259         tmr->tcb = (void *)stcb;
2260         tmr->net = (void *)net;
2261         tmr->self = (void *)tmr;
2262         tmr->vnet = (void *)curvnet;
2263         tmr->ticks = sctp_get_tick_count();
2264         (void)SCTP_OS_TIMER_START(&tmr->timer, to_ticks, sctp_timeout_handler, tmr);
2265         return;
2266 }
2267
2268 void
2269 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2270     struct sctp_nets *net, uint32_t from)
2271 {
2272         struct sctp_timer *tmr;
2273
2274         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) &&
2275             (inp == NULL))
2276                 return;
2277
2278         tmr = NULL;
2279         if (stcb) {
2280                 SCTP_TCB_LOCK_ASSERT(stcb);
2281         }
2282         switch (t_type) {
2283         case SCTP_TIMER_TYPE_ADDR_WQ:
2284                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2285                 break;
2286         case SCTP_TIMER_TYPE_SEND:
2287                 if ((stcb == NULL) || (net == NULL)) {
2288                         return;
2289                 }
2290                 tmr = &net->rxt_timer;
2291                 break;
2292         case SCTP_TIMER_TYPE_INIT:
2293                 if ((stcb == NULL) || (net == NULL)) {
2294                         return;
2295                 }
2296                 tmr = &net->rxt_timer;
2297                 break;
2298         case SCTP_TIMER_TYPE_RECV:
2299                 if (stcb == NULL) {
2300                         return;
2301                 }
2302                 tmr = &stcb->asoc.dack_timer;
2303                 break;
2304         case SCTP_TIMER_TYPE_SHUTDOWN:
2305                 if ((stcb == NULL) || (net == NULL)) {
2306                         return;
2307                 }
2308                 tmr = &net->rxt_timer;
2309                 break;
2310         case SCTP_TIMER_TYPE_HEARTBEAT:
2311                 if ((stcb == NULL) || (net == NULL)) {
2312                         return;
2313                 }
2314                 tmr = &net->hb_timer;
2315                 break;
2316         case SCTP_TIMER_TYPE_COOKIE:
2317                 if ((stcb == NULL) || (net == NULL)) {
2318                         return;
2319                 }
2320                 tmr = &net->rxt_timer;
2321                 break;
2322         case SCTP_TIMER_TYPE_NEWCOOKIE:
2323                 /* nothing needed but the endpoint here */
2324                 tmr = &inp->sctp_ep.signature_change;
2325                 /*
2326                  * We re-use the newcookie timer for the INP kill timer. We
2327                  * must assure that we do not kill it by accident.
2328                  */
2329                 break;
2330         case SCTP_TIMER_TYPE_ASOCKILL:
2331                 /*
2332                  * Stop the asoc kill timer.
2333                  */
2334                 if (stcb == NULL) {
2335                         return;
2336                 }
2337                 tmr = &stcb->asoc.strreset_timer;
2338                 break;
2339
2340         case SCTP_TIMER_TYPE_INPKILL:
2341                 /*
2342                  * The inp is setup to die. We re-use the signature_chage
2343                  * timer since that has stopped and we are in the GONE
2344                  * state.
2345                  */
2346                 tmr = &inp->sctp_ep.signature_change;
2347                 break;
2348         case SCTP_TIMER_TYPE_PATHMTURAISE:
2349                 if ((stcb == NULL) || (net == NULL)) {
2350                         return;
2351                 }
2352                 tmr = &net->pmtu_timer;
2353                 break;
2354         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2355                 if ((stcb == NULL) || (net == NULL)) {
2356                         return;
2357                 }
2358                 tmr = &net->rxt_timer;
2359                 break;
2360         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2361                 if (stcb == NULL) {
2362                         return;
2363                 }
2364                 tmr = &stcb->asoc.shut_guard_timer;
2365                 break;
2366         case SCTP_TIMER_TYPE_STRRESET:
2367                 if (stcb == NULL) {
2368                         return;
2369                 }
2370                 tmr = &stcb->asoc.strreset_timer;
2371                 break;
2372         case SCTP_TIMER_TYPE_ASCONF:
2373                 if (stcb == NULL) {
2374                         return;
2375                 }
2376                 tmr = &stcb->asoc.asconf_timer;
2377                 break;
2378         case SCTP_TIMER_TYPE_PRIM_DELETED:
2379                 if (stcb == NULL) {
2380                         return;
2381                 }
2382                 tmr = &stcb->asoc.delete_prim_timer;
2383                 break;
2384         case SCTP_TIMER_TYPE_AUTOCLOSE:
2385                 if (stcb == NULL) {
2386                         return;
2387                 }
2388                 tmr = &stcb->asoc.autoclose_timer;
2389                 break;
2390         default:
2391                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2392                     __func__, t_type);
2393                 break;
2394         }
2395         if (tmr == NULL) {
2396                 return;
2397         }
2398         if ((tmr->type != t_type) && tmr->type) {
2399                 /*
2400                  * Ok we have a timer that is under joint use. Cookie timer
2401                  * per chance with the SEND timer. We therefore are NOT
2402                  * running the timer that the caller wants stopped.  So just
2403                  * return.
2404                  */
2405                 return;
2406         }
2407         if ((t_type == SCTP_TIMER_TYPE_SEND) && (stcb != NULL)) {
2408                 stcb->asoc.num_send_timers_up--;
2409                 if (stcb->asoc.num_send_timers_up < 0) {
2410                         stcb->asoc.num_send_timers_up = 0;
2411                 }
2412         }
2413         tmr->self = NULL;
2414         tmr->stopped_from = from;
2415         (void)SCTP_OS_TIMER_STOP(&tmr->timer);
2416         return;
2417 }
2418
2419 uint32_t
2420 sctp_calculate_len(struct mbuf *m){
2421         uint32_t tlen = 0;
2422         struct mbuf *at;
2423
2424         at = m;
2425         while (at) {
2426                 tlen += SCTP_BUF_LEN(at);
2427                 at = SCTP_BUF_NEXT(at);
2428         }
2429         return (tlen);
2430 }
2431
2432 void
2433 sctp_mtu_size_reset(struct sctp_inpcb *inp,
2434     struct sctp_association *asoc, uint32_t mtu)
2435 {
2436         /*
2437          * Reset the P-MTU size on this association, this involves changing
2438          * the asoc MTU, going through ANY chunk+overhead larger than mtu to
2439          * allow the DF flag to be cleared.
2440          */
2441         struct sctp_tmit_chunk *chk;
2442         unsigned int eff_mtu, ovh;
2443
2444         asoc->smallest_mtu = mtu;
2445         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2446                 ovh = SCTP_MIN_OVERHEAD;
2447         } else {
2448                 ovh = SCTP_MIN_V4_OVERHEAD;
2449         }
2450         eff_mtu = mtu - ovh;
2451         TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
2452                 if (chk->send_size > eff_mtu) {
2453                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2454                 }
2455         }
2456         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
2457                 if (chk->send_size > eff_mtu) {
2458                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2459                 }
2460         }
2461 }
2462
2463
2464 /*
2465  * given an association and starting time of the current RTT period return
2466  * RTO in number of msecs net should point to the current network
2467  */
2468
2469 uint32_t
2470 sctp_calculate_rto(struct sctp_tcb *stcb,
2471     struct sctp_association *asoc,
2472     struct sctp_nets *net,
2473     struct timeval *old,
2474     int rtt_from_sack){
2475         /*-
2476          * given an association and the starting time of the current RTT
2477          * period (in value1/value2) return RTO in number of msecs.
2478          */
2479         int32_t rtt;            /* RTT in ms */
2480         uint32_t new_rto;
2481         int first_measure = 0;
2482         struct timeval now;
2483
2484         /************************/
2485         /* 1. calculate new RTT */
2486         /************************/
2487         /* get the current time */
2488         if (stcb->asoc.use_precise_time) {
2489                 (void)SCTP_GETPTIME_TIMEVAL(&now);
2490         } else {
2491                 (void)SCTP_GETTIME_TIMEVAL(&now);
2492         }
2493         timevalsub(&now, old);
2494         /* store the current RTT in us */
2495         net->rtt = (uint64_t) 1000000 * (uint64_t) now.tv_sec +
2496             (uint64_t) now.tv_usec;
2497         /* compute rtt in ms */
2498         rtt = (int32_t) (net->rtt / 1000);
2499         if ((asoc->cc_functions.sctp_rtt_calculated) && (rtt_from_sack == SCTP_RTT_FROM_DATA)) {
2500                 /*
2501                  * Tell the CC module that a new update has just occurred
2502                  * from a sack
2503                  */
2504                 (*asoc->cc_functions.sctp_rtt_calculated) (stcb, net, &now);
2505         }
2506         /*
2507          * Do we need to determine the lan? We do this only on sacks i.e.
2508          * RTT being determined from data not non-data (HB/INIT->INITACK).
2509          */
2510         if ((rtt_from_sack == SCTP_RTT_FROM_DATA) &&
2511             (net->lan_type == SCTP_LAN_UNKNOWN)) {
2512                 if (net->rtt > SCTP_LOCAL_LAN_RTT) {
2513                         net->lan_type = SCTP_LAN_INTERNET;
2514                 } else {
2515                         net->lan_type = SCTP_LAN_LOCAL;
2516                 }
2517         }
2518
2519         /***************************/
2520         /* 2. update RTTVAR & SRTT */
2521         /***************************/
2522         /*-
2523          * Compute the scaled average lastsa and the
2524          * scaled variance lastsv as described in van Jacobson
2525          * Paper "Congestion Avoidance and Control", Annex A.
2526          *
2527          * (net->lastsa >> SCTP_RTT_SHIFT) is the srtt
2528          * (net->lastsa >> SCTP_RTT_VAR_SHIFT) is the rttvar
2529          */
2530         if (net->RTO_measured) {
2531                 rtt -= (net->lastsa >> SCTP_RTT_SHIFT);
2532                 net->lastsa += rtt;
2533                 if (rtt < 0) {
2534                         rtt = -rtt;
2535                 }
2536                 rtt -= (net->lastsv >> SCTP_RTT_VAR_SHIFT);
2537                 net->lastsv += rtt;
2538                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2539                         rto_logging(net, SCTP_LOG_RTTVAR);
2540                 }
2541         } else {
2542                 /* First RTO measurment */
2543                 net->RTO_measured = 1;
2544                 first_measure = 1;
2545                 net->lastsa = rtt << SCTP_RTT_SHIFT;
2546                 net->lastsv = (rtt / 2) << SCTP_RTT_VAR_SHIFT;
2547                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2548                         rto_logging(net, SCTP_LOG_INITIAL_RTT);
2549                 }
2550         }
2551         if (net->lastsv == 0) {
2552                 net->lastsv = SCTP_CLOCK_GRANULARITY;
2553         }
2554         new_rto = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
2555         if ((new_rto > SCTP_SAT_NETWORK_MIN) &&
2556             (stcb->asoc.sat_network_lockout == 0)) {
2557                 stcb->asoc.sat_network = 1;
2558         } else if ((!first_measure) && stcb->asoc.sat_network) {
2559                 stcb->asoc.sat_network = 0;
2560                 stcb->asoc.sat_network_lockout = 1;
2561         }
2562         /* bound it, per C6/C7 in Section 5.3.1 */
2563         if (new_rto < stcb->asoc.minrto) {
2564                 new_rto = stcb->asoc.minrto;
2565         }
2566         if (new_rto > stcb->asoc.maxrto) {
2567                 new_rto = stcb->asoc.maxrto;
2568         }
2569         /* we are now returning the RTO */
2570         return (new_rto);
2571 }
2572
2573 /*
2574  * return a pointer to a contiguous piece of data from the given mbuf chain
2575  * starting at 'off' for 'len' bytes.  If the desired piece spans more than
2576  * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size
2577  * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain.
2578  */
2579 caddr_t
2580 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t * in_ptr)
2581 {
2582         uint32_t count;
2583         uint8_t *ptr;
2584
2585         ptr = in_ptr;
2586         if ((off < 0) || (len <= 0))
2587                 return (NULL);
2588
2589         /* find the desired start location */
2590         while ((m != NULL) && (off > 0)) {
2591                 if (off < SCTP_BUF_LEN(m))
2592                         break;
2593                 off -= SCTP_BUF_LEN(m);
2594                 m = SCTP_BUF_NEXT(m);
2595         }
2596         if (m == NULL)
2597                 return (NULL);
2598
2599         /* is the current mbuf large enough (eg. contiguous)? */
2600         if ((SCTP_BUF_LEN(m) - off) >= len) {
2601                 return (mtod(m, caddr_t)+off);
2602         } else {
2603                 /* else, it spans more than one mbuf, so save a temp copy... */
2604                 while ((m != NULL) && (len > 0)) {
2605                         count = min(SCTP_BUF_LEN(m) - off, len);
2606                         memcpy(ptr, mtod(m, caddr_t)+off, count);
2607                         len -= count;
2608                         ptr += count;
2609                         off = 0;
2610                         m = SCTP_BUF_NEXT(m);
2611                 }
2612                 if ((m == NULL) && (len > 0))
2613                         return (NULL);
2614                 else
2615                         return ((caddr_t)in_ptr);
2616         }
2617 }
2618
2619
2620
2621 struct sctp_paramhdr *
2622 sctp_get_next_param(struct mbuf *m,
2623     int offset,
2624     struct sctp_paramhdr *pull,
2625     int pull_limit)
2626 {
2627         /* This just provides a typed signature to Peter's Pull routine */
2628         return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit,
2629             (uint8_t *) pull));
2630 }
2631
2632
2633 struct mbuf *
2634 sctp_add_pad_tombuf(struct mbuf *m, int padlen)
2635 {
2636         struct mbuf *m_last;
2637         caddr_t dp;
2638
2639         if (padlen > 3) {
2640                 return (NULL);
2641         }
2642         if (padlen <= M_TRAILINGSPACE(m)) {
2643                 /*
2644                  * The easy way. We hope the majority of the time we hit
2645                  * here :)
2646                  */
2647                 m_last = m;
2648         } else {
2649                 /* Hard way we must grow the mbuf chain */
2650                 m_last = sctp_get_mbuf_for_msg(padlen, 0, M_NOWAIT, 1, MT_DATA);
2651                 if (m_last == NULL) {
2652                         return (NULL);
2653                 }
2654                 SCTP_BUF_LEN(m_last) = 0;
2655                 SCTP_BUF_NEXT(m_last) = NULL;
2656                 SCTP_BUF_NEXT(m) = m_last;
2657         }
2658         dp = mtod(m_last, caddr_t)+SCTP_BUF_LEN(m_last);
2659         SCTP_BUF_LEN(m_last) += padlen;
2660         memset(dp, 0, padlen);
2661         return (m_last);
2662 }
2663
2664 struct mbuf *
2665 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf)
2666 {
2667         /* find the last mbuf in chain and pad it */
2668         struct mbuf *m_at;
2669
2670         if (last_mbuf != NULL) {
2671                 return (sctp_add_pad_tombuf(last_mbuf, padval));
2672         } else {
2673                 for (m_at = m; m_at; m_at = SCTP_BUF_NEXT(m_at)) {
2674                         if (SCTP_BUF_NEXT(m_at) == NULL) {
2675                                 return (sctp_add_pad_tombuf(m_at, padval));
2676                         }
2677                 }
2678         }
2679         return (NULL);
2680 }
2681
2682 static void
2683 sctp_notify_assoc_change(uint16_t state, struct sctp_tcb *stcb,
2684     uint16_t error, struct sctp_abort_chunk *abort, uint8_t from_peer, int so_locked
2685 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2686     SCTP_UNUSED
2687 #endif
2688 )
2689 {
2690         struct mbuf *m_notify;
2691         struct sctp_assoc_change *sac;
2692         struct sctp_queued_to_read *control;
2693         unsigned int notif_len;
2694         uint16_t abort_len;
2695         unsigned int i;
2696 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2697         struct socket *so;
2698 #endif
2699
2700         if (stcb == NULL) {
2701                 return;
2702         }
2703         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVASSOCEVNT)) {
2704                 notif_len = (unsigned int)sizeof(struct sctp_assoc_change);
2705                 if (abort != NULL) {
2706                         abort_len = ntohs(abort->ch.chunk_length);
2707                         /*
2708                          * Only SCTP_CHUNK_BUFFER_SIZE are guaranteed to be
2709                          * contiguous.
2710                          */
2711                         if (abort_len > SCTP_CHUNK_BUFFER_SIZE) {
2712                                 abort_len = SCTP_CHUNK_BUFFER_SIZE;
2713                         }
2714                 } else {
2715                         abort_len = 0;
2716                 }
2717                 if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
2718                         notif_len += SCTP_ASSOC_SUPPORTS_MAX;
2719                 } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
2720                         notif_len += abort_len;
2721                 }
2722                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
2723                 if (m_notify == NULL) {
2724                         /* Retry with smaller value. */
2725                         notif_len = (unsigned int)sizeof(struct sctp_assoc_change);
2726                         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
2727                         if (m_notify == NULL) {
2728                                 goto set_error;
2729                         }
2730                 }
2731                 SCTP_BUF_NEXT(m_notify) = NULL;
2732                 sac = mtod(m_notify, struct sctp_assoc_change *);
2733                 memset(sac, 0, notif_len);
2734                 sac->sac_type = SCTP_ASSOC_CHANGE;
2735                 sac->sac_flags = 0;
2736                 sac->sac_length = sizeof(struct sctp_assoc_change);
2737                 sac->sac_state = state;
2738                 sac->sac_error = error;
2739                 /* XXX verify these stream counts */
2740                 sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
2741                 sac->sac_inbound_streams = stcb->asoc.streamincnt;
2742                 sac->sac_assoc_id = sctp_get_associd(stcb);
2743                 if (notif_len > sizeof(struct sctp_assoc_change)) {
2744                         if ((state == SCTP_COMM_UP) || (state == SCTP_RESTART)) {
2745                                 i = 0;
2746                                 if (stcb->asoc.prsctp_supported == 1) {
2747                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_PR;
2748                                 }
2749                                 if (stcb->asoc.auth_supported == 1) {
2750                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_AUTH;
2751                                 }
2752                                 if (stcb->asoc.asconf_supported == 1) {
2753                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_ASCONF;
2754                                 }
2755                                 if (stcb->asoc.idata_supported == 1) {
2756                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_INTERLEAVING;
2757                                 }
2758                                 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_MULTIBUF;
2759                                 if (stcb->asoc.reconfig_supported == 1) {
2760                                         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_RE_CONFIG;
2761                                 }
2762                                 sac->sac_length += i;
2763                         } else if ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC)) {
2764                                 memcpy(sac->sac_info, abort, abort_len);
2765                                 sac->sac_length += abort_len;
2766                         }
2767                 }
2768                 SCTP_BUF_LEN(m_notify) = sac->sac_length;
2769                 control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2770                     0, 0, stcb->asoc.context, 0, 0, 0,
2771                     m_notify);
2772                 if (control != NULL) {
2773                         control->length = SCTP_BUF_LEN(m_notify);
2774                         control->spec_flags = M_NOTIFICATION;
2775                         /* not that we need this */
2776                         control->tail_mbuf = m_notify;
2777                         sctp_add_to_readq(stcb->sctp_ep, stcb,
2778                             control,
2779                             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD,
2780                             so_locked);
2781                 } else {
2782                         sctp_m_freem(m_notify);
2783                 }
2784         }
2785         /*
2786          * For 1-to-1 style sockets, we send up and error when an ABORT
2787          * comes in.
2788          */
2789 set_error:
2790         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2791             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2792             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
2793                 SOCK_LOCK(stcb->sctp_socket);
2794                 if (from_peer) {
2795                         if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) {
2796                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNREFUSED);
2797                                 stcb->sctp_socket->so_error = ECONNREFUSED;
2798                         } else {
2799                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
2800                                 stcb->sctp_socket->so_error = ECONNRESET;
2801                         }
2802                 } else {
2803                         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) ||
2804                             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_ECHOED)) {
2805                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ETIMEDOUT);
2806                                 stcb->sctp_socket->so_error = ETIMEDOUT;
2807                         } else {
2808                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNABORTED);
2809                                 stcb->sctp_socket->so_error = ECONNABORTED;
2810                         }
2811                 }
2812                 SOCK_UNLOCK(stcb->sctp_socket);
2813         }
2814         /* Wake ANY sleepers */
2815 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2816         so = SCTP_INP_SO(stcb->sctp_ep);
2817         if (!so_locked) {
2818                 atomic_add_int(&stcb->asoc.refcnt, 1);
2819                 SCTP_TCB_UNLOCK(stcb);
2820                 SCTP_SOCKET_LOCK(so, 1);
2821                 SCTP_TCB_LOCK(stcb);
2822                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
2823                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2824                         SCTP_SOCKET_UNLOCK(so, 1);
2825                         return;
2826                 }
2827         }
2828 #endif
2829         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2830             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2831             ((state == SCTP_COMM_LOST) || (state == SCTP_CANT_STR_ASSOC))) {
2832                 socantrcvmore(stcb->sctp_socket);
2833         }
2834         sorwakeup(stcb->sctp_socket);
2835         sowwakeup(stcb->sctp_socket);
2836 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2837         if (!so_locked) {
2838                 SCTP_SOCKET_UNLOCK(so, 1);
2839         }
2840 #endif
2841 }
2842
2843 static void
2844 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
2845     struct sockaddr *sa, uint32_t error, int so_locked
2846 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2847     SCTP_UNUSED
2848 #endif
2849 )
2850 {
2851         struct mbuf *m_notify;
2852         struct sctp_paddr_change *spc;
2853         struct sctp_queued_to_read *control;
2854
2855         if ((stcb == NULL) ||
2856             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPADDREVNT)) {
2857                 /* event not enabled */
2858                 return;
2859         }
2860         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 0, M_NOWAIT, 1, MT_DATA);
2861         if (m_notify == NULL)
2862                 return;
2863         SCTP_BUF_LEN(m_notify) = 0;
2864         spc = mtod(m_notify, struct sctp_paddr_change *);
2865         memset(spc, 0, sizeof(struct sctp_paddr_change));
2866         spc->spc_type = SCTP_PEER_ADDR_CHANGE;
2867         spc->spc_flags = 0;
2868         spc->spc_length = sizeof(struct sctp_paddr_change);
2869         switch (sa->sa_family) {
2870 #ifdef INET
2871         case AF_INET:
2872 #ifdef INET6
2873                 if (sctp_is_feature_on(stcb->sctp_ep, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
2874                         in6_sin_2_v4mapsin6((struct sockaddr_in *)sa,
2875                             (struct sockaddr_in6 *)&spc->spc_aaddr);
2876                 } else {
2877                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2878                 }
2879 #else
2880                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2881 #endif
2882                 break;
2883 #endif
2884 #ifdef INET6
2885         case AF_INET6:
2886                 {
2887                         struct sockaddr_in6 *sin6;
2888
2889                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6));
2890
2891                         sin6 = (struct sockaddr_in6 *)&spc->spc_aaddr;
2892                         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2893                                 if (sin6->sin6_scope_id == 0) {
2894                                         /* recover scope_id for user */
2895                                         (void)sa6_recoverscope(sin6);
2896                                 } else {
2897                                         /* clear embedded scope_id for user */
2898                                         in6_clearscope(&sin6->sin6_addr);
2899                                 }
2900                         }
2901                         break;
2902                 }
2903 #endif
2904         default:
2905                 /* TSNH */
2906                 break;
2907         }
2908         spc->spc_state = state;
2909         spc->spc_error = error;
2910         spc->spc_assoc_id = sctp_get_associd(stcb);
2911
2912         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_paddr_change);
2913         SCTP_BUF_NEXT(m_notify) = NULL;
2914
2915         /* append to socket */
2916         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2917             0, 0, stcb->asoc.context, 0, 0, 0,
2918             m_notify);
2919         if (control == NULL) {
2920                 /* no memory */
2921                 sctp_m_freem(m_notify);
2922                 return;
2923         }
2924         control->length = SCTP_BUF_LEN(m_notify);
2925         control->spec_flags = M_NOTIFICATION;
2926         /* not that we need this */
2927         control->tail_mbuf = m_notify;
2928         sctp_add_to_readq(stcb->sctp_ep, stcb,
2929             control,
2930             &stcb->sctp_socket->so_rcv, 1,
2931             SCTP_READ_LOCK_NOT_HELD,
2932             so_locked);
2933 }
2934
2935
2936 static void
2937 sctp_notify_send_failed(struct sctp_tcb *stcb, uint8_t sent, uint32_t error,
2938     struct sctp_tmit_chunk *chk, int so_locked
2939 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2940     SCTP_UNUSED
2941 #endif
2942 )
2943 {
2944         struct mbuf *m_notify;
2945         struct sctp_send_failed *ssf;
2946         struct sctp_send_failed_event *ssfe;
2947         struct sctp_queued_to_read *control;
2948         struct sctp_chunkhdr *chkhdr;
2949         int notifhdr_len, chk_len, chkhdr_len, padding_len, payload_len;
2950
2951         if ((stcb == NULL) ||
2952             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
2953             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
2954                 /* event not enabled */
2955                 return;
2956         }
2957
2958         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2959                 notifhdr_len = sizeof(struct sctp_send_failed_event);
2960         } else {
2961                 notifhdr_len = sizeof(struct sctp_send_failed);
2962         }
2963         m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA);
2964         if (m_notify == NULL)
2965                 /* no space left */
2966                 return;
2967         SCTP_BUF_LEN(m_notify) = notifhdr_len;
2968         if (stcb->asoc.idata_supported) {
2969                 chkhdr_len = sizeof(struct sctp_idata_chunk);
2970         } else {
2971                 chkhdr_len = sizeof(struct sctp_data_chunk);
2972         }
2973         /* Use some defaults in case we can't access the chunk header */
2974         if (chk->send_size >= chkhdr_len) {
2975                 payload_len = chk->send_size - chkhdr_len;
2976         } else {
2977                 payload_len = 0;
2978         }
2979         padding_len = 0;
2980         if (chk->data != NULL) {
2981                 chkhdr = mtod(chk->data, struct sctp_chunkhdr *);
2982                 if (chkhdr != NULL) {
2983                         chk_len = ntohs(chkhdr->chunk_length);
2984                         if ((chk_len >= chkhdr_len) &&
2985                             (chk->send_size >= chk_len) &&
2986                             (chk->send_size - chk_len < 4)) {
2987                                 padding_len = chk->send_size - chk_len;
2988                                 payload_len = chk->send_size - chkhdr_len - padding_len;
2989                         }
2990                 }
2991         }
2992         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2993                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
2994                 memset(ssfe, 0, notifhdr_len);
2995                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
2996                 if (sent) {
2997                         ssfe->ssfe_flags = SCTP_DATA_SENT;
2998                 } else {
2999                         ssfe->ssfe_flags = SCTP_DATA_UNSENT;
3000                 }
3001                 ssfe->ssfe_length = (uint32_t) (notifhdr_len + payload_len);
3002                 ssfe->ssfe_error = error;
3003                 /* not exactly what the user sent in, but should be close :) */
3004                 ssfe->ssfe_info.snd_sid = chk->rec.data.sid;
3005                 ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags;
3006                 ssfe->ssfe_info.snd_ppid = chk->rec.data.ppid;
3007                 ssfe->ssfe_info.snd_context = chk->rec.data.context;
3008                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
3009                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
3010         } else {
3011                 ssf = mtod(m_notify, struct sctp_send_failed *);
3012                 memset(ssf, 0, notifhdr_len);
3013                 ssf->ssf_type = SCTP_SEND_FAILED;
3014                 if (sent) {
3015                         ssf->ssf_flags = SCTP_DATA_SENT;
3016                 } else {
3017                         ssf->ssf_flags = SCTP_DATA_UNSENT;
3018                 }
3019                 ssf->ssf_length = (uint32_t) (notifhdr_len + payload_len);
3020                 ssf->ssf_error = error;
3021                 /* not exactly what the user sent in, but should be close :) */
3022                 ssf->ssf_info.sinfo_stream = chk->rec.data.sid;
3023                 ssf->ssf_info.sinfo_ssn = (uint16_t) chk->rec.data.mid;
3024                 ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags;
3025                 ssf->ssf_info.sinfo_ppid = chk->rec.data.ppid;
3026                 ssf->ssf_info.sinfo_context = chk->rec.data.context;
3027                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
3028                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
3029         }
3030         if (chk->data != NULL) {
3031                 /* Trim off the sctp chunk header (it should be there) */
3032                 if (chk->send_size == chkhdr_len + payload_len + padding_len) {
3033                         m_adj(chk->data, chkhdr_len);
3034                         m_adj(chk->data, -padding_len);
3035                         sctp_mbuf_crush(chk->data);
3036                         chk->send_size -= (chkhdr_len + padding_len);
3037                 }
3038         }
3039         SCTP_BUF_NEXT(m_notify) = chk->data;
3040         /* Steal off the mbuf */
3041         chk->data = NULL;
3042         /*
3043          * For this case, we check the actual socket buffer, since the assoc
3044          * is going away we don't want to overfill the socket buffer for a
3045          * non-reader
3046          */
3047         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3048                 sctp_m_freem(m_notify);
3049                 return;
3050         }
3051         /* append to socket */
3052         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3053             0, 0, stcb->asoc.context, 0, 0, 0,
3054             m_notify);
3055         if (control == NULL) {
3056                 /* no memory */
3057                 sctp_m_freem(m_notify);
3058                 return;
3059         }
3060         control->length = SCTP_BUF_LEN(m_notify);
3061         control->spec_flags = M_NOTIFICATION;
3062         /* not that we need this */
3063         control->tail_mbuf = m_notify;
3064         sctp_add_to_readq(stcb->sctp_ep, stcb,
3065             control,
3066             &stcb->sctp_socket->so_rcv, 1,
3067             SCTP_READ_LOCK_NOT_HELD,
3068             so_locked);
3069 }
3070
3071
3072 static void
3073 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
3074     struct sctp_stream_queue_pending *sp, int so_locked
3075 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3076     SCTP_UNUSED
3077 #endif
3078 )
3079 {
3080         struct mbuf *m_notify;
3081         struct sctp_send_failed *ssf;
3082         struct sctp_send_failed_event *ssfe;
3083         struct sctp_queued_to_read *control;
3084         int notifhdr_len;
3085
3086         if ((stcb == NULL) ||
3087             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
3088             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
3089                 /* event not enabled */
3090                 return;
3091         }
3092         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3093                 notifhdr_len = sizeof(struct sctp_send_failed_event);
3094         } else {
3095                 notifhdr_len = sizeof(struct sctp_send_failed);
3096         }
3097         m_notify = sctp_get_mbuf_for_msg(notifhdr_len, 0, M_NOWAIT, 1, MT_DATA);
3098         if (m_notify == NULL) {
3099                 /* no space left */
3100                 return;
3101         }
3102         SCTP_BUF_LEN(m_notify) = notifhdr_len;
3103         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
3104                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
3105                 memset(ssfe, 0, notifhdr_len);
3106                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
3107                 ssfe->ssfe_flags = SCTP_DATA_UNSENT;
3108                 ssfe->ssfe_length = (uint32_t) (notifhdr_len + sp->length);
3109                 ssfe->ssfe_error = error;
3110                 /* not exactly what the user sent in, but should be close :) */
3111                 ssfe->ssfe_info.snd_sid = sp->sid;
3112                 if (sp->some_taken) {
3113                         ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG;
3114                 } else {
3115                         ssfe->ssfe_info.snd_flags = SCTP_DATA_NOT_FRAG;
3116                 }
3117                 ssfe->ssfe_info.snd_ppid = sp->ppid;
3118                 ssfe->ssfe_info.snd_context = sp->context;
3119                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
3120                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
3121         } else {
3122                 ssf = mtod(m_notify, struct sctp_send_failed *);
3123                 memset(ssf, 0, notifhdr_len);
3124                 ssf->ssf_type = SCTP_SEND_FAILED;
3125                 ssf->ssf_flags = SCTP_DATA_UNSENT;
3126                 ssf->ssf_length = (uint32_t) (notifhdr_len + sp->length);
3127                 ssf->ssf_error = error;
3128                 /* not exactly what the user sent in, but should be close :) */
3129                 ssf->ssf_info.sinfo_stream = sp->sid;
3130                 ssf->ssf_info.sinfo_ssn = 0;
3131                 if (sp->some_taken) {
3132                         ssf->ssf_info.sinfo_flags = SCTP_DATA_LAST_FRAG;
3133                 } else {
3134                         ssf->ssf_info.sinfo_flags = SCTP_DATA_NOT_FRAG;
3135                 }
3136                 ssf->ssf_info.sinfo_ppid = sp->ppid;
3137                 ssf->ssf_info.sinfo_context = sp->context;
3138                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
3139                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
3140         }
3141         SCTP_BUF_NEXT(m_notify) = sp->data;
3142
3143         /* Steal off the mbuf */
3144         sp->data = NULL;
3145         /*
3146          * For this case, we check the actual socket buffer, since the assoc
3147          * is going away we don't want to overfill the socket buffer for a
3148          * non-reader
3149          */
3150         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3151                 sctp_m_freem(m_notify);
3152                 return;
3153         }
3154         /* append to socket */
3155         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3156             0, 0, stcb->asoc.context, 0, 0, 0,
3157             m_notify);
3158         if (control == NULL) {
3159                 /* no memory */
3160                 sctp_m_freem(m_notify);
3161                 return;
3162         }
3163         control->length = SCTP_BUF_LEN(m_notify);
3164         control->spec_flags = M_NOTIFICATION;
3165         /* not that we need this */
3166         control->tail_mbuf = m_notify;
3167         sctp_add_to_readq(stcb->sctp_ep, stcb,
3168             control,
3169             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3170 }
3171
3172
3173
3174 static void
3175 sctp_notify_adaptation_layer(struct sctp_tcb *stcb)
3176 {
3177         struct mbuf *m_notify;
3178         struct sctp_adaptation_event *sai;
3179         struct sctp_queued_to_read *control;
3180
3181         if ((stcb == NULL) ||
3182             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ADAPTATIONEVNT)) {
3183                 /* event not enabled */
3184                 return;
3185         }
3186
3187         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_NOWAIT, 1, MT_DATA);
3188         if (m_notify == NULL)
3189                 /* no space left */
3190                 return;
3191         SCTP_BUF_LEN(m_notify) = 0;
3192         sai = mtod(m_notify, struct sctp_adaptation_event *);
3193         memset(sai, 0, sizeof(struct sctp_adaptation_event));
3194         sai->sai_type = SCTP_ADAPTATION_INDICATION;
3195         sai->sai_flags = 0;
3196         sai->sai_length = sizeof(struct sctp_adaptation_event);
3197         sai->sai_adaptation_ind = stcb->asoc.peers_adaptation;
3198         sai->sai_assoc_id = sctp_get_associd(stcb);
3199
3200         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_adaptation_event);
3201         SCTP_BUF_NEXT(m_notify) = NULL;
3202
3203         /* append to socket */
3204         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3205             0, 0, stcb->asoc.context, 0, 0, 0,
3206             m_notify);
3207         if (control == NULL) {
3208                 /* no memory */
3209                 sctp_m_freem(m_notify);
3210                 return;
3211         }
3212         control->length = SCTP_BUF_LEN(m_notify);
3213         control->spec_flags = M_NOTIFICATION;
3214         /* not that we need this */
3215         control->tail_mbuf = m_notify;
3216         sctp_add_to_readq(stcb->sctp_ep, stcb,
3217             control,
3218             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3219 }
3220
3221 /* This always must be called with the read-queue LOCKED in the INP */
3222 static void
3223 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb, uint32_t error,
3224     uint32_t val, int so_locked
3225 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3226     SCTP_UNUSED
3227 #endif
3228 )
3229 {
3230         struct mbuf *m_notify;
3231         struct sctp_pdapi_event *pdapi;
3232         struct sctp_queued_to_read *control;
3233         struct sockbuf *sb;
3234
3235         if ((stcb == NULL) ||
3236             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_PDAPIEVNT)) {
3237                 /* event not enabled */
3238                 return;
3239         }
3240         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
3241                 return;
3242         }
3243
3244         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 0, M_NOWAIT, 1, MT_DATA);
3245         if (m_notify == NULL)
3246                 /* no space left */
3247                 return;
3248         SCTP_BUF_LEN(m_notify) = 0;
3249         pdapi = mtod(m_notify, struct sctp_pdapi_event *);
3250         memset(pdapi, 0, sizeof(struct sctp_pdapi_event));
3251         pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
3252         pdapi->pdapi_flags = 0;
3253         pdapi->pdapi_length = sizeof(struct sctp_pdapi_event);
3254         pdapi->pdapi_indication = error;
3255         pdapi->pdapi_stream = (val >> 16);
3256         pdapi->pdapi_seq = (val & 0x0000ffff);
3257         pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
3258
3259         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_pdapi_event);
3260         SCTP_BUF_NEXT(m_notify) = NULL;
3261         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3262             0, 0, stcb->asoc.context, 0, 0, 0,
3263             m_notify);
3264         if (control == NULL) {
3265                 /* no memory */
3266                 sctp_m_freem(m_notify);
3267                 return;
3268         }
3269         control->length = SCTP_BUF_LEN(m_notify);
3270         control->spec_flags = M_NOTIFICATION;
3271         /* not that we need this */
3272         control->tail_mbuf = m_notify;
3273         sb = &stcb->sctp_socket->so_rcv;
3274         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3275                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m_notify));
3276         }
3277         sctp_sballoc(stcb, sb, m_notify);
3278         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3279                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3280         }
3281         control->end_added = 1;
3282         if (stcb->asoc.control_pdapi)
3283                 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next);
3284         else {
3285                 /* we really should not see this case */
3286                 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next);
3287         }
3288         if (stcb->sctp_ep && stcb->sctp_socket) {
3289                 /* This should always be the case */
3290 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3291                 struct socket *so;
3292
3293                 so = SCTP_INP_SO(stcb->sctp_ep);
3294                 if (!so_locked) {
3295                         atomic_add_int(&stcb->asoc.refcnt, 1);
3296                         SCTP_TCB_UNLOCK(stcb);
3297                         SCTP_SOCKET_LOCK(so, 1);
3298                         SCTP_TCB_LOCK(stcb);
3299                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
3300                         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3301                                 SCTP_SOCKET_UNLOCK(so, 1);
3302                                 return;
3303                         }
3304                 }
3305 #endif
3306                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
3307 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3308                 if (!so_locked) {
3309                         SCTP_SOCKET_UNLOCK(so, 1);
3310                 }
3311 #endif
3312         }
3313 }
3314
3315 static void
3316 sctp_notify_shutdown_event(struct sctp_tcb *stcb)
3317 {
3318         struct mbuf *m_notify;
3319         struct sctp_shutdown_event *sse;
3320         struct sctp_queued_to_read *control;
3321
3322         /*
3323          * For TCP model AND UDP connected sockets we will send an error up
3324          * when an SHUTDOWN completes
3325          */
3326         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3327             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
3328                 /* mark socket closed for read/write and wakeup! */
3329 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3330                 struct socket *so;
3331
3332                 so = SCTP_INP_SO(stcb->sctp_ep);
3333                 atomic_add_int(&stcb->asoc.refcnt, 1);
3334                 SCTP_TCB_UNLOCK(stcb);
3335                 SCTP_SOCKET_LOCK(so, 1);
3336                 SCTP_TCB_LOCK(stcb);
3337                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3338                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
3339                         SCTP_SOCKET_UNLOCK(so, 1);
3340                         return;
3341                 }
3342 #endif
3343                 socantsendmore(stcb->sctp_socket);
3344 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3345                 SCTP_SOCKET_UNLOCK(so, 1);
3346 #endif
3347         }
3348         if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT)) {
3349                 /* event not enabled */
3350                 return;
3351         }
3352
3353         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 0, M_NOWAIT, 1, MT_DATA);
3354         if (m_notify == NULL)
3355                 /* no space left */
3356                 return;
3357         sse = mtod(m_notify, struct sctp_shutdown_event *);
3358         memset(sse, 0, sizeof(struct sctp_shutdown_event));
3359         sse->sse_type = SCTP_SHUTDOWN_EVENT;
3360         sse->sse_flags = 0;
3361         sse->sse_length = sizeof(struct sctp_shutdown_event);
3362         sse->sse_assoc_id = sctp_get_associd(stcb);
3363
3364         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_shutdown_event);
3365         SCTP_BUF_NEXT(m_notify) = NULL;
3366
3367         /* append to socket */
3368         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3369             0, 0, stcb->asoc.context, 0, 0, 0,
3370             m_notify);
3371         if (control == NULL) {
3372                 /* no memory */
3373                 sctp_m_freem(m_notify);
3374                 return;
3375         }
3376         control->length = SCTP_BUF_LEN(m_notify);
3377         control->spec_flags = M_NOTIFICATION;
3378         /* not that we need this */
3379         control->tail_mbuf = m_notify;
3380         sctp_add_to_readq(stcb->sctp_ep, stcb,
3381             control,
3382             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3383 }
3384
3385 static void
3386 sctp_notify_sender_dry_event(struct sctp_tcb *stcb,
3387     int so_locked
3388 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3389     SCTP_UNUSED
3390 #endif
3391 )
3392 {
3393         struct mbuf *m_notify;
3394         struct sctp_sender_dry_event *event;
3395         struct sctp_queued_to_read *control;
3396
3397         if ((stcb == NULL) ||
3398             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DRYEVNT)) {
3399                 /* event not enabled */
3400                 return;
3401         }
3402
3403         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_sender_dry_event), 0, M_NOWAIT, 1, MT_DATA);
3404         if (m_notify == NULL) {
3405                 /* no space left */
3406                 return;
3407         }
3408         SCTP_BUF_LEN(m_notify) = 0;
3409         event = mtod(m_notify, struct sctp_sender_dry_event *);
3410         memset(event, 0, sizeof(struct sctp_sender_dry_event));
3411         event->sender_dry_type = SCTP_SENDER_DRY_EVENT;
3412         event->sender_dry_flags = 0;
3413         event->sender_dry_length = sizeof(struct sctp_sender_dry_event);
3414         event->sender_dry_assoc_id = sctp_get_associd(stcb);
3415
3416         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_sender_dry_event);
3417         SCTP_BUF_NEXT(m_notify) = NULL;
3418
3419         /* append to socket */
3420         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3421             0, 0, stcb->asoc.context, 0, 0, 0,
3422             m_notify);
3423         if (control == NULL) {
3424                 /* no memory */
3425                 sctp_m_freem(m_notify);
3426                 return;
3427         }
3428         control->length = SCTP_BUF_LEN(m_notify);
3429         control->spec_flags = M_NOTIFICATION;
3430         /* not that we need this */
3431         control->tail_mbuf = m_notify;
3432         sctp_add_to_readq(stcb->sctp_ep, stcb, control,
3433             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3434 }
3435
3436
3437 void
3438 sctp_notify_stream_reset_add(struct sctp_tcb *stcb, uint16_t numberin, uint16_t numberout, int flag)
3439 {
3440         struct mbuf *m_notify;
3441         struct sctp_queued_to_read *control;
3442         struct sctp_stream_change_event *stradd;
3443
3444         if ((stcb == NULL) ||
3445             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT))) {
3446                 /* event not enabled */
3447                 return;
3448         }
3449         if ((stcb->asoc.peer_req_out) && flag) {
3450                 /* Peer made the request, don't tell the local user */
3451                 stcb->asoc.peer_req_out = 0;
3452                 return;
3453         }
3454         stcb->asoc.peer_req_out = 0;
3455         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_stream_change_event), 0, M_NOWAIT, 1, MT_DATA);
3456         if (m_notify == NULL)
3457                 /* no space left */
3458                 return;
3459         SCTP_BUF_LEN(m_notify) = 0;
3460         stradd = mtod(m_notify, struct sctp_stream_change_event *);
3461         memset(stradd, 0, sizeof(struct sctp_stream_change_event));
3462         stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT;
3463         stradd->strchange_flags = flag;
3464         stradd->strchange_length = sizeof(struct sctp_stream_change_event);
3465         stradd->strchange_assoc_id = sctp_get_associd(stcb);
3466         stradd->strchange_instrms = numberin;
3467         stradd->strchange_outstrms = numberout;
3468         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_stream_change_event);
3469         SCTP_BUF_NEXT(m_notify) = NULL;
3470         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3471                 /* no space */
3472                 sctp_m_freem(m_notify);
3473                 return;
3474         }
3475         /* append to socket */
3476         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3477             0, 0, stcb->asoc.context, 0, 0, 0,
3478             m_notify);
3479         if (control == NULL) {
3480                 /* no memory */
3481                 sctp_m_freem(m_notify);
3482                 return;
3483         }
3484         control->length = SCTP_BUF_LEN(m_notify);
3485         control->spec_flags = M_NOTIFICATION;
3486         /* not that we need this */
3487         control->tail_mbuf = m_notify;
3488         sctp_add_to_readq(stcb->sctp_ep, stcb,
3489             control,
3490             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3491 }
3492
3493 void
3494 sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb, uint32_t sending_tsn, uint32_t recv_tsn, int flag)
3495 {
3496         struct mbuf *m_notify;
3497         struct sctp_queued_to_read *control;
3498         struct sctp_assoc_reset_event *strasoc;
3499
3500         if ((stcb == NULL) ||
3501             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT))) {
3502                 /* event not enabled */
3503                 return;
3504         }
3505         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_reset_event), 0, M_NOWAIT, 1, MT_DATA);
3506         if (m_notify == NULL)
3507                 /* no space left */
3508                 return;
3509         SCTP_BUF_LEN(m_notify) = 0;
3510         strasoc = mtod(m_notify, struct sctp_assoc_reset_event *);
3511         memset(strasoc, 0, sizeof(struct sctp_assoc_reset_event));
3512         strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT;
3513         strasoc->assocreset_flags = flag;
3514         strasoc->assocreset_length = sizeof(struct sctp_assoc_reset_event);
3515         strasoc->assocreset_assoc_id = sctp_get_associd(stcb);
3516         strasoc->assocreset_local_tsn = sending_tsn;
3517         strasoc->assocreset_remote_tsn = recv_tsn;
3518         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_assoc_reset_event);
3519         SCTP_BUF_NEXT(m_notify) = NULL;
3520         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3521                 /* no space */
3522                 sctp_m_freem(m_notify);
3523                 return;
3524         }
3525         /* append to socket */
3526         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3527             0, 0, stcb->asoc.context, 0, 0, 0,
3528             m_notify);
3529         if (control == NULL) {
3530                 /* no memory */
3531                 sctp_m_freem(m_notify);
3532                 return;
3533         }
3534         control->length = SCTP_BUF_LEN(m_notify);
3535         control->spec_flags = M_NOTIFICATION;
3536         /* not that we need this */
3537         control->tail_mbuf = m_notify;
3538         sctp_add_to_readq(stcb->sctp_ep, stcb,
3539             control,
3540             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3541 }
3542
3543
3544
3545 static void
3546 sctp_notify_stream_reset(struct sctp_tcb *stcb,
3547     int number_entries, uint16_t * list, int flag)
3548 {
3549         struct mbuf *m_notify;
3550         struct sctp_queued_to_read *control;
3551         struct sctp_stream_reset_event *strreset;
3552         int len;
3553
3554         if ((stcb == NULL) ||
3555             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_RESETEVNT))) {
3556                 /* event not enabled */
3557                 return;
3558         }
3559
3560         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_NOWAIT, 1, MT_DATA);
3561         if (m_notify == NULL)
3562                 /* no space left */
3563                 return;
3564         SCTP_BUF_LEN(m_notify) = 0;
3565         len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
3566         if (len > M_TRAILINGSPACE(m_notify)) {
3567                 /* never enough room */
3568                 sctp_m_freem(m_notify);
3569                 return;
3570         }
3571         strreset = mtod(m_notify, struct sctp_stream_reset_event *);
3572         memset(strreset, 0, len);
3573         strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
3574         strreset->strreset_flags = flag;
3575         strreset->strreset_length = len;
3576         strreset->strreset_assoc_id = sctp_get_associd(stcb);
3577         if (number_entries) {
3578                 int i;
3579
3580                 for (i = 0; i < number_entries; i++) {
3581                         strreset->strreset_stream_list[i] = ntohs(list[i]);
3582                 }
3583         }
3584         SCTP_BUF_LEN(m_notify) = len;
3585         SCTP_BUF_NEXT(m_notify) = NULL;
3586         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3587                 /* no space */
3588                 sctp_m_freem(m_notify);
3589                 return;
3590         }
3591         /* append to socket */
3592         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3593             0, 0, stcb->asoc.context, 0, 0, 0,
3594             m_notify);
3595         if (control == NULL) {
3596                 /* no memory */
3597                 sctp_m_freem(m_notify);
3598                 return;
3599         }
3600         control->length = SCTP_BUF_LEN(m_notify);
3601         control->spec_flags = M_NOTIFICATION;
3602         /* not that we need this */
3603         control->tail_mbuf = m_notify;
3604         sctp_add_to_readq(stcb->sctp_ep, stcb,
3605             control,
3606             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3607 }
3608
3609
3610 static void
3611 sctp_notify_remote_error(struct sctp_tcb *stcb, uint16_t error, struct sctp_error_chunk *chunk)
3612 {
3613         struct mbuf *m_notify;
3614         struct sctp_remote_error *sre;
3615         struct sctp_queued_to_read *control;
3616         unsigned int notif_len;
3617         uint16_t chunk_len;
3618
3619         if ((stcb == NULL) ||
3620             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPEERERR)) {
3621                 return;
3622         }
3623         if (chunk != NULL) {
3624                 chunk_len = ntohs(chunk->ch.chunk_length);
3625                 /*
3626                  * Only SCTP_CHUNK_BUFFER_SIZE are guaranteed to be
3627                  * contiguous.
3628                  */
3629                 if (chunk_len > SCTP_CHUNK_BUFFER_SIZE) {
3630                         chunk_len = SCTP_CHUNK_BUFFER_SIZE;
3631                 }
3632         } else {
3633                 chunk_len = 0;
3634         }
3635         notif_len = (unsigned int)(sizeof(struct sctp_remote_error) + chunk_len);
3636         m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3637         if (m_notify == NULL) {
3638                 /* Retry with smaller value. */
3639                 notif_len = (unsigned int)sizeof(struct sctp_remote_error);
3640                 m_notify = sctp_get_mbuf_for_msg(notif_len, 0, M_NOWAIT, 1, MT_DATA);
3641                 if (m_notify == NULL) {
3642                         return;
3643                 }
3644         }
3645         SCTP_BUF_NEXT(m_notify) = NULL;
3646         sre = mtod(m_notify, struct sctp_remote_error *);
3647         memset(sre, 0, notif_len);
3648         sre->sre_type = SCTP_REMOTE_ERROR;
3649         sre->sre_flags = 0;
3650         sre->sre_length = sizeof(struct sctp_remote_error);
3651         sre->sre_error = error;
3652         sre->sre_assoc_id = sctp_get_associd(stcb);
3653         if (notif_len > sizeof(struct sctp_remote_error)) {
3654                 memcpy(sre->sre_data, chunk, chunk_len);
3655                 sre->sre_length += chunk_len;
3656         }
3657         SCTP_BUF_LEN(m_notify) = sre->sre_length;
3658         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3659             0, 0, stcb->asoc.context, 0, 0, 0,
3660             m_notify);
3661         if (control != NULL) {
3662                 control->length = SCTP_BUF_LEN(m_notify);
3663                 control->spec_flags = M_NOTIFICATION;
3664                 /* not that we need this */
3665                 control->tail_mbuf = m_notify;
3666                 sctp_add_to_readq(stcb->sctp_ep, stcb,
3667                     control,
3668                     &stcb->sctp_socket->so_rcv, 1,
3669                     SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3670         } else {
3671                 sctp_m_freem(m_notify);
3672         }
3673 }
3674
3675
3676 void
3677 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb,
3678     uint32_t error, void *data, int so_locked
3679 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3680     SCTP_UNUSED
3681 #endif
3682 )
3683 {
3684         if ((stcb == NULL) ||
3685             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3686             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3687             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3688                 /* If the socket is gone we are out of here */
3689                 return;
3690         }
3691         if (stcb->sctp_socket->so_rcv.sb_state & SBS_CANTRCVMORE) {
3692                 return;
3693         }
3694         if ((stcb->asoc.state & SCTP_STATE_COOKIE_WAIT) ||
3695             (stcb->asoc.state & SCTP_STATE_COOKIE_ECHOED)) {
3696                 if ((notification == SCTP_NOTIFY_INTERFACE_DOWN) ||
3697                     (notification == SCTP_NOTIFY_INTERFACE_UP) ||
3698                     (notification == SCTP_NOTIFY_INTERFACE_CONFIRMED)) {
3699                         /* Don't report these in front states */
3700                         return;
3701                 }
3702         }
3703         switch (notification) {
3704         case SCTP_NOTIFY_ASSOC_UP:
3705                 if (stcb->asoc.assoc_up_sent == 0) {
3706                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, NULL, 0, so_locked);
3707                         stcb->asoc.assoc_up_sent = 1;
3708                 }
3709                 if (stcb->asoc.adaptation_needed && (stcb->asoc.adaptation_sent == 0)) {
3710                         sctp_notify_adaptation_layer(stcb);
3711                 }
3712                 if (stcb->asoc.auth_supported == 0) {
3713                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3714                             NULL, so_locked);
3715                 }
3716                 break;
3717         case SCTP_NOTIFY_ASSOC_DOWN:
3718                 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, NULL, 0, so_locked);
3719                 break;
3720         case SCTP_NOTIFY_INTERFACE_DOWN:
3721                 {
3722                         struct sctp_nets *net;
3723
3724                         net = (struct sctp_nets *)data;
3725                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE,
3726                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
3727                         break;
3728                 }
3729         case SCTP_NOTIFY_INTERFACE_UP:
3730                 {
3731                         struct sctp_nets *net;
3732
3733                         net = (struct sctp_nets *)data;
3734                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE,
3735                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
3736                         break;
3737                 }
3738         case SCTP_NOTIFY_INTERFACE_CONFIRMED:
3739                 {
3740                         struct sctp_nets *net;
3741
3742                         net = (struct sctp_nets *)data;
3743                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED,
3744                             (struct sockaddr *)&net->ro._l_addr, error, so_locked);
3745                         break;
3746                 }
3747         case SCTP_NOTIFY_SPECIAL_SP_FAIL:
3748                 sctp_notify_send_failed2(stcb, error,
3749                     (struct sctp_stream_queue_pending *)data, so_locked);
3750                 break;
3751         case SCTP_NOTIFY_SENT_DG_FAIL:
3752                 sctp_notify_send_failed(stcb, 1, error,
3753                     (struct sctp_tmit_chunk *)data, so_locked);
3754                 break;
3755         case SCTP_NOTIFY_UNSENT_DG_FAIL:
3756                 sctp_notify_send_failed(stcb, 0, error,
3757                     (struct sctp_tmit_chunk *)data, so_locked);
3758                 break;
3759         case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION:
3760                 {
3761                         uint32_t val;
3762
3763                         val = *((uint32_t *) data);
3764
3765                         sctp_notify_partial_delivery_indication(stcb, error, val, so_locked);
3766                         break;
3767                 }
3768         case SCTP_NOTIFY_ASSOC_LOC_ABORTED:
3769                 if (((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_WAIT) ||
3770                     ((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_ECHOED)) {
3771                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 0, so_locked);
3772                 } else {
3773                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 0, so_locked);
3774                 }
3775                 break;
3776         case SCTP_NOTIFY_ASSOC_REM_ABORTED:
3777                 if (((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_WAIT) ||
3778                     ((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_ECHOED)) {
3779                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, data, 1, so_locked);
3780                 } else {
3781                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, data, 1, so_locked);
3782                 }
3783                 break;
3784         case SCTP_NOTIFY_ASSOC_RESTART:
3785                 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, NULL, 0, so_locked);
3786                 if (stcb->asoc.auth_supported == 0) {
3787                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3788                             NULL, so_locked);
3789                 }
3790                 break;
3791         case SCTP_NOTIFY_STR_RESET_SEND:
3792                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STREAM_RESET_OUTGOING_SSN);
3793                 break;
3794         case SCTP_NOTIFY_STR_RESET_RECV:
3795                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STREAM_RESET_INCOMING);
3796                 break;
3797         case SCTP_NOTIFY_STR_RESET_FAILED_OUT:
3798                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3799                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_FAILED));
3800                 break;
3801         case SCTP_NOTIFY_STR_RESET_DENIED_OUT:
3802                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3803                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_DENIED));
3804                 break;
3805         case SCTP_NOTIFY_STR_RESET_FAILED_IN:
3806                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3807                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_FAILED));
3808                 break;
3809         case SCTP_NOTIFY_STR_RESET_DENIED_IN:
3810                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3811                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_DENIED));
3812                 break;
3813         case SCTP_NOTIFY_ASCONF_ADD_IP:
3814                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data,
3815                     error, so_locked);
3816                 break;
3817         case SCTP_NOTIFY_ASCONF_DELETE_IP:
3818                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data,
3819                     error, so_locked);
3820                 break;
3821         case SCTP_NOTIFY_ASCONF_SET_PRIMARY:
3822                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data,
3823                     error, so_locked);
3824                 break;
3825         case SCTP_NOTIFY_PEER_SHUTDOWN:
3826                 sctp_notify_shutdown_event(stcb);
3827                 break;
3828         case SCTP_NOTIFY_AUTH_NEW_KEY:
3829                 sctp_notify_authentication(stcb, SCTP_AUTH_NEW_KEY, error,
3830                     (uint16_t) (uintptr_t) data,
3831                     so_locked);
3832                 break;
3833         case SCTP_NOTIFY_AUTH_FREE_KEY:
3834                 sctp_notify_authentication(stcb, SCTP_AUTH_FREE_KEY, error,
3835                     (uint16_t) (uintptr_t) data,
3836                     so_locked);
3837                 break;
3838         case SCTP_NOTIFY_NO_PEER_AUTH:
3839                 sctp_notify_authentication(stcb, SCTP_AUTH_NO_AUTH, error,
3840                     (uint16_t) (uintptr_t) data,
3841                     so_locked);
3842                 break;
3843         case SCTP_NOTIFY_SENDER_DRY:
3844                 sctp_notify_sender_dry_event(stcb, so_locked);
3845                 break;
3846         case SCTP_NOTIFY_REMOTE_ERROR:
3847                 sctp_notify_remote_error(stcb, error, data);
3848                 break;
3849         default:
3850                 SCTPDBG(SCTP_DEBUG_UTIL1, "%s: unknown notification %xh (%u)\n",
3851                     __func__, notification, notification);
3852                 break;
3853         }                       /* end switch */
3854 }
3855
3856 void
3857 sctp_report_all_outbound(struct sctp_tcb *stcb, uint16_t error, int holds_lock, int so_locked
3858 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3859     SCTP_UNUSED
3860 #endif
3861 )
3862 {
3863         struct sctp_association *asoc;
3864         struct sctp_stream_out *outs;
3865         struct sctp_tmit_chunk *chk, *nchk;
3866         struct sctp_stream_queue_pending *sp, *nsp;
3867         int i;
3868
3869         if (stcb == NULL) {
3870                 return;
3871         }
3872         asoc = &stcb->asoc;
3873         if (asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) {
3874                 /* already being freed */
3875                 return;
3876         }
3877         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3878             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3879             (asoc->state & SCTP_STATE_CLOSED_SOCKET)) {
3880                 return;
3881         }
3882         /* now through all the gunk freeing chunks */
3883         if (holds_lock == 0) {
3884                 SCTP_TCB_SEND_LOCK(stcb);
3885         }
3886         /* sent queue SHOULD be empty */
3887         TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) {
3888                 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
3889                 asoc->sent_queue_cnt--;
3890                 if (chk->sent != SCTP_DATAGRAM_NR_ACKED) {
3891                         if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
3892                                 asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
3893 #ifdef INVARIANTS
3894                         } else {
3895                                 panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
3896 #endif
3897                         }
3898                 }
3899                 if (chk->data != NULL) {
3900                         sctp_free_bufspace(stcb, asoc, chk, 1);
3901                         sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb,
3902                             error, chk, so_locked);
3903                         if (chk->data) {
3904                                 sctp_m_freem(chk->data);
3905                                 chk->data = NULL;
3906                         }
3907                 }
3908                 sctp_free_a_chunk(stcb, chk, so_locked);
3909                 /* sa_ignore FREED_MEMORY */
3910         }
3911         /* pending send queue SHOULD be empty */
3912         TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
3913                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
3914                 asoc->send_queue_cnt--;
3915                 if (asoc->strmout[chk->rec.data.sid].chunks_on_queues > 0) {
3916                         asoc->strmout[chk->rec.data.sid].chunks_on_queues--;
3917 #ifdef INVARIANTS
3918                 } else {
3919                         panic("No chunks on the queues for sid %u.", chk->rec.data.sid);
3920 #endif
3921                 }
3922                 if (chk->data != NULL) {
3923                         sctp_free_bufspace(stcb, asoc, chk, 1);
3924                         sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb,
3925                             error, chk, so_locked);
3926                         if (chk->data) {
3927                                 sctp_m_freem(chk->data);
3928                                 chk->data = NULL;
3929                         }
3930                 }
3931                 sctp_free_a_chunk(stcb, chk, so_locked);
3932                 /* sa_ignore FREED_MEMORY */
3933         }
3934         for (i = 0; i < asoc->streamoutcnt; i++) {
3935                 /* For each stream */
3936                 outs = &asoc->strmout[i];
3937                 /* clean up any sends there */
3938                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
3939                         atomic_subtract_int(&asoc->stream_queue_cnt, 1);
3940                         TAILQ_REMOVE(&outs->outqueue, sp, next);
3941                         stcb->asoc.ss_functions.sctp_ss_remove_from_stream(stcb, asoc, outs, sp, holds_lock);
3942                         sctp_free_spbufspace(stcb, asoc, sp);
3943                         if (sp->data) {
3944                                 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
3945                                     error, (void *)sp, so_locked);
3946                                 if (sp->data) {
3947                                         sctp_m_freem(sp->data);
3948                                         sp->data = NULL;
3949                                         sp->tail_mbuf = NULL;
3950                                         sp->length = 0;
3951                                 }
3952                         }
3953                         if (sp->net) {
3954                                 sctp_free_remote_addr(sp->net);
3955                                 sp->net = NULL;
3956                         }
3957                         /* Free the chunk */
3958                         sctp_free_a_strmoq(stcb, sp, so_locked);
3959                         /* sa_ignore FREED_MEMORY */
3960                 }
3961         }
3962
3963         if (holds_lock == 0) {
3964                 SCTP_TCB_SEND_UNLOCK(stcb);
3965         }
3966 }
3967
3968 void
3969 sctp_abort_notification(struct sctp_tcb *stcb, uint8_t from_peer, uint16_t error,
3970     struct sctp_abort_chunk *abort, int so_locked
3971 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3972     SCTP_UNUSED
3973 #endif
3974 )
3975 {
3976         if (stcb == NULL) {
3977                 return;
3978         }
3979         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
3980             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
3981             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
3982                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED;
3983         }
3984         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3985             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3986             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3987                 return;
3988         }
3989         /* Tell them we lost the asoc */
3990         sctp_report_all_outbound(stcb, error, 1, so_locked);
3991         if (from_peer) {
3992                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_REM_ABORTED, stcb, error, abort, so_locked);
3993         } else {
3994                 sctp_ulp_notify(SCTP_NOTIFY_ASSOC_LOC_ABORTED, stcb, error, abort, so_locked);
3995         }
3996 }
3997
3998 void
3999 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
4000     struct mbuf *m, int iphlen,
4001     struct sockaddr *src, struct sockaddr *dst,
4002     struct sctphdr *sh, struct mbuf *op_err,
4003     uint8_t mflowtype, uint32_t mflowid,
4004     uint32_t vrf_id, uint16_t port)
4005 {
4006         uint32_t vtag;
4007 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4008         struct socket *so;
4009 #endif
4010
4011         vtag = 0;
4012         if (stcb != NULL) {
4013                 vtag = stcb->asoc.peer_vtag;
4014                 vrf_id = stcb->asoc.vrf_id;
4015         }
4016         sctp_send_abort(m, iphlen, src, dst, sh, vtag, op_err,
4017             mflowtype, mflowid, inp->fibnum,
4018             vrf_id, port);
4019         if (stcb != NULL) {
4020                 /* We have a TCB to abort, send notification too */
4021                 sctp_abort_notification(stcb, 0, 0, NULL, SCTP_SO_NOT_LOCKED);
4022                 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
4023                 /* Ok, now lets free it */
4024 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4025                 so = SCTP_INP_SO(inp);
4026                 atomic_add_int(&stcb->asoc.refcnt, 1);
4027                 SCTP_TCB_UNLOCK(stcb);
4028                 SCTP_SOCKET_LOCK(so, 1);
4029                 SCTP_TCB_LOCK(stcb);
4030                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4031 #endif
4032                 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4033                 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
4034                     (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4035                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4036                 }
4037                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4038                     SCTP_FROM_SCTPUTIL + SCTP_LOC_4);
4039 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4040                 SCTP_SOCKET_UNLOCK(so, 1);
4041 #endif
4042         }
4043 }
4044 #ifdef SCTP_ASOCLOG_OF_TSNS
4045 void
4046 sctp_print_out_track_log(struct sctp_tcb *stcb)
4047 {
4048 #ifdef NOSIY_PRINTS
4049         int i;
4050
4051         SCTP_PRINTF("Last ep reason:%x\n", stcb->sctp_ep->last_abort_code);
4052         SCTP_PRINTF("IN bound TSN log-aaa\n");
4053         if ((stcb->asoc.tsn_in_at == 0) && (stcb->asoc.tsn_in_wrapped == 0)) {
4054                 SCTP_PRINTF("None rcvd\n");
4055                 goto none_in;
4056         }
4057         if (stcb->asoc.tsn_in_wrapped) {
4058                 for (i = stcb->asoc.tsn_in_at; i < SCTP_TSN_LOG_SIZE; i++) {
4059                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4060                             stcb->asoc.in_tsnlog[i].tsn,
4061                             stcb->asoc.in_tsnlog[i].strm,
4062                             stcb->asoc.in_tsnlog[i].seq,
4063                             stcb->asoc.in_tsnlog[i].flgs,
4064                             stcb->asoc.in_tsnlog[i].sz);
4065                 }
4066         }
4067         if (stcb->asoc.tsn_in_at) {
4068                 for (i = 0; i < stcb->asoc.tsn_in_at; i++) {
4069                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4070                             stcb->asoc.in_tsnlog[i].tsn,
4071                             stcb->asoc.in_tsnlog[i].strm,
4072                             stcb->asoc.in_tsnlog[i].seq,
4073                             stcb->asoc.in_tsnlog[i].flgs,
4074                             stcb->asoc.in_tsnlog[i].sz);
4075                 }
4076         }
4077 none_in:
4078         SCTP_PRINTF("OUT bound TSN log-aaa\n");
4079         if ((stcb->asoc.tsn_out_at == 0) &&
4080             (stcb->asoc.tsn_out_wrapped == 0)) {
4081                 SCTP_PRINTF("None sent\n");
4082         }
4083         if (stcb->asoc.tsn_out_wrapped) {
4084                 for (i = stcb->asoc.tsn_out_at; i < SCTP_TSN_LOG_SIZE; i++) {
4085                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4086                             stcb->asoc.out_tsnlog[i].tsn,
4087                             stcb->asoc.out_tsnlog[i].strm,
4088                             stcb->asoc.out_tsnlog[i].seq,
4089                             stcb->asoc.out_tsnlog[i].flgs,
4090                             stcb->asoc.out_tsnlog[i].sz);
4091                 }
4092         }
4093         if (stcb->asoc.tsn_out_at) {
4094                 for (i = 0; i < stcb->asoc.tsn_out_at; i++) {
4095                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
4096                             stcb->asoc.out_tsnlog[i].tsn,
4097                             stcb->asoc.out_tsnlog[i].strm,
4098                             stcb->asoc.out_tsnlog[i].seq,
4099                             stcb->asoc.out_tsnlog[i].flgs,
4100                             stcb->asoc.out_tsnlog[i].sz);
4101                 }
4102         }
4103 #endif
4104 }
4105 #endif
4106
4107 void
4108 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
4109     struct mbuf *op_err,
4110     int so_locked
4111 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4112     SCTP_UNUSED
4113 #endif
4114 )
4115 {
4116 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4117         struct socket *so;
4118 #endif
4119
4120 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4121         so = SCTP_INP_SO(inp);
4122 #endif
4123         if (stcb == NULL) {
4124                 /* Got to have a TCB */
4125                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4126                         if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4127                                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4128                                     SCTP_CALLED_DIRECTLY_NOCMPSET);
4129                         }
4130                 }
4131                 return;
4132         } else {
4133                 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
4134         }
4135         /* notify the peer */
4136         sctp_send_abort_tcb(stcb, op_err, so_locked);
4137         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
4138         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
4139             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
4140                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
4141         }
4142         /* notify the ulp */
4143         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0) {
4144                 sctp_abort_notification(stcb, 0, 0, NULL, so_locked);
4145         }
4146         /* now free the asoc */
4147 #ifdef SCTP_ASOCLOG_OF_TSNS
4148         sctp_print_out_track_log(stcb);
4149 #endif
4150 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4151         if (!so_locked) {
4152                 atomic_add_int(&stcb->asoc.refcnt, 1);
4153                 SCTP_TCB_UNLOCK(stcb);
4154                 SCTP_SOCKET_LOCK(so, 1);
4155                 SCTP_TCB_LOCK(stcb);
4156                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4157         }
4158 #endif
4159         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
4160             SCTP_FROM_SCTPUTIL + SCTP_LOC_5);
4161 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4162         if (!so_locked) {
4163                 SCTP_SOCKET_UNLOCK(so, 1);
4164         }
4165 #endif
4166 }
4167
4168 void
4169 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset,
4170     struct sockaddr *src, struct sockaddr *dst,
4171     struct sctphdr *sh, struct sctp_inpcb *inp,
4172     struct mbuf *cause,
4173     uint8_t mflowtype, uint32_t mflowid, uint16_t fibnum,
4174     uint32_t vrf_id, uint16_t port)
4175 {
4176         struct sctp_chunkhdr *ch, chunk_buf;
4177         unsigned int chk_length;
4178         int contains_init_chunk;
4179
4180         SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue);
4181         /* Generate a TO address for future reference */
4182         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
4183                 if (LIST_EMPTY(&inp->sctp_asoc_list)) {
4184                         sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
4185                             SCTP_CALLED_DIRECTLY_NOCMPSET);
4186                 }
4187         }
4188         contains_init_chunk = 0;
4189         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4190             sizeof(*ch), (uint8_t *) & chunk_buf);
4191         while (ch != NULL) {
4192                 chk_length = ntohs(ch->chunk_length);
4193                 if (chk_length < sizeof(*ch)) {
4194                         /* break to abort land */
4195                         break;
4196                 }
4197                 switch (ch->chunk_type) {
4198                 case SCTP_INIT:
4199                         contains_init_chunk = 1;
4200                         break;
4201                 case SCTP_PACKET_DROPPED:
4202                         /* we don't respond to pkt-dropped */
4203                         return;
4204                 case SCTP_ABORT_ASSOCIATION:
4205                         /* we don't respond with an ABORT to an ABORT */
4206                         return;
4207                 case SCTP_SHUTDOWN_COMPLETE:
4208                         /*
4209                          * we ignore it since we are not waiting for it and
4210                          * peer is gone
4211                          */
4212                         return;
4213                 case SCTP_SHUTDOWN_ACK:
4214                         sctp_send_shutdown_complete2(src, dst, sh,
4215                             mflowtype, mflowid, fibnum,
4216                             vrf_id, port);
4217                         return;
4218                 default:
4219                         break;
4220                 }
4221                 offset += SCTP_SIZE32(chk_length);
4222                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4223                     sizeof(*ch), (uint8_t *) & chunk_buf);
4224         }
4225         if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
4226             ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
4227             (contains_init_chunk == 0))) {
4228                 sctp_send_abort(m, iphlen, src, dst, sh, 0, cause,
4229                     mflowtype, mflowid, fibnum,
4230                     vrf_id, port);
4231         }
4232 }
4233
4234 /*
4235  * check the inbound datagram to make sure there is not an abort inside it,
4236  * if there is return 1, else return 0.
4237  */
4238 int
4239 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t * vtagfill)
4240 {
4241         struct sctp_chunkhdr *ch;
4242         struct sctp_init_chunk *init_chk, chunk_buf;
4243         int offset;
4244         unsigned int chk_length;
4245
4246         offset = iphlen + sizeof(struct sctphdr);
4247         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch),
4248             (uint8_t *) & chunk_buf);
4249         while (ch != NULL) {
4250                 chk_length = ntohs(ch->chunk_length);
4251                 if (chk_length < sizeof(*ch)) {
4252                         /* packet is probably corrupt */
4253                         break;
4254                 }
4255                 /* we seem to be ok, is it an abort? */
4256                 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) {
4257                         /* yep, tell them */
4258                         return (1);
4259                 }
4260                 if (ch->chunk_type == SCTP_INITIATION) {
4261                         /* need to update the Vtag */
4262                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
4263                             offset, sizeof(*init_chk), (uint8_t *) & chunk_buf);
4264                         if (init_chk != NULL) {
4265                                 *vtagfill = ntohl(init_chk->init.initiate_tag);
4266                         }
4267                 }
4268                 /* Nope, move to the next chunk */
4269                 offset += SCTP_SIZE32(chk_length);
4270                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4271                     sizeof(*ch), (uint8_t *) & chunk_buf);
4272         }
4273         return (0);
4274 }
4275
4276 /*
4277  * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id
4278  * set (i.e. it's 0) so, create this function to compare link local scopes
4279  */
4280 #ifdef INET6
4281 uint32_t
4282 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2){
4283         struct sockaddr_in6 a, b;
4284
4285         /* save copies */
4286         a = *addr1;
4287         b = *addr2;
4288
4289         if (a.sin6_scope_id == 0)
4290                 if (sa6_recoverscope(&a)) {
4291                         /* can't get scope, so can't match */
4292                         return (0);
4293                 }
4294         if (b.sin6_scope_id == 0)
4295                 if (sa6_recoverscope(&b)) {
4296                         /* can't get scope, so can't match */
4297                         return (0);
4298                 }
4299         if (a.sin6_scope_id != b.sin6_scope_id)
4300                 return (0);
4301
4302         return (1);
4303 }
4304
4305 /*
4306  * returns a sockaddr_in6 with embedded scope recovered and removed
4307  */
4308 struct sockaddr_in6 *
4309 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store)
4310 {
4311         /* check and strip embedded scope junk */
4312         if (addr->sin6_family == AF_INET6) {
4313                 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) {
4314                         if (addr->sin6_scope_id == 0) {
4315                                 *store = *addr;
4316                                 if (!sa6_recoverscope(store)) {
4317                                         /* use the recovered scope */
4318                                         addr = store;
4319                                 }
4320                         } else {
4321                                 /* else, return the original "to" addr */
4322                                 in6_clearscope(&addr->sin6_addr);
4323                         }
4324                 }
4325         }
4326         return (addr);
4327 }
4328 #endif
4329
4330 /*
4331  * are the two addresses the same?  currently a "scopeless" check returns: 1
4332  * if same, 0 if not
4333  */
4334 int
4335 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2)
4336 {
4337
4338         /* must be valid */
4339         if (sa1 == NULL || sa2 == NULL)
4340                 return (0);
4341
4342         /* must be the same family */
4343         if (sa1->sa_family != sa2->sa_family)
4344                 return (0);
4345
4346         switch (sa1->sa_family) {
4347 #ifdef INET6
4348         case AF_INET6:
4349                 {
4350                         /* IPv6 addresses */
4351                         struct sockaddr_in6 *sin6_1, *sin6_2;
4352
4353                         sin6_1 = (struct sockaddr_in6 *)sa1;
4354                         sin6_2 = (struct sockaddr_in6 *)sa2;
4355                         return (SCTP6_ARE_ADDR_EQUAL(sin6_1,
4356                             sin6_2));
4357                 }
4358 #endif
4359 #ifdef INET
4360         case AF_INET:
4361                 {
4362                         /* IPv4 addresses */
4363                         struct sockaddr_in *sin_1, *sin_2;
4364
4365                         sin_1 = (struct sockaddr_in *)sa1;
4366                         sin_2 = (struct sockaddr_in *)sa2;
4367                         return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr);
4368                 }
4369 #endif
4370         default:
4371                 /* we don't do these... */
4372                 return (0);
4373         }
4374 }
4375
4376 void
4377 sctp_print_address(struct sockaddr *sa)
4378 {
4379 #ifdef INET6
4380         char ip6buf[INET6_ADDRSTRLEN];
4381 #endif
4382
4383         switch (sa->sa_family) {
4384 #ifdef INET6
4385         case AF_INET6:
4386                 {
4387                         struct sockaddr_in6 *sin6;
4388
4389                         sin6 = (struct sockaddr_in6 *)sa;
4390                         SCTP_PRINTF("IPv6 address: %s:port:%d scope:%u\n",
4391                             ip6_sprintf(ip6buf, &sin6->sin6_addr),
4392                             ntohs(sin6->sin6_port),
4393                             sin6->sin6_scope_id);
4394                         break;
4395                 }
4396 #endif
4397 #ifdef INET
4398         case AF_INET:
4399                 {
4400                         struct sockaddr_in *sin;
4401                         unsigned char *p;
4402
4403                         sin = (struct sockaddr_in *)sa;
4404                         p = (unsigned char *)&sin->sin_addr;
4405                         SCTP_PRINTF("IPv4 address: %u.%u.%u.%u:%d\n",
4406                             p[0], p[1], p[2], p[3], ntohs(sin->sin_port));
4407                         break;
4408                 }
4409 #endif
4410         default:
4411                 SCTP_PRINTF("?\n");
4412                 break;
4413         }
4414 }
4415
4416 void
4417 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
4418     struct sctp_inpcb *new_inp,
4419     struct sctp_tcb *stcb,
4420     int waitflags)
4421 {
4422         /*
4423          * go through our old INP and pull off any control structures that
4424          * belong to stcb and move then to the new inp.
4425          */
4426         struct socket *old_so, *new_so;
4427         struct sctp_queued_to_read *control, *nctl;
4428         struct sctp_readhead tmp_queue;
4429         struct mbuf *m;
4430         int error = 0;
4431
4432         old_so = old_inp->sctp_socket;
4433         new_so = new_inp->sctp_socket;
4434         TAILQ_INIT(&tmp_queue);
4435         error = sblock(&old_so->so_rcv, waitflags);
4436         if (error) {
4437                 /*
4438                  * Gak, can't get sblock, we have a problem. data will be
4439                  * left stranded.. and we don't dare look at it since the
4440                  * other thread may be reading something. Oh well, its a
4441                  * screwed up app that does a peeloff OR a accept while
4442                  * reading from the main socket... actually its only the
4443                  * peeloff() case, since I think read will fail on a
4444                  * listening socket..
4445                  */
4446                 return;
4447         }
4448         /* lock the socket buffers */
4449         SCTP_INP_READ_LOCK(old_inp);
4450         TAILQ_FOREACH_SAFE(control, &old_inp->read_queue, next, nctl) {
4451                 /* Pull off all for out target stcb */
4452                 if (control->stcb == stcb) {
4453                         /* remove it we want it */
4454                         TAILQ_REMOVE(&old_inp->read_queue, control, next);
4455                         TAILQ_INSERT_TAIL(&tmp_queue, control, next);
4456                         m = control->data;
4457                         while (m) {
4458                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4459                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
4460                                 }
4461                                 sctp_sbfree(control, stcb, &old_so->so_rcv, m);
4462                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4463                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4464                                 }
4465                                 m = SCTP_BUF_NEXT(m);
4466                         }
4467                 }
4468         }
4469         SCTP_INP_READ_UNLOCK(old_inp);
4470         /* Remove the sb-lock on the old socket */
4471
4472         sbunlock(&old_so->so_rcv);
4473         /* Now we move them over to the new socket buffer */
4474         SCTP_INP_READ_LOCK(new_inp);
4475         TAILQ_FOREACH_SAFE(control, &tmp_queue, next, nctl) {
4476                 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next);
4477                 m = control->data;
4478                 while (m) {
4479                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4480                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4481                         }
4482                         sctp_sballoc(stcb, &new_so->so_rcv, m);
4483                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4484                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4485                         }
4486                         m = SCTP_BUF_NEXT(m);
4487                 }
4488         }
4489         SCTP_INP_READ_UNLOCK(new_inp);
4490 }
4491
4492 void
4493 sctp_wakeup_the_read_socket(struct sctp_inpcb *inp,
4494     struct sctp_tcb *stcb,
4495     int so_locked
4496 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4497     SCTP_UNUSED
4498 #endif
4499 )
4500 {
4501         if ((inp != NULL) && (inp->sctp_socket != NULL)) {
4502 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4503                 struct socket *so;
4504
4505                 so = SCTP_INP_SO(inp);
4506                 if (!so_locked) {
4507                         if (stcb) {
4508                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4509                                 SCTP_TCB_UNLOCK(stcb);
4510                         }
4511                         SCTP_SOCKET_LOCK(so, 1);
4512                         if (stcb) {
4513                                 SCTP_TCB_LOCK(stcb);
4514                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4515                         }
4516                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4517                                 SCTP_SOCKET_UNLOCK(so, 1);
4518                                 return;
4519                         }
4520                 }
4521 #endif
4522                 sctp_sorwakeup(inp, inp->sctp_socket);
4523 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4524                 if (!so_locked) {
4525                         SCTP_SOCKET_UNLOCK(so, 1);
4526                 }
4527 #endif
4528         }
4529 }
4530
4531 void
4532 sctp_add_to_readq(struct sctp_inpcb *inp,
4533     struct sctp_tcb *stcb,
4534     struct sctp_queued_to_read *control,
4535     struct sockbuf *sb,
4536     int end,
4537     int inp_read_lock_held,
4538     int so_locked
4539 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4540     SCTP_UNUSED
4541 #endif
4542 )
4543 {
4544         /*
4545          * Here we must place the control on the end of the socket read
4546          * queue AND increment sb_cc so that select will work properly on
4547          * read.
4548          */
4549         struct mbuf *m, *prev = NULL;
4550
4551         if (inp == NULL) {
4552                 /* Gak, TSNH!! */
4553 #ifdef INVARIANTS
4554                 panic("Gak, inp NULL on add_to_readq");
4555 #endif
4556                 return;
4557         }
4558         if (inp_read_lock_held == 0)
4559                 SCTP_INP_READ_LOCK(inp);
4560         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
4561                 sctp_free_remote_addr(control->whoFrom);
4562                 if (control->data) {
4563                         sctp_m_freem(control->data);
4564                         control->data = NULL;
4565                 }
4566                 sctp_free_a_readq(stcb, control);
4567                 if (inp_read_lock_held == 0)
4568                         SCTP_INP_READ_UNLOCK(inp);
4569                 return;
4570         }
4571         if (!(control->spec_flags & M_NOTIFICATION)) {
4572                 atomic_add_int(&inp->total_recvs, 1);
4573                 if (!control->do_not_ref_stcb) {
4574                         atomic_add_int(&stcb->total_recvs, 1);
4575                 }
4576         }
4577         m = control->data;
4578         control->held_length = 0;
4579         control->length = 0;
4580         while (m) {
4581                 if (SCTP_BUF_LEN(m) == 0) {
4582                         /* Skip mbufs with NO length */
4583                         if (prev == NULL) {
4584                                 /* First one */
4585                                 control->data = sctp_m_free(m);
4586                                 m = control->data;
4587                         } else {
4588                                 SCTP_BUF_NEXT(prev) = sctp_m_free(m);
4589                                 m = SCTP_BUF_NEXT(prev);
4590                         }
4591                         if (m == NULL) {
4592                                 control->tail_mbuf = prev;
4593                         }
4594                         continue;
4595                 }
4596                 prev = m;
4597                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4598                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4599                 }
4600                 sctp_sballoc(stcb, sb, m);
4601                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4602                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4603                 }
4604                 atomic_add_int(&control->length, SCTP_BUF_LEN(m));
4605                 m = SCTP_BUF_NEXT(m);
4606         }
4607         if (prev != NULL) {
4608                 control->tail_mbuf = prev;
4609         } else {
4610                 /* Everything got collapsed out?? */
4611                 sctp_free_remote_addr(control->whoFrom);
4612                 sctp_free_a_readq(stcb, control);
4613                 if (inp_read_lock_held == 0)
4614                         SCTP_INP_READ_UNLOCK(inp);
4615                 return;
4616         }
4617         if (end) {
4618                 control->end_added = 1;
4619         }
4620         TAILQ_INSERT_TAIL(&inp->read_queue, control, next);
4621         control->on_read_q = 1;
4622         if (inp_read_lock_held == 0)
4623                 SCTP_INP_READ_UNLOCK(inp);
4624         if (inp && inp->sctp_socket) {
4625                 sctp_wakeup_the_read_socket(inp, stcb, so_locked);
4626         }
4627 }
4628
4629 /*************HOLD THIS COMMENT FOR PATCH FILE OF
4630  *************ALTERNATE ROUTING CODE
4631  */
4632
4633 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF
4634  *************ALTERNATE ROUTING CODE
4635  */
4636
4637 struct mbuf *
4638 sctp_generate_cause(uint16_t code, char *info)
4639 {
4640         struct mbuf *m;
4641         struct sctp_gen_error_cause *cause;
4642         size_t info_len;
4643         uint16_t len;
4644
4645         if ((code == 0) || (info == NULL)) {
4646                 return (NULL);
4647         }
4648         info_len = strlen(info);
4649         if (info_len > (SCTP_MAX_CAUSE_LENGTH - sizeof(struct sctp_paramhdr))) {
4650                 return (NULL);
4651         }
4652         len = (uint16_t) (sizeof(struct sctp_paramhdr) + info_len);
4653         m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
4654         if (m != NULL) {
4655                 SCTP_BUF_LEN(m) = len;
4656                 cause = mtod(m, struct sctp_gen_error_cause *);
4657                 cause->code = htons(code);
4658                 cause->length = htons(len);
4659                 memcpy(cause->info, info, info_len);
4660         }
4661         return (m);
4662 }
4663
4664 struct mbuf *
4665 sctp_generate_no_user_data_cause(uint32_t tsn)
4666 {
4667         struct mbuf *m;
4668         struct sctp_error_no_user_data *no_user_data_cause;
4669         uint16_t len;
4670
4671         len = (uint16_t) sizeof(struct sctp_error_no_user_data);
4672         m = sctp_get_mbuf_for_msg(len, 0, M_NOWAIT, 1, MT_DATA);
4673         if (m != NULL) {
4674                 SCTP_BUF_LEN(m) = len;
4675                 no_user_data_cause = mtod(m, struct sctp_error_no_user_data *);
4676                 no_user_data_cause->cause.code = htons(SCTP_CAUSE_NO_USER_DATA);
4677                 no_user_data_cause->cause.length = htons(len);
4678                 no_user_data_cause->tsn = htonl(tsn);
4679         }
4680         return (m);
4681 }
4682
4683 #ifdef SCTP_MBCNT_LOGGING
4684 void
4685 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc,
4686     struct sctp_tmit_chunk *tp1, int chk_cnt)
4687 {
4688         if (tp1->data == NULL) {
4689                 return;
4690         }
4691         asoc->chunks_on_out_queue -= chk_cnt;
4692         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBCNT_LOGGING_ENABLE) {
4693                 sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE,
4694                     asoc->total_output_queue_size,
4695                     tp1->book_size,
4696                     0,
4697                     tp1->mbcnt);
4698         }
4699         if (asoc->total_output_queue_size >= tp1->book_size) {
4700                 atomic_add_int(&asoc->total_output_queue_size, -tp1->book_size);
4701         } else {
4702                 asoc->total_output_queue_size = 0;
4703         }
4704
4705         if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) ||
4706             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) {
4707                 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) {
4708                         stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size;
4709                 } else {
4710                         stcb->sctp_socket->so_snd.sb_cc = 0;
4711
4712                 }
4713         }
4714 }
4715
4716 #endif
4717
4718 int
4719 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1,
4720     uint8_t sent, int so_locked
4721 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4722     SCTP_UNUSED
4723 #endif
4724 )
4725 {
4726         struct sctp_stream_out *strq;
4727         struct sctp_tmit_chunk *chk = NULL, *tp2;
4728         struct sctp_stream_queue_pending *sp;
4729         uint32_t mid;
4730         uint16_t sid;
4731         uint8_t foundeom = 0;
4732         int ret_sz = 0;
4733         int notdone;
4734         int do_wakeup_routine = 0;
4735
4736         sid = tp1->rec.data.sid;
4737         mid = tp1->rec.data.mid;
4738         if (sent || !(tp1->rec.data.rcv_flags & SCTP_DATA_FIRST_FRAG)) {
4739                 stcb->asoc.abandoned_sent[0]++;
4740                 stcb->asoc.abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
4741                 stcb->asoc.strmout[sid].abandoned_sent[0]++;
4742 #if defined(SCTP_DETAILED_STR_STATS)
4743                 stcb->asoc.strmout[sid].abandoned_sent[PR_SCTP_POLICY(tp1->flags)]++;
4744 #endif
4745         } else {
4746                 stcb->asoc.abandoned_unsent[0]++;
4747                 stcb->asoc.abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
4748                 stcb->asoc.strmout[sid].abandoned_unsent[0]++;
4749 #if defined(SCTP_DETAILED_STR_STATS)
4750                 stcb->asoc.strmout[sid].abandoned_unsent[PR_SCTP_POLICY(tp1->flags)]++;
4751 #endif
4752         }
4753         do {
4754                 ret_sz += tp1->book_size;
4755                 if (tp1->data != NULL) {
4756                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4757                                 sctp_flight_size_decrease(tp1);
4758                                 sctp_total_flight_decrease(stcb, tp1);
4759                         }
4760                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4761                         stcb->asoc.peers_rwnd += tp1->send_size;
4762                         stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh);
4763                         if (sent) {
4764                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
4765                         } else {
4766                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
4767                         }
4768                         if (tp1->data) {
4769                                 sctp_m_freem(tp1->data);
4770                                 tp1->data = NULL;
4771                         }
4772                         do_wakeup_routine = 1;
4773                         if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
4774                                 stcb->asoc.sent_queue_cnt_removeable--;
4775                         }
4776                 }
4777                 tp1->sent = SCTP_FORWARD_TSN_SKIP;
4778                 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
4779                     SCTP_DATA_NOT_FRAG) {
4780                         /* not frag'ed we ae done   */
4781                         notdone = 0;
4782                         foundeom = 1;
4783                 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4784                         /* end of frag, we are done */
4785                         notdone = 0;
4786                         foundeom = 1;
4787                 } else {
4788                         /*
4789                          * Its a begin or middle piece, we must mark all of
4790                          * it
4791                          */
4792                         notdone = 1;
4793                         tp1 = TAILQ_NEXT(tp1, sctp_next);
4794                 }
4795         } while (tp1 && notdone);
4796         if (foundeom == 0) {
4797                 /*
4798                  * The multi-part message was scattered across the send and
4799                  * sent queue.
4800                  */
4801                 TAILQ_FOREACH_SAFE(tp1, &stcb->asoc.send_queue, sctp_next, tp2) {
4802                         if ((tp1->rec.data.sid != sid) ||
4803                             (!SCTP_MID_EQ(stcb->asoc.idata_supported, tp1->rec.data.mid, mid))) {
4804                                 break;
4805                         }
4806                         /*
4807                          * save to chk in case we have some on stream out
4808                          * queue. If so and we have an un-transmitted one we
4809                          * don't have to fudge the TSN.
4810                          */
4811                         chk = tp1;
4812                         ret_sz += tp1->book_size;
4813                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4814                         if (sent) {
4815                                 sctp_ulp_notify(SCTP_NOTIFY_SENT_DG_FAIL, stcb, 0, tp1, so_locked);
4816                         } else {
4817                                 sctp_ulp_notify(SCTP_NOTIFY_UNSENT_DG_FAIL, stcb, 0, tp1, so_locked);
4818                         }
4819                         if (tp1->data) {
4820                                 sctp_m_freem(tp1->data);
4821                                 tp1->data = NULL;
4822                         }
4823                         /* No flight involved here book the size to 0 */
4824                         tp1->book_size = 0;
4825                         if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4826                                 foundeom = 1;
4827                         }
4828                         do_wakeup_routine = 1;
4829                         tp1->sent = SCTP_FORWARD_TSN_SKIP;
4830                         TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next);
4831                         /*
4832                          * on to the sent queue so we can wait for it to be
4833                          * passed by.
4834                          */
4835                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1,
4836                             sctp_next);
4837                         stcb->asoc.send_queue_cnt--;
4838                         stcb->asoc.sent_queue_cnt++;
4839                 }
4840         }
4841         if (foundeom == 0) {
4842                 /*
4843                  * Still no eom found. That means there is stuff left on the
4844                  * stream out queue.. yuck.
4845                  */
4846                 SCTP_TCB_SEND_LOCK(stcb);
4847                 strq = &stcb->asoc.strmout[sid];
4848                 sp = TAILQ_FIRST(&strq->outqueue);
4849                 if (sp != NULL) {
4850                         sp->discard_rest = 1;
4851                         /*
4852                          * We may need to put a chunk on the queue that
4853                          * holds the TSN that would have been sent with the
4854                          * LAST bit.
4855                          */
4856                         if (chk == NULL) {
4857                                 /* Yep, we have to */
4858                                 sctp_alloc_a_chunk(stcb, chk);
4859                                 if (chk == NULL) {
4860                                         /*
4861                                          * we are hosed. All we can do is
4862                                          * nothing.. which will cause an
4863                                          * abort if the peer is paying
4864                                          * attention.
4865                                          */
4866                                         goto oh_well;
4867                                 }
4868                                 memset(chk, 0, sizeof(*chk));
4869                                 chk->rec.data.rcv_flags = 0;
4870                                 chk->sent = SCTP_FORWARD_TSN_SKIP;
4871                                 chk->asoc = &stcb->asoc;
4872                                 if (stcb->asoc.idata_supported == 0) {
4873                                         if (sp->sinfo_flags & SCTP_UNORDERED) {
4874                                                 chk->rec.data.mid = 0;
4875                                         } else {
4876                                                 chk->rec.data.mid = strq->next_mid_ordered;
4877                                         }
4878                                 } else {
4879                                         if (sp->sinfo_flags & SCTP_UNORDERED) {
4880                                                 chk->rec.data.mid = strq->next_mid_unordered;
4881                                         } else {
4882                                                 chk->rec.data.mid = strq->next_mid_ordered;
4883                                         }
4884                                 }
4885                                 chk->rec.data.sid = sp->sid;
4886                                 chk->rec.data.ppid = sp->ppid;
4887                                 chk->rec.data.context = sp->context;
4888                                 chk->flags = sp->act_flags;
4889                                 chk->whoTo = NULL;
4890                                 chk->rec.data.tsn = atomic_fetchadd_int(&stcb->asoc.sending_seq, 1);
4891                                 strq->chunks_on_queues++;
4892                                 TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, chk, sctp_next);
4893                                 stcb->asoc.sent_queue_cnt++;
4894                                 stcb->asoc.pr_sctp_cnt++;
4895                         }
4896                         chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
4897                         if (sp->sinfo_flags & SCTP_UNORDERED) {
4898                                 chk->rec.data.rcv_flags |= SCTP_DATA_UNORDERED;
4899                         }
4900                         if (stcb->asoc.idata_supported == 0) {
4901                                 if ((sp->sinfo_flags & SCTP_UNORDERED) == 0) {
4902                                         strq->next_mid_ordered++;
4903                                 }
4904                         } else {
4905                                 if (sp->sinfo_flags & SCTP_UNORDERED) {
4906                                         strq->next_mid_unordered++;
4907                                 } else {
4908                                         strq->next_mid_ordered++;
4909                                 }
4910                         }
4911         oh_well:
4912                         if (sp->data) {
4913                                 /*
4914                                  * Pull any data to free up the SB and allow
4915                                  * sender to "add more" while we will throw
4916                                  * away :-)
4917                                  */
4918                                 sctp_free_spbufspace(stcb, &stcb->asoc, sp);
4919                                 ret_sz += sp->length;
4920                                 do_wakeup_routine = 1;
4921                                 sp->some_taken = 1;
4922                                 sctp_m_freem(sp->data);
4923                                 sp->data = NULL;
4924                                 sp->tail_mbuf = NULL;
4925                                 sp->length = 0;
4926                         }
4927                 }
4928                 SCTP_TCB_SEND_UNLOCK(stcb);
4929         }
4930         if (do_wakeup_routine) {
4931 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4932                 struct socket *so;
4933
4934                 so = SCTP_INP_SO(stcb->sctp_ep);
4935                 if (!so_locked) {
4936                         atomic_add_int(&stcb->asoc.refcnt, 1);
4937                         SCTP_TCB_UNLOCK(stcb);
4938                         SCTP_SOCKET_LOCK(so, 1);
4939                         SCTP_TCB_LOCK(stcb);
4940                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
4941                         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
4942                                 /* assoc was freed while we were unlocked */
4943                                 SCTP_SOCKET_UNLOCK(so, 1);
4944                                 return (ret_sz);
4945                         }
4946                 }
4947 #endif
4948                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
4949 #if defined(__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4950                 if (!so_locked) {
4951                         SCTP_SOCKET_UNLOCK(so, 1);
4952                 }
4953 #endif
4954         }
4955         return (ret_sz);
4956 }
4957
4958 /*
4959  * checks to see if the given address, sa, is one that is currently known by
4960  * the kernel note: can't distinguish the same address on multiple interfaces
4961  * and doesn't handle multiple addresses with different zone/scope id's note:
4962  * ifa_ifwithaddr() compares the entire sockaddr struct
4963  */
4964 struct sctp_ifa *
4965 sctp_find_ifa_in_ep(struct sctp_inpcb *inp, struct sockaddr *addr,
4966     int holds_lock)
4967 {
4968         struct sctp_laddr *laddr;
4969
4970         if (holds_lock == 0) {
4971                 SCTP_INP_RLOCK(inp);
4972         }
4973
4974         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
4975                 if (laddr->ifa == NULL)
4976                         continue;
4977                 if (addr->sa_family != laddr->ifa->address.sa.sa_family)
4978                         continue;
4979 #ifdef INET
4980                 if (addr->sa_family == AF_INET) {
4981                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
4982                             laddr->ifa->address.sin.sin_addr.s_addr) {
4983                                 /* found him. */
4984                                 if (holds_lock == 0) {
4985                                         SCTP_INP_RUNLOCK(inp);
4986                                 }
4987                                 return (laddr->ifa);
4988                                 break;
4989                         }
4990                 }
4991 #endif
4992 #ifdef INET6
4993                 if (addr->sa_family == AF_INET6) {
4994                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
4995                             &laddr->ifa->address.sin6)) {
4996                                 /* found him. */
4997                                 if (holds_lock == 0) {
4998                                         SCTP_INP_RUNLOCK(inp);
4999                                 }
5000                                 return (laddr->ifa);
5001                                 break;
5002                         }
5003                 }
5004 #endif
5005         }
5006         if (holds_lock == 0) {
5007                 SCTP_INP_RUNLOCK(inp);
5008         }
5009         return (NULL);
5010 }
5011
5012 uint32_t
5013 sctp_get_ifa_hash_val(struct sockaddr *addr){
5014         switch (addr->sa_family) {
5015 #ifdef INET
5016         case AF_INET:
5017                 {
5018                         struct sockaddr_in *sin;
5019
5020                         sin = (struct sockaddr_in *)addr;
5021                         return (sin->sin_addr.s_addr ^ (sin->sin_addr.s_addr >> 16));
5022                 }
5023 #endif
5024 #ifdef INET6
5025         case AF_INET6:
5026                 {
5027                         struct sockaddr_in6 *sin6;
5028                         uint32_t hash_of_addr;
5029
5030                         sin6 = (struct sockaddr_in6 *)addr;
5031                         hash_of_addr = (sin6->sin6_addr.s6_addr32[0] +
5032                             sin6->sin6_addr.s6_addr32[1] +
5033                             sin6->sin6_addr.s6_addr32[2] +
5034                             sin6->sin6_addr.s6_addr32[3]);
5035                         hash_of_addr = (hash_of_addr ^ (hash_of_addr >> 16));
5036                         return (hash_of_addr);
5037                 }
5038 #endif
5039         default:
5040                 break;
5041         }
5042         return (0);
5043 }
5044
5045 struct sctp_ifa *
5046 sctp_find_ifa_by_addr(struct sockaddr *addr, uint32_t vrf_id, int holds_lock)
5047 {
5048         struct sctp_ifa *sctp_ifap;
5049         struct sctp_vrf *vrf;
5050         struct sctp_ifalist *hash_head;
5051         uint32_t hash_of_addr;
5052
5053         if (holds_lock == 0)
5054                 SCTP_IPI_ADDR_RLOCK();
5055
5056         vrf = sctp_find_vrf(vrf_id);
5057         if (vrf == NULL) {
5058                 if (holds_lock == 0)
5059                         SCTP_IPI_ADDR_RUNLOCK();
5060                 return (NULL);
5061         }
5062
5063         hash_of_addr = sctp_get_ifa_hash_val(addr);
5064
5065         hash_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)];
5066         if (hash_head == NULL) {
5067                 SCTP_PRINTF("hash_of_addr:%x mask:%x table:%x - ",
5068                     hash_of_addr, (uint32_t) vrf->vrf_addr_hashmark,
5069                     (uint32_t) (hash_of_addr & vrf->vrf_addr_hashmark));
5070                 sctp_print_address(addr);
5071                 SCTP_PRINTF("No such bucket for address\n");
5072                 if (holds_lock == 0)
5073                         SCTP_IPI_ADDR_RUNLOCK();
5074
5075                 return (NULL);
5076         }
5077         LIST_FOREACH(sctp_ifap, hash_head, next_bucket) {
5078                 if (addr->sa_family != sctp_ifap->address.sa.sa_family)
5079                         continue;
5080 #ifdef INET
5081                 if (addr->sa_family == AF_INET) {
5082                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
5083                             sctp_ifap->address.sin.sin_addr.s_addr) {
5084                                 /* found him. */
5085                                 if (holds_lock == 0)
5086                                         SCTP_IPI_ADDR_RUNLOCK();
5087                                 return (sctp_ifap);
5088                                 break;
5089                         }
5090                 }
5091 #endif
5092 #ifdef INET6
5093                 if (addr->sa_family == AF_INET6) {
5094                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
5095                             &sctp_ifap->address.sin6)) {
5096                                 /* found him. */
5097                                 if (holds_lock == 0)
5098                                         SCTP_IPI_ADDR_RUNLOCK();
5099                                 return (sctp_ifap);
5100                                 break;
5101                         }
5102                 }
5103 #endif
5104         }
5105         if (holds_lock == 0)
5106                 SCTP_IPI_ADDR_RUNLOCK();
5107         return (NULL);
5108 }
5109
5110 static void
5111 sctp_user_rcvd(struct sctp_tcb *stcb, uint32_t * freed_so_far, int hold_rlock,
5112     uint32_t rwnd_req)
5113 {
5114         /* User pulled some data, do we need a rwnd update? */
5115         int r_unlocked = 0;
5116         uint32_t dif, rwnd;
5117         struct socket *so = NULL;
5118
5119         if (stcb == NULL)
5120                 return;
5121
5122         atomic_add_int(&stcb->asoc.refcnt, 1);
5123
5124         if (stcb->asoc.state & (SCTP_STATE_ABOUT_TO_BE_FREED |
5125             SCTP_STATE_SHUTDOWN_RECEIVED |
5126             SCTP_STATE_SHUTDOWN_ACK_SENT)) {
5127                 /* Pre-check If we are freeing no update */
5128                 goto no_lock;
5129         }
5130         SCTP_INP_INCR_REF(stcb->sctp_ep);
5131         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5132             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5133                 goto out;
5134         }
5135         so = stcb->sctp_socket;
5136         if (so == NULL) {
5137                 goto out;
5138         }
5139         atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far);
5140         /* Have you have freed enough to look */
5141         *freed_so_far = 0;
5142         /* Yep, its worth a look and the lock overhead */
5143
5144         /* Figure out what the rwnd would be */
5145         rwnd = sctp_calc_rwnd(stcb, &stcb->asoc);
5146         if (rwnd >= stcb->asoc.my_last_reported_rwnd) {
5147                 dif = rwnd - stcb->asoc.my_last_reported_rwnd;
5148         } else {
5149                 dif = 0;
5150         }
5151         if (dif >= rwnd_req) {
5152                 if (hold_rlock) {
5153                         SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5154                         r_unlocked = 1;
5155                 }
5156                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5157                         /*
5158                          * One last check before we allow the guy possibly
5159                          * to get in. There is a race, where the guy has not
5160                          * reached the gate. In that case
5161                          */
5162                         goto out;
5163                 }
5164                 SCTP_TCB_LOCK(stcb);
5165                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5166                         /* No reports here */
5167                         SCTP_TCB_UNLOCK(stcb);
5168                         goto out;
5169                 }
5170                 SCTP_STAT_INCR(sctps_wu_sacks_sent);
5171                 sctp_send_sack(stcb, SCTP_SO_LOCKED);
5172
5173                 sctp_chunk_output(stcb->sctp_ep, stcb,
5174                     SCTP_OUTPUT_FROM_USR_RCVD, SCTP_SO_LOCKED);
5175                 /* make sure no timer is running */
5176                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL,
5177                     SCTP_FROM_SCTPUTIL + SCTP_LOC_6);
5178                 SCTP_TCB_UNLOCK(stcb);
5179         } else {
5180                 /* Update how much we have pending */
5181                 stcb->freed_by_sorcv_sincelast = dif;
5182         }
5183 out:
5184         if (so && r_unlocked && hold_rlock) {
5185                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
5186         }
5187
5188         SCTP_INP_DECR_REF(stcb->sctp_ep);
5189 no_lock:
5190         atomic_add_int(&stcb->asoc.refcnt, -1);
5191         return;
5192 }
5193
5194 int
5195 sctp_sorecvmsg(struct socket *so,
5196     struct uio *uio,
5197     struct mbuf **mp,
5198     struct sockaddr *from,
5199     int fromlen,
5200     int *msg_flags,
5201     struct sctp_sndrcvinfo *sinfo,
5202     int filling_sinfo)
5203 {
5204         /*
5205          * MSG flags we will look at MSG_DONTWAIT - non-blocking IO.
5206          * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy
5207          * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ??
5208          * On the way out we may send out any combination of:
5209          * MSG_NOTIFICATION MSG_EOR
5210          *
5211          */
5212         struct sctp_inpcb *inp = NULL;
5213         int my_len = 0;
5214         int cp_len = 0, error = 0;
5215         struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
5216         struct mbuf *m = NULL;
5217         struct sctp_tcb *stcb = NULL;
5218         int wakeup_read_socket = 0;
5219         int freecnt_applied = 0;
5220         int out_flags = 0, in_flags = 0;
5221         int block_allowed = 1;
5222         uint32_t freed_so_far = 0;
5223         uint32_t copied_so_far = 0;
5224         int in_eeor_mode = 0;
5225         int no_rcv_needed = 0;
5226         uint32_t rwnd_req = 0;
5227         int hold_sblock = 0;
5228         int hold_rlock = 0;
5229         ssize_t slen = 0;
5230         uint32_t held_length = 0;
5231         int sockbuf_lock = 0;
5232
5233         if (uio == NULL) {
5234                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5235                 return (EINVAL);
5236         }
5237
5238         if (msg_flags) {
5239                 in_flags = *msg_flags;
5240                 if (in_flags & MSG_PEEK)
5241                         SCTP_STAT_INCR(sctps_read_peeks);
5242         } else {
5243                 in_flags = 0;
5244         }
5245         slen = uio->uio_resid;
5246
5247         /* Pull in and set up our int flags */
5248         if (in_flags & MSG_OOB) {
5249                 /* Out of band's NOT supported */
5250                 return (EOPNOTSUPP);
5251         }
5252         if ((in_flags & MSG_PEEK) && (mp != NULL)) {
5253                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5254                 return (EINVAL);
5255         }
5256         if ((in_flags & (MSG_DONTWAIT
5257             | MSG_NBIO
5258             )) ||
5259             SCTP_SO_IS_NBIO(so)) {
5260                 block_allowed = 0;
5261         }
5262         /* setup the endpoint */
5263         inp = (struct sctp_inpcb *)so->so_pcb;
5264         if (inp == NULL) {
5265                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
5266                 return (EFAULT);
5267         }
5268         rwnd_req = (SCTP_SB_LIMIT_RCV(so) >> SCTP_RWND_HIWAT_SHIFT);
5269         /* Must be at least a MTU's worth */
5270         if (rwnd_req < SCTP_MIN_RWND)
5271                 rwnd_req = SCTP_MIN_RWND;
5272         in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
5273         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5274                 sctp_misc_ints(SCTP_SORECV_ENTER,
5275                     rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, (uint32_t) uio->uio_resid);
5276         }
5277         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5278                 sctp_misc_ints(SCTP_SORECV_ENTERPL,
5279                     rwnd_req, block_allowed, so->so_rcv.sb_cc, (uint32_t) uio->uio_resid);
5280         }
5281
5282
5283         error = sblock(&so->so_rcv, (block_allowed ? SBL_WAIT : 0));
5284         if (error) {
5285                 goto release_unlocked;
5286         }
5287         sockbuf_lock = 1;
5288 restart:
5289
5290
5291 restart_nosblocks:
5292         if (hold_sblock == 0) {
5293                 SOCKBUF_LOCK(&so->so_rcv);
5294                 hold_sblock = 1;
5295         }
5296         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5297             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5298                 goto out;
5299         }
5300         if ((so->so_rcv.sb_state & SBS_CANTRCVMORE) && (so->so_rcv.sb_cc == 0)) {
5301                 if (so->so_error) {
5302                         error = so->so_error;
5303                         if ((in_flags & MSG_PEEK) == 0)
5304                                 so->so_error = 0;
5305                         goto out;
5306                 } else {
5307                         if (so->so_rcv.sb_cc == 0) {
5308                                 /* indicate EOF */
5309                                 error = 0;
5310                                 goto out;
5311                         }
5312                 }
5313         }
5314         if (so->so_rcv.sb_cc <= held_length) {
5315                 if (so->so_error) {
5316                         error = so->so_error;
5317                         if ((in_flags & MSG_PEEK) == 0) {
5318                                 so->so_error = 0;
5319                         }
5320                         goto out;
5321                 }
5322                 if ((so->so_rcv.sb_cc == 0) &&
5323                     ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5324                     (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) {
5325                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5326                                 /*
5327                                  * For active open side clear flags for
5328                                  * re-use passive open is blocked by
5329                                  * connect.
5330                                  */
5331                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5332                                         /*
5333                                          * You were aborted, passive side
5334                                          * always hits here
5335                                          */
5336                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5337                                         error = ECONNRESET;
5338                                 }
5339                                 so->so_state &= ~(SS_ISCONNECTING |
5340                                     SS_ISDISCONNECTING |
5341                                     SS_ISCONFIRMING |
5342                                     SS_ISCONNECTED);
5343                                 if (error == 0) {
5344                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5345                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5346                                                 error = ENOTCONN;
5347                                         }
5348                                 }
5349                                 goto out;
5350                         }
5351                 }
5352                 if (block_allowed) {
5353                         error = sbwait(&so->so_rcv);
5354                         if (error) {
5355                                 goto out;
5356                         }
5357                         held_length = 0;
5358                         goto restart_nosblocks;
5359                 } else {
5360                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EWOULDBLOCK);
5361                         error = EWOULDBLOCK;
5362                         goto out;
5363                 }
5364         }
5365         if (hold_sblock == 1) {
5366                 SOCKBUF_UNLOCK(&so->so_rcv);
5367                 hold_sblock = 0;
5368         }
5369         /* we possibly have data we can read */
5370         /* sa_ignore FREED_MEMORY */
5371         control = TAILQ_FIRST(&inp->read_queue);
5372         if (control == NULL) {
5373                 /*
5374                  * This could be happening since the appender did the
5375                  * increment but as not yet did the tailq insert onto the
5376                  * read_queue
5377                  */
5378                 if (hold_rlock == 0) {
5379                         SCTP_INP_READ_LOCK(inp);
5380                 }
5381                 control = TAILQ_FIRST(&inp->read_queue);
5382                 if ((control == NULL) && (so->so_rcv.sb_cc != 0)) {
5383 #ifdef INVARIANTS
5384                         panic("Huh, its non zero and nothing on control?");
5385 #endif
5386                         so->so_rcv.sb_cc = 0;
5387                 }
5388                 SCTP_INP_READ_UNLOCK(inp);
5389                 hold_rlock = 0;
5390                 goto restart;
5391         }
5392
5393         if ((control->length == 0) &&
5394             (control->do_not_ref_stcb)) {
5395                 /*
5396                  * Clean up code for freeing assoc that left behind a
5397                  * pdapi.. maybe a peer in EEOR that just closed after
5398                  * sending and never indicated a EOR.
5399                  */
5400                 if (hold_rlock == 0) {
5401                         hold_rlock = 1;
5402                         SCTP_INP_READ_LOCK(inp);
5403                 }
5404                 control->held_length = 0;
5405                 if (control->data) {
5406                         /* Hmm there is data here .. fix */
5407                         struct mbuf *m_tmp;
5408                         int cnt = 0;
5409
5410                         m_tmp = control->data;
5411                         while (m_tmp) {
5412                                 cnt += SCTP_BUF_LEN(m_tmp);
5413                                 if (SCTP_BUF_NEXT(m_tmp) == NULL) {
5414                                         control->tail_mbuf = m_tmp;
5415                                         control->end_added = 1;
5416                                 }
5417                                 m_tmp = SCTP_BUF_NEXT(m_tmp);
5418                         }
5419                         control->length = cnt;
5420                 } else {
5421                         /* remove it */
5422                         TAILQ_REMOVE(&inp->read_queue, control, next);
5423                         /* Add back any hiddend data */
5424                         sctp_free_remote_addr(control->whoFrom);
5425                         sctp_free_a_readq(stcb, control);
5426                 }
5427                 if (hold_rlock) {
5428                         hold_rlock = 0;
5429                         SCTP_INP_READ_UNLOCK(inp);
5430                 }
5431                 goto restart;
5432         }
5433         if ((control->length == 0) &&
5434             (control->end_added == 1)) {
5435                 /*
5436                  * Do we also need to check for (control->pdapi_aborted ==
5437                  * 1)?
5438                  */
5439                 if (hold_rlock == 0) {
5440                         hold_rlock = 1;
5441                         SCTP_INP_READ_LOCK(inp);
5442                 }
5443                 TAILQ_REMOVE(&inp->read_queue, control, next);
5444                 if (control->data) {
5445 #ifdef INVARIANTS
5446                         panic("control->data not null but control->length == 0");
5447 #else
5448                         SCTP_PRINTF("Strange, data left in the control buffer. Cleaning up.\n");
5449                         sctp_m_freem(control->data);
5450                         control->data = NULL;
5451 #endif
5452                 }
5453                 if (control->aux_data) {
5454                         sctp_m_free(control->aux_data);
5455                         control->aux_data = NULL;
5456                 }
5457 #ifdef INVARIANTS
5458                 if (control->on_strm_q) {
5459                         panic("About to free ctl:%p so:%p and its in %d",
5460                             control, so, control->on_strm_q);
5461                 }
5462 #endif
5463                 sctp_free_remote_addr(control->whoFrom);
5464                 sctp_free_a_readq(stcb, control);
5465                 if (hold_rlock) {
5466                         hold_rlock = 0;
5467                         SCTP_INP_READ_UNLOCK(inp);
5468                 }
5469                 goto restart;
5470         }
5471         if (control->length == 0) {
5472                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) &&
5473                     (filling_sinfo)) {
5474                         /* find a more suitable one then this */
5475                         ctl = TAILQ_NEXT(control, next);
5476                         while (ctl) {
5477                                 if ((ctl->stcb != control->stcb) && (ctl->length) &&
5478                                     (ctl->some_taken ||
5479                                     (ctl->spec_flags & M_NOTIFICATION) ||
5480                                     ((ctl->do_not_ref_stcb == 0) &&
5481                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))
5482                                     ) {
5483                                         /*-
5484                                          * If we have a different TCB next, and there is data
5485                                          * present. If we have already taken some (pdapi), OR we can
5486                                          * ref the tcb and no delivery as started on this stream, we
5487                                          * take it. Note we allow a notification on a different
5488                                          * assoc to be delivered..
5489                                          */
5490                                         control = ctl;
5491                                         goto found_one;
5492                                 } else if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS)) &&
5493                                             (ctl->length) &&
5494                                             ((ctl->some_taken) ||
5495                                             ((ctl->do_not_ref_stcb == 0) &&
5496                                             ((ctl->spec_flags & M_NOTIFICATION) == 0) &&
5497                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))) {
5498                                         /*-
5499                                          * If we have the same tcb, and there is data present, and we
5500                                          * have the strm interleave feature present. Then if we have
5501                                          * taken some (pdapi) or we can refer to tht tcb AND we have
5502                                          * not started a delivery for this stream, we can take it.
5503                                          * Note we do NOT allow a notificaiton on the same assoc to
5504                                          * be delivered.
5505                                          */
5506                                         control = ctl;
5507                                         goto found_one;
5508                                 }
5509                                 ctl = TAILQ_NEXT(ctl, next);
5510                         }
5511                 }
5512                 /*
5513                  * if we reach here, not suitable replacement is available
5514                  * <or> fragment interleave is NOT on. So stuff the sb_cc
5515                  * into the our held count, and its time to sleep again.
5516                  */
5517                 held_length = so->so_rcv.sb_cc;
5518                 control->held_length = so->so_rcv.sb_cc;
5519                 goto restart;
5520         }
5521         /* Clear the held length since there is something to read */
5522         control->held_length = 0;
5523 found_one:
5524         /*
5525          * If we reach here, control has a some data for us to read off.
5526          * Note that stcb COULD be NULL.
5527          */
5528         if (hold_rlock == 0) {
5529                 hold_rlock = 1;
5530                 SCTP_INP_READ_LOCK(inp);
5531         }
5532         control->some_taken++;
5533         stcb = control->stcb;
5534         if (stcb) {
5535                 if ((control->do_not_ref_stcb == 0) &&
5536                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5537                         if (freecnt_applied == 0)
5538                                 stcb = NULL;
5539                 } else if (control->do_not_ref_stcb == 0) {
5540                         /* you can't free it on me please */
5541                         /*
5542                          * The lock on the socket buffer protects us so the
5543                          * free code will stop. But since we used the
5544                          * socketbuf lock and the sender uses the tcb_lock
5545                          * to increment, we need to use the atomic add to
5546                          * the refcnt
5547                          */
5548                         if (freecnt_applied) {
5549 #ifdef INVARIANTS
5550                                 panic("refcnt already incremented");
5551 #else
5552                                 SCTP_PRINTF("refcnt already incremented?\n");
5553 #endif
5554                         } else {
5555                                 atomic_add_int(&stcb->asoc.refcnt, 1);
5556                                 freecnt_applied = 1;
5557                         }
5558                         /*
5559                          * Setup to remember how much we have not yet told
5560                          * the peer our rwnd has opened up. Note we grab the
5561                          * value from the tcb from last time. Note too that
5562                          * sack sending clears this when a sack is sent,
5563                          * which is fine. Once we hit the rwnd_req, we then
5564                          * will go to the sctp_user_rcvd() that will not
5565                          * lock until it KNOWs it MUST send a WUP-SACK.
5566                          */
5567                         freed_so_far = stcb->freed_by_sorcv_sincelast;
5568                         stcb->freed_by_sorcv_sincelast = 0;
5569                 }
5570         }
5571         if (stcb &&
5572             ((control->spec_flags & M_NOTIFICATION) == 0) &&
5573             control->do_not_ref_stcb == 0) {
5574                 stcb->asoc.strmin[control->sinfo_stream].delivery_started = 1;
5575         }
5576
5577         /* First lets get off the sinfo and sockaddr info */
5578         if ((sinfo != NULL) && (filling_sinfo != 0)) {
5579                 sinfo->sinfo_stream = control->sinfo_stream;
5580                 sinfo->sinfo_ssn = (uint16_t) control->mid;
5581                 sinfo->sinfo_flags = control->sinfo_flags;
5582                 sinfo->sinfo_ppid = control->sinfo_ppid;
5583                 sinfo->sinfo_context = control->sinfo_context;
5584                 sinfo->sinfo_timetolive = control->sinfo_timetolive;
5585                 sinfo->sinfo_tsn = control->sinfo_tsn;
5586                 sinfo->sinfo_cumtsn = control->sinfo_cumtsn;
5587                 sinfo->sinfo_assoc_id = control->sinfo_assoc_id;
5588                 nxt = TAILQ_NEXT(control, next);
5589                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
5590                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) {
5591                         struct sctp_extrcvinfo *s_extra;
5592
5593                         s_extra = (struct sctp_extrcvinfo *)sinfo;
5594                         if ((nxt) &&
5595                             (nxt->length)) {
5596                                 s_extra->serinfo_next_flags = SCTP_NEXT_MSG_AVAIL;
5597                                 if (nxt->sinfo_flags & SCTP_UNORDERED) {
5598                                         s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_UNORDERED;
5599                                 }
5600                                 if (nxt->spec_flags & M_NOTIFICATION) {
5601                                         s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_IS_NOTIFICATION;
5602                                 }
5603                                 s_extra->serinfo_next_aid = nxt->sinfo_assoc_id;
5604                                 s_extra->serinfo_next_length = nxt->length;
5605                                 s_extra->serinfo_next_ppid = nxt->sinfo_ppid;
5606                                 s_extra->serinfo_next_stream = nxt->sinfo_stream;
5607                                 if (nxt->tail_mbuf != NULL) {
5608                                         if (nxt->end_added) {
5609                                                 s_extra->serinfo_next_flags |= SCTP_NEXT_MSG_ISCOMPLETE;
5610                                         }
5611                                 }
5612                         } else {
5613                                 /*
5614                                  * we explicitly 0 this, since the memcpy
5615                                  * got some other things beyond the older
5616                                  * sinfo_ that is on the control's structure
5617                                  * :-D
5618                                  */
5619                                 nxt = NULL;
5620                                 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG;
5621                                 s_extra->serinfo_next_aid = 0;
5622                                 s_extra->serinfo_next_length = 0;
5623                                 s_extra->serinfo_next_ppid = 0;
5624                                 s_extra->serinfo_next_stream = 0;
5625                         }
5626                 }
5627                 /*
5628                  * update off the real current cum-ack, if we have an stcb.
5629                  */
5630                 if ((control->do_not_ref_stcb == 0) && stcb)
5631                         sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
5632                 /*
5633                  * mask off the high bits, we keep the actual chunk bits in
5634                  * there.
5635                  */
5636                 sinfo->sinfo_flags &= 0x00ff;
5637                 if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) {
5638                         sinfo->sinfo_flags |= SCTP_UNORDERED;
5639                 }
5640         }
5641 #ifdef SCTP_ASOCLOG_OF_TSNS
5642         {
5643                 int index, newindex;
5644                 struct sctp_pcbtsn_rlog *entry;
5645
5646                 do {
5647                         index = inp->readlog_index;
5648                         newindex = index + 1;
5649                         if (newindex >= SCTP_READ_LOG_SIZE) {
5650                                 newindex = 0;
5651                         }
5652                 } while (atomic_cmpset_int(&inp->readlog_index, index, newindex) == 0);
5653                 entry = &inp->readlog[index];
5654                 entry->vtag = control->sinfo_assoc_id;
5655                 entry->strm = control->sinfo_stream;
5656                 entry->seq = (uint16_t) control->mid;
5657                 entry->sz = control->length;
5658                 entry->flgs = control->sinfo_flags;
5659         }
5660 #endif
5661         if ((fromlen > 0) && (from != NULL)) {
5662                 union sctp_sockstore store;
5663                 size_t len;
5664
5665                 switch (control->whoFrom->ro._l_addr.sa.sa_family) {
5666 #ifdef INET6
5667                 case AF_INET6:
5668                         len = sizeof(struct sockaddr_in6);
5669                         store.sin6 = control->whoFrom->ro._l_addr.sin6;
5670                         store.sin6.sin6_port = control->port_from;
5671                         break;
5672 #endif
5673 #ifdef INET
5674                 case AF_INET:
5675 #ifdef INET6
5676                         if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) {
5677                                 len = sizeof(struct sockaddr_in6);
5678                                 in6_sin_2_v4mapsin6(&control->whoFrom->ro._l_addr.sin,
5679                                     &store.sin6);
5680                                 store.sin6.sin6_port = control->port_from;
5681                         } else {
5682                                 len = sizeof(struct sockaddr_in);
5683                                 store.sin = control->whoFrom->ro._l_addr.sin;
5684                                 store.sin.sin_port = control->port_from;
5685                         }
5686 #else
5687                         len = sizeof(struct sockaddr_in);
5688                         store.sin = control->whoFrom->ro._l_addr.sin;
5689                         store.sin.sin_port = control->port_from;
5690 #endif
5691                         break;
5692 #endif
5693                 default:
5694                         len = 0;
5695                         break;
5696                 }
5697                 memcpy(from, &store, min((size_t)fromlen, len));
5698 #ifdef INET6
5699                 {
5700                         struct sockaddr_in6 lsa6, *from6;
5701
5702                         from6 = (struct sockaddr_in6 *)from;
5703                         sctp_recover_scope_mac(from6, (&lsa6));
5704                 }
5705 #endif
5706         }
5707         if (hold_rlock) {
5708                 SCTP_INP_READ_UNLOCK(inp);
5709                 hold_rlock = 0;
5710         }
5711         if (hold_sblock) {
5712                 SOCKBUF_UNLOCK(&so->so_rcv);
5713                 hold_sblock = 0;
5714         }
5715         /* now copy out what data we can */
5716         if (mp == NULL) {
5717                 /* copy out each mbuf in the chain up to length */
5718 get_more_data:
5719                 m = control->data;
5720                 while (m) {
5721                         /* Move out all we can */
5722                         cp_len = (int)uio->uio_resid;
5723                         my_len = (int)SCTP_BUF_LEN(m);
5724                         if (cp_len > my_len) {
5725                                 /* not enough in this buf */
5726                                 cp_len = my_len;
5727                         }
5728                         if (hold_rlock) {
5729                                 SCTP_INP_READ_UNLOCK(inp);
5730                                 hold_rlock = 0;
5731                         }
5732                         if (cp_len > 0)
5733                                 error = uiomove(mtod(m, char *), cp_len, uio);
5734                         /* re-read */
5735                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5736                                 goto release;
5737                         }
5738
5739                         if ((control->do_not_ref_stcb == 0) && stcb &&
5740                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5741                                 no_rcv_needed = 1;
5742                         }
5743                         if (error) {
5744                                 /* error we are out of here */
5745                                 goto release;
5746                         }
5747                         SCTP_INP_READ_LOCK(inp);
5748                         hold_rlock = 1;
5749                         if (cp_len == SCTP_BUF_LEN(m)) {
5750                                 if ((SCTP_BUF_NEXT(m) == NULL) &&
5751                                     (control->end_added)) {
5752                                         out_flags |= MSG_EOR;
5753                                         if ((control->do_not_ref_stcb == 0) &&
5754                                             (control->stcb != NULL) &&
5755                                             ((control->spec_flags & M_NOTIFICATION) == 0))
5756                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5757                                 }
5758                                 if (control->spec_flags & M_NOTIFICATION) {
5759                                         out_flags |= MSG_NOTIFICATION;
5760                                 }
5761                                 /* we ate up the mbuf */
5762                                 if (in_flags & MSG_PEEK) {
5763                                         /* just looking */
5764                                         m = SCTP_BUF_NEXT(m);
5765                                         copied_so_far += cp_len;
5766                                 } else {
5767                                         /* dispose of the mbuf */
5768                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5769                                                 sctp_sblog(&so->so_rcv,
5770                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
5771                                         }
5772                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
5773                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5774                                                 sctp_sblog(&so->so_rcv,
5775                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5776                                         }
5777                                         copied_so_far += cp_len;
5778                                         freed_so_far += cp_len;
5779                                         freed_so_far += MSIZE;
5780                                         atomic_subtract_int(&control->length, cp_len);
5781                                         control->data = sctp_m_free(m);
5782                                         m = control->data;
5783                                         /*
5784                                          * been through it all, must hold sb
5785                                          * lock ok to null tail
5786                                          */
5787                                         if (control->data == NULL) {
5788 #ifdef INVARIANTS
5789                                                 if ((control->end_added == 0) ||
5790                                                     (TAILQ_NEXT(control, next) == NULL)) {
5791                                                         /*
5792                                                          * If the end is not
5793                                                          * added, OR the
5794                                                          * next is NOT null
5795                                                          * we MUST have the
5796                                                          * lock.
5797                                                          */
5798                                                         if (mtx_owned(&inp->inp_rdata_mtx) == 0) {
5799                                                                 panic("Hmm we don't own the lock?");
5800                                                         }
5801                                                 }
5802 #endif
5803                                                 control->tail_mbuf = NULL;
5804 #ifdef INVARIANTS
5805                                                 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) {
5806                                                         panic("end_added, nothing left and no MSG_EOR");
5807                                                 }
5808 #endif
5809                                         }
5810                                 }
5811                         } else {
5812                                 /* Do we need to trim the mbuf? */
5813                                 if (control->spec_flags & M_NOTIFICATION) {
5814                                         out_flags |= MSG_NOTIFICATION;
5815                                 }
5816                                 if ((in_flags & MSG_PEEK) == 0) {
5817                                         SCTP_BUF_RESV_UF(m, cp_len);
5818                                         SCTP_BUF_LEN(m) -= cp_len;
5819                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5820                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, cp_len);
5821                                         }
5822                                         atomic_subtract_int(&so->so_rcv.sb_cc, cp_len);
5823                                         if ((control->do_not_ref_stcb == 0) &&
5824                                             stcb) {
5825                                                 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len);
5826                                         }
5827                                         copied_so_far += cp_len;
5828                                         freed_so_far += cp_len;
5829                                         freed_so_far += MSIZE;
5830                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5831                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
5832                                                     SCTP_LOG_SBRESULT, 0);
5833                                         }
5834                                         atomic_subtract_int(&control->length, cp_len);
5835                                 } else {
5836                                         copied_so_far += cp_len;
5837                                 }
5838                         }
5839                         if ((out_flags & MSG_EOR) || (uio->uio_resid == 0)) {
5840                                 break;
5841                         }
5842                         if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5843                             (control->do_not_ref_stcb == 0) &&
5844                             (freed_so_far >= rwnd_req)) {
5845                                 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5846                         }
5847                 }               /* end while(m) */
5848                 /*
5849                  * At this point we have looked at it all and we either have
5850                  * a MSG_EOR/or read all the user wants... <OR>
5851                  * control->length == 0.
5852                  */
5853                 if ((out_flags & MSG_EOR) && ((in_flags & MSG_PEEK) == 0)) {
5854                         /* we are done with this control */
5855                         if (control->length == 0) {
5856                                 if (control->data) {
5857 #ifdef INVARIANTS
5858                                         panic("control->data not null at read eor?");
5859 #else
5860                                         SCTP_PRINTF("Strange, data left in the control buffer .. invarients would panic?\n");
5861                                         sctp_m_freem(control->data);
5862                                         control->data = NULL;
5863 #endif
5864                                 }
5865                 done_with_control:
5866                                 if (hold_rlock == 0) {
5867                                         SCTP_INP_READ_LOCK(inp);
5868                                         hold_rlock = 1;
5869                                 }
5870                                 TAILQ_REMOVE(&inp->read_queue, control, next);
5871                                 /* Add back any hiddend data */
5872                                 if (control->held_length) {
5873                                         held_length = 0;
5874                                         control->held_length = 0;
5875                                         wakeup_read_socket = 1;
5876                                 }
5877                                 if (control->aux_data) {
5878                                         sctp_m_free(control->aux_data);
5879                                         control->aux_data = NULL;
5880                                 }
5881                                 no_rcv_needed = control->do_not_ref_stcb;
5882                                 sctp_free_remote_addr(control->whoFrom);
5883                                 control->data = NULL;
5884 #ifdef INVARIANTS
5885                                 if (control->on_strm_q) {
5886                                         panic("About to free ctl:%p so:%p and its in %d",
5887                                             control, so, control->on_strm_q);
5888                                 }
5889 #endif
5890                                 sctp_free_a_readq(stcb, control);
5891                                 control = NULL;
5892                                 if ((freed_so_far >= rwnd_req) &&
5893                                     (no_rcv_needed == 0))
5894                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5895
5896                         } else {
5897                                 /*
5898                                  * The user did not read all of this
5899                                  * message, turn off the returned MSG_EOR
5900                                  * since we are leaving more behind on the
5901                                  * control to read.
5902                                  */
5903 #ifdef INVARIANTS
5904                                 if (control->end_added &&
5905                                     (control->data == NULL) &&
5906                                     (control->tail_mbuf == NULL)) {
5907                                         panic("Gak, control->length is corrupt?");
5908                                 }
5909 #endif
5910                                 no_rcv_needed = control->do_not_ref_stcb;
5911                                 out_flags &= ~MSG_EOR;
5912                         }
5913                 }
5914                 if (out_flags & MSG_EOR) {
5915                         goto release;
5916                 }
5917                 if ((uio->uio_resid == 0) ||
5918                     ((in_eeor_mode) &&
5919                     (copied_so_far >= (uint32_t) max(so->so_rcv.sb_lowat, 1)))) {
5920                         goto release;
5921                 }
5922                 /*
5923                  * If I hit here the receiver wants more and this message is
5924                  * NOT done (pd-api). So two questions. Can we block? if not
5925                  * we are done. Did the user NOT set MSG_WAITALL?
5926                  */
5927                 if (block_allowed == 0) {
5928                         goto release;
5929                 }
5930                 /*
5931                  * We need to wait for more data a few things: - We don't
5932                  * sbunlock() so we don't get someone else reading. - We
5933                  * must be sure to account for the case where what is added
5934                  * is NOT to our control when we wakeup.
5935                  */
5936
5937                 /*
5938                  * Do we need to tell the transport a rwnd update might be
5939                  * needed before we go to sleep?
5940                  */
5941                 if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5942                     ((freed_so_far >= rwnd_req) &&
5943                     (control->do_not_ref_stcb == 0) &&
5944                     (no_rcv_needed == 0))) {
5945                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5946                 }
5947 wait_some_more:
5948                 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
5949                         goto release;
5950                 }
5951
5952                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
5953                         goto release;
5954
5955                 if (hold_rlock == 1) {
5956                         SCTP_INP_READ_UNLOCK(inp);
5957                         hold_rlock = 0;
5958                 }
5959                 if (hold_sblock == 0) {
5960                         SOCKBUF_LOCK(&so->so_rcv);
5961                         hold_sblock = 1;
5962                 }
5963                 if ((copied_so_far) && (control->length == 0) &&
5964                     (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE))) {
5965                         goto release;
5966                 }
5967                 if (so->so_rcv.sb_cc <= control->held_length) {
5968                         error = sbwait(&so->so_rcv);
5969                         if (error) {
5970                                 goto release;
5971                         }
5972                         control->held_length = 0;
5973                 }
5974                 if (hold_sblock) {
5975                         SOCKBUF_UNLOCK(&so->so_rcv);
5976                         hold_sblock = 0;
5977                 }
5978                 if (control->length == 0) {
5979                         /* still nothing here */
5980                         if (control->end_added == 1) {
5981                                 /* he aborted, or is done i.e.did a shutdown */
5982                                 out_flags |= MSG_EOR;
5983                                 if (control->pdapi_aborted) {
5984                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5985                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5986
5987                                         out_flags |= MSG_TRUNC;
5988                                 } else {
5989                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5990                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5991                                 }
5992                                 goto done_with_control;
5993                         }
5994                         if (so->so_rcv.sb_cc > held_length) {
5995                                 control->held_length = so->so_rcv.sb_cc;
5996                                 held_length = 0;
5997                         }
5998                         goto wait_some_more;
5999                 } else if (control->data == NULL) {
6000                         /*
6001                          * we must re-sync since data is probably being
6002                          * added
6003                          */
6004                         SCTP_INP_READ_LOCK(inp);
6005                         if ((control->length > 0) && (control->data == NULL)) {
6006                                 /*
6007                                  * big trouble.. we have the lock and its
6008                                  * corrupt?
6009                                  */
6010 #ifdef INVARIANTS
6011                                 panic("Impossible data==NULL length !=0");
6012 #endif
6013                                 out_flags |= MSG_EOR;
6014                                 out_flags |= MSG_TRUNC;
6015                                 control->length = 0;
6016                                 SCTP_INP_READ_UNLOCK(inp);
6017                                 goto done_with_control;
6018                         }
6019                         SCTP_INP_READ_UNLOCK(inp);
6020                         /* We will fall around to get more data */
6021                 }
6022                 goto get_more_data;
6023         } else {
6024                 /*-
6025                  * Give caller back the mbuf chain,
6026                  * store in uio_resid the length
6027                  */
6028                 wakeup_read_socket = 0;
6029                 if ((control->end_added == 0) ||
6030                     (TAILQ_NEXT(control, next) == NULL)) {
6031                         /* Need to get rlock */
6032                         if (hold_rlock == 0) {
6033                                 SCTP_INP_READ_LOCK(inp);
6034                                 hold_rlock = 1;
6035                         }
6036                 }
6037                 if (control->end_added) {
6038                         out_flags |= MSG_EOR;
6039                         if ((control->do_not_ref_stcb == 0) &&
6040                             (control->stcb != NULL) &&
6041                             ((control->spec_flags & M_NOTIFICATION) == 0))
6042                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
6043                 }
6044                 if (control->spec_flags & M_NOTIFICATION) {
6045                         out_flags |= MSG_NOTIFICATION;
6046                 }
6047                 uio->uio_resid = control->length;
6048                 *mp = control->data;
6049                 m = control->data;
6050                 while (m) {
6051                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6052                                 sctp_sblog(&so->so_rcv,
6053                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
6054                         }
6055                         sctp_sbfree(control, stcb, &so->so_rcv, m);
6056                         freed_so_far += SCTP_BUF_LEN(m);
6057                         freed_so_far += MSIZE;
6058                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
6059                                 sctp_sblog(&so->so_rcv,
6060                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
6061                         }
6062                         m = SCTP_BUF_NEXT(m);
6063                 }
6064                 control->data = control->tail_mbuf = NULL;
6065                 control->length = 0;
6066                 if (out_flags & MSG_EOR) {
6067                         /* Done with this control */
6068                         goto done_with_control;
6069                 }
6070         }
6071 release:
6072         if (hold_rlock == 1) {
6073                 SCTP_INP_READ_UNLOCK(inp);
6074                 hold_rlock = 0;
6075         }
6076         if (hold_sblock == 1) {
6077                 SOCKBUF_UNLOCK(&so->so_rcv);
6078                 hold_sblock = 0;
6079         }
6080
6081         sbunlock(&so->so_rcv);
6082         sockbuf_lock = 0;
6083
6084 release_unlocked:
6085         if (hold_sblock) {
6086                 SOCKBUF_UNLOCK(&so->so_rcv);
6087                 hold_sblock = 0;
6088         }
6089         if ((stcb) && (in_flags & MSG_PEEK) == 0) {
6090                 if ((freed_so_far >= rwnd_req) &&
6091                     (control && (control->do_not_ref_stcb == 0)) &&
6092                     (no_rcv_needed == 0))
6093                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6094         }
6095 out:
6096         if (msg_flags) {
6097                 *msg_flags = out_flags;
6098         }
6099         if (((out_flags & MSG_EOR) == 0) &&
6100             ((in_flags & MSG_PEEK) == 0) &&
6101             (sinfo) &&
6102             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
6103             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO))) {
6104                 struct sctp_extrcvinfo *s_extra;
6105
6106                 s_extra = (struct sctp_extrcvinfo *)sinfo;
6107                 s_extra->serinfo_next_flags = SCTP_NO_NEXT_MSG;
6108         }
6109         if (hold_rlock == 1) {
6110                 SCTP_INP_READ_UNLOCK(inp);
6111         }
6112         if (hold_sblock) {
6113                 SOCKBUF_UNLOCK(&so->so_rcv);
6114         }
6115         if (sockbuf_lock) {
6116                 sbunlock(&so->so_rcv);
6117         }
6118
6119         if (freecnt_applied) {
6120                 /*
6121                  * The lock on the socket buffer protects us so the free
6122                  * code will stop. But since we used the socketbuf lock and
6123                  * the sender uses the tcb_lock to increment, we need to use
6124                  * the atomic add to the refcnt.
6125                  */
6126                 if (stcb == NULL) {
6127 #ifdef INVARIANTS
6128                         panic("stcb for refcnt has gone NULL?");
6129                         goto stage_left;
6130 #else
6131                         goto stage_left;
6132 #endif
6133                 }
6134                 /* Save the value back for next time */
6135                 stcb->freed_by_sorcv_sincelast = freed_so_far;
6136                 atomic_add_int(&stcb->asoc.refcnt, -1);
6137         }
6138         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
6139                 if (stcb) {
6140                         sctp_misc_ints(SCTP_SORECV_DONE,
6141                             freed_so_far,
6142                             (uint32_t) ((uio) ? (slen - uio->uio_resid) : slen),
6143                             stcb->asoc.my_rwnd,
6144                             so->so_rcv.sb_cc);
6145                 } else {
6146                         sctp_misc_ints(SCTP_SORECV_DONE,
6147                             freed_so_far,
6148                             (uint32_t) ((uio) ? (slen - uio->uio_resid) : slen),
6149                             0,
6150                             so->so_rcv.sb_cc);
6151                 }
6152         }
6153 stage_left:
6154         if (wakeup_read_socket) {
6155                 sctp_sorwakeup(inp, so);
6156         }
6157         return (error);
6158 }
6159
6160
6161 #ifdef SCTP_MBUF_LOGGING
6162 struct mbuf *
6163 sctp_m_free(struct mbuf *m)
6164 {
6165         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
6166                 sctp_log_mb(m, SCTP_MBUF_IFREE);
6167         }
6168         return (m_free(m));
6169 }
6170
6171 void
6172 sctp_m_freem(struct mbuf *mb)
6173 {
6174         while (mb != NULL)
6175                 mb = sctp_m_free(mb);
6176 }
6177
6178 #endif
6179
6180 int
6181 sctp_dynamic_set_primary(struct sockaddr *sa, uint32_t vrf_id)
6182 {
6183         /*
6184          * Given a local address. For all associations that holds the
6185          * address, request a peer-set-primary.
6186          */
6187         struct sctp_ifa *ifa;
6188         struct sctp_laddr *wi;
6189
6190         ifa = sctp_find_ifa_by_addr(sa, vrf_id, 0);
6191         if (ifa == NULL) {
6192                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EADDRNOTAVAIL);
6193                 return (EADDRNOTAVAIL);
6194         }
6195         /*
6196          * Now that we have the ifa we must awaken the iterator with this
6197          * message.
6198          */
6199         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
6200         if (wi == NULL) {
6201                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
6202                 return (ENOMEM);
6203         }
6204         /* Now incr the count and int wi structure */
6205         SCTP_INCR_LADDR_COUNT();
6206         memset(wi, 0, sizeof(*wi));
6207         (void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
6208         wi->ifa = ifa;
6209         wi->action = SCTP_SET_PRIM_ADDR;
6210         atomic_add_int(&ifa->refcount, 1);
6211
6212         /* Now add it to the work queue */
6213         SCTP_WQ_ADDR_LOCK();
6214         /*
6215          * Should this really be a tailq? As it is we will process the
6216          * newest first :-0
6217          */
6218         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
6219         sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
6220             (struct sctp_inpcb *)NULL,
6221             (struct sctp_tcb *)NULL,
6222             (struct sctp_nets *)NULL);
6223         SCTP_WQ_ADDR_UNLOCK();
6224         return (0);
6225 }
6226
6227
6228 int
6229 sctp_soreceive(struct socket *so,
6230     struct sockaddr **psa,
6231     struct uio *uio,
6232     struct mbuf **mp0,
6233     struct mbuf **controlp,
6234     int *flagsp)
6235 {
6236         int error, fromlen;
6237         uint8_t sockbuf[256];
6238         struct sockaddr *from;
6239         struct sctp_extrcvinfo sinfo;
6240         int filling_sinfo = 1;
6241         int flags;
6242         struct sctp_inpcb *inp;
6243
6244         inp = (struct sctp_inpcb *)so->so_pcb;
6245         /* pickup the assoc we are reading from */
6246         if (inp == NULL) {
6247                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6248                 return (EINVAL);
6249         }
6250         if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) &&
6251             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) &&
6252             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) ||
6253             (controlp == NULL)) {
6254                 /* user does not want the sndrcv ctl */
6255                 filling_sinfo = 0;
6256         }
6257         if (psa) {
6258                 from = (struct sockaddr *)sockbuf;
6259                 fromlen = sizeof(sockbuf);
6260                 from->sa_len = 0;
6261         } else {
6262                 from = NULL;
6263                 fromlen = 0;
6264         }
6265
6266         if (filling_sinfo) {
6267                 memset(&sinfo, 0, sizeof(struct sctp_extrcvinfo));
6268         }
6269         if (flagsp != NULL) {
6270                 flags = *flagsp;
6271         } else {
6272                 flags = 0;
6273         }
6274         error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, &flags,
6275             (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo);
6276         if (flagsp != NULL) {
6277                 *flagsp = flags;
6278         }
6279         if (controlp != NULL) {
6280                 /* copy back the sinfo in a CMSG format */
6281                 if (filling_sinfo && ((flags & MSG_NOTIFICATION) == 0)) {
6282                         *controlp = sctp_build_ctl_nchunk(inp,
6283                             (struct sctp_sndrcvinfo *)&sinfo);
6284                 } else {
6285                         *controlp = NULL;
6286                 }
6287         }
6288         if (psa) {
6289                 /* copy back the address info */
6290                 if (from && from->sa_len) {
6291                         *psa = sodupsockaddr(from, M_NOWAIT);
6292                 } else {
6293                         *psa = NULL;
6294                 }
6295         }
6296         return (error);
6297 }
6298
6299
6300
6301
6302
6303 int
6304 sctp_connectx_helper_add(struct sctp_tcb *stcb, struct sockaddr *addr,
6305     int totaddr, int *error)
6306 {
6307         int added = 0;
6308         int i;
6309         struct sctp_inpcb *inp;
6310         struct sockaddr *sa;
6311         size_t incr = 0;
6312 #ifdef INET
6313         struct sockaddr_in *sin;
6314 #endif
6315 #ifdef INET6
6316         struct sockaddr_in6 *sin6;
6317 #endif
6318
6319         sa = addr;
6320         inp = stcb->sctp_ep;
6321         *error = 0;
6322         for (i = 0; i < totaddr; i++) {
6323                 switch (sa->sa_family) {
6324 #ifdef INET
6325                 case AF_INET:
6326                         incr = sizeof(struct sockaddr_in);
6327                         sin = (struct sockaddr_in *)sa;
6328                         if ((sin->sin_addr.s_addr == INADDR_ANY) ||
6329                             (sin->sin_addr.s_addr == INADDR_BROADCAST) ||
6330                             IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
6331                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6332                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6333                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_7);
6334                                 *error = EINVAL;
6335                                 goto out_now;
6336                         }
6337                         if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port,
6338                             SCTP_DONOT_SETSCOPE,
6339                             SCTP_ADDR_IS_CONFIRMED)) {
6340                                 /* assoc gone no un-lock */
6341                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6342                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6343                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_8);
6344                                 *error = ENOBUFS;
6345                                 goto out_now;
6346                         }
6347                         added++;
6348                         break;
6349 #endif
6350 #ifdef INET6
6351                 case AF_INET6:
6352                         incr = sizeof(struct sockaddr_in6);
6353                         sin6 = (struct sockaddr_in6 *)sa;
6354                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
6355                             IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
6356                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6357                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6358                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_9);
6359                                 *error = EINVAL;
6360                                 goto out_now;
6361                         }
6362                         if (sctp_add_remote_addr(stcb, sa, NULL, stcb->asoc.port,
6363                             SCTP_DONOT_SETSCOPE,
6364                             SCTP_ADDR_IS_CONFIRMED)) {
6365                                 /* assoc gone no un-lock */
6366                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6367                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC,
6368                                     SCTP_FROM_SCTPUTIL + SCTP_LOC_10);
6369                                 *error = ENOBUFS;
6370                                 goto out_now;
6371                         }
6372                         added++;
6373                         break;
6374 #endif
6375                 default:
6376                         break;
6377                 }
6378                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6379         }
6380 out_now:
6381         return (added);
6382 }
6383
6384 struct sctp_tcb *
6385 sctp_connectx_helper_find(struct sctp_inpcb *inp, struct sockaddr *addr,
6386     unsigned int *totaddr,
6387     unsigned int *num_v4, unsigned int *num_v6, int *error,
6388     unsigned int limit, int *bad_addr)
6389 {
6390         struct sockaddr *sa;
6391         struct sctp_tcb *stcb = NULL;
6392         unsigned int incr, at, i;
6393
6394         at = 0;
6395         sa = addr;
6396         *error = *num_v6 = *num_v4 = 0;
6397         /* account and validate addresses */
6398         for (i = 0; i < *totaddr; i++) {
6399                 switch (sa->sa_family) {
6400 #ifdef INET
6401                 case AF_INET:
6402                         incr = (unsigned int)sizeof(struct sockaddr_in);
6403                         if (sa->sa_len != incr) {
6404                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6405                                 *error = EINVAL;
6406                                 *bad_addr = 1;
6407                                 return (NULL);
6408                         }
6409                         (*num_v4) += 1;
6410                         break;
6411 #endif
6412 #ifdef INET6
6413                 case AF_INET6:
6414                         {
6415                                 struct sockaddr_in6 *sin6;
6416
6417                                 sin6 = (struct sockaddr_in6 *)sa;
6418                                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6419                                         /* Must be non-mapped for connectx */
6420                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6421                                         *error = EINVAL;
6422                                         *bad_addr = 1;
6423                                         return (NULL);
6424                                 }
6425                                 incr = (unsigned int)sizeof(struct sockaddr_in6);
6426                                 if (sa->sa_len != incr) {
6427                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6428                                         *error = EINVAL;
6429                                         *bad_addr = 1;
6430                                         return (NULL);
6431                                 }
6432                                 (*num_v6) += 1;
6433                                 break;
6434                         }
6435 #endif
6436                 default:
6437                         *totaddr = i;
6438                         incr = 0;
6439                         /* we are done */
6440                         break;
6441                 }
6442                 if (i == *totaddr) {
6443                         break;
6444                 }
6445                 SCTP_INP_INCR_REF(inp);
6446                 stcb = sctp_findassociation_ep_addr(&inp, sa, NULL, NULL, NULL);
6447                 if (stcb != NULL) {
6448                         /* Already have or am bring up an association */
6449                         return (stcb);
6450                 } else {
6451                         SCTP_INP_DECR_REF(inp);
6452                 }
6453                 if ((at + incr) > limit) {
6454                         *totaddr = i;
6455                         break;
6456                 }
6457                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6458         }
6459         return ((struct sctp_tcb *)NULL);
6460 }
6461
6462 /*
6463  * sctp_bindx(ADD) for one address.
6464  * assumes all arguments are valid/checked by caller.
6465  */
6466 void
6467 sctp_bindx_add_address(struct socket *so, struct sctp_inpcb *inp,
6468     struct sockaddr *sa, sctp_assoc_t assoc_id,
6469     uint32_t vrf_id, int *error, void *p)
6470 {
6471         struct sockaddr *addr_touse;
6472 #if defined(INET) && defined(INET6)
6473         struct sockaddr_in sin;
6474 #endif
6475
6476         /* see if we're bound all already! */
6477         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6478                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6479                 *error = EINVAL;
6480                 return;
6481         }
6482         addr_touse = sa;
6483 #ifdef INET6
6484         if (sa->sa_family == AF_INET6) {
6485 #ifdef INET
6486                 struct sockaddr_in6 *sin6;
6487
6488 #endif
6489                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6490                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6491                         *error = EINVAL;
6492                         return;
6493                 }
6494                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6495                         /* can only bind v6 on PF_INET6 sockets */
6496                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6497                         *error = EINVAL;
6498                         return;
6499                 }
6500 #ifdef INET
6501                 sin6 = (struct sockaddr_in6 *)addr_touse;
6502                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6503                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6504                             SCTP_IPV6_V6ONLY(inp)) {
6505                                 /* can't bind v4-mapped on PF_INET sockets */
6506                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6507                                 *error = EINVAL;
6508                                 return;
6509                         }
6510                         in6_sin6_2_sin(&sin, sin6);
6511                         addr_touse = (struct sockaddr *)&sin;
6512                 }
6513 #endif
6514         }
6515 #endif
6516 #ifdef INET
6517         if (sa->sa_family == AF_INET) {
6518                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6519                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6520                         *error = EINVAL;
6521                         return;
6522                 }
6523                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6524                     SCTP_IPV6_V6ONLY(inp)) {
6525                         /* can't bind v4 on PF_INET sockets */
6526                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6527                         *error = EINVAL;
6528                         return;
6529                 }
6530         }
6531 #endif
6532         if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
6533                 if (p == NULL) {
6534                         /* Can't get proc for Net/Open BSD */
6535                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6536                         *error = EINVAL;
6537                         return;
6538                 }
6539                 *error = sctp_inpcb_bind(so, addr_touse, NULL, p);
6540                 return;
6541         }
6542         /*
6543          * No locks required here since bind and mgmt_ep_sa all do their own
6544          * locking. If we do something for the FIX: below we may need to
6545          * lock in that case.
6546          */
6547         if (assoc_id == 0) {
6548                 /* add the address */
6549                 struct sctp_inpcb *lep;
6550                 struct sockaddr_in *lsin = (struct sockaddr_in *)addr_touse;
6551
6552                 /* validate the incoming port */
6553                 if ((lsin->sin_port != 0) &&
6554                     (lsin->sin_port != inp->sctp_lport)) {
6555                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6556                         *error = EINVAL;
6557                         return;
6558                 } else {
6559                         /* user specified 0 port, set it to existing port */
6560                         lsin->sin_port = inp->sctp_lport;
6561                 }
6562
6563                 lep = sctp_pcb_findep(addr_touse, 1, 0, vrf_id);
6564                 if (lep != NULL) {
6565                         /*
6566                          * We must decrement the refcount since we have the
6567                          * ep already and are binding. No remove going on
6568                          * here.
6569                          */
6570                         SCTP_INP_DECR_REF(lep);
6571                 }
6572                 if (lep == inp) {
6573                         /* already bound to it.. ok */
6574                         return;
6575                 } else if (lep == NULL) {
6576                         ((struct sockaddr_in *)addr_touse)->sin_port = 0;
6577                         *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6578                             SCTP_ADD_IP_ADDRESS,
6579                             vrf_id, NULL);
6580                 } else {
6581                         *error = EADDRINUSE;
6582                 }
6583                 if (*error)
6584                         return;
6585         } else {
6586                 /*
6587                  * FIX: decide whether we allow assoc based bindx
6588                  */
6589         }
6590 }
6591
6592 /*
6593  * sctp_bindx(DELETE) for one address.
6594  * assumes all arguments are valid/checked by caller.
6595  */
6596 void
6597 sctp_bindx_delete_address(struct sctp_inpcb *inp,
6598     struct sockaddr *sa, sctp_assoc_t assoc_id,
6599     uint32_t vrf_id, int *error)
6600 {
6601         struct sockaddr *addr_touse;
6602 #if defined(INET) && defined(INET6)
6603         struct sockaddr_in sin;
6604 #endif
6605
6606         /* see if we're bound all already! */
6607         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6608                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6609                 *error = EINVAL;
6610                 return;
6611         }
6612         addr_touse = sa;
6613 #ifdef INET6
6614         if (sa->sa_family == AF_INET6) {
6615 #ifdef INET
6616                 struct sockaddr_in6 *sin6;
6617 #endif
6618
6619                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6620                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6621                         *error = EINVAL;
6622                         return;
6623                 }
6624                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6625                         /* can only bind v6 on PF_INET6 sockets */
6626                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6627                         *error = EINVAL;
6628                         return;
6629                 }
6630 #ifdef INET
6631                 sin6 = (struct sockaddr_in6 *)addr_touse;
6632                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6633                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6634                             SCTP_IPV6_V6ONLY(inp)) {
6635                                 /* can't bind mapped-v4 on PF_INET sockets */
6636                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6637                                 *error = EINVAL;
6638                                 return;
6639                         }
6640                         in6_sin6_2_sin(&sin, sin6);
6641                         addr_touse = (struct sockaddr *)&sin;
6642                 }
6643 #endif
6644         }
6645 #endif
6646 #ifdef INET
6647         if (sa->sa_family == AF_INET) {
6648                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6649                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6650                         *error = EINVAL;
6651                         return;
6652                 }
6653                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6654                     SCTP_IPV6_V6ONLY(inp)) {
6655                         /* can't bind v4 on PF_INET sockets */
6656                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6657                         *error = EINVAL;
6658                         return;
6659                 }
6660         }
6661 #endif
6662         /*
6663          * No lock required mgmt_ep_sa does its own locking. If the FIX:
6664          * below is ever changed we may need to lock before calling
6665          * association level binding.
6666          */
6667         if (assoc_id == 0) {
6668                 /* delete the address */
6669                 *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6670                     SCTP_DEL_IP_ADDRESS,
6671                     vrf_id, NULL);
6672         } else {
6673                 /*
6674                  * FIX: decide whether we allow assoc based bindx
6675                  */
6676         }
6677 }
6678
6679 /*
6680  * returns the valid local address count for an assoc, taking into account
6681  * all scoping rules
6682  */
6683 int
6684 sctp_local_addr_count(struct sctp_tcb *stcb)
6685 {
6686         int loopback_scope;
6687 #if defined(INET)
6688         int ipv4_local_scope, ipv4_addr_legal;
6689 #endif
6690 #if defined (INET6)
6691         int local_scope, site_scope, ipv6_addr_legal;
6692 #endif
6693         struct sctp_vrf *vrf;
6694         struct sctp_ifn *sctp_ifn;
6695         struct sctp_ifa *sctp_ifa;
6696         int count = 0;
6697
6698         /* Turn on all the appropriate scopes */
6699         loopback_scope = stcb->asoc.scope.loopback_scope;
6700 #if defined(INET)
6701         ipv4_local_scope = stcb->asoc.scope.ipv4_local_scope;
6702         ipv4_addr_legal = stcb->asoc.scope.ipv4_addr_legal;
6703 #endif
6704 #if defined(INET6)
6705         local_scope = stcb->asoc.scope.local_scope;
6706         site_scope = stcb->asoc.scope.site_scope;
6707         ipv6_addr_legal = stcb->asoc.scope.ipv6_addr_legal;
6708 #endif
6709         SCTP_IPI_ADDR_RLOCK();
6710         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
6711         if (vrf == NULL) {
6712                 /* no vrf, no addresses */
6713                 SCTP_IPI_ADDR_RUNLOCK();
6714                 return (0);
6715         }
6716
6717         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6718                 /*
6719                  * bound all case: go through all ifns on the vrf
6720                  */
6721                 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
6722                         if ((loopback_scope == 0) &&
6723                             SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
6724                                 continue;
6725                         }
6726                         LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
6727                                 if (sctp_is_addr_restricted(stcb, sctp_ifa))
6728                                         continue;
6729                                 switch (sctp_ifa->address.sa.sa_family) {
6730 #ifdef INET
6731                                 case AF_INET:
6732                                         if (ipv4_addr_legal) {
6733                                                 struct sockaddr_in *sin;
6734
6735                                                 sin = &sctp_ifa->address.sin;
6736                                                 if (sin->sin_addr.s_addr == 0) {
6737                                                         /*
6738                                                          * skip unspecified
6739                                                          * addrs
6740                                                          */
6741                                                         continue;
6742                                                 }
6743                                                 if (prison_check_ip4(stcb->sctp_ep->ip_inp.inp.inp_cred,
6744                                                     &sin->sin_addr) != 0) {
6745                                                         continue;
6746                                                 }
6747                                                 if ((ipv4_local_scope == 0) &&
6748                                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
6749                                                         continue;
6750                                                 }
6751                                                 /* count this one */
6752                                                 count++;
6753                                         } else {
6754                                                 continue;
6755                                         }
6756                                         break;
6757 #endif
6758 #ifdef INET6
6759                                 case AF_INET6:
6760                                         if (ipv6_addr_legal) {
6761                                                 struct sockaddr_in6 *sin6;
6762
6763                                                 sin6 = &sctp_ifa->address.sin6;
6764                                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
6765                                                         continue;
6766                                                 }
6767                                                 if (prison_check_ip6(stcb->sctp_ep->ip_inp.inp.inp_cred,
6768                                                     &sin6->sin6_addr) != 0) {
6769                                                         continue;
6770                                                 }
6771                                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
6772                                                         if (local_scope == 0)
6773                                                                 continue;
6774                                                         if (sin6->sin6_scope_id == 0) {
6775                                                                 if (sa6_recoverscope(sin6) != 0)
6776                                                                         /*
6777                                                                          *
6778                                                                          * bad
6779                                                                          * link
6780                                                                          *
6781                                                                          * local
6782                                                                          *
6783                                                                          * address
6784                                                                          */
6785                                                                         continue;
6786                                                         }
6787                                                 }
6788                                                 if ((site_scope == 0) &&
6789                                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
6790                                                         continue;
6791                                                 }
6792                                                 /* count this one */
6793                                                 count++;
6794                                         }
6795                                         break;
6796 #endif
6797                                 default:
6798                                         /* TSNH */
6799                                         break;
6800                                 }
6801                         }
6802                 }
6803         } else {
6804                 /*
6805                  * subset bound case
6806                  */
6807                 struct sctp_laddr *laddr;
6808
6809                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list,
6810                     sctp_nxt_addr) {
6811                         if (sctp_is_addr_restricted(stcb, laddr->ifa)) {
6812                                 continue;
6813                         }
6814                         /* count this one */
6815                         count++;
6816                 }
6817         }
6818         SCTP_IPI_ADDR_RUNLOCK();
6819         return (count);
6820 }
6821
6822 #if defined(SCTP_LOCAL_TRACE_BUF)
6823
6824 void
6825 sctp_log_trace(uint32_t subsys, const char *str SCTP_UNUSED, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f)
6826 {
6827         uint32_t saveindex, newindex;
6828
6829         do {
6830                 saveindex = SCTP_BASE_SYSCTL(sctp_log).index;
6831                 if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6832                         newindex = 1;
6833                 } else {
6834                         newindex = saveindex + 1;
6835                 }
6836         } while (atomic_cmpset_int(&SCTP_BASE_SYSCTL(sctp_log).index, saveindex, newindex) == 0);
6837         if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6838                 saveindex = 0;
6839         }
6840         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].timestamp = SCTP_GET_CYCLECOUNT;
6841         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].subsys = subsys;
6842         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[0] = a;
6843         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[1] = b;
6844         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[2] = c;
6845         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[3] = d;
6846         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[4] = e;
6847         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[5] = f;
6848 }
6849
6850 #endif
6851 static void
6852 sctp_recv_udp_tunneled_packet(struct mbuf *m, int off, struct inpcb *inp,
6853     const struct sockaddr *sa SCTP_UNUSED, void *ctx SCTP_UNUSED)
6854 {
6855         struct ip *iph;
6856 #ifdef INET6
6857         struct ip6_hdr *ip6;
6858 #endif
6859         struct mbuf *sp, *last;
6860         struct udphdr *uhdr;
6861         uint16_t port;
6862
6863         if ((m->m_flags & M_PKTHDR) == 0) {
6864                 /* Can't handle one that is not a pkt hdr */
6865                 goto out;
6866         }
6867         /* Pull the src port */
6868         iph = mtod(m, struct ip *);
6869         uhdr = (struct udphdr *)((caddr_t)iph + off);
6870         port = uhdr->uh_sport;
6871         /*
6872          * Split out the mbuf chain. Leave the IP header in m, place the
6873          * rest in the sp.
6874          */
6875         sp = m_split(m, off, M_NOWAIT);
6876         if (sp == NULL) {
6877                 /* Gak, drop packet, we can't do a split */
6878                 goto out;
6879         }
6880         if (sp->m_pkthdr.len < sizeof(struct udphdr) + sizeof(struct sctphdr)) {
6881                 /* Gak, packet can't have an SCTP header in it - too small */
6882                 m_freem(sp);
6883                 goto out;
6884         }
6885         /* Now pull up the UDP header and SCTP header together */
6886         sp = m_pullup(sp, sizeof(struct udphdr) + sizeof(struct sctphdr));
6887         if (sp == NULL) {
6888                 /* Gak pullup failed */
6889                 goto out;
6890         }
6891         /* Trim out the UDP header */
6892         m_adj(sp, sizeof(struct udphdr));
6893
6894         /* Now reconstruct the mbuf chain */
6895         for (last = m; last->m_next; last = last->m_next);
6896         last->m_next = sp;
6897         m->m_pkthdr.len += sp->m_pkthdr.len;
6898         /*
6899          * The CSUM_DATA_VALID flags indicates that the HW checked the UDP
6900          * checksum and it was valid. Since CSUM_DATA_VALID ==
6901          * CSUM_SCTP_VALID this would imply that the HW also verified the
6902          * SCTP checksum. Therefore, clear the bit.
6903          */
6904         SCTPDBG(SCTP_DEBUG_CRCOFFLOAD,
6905             "sctp_recv_udp_tunneled_packet(): Packet of length %d received on %s with csum_flags 0x%b.\n",
6906             m->m_pkthdr.len,
6907             if_name(m->m_pkthdr.rcvif),
6908             (int)m->m_pkthdr.csum_flags, CSUM_BITS);
6909         m->m_pkthdr.csum_flags &= ~CSUM_DATA_VALID;
6910         iph = mtod(m, struct ip *);
6911         switch (iph->ip_v) {
6912 #ifdef INET
6913         case IPVERSION:
6914                 iph->ip_len = htons(ntohs(iph->ip_len) - sizeof(struct udphdr));
6915                 sctp_input_with_port(m, off, port);
6916                 break;
6917 #endif
6918 #ifdef INET6
6919         case IPV6_VERSION >> 4:
6920                 ip6 = mtod(m, struct ip6_hdr *);
6921                 ip6->ip6_plen = htons(ntohs(ip6->ip6_plen) - sizeof(struct udphdr));
6922                 sctp6_input_with_port(&m, &off, port);
6923                 break;
6924 #endif
6925         default:
6926                 goto out;
6927                 break;
6928         }
6929         return;
6930 out:
6931         m_freem(m);
6932 }
6933
6934 #ifdef INET
6935 static void
6936 sctp_recv_icmp_tunneled_packet(int cmd, struct sockaddr *sa, void *vip, void *ctx SCTP_UNUSED)
6937 {
6938         struct ip *outer_ip, *inner_ip;
6939         struct sctphdr *sh;
6940         struct icmp *icmp;
6941         struct udphdr *udp;
6942         struct sctp_inpcb *inp;
6943         struct sctp_tcb *stcb;
6944         struct sctp_nets *net;
6945         struct sctp_init_chunk *ch;
6946         struct sockaddr_in src, dst;
6947         uint8_t type, code;
6948
6949         inner_ip = (struct ip *)vip;
6950         icmp = (struct icmp *)((caddr_t)inner_ip -
6951             (sizeof(struct icmp) - sizeof(struct ip)));
6952         outer_ip = (struct ip *)((caddr_t)icmp - sizeof(struct ip));
6953         if (ntohs(outer_ip->ip_len) <
6954             sizeof(struct ip) + 8 + (inner_ip->ip_hl << 2) + sizeof(struct udphdr) + 8) {
6955                 return;
6956         }
6957         udp = (struct udphdr *)((caddr_t)inner_ip + (inner_ip->ip_hl << 2));
6958         sh = (struct sctphdr *)(udp + 1);
6959         memset(&src, 0, sizeof(struct sockaddr_in));
6960         src.sin_family = AF_INET;
6961         src.sin_len = sizeof(struct sockaddr_in);
6962         src.sin_port = sh->src_port;
6963         src.sin_addr = inner_ip->ip_src;
6964         memset(&dst, 0, sizeof(struct sockaddr_in));
6965         dst.sin_family = AF_INET;
6966         dst.sin_len = sizeof(struct sockaddr_in);
6967         dst.sin_port = sh->dest_port;
6968         dst.sin_addr = inner_ip->ip_dst;
6969         /*
6970          * 'dst' holds the dest of the packet that failed to be sent. 'src'
6971          * holds our local endpoint address. Thus we reverse the dst and the
6972          * src in the lookup.
6973          */
6974         inp = NULL;
6975         net = NULL;
6976         stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst,
6977             (struct sockaddr *)&src,
6978             &inp, &net, 1,
6979             SCTP_DEFAULT_VRFID);
6980         if ((stcb != NULL) &&
6981             (net != NULL) &&
6982             (inp != NULL)) {
6983                 /* Check the UDP port numbers */
6984                 if ((udp->uh_dport != net->port) ||
6985                     (udp->uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) {
6986                         SCTP_TCB_UNLOCK(stcb);
6987                         return;
6988                 }
6989                 /* Check the verification tag */
6990                 if (ntohl(sh->v_tag) != 0) {
6991                         /*
6992                          * This must be the verification tag used for
6993                          * sending out packets. We don't consider packets
6994                          * reflecting the verification tag.
6995                          */
6996                         if (ntohl(sh->v_tag) != stcb->asoc.peer_vtag) {
6997                                 SCTP_TCB_UNLOCK(stcb);
6998                                 return;
6999                         }
7000                 } else {
7001                         if (ntohs(outer_ip->ip_len) >=
7002                             sizeof(struct ip) +
7003                             8 + (inner_ip->ip_hl << 2) + 8 + 20) {
7004                                 /*
7005                                  * In this case we can check if we got an
7006                                  * INIT chunk and if the initiate tag
7007                                  * matches.
7008                                  */
7009                                 ch = (struct sctp_init_chunk *)(sh + 1);
7010                                 if ((ch->ch.chunk_type != SCTP_INITIATION) ||
7011                                     (ntohl(ch->init.initiate_tag) != stcb->asoc.my_vtag)) {
7012                                         SCTP_TCB_UNLOCK(stcb);
7013                                         return;
7014                                 }
7015                         } else {
7016                                 SCTP_TCB_UNLOCK(stcb);
7017                                 return;
7018                         }
7019                 }
7020                 type = icmp->icmp_type;
7021                 code = icmp->icmp_code;
7022                 if ((type == ICMP_UNREACH) &&
7023                     (code == ICMP_UNREACH_PORT)) {
7024                         code = ICMP_UNREACH_PROTOCOL;
7025                 }
7026                 sctp_notify(inp, stcb, net, type, code,
7027                     ntohs(inner_ip->ip_len),
7028                     (uint32_t) ntohs(icmp->icmp_nextmtu));
7029         } else {
7030                 if ((stcb == NULL) && (inp != NULL)) {
7031                         /* reduce ref-count */
7032                         SCTP_INP_WLOCK(inp);
7033                         SCTP_INP_DECR_REF(inp);
7034                         SCTP_INP_WUNLOCK(inp);
7035                 }
7036                 if (stcb) {
7037                         SCTP_TCB_UNLOCK(stcb);
7038                 }
7039         }
7040         return;
7041 }
7042 #endif
7043
7044 #ifdef INET6
7045 static void
7046 sctp_recv_icmp6_tunneled_packet(int cmd, struct sockaddr *sa, void *d, void *ctx SCTP_UNUSED)
7047 {
7048         struct ip6ctlparam *ip6cp;
7049         struct sctp_inpcb *inp;
7050         struct sctp_tcb *stcb;
7051         struct sctp_nets *net;
7052         struct sctphdr sh;
7053         struct udphdr udp;
7054         struct sockaddr_in6 src, dst;
7055         uint8_t type, code;
7056
7057         ip6cp = (struct ip6ctlparam *)d;
7058         /*
7059          * XXX: We assume that when IPV6 is non NULL, M and OFF are valid.
7060          */
7061         if (ip6cp->ip6c_m == NULL) {
7062                 return;
7063         }
7064         /*
7065          * Check if we can safely examine the ports and the verification tag
7066          * of the SCTP common header.
7067          */
7068         if (ip6cp->ip6c_m->m_pkthdr.len <
7069             ip6cp->ip6c_off + sizeof(struct udphdr) + offsetof(struct sctphdr, checksum)) {
7070                 return;
7071         }
7072         /* Copy out the UDP header. */
7073         memset(&udp, 0, sizeof(struct udphdr));
7074         m_copydata(ip6cp->ip6c_m,
7075             ip6cp->ip6c_off,
7076             sizeof(struct udphdr),
7077             (caddr_t)&udp);
7078         /* Copy out the port numbers and the verification tag. */
7079         memset(&sh, 0, sizeof(struct sctphdr));
7080         m_copydata(ip6cp->ip6c_m,
7081             ip6cp->ip6c_off + sizeof(struct udphdr),
7082             sizeof(uint16_t) + sizeof(uint16_t) + sizeof(uint32_t),
7083             (caddr_t)&sh);
7084         memset(&src, 0, sizeof(struct sockaddr_in6));
7085         src.sin6_family = AF_INET6;
7086         src.sin6_len = sizeof(struct sockaddr_in6);
7087         src.sin6_port = sh.src_port;
7088         src.sin6_addr = ip6cp->ip6c_ip6->ip6_src;
7089         if (in6_setscope(&src.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) {
7090                 return;
7091         }
7092         memset(&dst, 0, sizeof(struct sockaddr_in6));
7093         dst.sin6_family = AF_INET6;
7094         dst.sin6_len = sizeof(struct sockaddr_in6);
7095         dst.sin6_port = sh.dest_port;
7096         dst.sin6_addr = ip6cp->ip6c_ip6->ip6_dst;
7097         if (in6_setscope(&dst.sin6_addr, ip6cp->ip6c_m->m_pkthdr.rcvif, NULL) != 0) {
7098                 return;
7099         }
7100         inp = NULL;
7101         net = NULL;
7102         stcb = sctp_findassociation_addr_sa((struct sockaddr *)&dst,
7103             (struct sockaddr *)&src,
7104             &inp, &net, 1, SCTP_DEFAULT_VRFID);
7105         if ((stcb != NULL) &&
7106             (net != NULL) &&
7107             (inp != NULL)) {
7108                 /* Check the UDP port numbers */
7109                 if ((udp.uh_dport != net->port) ||
7110                     (udp.uh_sport != htons(SCTP_BASE_SYSCTL(sctp_udp_tunneling_port)))) {
7111                         SCTP_TCB_UNLOCK(stcb);
7112                         return;
7113                 }
7114                 /* Check the verification tag */
7115                 if (ntohl(sh.v_tag) != 0) {
7116                         /*
7117                          * This must be the verification tag used for
7118                          * sending out packets. We don't consider packets
7119                          * reflecting the verification tag.
7120                          */
7121                         if (ntohl(sh.v_tag) != stcb->asoc.peer_vtag) {
7122                                 SCTP_TCB_UNLOCK(stcb);
7123                                 return;
7124                         }
7125                 } else {
7126                         if (ip6cp->ip6c_m->m_pkthdr.len >=
7127                             ip6cp->ip6c_off + sizeof(struct udphdr) +
7128                             sizeof(struct sctphdr) +
7129                             sizeof(struct sctp_chunkhdr) +
7130                             offsetof(struct sctp_init, a_rwnd)) {
7131                                 /*
7132                                  * In this case we can check if we got an
7133                                  * INIT chunk and if the initiate tag
7134                                  * matches.
7135                                  */
7136                                 uint32_t initiate_tag;
7137                                 uint8_t chunk_type;
7138
7139                                 m_copydata(ip6cp->ip6c_m,
7140                                     ip6cp->ip6c_off +
7141                                     sizeof(struct udphdr) +
7142                                     sizeof(struct sctphdr),
7143                                     sizeof(uint8_t),
7144                                     (caddr_t)&chunk_type);
7145                                 m_copydata(ip6cp->ip6c_m,
7146                                     ip6cp->ip6c_off +
7147                                     sizeof(struct udphdr) +
7148                                     sizeof(struct sctphdr) +
7149                                     sizeof(struct sctp_chunkhdr),
7150                                     sizeof(uint32_t),
7151                                     (caddr_t)&initiate_tag);
7152                                 if ((chunk_type != SCTP_INITIATION) ||
7153                                     (ntohl(initiate_tag) != stcb->asoc.my_vtag)) {
7154                                         SCTP_TCB_UNLOCK(stcb);
7155                                         return;
7156                                 }
7157                         } else {
7158                                 SCTP_TCB_UNLOCK(stcb);
7159                                 return;
7160                         }
7161                 }
7162                 type = ip6cp->ip6c_icmp6->icmp6_type;
7163                 code = ip6cp->ip6c_icmp6->icmp6_code;
7164                 if ((type == ICMP6_DST_UNREACH) &&
7165                     (code == ICMP6_DST_UNREACH_NOPORT)) {
7166                         type = ICMP6_PARAM_PROB;
7167                         code = ICMP6_PARAMPROB_NEXTHEADER;
7168                 }
7169                 sctp6_notify(inp, stcb, net, type, code,
7170                     ntohl(ip6cp->ip6c_icmp6->icmp6_mtu));
7171         } else {
7172                 if ((stcb == NULL) && (inp != NULL)) {
7173                         /* reduce inp's ref-count */
7174                         SCTP_INP_WLOCK(inp);
7175                         SCTP_INP_DECR_REF(inp);
7176                         SCTP_INP_WUNLOCK(inp);
7177                 }
7178                 if (stcb) {
7179                         SCTP_TCB_UNLOCK(stcb);
7180                 }
7181         }
7182 }
7183 #endif
7184
7185 void
7186 sctp_over_udp_stop(void)
7187 {
7188         /*
7189          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
7190          * for writting!
7191          */
7192 #ifdef INET
7193         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
7194                 soclose(SCTP_BASE_INFO(udp4_tun_socket));
7195                 SCTP_BASE_INFO(udp4_tun_socket) = NULL;
7196         }
7197 #endif
7198 #ifdef INET6
7199         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
7200                 soclose(SCTP_BASE_INFO(udp6_tun_socket));
7201                 SCTP_BASE_INFO(udp6_tun_socket) = NULL;
7202         }
7203 #endif
7204 }
7205
7206 int
7207 sctp_over_udp_start(void)
7208 {
7209         uint16_t port;
7210         int ret;
7211 #ifdef INET
7212         struct sockaddr_in sin;
7213 #endif
7214 #ifdef INET6
7215         struct sockaddr_in6 sin6;
7216 #endif
7217         /*
7218          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
7219          * for writting!
7220          */
7221         port = SCTP_BASE_SYSCTL(sctp_udp_tunneling_port);
7222         if (ntohs(port) == 0) {
7223                 /* Must have a port set */
7224                 return (EINVAL);
7225         }
7226 #ifdef INET
7227         if (SCTP_BASE_INFO(udp4_tun_socket) != NULL) {
7228                 /* Already running -- must stop first */
7229                 return (EALREADY);
7230         }
7231 #endif
7232 #ifdef INET6
7233         if (SCTP_BASE_INFO(udp6_tun_socket) != NULL) {
7234                 /* Already running -- must stop first */
7235                 return (EALREADY);
7236         }
7237 #endif
7238 #ifdef INET
7239         if ((ret = socreate(PF_INET, &SCTP_BASE_INFO(udp4_tun_socket),
7240             SOCK_DGRAM, IPPROTO_UDP,
7241             curthread->td_ucred, curthread))) {
7242                 sctp_over_udp_stop();
7243                 return (ret);
7244         }
7245         /* Call the special UDP hook. */
7246         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp4_tun_socket),
7247             sctp_recv_udp_tunneled_packet,
7248             sctp_recv_icmp_tunneled_packet,
7249             NULL))) {
7250                 sctp_over_udp_stop();
7251                 return (ret);
7252         }
7253         /* Ok, we have a socket, bind it to the port. */
7254         memset(&sin, 0, sizeof(struct sockaddr_in));
7255         sin.sin_len = sizeof(struct sockaddr_in);
7256         sin.sin_family = AF_INET;
7257         sin.sin_port = htons(port);
7258         if ((ret = sobind(SCTP_BASE_INFO(udp4_tun_socket),
7259             (struct sockaddr *)&sin, curthread))) {
7260                 sctp_over_udp_stop();
7261                 return (ret);
7262         }
7263 #endif
7264 #ifdef INET6
7265         if ((ret = socreate(PF_INET6, &SCTP_BASE_INFO(udp6_tun_socket),
7266             SOCK_DGRAM, IPPROTO_UDP,
7267             curthread->td_ucred, curthread))) {
7268                 sctp_over_udp_stop();
7269                 return (ret);
7270         }
7271         /* Call the special UDP hook. */
7272         if ((ret = udp_set_kernel_tunneling(SCTP_BASE_INFO(udp6_tun_socket),
7273             sctp_recv_udp_tunneled_packet,
7274             sctp_recv_icmp6_tunneled_packet,
7275             NULL))) {
7276                 sctp_over_udp_stop();
7277                 return (ret);
7278         }
7279         /* Ok, we have a socket, bind it to the port. */
7280         memset(&sin6, 0, sizeof(struct sockaddr_in6));
7281         sin6.sin6_len = sizeof(struct sockaddr_in6);
7282         sin6.sin6_family = AF_INET6;
7283         sin6.sin6_port = htons(port);
7284         if ((ret = sobind(SCTP_BASE_INFO(udp6_tun_socket),
7285             (struct sockaddr *)&sin6, curthread))) {
7286                 sctp_over_udp_stop();
7287                 return (ret);
7288         }
7289 #endif
7290         return (0);
7291 }
7292
7293 /*
7294  * sctp_min_mtu ()returns the minimum of all non-zero arguments.
7295  * If all arguments are zero, zero is returned.
7296  */
7297 uint32_t
7298 sctp_min_mtu(uint32_t mtu1, uint32_t mtu2, uint32_t mtu3) {
7299         if (mtu1 > 0) {
7300                 if (mtu2 > 0) {
7301                         if (mtu3 > 0) {
7302                                 return (min(mtu1, min(mtu2, mtu3)));
7303                         } else {
7304                                 return (min(mtu1, mtu2));
7305                         }
7306                 } else {
7307                         if (mtu3 > 0) {
7308                                 return (min(mtu1, mtu3));
7309                         } else {
7310                                 return (mtu1);
7311                         }
7312                 }
7313         } else {
7314                 if (mtu2 > 0) {
7315                         if (mtu3 > 0) {
7316                                 return (min(mtu2, mtu3));
7317                         } else {
7318                                 return (mtu2);
7319                         }
7320                 } else {
7321                         return (mtu3);
7322                 }
7323         }
7324 }
7325
7326 void
7327 sctp_hc_set_mtu(union sctp_sockstore *addr, uint16_t fibnum, uint32_t mtu)
7328 {
7329         struct in_conninfo inc;
7330
7331         memset(&inc, 0, sizeof(struct in_conninfo));
7332         inc.inc_fibnum = fibnum;
7333         switch (addr->sa.sa_family) {
7334 #ifdef INET
7335         case AF_INET:
7336                 inc.inc_faddr = addr->sin.sin_addr;
7337                 break;
7338 #endif
7339 #ifdef INET6
7340         case AF_INET6:
7341                 inc.inc_flags |= INC_ISIPV6;
7342                 inc.inc6_faddr = addr->sin6.sin6_addr;
7343                 break;
7344 #endif
7345         default:
7346                 return;
7347         }
7348         tcp_hc_updatemtu(&inc, (u_long)mtu);
7349 }
7350
7351 uint32_t
7352 sctp_hc_get_mtu(union sctp_sockstore *addr, uint16_t fibnum){
7353         struct in_conninfo inc;
7354
7355         memset(&inc, 0, sizeof(struct in_conninfo));
7356         inc.inc_fibnum = fibnum;
7357         switch (addr->sa.sa_family) {
7358 #ifdef INET
7359         case AF_INET:
7360                 inc.inc_faddr = addr->sin.sin_addr;
7361                 break;
7362 #endif
7363 #ifdef INET6
7364         case AF_INET6:
7365                 inc.inc_flags |= INC_ISIPV6;
7366                 inc.inc6_faddr = addr->sin6.sin6_addr;
7367                 break;
7368 #endif
7369         default:
7370                 return (0);
7371         }
7372         return ((uint32_t) tcp_hc_getmtu(&inc));
7373 }