sys/netinet/sctputil.c

   1 /*-
   2  * Copyright (c) 2001-2006, Cisco Systems, Inc. All rights reserved.
   3  *
   4  * Redistribution and use in source and binary forms, with or without
   5  * modification, are permitted provided that the following conditions are met:
   6  *
   7  * a) Redistributions of source code must retain the above copyright notice,
   8  *   this list of conditions and the following disclaimer.
   9  *
  10  * b) Redistributions in binary form must reproduce the above copyright
  11  *    notice, this list of conditions and the following disclaimer in
  12  *   the documentation and/or other materials provided with the distribution.
  13  *
  14  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  15  *    contributors may be used to endorse or promote products derived
  16  *    from this software without specific prior written permission.
  17  *
  18  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  19  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  20  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  21  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  22  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  23  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  24  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  25  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  26  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  27  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  28  * THE POSSIBILITY OF SUCH DAMAGE.
  29  */
  30
  31 /* $KAME: sctputil.c,v 1.37 2005/03/07 23:26:09 itojun Exp $     */
  32
  33 #include <sys/cdefs.h>
  34 __FBSDID("$FreeBSD$");
  35
  36
  37 #include "opt_ipsec.h"
  38 #include "opt_compat.h"
  39 #include "opt_inet6.h"
  40 #include "opt_inet.h"
  41 #include "opt_sctp.h"
  42
  43 #include <sys/param.h>
  44 #include <sys/systm.h>
  45 #include <sys/fcntl.h>
  46 #include <sys/lock.h>
  47 #include <sys/malloc.h>
  48 #include <sys/mbuf.h>
  49 #include <sys/domain.h>
  50 #include <sys/file.h>           /* for struct knote */
  51 #include <sys/kernel.h>
  52 #include <sys/event.h>
  53 #include <sys/poll.h>
  54
  55 #include <sys/protosw.h>
  56 #include <sys/socket.h>
  57 #include <sys/socketvar.h>
  58 #include <sys/proc.h>
  59 #include <sys/kernel.h>
  60 #include <sys/resourcevar.h>
  61 #include <sys/signalvar.h>
  62 #include <sys/sysctl.h>
  63 #include <sys/uio.h>
  64 #include <sys/jail.h>
  65
  66 #include <sys/callout.h>
  67
  68 #include <net/radix.h>
  69 #include <net/route.h>
  70
  71 #ifdef INET6
  72 #include <sys/domain.h>
  73 #endif
  74
  75 #include <sys/limits.h>
  76 #include <sys/mac.h>
  77 #include <sys/mutex.h>
  78
  79 #include <net/if.h>
  80 #include <net/if_types.h>
  81 #include <net/route.h>
  82
  83 #include <netinet/in.h>
  84 #include <netinet/in_systm.h>
  85 #include <netinet/ip.h>
  86 #include <netinet/in_pcb.h>
  87 #include <netinet/in_var.h>
  88 #include <netinet/ip_var.h>
  89
  90 #ifdef INET6
  91 #include <netinet/ip6.h>
  92 #include <netinet6/ip6_var.h>
  93
  94 #include <netinet6/in6_pcb.h>
  95
  96 #include <netinet6/scope6_var.h>
  97 #endif                          /* INET6 */
  98
  99 #ifdef IPSEC
 100 #include <netinet6/ipsec.h>
 101 #include <netkey/key.h>
 102 #endif                          /* IPSEC */
 103
 104 #include <netinet/sctp_os.h>
 105 #include <netinet/sctp_pcb.h>
 106 #include <netinet/sctputil.h>
 107 #include <netinet/sctp_var.h>
 108 #ifdef INET6
 109 #include <netinet6/sctp6_var.h>
 110 #endif
 111 #include <netinet/sctp_header.h>
 112 #include <netinet/sctp_output.h>
 113 #include <netinet/sctp_uio.h>
 114 #include <netinet/sctp_timer.h>
 115 #include <netinet/sctp_crc32.h>
 116 #include <netinet/sctp_indata.h>/* for sctp_deliver_data() */
 117 #include <netinet/sctp_auth.h>
 118 #include <netinet/sctp_asconf.h>
 119
 120 extern int sctp_warm_the_crc32_table;
 121
 122 #define NUMBER_OF_MTU_SIZES 18
 123
 124 #ifdef SCTP_DEBUG
 125 extern uint32_t sctp_debug_on;
 126
 127 #endif
 128
 129
 130 #ifdef SCTP_STAT_LOGGING
 131 int global_sctp_cwnd_log_at = 0;
 132 int global_sctp_cwnd_log_rolled = 0;
 133 struct sctp_cwnd_log sctp_clog[SCTP_STAT_LOG_SIZE];
 134
 135 static uint32_t
 136 sctp_get_time_of_event(void)
 137 {
 138         struct timeval now;
 139         uint32_t timeval;
 140
 141         SCTP_GETPTIME_TIMEVAL(&now);
 142         timeval = (now.tv_sec % 0x00000fff);
 143         timeval <<= 20;
 144         timeval |= now.tv_usec & 0xfffff;
 145         return (timeval);
 146 }
 147
 148
 149 void
 150 sctp_clr_stat_log(void)
 151 {
 152         global_sctp_cwnd_log_at = 0;
 153         global_sctp_cwnd_log_rolled = 0;
 154 }
 155
 156
 157 void
 158 sctp_sblog(struct sockbuf *sb,
 159     struct sctp_tcb *stcb, int from, int incr)
 160 {
 161         int sctp_cwnd_log_at;
 162
 163         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 164         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 165         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 166         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_SB;
 167         sctp_clog[sctp_cwnd_log_at].x.sb.stcb = stcb;
 168         sctp_clog[sctp_cwnd_log_at].x.sb.so_sbcc = sb->sb_cc;
 169         if (stcb)
 170                 sctp_clog[sctp_cwnd_log_at].x.sb.stcb_sbcc = stcb->asoc.sb_cc;
 171         else
 172                 sctp_clog[sctp_cwnd_log_at].x.sb.stcb_sbcc = 0;
 173         sctp_clog[sctp_cwnd_log_at].x.sb.incr = incr;
 174 }
 175
 176 void
 177 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc)
 178 {
 179         int sctp_cwnd_log_at;
 180
 181         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 182         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 183         sctp_clog[sctp_cwnd_log_at].from = 0;
 184         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_CLOSE;
 185         sctp_clog[sctp_cwnd_log_at].x.close.inp = (void *)inp;
 186         sctp_clog[sctp_cwnd_log_at].x.close.sctp_flags = inp->sctp_flags;
 187         if (stcb) {
 188                 sctp_clog[sctp_cwnd_log_at].x.close.stcb = (void *)stcb;
 189                 sctp_clog[sctp_cwnd_log_at].x.close.state = (uint16_t) stcb->asoc.state;
 190         } else {
 191                 sctp_clog[sctp_cwnd_log_at].x.close.stcb = 0;
 192                 sctp_clog[sctp_cwnd_log_at].x.close.state = 0;
 193         }
 194         sctp_clog[sctp_cwnd_log_at].x.close.loc = loc;
 195 }
 196
 197
 198 void
 199 rto_logging(struct sctp_nets *net, int from)
 200 {
 201         int sctp_cwnd_log_at;
 202
 203         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 204         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 205         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 206         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_RTT;
 207         sctp_clog[sctp_cwnd_log_at].x.rto.net = (void *)net;
 208         sctp_clog[sctp_cwnd_log_at].x.rto.rtt = net->prev_rtt;
 209         sctp_clog[sctp_cwnd_log_at].x.rto.rttvar = net->rtt_variance;
 210         sctp_clog[sctp_cwnd_log_at].x.rto.direction = net->rto_variance_dir;
 211 }
 212
 213 void
 214 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from)
 215 {
 216         int sctp_cwnd_log_at;
 217
 218         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 219         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 220         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 221         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_STRM;
 222         sctp_clog[sctp_cwnd_log_at].x.strlog.stcb = stcb;
 223         sctp_clog[sctp_cwnd_log_at].x.strlog.n_tsn = tsn;
 224         sctp_clog[sctp_cwnd_log_at].x.strlog.n_sseq = sseq;
 225         sctp_clog[sctp_cwnd_log_at].x.strlog.e_tsn = 0;
 226         sctp_clog[sctp_cwnd_log_at].x.strlog.e_sseq = 0;
 227         sctp_clog[sctp_cwnd_log_at].x.strlog.strm = stream;
 228 }
 229
 230 void
 231 sctp_log_nagle_event(struct sctp_tcb *stcb, int action)
 232 {
 233         int sctp_cwnd_log_at;
 234
 235         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 236         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 237         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) action;
 238         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_NAGLE;
 239         sctp_clog[sctp_cwnd_log_at].x.nagle.stcb = (void *)stcb;
 240         sctp_clog[sctp_cwnd_log_at].x.nagle.total_flight = stcb->asoc.total_flight;
 241         sctp_clog[sctp_cwnd_log_at].x.nagle.total_in_queue = stcb->asoc.total_output_queue_size;
 242         sctp_clog[sctp_cwnd_log_at].x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue;
 243         sctp_clog[sctp_cwnd_log_at].x.nagle.count_in_flight = stcb->asoc.total_flight_count;
 244 }
 245
 246
 247 void
 248 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from)
 249 {
 250         int sctp_cwnd_log_at;
 251
 252         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 253         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 254         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 255         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_SACK;
 256         sctp_clog[sctp_cwnd_log_at].x.sack.cumack = cumack;
 257         sctp_clog[sctp_cwnd_log_at].x.sack.oldcumack = old_cumack;
 258         sctp_clog[sctp_cwnd_log_at].x.sack.tsn = tsn;
 259         sctp_clog[sctp_cwnd_log_at].x.sack.numGaps = gaps;
 260         sctp_clog[sctp_cwnd_log_at].x.sack.numDups = dups;
 261 }
 262
 263 void
 264 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from)
 265 {
 266         int sctp_cwnd_log_at;
 267
 268         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 269         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 270         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 271         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_MAP;
 272         sctp_clog[sctp_cwnd_log_at].x.map.base = map;
 273         sctp_clog[sctp_cwnd_log_at].x.map.cum = cum;
 274         sctp_clog[sctp_cwnd_log_at].x.map.high = high;
 275 }
 276
 277 void
 278 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn,
 279     int from)
 280 {
 281         int sctp_cwnd_log_at;
 282
 283         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 284         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 285         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 286         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_FR;
 287         sctp_clog[sctp_cwnd_log_at].x.fr.largest_tsn = biggest_tsn;
 288         sctp_clog[sctp_cwnd_log_at].x.fr.largest_new_tsn = biggest_new_tsn;
 289         sctp_clog[sctp_cwnd_log_at].x.fr.tsn = tsn;
 290 }
 291
 292
 293 void
 294 sctp_log_mb(struct mbuf *m, int from)
 295 {
 296         int sctp_cwnd_log_at;
 297
 298         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 299         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 300         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 301         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_MBUF;
 302         sctp_clog[sctp_cwnd_log_at].x.mb.mp = m;
 303         sctp_clog[sctp_cwnd_log_at].x.mb.mbuf_flags = (uint8_t) (m->m_flags);
 304         sctp_clog[sctp_cwnd_log_at].x.mb.size = (uint16_t) (m->m_len);
 305         sctp_clog[sctp_cwnd_log_at].x.mb.data = m->m_data;
 306         if (m->m_flags & M_EXT) {
 307                 sctp_clog[sctp_cwnd_log_at].x.mb.ext = m->m_ext.ext_buf;
 308                 sctp_clog[sctp_cwnd_log_at].x.mb.refcnt = (uint8_t) (*m->m_ext.ref_cnt);
 309         } else {
 310                 sctp_clog[sctp_cwnd_log_at].x.mb.ext = 0;
 311                 sctp_clog[sctp_cwnd_log_at].x.mb.refcnt = 0;
 312         }
 313 }
 314
 315
 316 void
 317 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk,
 318     int from)
 319 {
 320         int sctp_cwnd_log_at;
 321
 322         if (control == NULL) {
 323                 printf("Gak log of NULL?\n");
 324                 return;
 325         }
 326         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 327         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 328         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 329         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_STRM;
 330         sctp_clog[sctp_cwnd_log_at].x.strlog.stcb = control->stcb;
 331         sctp_clog[sctp_cwnd_log_at].x.strlog.n_tsn = control->sinfo_tsn;
 332         sctp_clog[sctp_cwnd_log_at].x.strlog.n_sseq = control->sinfo_ssn;
 333         sctp_clog[sctp_cwnd_log_at].x.strlog.strm = control->sinfo_stream;
 334         if (poschk != NULL) {
 335                 sctp_clog[sctp_cwnd_log_at].x.strlog.e_tsn = poschk->sinfo_tsn;
 336                 sctp_clog[sctp_cwnd_log_at].x.strlog.e_sseq = poschk->sinfo_ssn;
 337         } else {
 338                 sctp_clog[sctp_cwnd_log_at].x.strlog.e_tsn = 0;
 339                 sctp_clog[sctp_cwnd_log_at].x.strlog.e_sseq = 0;
 340         }
 341 }
 342
 343 void
 344 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from)
 345 {
 346         int sctp_cwnd_log_at;
 347
 348         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 349         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 350         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 351         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_CWND;
 352         sctp_clog[sctp_cwnd_log_at].x.cwnd.net = net;
 353         if (stcb->asoc.send_queue_cnt > 255)
 354                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_send = 255;
 355         else
 356                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 357         if (stcb->asoc.stream_queue_cnt > 255)
 358                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_str = 255;
 359         else
 360                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 361
 362         if (net) {
 363                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cwnd_new_value = net->cwnd;
 364                 sctp_clog[sctp_cwnd_log_at].x.cwnd.inflight = net->flight_size;
 365                 sctp_clog[sctp_cwnd_log_at].x.cwnd.pseudo_cumack = net->pseudo_cumack;
 366                 sctp_clog[sctp_cwnd_log_at].x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack;
 367                 sctp_clog[sctp_cwnd_log_at].x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack;
 368         }
 369         if (SCTP_CWNDLOG_PRESEND == from) {
 370                 sctp_clog[sctp_cwnd_log_at].x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd;
 371         }
 372         sctp_clog[sctp_cwnd_log_at].x.cwnd.cwnd_augment = augment;
 373 }
 374
 375 void
 376 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from)
 377 {
 378         int sctp_cwnd_log_at;
 379
 380         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 381         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 382         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 383         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_LOCK_EVENT;
 384         if (inp) {
 385                 sctp_clog[sctp_cwnd_log_at].x.lock.sock = (void *)inp->sctp_socket;
 386
 387         } else {
 388                 sctp_clog[sctp_cwnd_log_at].x.lock.sock = (void *)NULL;
 389         }
 390         sctp_clog[sctp_cwnd_log_at].x.lock.inp = (void *)inp;
 391         if (stcb) {
 392                 sctp_clog[sctp_cwnd_log_at].x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx);
 393         } else {
 394                 sctp_clog[sctp_cwnd_log_at].x.lock.tcb_lock = SCTP_LOCK_UNKNOWN;
 395         }
 396         if (inp) {
 397                 sctp_clog[sctp_cwnd_log_at].x.lock.inp_lock = mtx_owned(&inp->inp_mtx);
 398                 sctp_clog[sctp_cwnd_log_at].x.lock.create_lock = mtx_owned(&inp->inp_create_mtx);
 399         } else {
 400                 sctp_clog[sctp_cwnd_log_at].x.lock.inp_lock = SCTP_LOCK_UNKNOWN;
 401                 sctp_clog[sctp_cwnd_log_at].x.lock.create_lock = SCTP_LOCK_UNKNOWN;
 402         }
 403         sctp_clog[sctp_cwnd_log_at].x.lock.info_lock = mtx_owned(&sctppcbinfo.ipi_ep_mtx);
 404         if (inp->sctp_socket) {
 405                 sctp_clog[sctp_cwnd_log_at].x.lock.sock_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 406                 sctp_clog[sctp_cwnd_log_at].x.lock.sockrcvbuf_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 407                 sctp_clog[sctp_cwnd_log_at].x.lock.socksndbuf_lock = mtx_owned(&(inp->sctp_socket->so_snd.sb_mtx));
 408         } else {
 409                 sctp_clog[sctp_cwnd_log_at].x.lock.sock_lock = SCTP_LOCK_UNKNOWN;
 410                 sctp_clog[sctp_cwnd_log_at].x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN;
 411                 sctp_clog[sctp_cwnd_log_at].x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN;
 412         }
 413 }
 414
 415 void
 416 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from)
 417 {
 418         int sctp_cwnd_log_at;
 419
 420         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 421         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 422         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 423         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_MAXBURST;
 424         sctp_clog[sctp_cwnd_log_at].x.cwnd.net = net;
 425         sctp_clog[sctp_cwnd_log_at].x.cwnd.cwnd_new_value = error;
 426         sctp_clog[sctp_cwnd_log_at].x.cwnd.inflight = net->flight_size;
 427         sctp_clog[sctp_cwnd_log_at].x.cwnd.cwnd_augment = burst;
 428         if (stcb->asoc.send_queue_cnt > 255)
 429                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_send = 255;
 430         else
 431                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 432         if (stcb->asoc.stream_queue_cnt > 255)
 433                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_str = 255;
 434         else
 435                 sctp_clog[sctp_cwnd_log_at].x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 436 }
 437
 438 void
 439 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead)
 440 {
 441         int sctp_cwnd_log_at;
 442
 443         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 444         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 445         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 446         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_RWND;
 447         sctp_clog[sctp_cwnd_log_at].x.rwnd.rwnd = peers_rwnd;
 448         sctp_clog[sctp_cwnd_log_at].x.rwnd.send_size = snd_size;
 449         sctp_clog[sctp_cwnd_log_at].x.rwnd.overhead = overhead;
 450         sctp_clog[sctp_cwnd_log_at].x.rwnd.new_rwnd = 0;
 451 }
 452
 453 void
 454 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval)
 455 {
 456         int sctp_cwnd_log_at;
 457
 458         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 459         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 460         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 461         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_RWND;
 462         sctp_clog[sctp_cwnd_log_at].x.rwnd.rwnd = peers_rwnd;
 463         sctp_clog[sctp_cwnd_log_at].x.rwnd.send_size = flight_size;
 464         sctp_clog[sctp_cwnd_log_at].x.rwnd.overhead = overhead;
 465         sctp_clog[sctp_cwnd_log_at].x.rwnd.new_rwnd = a_rwndval;
 466 }
 467
 468 void
 469 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt)
 470 {
 471         int sctp_cwnd_log_at;
 472
 473         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 474         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 475         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 476         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_MBCNT;
 477         sctp_clog[sctp_cwnd_log_at].x.mbcnt.total_queue_size = total_oq;
 478         sctp_clog[sctp_cwnd_log_at].x.mbcnt.size_change = book;
 479         sctp_clog[sctp_cwnd_log_at].x.mbcnt.total_queue_mb_size = total_mbcnt_q;
 480         sctp_clog[sctp_cwnd_log_at].x.mbcnt.mbcnt_change = mbcnt;
 481 }
 482
 483 void
 484 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d)
 485 {
 486         int sctp_cwnd_log_at;
 487
 488         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 489         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 490         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 491         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_MISC_EVENT;
 492         sctp_clog[sctp_cwnd_log_at].x.misc.log1 = a;
 493         sctp_clog[sctp_cwnd_log_at].x.misc.log2 = b;
 494         sctp_clog[sctp_cwnd_log_at].x.misc.log3 = c;
 495         sctp_clog[sctp_cwnd_log_at].x.misc.log4 = d;
 496 }
 497
 498 void
 499 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t cumtsn, uint32_t wake_cnt, int from)
 500 {
 501         int sctp_cwnd_log_at;
 502
 503         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 504         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 505         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 506         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_WAKE;
 507         sctp_clog[sctp_cwnd_log_at].x.wake.stcb = (void *)stcb;
 508         sctp_clog[sctp_cwnd_log_at].x.wake.wake_cnt = wake_cnt;
 509         sctp_clog[sctp_cwnd_log_at].x.wake.flight = stcb->asoc.total_flight_count;
 510         sctp_clog[sctp_cwnd_log_at].x.wake.send_q = stcb->asoc.send_queue_cnt;
 511         sctp_clog[sctp_cwnd_log_at].x.wake.sent_q = stcb->asoc.sent_queue_cnt;
 512
 513         if (stcb->asoc.stream_queue_cnt < 0xff)
 514                 sctp_clog[sctp_cwnd_log_at].x.wake.stream_qcnt = (uint8_t) stcb->asoc.stream_queue_cnt;
 515         else
 516                 sctp_clog[sctp_cwnd_log_at].x.wake.stream_qcnt = 0xff;
 517
 518         if (stcb->asoc.chunks_on_out_queue < 0xff)
 519                 sctp_clog[sctp_cwnd_log_at].x.wake.chunks_on_oque = (uint8_t) stcb->asoc.chunks_on_out_queue;
 520         else
 521                 sctp_clog[sctp_cwnd_log_at].x.wake.chunks_on_oque = 0xff;
 522
 523         sctp_clog[sctp_cwnd_log_at].x.wake.sctpflags = 0;
 524         /* set in the defered mode stuff */
 525         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE)
 526                 sctp_clog[sctp_cwnd_log_at].x.wake.sctpflags |= 1;
 527         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT)
 528                 sctp_clog[sctp_cwnd_log_at].x.wake.sctpflags |= 2;
 529         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT)
 530                 sctp_clog[sctp_cwnd_log_at].x.wake.sctpflags |= 4;
 531         /* what about the sb */
 532         if (stcb->sctp_socket) {
 533                 struct socket *so = stcb->sctp_socket;
 534
 535                 sctp_clog[sctp_cwnd_log_at].x.wake.sbflags = (uint8_t) ((so->so_snd.sb_flags & 0x00ff));
 536         } else {
 537                 sctp_clog[sctp_cwnd_log_at].x.wake.sbflags = 0xff;
 538         }
 539 }
 540
 541 void
 542 sctp_log_block(uint8_t from, struct socket *so, struct sctp_association *asoc, int sendlen)
 543 {
 544         int sctp_cwnd_log_at;
 545
 546         SCTP_STATLOG_GETREF(sctp_cwnd_log_at);
 547         sctp_clog[sctp_cwnd_log_at].from = (uint8_t) from;
 548         sctp_clog[sctp_cwnd_log_at].time_event = sctp_get_time_of_event();
 549         sctp_clog[sctp_cwnd_log_at].event_type = (uint8_t) SCTP_LOG_EVENT_BLOCK;
 550         sctp_clog[sctp_cwnd_log_at].x.blk.onsb = asoc->total_output_queue_size;
 551         sctp_clog[sctp_cwnd_log_at].x.blk.send_sent_qcnt = (uint16_t) (asoc->send_queue_cnt + asoc->sent_queue_cnt);
 552         sctp_clog[sctp_cwnd_log_at].x.blk.peer_rwnd = asoc->peers_rwnd;
 553         sctp_clog[sctp_cwnd_log_at].x.blk.stream_qcnt = (uint16_t) asoc->stream_queue_cnt;
 554         sctp_clog[sctp_cwnd_log_at].x.blk.chunks_on_oque = (uint16_t) asoc->chunks_on_out_queue;
 555         sctp_clog[sctp_cwnd_log_at].x.blk.flight_size = (uint16_t) (asoc->total_flight / 1024);
 556         sctp_clog[sctp_cwnd_log_at].x.blk.sndlen = sendlen;
 557 }
 558
 559 int
 560 sctp_fill_stat_log(struct mbuf *m)
 561 {
 562         int sctp_cwnd_log_at;
 563         struct sctp_cwnd_log_req *req;
 564         size_t size_limit;
 565         int num, i, at, cnt_out = 0;
 566
 567         if (m == NULL)
 568                 return (EINVAL);
 569
 570         size_limit = (m->m_len - sizeof(struct sctp_cwnd_log_req));
 571         if (size_limit < sizeof(struct sctp_cwnd_log)) {
 572                 return (EINVAL);
 573         }
 574         sctp_cwnd_log_at = global_sctp_cwnd_log_at;
 575         req = mtod(m, struct sctp_cwnd_log_req *);
 576         num = size_limit / sizeof(struct sctp_cwnd_log);
 577         if (global_sctp_cwnd_log_rolled) {
 578                 req->num_in_log = SCTP_STAT_LOG_SIZE;
 579         } else {
 580                 req->num_in_log = sctp_cwnd_log_at;
 581                 /*
 582                  * if the log has not rolled, we don't let you have old
 583                  * data.
 584                  */
 585                 if (req->end_at > sctp_cwnd_log_at) {
 586                         req->end_at = sctp_cwnd_log_at;
 587                 }
 588         }
 589         if ((num < SCTP_STAT_LOG_SIZE) &&
 590             ((global_sctp_cwnd_log_rolled) || (sctp_cwnd_log_at > num))) {
 591                 /* we can't return all of it */
 592                 if (((req->start_at == 0) && (req->end_at == 0)) ||
 593                     (req->start_at >= SCTP_STAT_LOG_SIZE) ||
 594                     (req->end_at >= SCTP_STAT_LOG_SIZE)) {
 595                         /* No user request or user is wacked. */
 596                         req->num_ret = num;
 597                         req->end_at = sctp_cwnd_log_at - 1;
 598                         if ((sctp_cwnd_log_at - num) < 0) {
 599                                 int cc;
 600
 601                                 cc = num - sctp_cwnd_log_at;
 602                                 req->start_at = SCTP_STAT_LOG_SIZE - cc;
 603                         } else {
 604                                 req->start_at = sctp_cwnd_log_at - num;
 605                         }
 606                 } else {
 607                         /* a user request */
 608                         int cc;
 609
 610                         if (req->start_at > req->end_at) {
 611                                 cc = (SCTP_STAT_LOG_SIZE - req->start_at) +
 612                                     (req->end_at + 1);
 613                         } else {
 614
 615                                 cc = (req->end_at - req->start_at) + 1;
 616                         }
 617                         if (cc < num) {
 618                                 num = cc;
 619                         }
 620                         req->num_ret = num;
 621                 }
 622         } else {
 623                 /* We can return all  of it */
 624                 req->start_at = 0;
 625                 req->end_at = sctp_cwnd_log_at - 1;
 626                 req->num_ret = sctp_cwnd_log_at;
 627         }
 628 #ifdef INVARIENTS
 629         if (req->num_ret > num) {
 630                 panic("Bad statlog get?");
 631         }
 632 #endif
 633         for (i = 0, at = req->start_at; i < req->num_ret; i++) {
 634                 req->log[i] = sctp_clog[at];
 635                 cnt_out++;
 636                 at++;
 637                 if (at >= SCTP_STAT_LOG_SIZE)
 638                         at = 0;
 639         }
 640         m->m_len = (cnt_out * sizeof(struct sctp_cwnd_log)) + sizeof(struct sctp_cwnd_log_req);
 641         return (0);
 642 }
 643
 644 #endif
 645
 646 #ifdef SCTP_AUDITING_ENABLED
 647 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2];
 648 static int sctp_audit_indx = 0;
 649
 650 static
 651 void
 652 sctp_print_audit_report(void)
 653 {
 654         int i;
 655         int cnt;
 656
 657         cnt = 0;
 658         for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) {
 659                 if ((sctp_audit_data[i][0] == 0xe0) &&
 660                     (sctp_audit_data[i][1] == 0x01)) {
 661                         cnt = 0;
 662                         printf("\n");
 663                 } else if (sctp_audit_data[i][0] == 0xf0) {
 664                         cnt = 0;
 665                         printf("\n");
 666                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 667                     (sctp_audit_data[i][1] == 0x01)) {
 668                         printf("\n");
 669                         cnt = 0;
 670                 }
 671                 printf("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0],
 672                     (uint32_t) sctp_audit_data[i][1]);
 673                 cnt++;
 674                 if ((cnt % 14) == 0)
 675                         printf("\n");
 676         }
 677         for (i = 0; i < sctp_audit_indx; i++) {
 678                 if ((sctp_audit_data[i][0] == 0xe0) &&
 679                     (sctp_audit_data[i][1] == 0x01)) {
 680                         cnt = 0;
 681                         printf("\n");
 682                 } else if (sctp_audit_data[i][0] == 0xf0) {
 683                         cnt = 0;
 684                         printf("\n");
 685                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 686                     (sctp_audit_data[i][1] == 0x01)) {
 687                         printf("\n");
 688                         cnt = 0;
 689                 }
 690                 printf("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0],
 691                     (uint32_t) sctp_audit_data[i][1]);
 692                 cnt++;
 693                 if ((cnt % 14) == 0)
 694                         printf("\n");
 695         }
 696         printf("\n");
 697 }
 698
 699 void
 700 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 701     struct sctp_nets *net)
 702 {
 703         int resend_cnt, tot_out, rep, tot_book_cnt;
 704         struct sctp_nets *lnet;
 705         struct sctp_tmit_chunk *chk;
 706
 707         sctp_audit_data[sctp_audit_indx][0] = 0xAA;
 708         sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from;
 709         sctp_audit_indx++;
 710         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 711                 sctp_audit_indx = 0;
 712         }
 713         if (inp == NULL) {
 714                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 715                 sctp_audit_data[sctp_audit_indx][1] = 0x01;
 716                 sctp_audit_indx++;
 717                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 718                         sctp_audit_indx = 0;
 719                 }
 720                 return;
 721         }
 722         if (stcb == NULL) {
 723                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 724                 sctp_audit_data[sctp_audit_indx][1] = 0x02;
 725                 sctp_audit_indx++;
 726                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 727                         sctp_audit_indx = 0;
 728                 }
 729                 return;
 730         }
 731         sctp_audit_data[sctp_audit_indx][0] = 0xA1;
 732         sctp_audit_data[sctp_audit_indx][1] =
 733             (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 734         sctp_audit_indx++;
 735         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 736                 sctp_audit_indx = 0;
 737         }
 738         rep = 0;
 739         tot_book_cnt = 0;
 740         resend_cnt = tot_out = 0;
 741         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 742                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 743                         resend_cnt++;
 744                 } else if (chk->sent < SCTP_DATAGRAM_RESEND) {
 745                         tot_out += chk->book_size;
 746                         tot_book_cnt++;
 747                 }
 748         }
 749         if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) {
 750                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 751                 sctp_audit_data[sctp_audit_indx][1] = 0xA1;
 752                 sctp_audit_indx++;
 753                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 754                         sctp_audit_indx = 0;
 755                 }
 756                 printf("resend_cnt:%d asoc-tot:%d\n",
 757                     resend_cnt, stcb->asoc.sent_queue_retran_cnt);
 758                 rep = 1;
 759                 stcb->asoc.sent_queue_retran_cnt = resend_cnt;
 760                 sctp_audit_data[sctp_audit_indx][0] = 0xA2;
 761                 sctp_audit_data[sctp_audit_indx][1] =
 762                     (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 763                 sctp_audit_indx++;
 764                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 765                         sctp_audit_indx = 0;
 766                 }
 767         }
 768         if (tot_out != stcb->asoc.total_flight) {
 769                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 770                 sctp_audit_data[sctp_audit_indx][1] = 0xA2;
 771                 sctp_audit_indx++;
 772                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 773                         sctp_audit_indx = 0;
 774                 }
 775                 rep = 1;
 776                 printf("tot_flt:%d asoc_tot:%d\n", tot_out,
 777                     (int)stcb->asoc.total_flight);
 778                 stcb->asoc.total_flight = tot_out;
 779         }
 780         if (tot_book_cnt != stcb->asoc.total_flight_count) {
 781                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 782                 sctp_audit_data[sctp_audit_indx][1] = 0xA5;
 783                 sctp_audit_indx++;
 784                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 785                         sctp_audit_indx = 0;
 786                 }
 787                 rep = 1;
 788                 printf("tot_flt_book:%d\n", tot_book);
 789
 790                 stcb->asoc.total_flight_count = tot_book_cnt;
 791         }
 792         tot_out = 0;
 793         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 794                 tot_out += lnet->flight_size;
 795         }
 796         if (tot_out != stcb->asoc.total_flight) {
 797                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 798                 sctp_audit_data[sctp_audit_indx][1] = 0xA3;
 799                 sctp_audit_indx++;
 800                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 801                         sctp_audit_indx = 0;
 802                 }
 803                 rep = 1;
 804                 printf("real flight:%d net total was %d\n",
 805                     stcb->asoc.total_flight, tot_out);
 806                 /* now corrective action */
 807                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 808
 809                         tot_out = 0;
 810                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 811                                 if ((chk->whoTo == lnet) &&
 812                                     (chk->sent < SCTP_DATAGRAM_RESEND)) {
 813                                         tot_out += chk->book_size;
 814                                 }
 815                         }
 816                         if (lnet->flight_size != tot_out) {
 817                                 printf("net:%x flight was %d corrected to %d\n",
 818                                     (uint32_t) lnet, lnet->flight_size, tot_out);
 819                                 lnet->flight_size = tot_out;
 820                         }
 821                 }
 822         }
 823         if (rep) {
 824                 sctp_print_audit_report();
 825         }
 826 }
 827
 828 void
 829 sctp_audit_log(uint8_t ev, uint8_t fd)
 830 {
 831         int s;
 832
 833         s = splnet();
 834         sctp_audit_data[sctp_audit_indx][0] = ev;
 835         sctp_audit_data[sctp_audit_indx][1] = fd;
 836         sctp_audit_indx++;
 837         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 838                 sctp_audit_indx = 0;
 839         }
 840         splx(s);
 841 }
 842
 843 #endif
 844
 845 /*
 846  * a list of sizes based on typical mtu's, used only if next hop size not
 847  * returned.
 848  */
 849 static int sctp_mtu_sizes[] = {
 850         68,
 851         296,
 852         508,
 853         512,
 854         544,
 855         576,
 856         1006,
 857         1492,
 858         1500,
 859         1536,
 860         2002,
 861         2048,
 862         4352,
 863         4464,
 864         8166,
 865         17914,
 866         32000,
 867         65535
 868 };
 869
 870 void
 871 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb)
 872 {
 873         struct sctp_association *asoc;
 874         struct sctp_nets *net;
 875
 876         asoc = &stcb->asoc;
 877
 878         callout_stop(&asoc->hb_timer.timer);
 879         callout_stop(&asoc->dack_timer.timer);
 880         callout_stop(&asoc->strreset_timer.timer);
 881         callout_stop(&asoc->asconf_timer.timer);
 882         callout_stop(&asoc->autoclose_timer.timer);
 883         callout_stop(&asoc->delayed_event_timer.timer);
 884         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
 885                 callout_stop(&net->fr_timer.timer);
 886                 callout_stop(&net->pmtu_timer.timer);
 887         }
 888 }
 889
 890 int
 891 find_next_best_mtu(int totsz)
 892 {
 893         int i, perfer;
 894
 895         /*
 896          * if we are in here we must find the next best fit based on the
 897          * size of the dg that failed to be sent.
 898          */
 899         perfer = 0;
 900         for (i = 0; i < NUMBER_OF_MTU_SIZES; i++) {
 901                 if (totsz < sctp_mtu_sizes[i]) {
 902                         perfer = i - 1;
 903                         if (perfer < 0)
 904                                 perfer = 0;
 905                         break;
 906                 }
 907         }
 908         return (sctp_mtu_sizes[perfer]);
 909 }
 910
 911 void
 912 sctp_fill_random_store(struct sctp_pcb *m)
 913 {
 914         /*
 915          * Here we use the MD5/SHA-1 to hash with our good randomNumbers and
 916          * our counter. The result becomes our good random numbers and we
 917          * then setup to give these out. Note that we do no locking to
 918          * protect this. This is ok, since if competing folks call this we
 919          * will get more gobbled gook in the random store whic is what we
 920          * want. There is a danger that two guys will use the same random
 921          * numbers, but thats ok too since that is random as well :->
 922          */
 923         m->store_at = 0;
 924         sctp_hmac(SCTP_HMAC, (uint8_t *) m->random_numbers,
 925             sizeof(m->random_numbers), (uint8_t *) & m->random_counter,
 926             sizeof(m->random_counter), (uint8_t *) m->random_store);
 927         m->random_counter++;
 928 }
 929
 930 uint32_t
 931 sctp_select_initial_TSN(struct sctp_pcb *m)
 932 {
 933         /*
 934          * A true implementation should use random selection process to get
 935          * the initial stream sequence number, using RFC1750 as a good
 936          * guideline
 937          */
 938         u_long x, *xp;
 939         uint8_t *p;
 940
 941         if (m->initial_sequence_debug != 0) {
 942                 uint32_t ret;
 943
 944                 ret = m->initial_sequence_debug;
 945                 m->initial_sequence_debug++;
 946                 return (ret);
 947         }
 948         if ((m->store_at + sizeof(u_long)) > SCTP_SIGNATURE_SIZE) {
 949                 /* Refill the random store */
 950                 sctp_fill_random_store(m);
 951         }
 952         p = &m->random_store[(int)m->store_at];
 953         xp = (u_long *)p;
 954         x = *xp;
 955         m->store_at += sizeof(u_long);
 956         return (x);
 957 }
 958
 959 uint32_t
 960 sctp_select_a_tag(struct sctp_inpcb *m)
 961 {
 962         u_long x, not_done;
 963         struct timeval now;
 964
 965         SCTP_GETTIME_TIMEVAL(&now);
 966         not_done = 1;
 967         while (not_done) {
 968                 x = sctp_select_initial_TSN(&m->sctp_ep);
 969                 if (x == 0) {
 970                         /* we never use 0 */
 971                         continue;
 972                 }
 973                 if (sctp_is_vtag_good(m, x, &now)) {
 974                         not_done = 0;
 975                 }
 976         }
 977         return (x);
 978 }
 979
 980
 981 int
 982 sctp_init_asoc(struct sctp_inpcb *m, struct sctp_association *asoc,
 983     int for_a_init, uint32_t override_tag)
 984 {
 985         /*
 986          * Anything set to zero is taken care of by the allocation routine's
 987          * bzero
 988          */
 989
 990         /*
 991          * Up front select what scoping to apply on addresses I tell my peer
 992          * Not sure what to do with these right now, we will need to come up
 993          * with a way to set them. We may need to pass them through from the
 994          * caller in the sctp_aloc_assoc() function.
 995          */
 996         int i;
 997
 998         /* init all variables to a known value. */
 999         asoc->state = SCTP_STATE_INUSE;
1000         asoc->max_burst = m->sctp_ep.max_burst;
1001         asoc->heart_beat_delay = TICKS_TO_MSEC(m->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]);
1002         asoc->cookie_life = m->sctp_ep.def_cookie_life;
1003         asoc->sctp_cmt_on_off = (uint8_t) sctp_cmt_on_off;
1004 #ifdef AF_INET
1005         asoc->default_tos = m->ip_inp.inp.inp_ip_tos;
1006 #else
1007         asoc->default_tos = 0;
1008 #endif
1009
1010 #ifdef AF_INET6
1011         asoc->default_flowlabel = ((struct in6pcb *)m)->in6p_flowinfo;
1012 #else
1013         asoc->default_flowlabel = 0;
1014 #endif
1015         if (override_tag) {
1016                 struct timeval now;
1017
1018                 if (sctp_is_vtag_good(m, override_tag, &now)) {
1019                         asoc->my_vtag = override_tag;
1020                 } else {
1021                         return (ENOMEM);
1022                 }
1023
1024         } else {
1025                 asoc->my_vtag = sctp_select_a_tag(m);
1026         }
1027         /* Get the nonce tags */
1028         asoc->my_vtag_nonce = sctp_select_a_tag(m);
1029         asoc->peer_vtag_nonce = sctp_select_a_tag(m);
1030
1031         if (sctp_is_feature_on(m, SCTP_PCB_FLAGS_DONOT_HEARTBEAT))
1032                 asoc->hb_is_disabled = 1;
1033         else
1034                 asoc->hb_is_disabled = 0;
1035
1036         asoc->refcnt = 0;
1037         asoc->assoc_up_sent = 0;
1038         asoc->assoc_id = asoc->my_vtag;
1039         asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number = asoc->sending_seq =
1040             sctp_select_initial_TSN(&m->sctp_ep);
1041         /* we are optimisitic here */
1042         asoc->peer_supports_pktdrop = 1;
1043
1044         asoc->sent_queue_retran_cnt = 0;
1045
1046         /* for CMT */
1047         asoc->last_net_data_came_from = NULL;
1048
1049         /* This will need to be adjusted */
1050         asoc->last_cwr_tsn = asoc->init_seq_number - 1;
1051         asoc->last_acked_seq = asoc->init_seq_number - 1;
1052         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
1053         asoc->asconf_seq_in = asoc->last_acked_seq;
1054
1055         /* here we are different, we hold the next one we expect */
1056         asoc->str_reset_seq_in = asoc->last_acked_seq + 1;
1057
1058         asoc->initial_init_rto_max = m->sctp_ep.initial_init_rto_max;
1059         asoc->initial_rto = m->sctp_ep.initial_rto;
1060
1061         asoc->max_init_times = m->sctp_ep.max_init_times;
1062         asoc->max_send_times = m->sctp_ep.max_send_times;
1063         asoc->def_net_failure = m->sctp_ep.def_net_failure;
1064         asoc->free_chunk_cnt = 0;
1065
1066         asoc->iam_blocking = 0;
1067         /* ECN Nonce initialization */
1068         asoc->context = m->sctp_context;
1069         asoc->def_send = m->def_send;
1070         asoc->ecn_nonce_allowed = 0;
1071         asoc->receiver_nonce_sum = 1;
1072         asoc->nonce_sum_expect_base = 1;
1073         asoc->nonce_sum_check = 1;
1074         asoc->nonce_resync_tsn = 0;
1075         asoc->nonce_wait_for_ecne = 0;
1076         asoc->nonce_wait_tsn = 0;
1077         asoc->delayed_ack = TICKS_TO_MSEC(m->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]);
1078         asoc->pr_sctp_cnt = 0;
1079         asoc->total_output_queue_size = 0;
1080
1081         if (m->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
1082                 struct in6pcb *inp6;
1083
1084
1085                 /* Its a V6 socket */
1086                 inp6 = (struct in6pcb *)m;
1087                 asoc->ipv6_addr_legal = 1;
1088                 /* Now look at the binding flag to see if V4 will be legal */
1089                 if (
1090                     (inp6->inp_flags & IN6P_IPV6_V6ONLY)
1091                     == 0) {
1092                         asoc->ipv4_addr_legal = 1;
1093                 } else {
1094                         /* V4 addresses are NOT legal on the association */
1095                         asoc->ipv4_addr_legal = 0;
1096                 }
1097         } else {
1098                 /* Its a V4 socket, no - V6 */
1099                 asoc->ipv4_addr_legal = 1;
1100                 asoc->ipv6_addr_legal = 0;
1101         }
1102
1103
1104         asoc->my_rwnd = max(m->sctp_socket->so_rcv.sb_hiwat, SCTP_MINIMAL_RWND);
1105         asoc->peers_rwnd = m->sctp_socket->so_rcv.sb_hiwat;
1106
1107         asoc->smallest_mtu = m->sctp_frag_point;
1108         asoc->minrto = m->sctp_ep.sctp_minrto;
1109         asoc->maxrto = m->sctp_ep.sctp_maxrto;
1110
1111         asoc->locked_on_sending = NULL;
1112         asoc->stream_locked_on = 0;
1113         asoc->ecn_echo_cnt_onq = 0;
1114         asoc->stream_locked = 0;
1115
1116         LIST_INIT(&asoc->sctp_local_addr_list);
1117         TAILQ_INIT(&asoc->nets);
1118         TAILQ_INIT(&asoc->pending_reply_queue);
1119         asoc->last_asconf_ack_sent = NULL;
1120         /* Setup to fill the hb random cache at first HB */
1121         asoc->hb_random_idx = 4;
1122
1123         asoc->sctp_autoclose_ticks = m->sctp_ep.auto_close_time;
1124
1125         /*
1126          * Now the stream parameters, here we allocate space for all streams
1127          * that we request by default.
1128          */
1129         asoc->streamoutcnt = asoc->pre_open_streams =
1130             m->sctp_ep.pre_open_stream_count;
1131         SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *,
1132             asoc->streamoutcnt * sizeof(struct sctp_stream_out),
1133             "StreamsOut");
1134         if (asoc->strmout == NULL) {
1135                 /* big trouble no memory */
1136                 return (ENOMEM);
1137         }
1138         for (i = 0; i < asoc->streamoutcnt; i++) {
1139                 /*
1140                  * inbound side must be set to 0xffff, also NOTE when we get
1141                  * the INIT-ACK back (for INIT sender) we MUST reduce the
1142                  * count (streamoutcnt) but first check if we sent to any of
1143                  * the upper streams that were dropped (if some were). Those
1144                  * that were dropped must be notified to the upper layer as
1145                  * failed to send.
1146                  */
1147                 asoc->strmout[i].next_sequence_sent = 0x0;
1148                 TAILQ_INIT(&asoc->strmout[i].outqueue);
1149                 asoc->strmout[i].stream_no = i;
1150                 asoc->strmout[i].last_msg_incomplete = 0;
1151                 asoc->strmout[i].next_spoke.tqe_next = 0;
1152                 asoc->strmout[i].next_spoke.tqe_prev = 0;
1153         }
1154         /* Now the mapping array */
1155         asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY;
1156         SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size,
1157             "MappingArray");
1158         if (asoc->mapping_array == NULL) {
1159                 SCTP_FREE(asoc->strmout);
1160                 return (ENOMEM);
1161         }
1162         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
1163         /* Now the init of the other outqueues */
1164         TAILQ_INIT(&asoc->free_chunks);
1165         TAILQ_INIT(&asoc->free_strmoq);
1166         TAILQ_INIT(&asoc->out_wheel);
1167         TAILQ_INIT(&asoc->control_send_queue);
1168         TAILQ_INIT(&asoc->send_queue);
1169         TAILQ_INIT(&asoc->sent_queue);
1170         TAILQ_INIT(&asoc->reasmqueue);
1171         TAILQ_INIT(&asoc->resetHead);
1172         asoc->max_inbound_streams = m->sctp_ep.max_open_streams_intome;
1173         TAILQ_INIT(&asoc->asconf_queue);
1174         /* authentication fields */
1175         asoc->authinfo.random = NULL;
1176         asoc->authinfo.assoc_key = NULL;
1177         asoc->authinfo.assoc_keyid = 0;
1178         asoc->authinfo.recv_key = NULL;
1179         asoc->authinfo.recv_keyid = 0;
1180         LIST_INIT(&asoc->shared_keys);
1181
1182         return (0);
1183 }
1184
1185 int
1186 sctp_expand_mapping_array(struct sctp_association *asoc)
1187 {
1188         /* mapping array needs to grow */
1189         uint8_t *new_array;
1190         uint16_t new_size;
1191
1192         new_size = asoc->mapping_array_size + SCTP_MAPPING_ARRAY_INCR;
1193         SCTP_MALLOC(new_array, uint8_t *, new_size, "MappingArray");
1194         if (new_array == NULL) {
1195                 /* can't get more, forget it */
1196                 printf("No memory for expansion of SCTP mapping array %d\n",
1197                     new_size);
1198                 return (-1);
1199         }
1200         memset(new_array, 0, new_size);
1201         memcpy(new_array, asoc->mapping_array, asoc->mapping_array_size);
1202         SCTP_FREE(asoc->mapping_array);
1203         asoc->mapping_array = new_array;
1204         asoc->mapping_array_size = new_size;
1205         return (0);
1206 }
1207
1208 extern unsigned int sctp_early_fr_msec;
1209
1210 static void
1211 sctp_handle_addr_wq(void)
1212 {
1213         /* deal with the ADDR wq from the rtsock calls */
1214         struct sctp_laddr *wi;
1215
1216         SCTP_IPI_ADDR_LOCK();
1217         wi = LIST_FIRST(&sctppcbinfo.addr_wq);
1218         if (wi == NULL) {
1219                 SCTP_IPI_ADDR_UNLOCK();
1220                 return;
1221         }
1222         LIST_REMOVE(wi, sctp_nxt_addr);
1223         if (!LIST_EMPTY(&sctppcbinfo.addr_wq)) {
1224                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
1225                     (struct sctp_inpcb *)NULL,
1226                     (struct sctp_tcb *)NULL,
1227                     (struct sctp_nets *)NULL);
1228         }
1229         SCTP_IPI_ADDR_UNLOCK();
1230         if (wi->action == RTM_ADD) {
1231                 sctp_add_ip_address(wi->ifa);
1232         } else if (wi->action == RTM_DELETE) {
1233                 sctp_delete_ip_address(wi->ifa);
1234         }
1235         IFAFREE(wi->ifa);
1236         SCTP_ZONE_FREE(sctppcbinfo.ipi_zone_laddr, wi);
1237         SCTP_DECR_LADDR_COUNT();
1238 }
1239
1240 void
1241 sctp_timeout_handler(void *t)
1242 {
1243         struct sctp_inpcb *inp;
1244         struct sctp_tcb *stcb;
1245         struct sctp_nets *net;
1246         struct sctp_timer *tmr;
1247         int s, did_output;
1248         struct sctp_iterator *it = NULL;
1249
1250
1251         s = splnet();
1252         tmr = (struct sctp_timer *)t;
1253         inp = (struct sctp_inpcb *)tmr->ep;
1254         stcb = (struct sctp_tcb *)tmr->tcb;
1255         net = (struct sctp_nets *)tmr->net;
1256         did_output = 1;
1257
1258 #ifdef SCTP_AUDITING_ENABLED
1259         sctp_audit_log(0xF0, (uint8_t) tmr->type);
1260         sctp_auditing(3, inp, stcb, net);
1261 #endif
1262
1263         /* sanity checks... */
1264         if (tmr->self != (void *)tmr) {
1265                 /*
1266                  * printf("Stale SCTP timer fired (%p), ignoring...\n",
1267                  * tmr);
1268                  */
1269                 splx(s);
1270                 return;
1271         }
1272         if (!SCTP_IS_TIMER_TYPE_VALID(tmr->type)) {
1273                 /*
1274                  * printf("SCTP timer fired with invalid type: 0x%x\n",
1275                  * tmr->type);
1276                  */
1277                 splx(s);
1278                 return;
1279         }
1280         if ((tmr->type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL)) {
1281                 splx(s);
1282                 return;
1283         }
1284         /* if this is an iterator timeout, get the struct and clear inp */
1285         if (tmr->type == SCTP_TIMER_TYPE_ITERATOR) {
1286                 it = (struct sctp_iterator *)inp;
1287                 inp = NULL;
1288         }
1289         if (inp) {
1290                 SCTP_INP_INCR_REF(inp);
1291                 if ((inp->sctp_socket == 0) &&
1292                     ((tmr->type != SCTP_TIMER_TYPE_INPKILL) &&
1293                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWN) &&
1294                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNACK) &&
1295                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNGUARD) &&
1296                     (tmr->type != SCTP_TIMER_TYPE_ASOCKILL))
1297                     ) {
1298                         splx(s);
1299                         SCTP_INP_DECR_REF(inp);
1300                         return;
1301                 }
1302         }
1303         if (stcb) {
1304                 if (stcb->asoc.state == 0) {
1305                         splx(s);
1306                         if (inp) {
1307                                 SCTP_INP_DECR_REF(inp);
1308                         }
1309                         return;
1310                 }
1311         }
1312 #ifdef SCTP_DEBUG
1313         if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1314                 printf("Timer type %d goes off\n", tmr->type);
1315         }
1316 #endif                          /* SCTP_DEBUG */
1317         if (!callout_active(&tmr->timer)) {
1318                 splx(s);
1319                 if (inp) {
1320                         SCTP_INP_DECR_REF(inp);
1321                 }
1322                 return;
1323         }
1324         if (stcb) {
1325                 atomic_add_int(&stcb->asoc.refcnt, 1);
1326                 SCTP_TCB_LOCK(stcb);
1327                 atomic_add_int(&stcb->asoc.refcnt, -1);
1328         }
1329         /* mark as being serviced now */
1330         callout_deactivate(&tmr->timer);
1331
1332         /* call the handler for the appropriate timer type */
1333         switch (tmr->type) {
1334         case SCTP_TIMER_TYPE_ADDR_WQ:
1335                 sctp_handle_addr_wq();
1336                 break;
1337         case SCTP_TIMER_TYPE_ITERATOR:
1338                 SCTP_STAT_INCR(sctps_timoiterator);
1339                 sctp_iterator_timer(it);
1340                 break;
1341         case SCTP_TIMER_TYPE_SEND:
1342                 SCTP_STAT_INCR(sctps_timodata);
1343                 stcb->asoc.num_send_timers_up--;
1344                 if (stcb->asoc.num_send_timers_up < 0) {
1345                         stcb->asoc.num_send_timers_up = 0;
1346                 }
1347                 if (sctp_t3rxt_timer(inp, stcb, net)) {
1348                         /* no need to unlock on tcb its gone */
1349
1350                         goto out_decr;
1351                 }
1352 #ifdef SCTP_AUDITING_ENABLED
1353                 sctp_auditing(4, inp, stcb, net);
1354 #endif
1355                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3);
1356                 if ((stcb->asoc.num_send_timers_up == 0) &&
1357                     (stcb->asoc.sent_queue_cnt > 0)
1358                     ) {
1359                         struct sctp_tmit_chunk *chk;
1360
1361                         /*
1362                          * safeguard. If there on some on the sent queue
1363                          * somewhere but no timers running something is
1364                          * wrong... so we start a timer on the first chunk
1365                          * on the send queue on whatever net it is sent to.
1366                          */
1367                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1368                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb,
1369                             chk->whoTo);
1370                 }
1371                 break;
1372         case SCTP_TIMER_TYPE_INIT:
1373                 SCTP_STAT_INCR(sctps_timoinit);
1374                 if (sctp_t1init_timer(inp, stcb, net)) {
1375                         /* no need to unlock on tcb its gone */
1376                         goto out_decr;
1377                 }
1378                 /* We do output but not here */
1379                 did_output = 0;
1380                 break;
1381         case SCTP_TIMER_TYPE_RECV:
1382                 SCTP_STAT_INCR(sctps_timosack);
1383                 sctp_send_sack(stcb);
1384 #ifdef SCTP_AUDITING_ENABLED
1385                 sctp_auditing(4, inp, stcb, net);
1386 #endif
1387                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR);
1388                 break;
1389         case SCTP_TIMER_TYPE_SHUTDOWN:
1390                 if (sctp_shutdown_timer(inp, stcb, net)) {
1391                         /* no need to unlock on tcb its gone */
1392                         goto out_decr;
1393                 }
1394                 SCTP_STAT_INCR(sctps_timoshutdown);
1395 #ifdef SCTP_AUDITING_ENABLED
1396                 sctp_auditing(4, inp, stcb, net);
1397 #endif
1398                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR);
1399                 break;
1400         case SCTP_TIMER_TYPE_HEARTBEAT:
1401                 {
1402                         struct sctp_nets *net;
1403                         int cnt_of_unconf = 0;
1404
1405                         SCTP_STAT_INCR(sctps_timoheartbeat);
1406                         TAILQ_FOREACH(net, &stcb->asoc.nets, sctp_next) {
1407                                 if ((net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
1408                                     (net->dest_state & SCTP_ADDR_REACHABLE)) {
1409                                         cnt_of_unconf++;
1410                                 }
1411                         }
1412                         if (cnt_of_unconf == 0) {
1413                                 if (sctp_heartbeat_timer(inp, stcb, net, cnt_of_unconf)) {
1414                                         /* no need to unlock on tcb its gone */
1415                                         goto out_decr;
1416                                 }
1417                         }
1418 #ifdef SCTP_AUDITING_ENABLED
1419                         sctp_auditing(4, inp, stcb, net);
1420 #endif
1421                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, stcb->sctp_ep,
1422                             stcb, net);
1423                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR);
1424                 }
1425                 break;
1426         case SCTP_TIMER_TYPE_COOKIE:
1427                 if (sctp_cookie_timer(inp, stcb, net)) {
1428                         /* no need to unlock on tcb its gone */
1429                         goto out_decr;
1430                 }
1431                 SCTP_STAT_INCR(sctps_timocookie);
1432 #ifdef SCTP_AUDITING_ENABLED
1433                 sctp_auditing(4, inp, stcb, net);
1434 #endif
1435                 /*
1436                  * We consider T3 and Cookie timer pretty much the same with
1437                  * respect to where from in chunk_output.
1438                  */
1439                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3);
1440                 break;
1441         case SCTP_TIMER_TYPE_NEWCOOKIE:
1442                 {
1443                         struct timeval tv;
1444                         int i, secret;
1445
1446                         SCTP_STAT_INCR(sctps_timosecret);
1447                         SCTP_GETTIME_TIMEVAL(&tv);
1448                         SCTP_INP_WLOCK(inp);
1449                         inp->sctp_ep.time_of_secret_change = tv.tv_sec;
1450                         inp->sctp_ep.last_secret_number =
1451                             inp->sctp_ep.current_secret_number;
1452                         inp->sctp_ep.current_secret_number++;
1453                         if (inp->sctp_ep.current_secret_number >=
1454                             SCTP_HOW_MANY_SECRETS) {
1455                                 inp->sctp_ep.current_secret_number = 0;
1456                         }
1457                         secret = (int)inp->sctp_ep.current_secret_number;
1458                         for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1459                                 inp->sctp_ep.secret_key[secret][i] =
1460                                     sctp_select_initial_TSN(&inp->sctp_ep);
1461                         }
1462                         SCTP_INP_WUNLOCK(inp);
1463                         sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, stcb, net);
1464                 }
1465                 did_output = 0;
1466                 break;
1467         case SCTP_TIMER_TYPE_PATHMTURAISE:
1468                 SCTP_STAT_INCR(sctps_timopathmtu);
1469                 sctp_pathmtu_timer(inp, stcb, net);
1470                 did_output = 0;
1471                 break;
1472         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1473                 if (sctp_shutdownack_timer(inp, stcb, net)) {
1474                         /* no need to unlock on tcb its gone */
1475                         goto out_decr;
1476                 }
1477                 SCTP_STAT_INCR(sctps_timoshutdownack);
1478 #ifdef SCTP_AUDITING_ENABLED
1479                 sctp_auditing(4, inp, stcb, net);
1480 #endif
1481                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR);
1482                 break;
1483         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1484                 SCTP_STAT_INCR(sctps_timoshutdownguard);
1485                 sctp_abort_an_association(inp, stcb,
1486                     SCTP_SHUTDOWN_GUARD_EXPIRES, NULL);
1487                 /* no need to unlock on tcb its gone */
1488                 goto out_decr;
1489                 break;
1490
1491         case SCTP_TIMER_TYPE_STRRESET:
1492                 if (sctp_strreset_timer(inp, stcb, net)) {
1493                         /* no need to unlock on tcb its gone */
1494                         goto out_decr;
1495                 }
1496                 SCTP_STAT_INCR(sctps_timostrmrst);
1497                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR);
1498                 break;
1499         case SCTP_TIMER_TYPE_EARLYFR:
1500                 /* Need to do FR of things for net */
1501                 SCTP_STAT_INCR(sctps_timoearlyfr);
1502                 sctp_early_fr_timer(inp, stcb, net);
1503                 break;
1504         case SCTP_TIMER_TYPE_ASCONF:
1505                 if (sctp_asconf_timer(inp, stcb, net)) {
1506                         /* no need to unlock on tcb its gone */
1507                         goto out_decr;
1508                 }
1509                 SCTP_STAT_INCR(sctps_timoasconf);
1510 #ifdef SCTP_AUDITING_ENABLED
1511                 sctp_auditing(4, inp, stcb, net);
1512 #endif
1513                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR);
1514                 break;
1515
1516         case SCTP_TIMER_TYPE_AUTOCLOSE:
1517                 SCTP_STAT_INCR(sctps_timoautoclose);
1518                 sctp_autoclose_timer(inp, stcb, net);
1519                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR);
1520                 did_output = 0;
1521                 break;
1522         case SCTP_TIMER_TYPE_ASOCKILL:
1523                 SCTP_STAT_INCR(sctps_timoassockill);
1524                 /* Can we free it yet? */
1525                 SCTP_INP_DECR_REF(inp);
1526                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL);
1527                 sctp_free_assoc(inp, stcb, 0);
1528                 /*
1529                  * free asoc, always unlocks (or destroy's) so prevent
1530                  * duplicate unlock or unlock of a free mtx :-0
1531                  */
1532                 stcb = NULL;
1533                 goto out_no_decr;
1534                 break;
1535         case SCTP_TIMER_TYPE_INPKILL:
1536                 SCTP_STAT_INCR(sctps_timoinpkill);
1537                 /*
1538                  * special case, take away our increment since WE are the
1539                  * killer
1540                  */
1541                 SCTP_INP_DECR_REF(inp);
1542                 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL);
1543                 sctp_inpcb_free(inp, 1, 0);
1544                 goto out_no_decr;
1545                 break;
1546         default:
1547 #ifdef SCTP_DEBUG
1548                 if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1549                         printf("sctp_timeout_handler:unknown timer %d\n",
1550                             tmr->type);
1551                 }
1552 #endif                          /* SCTP_DEBUG */
1553                 break;
1554         };
1555 #ifdef SCTP_AUDITING_ENABLED
1556         sctp_audit_log(0xF1, (uint8_t) tmr->type);
1557         if (inp)
1558                 sctp_auditing(5, inp, stcb, net);
1559 #endif
1560         if ((did_output) && stcb) {
1561                 /*
1562                  * Now we need to clean up the control chunk chain if an
1563                  * ECNE is on it. It must be marked as UNSENT again so next
1564                  * call will continue to send it until such time that we get
1565                  * a CWR, to remove it. It is, however, less likely that we
1566                  * will find a ecn echo on the chain though.
1567                  */
1568                 sctp_fix_ecn_echo(&stcb->asoc);
1569         }
1570         if (stcb) {
1571                 SCTP_TCB_UNLOCK(stcb);
1572         }
1573 out_decr:
1574         if (inp) {
1575                 SCTP_INP_DECR_REF(inp);
1576         }
1577 out_no_decr:
1578
1579 #ifdef SCTP_DEBUG
1580         if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1581                 printf("Timer now complete (type %d)\n", tmr->type);
1582         }
1583 #endif                          /* SCTP_DEBUG */
1584         splx(s);
1585         if (inp) {
1586         }
1587 }
1588
1589 int
1590 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1591     struct sctp_nets *net)
1592 {
1593         int to_ticks;
1594         struct sctp_timer *tmr;
1595
1596
1597         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) &&
1598             (inp == NULL))
1599                 return (EFAULT);
1600
1601         to_ticks = 0;
1602
1603         tmr = NULL;
1604         if (stcb) {
1605                 SCTP_TCB_LOCK_ASSERT(stcb);
1606         }
1607         switch (t_type) {
1608         case SCTP_TIMER_TYPE_ADDR_WQ:
1609                 /* Only 1 tick away :-) */
1610                 tmr = &sctppcbinfo.addr_wq_timer;
1611                 to_ticks = 1;
1612                 break;
1613         case SCTP_TIMER_TYPE_ITERATOR:
1614                 {
1615                         struct sctp_iterator *it;
1616
1617                         it = (struct sctp_iterator *)inp;
1618                         tmr = &it->tmr;
1619                         to_ticks = SCTP_ITERATOR_TICKS;
1620                 }
1621                 break;
1622         case SCTP_TIMER_TYPE_SEND:
1623                 /* Here we use the RTO timer */
1624                 {
1625                         int rto_val;
1626
1627                         if ((stcb == NULL) || (net == NULL)) {
1628                                 return (EFAULT);
1629                         }
1630                         tmr = &net->rxt_timer;
1631                         if (net->RTO == 0) {
1632                                 rto_val = stcb->asoc.initial_rto;
1633                         } else {
1634                                 rto_val = net->RTO;
1635                         }
1636                         to_ticks = MSEC_TO_TICKS(rto_val);
1637                 }
1638                 break;
1639         case SCTP_TIMER_TYPE_INIT:
1640                 /*
1641                  * Here we use the INIT timer default usually about 1
1642                  * minute.
1643                  */
1644                 if ((stcb == NULL) || (net == NULL)) {
1645                         return (EFAULT);
1646                 }
1647                 tmr = &net->rxt_timer;
1648                 if (net->RTO == 0) {
1649                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1650                 } else {
1651                         to_ticks = MSEC_TO_TICKS(net->RTO);
1652                 }
1653                 break;
1654         case SCTP_TIMER_TYPE_RECV:
1655                 /*
1656                  * Here we use the Delayed-Ack timer value from the inp
1657                  * ususually about 200ms.
1658                  */
1659                 if (stcb == NULL) {
1660                         return (EFAULT);
1661                 }
1662                 tmr = &stcb->asoc.dack_timer;
1663                 to_ticks = MSEC_TO_TICKS(stcb->asoc.delayed_ack);
1664                 break;
1665         case SCTP_TIMER_TYPE_SHUTDOWN:
1666                 /* Here we use the RTO of the destination. */
1667                 if ((stcb == NULL) || (net == NULL)) {
1668                         return (EFAULT);
1669                 }
1670                 if (net->RTO == 0) {
1671                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1672                 } else {
1673                         to_ticks = MSEC_TO_TICKS(net->RTO);
1674                 }
1675                 tmr = &net->rxt_timer;
1676                 break;
1677         case SCTP_TIMER_TYPE_HEARTBEAT:
1678                 /*
1679                  * the net is used here so that we can add in the RTO. Even
1680                  * though we use a different timer. We also add the HB timer
1681                  * PLUS a random jitter.
1682                  */
1683                 if (stcb == NULL) {
1684                         return (EFAULT);
1685                 } {
1686                         uint32_t rndval;
1687                         uint8_t this_random;
1688                         int cnt_of_unconf = 0;
1689                         struct sctp_nets *lnet;
1690
1691                         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
1692                                 if ((lnet->dest_state & SCTP_ADDR_UNCONFIRMED) &&
1693                                     (lnet->dest_state & SCTP_ADDR_REACHABLE)) {
1694                                         cnt_of_unconf++;
1695                                 }
1696                         }
1697                         if (cnt_of_unconf) {
1698                                 lnet = NULL;
1699                                 sctp_heartbeat_timer(inp, stcb, lnet, cnt_of_unconf);
1700                         }
1701                         if (stcb->asoc.hb_random_idx > 3) {
1702                                 rndval = sctp_select_initial_TSN(&inp->sctp_ep);
1703                                 memcpy(stcb->asoc.hb_random_values, &rndval,
1704                                     sizeof(stcb->asoc.hb_random_values));
1705                                 this_random = stcb->asoc.hb_random_values[0];
1706                                 stcb->asoc.hb_random_idx = 0;
1707                                 stcb->asoc.hb_ect_randombit = 0;
1708                         } else {
1709                                 this_random = stcb->asoc.hb_random_values[stcb->asoc.hb_random_idx];
1710                                 stcb->asoc.hb_random_idx++;
1711                                 stcb->asoc.hb_ect_randombit = 0;
1712                         }
1713                         /*
1714                          * this_random will be 0 - 256 ms RTO is in ms.
1715                          */
1716                         if ((stcb->asoc.hb_is_disabled) &&
1717                             (cnt_of_unconf == 0)) {
1718                                 return (0);
1719                         }
1720                         if (net) {
1721                                 struct sctp_nets *lnet;
1722                                 int delay;
1723
1724                                 delay = stcb->asoc.heart_beat_delay;
1725                                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
1726                                         if ((lnet->dest_state & SCTP_ADDR_UNCONFIRMED) &&
1727                                             ((lnet->dest_state & SCTP_ADDR_OUT_OF_SCOPE) == 0) &&
1728                                             (lnet->dest_state & SCTP_ADDR_REACHABLE)) {
1729                                                 delay = 0;
1730                                         }
1731                                 }
1732                                 if (net->RTO == 0) {
1733                                         /* Never been checked */
1734                                         to_ticks = this_random + stcb->asoc.initial_rto + delay;
1735                                 } else {
1736                                         /* set rto_val to the ms */
1737                                         to_ticks = delay + net->RTO + this_random;
1738                                 }
1739                         } else {
1740                                 if (cnt_of_unconf) {
1741                                         to_ticks = this_random + stcb->asoc.initial_rto;
1742                                 } else {
1743                                         to_ticks = stcb->asoc.heart_beat_delay + this_random + stcb->asoc.initial_rto;
1744                                 }
1745                         }
1746                         /*
1747                          * Now we must convert the to_ticks that are now in
1748                          * ms to ticks.
1749                          */
1750                         to_ticks = MSEC_TO_TICKS(to_ticks);
1751                         tmr = &stcb->asoc.hb_timer;
1752                 }
1753                 break;
1754         case SCTP_TIMER_TYPE_COOKIE:
1755                 /*
1756                  * Here we can use the RTO timer from the network since one
1757                  * RTT was compelete. If a retran happened then we will be
1758                  * using the RTO initial value.
1759                  */
1760                 if ((stcb == NULL) || (net == NULL)) {
1761                         return (EFAULT);
1762                 }
1763                 if (net->RTO == 0) {
1764                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1765                 } else {
1766                         to_ticks = MSEC_TO_TICKS(net->RTO);
1767                 }
1768                 tmr = &net->rxt_timer;
1769                 break;
1770         case SCTP_TIMER_TYPE_NEWCOOKIE:
1771                 /*
1772                  * nothing needed but the endpoint here ususually about 60
1773                  * minutes.
1774                  */
1775                 tmr = &inp->sctp_ep.signature_change;
1776                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE];
1777                 break;
1778         case SCTP_TIMER_TYPE_ASOCKILL:
1779                 if (stcb == NULL) {
1780                         return (EFAULT);
1781                 }
1782                 tmr = &stcb->asoc.strreset_timer;
1783                 to_ticks = MSEC_TO_TICKS(SCTP_ASOC_KILL_TIMEOUT);
1784                 break;
1785         case SCTP_TIMER_TYPE_INPKILL:
1786                 /*
1787                  * The inp is setup to die. We re-use the signature_chage
1788                  * timer since that has stopped and we are in the GONE
1789                  * state.
1790                  */
1791                 tmr = &inp->sctp_ep.signature_change;
1792                 to_ticks = MSEC_TO_TICKS(SCTP_INP_KILL_TIMEOUT);
1793                 break;
1794         case SCTP_TIMER_TYPE_PATHMTURAISE:
1795                 /*
1796                  * Here we use the value found in the EP for PMTU ususually
1797                  * about 10 minutes.
1798                  */
1799                 if (stcb == NULL) {
1800                         return (EFAULT);
1801                 }
1802                 if (net == NULL) {
1803                         return (EFAULT);
1804                 }
1805                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU];
1806                 tmr = &net->pmtu_timer;
1807                 break;
1808         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1809                 /* Here we use the RTO of the destination */
1810                 if ((stcb == NULL) || (net == NULL)) {
1811                         return (EFAULT);
1812                 }
1813                 if (net->RTO == 0) {
1814                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1815                 } else {
1816                         to_ticks = MSEC_TO_TICKS(net->RTO);
1817                 }
1818                 tmr = &net->rxt_timer;
1819                 break;
1820         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1821                 /*
1822                  * Here we use the endpoints shutdown guard timer usually
1823                  * about 3 minutes.
1824                  */
1825                 if (stcb == NULL) {
1826                         return (EFAULT);
1827                 }
1828                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN];
1829                 tmr = &stcb->asoc.shut_guard_timer;
1830                 break;
1831         case SCTP_TIMER_TYPE_STRRESET:
1832                 /*
1833                  * Here the timer comes from the inp but its value is from
1834                  * the RTO.
1835                  */
1836                 if ((stcb == NULL) || (net == NULL)) {
1837                         return (EFAULT);
1838                 }
1839                 if (net->RTO == 0) {
1840                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1841                 } else {
1842                         to_ticks = MSEC_TO_TICKS(net->RTO);
1843                 }
1844                 tmr = &stcb->asoc.strreset_timer;
1845                 break;
1846
1847         case SCTP_TIMER_TYPE_EARLYFR:
1848                 {
1849                         unsigned int msec;
1850
1851                         if ((stcb == NULL) || (net == NULL)) {
1852                                 return (EFAULT);
1853                         }
1854                         if (net->flight_size > net->cwnd) {
1855                                 /* no need to start */
1856                                 return (0);
1857                         }
1858                         SCTP_STAT_INCR(sctps_earlyfrstart);
1859                         if (net->lastsa == 0) {
1860                                 /* Hmm no rtt estimate yet? */
1861                                 msec = stcb->asoc.initial_rto >> 2;
1862                         } else {
1863                                 msec = ((net->lastsa >> 2) + net->lastsv) >> 1;
1864                         }
1865                         if (msec < sctp_early_fr_msec) {
1866                                 msec = sctp_early_fr_msec;
1867                                 if (msec < SCTP_MINFR_MSEC_FLOOR) {
1868                                         msec = SCTP_MINFR_MSEC_FLOOR;
1869                                 }
1870                         }
1871                         to_ticks = MSEC_TO_TICKS(msec);
1872                         tmr = &net->fr_timer;
1873                 }
1874                 break;
1875         case SCTP_TIMER_TYPE_ASCONF:
1876                 /*
1877                  * Here the timer comes from the inp but its value is from
1878                  * the RTO.
1879                  */
1880                 if ((stcb == NULL) || (net == NULL)) {
1881                         return (EFAULT);
1882                 }
1883                 if (net->RTO == 0) {
1884                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1885                 } else {
1886                         to_ticks = MSEC_TO_TICKS(net->RTO);
1887                 }
1888                 tmr = &stcb->asoc.asconf_timer;
1889                 break;
1890         case SCTP_TIMER_TYPE_AUTOCLOSE:
1891                 if (stcb == NULL) {
1892                         return (EFAULT);
1893                 }
1894                 if (stcb->asoc.sctp_autoclose_ticks == 0) {
1895                         /*
1896                          * Really an error since stcb is NOT set to
1897                          * autoclose
1898                          */
1899                         return (0);
1900                 }
1901                 to_ticks = stcb->asoc.sctp_autoclose_ticks;
1902                 tmr = &stcb->asoc.autoclose_timer;
1903                 break;
1904         default:
1905 #ifdef SCTP_DEBUG
1906                 if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1907                         printf("sctp_timer_start:Unknown timer type %d\n",
1908                             t_type);
1909                 }
1910 #endif                          /* SCTP_DEBUG */
1911                 return (EFAULT);
1912                 break;
1913         };
1914         if ((to_ticks <= 0) || (tmr == NULL)) {
1915 #ifdef SCTP_DEBUG
1916                 if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
1917                         printf("sctp_timer_start:%d:software error to_ticks:%d tmr:%p not set ??\n",
1918                             t_type, to_ticks, tmr);
1919                 }
1920 #endif                          /* SCTP_DEBUG */
1921                 return (EFAULT);
1922         }
1923         if (callout_pending(&tmr->timer)) {
1924                 /*
1925                  * we do NOT allow you to have it already running. if it is
1926                  * we leave the current one up unchanged
1927                  */
1928                 return (EALREADY);
1929         }
1930         /* At this point we can proceed */
1931         if (t_type == SCTP_TIMER_TYPE_SEND) {
1932                 stcb->asoc.num_send_timers_up++;
1933         }
1934         tmr->type = t_type;
1935         tmr->ep = (void *)inp;
1936         tmr->tcb = (void *)stcb;
1937         tmr->net = (void *)net;
1938         tmr->self = (void *)tmr;
1939         tmr->ticks = ticks;
1940         callout_reset(&tmr->timer, to_ticks, sctp_timeout_handler, tmr);
1941         return (0);
1942 }
1943
1944 int
1945 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1946     struct sctp_nets *net)
1947 {
1948         struct sctp_timer *tmr;
1949
1950         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) &&
1951             (inp == NULL))
1952                 return (EFAULT);
1953
1954         tmr = NULL;
1955         if (stcb) {
1956                 SCTP_TCB_LOCK_ASSERT(stcb);
1957         }
1958         switch (t_type) {
1959         case SCTP_TIMER_TYPE_ADDR_WQ:
1960                 tmr = &sctppcbinfo.addr_wq_timer;
1961                 break;
1962         case SCTP_TIMER_TYPE_EARLYFR:
1963                 if ((stcb == NULL) || (net == NULL)) {
1964                         return (EFAULT);
1965                 }
1966                 tmr = &net->fr_timer;
1967                 SCTP_STAT_INCR(sctps_earlyfrstop);
1968                 break;
1969         case SCTP_TIMER_TYPE_ITERATOR:
1970                 {
1971                         struct sctp_iterator *it;
1972
1973                         it = (struct sctp_iterator *)inp;
1974                         tmr = &it->tmr;
1975                 }
1976                 break;
1977         case SCTP_TIMER_TYPE_SEND:
1978                 if ((stcb == NULL) || (net == NULL)) {
1979                         return (EFAULT);
1980                 }
1981                 tmr = &net->rxt_timer;
1982                 break;
1983         case SCTP_TIMER_TYPE_INIT:
1984                 if ((stcb == NULL) || (net == NULL)) {
1985                         return (EFAULT);
1986                 }
1987                 tmr = &net->rxt_timer;
1988                 break;
1989         case SCTP_TIMER_TYPE_RECV:
1990                 if (stcb == NULL) {
1991                         return (EFAULT);
1992                 }
1993                 tmr = &stcb->asoc.dack_timer;
1994                 break;
1995         case SCTP_TIMER_TYPE_SHUTDOWN:
1996                 if ((stcb == NULL) || (net == NULL)) {
1997                         return (EFAULT);
1998                 }
1999                 tmr = &net->rxt_timer;
2000                 break;
2001         case SCTP_TIMER_TYPE_HEARTBEAT:
2002                 if (stcb == NULL) {
2003                         return (EFAULT);
2004                 }
2005                 tmr = &stcb->asoc.hb_timer;
2006                 break;
2007         case SCTP_TIMER_TYPE_COOKIE:
2008                 if ((stcb == NULL) || (net == NULL)) {
2009                         return (EFAULT);
2010                 }
2011                 tmr = &net->rxt_timer;
2012                 break;
2013         case SCTP_TIMER_TYPE_NEWCOOKIE:
2014                 /* nothing needed but the endpoint here */
2015                 tmr = &inp->sctp_ep.signature_change;
2016                 /*
2017                  * We re-use the newcookie timer for the INP kill timer. We
2018                  * must assure that we do not kill it by accident.
2019                  */
2020                 break;
2021         case SCTP_TIMER_TYPE_ASOCKILL:
2022                 /*
2023                  * Stop the asoc kill timer.
2024                  */
2025                 if (stcb == NULL) {
2026                         return (EFAULT);
2027                 }
2028                 tmr = &stcb->asoc.strreset_timer;
2029                 break;
2030
2031         case SCTP_TIMER_TYPE_INPKILL:
2032                 /*
2033                  * The inp is setup to die. We re-use the signature_chage
2034                  * timer since that has stopped and we are in the GONE
2035                  * state.
2036                  */
2037                 tmr = &inp->sctp_ep.signature_change;
2038                 break;
2039         case SCTP_TIMER_TYPE_PATHMTURAISE:
2040                 if ((stcb == NULL) || (net == NULL)) {
2041                         return (EFAULT);
2042                 }
2043                 tmr = &net->pmtu_timer;
2044                 break;
2045         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2046                 if ((stcb == NULL) || (net == NULL)) {
2047                         return (EFAULT);
2048                 }
2049                 tmr = &net->rxt_timer;
2050                 break;
2051         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2052                 if (stcb == NULL) {
2053                         return (EFAULT);
2054                 }
2055                 tmr = &stcb->asoc.shut_guard_timer;
2056                 break;
2057         case SCTP_TIMER_TYPE_STRRESET:
2058                 if (stcb == NULL) {
2059                         return (EFAULT);
2060                 }
2061                 tmr = &stcb->asoc.strreset_timer;
2062                 break;
2063         case SCTP_TIMER_TYPE_ASCONF:
2064                 if (stcb == NULL) {
2065                         return (EFAULT);
2066                 }
2067                 tmr = &stcb->asoc.asconf_timer;
2068                 break;
2069         case SCTP_TIMER_TYPE_AUTOCLOSE:
2070                 if (stcb == NULL) {
2071                         return (EFAULT);
2072                 }
2073                 tmr = &stcb->asoc.autoclose_timer;
2074                 break;
2075         default:
2076 #ifdef SCTP_DEBUG
2077                 if (sctp_debug_on & SCTP_DEBUG_TIMER1) {
2078                         printf("sctp_timer_stop:Unknown timer type %d\n",
2079                             t_type);
2080                 }
2081 #endif                          /* SCTP_DEBUG */
2082                 break;
2083         };
2084         if (tmr == NULL) {
2085                 return (EFAULT);
2086         }
2087         if ((tmr->type != t_type) && tmr->type) {
2088                 /*
2089                  * Ok we have a timer that is under joint use. Cookie timer
2090                  * per chance with the SEND timer. We therefore are NOT
2091                  * running the timer that the caller wants stopped.  So just
2092                  * return.
2093                  */
2094                 return (0);
2095         }
2096         if (t_type == SCTP_TIMER_TYPE_SEND) {
2097                 stcb->asoc.num_send_timers_up--;
2098                 if (stcb->asoc.num_send_timers_up < 0) {
2099                         stcb->asoc.num_send_timers_up = 0;
2100                 }
2101         }
2102         tmr->self = NULL;
2103         callout_stop(&tmr->timer);
2104         return (0);
2105 }
2106
2107 #ifdef SCTP_USE_ADLER32
2108 static uint32_t
2109 update_adler32(uint32_t adler, uint8_t * buf, int32_t len)
2110 {
2111         uint32_t s1 = adler & 0xffff;
2112         uint32_t s2 = (adler >> 16) & 0xffff;
2113         int n;
2114
2115         for (n = 0; n < len; n++, buf++) {
2116                 /* s1 = (s1 + buf[n]) % BASE */
2117                 /* first we add */
2118                 s1 = (s1 + *buf);
2119                 /*
2120                  * now if we need to, we do a mod by subtracting. It seems a
2121                  * bit faster since I really will only ever do one subtract
2122                  * at the MOST, since buf[n] is a max of 255.
2123                  */
2124                 if (s1 >= SCTP_ADLER32_BASE) {
2125                         s1 -= SCTP_ADLER32_BASE;
2126                 }
2127                 /* s2 = (s2 + s1) % BASE */
2128                 /* first we add */
2129                 s2 = (s2 + s1);
2130                 /*
2131                  * again, it is more efficent (it seems) to subtract since
2132                  * the most s2 will ever be is (BASE-1 + BASE-1) in the
2133                  * worse case. This would then be (2 * BASE) - 2, which will
2134                  * still only do one subtract. On Intel this is much better
2135                  * to do this way and avoid the divide. Have not -pg'd on
2136                  * sparc.
2137                  */
2138                 if (s2 >= SCTP_ADLER32_BASE) {
2139                         s2 -= SCTP_ADLER32_BASE;
2140                 }
2141         }
2142         /* Return the adler32 of the bytes buf[0..len-1] */
2143         return ((s2 << 16) + s1);
2144 }
2145
2146 #endif
2147
2148
2149 uint32_t
2150 sctp_calculate_len(struct mbuf *m)
2151 {
2152         uint32_t tlen = 0;
2153         struct mbuf *at;
2154
2155         at = m;
2156         while (at) {
2157                 tlen += at->m_len;
2158                 at = at->m_next;
2159         }
2160         return (tlen);
2161 }
2162
2163 #if defined(SCTP_WITH_NO_CSUM)
2164
2165 uint32_t
2166 sctp_calculate_sum(struct mbuf *m, int32_t * pktlen, uint32_t offset)
2167 {
2168         /*
2169          * given a mbuf chain with a packetheader offset by 'offset'
2170          * pointing at a sctphdr (with csum set to 0) go through the chain
2171          * of m_next's and calculate the SCTP checksum. This is currently
2172          * Adler32 but will change to CRC32x soon. Also has a side bonus
2173          * calculate the total length of the mbuf chain. Note: if offset is
2174          * greater than the total mbuf length, checksum=1, pktlen=0 is
2175          * returned (ie. no real error code)
2176          */
2177         if (pktlen == NULL)
2178                 return (0);
2179         *pktlen = sctp_calculate_len(m);
2180         return (0);
2181 }
2182
2183 #elif defined(SCTP_USE_INCHKSUM)
2184
2185 #include <machine/in_cksum.h>
2186
2187 uint32_t
2188 sctp_calculate_sum(struct mbuf *m, int32_t * pktlen, uint32_t offset)
2189 {
2190         /*
2191          * given a mbuf chain with a packetheader offset by 'offset'
2192          * pointing at a sctphdr (with csum set to 0) go through the chain
2193          * of m_next's and calculate the SCTP checksum. This is currently
2194          * Adler32 but will change to CRC32x soon. Also has a side bonus
2195          * calculate the total length of the mbuf chain. Note: if offset is
2196          * greater than the total mbuf length, checksum=1, pktlen=0 is
2197          * returned (ie. no real error code)
2198          */
2199         int32_t tlen = 0;
2200         struct mbuf *at;
2201         uint32_t the_sum, retsum;
2202
2203         at = m;
2204         while (at) {
2205                 tlen += at->m_len;
2206                 at = at->m_next;
2207         }
2208         the_sum = (uint32_t) (in_cksum_skip(m, tlen, offset));
2209         if (pktlen != NULL)
2210                 *pktlen = (tlen - offset);
2211         retsum = htons(the_sum);
2212         return (the_sum);
2213 }
2214
2215 #else
2216
2217 uint32_t
2218 sctp_calculate_sum(struct mbuf *m, int32_t * pktlen, uint32_t offset)
2219 {
2220         /*
2221          * given a mbuf chain with a packetheader offset by 'offset'
2222          * pointing at a sctphdr (with csum set to 0) go through the chain
2223          * of m_next's and calculate the SCTP checksum. This is currently
2224          * Adler32 but will change to CRC32x soon. Also has a side bonus
2225          * calculate the total length of the mbuf chain. Note: if offset is
2226          * greater than the total mbuf length, checksum=1, pktlen=0 is
2227          * returned (ie. no real error code)
2228          */
2229         int32_t tlen = 0;
2230
2231 #ifdef SCTP_USE_ADLER32
2232         uint32_t base = 1L;
2233
2234 #else
2235         uint32_t base = 0xffffffff;
2236
2237 #endif                          /* SCTP_USE_ADLER32 */
2238         struct mbuf *at;
2239
2240         at = m;
2241         /* find the correct mbuf and offset into mbuf */
2242         while ((at != NULL) && (offset > (uint32_t) at->m_len)) {
2243                 offset -= at->m_len;    /* update remaining offset left */
2244                 at = at->m_next;
2245         }
2246         while (at != NULL) {
2247                 if ((at->m_len - offset) > 0) {
2248 #ifdef SCTP_USE_ADLER32
2249                         base = update_adler32(base,
2250                             (unsigned char *)(at->m_data + offset),
2251                             (unsigned int)(at->m_len - offset));
2252 #else
2253                         if ((at->m_len - offset) < 4) {
2254                                 /* Use old method if less than 4 bytes */
2255                                 base = old_update_crc32(base,
2256                                     (unsigned char *)(at->m_data + offset),
2257                                     (unsigned int)(at->m_len - offset));
2258                         } else {
2259                                 base = update_crc32(base,
2260                                     (unsigned char *)(at->m_data + offset),
2261                                     (unsigned int)(at->m_len - offset));
2262                         }
2263 #endif                          /* SCTP_USE_ADLER32 */
2264                         tlen += at->m_len - offset;
2265                         /* we only offset once into the first mbuf */
2266                 }
2267                 if (offset) {
2268                         if (offset < at->m_len)
2269                                 offset = 0;
2270                         else
2271                                 offset -= at->m_len;
2272                 }
2273                 at = at->m_next;
2274         }
2275         if (pktlen != NULL) {
2276                 *pktlen = tlen;
2277         }
2278 #ifdef SCTP_USE_ADLER32
2279         /* Adler32 */
2280         base = htonl(base);
2281 #else
2282         /* CRC-32c */
2283         base = sctp_csum_finalize(base);
2284 #endif
2285         return (base);
2286 }
2287
2288
2289 #endif
2290
2291 void
2292 sctp_mtu_size_reset(struct sctp_inpcb *inp,
2293     struct sctp_association *asoc, u_long mtu)
2294 {
2295         /*
2296          * Reset the P-MTU size on this association, this involves changing
2297          * the asoc MTU, going through ANY chunk+overhead larger than mtu to
2298          * allow the DF flag to be cleared.
2299          */
2300         struct sctp_tmit_chunk *chk;
2301         unsigned int eff_mtu, ovh;
2302
2303         asoc->smallest_mtu = mtu;
2304         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2305                 ovh = SCTP_MIN_OVERHEAD;
2306         } else {
2307                 ovh = SCTP_MIN_V4_OVERHEAD;
2308         }
2309         eff_mtu = mtu - ovh;
2310         TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
2311
2312                 if (chk->send_size > eff_mtu) {
2313                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2314                 }
2315         }
2316         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
2317                 if (chk->send_size > eff_mtu) {
2318                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2319                 }
2320         }
2321 }
2322
2323
2324 /*
2325  * given an association and starting time of the current RTT period return
2326  * RTO in number of usecs net should point to the current network
2327  */
2328 uint32_t
2329 sctp_calculate_rto(struct sctp_tcb *stcb,
2330     struct sctp_association *asoc,
2331     struct sctp_nets *net,
2332     struct timeval *old)
2333 {
2334         /*
2335          * given an association and the starting time of the current RTT
2336          * period (in value1/value2) return RTO in number of usecs.
2337          */
2338         int calc_time = 0;
2339         int o_calctime;
2340         unsigned int new_rto = 0;
2341         int first_measure = 0;
2342         struct timeval now;
2343
2344         /************************/
2345         /* 1. calculate new RTT */
2346         /************************/
2347         /* get the current time */
2348         SCTP_GETTIME_TIMEVAL(&now);
2349         /* compute the RTT value */
2350         if ((u_long)now.tv_sec > (u_long)old->tv_sec) {
2351                 calc_time = ((u_long)now.tv_sec - (u_long)old->tv_sec) * 1000;
2352                 if ((u_long)now.tv_usec > (u_long)old->tv_usec) {
2353                         calc_time += (((u_long)now.tv_usec -
2354                             (u_long)old->tv_usec) / 1000);
2355                 } else if ((u_long)now.tv_usec < (u_long)old->tv_usec) {
2356                         /* Borrow 1,000ms from current calculation */
2357                         calc_time -= 1000;
2358                         /* Add in the slop over */
2359                         calc_time += ((int)now.tv_usec / 1000);
2360                         /* Add in the pre-second ms's */
2361                         calc_time += (((int)1000000 - (int)old->tv_usec) / 1000);
2362                 }
2363         } else if ((u_long)now.tv_sec == (u_long)old->tv_sec) {
2364                 if ((u_long)now.tv_usec > (u_long)old->tv_usec) {
2365                         calc_time = ((u_long)now.tv_usec -
2366                             (u_long)old->tv_usec) / 1000;
2367                 } else if ((u_long)now.tv_usec < (u_long)old->tv_usec) {
2368                         /* impossible .. garbage in nothing out */
2369                         return (((net->lastsa >> 2) + net->lastsv) >> 1);
2370                 } else {
2371                         /* impossible .. garbage in nothing out */
2372                         return (((net->lastsa >> 2) + net->lastsv) >> 1);
2373                 }
2374         } else {
2375                 /* Clock wrapped? */
2376                 return (((net->lastsa >> 2) + net->lastsv) >> 1);
2377         }
2378         /***************************/
2379         /* 2. update RTTVAR & SRTT */
2380         /***************************/
2381 #if 0
2382         /* if (net->lastsv || net->lastsa) { */
2383         /* per Section 5.3.1 C3 in SCTP */
2384         /* net->lastsv = (int)   *//* RTTVAR */
2385         /*
2386          * (((double)(1.0 - 0.25) * (double)net->lastsv) + (double)(0.25 *
2387          * (double)abs(net->lastsa - calc_time))); net->lastsa = (int)
2388 *//* SRTT */
2389         /*
2390          * (((double)(1.0 - 0.125) * (double)net->lastsa) + (double)(0.125 *
2391          * (double)calc_time)); } else {
2392 *//* the first RTT calculation, per C2 Section 5.3.1 */
2393         /* net->lastsa = calc_time;      *//* SRTT */
2394         /* net->lastsv = calc_time / 2;  *//* RTTVAR */
2395         /* } */
2396         /* if RTTVAR goes to 0 you set to clock grainularity */
2397         /*
2398          * if (net->lastsv == 0) { net->lastsv = SCTP_CLOCK_GRANULARITY; }
2399          * new_rto = net->lastsa + 4 * net->lastsv;
2400          */
2401 #endif
2402         o_calctime = calc_time;
2403         /* this is Van Jacobson's integer version */
2404         if (net->RTO) {
2405                 calc_time -= (net->lastsa >> 3);
2406                 if ((int)net->prev_rtt > o_calctime) {
2407                         net->rtt_variance = net->prev_rtt - o_calctime;
2408                         /* decreasing */
2409                         net->rto_variance_dir = 0;
2410                 } else {
2411                         /* increasing */
2412                         net->rtt_variance = o_calctime - net->prev_rtt;
2413                         net->rto_variance_dir = 1;
2414                 }
2415 #ifdef SCTP_RTTVAR_LOGGING
2416                 rto_logging(net, SCTP_LOG_RTTVAR);
2417 #endif
2418                 net->prev_rtt = o_calctime;
2419                 net->lastsa += calc_time;
2420                 if (calc_time < 0) {
2421                         calc_time = -calc_time;
2422                 }
2423                 calc_time -= (net->lastsv >> 2);
2424                 net->lastsv += calc_time;
2425                 if (net->lastsv == 0) {
2426                         net->lastsv = SCTP_CLOCK_GRANULARITY;
2427                 }
2428         } else {
2429                 /* First RTO measurment */
2430                 net->lastsa = calc_time;
2431                 net->lastsv = calc_time >> 1;
2432                 first_measure = 1;
2433                 net->rto_variance_dir = 1;
2434                 net->prev_rtt = o_calctime;
2435                 net->rtt_variance = 0;
2436 #ifdef SCTP_RTTVAR_LOGGING
2437                 rto_logging(net, SCTP_LOG_INITIAL_RTT);
2438 #endif
2439         }
2440         new_rto = ((net->lastsa >> 2) + net->lastsv) >> 1;
2441         if ((new_rto > SCTP_SAT_NETWORK_MIN) &&
2442             (stcb->asoc.sat_network_lockout == 0)) {
2443                 stcb->asoc.sat_network = 1;
2444         } else if ((!first_measure) && stcb->asoc.sat_network) {
2445                 stcb->asoc.sat_network = 0;
2446                 stcb->asoc.sat_network_lockout = 1;
2447         }
2448         /* bound it, per C6/C7 in Section 5.3.1 */
2449         if (new_rto < stcb->asoc.minrto) {
2450                 new_rto = stcb->asoc.minrto;
2451         }
2452         if (new_rto > stcb->asoc.maxrto) {
2453                 new_rto = stcb->asoc.maxrto;
2454         }
2455         /* we are now returning the RTT Smoothed */
2456         return ((uint32_t) new_rto);
2457 }
2458
2459
2460 /*
2461  * return a pointer to a contiguous piece of data from the given mbuf chain
2462  * starting at 'off' for 'len' bytes.  If the desired piece spans more than
2463  * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size
2464  * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain.
2465  */
2466 __inline caddr_t
2467 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t * in_ptr)
2468 {
2469         uint32_t count;
2470         uint8_t *ptr;
2471
2472         ptr = in_ptr;
2473         if ((off < 0) || (len <= 0))
2474                 return (NULL);
2475
2476         /* find the desired start location */
2477         while ((m != NULL) && (off > 0)) {
2478                 if (off < m->m_len)
2479                         break;
2480                 off -= m->m_len;
2481                 m = m->m_next;
2482         }
2483         if (m == NULL)
2484                 return (NULL);
2485
2486         /* is the current mbuf large enough (eg. contiguous)? */
2487         if ((m->m_len - off) >= len) {
2488                 return (mtod(m, caddr_t)+off);
2489         } else {
2490                 /* else, it spans more than one mbuf, so save a temp copy... */
2491                 while ((m != NULL) && (len > 0)) {
2492                         count = min(m->m_len - off, len);
2493                         bcopy(mtod(m, caddr_t)+off, ptr, count);
2494                         len -= count;
2495                         ptr += count;
2496                         off = 0;
2497                         m = m->m_next;
2498                 }
2499                 if ((m == NULL) && (len > 0))
2500                         return (NULL);
2501                 else
2502                         return ((caddr_t)in_ptr);
2503         }
2504 }
2505
2506
2507 struct sctp_paramhdr *
2508 sctp_get_next_param(struct mbuf *m,
2509     int offset,
2510     struct sctp_paramhdr *pull,
2511     int pull_limit)
2512 {
2513         /* This just provides a typed signature to Peter's Pull routine */
2514         return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit,
2515             (uint8_t *) pull));
2516 }
2517
2518
2519 int
2520 sctp_add_pad_tombuf(struct mbuf *m, int padlen)
2521 {
2522         /*
2523          * add padlen bytes of 0 filled padding to the end of the mbuf. If
2524          * padlen is > 3 this routine will fail.
2525          */
2526         uint8_t *dp;
2527         int i;
2528
2529         if (padlen > 3) {
2530                 return (ENOBUFS);
2531         }
2532         if (M_TRAILINGSPACE(m)) {
2533                 /*
2534                  * The easy way. We hope the majority of the time we hit
2535                  * here :)
2536                  */
2537                 dp = (uint8_t *) (mtod(m, caddr_t)+m->m_len);
2538                 m->m_len += padlen;
2539         } else {
2540                 /* Hard way we must grow the mbuf */
2541                 struct mbuf *tmp;
2542
2543                 tmp = sctp_get_mbuf_for_msg(padlen, 0, M_DONTWAIT, 1, MT_DATA);
2544                 if (tmp == NULL) {
2545                         /* Out of space GAK! we are in big trouble. */
2546                         return (ENOSPC);
2547                 }
2548                 /* setup and insert in middle */
2549                 tmp->m_next = m->m_next;
2550                 tmp->m_len = padlen;
2551                 m->m_next = tmp;
2552                 dp = mtod(tmp, uint8_t *);
2553         }
2554         /* zero out the pad */
2555         for (i = 0; i < padlen; i++) {
2556                 *dp = 0;
2557                 dp++;
2558         }
2559         return (0);
2560 }
2561
2562 int
2563 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf)
2564 {
2565         /* find the last mbuf in chain and pad it */
2566         struct mbuf *m_at;
2567
2568         m_at = m;
2569         if (last_mbuf) {
2570                 return (sctp_add_pad_tombuf(last_mbuf, padval));
2571         } else {
2572                 while (m_at) {
2573                         if (m_at->m_next == NULL) {
2574                                 return (sctp_add_pad_tombuf(m_at, padval));
2575                         }
2576                         m_at = m_at->m_next;
2577                 }
2578         }
2579         return (EFAULT);
2580 }
2581
2582 int sctp_asoc_change_wake = 0;
2583
2584 static void
2585 sctp_notify_assoc_change(uint32_t event, struct sctp_tcb *stcb,
2586     uint32_t error, void *data)
2587 {
2588         struct mbuf *m_notify;
2589         struct sctp_assoc_change *sac;
2590         struct sctp_queued_to_read *control;
2591
2592         /*
2593          * First if we are are going down dump everything we can to the
2594          * socket rcv queue.
2595          */
2596
2597         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
2598             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
2599             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)
2600             ) {
2601                 /* If the socket is gone we are out of here */
2602                 return;
2603         }
2604         /*
2605          * For TCP model AND UDP connected sockets we will send an error up
2606          * when an ABORT comes in.
2607          */
2608         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2609             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2610             (event == SCTP_COMM_LOST)) {
2611                 if (TAILQ_EMPTY(&stcb->sctp_ep->read_queue)) {
2612                         stcb->sctp_socket->so_error = ECONNRESET;
2613                 }
2614                 /* Wake ANY sleepers */
2615                 sorwakeup(stcb->sctp_socket);
2616                 sowwakeup(stcb->sctp_socket);
2617                 sctp_asoc_change_wake++;
2618         }
2619         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_RECVASSOCEVNT)) {
2620                 /* event not enabled */
2621                 return;
2622         }
2623         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_change), 1, M_DONTWAIT, 1, MT_DATA);
2624         if (m_notify == NULL)
2625                 /* no space left */
2626                 return;
2627         m_notify->m_len = 0;
2628
2629         sac = mtod(m_notify, struct sctp_assoc_change *);
2630         sac->sac_type = SCTP_ASSOC_CHANGE;
2631         sac->sac_flags = 0;
2632         sac->sac_length = sizeof(struct sctp_assoc_change);
2633         sac->sac_state = event;
2634         sac->sac_error = error;
2635         /* XXX verify these stream counts */
2636         sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
2637         sac->sac_inbound_streams = stcb->asoc.streamincnt;
2638         sac->sac_assoc_id = sctp_get_associd(stcb);
2639         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
2640         m_notify->m_pkthdr.len = sizeof(struct sctp_assoc_change);
2641         m_notify->m_pkthdr.rcvif = 0;
2642         m_notify->m_len = sizeof(struct sctp_assoc_change);
2643         m_notify->m_next = NULL;
2644         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2645             0, 0, 0, 0, 0, 0,
2646             m_notify);
2647         if (control == NULL) {
2648                 /* no memory */
2649                 sctp_m_freem(m_notify);
2650                 return;
2651         }
2652         control->length = m_notify->m_len;
2653         /* not that we need this */
2654         control->tail_mbuf = m_notify;
2655         sctp_add_to_readq(stcb->sctp_ep, stcb,
2656             control,
2657             &stcb->sctp_socket->so_rcv, 1);
2658         if (event == SCTP_COMM_LOST) {
2659                 /* Wake up any sleeper */
2660                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
2661         }
2662 }
2663
2664 static void
2665 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
2666     struct sockaddr *sa, uint32_t error)
2667 {
2668         struct mbuf *m_notify;
2669         struct sctp_paddr_change *spc;
2670         struct sctp_queued_to_read *control;
2671
2672         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_RECVPADDREVNT))
2673                 /* event not enabled */
2674                 return;
2675
2676         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 1, M_DONTWAIT, 1, MT_DATA);
2677         if (m_notify == NULL)
2678                 return;
2679         m_notify->m_len = 0;
2680         spc = mtod(m_notify, struct sctp_paddr_change *);
2681         spc->spc_type = SCTP_PEER_ADDR_CHANGE;
2682         spc->spc_flags = 0;
2683         spc->spc_length = sizeof(struct sctp_paddr_change);
2684         if (sa->sa_family == AF_INET) {
2685                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2686         } else {
2687                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6));
2688         }
2689         spc->spc_state = state;
2690         spc->spc_error = error;
2691         spc->spc_assoc_id = sctp_get_associd(stcb);
2692
2693         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
2694         m_notify->m_pkthdr.len = sizeof(struct sctp_paddr_change);
2695         m_notify->m_pkthdr.rcvif = 0;
2696         m_notify->m_len = sizeof(struct sctp_paddr_change);
2697         m_notify->m_next = NULL;
2698
2699         /* append to socket */
2700         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2701             0, 0, 0, 0, 0, 0,
2702             m_notify);
2703         if (control == NULL) {
2704                 /* no memory */
2705                 sctp_m_freem(m_notify);
2706                 return;
2707         }
2708         control->length = m_notify->m_len;
2709         /* not that we need this */
2710         control->tail_mbuf = m_notify;
2711         sctp_add_to_readq(stcb->sctp_ep, stcb,
2712             control,
2713             &stcb->sctp_socket->so_rcv, 1);
2714 }
2715
2716
2717 static void
2718 sctp_notify_send_failed(struct sctp_tcb *stcb, uint32_t error,
2719     struct sctp_tmit_chunk *chk)
2720 {
2721         struct mbuf *m_notify;
2722         struct sctp_send_failed *ssf;
2723         struct sctp_queued_to_read *control;
2724         int length;
2725
2726         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_RECVSENDFAILEVNT))
2727                 /* event not enabled */
2728                 return;
2729
2730         length = sizeof(struct sctp_send_failed) + chk->send_size;
2731         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_send_failed), 1, M_DONTWAIT, 1, MT_DATA);
2732         if (m_notify == NULL)
2733                 /* no space left */
2734                 return;
2735         m_notify->m_len = 0;
2736         ssf = mtod(m_notify, struct sctp_send_failed *);
2737         ssf->ssf_type = SCTP_SEND_FAILED;
2738         if (error == SCTP_NOTIFY_DATAGRAM_UNSENT)
2739                 ssf->ssf_flags = SCTP_DATA_UNSENT;
2740         else
2741                 ssf->ssf_flags = SCTP_DATA_SENT;
2742         ssf->ssf_length = length;
2743         ssf->ssf_error = error;
2744         /* not exactly what the user sent in, but should be close :) */
2745         ssf->ssf_info.sinfo_stream = chk->rec.data.stream_number;
2746         ssf->ssf_info.sinfo_ssn = chk->rec.data.stream_seq;
2747         ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags;
2748         ssf->ssf_info.sinfo_ppid = chk->rec.data.payloadtype;
2749         ssf->ssf_info.sinfo_context = chk->rec.data.context;
2750         ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
2751         ssf->ssf_assoc_id = sctp_get_associd(stcb);
2752         m_notify->m_next = chk->data;
2753         m_notify->m_flags |= M_NOTIFICATION;
2754         m_notify->m_pkthdr.len = length;
2755         m_notify->m_pkthdr.rcvif = 0;
2756         m_notify->m_len = sizeof(struct sctp_send_failed);
2757
2758         /* Steal off the mbuf */
2759         chk->data = NULL;
2760         /*
2761          * For this case, we check the actual socket buffer, since the assoc
2762          * is going away we don't want to overfill the socket buffer for a
2763          * non-reader
2764          */
2765         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < m_notify->m_len) {
2766                 sctp_m_freem(m_notify);
2767                 return;
2768         }
2769         /* append to socket */
2770         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2771             0, 0, 0, 0, 0, 0,
2772             m_notify);
2773         if (control == NULL) {
2774                 /* no memory */
2775                 sctp_m_freem(m_notify);
2776                 return;
2777         }
2778         sctp_add_to_readq(stcb->sctp_ep, stcb,
2779             control,
2780             &stcb->sctp_socket->so_rcv, 1);
2781 }
2782
2783
2784 static void
2785 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
2786     struct sctp_stream_queue_pending *sp)
2787 {
2788         struct mbuf *m_notify;
2789         struct sctp_send_failed *ssf;
2790         struct sctp_queued_to_read *control;
2791         int length;
2792
2793         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_RECVSENDFAILEVNT))
2794                 /* event not enabled */
2795                 return;
2796
2797         length = sizeof(struct sctp_send_failed) + sp->length;
2798         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 1, M_DONTWAIT, 1, MT_DATA);
2799         if (m_notify == NULL)
2800                 /* no space left */
2801                 return;
2802         m_notify->m_len = 0;
2803         ssf = mtod(m_notify, struct sctp_send_failed *);
2804         ssf->ssf_type = SCTP_SEND_FAILED;
2805         if (error == SCTP_NOTIFY_DATAGRAM_UNSENT)
2806                 ssf->ssf_flags = SCTP_DATA_UNSENT;
2807         else
2808                 ssf->ssf_flags = SCTP_DATA_SENT;
2809         ssf->ssf_length = length;
2810         ssf->ssf_error = error;
2811         /* not exactly what the user sent in, but should be close :) */
2812         ssf->ssf_info.sinfo_stream = sp->stream;
2813         ssf->ssf_info.sinfo_ssn = sp->strseq;
2814         ssf->ssf_info.sinfo_flags = sp->sinfo_flags;
2815         ssf->ssf_info.sinfo_ppid = sp->ppid;
2816         ssf->ssf_info.sinfo_context = sp->context;
2817         ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
2818         ssf->ssf_assoc_id = sctp_get_associd(stcb);
2819         m_notify->m_next = sp->data;
2820         m_notify->m_flags |= M_NOTIFICATION;
2821         m_notify->m_pkthdr.len = length;
2822         m_notify->m_pkthdr.rcvif = 0;
2823         m_notify->m_len = sizeof(struct sctp_send_failed);
2824
2825         /* Steal off the mbuf */
2826         sp->data = NULL;
2827         /*
2828          * For this case, we check the actual socket buffer, since the assoc
2829          * is going away we don't want to overfill the socket buffer for a
2830          * non-reader
2831          */
2832         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < m_notify->m_len) {
2833                 sctp_m_freem(m_notify);
2834                 return;
2835         }
2836         /* append to socket */
2837         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2838             0, 0, 0, 0, 0, 0,
2839             m_notify);
2840         if (control == NULL) {
2841                 /* no memory */
2842                 sctp_m_freem(m_notify);
2843                 return;
2844         }
2845         sctp_add_to_readq(stcb->sctp_ep, stcb,
2846             control,
2847             &stcb->sctp_socket->so_rcv, 1);
2848 }
2849
2850
2851
2852 static void
2853 sctp_notify_adaptation_layer(struct sctp_tcb *stcb,
2854     uint32_t error)
2855 {
2856         struct mbuf *m_notify;
2857         struct sctp_adaptation_event *sai;
2858         struct sctp_queued_to_read *control;
2859
2860         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_ADAPTATIONEVNT))
2861                 /* event not enabled */
2862                 return;
2863
2864         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 1, M_DONTWAIT, 1, MT_DATA);
2865         if (m_notify == NULL)
2866                 /* no space left */
2867                 return;
2868         m_notify->m_len = 0;
2869         sai = mtod(m_notify, struct sctp_adaptation_event *);
2870         sai->sai_type = SCTP_ADAPTATION_INDICATION;
2871         sai->sai_flags = 0;
2872         sai->sai_length = sizeof(struct sctp_adaptation_event);
2873         sai->sai_adaptation_ind = error;
2874         sai->sai_assoc_id = sctp_get_associd(stcb);
2875
2876         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
2877         m_notify->m_pkthdr.len = sizeof(struct sctp_adaptation_event);
2878         m_notify->m_pkthdr.rcvif = 0;
2879         m_notify->m_len = sizeof(struct sctp_adaptation_event);
2880         m_notify->m_next = NULL;
2881
2882         /* append to socket */
2883         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2884             0, 0, 0, 0, 0, 0,
2885             m_notify);
2886         if (control == NULL) {
2887                 /* no memory */
2888                 sctp_m_freem(m_notify);
2889                 return;
2890         }
2891         control->length = m_notify->m_len;
2892         /* not that we need this */
2893         control->tail_mbuf = m_notify;
2894         sctp_add_to_readq(stcb->sctp_ep, stcb,
2895             control,
2896             &stcb->sctp_socket->so_rcv, 1);
2897 }
2898
2899 /* This always must be called with the read-queue LOCKED in the INP */
2900 void
2901 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb,
2902     uint32_t error, int nolock)
2903 {
2904         struct mbuf *m_notify;
2905         struct sctp_pdapi_event *pdapi;
2906         struct sctp_queued_to_read *control;
2907         struct sockbuf *sb;
2908
2909         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_PDAPIEVNT))
2910                 /* event not enabled */
2911                 return;
2912
2913         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 1, M_DONTWAIT, 1, MT_DATA);
2914         if (m_notify == NULL)
2915                 /* no space left */
2916                 return;
2917         m_notify->m_len = 0;
2918         pdapi = mtod(m_notify, struct sctp_pdapi_event *);
2919         pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
2920         pdapi->pdapi_flags = 0;
2921         pdapi->pdapi_length = sizeof(struct sctp_pdapi_event);
2922         pdapi->pdapi_indication = error;
2923         pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
2924
2925         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
2926         m_notify->m_pkthdr.len = sizeof(struct sctp_pdapi_event);
2927         m_notify->m_pkthdr.rcvif = 0;
2928         m_notify->m_len = sizeof(struct sctp_pdapi_event);
2929         m_notify->m_next = NULL;
2930         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2931             0, 0, 0, 0, 0, 0,
2932             m_notify);
2933         if (control == NULL) {
2934                 /* no memory */
2935                 sctp_m_freem(m_notify);
2936                 return;
2937         }
2938         control->length = m_notify->m_len;
2939         /* not that we need this */
2940         control->tail_mbuf = m_notify;
2941         control->held_length = 0;
2942         control->length = 0;
2943         if (nolock == 0) {
2944                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
2945         }
2946         sb = &stcb->sctp_socket->so_rcv;
2947 #ifdef SCTP_SB_LOGGING
2948         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, m_notify->m_len);
2949 #endif
2950         sctp_sballoc(stcb, sb, m_notify);
2951 #ifdef SCTP_SB_LOGGING
2952         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
2953 #endif
2954         atomic_add_int(&control->length, m_notify->m_len);
2955         control->end_added = 1;
2956         if (stcb->asoc.control_pdapi)
2957                 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next);
2958         else {
2959                 /* we really should not see this case */
2960                 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next);
2961         }
2962         if (nolock == 0) {
2963                 SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
2964         }
2965         if (stcb->sctp_ep && stcb->sctp_socket) {
2966                 /* This should always be the case */
2967                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
2968         }
2969 }
2970
2971 static void
2972 sctp_notify_shutdown_event(struct sctp_tcb *stcb)
2973 {
2974         struct mbuf *m_notify;
2975         struct sctp_shutdown_event *sse;
2976         struct sctp_queued_to_read *control;
2977
2978         /*
2979          * For TCP model AND UDP connected sockets we will send an error up
2980          * when an SHUTDOWN completes
2981          */
2982         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2983             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
2984                 /* mark socket closed for read/write and wakeup! */
2985                 socantsendmore(stcb->sctp_socket);
2986         }
2987         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT))
2988                 /* event not enabled */
2989                 return;
2990
2991         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 1, M_DONTWAIT, 1, MT_DATA);
2992         if (m_notify == NULL)
2993                 /* no space left */
2994                 return;
2995         m_notify->m_len = 0;
2996         sse = mtod(m_notify, struct sctp_shutdown_event *);
2997         sse->sse_type = SCTP_SHUTDOWN_EVENT;
2998         sse->sse_flags = 0;
2999         sse->sse_length = sizeof(struct sctp_shutdown_event);
3000         sse->sse_assoc_id = sctp_get_associd(stcb);
3001
3002         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
3003         m_notify->m_pkthdr.len = sizeof(struct sctp_shutdown_event);
3004         m_notify->m_pkthdr.rcvif = 0;
3005         m_notify->m_len = sizeof(struct sctp_shutdown_event);
3006         m_notify->m_next = NULL;
3007
3008         /* append to socket */
3009         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3010             0, 0, 0, 0, 0, 0,
3011             m_notify);
3012         if (control == NULL) {
3013                 /* no memory */
3014                 sctp_m_freem(m_notify);
3015                 return;
3016         }
3017         control->length = m_notify->m_len;
3018         /* not that we need this */
3019         control->tail_mbuf = m_notify;
3020         sctp_add_to_readq(stcb->sctp_ep, stcb,
3021             control,
3022             &stcb->sctp_socket->so_rcv, 1);
3023 }
3024
3025 static void
3026 sctp_notify_stream_reset(struct sctp_tcb *stcb,
3027     int number_entries, uint16_t * list, int flag)
3028 {
3029         struct mbuf *m_notify;
3030         struct sctp_queued_to_read *control;
3031         struct sctp_stream_reset_event *strreset;
3032         int len;
3033
3034         if (sctp_is_feature_off(stcb->sctp_ep, SCTP_PCB_FLAGS_STREAM_RESETEVNT))
3035                 /* event not enabled */
3036                 return;
3037
3038         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 1, M_DONTWAIT, 1, MT_DATA);
3039         if (m_notify == NULL)
3040                 /* no space left */
3041                 return;
3042         m_notify->m_len = 0;
3043         len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
3044         if (len > M_TRAILINGSPACE(m_notify)) {
3045                 /* never enough room */
3046                 sctp_m_freem(m_notify);
3047                 return;
3048         }
3049         strreset = mtod(m_notify, struct sctp_stream_reset_event *);
3050         strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
3051         if (number_entries == 0) {
3052                 strreset->strreset_flags = flag | SCTP_STRRESET_ALL_STREAMS;
3053         } else {
3054                 strreset->strreset_flags = flag | SCTP_STRRESET_STREAM_LIST;
3055         }
3056         strreset->strreset_length = len;
3057         strreset->strreset_assoc_id = sctp_get_associd(stcb);
3058         if (number_entries) {
3059                 int i;
3060
3061                 for (i = 0; i < number_entries; i++) {
3062                         strreset->strreset_list[i] = ntohs(list[i]);
3063                 }
3064         }
3065         m_notify->m_flags |= M_EOR | M_NOTIFICATION;
3066         m_notify->m_pkthdr.len = len;
3067         m_notify->m_pkthdr.rcvif = 0;
3068         m_notify->m_len = len;
3069         m_notify->m_next = NULL;
3070         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < m_notify->m_len) {
3071                 /* no space */
3072                 sctp_m_freem(m_notify);
3073                 return;
3074         }
3075         /* append to socket */
3076         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3077             0, 0, 0, 0, 0, 0,
3078             m_notify);
3079         if (control == NULL) {
3080                 /* no memory */
3081                 sctp_m_freem(m_notify);
3082                 return;
3083         }
3084         control->length = m_notify->m_len;
3085         /* not that we need this */
3086         control->tail_mbuf = m_notify;
3087         sctp_add_to_readq(stcb->sctp_ep, stcb,
3088             control,
3089             &stcb->sctp_socket->so_rcv, 1);
3090 }
3091
3092
3093 void
3094 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb,
3095     uint32_t error, void *data)
3096 {
3097         if (stcb == NULL) {
3098                 /* unlikely but */
3099                 return;
3100         }
3101         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3102             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3103             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)
3104             ) {
3105                 /* No notifications up when we are in a no socket state */
3106                 return;
3107         }
3108         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
3109                 /* Can't send up to a closed socket any notifications */
3110                 return;
3111         }
3112         if (stcb && (stcb->asoc.assoc_up_sent == 0) && (notification != SCTP_NOTIFY_ASSOC_UP)) {
3113                 if ((notification != SCTP_NOTIFY_ASSOC_DOWN) &&
3114                     (notification != SCTP_NOTIFY_ASSOC_ABORTED) &&
3115                     (notification != SCTP_NOTIFY_SPECIAL_SP_FAIL) &&
3116                     (notification != SCTP_NOTIFY_DG_FAIL) &&
3117                     (notification != SCTP_NOTIFY_PEER_SHUTDOWN)) {
3118                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, 0, NULL);
3119                         stcb->asoc.assoc_up_sent = 1;
3120                 }
3121         }
3122         switch (notification) {
3123         case SCTP_NOTIFY_ASSOC_UP:
3124                 if (stcb->asoc.assoc_up_sent == 0) {
3125                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, NULL);
3126                         stcb->asoc.assoc_up_sent = 1;
3127                 }
3128                 break;
3129         case SCTP_NOTIFY_ASSOC_DOWN:
3130                 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, NULL);
3131                 break;
3132         case SCTP_NOTIFY_INTERFACE_DOWN:
3133                 {
3134                         struct sctp_nets *net;
3135
3136                         net = (struct sctp_nets *)data;
3137                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE,
3138                             (struct sockaddr *)&net->ro._l_addr, error);
3139                         break;
3140                 }
3141         case SCTP_NOTIFY_INTERFACE_UP:
3142                 {
3143                         struct sctp_nets *net;
3144
3145                         net = (struct sctp_nets *)data;
3146                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE,
3147                             (struct sockaddr *)&net->ro._l_addr, error);
3148                         break;
3149                 }
3150         case SCTP_NOTIFY_INTERFACE_CONFIRMED:
3151                 {
3152                         struct sctp_nets *net;
3153
3154                         net = (struct sctp_nets *)data;
3155                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED,
3156                             (struct sockaddr *)&net->ro._l_addr, error);
3157                         break;
3158                 }
3159         case SCTP_NOTIFY_SPECIAL_SP_FAIL:
3160                 sctp_notify_send_failed2(stcb, error,
3161                     (struct sctp_stream_queue_pending *)data);
3162                 break;
3163         case SCTP_NOTIFY_DG_FAIL:
3164                 sctp_notify_send_failed(stcb, error,
3165                     (struct sctp_tmit_chunk *)data);
3166                 break;
3167         case SCTP_NOTIFY_ADAPTATION_INDICATION:
3168                 /* Here the error is the adaptation indication */
3169                 sctp_notify_adaptation_layer(stcb, error);
3170                 break;
3171         case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION:
3172                 sctp_notify_partial_delivery_indication(stcb, error, 0);
3173                 break;
3174         case SCTP_NOTIFY_STRDATA_ERR:
3175                 break;
3176         case SCTP_NOTIFY_ASSOC_ABORTED:
3177                 sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, NULL);
3178                 break;
3179         case SCTP_NOTIFY_PEER_OPENED_STREAM:
3180                 break;
3181         case SCTP_NOTIFY_STREAM_OPENED_OK:
3182                 break;
3183         case SCTP_NOTIFY_ASSOC_RESTART:
3184                 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, data);
3185                 break;
3186         case SCTP_NOTIFY_HB_RESP:
3187                 break;
3188         case SCTP_NOTIFY_STR_RESET_SEND:
3189                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STRRESET_OUTBOUND_STR);
3190                 break;
3191         case SCTP_NOTIFY_STR_RESET_RECV:
3192                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STRRESET_INBOUND_STR);
3193                 break;
3194         case SCTP_NOTIFY_STR_RESET_FAILED_OUT:
3195                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), (SCTP_STRRESET_OUTBOUND_STR | SCTP_STRRESET_INBOUND_STR));
3196                 break;
3197
3198         case SCTP_NOTIFY_STR_RESET_FAILED_IN:
3199                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), (SCTP_STRRESET_INBOUND_STR | SCTP_STRRESET_INBOUND_STR));
3200                 break;
3201
3202         case SCTP_NOTIFY_ASCONF_ADD_IP:
3203                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data,
3204                     error);
3205                 break;
3206         case SCTP_NOTIFY_ASCONF_DELETE_IP:
3207                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data,
3208                     error);
3209                 break;
3210         case SCTP_NOTIFY_ASCONF_SET_PRIMARY:
3211                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data,
3212                     error);
3213                 break;
3214         case SCTP_NOTIFY_ASCONF_SUCCESS:
3215                 break;
3216         case SCTP_NOTIFY_ASCONF_FAILED:
3217                 break;
3218         case SCTP_NOTIFY_PEER_SHUTDOWN:
3219                 sctp_notify_shutdown_event(stcb);
3220                 break;
3221         case SCTP_NOTIFY_AUTH_NEW_KEY:
3222                 sctp_notify_authentication(stcb, SCTP_AUTH_NEWKEY, error,
3223                     (uint16_t) (uintptr_t) data);
3224                 break;
3225 #if 0
3226         case SCTP_NOTIFY_AUTH_KEY_CONFLICT:
3227                 sctp_notify_authentication(stcb, SCTP_AUTH_KEY_CONFLICT,
3228                     error, (uint16_t) (uintptr_t) data);
3229                 break;
3230 #endif                          /* not yet? remove? */
3231
3232
3233         default:
3234 #ifdef SCTP_DEBUG
3235                 if (sctp_debug_on & SCTP_DEBUG_UTIL1) {
3236                         printf("NOTIFY: unknown notification %xh (%u)\n",
3237                             notification, notification);
3238                 }
3239 #endif                          /* SCTP_DEBUG */
3240                 break;
3241         }                       /* end switch */
3242 }
3243
3244 void
3245 sctp_report_all_outbound(struct sctp_tcb *stcb, int holds_lock)
3246 {
3247         struct sctp_association *asoc;
3248         struct sctp_stream_out *outs;
3249         struct sctp_tmit_chunk *chk;
3250         struct sctp_stream_queue_pending *sp;
3251         int i;
3252
3253         asoc = &stcb->asoc;
3254
3255         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3256             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3257             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3258                 return;
3259         }
3260         /* now through all the gunk freeing chunks */
3261         if (holds_lock == 0)
3262                 SCTP_TCB_SEND_LOCK(stcb);
3263         for (i = 0; i < stcb->asoc.streamoutcnt; i++) {
3264                 /* For each stream */
3265                 outs = &stcb->asoc.strmout[i];
3266                 /* clean up any sends there */
3267                 stcb->asoc.locked_on_sending = NULL;
3268                 sp = TAILQ_FIRST(&outs->outqueue);
3269                 while (sp) {
3270                         stcb->asoc.stream_queue_cnt--;
3271                         TAILQ_REMOVE(&outs->outqueue, sp, next);
3272                         sctp_free_spbufspace(stcb, asoc, sp);
3273                         sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
3274                             SCTP_NOTIFY_DATAGRAM_UNSENT, (void *)sp);
3275                         if (sp->data) {
3276                                 sctp_m_freem(sp->data);
3277                                 sp->data = NULL;
3278                         }
3279                         if (sp->net)
3280                                 sctp_free_remote_addr(sp->net);
3281                         sp->net = NULL;
3282                         /* Free the chunk */
3283                         sctp_free_a_strmoq(stcb, sp);
3284                         sp = TAILQ_FIRST(&outs->outqueue);
3285                 }
3286         }
3287
3288         /* pending send queue SHOULD be empty */
3289         if (!TAILQ_EMPTY(&asoc->send_queue)) {
3290                 chk = TAILQ_FIRST(&asoc->send_queue);
3291                 while (chk) {
3292                         TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
3293                         if (chk->data) {
3294                                 /*
3295                                  * trim off the sctp chunk header(it should
3296                                  * be there)
3297                                  */
3298                                 if (chk->send_size >= sizeof(struct sctp_data_chunk)) {
3299                                         m_adj(chk->data, sizeof(struct sctp_data_chunk));
3300                                         sctp_mbuf_crush(chk->data);
3301                                 }
3302                         }
3303                         sctp_free_bufspace(stcb, asoc, chk, 1);
3304                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, SCTP_NOTIFY_DATAGRAM_UNSENT, chk);
3305                         if (chk->data) {
3306                                 sctp_m_freem(chk->data);
3307                                 chk->data = NULL;
3308                         }
3309                         if (chk->whoTo)
3310                                 sctp_free_remote_addr(chk->whoTo);
3311                         chk->whoTo = NULL;
3312                         sctp_free_a_chunk(stcb, chk);
3313                         chk = TAILQ_FIRST(&asoc->send_queue);
3314                 }
3315         }
3316         /* sent queue SHOULD be empty */
3317         if (!TAILQ_EMPTY(&asoc->sent_queue)) {
3318                 chk = TAILQ_FIRST(&asoc->sent_queue);
3319                 while (chk) {
3320                         TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
3321                         if (chk->data) {
3322                                 /*
3323                                  * trim off the sctp chunk header(it should
3324                                  * be there)
3325                                  */
3326                                 if (chk->send_size >= sizeof(struct sctp_data_chunk)) {
3327                                         m_adj(chk->data, sizeof(struct sctp_data_chunk));
3328                                         sctp_mbuf_crush(chk->data);
3329                                 }
3330                         }
3331                         sctp_free_bufspace(stcb, asoc, chk, 1);
3332                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
3333                             SCTP_NOTIFY_DATAGRAM_SENT, chk);
3334                         if (chk->data) {
3335                                 sctp_m_freem(chk->data);
3336                                 chk->data = NULL;
3337                         }
3338                         if (chk->whoTo)
3339                                 sctp_free_remote_addr(chk->whoTo);
3340                         chk->whoTo = NULL;
3341                         sctp_free_a_chunk(stcb, chk);
3342                         chk = TAILQ_FIRST(&asoc->sent_queue);
3343                 }
3344         }
3345         if (holds_lock == 0)
3346                 SCTP_TCB_SEND_UNLOCK(stcb);
3347 }
3348
3349 void
3350 sctp_abort_notification(struct sctp_tcb *stcb, int error)
3351 {
3352
3353         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3354             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3355             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3356                 return;
3357         }
3358         /* Tell them we lost the asoc */
3359         sctp_report_all_outbound(stcb, 1);
3360         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
3361             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
3362             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
3363                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED;
3364         }
3365         sctp_ulp_notify(SCTP_NOTIFY_ASSOC_ABORTED, stcb, error, NULL);
3366 }
3367
3368 void
3369 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3370     struct mbuf *m, int iphlen, struct sctphdr *sh, struct mbuf *op_err)
3371 {
3372         uint32_t vtag;
3373
3374         vtag = 0;
3375         if (stcb != NULL) {
3376                 /* We have a TCB to abort, send notification too */
3377                 vtag = stcb->asoc.peer_vtag;
3378                 sctp_abort_notification(stcb, 0);
3379         }
3380         sctp_send_abort(m, iphlen, sh, vtag, op_err);
3381         if (stcb != NULL) {
3382                 /* Ok, now lets free it */
3383                 sctp_free_assoc(inp, stcb, 0);
3384         } else {
3385                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3386                         if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
3387                                 sctp_inpcb_free(inp, 1, 0);
3388                         }
3389                 }
3390         }
3391 }
3392
3393 void
3394 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3395     int error, struct mbuf *op_err)
3396 {
3397         uint32_t vtag;
3398
3399         if (stcb == NULL) {
3400                 /* Got to have a TCB */
3401                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3402                         if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
3403                                 sctp_inpcb_free(inp, 1, 0);
3404                         }
3405                 }
3406                 return;
3407         }
3408         vtag = stcb->asoc.peer_vtag;
3409         /* notify the ulp */
3410         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0)
3411                 sctp_abort_notification(stcb, error);
3412         /* notify the peer */
3413         sctp_send_abort_tcb(stcb, op_err);
3414         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3415         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
3416             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3417                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3418         }
3419         /* now free the asoc */
3420         sctp_free_assoc(inp, stcb, 0);
3421 }
3422
3423 void
3424 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh,
3425     struct sctp_inpcb *inp, struct mbuf *op_err)
3426 {
3427         struct sctp_chunkhdr *ch, chunk_buf;
3428         unsigned int chk_length;
3429
3430         SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue);
3431         /* Generate a TO address for future reference */
3432         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
3433                 if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
3434                         sctp_inpcb_free(inp, 1, 0);
3435                 }
3436         }
3437         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
3438             sizeof(*ch), (uint8_t *) & chunk_buf);
3439         while (ch != NULL) {
3440                 chk_length = ntohs(ch->chunk_length);
3441                 if (chk_length < sizeof(*ch)) {
3442                         /* break to abort land */
3443                         break;
3444                 }
3445                 switch (ch->chunk_type) {
3446                 case SCTP_PACKET_DROPPED:
3447                         /* we don't respond to pkt-dropped */
3448                         return;
3449                 case SCTP_ABORT_ASSOCIATION:
3450                         /* we don't respond with an ABORT to an ABORT */
3451                         return;
3452                 case SCTP_SHUTDOWN_COMPLETE:
3453                         /*
3454                          * we ignore it since we are not waiting for it and
3455                          * peer is gone
3456                          */
3457                         return;
3458                 case SCTP_SHUTDOWN_ACK:
3459                         sctp_send_shutdown_complete2(m, iphlen, sh);
3460                         return;
3461                 default:
3462                         break;
3463                 }
3464                 offset += SCTP_SIZE32(chk_length);
3465                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
3466                     sizeof(*ch), (uint8_t *) & chunk_buf);
3467         }
3468         sctp_send_abort(m, iphlen, sh, 0, op_err);
3469 }
3470
3471 /*
3472  * check the inbound datagram to make sure there is not an abort inside it,
3473  * if there is return 1, else return 0.
3474  */
3475 int
3476 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t * vtagfill)
3477 {
3478         struct sctp_chunkhdr *ch;
3479         struct sctp_init_chunk *init_chk, chunk_buf;
3480         int offset;
3481         unsigned int chk_length;
3482
3483         offset = iphlen + sizeof(struct sctphdr);
3484         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch),
3485             (uint8_t *) & chunk_buf);
3486         while (ch != NULL) {
3487                 chk_length = ntohs(ch->chunk_length);
3488                 if (chk_length < sizeof(*ch)) {
3489                         /* packet is probably corrupt */
3490                         break;
3491                 }
3492                 /* we seem to be ok, is it an abort? */
3493                 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) {
3494                         /* yep, tell them */
3495                         return (1);
3496                 }
3497                 if (ch->chunk_type == SCTP_INITIATION) {
3498                         /* need to update the Vtag */
3499                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
3500                             offset, sizeof(*init_chk), (uint8_t *) & chunk_buf);
3501                         if (init_chk != NULL) {
3502                                 *vtagfill = ntohl(init_chk->init.initiate_tag);
3503                         }
3504                 }
3505                 /* Nope, move to the next chunk */
3506                 offset += SCTP_SIZE32(chk_length);
3507                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
3508                     sizeof(*ch), (uint8_t *) & chunk_buf);
3509         }
3510         return (0);
3511 }
3512
3513 /*
3514  * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id
3515  * set (i.e. it's 0) so, create this function to compare link local scopes
3516  */
3517 uint32_t
3518 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2)
3519 {
3520         struct sockaddr_in6 a, b;
3521
3522         /* save copies */
3523         a = *addr1;
3524         b = *addr2;
3525
3526         if (a.sin6_scope_id == 0)
3527                 if (sa6_recoverscope(&a)) {
3528                         /* can't get scope, so can't match */
3529                         return (0);
3530                 }
3531         if (b.sin6_scope_id == 0)
3532                 if (sa6_recoverscope(&b)) {
3533                         /* can't get scope, so can't match */
3534                         return (0);
3535                 }
3536         if (a.sin6_scope_id != b.sin6_scope_id)
3537                 return (0);
3538
3539         return (1);
3540 }
3541
3542 /*
3543  * returns a sockaddr_in6 with embedded scope recovered and removed
3544  */
3545 struct sockaddr_in6 *
3546 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store)
3547 {
3548
3549         /* check and strip embedded scope junk */
3550         if (addr->sin6_family == AF_INET6) {
3551                 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) {
3552                         if (addr->sin6_scope_id == 0) {
3553                                 *store = *addr;
3554                                 if (!sa6_recoverscope(store)) {
3555                                         /* use the recovered scope */
3556                                         addr = store;
3557                                 }
3558                                 /* else, return the original "to" addr */
3559                         }
3560                 }
3561         }
3562         return (addr);
3563 }
3564
3565 /*
3566  * are the two addresses the same?  currently a "scopeless" check returns: 1
3567  * if same, 0 if not
3568  */
3569 __inline int
3570 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2)
3571 {
3572
3573         /* must be valid */
3574         if (sa1 == NULL || sa2 == NULL)
3575                 return (0);
3576
3577         /* must be the same family */
3578         if (sa1->sa_family != sa2->sa_family)
3579                 return (0);
3580
3581         if (sa1->sa_family == AF_INET6) {
3582                 /* IPv6 addresses */
3583                 struct sockaddr_in6 *sin6_1, *sin6_2;
3584
3585                 sin6_1 = (struct sockaddr_in6 *)sa1;
3586                 sin6_2 = (struct sockaddr_in6 *)sa2;
3587                 return (SCTP6_ARE_ADDR_EQUAL(&sin6_1->sin6_addr,
3588                     &sin6_2->sin6_addr));
3589         } else if (sa1->sa_family == AF_INET) {
3590                 /* IPv4 addresses */
3591                 struct sockaddr_in *sin_1, *sin_2;
3592
3593                 sin_1 = (struct sockaddr_in *)sa1;
3594                 sin_2 = (struct sockaddr_in *)sa2;
3595                 return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr);
3596         } else {
3597                 /* we don't do these... */
3598                 return (0);
3599         }
3600 }
3601
3602 void
3603 sctp_print_address(struct sockaddr *sa)
3604 {
3605
3606         if (sa->sa_family == AF_INET6) {
3607                 struct sockaddr_in6 *sin6;
3608                 char ip6buf[INET6_ADDRSTRLEN];
3609
3610                 sin6 = (struct sockaddr_in6 *)sa;
3611                 printf("IPv6 address: %s:%d scope:%u\n",
3612                     ip6_sprintf(ip6buf, &sin6->sin6_addr),
3613                     ntohs(sin6->sin6_port),
3614                     sin6->sin6_scope_id);
3615         } else if (sa->sa_family == AF_INET) {
3616                 struct sockaddr_in *sin;
3617                 unsigned char *p;
3618
3619                 sin = (struct sockaddr_in *)sa;
3620                 p = (unsigned char *)&sin->sin_addr;
3621                 printf("IPv4 address: %u.%u.%u.%u:%d\n",
3622                     p[0], p[1], p[2], p[3], ntohs(sin->sin_port));
3623         } else {
3624                 printf("?\n");
3625         }
3626 }
3627
3628 void
3629 sctp_print_address_pkt(struct ip *iph, struct sctphdr *sh)
3630 {
3631         if (iph->ip_v == IPVERSION) {
3632                 struct sockaddr_in lsa, fsa;
3633
3634                 bzero(&lsa, sizeof(lsa));
3635                 lsa.sin_len = sizeof(lsa);
3636                 lsa.sin_family = AF_INET;
3637                 lsa.sin_addr = iph->ip_src;
3638                 lsa.sin_port = sh->src_port;
3639                 bzero(&fsa, sizeof(fsa));
3640                 fsa.sin_len = sizeof(fsa);
3641                 fsa.sin_family = AF_INET;
3642                 fsa.sin_addr = iph->ip_dst;
3643                 fsa.sin_port = sh->dest_port;
3644                 printf("src: ");
3645                 sctp_print_address((struct sockaddr *)&lsa);
3646                 printf("dest: ");
3647                 sctp_print_address((struct sockaddr *)&fsa);
3648         } else if (iph->ip_v == (IPV6_VERSION >> 4)) {
3649                 struct ip6_hdr *ip6;
3650                 struct sockaddr_in6 lsa6, fsa6;
3651
3652                 ip6 = (struct ip6_hdr *)iph;
3653                 bzero(&lsa6, sizeof(lsa6));
3654                 lsa6.sin6_len = sizeof(lsa6);
3655                 lsa6.sin6_family = AF_INET6;
3656                 lsa6.sin6_addr = ip6->ip6_src;
3657                 lsa6.sin6_port = sh->src_port;
3658                 bzero(&fsa6, sizeof(fsa6));
3659                 fsa6.sin6_len = sizeof(fsa6);
3660                 fsa6.sin6_family = AF_INET6;
3661                 fsa6.sin6_addr = ip6->ip6_dst;
3662                 fsa6.sin6_port = sh->dest_port;
3663                 printf("src: ");
3664                 sctp_print_address((struct sockaddr *)&lsa6);
3665                 printf("dest: ");
3666                 sctp_print_address((struct sockaddr *)&fsa6);
3667         }
3668 }
3669
3670 #if defined(HAVE_SCTP_SO_LASTRECORD)
3671
3672 /* cloned from uipc_socket.c */
3673
3674 #define SCTP_SBLINKRECORD(sb, m0) do {                                  \
3675         if ((sb)->sb_lastrecord != NULL)                                \
3676                 (sb)->sb_lastrecord->m_nextpkt = (m0);                  \
3677         else                                                            \
3678                 (sb)->sb_mb = (m0);                                     \
3679         (sb)->sb_lastrecord = (m0);                                     \
3680 } while (/*CONSTCOND*/0)
3681 #endif
3682
3683 void
3684 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
3685     struct sctp_inpcb *new_inp,
3686     struct sctp_tcb *stcb)
3687 {
3688         /*
3689          * go through our old INP and pull off any control structures that
3690          * belong to stcb and move then to the new inp.
3691          */
3692         struct socket *old_so, *new_so;
3693         struct sctp_queued_to_read *control, *nctl;
3694         struct sctp_readhead tmp_queue;
3695         struct mbuf *m;
3696         int error;
3697
3698         old_so = old_inp->sctp_socket;
3699         new_so = new_inp->sctp_socket;
3700         TAILQ_INIT(&tmp_queue);
3701
3702         SOCKBUF_LOCK(&(old_so->so_rcv));
3703
3704         error = sblock(&old_so->so_rcv, 0);
3705
3706         SOCKBUF_UNLOCK(&(old_so->so_rcv));
3707         if (error) {
3708                 /*
3709                  * Gak, can't get sblock, we have a problem. data will be
3710                  * left stranded.. and we don't dare look at it since the
3711                  * other thread may be reading something. Oh well, its a
3712                  * screwed up app that does a peeloff OR a accept while
3713                  * reading from the main socket... actually its only the
3714                  * peeloff() case, since I think read will fail on a
3715                  * listening socket..
3716                  */
3717                 return;
3718         }
3719         /* lock the socket buffers */
3720         SCTP_INP_READ_LOCK(old_inp);
3721         control = TAILQ_FIRST(&old_inp->read_queue);
3722         /* Pull off all for out target stcb */
3723         while (control) {
3724                 nctl = TAILQ_NEXT(control, next);
3725                 if (control->stcb == stcb) {
3726                         /* remove it we want it */
3727                         TAILQ_REMOVE(&old_inp->read_queue, control, next);
3728                         TAILQ_INSERT_TAIL(&tmp_queue, control, next);
3729                         m = control->data;
3730                         while (m) {
3731 #ifdef SCTP_SB_LOGGING
3732                                 sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, m->m_len);
3733 #endif
3734                                 sctp_sbfree(control, stcb, &old_so->so_rcv, m);
3735 #ifdef SCTP_SB_LOGGING
3736                                 sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3737 #endif
3738                                 m = m->m_next;
3739                         }
3740                 }
3741                 control = nctl;
3742         }
3743         SCTP_INP_READ_UNLOCK(old_inp);
3744
3745         /* Remove the sb-lock on the old socket */
3746         SOCKBUF_LOCK(&(old_so->so_rcv));
3747
3748         sbunlock(&old_so->so_rcv);
3749         SOCKBUF_UNLOCK(&(old_so->so_rcv));
3750
3751         /* Now we move them over to the new socket buffer */
3752         control = TAILQ_FIRST(&tmp_queue);
3753         SCTP_INP_READ_LOCK(new_inp);
3754         while (control) {
3755                 nctl = TAILQ_NEXT(control, next);
3756                 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next);
3757                 m = control->data;
3758                 while (m) {
3759 #ifdef SCTP_SB_LOGGING
3760                         sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, m->m_len);
3761 #endif
3762                         sctp_sballoc(stcb, &new_so->so_rcv, m);
3763 #ifdef SCTP_SB_LOGGING
3764                         sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3765 #endif
3766                         m = m->m_next;
3767                 }
3768                 control = nctl;
3769         }
3770         SCTP_INP_READ_UNLOCK(new_inp);
3771 }
3772
3773
3774 void
3775 sctp_add_to_readq(struct sctp_inpcb *inp,
3776     struct sctp_tcb *stcb,
3777     struct sctp_queued_to_read *control,
3778     struct sockbuf *sb,
3779     int end)
3780 {
3781         /*
3782          * Here we must place the control on the end of the socket read
3783          * queue AND increment sb_cc so that select will work properly on
3784          * read.
3785          */
3786         struct mbuf *m, *prev = NULL;
3787
3788         if (inp == NULL) {
3789                 /* Gak, TSNH!! */
3790 #ifdef INVARIENTS
3791                 panic("Gak, inp NULL on add_to_readq");
3792 #endif
3793                 return;
3794         }
3795         SCTP_INP_READ_LOCK(inp);
3796         m = control->data;
3797         control->held_length = 0;
3798         control->length = 0;
3799         while (m) {
3800                 if (m->m_len == 0) {
3801                         /* Skip mbufs with NO length */
3802                         if (prev == NULL) {
3803                                 /* First one */
3804                                 control->data = sctp_m_free(m);
3805                                 m = control->data;
3806                         } else {
3807                                 prev->m_next = sctp_m_free(m);
3808                                 m = prev->m_next;
3809                         }
3810                         if (m == NULL) {
3811                                 control->tail_mbuf = prev;;
3812                         }
3813                         continue;
3814                 }
3815                 prev = m;
3816 #ifdef SCTP_SB_LOGGING
3817                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, m->m_len);
3818 #endif
3819                 sctp_sballoc(stcb, sb, m);
3820 #ifdef SCTP_SB_LOGGING
3821                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3822 #endif
3823                 atomic_add_int(&control->length, m->m_len);
3824                 m = m->m_next;
3825         }
3826         if (prev != NULL) {
3827                 control->tail_mbuf = prev;
3828                 if (end) {
3829                         prev->m_flags |= M_EOR;
3830                 }
3831         } else {
3832                 return;
3833         }
3834         if (end) {
3835                 control->end_added = 1;
3836         }
3837         TAILQ_INSERT_TAIL(&inp->read_queue, control, next);
3838         SCTP_INP_READ_UNLOCK(inp);
3839         if (inp && inp->sctp_socket) {
3840                 sctp_sorwakeup(inp, inp->sctp_socket);
3841         }
3842 }
3843
3844
3845 int
3846 sctp_append_to_readq(struct sctp_inpcb *inp,
3847     struct sctp_tcb *stcb,
3848     struct sctp_queued_to_read *control,
3849     struct mbuf *m,
3850     int end,
3851     int ctls_cumack,
3852     struct sockbuf *sb)
3853 {
3854         /*
3855          * A partial delivery API event is underway. OR we are appending on
3856          * the reassembly queue.
3857          *
3858          * If PDAPI this means we need to add m to the end of the data.
3859          * Increase the length in the control AND increment the sb_cc.
3860          * Otherwise sb is NULL and all we need to do is put it at the end
3861          * of the mbuf chain.
3862          */
3863         int len = 0;
3864         struct mbuf *mm, *tail = NULL, *prev = NULL;
3865
3866         if (inp) {
3867                 SCTP_INP_READ_LOCK(inp);
3868         }
3869         if (control == NULL) {
3870 get_out:
3871                 if (inp) {
3872                         SCTP_INP_READ_UNLOCK(inp);
3873                 }
3874                 return (-1);
3875         }
3876         if ((control->tail_mbuf) &&
3877             (control->tail_mbuf->m_flags & M_EOR)) {
3878                 /* huh this one is complete? */
3879                 goto get_out;
3880         }
3881         mm = m;
3882         if (mm == NULL) {
3883                 goto get_out;
3884         }
3885         while (mm) {
3886                 if (mm->m_len == 0) {
3887                         /* Skip mbufs with NO lenght */
3888                         if (prev == NULL) {
3889                                 /* First one */
3890                                 m = sctp_m_free(mm);
3891                                 mm = m;
3892                         } else {
3893                                 prev->m_next = sctp_m_free(mm);
3894                                 mm = prev->m_next;
3895                         }
3896                         continue;
3897                 }
3898                 prev = mm;
3899                 len += mm->m_len;
3900                 if (sb) {
3901 #ifdef SCTP_SB_LOGGING
3902                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, mm->m_len);
3903 #endif
3904                         sctp_sballoc(stcb, sb, mm);
3905 #ifdef SCTP_SB_LOGGING
3906                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3907 #endif
3908                 }
3909                 mm = mm->m_next;
3910         }
3911         if (prev) {
3912                 tail = prev;
3913         } else {
3914                 /* Really there should always be a prev */
3915                 if (m == NULL) {
3916                         /* Huh nothing left? */
3917 #ifdef INVARIENTS
3918                         panic("Nothing left to add?");
3919 #else
3920                         goto get_out;
3921 #endif
3922                 }
3923                 tail = m;
3924         }
3925         if (end) {
3926                 /* message is complete */
3927                 tail->m_flags |= M_EOR;
3928                 if (control == stcb->asoc.control_pdapi) {
3929                         stcb->asoc.control_pdapi = NULL;
3930                 }
3931                 control->held_length = 0;
3932                 control->end_added = 1;
3933         }
3934         atomic_add_int(&control->length, len);
3935         if (control->tail_mbuf) {
3936                 /* append */
3937                 control->tail_mbuf->m_next = m;
3938                 control->tail_mbuf = tail;
3939         } else {
3940                 /* nothing there */
3941 #ifdef INVARIENTS
3942                 if (control->data != NULL) {
3943                         panic("This should NOT happen");
3944                 }
3945 #endif
3946                 control->data = m;
3947                 control->tail_mbuf = tail;
3948         }
3949         /*
3950          * When we are appending in partial delivery, the cum-ack is used
3951          * for the actual pd-api highest tsn on this mbuf. The true cum-ack
3952          * is populated in the outbound sinfo structure from the true cumack
3953          * if the association exists...
3954          */
3955         control->sinfo_tsn = control->sinfo_cumtsn = ctls_cumack;
3956         if (inp) {
3957                 SCTP_INP_READ_UNLOCK(inp);
3958         }
3959         if (inp && inp->sctp_socket) {
3960                 sctp_sorwakeup(inp, inp->sctp_socket);
3961         }
3962         return (0);
3963 }
3964
3965
3966
3967 /*************HOLD THIS COMMENT FOR PATCH FILE OF
3968  *************ALTERNATE ROUTING CODE
3969  */
3970
3971 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF
3972  *************ALTERNATE ROUTING CODE
3973  */
3974
3975 struct mbuf *
3976 sctp_generate_invmanparam(int err)
3977 {
3978         /* Return a MBUF with a invalid mandatory parameter */
3979         struct mbuf *m;
3980
3981         m = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_DONTWAIT, 1, MT_DATA);
3982         if (m) {
3983                 struct sctp_paramhdr *ph;
3984
3985                 m->m_len = sizeof(struct sctp_paramhdr);
3986                 ph = mtod(m, struct sctp_paramhdr *);
3987                 ph->param_length = htons(sizeof(struct sctp_paramhdr));
3988                 ph->param_type = htons(err);
3989         }
3990         return (m);
3991 }
3992
3993 #ifdef SCTP_MBCNT_LOGGING
3994 void
3995 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc,
3996     struct sctp_tmit_chunk *tp1, int chk_cnt)
3997 {
3998         if (tp1->data == NULL) {
3999                 return;
4000         }
4001         asoc->chunks_on_out_queue -= chk_cnt;
4002         sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE,
4003             asoc->total_output_queue_size,
4004             tp1->book_size,
4005             0,
4006             tp1->mbcnt);
4007         if (asoc->total_output_queue_size >= tp1->book_size) {
4008                 asoc->total_output_queue_size -= tp1->book_size;
4009         } else {
4010                 asoc->total_output_queue_size = 0;
4011         }
4012
4013         if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) ||
4014             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) {
4015                 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) {
4016                         stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size;
4017                 } else {
4018                         stcb->sctp_socket->so_snd.sb_cc = 0;
4019
4020                 }
4021         }
4022 }
4023
4024 #endif
4025
4026 int
4027 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1,
4028     int reason, struct sctpchunk_listhead *queue)
4029 {
4030         int ret_sz = 0;
4031         int notdone;
4032         uint8_t foundeom = 0;
4033
4034         do {
4035                 ret_sz += tp1->book_size;
4036                 tp1->sent = SCTP_FORWARD_TSN_SKIP;
4037                 if (tp1->data) {
4038                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4039                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, reason, tp1);
4040                         sctp_m_freem(tp1->data);
4041                         tp1->data = NULL;
4042                         sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
4043                 }
4044                 if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
4045                         stcb->asoc.sent_queue_cnt_removeable--;
4046                 }
4047                 if (queue == &stcb->asoc.send_queue) {
4048                         TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next);
4049                         /* on to the sent queue */
4050                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1,
4051                             sctp_next);
4052                         stcb->asoc.sent_queue_cnt++;
4053                 }
4054                 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
4055                     SCTP_DATA_NOT_FRAG) {
4056                         /* not frag'ed we ae done   */
4057                         notdone = 0;
4058                         foundeom = 1;
4059                 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4060                         /* end of frag, we are done */
4061                         notdone = 0;
4062                         foundeom = 1;
4063                 } else {
4064                         /*
4065                          * Its a begin or middle piece, we must mark all of
4066                          * it
4067                          */
4068                         notdone = 1;
4069                         tp1 = TAILQ_NEXT(tp1, sctp_next);
4070                 }
4071         } while (tp1 && notdone);
4072         if ((foundeom == 0) && (queue == &stcb->asoc.sent_queue)) {
4073                 /*
4074                  * The multi-part message was scattered across the send and
4075                  * sent queue.
4076                  */
4077                 tp1 = TAILQ_FIRST(&stcb->asoc.send_queue);
4078                 /*
4079                  * recurse throught the send_queue too, starting at the
4080                  * beginning.
4081                  */
4082                 if (tp1) {
4083                         ret_sz += sctp_release_pr_sctp_chunk(stcb, tp1, reason,
4084                             &stcb->asoc.send_queue);
4085                 } else {
4086                         printf("hmm, nothing on the send queue and no EOM?\n");
4087                 }
4088         }
4089         return (ret_sz);
4090 }
4091
4092 /*
4093  * checks to see if the given address, sa, is one that is currently known by
4094  * the kernel note: can't distinguish the same address on multiple interfaces
4095  * and doesn't handle multiple addresses with different zone/scope id's note:
4096  * ifa_ifwithaddr() compares the entire sockaddr struct
4097  */
4098 struct ifaddr *
4099 sctp_find_ifa_by_addr(struct sockaddr *sa)
4100 {
4101         struct ifnet *ifn;
4102         struct ifaddr *ifa;
4103
4104         /* go through all our known interfaces */
4105         TAILQ_FOREACH(ifn, &ifnet, if_list) {
4106                 /* go through each interface addresses */
4107                 TAILQ_FOREACH(ifa, &ifn->if_addrlist, ifa_list) {
4108                         /* correct family? */
4109                         if (ifa->ifa_addr->sa_family != sa->sa_family)
4110                                 continue;
4111
4112 #ifdef INET6
4113                         if (ifa->ifa_addr->sa_family == AF_INET6) {
4114                                 /* IPv6 address */
4115                                 struct sockaddr_in6 *sin1, *sin2, sin6_tmp;
4116
4117                                 sin1 = (struct sockaddr_in6 *)ifa->ifa_addr;
4118                                 if (IN6_IS_SCOPE_LINKLOCAL(&sin1->sin6_addr)) {
4119                                         /* create a copy and clear scope */
4120                                         memcpy(&sin6_tmp, sin1,
4121                                             sizeof(struct sockaddr_in6));
4122                                         sin1 = &sin6_tmp;
4123                                         in6_clearscope(&sin1->sin6_addr);
4124                                 }
4125                                 sin2 = (struct sockaddr_in6 *)sa;
4126                                 if (memcmp(&sin1->sin6_addr, &sin2->sin6_addr,
4127                                     sizeof(struct in6_addr)) == 0) {
4128                                         /* found it */
4129                                         return (ifa);
4130                                 }
4131                         } else
4132 #endif
4133                         if (ifa->ifa_addr->sa_family == AF_INET) {
4134                                 /* IPv4 address */
4135                                 struct sockaddr_in *sin1, *sin2;
4136
4137                                 sin1 = (struct sockaddr_in *)ifa->ifa_addr;
4138                                 sin2 = (struct sockaddr_in *)sa;
4139                                 if (sin1->sin_addr.s_addr ==
4140                                     sin2->sin_addr.s_addr) {
4141                                         /* found it */
4142                                         return (ifa);
4143                                 }
4144                         }
4145                         /* else, not AF_INET or AF_INET6, so skip */
4146                 }               /* end foreach ifa */
4147         }                       /* end foreach ifn */
4148         /* not found! */
4149         return (NULL);
4150 }
4151
4152
4153
4154
4155
4156
4157
4158
4159 static void
4160 sctp_user_rcvd(struct sctp_tcb *stcb, int *freed_so_far, int hold_rlock,
4161     uint32_t rwnd_req)
4162 {
4163         /* User pulled some data, do we need a rwnd update? */
4164         int r_unlocked = 0;
4165         uint32_t dif, rwnd;
4166         struct socket *so = NULL;
4167
4168         if (stcb == NULL)
4169                 return;
4170
4171         atomic_add_int(&stcb->asoc.refcnt, 1);
4172
4173         if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
4174                 /* Pre-check If we are freeing no update */
4175                 goto no_lock;
4176         }
4177         SCTP_INP_INCR_REF(stcb->sctp_ep);
4178         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
4179             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
4180                 goto out;
4181         }
4182         so = stcb->sctp_socket;
4183         if (so == NULL) {
4184                 goto out;
4185         }
4186         atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far);
4187         /* Have you have freed enough to look */
4188 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4189         sctp_misc_ints(SCTP_ENTER_USER_RECV,
4190             (stcb->asoc.my_rwnd - stcb->asoc.my_last_reported_rwnd),
4191             *freed_so_far,
4192             stcb->freed_by_sorcv_sincelast,
4193             rwnd_req);
4194 #endif
4195         *freed_so_far = 0;
4196         /* Yep, its worth a look and the lock overhead */
4197
4198         /* Figure out what the rwnd would be */
4199         rwnd = sctp_calc_rwnd(stcb, &stcb->asoc);
4200         if (rwnd >= stcb->asoc.my_last_reported_rwnd) {
4201                 dif = rwnd - stcb->asoc.my_last_reported_rwnd;
4202         } else {
4203                 dif = 0;
4204         }
4205         if (dif >= rwnd_req) {
4206                 if (hold_rlock) {
4207                         SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
4208                         r_unlocked = 1;
4209                 }
4210                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
4211                         /*
4212                          * One last check before we allow the guy possibly
4213                          * to get in. There is a race, where the guy has not
4214                          * reached the gate. In that case
4215                          */
4216                         goto out;
4217                 }
4218                 SCTP_TCB_LOCK(stcb);
4219                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
4220                         /* No reports here */
4221                         SCTP_TCB_UNLOCK(stcb);
4222                         goto out;
4223                 }
4224 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4225                 sctp_misc_ints(SCTP_USER_RECV_SACKS,
4226                     stcb->asoc.my_rwnd,
4227                     stcb->asoc.my_last_reported_rwnd,
4228                     stcb->freed_by_sorcv_sincelast,
4229                     dif);
4230 #endif
4231                 SCTP_STAT_INCR(sctps_wu_sacks_sent);
4232                 sctp_send_sack(stcb);
4233                 sctp_chunk_output(stcb->sctp_ep, stcb,
4234                     SCTP_OUTPUT_FROM_USR_RCVD);
4235                 /* make sure no timer is running */
4236                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL);
4237                 SCTP_TCB_UNLOCK(stcb);
4238         } else {
4239                 /* Update how much we have pending */
4240                 stcb->freed_by_sorcv_sincelast = dif;
4241 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4242                 sctp_misc_ints(SCTP_USER_RECV_SACKS,
4243                     stcb->asoc.my_rwnd,
4244                     stcb->asoc.my_last_reported_rwnd,
4245                     stcb->freed_by_sorcv_sincelast,
4246                     0);
4247 #endif
4248         }
4249 out:
4250         if (so && r_unlocked && hold_rlock) {
4251                 SCTP_STAT_INCR(sctps_locks_in_rcv);
4252                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
4253         }
4254         SCTP_INP_DECR_REF(stcb->sctp_ep);
4255 no_lock:
4256         atomic_add_int(&stcb->asoc.refcnt, -1);
4257         return;
4258 }
4259
4260 int
4261 sctp_sorecvmsg(struct socket *so,
4262     struct uio *uio,
4263     struct mbuf **mp,
4264     struct sockaddr *from,
4265     int fromlen,
4266     int *msg_flags,
4267     struct sctp_sndrcvinfo *sinfo,
4268     int filling_sinfo)
4269 {
4270         /*
4271          * MSG flags we will look at MSG_DONTWAIT - non-blocking IO.
4272          * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy
4273          * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ??
4274          * On the way out we may send out any combination of:
4275          * MSG_NOTIFICATION MSG_EOR
4276          *
4277          */
4278         struct sctp_inpcb *inp = NULL;
4279         int my_len = 0;
4280         int cp_len = 0, error = 0;
4281         struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
4282         struct mbuf *m = NULL, *embuf = NULL;
4283         struct sctp_tcb *stcb = NULL;
4284         int wakeup_read_socket = 0;
4285         int freecnt_applied = 0;
4286         int out_flags = 0, in_flags = 0;
4287         int block_allowed = 1;
4288         int freed_so_far = 0;
4289         int copied_so_far = 0;
4290         int s, in_eeor_mode = 0;
4291         int no_rcv_needed = 0;
4292         uint32_t rwnd_req = 0;
4293         int hold_sblock = 0;
4294         int hold_rlock = 0;
4295         int alen = 0, slen = 0;
4296         int held_length = 0;
4297
4298         if (msg_flags) {
4299                 in_flags = *msg_flags;
4300         } else {
4301                 in_flags = 0;
4302         }
4303         slen = uio->uio_resid;
4304         /* Pull in and set up our int flags */
4305         if (in_flags & MSG_OOB) {
4306                 /* Out of band's NOT supported */
4307                 return (EOPNOTSUPP);
4308         }
4309         if ((in_flags & MSG_PEEK) && (mp != NULL)) {
4310                 return (EINVAL);
4311         }
4312         if ((in_flags & (MSG_DONTWAIT
4313             | MSG_NBIO
4314             )) ||
4315             (so->so_state & SS_NBIO)) {
4316                 block_allowed = 0;
4317         }
4318         /* setup the endpoint */
4319         inp = (struct sctp_inpcb *)so->so_pcb;
4320         if (inp == NULL) {
4321                 return (EFAULT);
4322         }
4323         s = splnet();
4324         rwnd_req = (so->so_rcv.sb_hiwat >> SCTP_RWND_HIWAT_SHIFT);
4325         /* Must be at least a MTU's worth */
4326         if (rwnd_req < SCTP_MIN_RWND)
4327                 rwnd_req = SCTP_MIN_RWND;
4328         in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
4329 #ifdef SCTP_RECV_RWND_LOGGING
4330         sctp_misc_ints(SCTP_SORECV_ENTER,
4331             rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, uio->uio_resid);
4332 #endif
4333         SOCKBUF_LOCK(&so->so_rcv);
4334         hold_sblock = 1;
4335 #ifdef SCTP_RECV_RWND_LOGGING
4336         sctp_misc_ints(SCTP_SORECV_ENTERPL,
4337             rwnd_req, block_allowed, so->so_rcv.sb_cc, uio->uio_resid);
4338 #endif
4339
4340
4341         error = sblock(&so->so_rcv, (block_allowed ? M_WAITOK : 0));
4342         if (error) {
4343                 goto release_unlocked;
4344         }
4345 restart:
4346         if (hold_sblock == 0) {
4347                 SOCKBUF_LOCK(&so->so_rcv);
4348                 hold_sblock = 1;
4349         }
4350         sbunlock(&so->so_rcv);
4351
4352 restart_nosblocks:
4353         if (hold_sblock == 0) {
4354                 SOCKBUF_LOCK(&so->so_rcv);
4355                 hold_sblock = 1;
4356         }
4357         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
4358             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
4359                 goto out;
4360         }
4361         if (so->so_error || so->so_rcv.sb_state & SBS_CANTRCVMORE) {
4362                 if (so->so_error) {
4363                         error = so->so_error;
4364                 } else {
4365                         error = ENOTCONN;
4366                 }
4367                 goto out;
4368         }
4369         if ((so->so_rcv.sb_cc <= held_length) && block_allowed) {
4370                 /* we need to wait for data */
4371 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4372                 sctp_misc_ints(SCTP_SORECV_BLOCKSA,
4373                     0, 0, so->so_rcv.sb_cc, uio->uio_resid);
4374 #endif
4375                 if ((so->so_rcv.sb_cc == 0) &&
4376                     ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
4377                     (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) {
4378                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
4379                                 /*
4380                                  * For active open side clear flags for
4381                                  * re-use passive open is blocked by
4382                                  * connect.
4383                                  */
4384                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
4385                                         /*
4386                                          * You were aborted, passive side
4387                                          * always hits here
4388                                          */
4389                                         error = ECONNRESET;
4390                                         /*
4391                                          * You get this once if you are
4392                                          * active open side
4393                                          */
4394                                         if (!(inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
4395                                                 /*
4396                                                  * Remove flag if on the
4397                                                  * active open side
4398                                                  */
4399                                                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_WAS_ABORTED;
4400                                         }
4401                                 }
4402                                 so->so_state &= ~(SS_ISCONNECTING |
4403                                     SS_ISDISCONNECTING |
4404                                     SS_ISCONFIRMING |
4405                                     SS_ISCONNECTED);
4406                                 if (error == 0) {
4407                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
4408                                                 error = ENOTCONN;
4409                                         } else {
4410                                                 inp->sctp_flags &= ~SCTP_PCB_FLAGS_WAS_CONNECTED;
4411                                         }
4412                                 }
4413                                 goto out;
4414                         }
4415                 }
4416                 error = sbwait(&so->so_rcv);
4417                 if (error) {
4418                         goto out;
4419                 }
4420                 held_length = 0;
4421                 goto restart_nosblocks;
4422         } else if (so->so_rcv.sb_cc == 0) {
4423                 error = EWOULDBLOCK;
4424                 goto out;
4425         }
4426         error = sblock(&so->so_rcv, (block_allowed ? M_WAITOK : 0));
4427         /* we possibly have data we can read */
4428         control = TAILQ_FIRST(&inp->read_queue);
4429         if (control == NULL) {
4430                 /*
4431                  * This could be happening since the appender did the
4432                  * increment but as not yet did the tailq insert onto the
4433                  * read_queue
4434                  */
4435                 if (hold_rlock == 0) {
4436                         SCTP_INP_READ_LOCK(inp);
4437                         hold_rlock = 1;
4438                 }
4439                 control = TAILQ_FIRST(&inp->read_queue);
4440                 if ((control == NULL) && (so->so_rcv.sb_cc != 0)) {
4441 #ifdef INVARIENTS
4442                         panic("Huh, its non zero and nothing on control?");
4443 #endif
4444                         so->so_rcv.sb_cc = 0;
4445                 }
4446                 SCTP_INP_READ_UNLOCK(inp);
4447                 hold_rlock = 0;
4448                 goto restart;
4449         }
4450         if ((control->length == 0) &&
4451             (control->do_not_ref_stcb)) {
4452                 /*
4453                  * Clean up code for freeing assoc that left behind a
4454                  * pdapi.. maybe a peer in EEOR that just closed after
4455                  * sending and never indicated a EOR.
4456                  */
4457                 SCTP_STAT_INCR(sctps_locks_in_rcva);
4458                 if (hold_rlock == 0) {
4459                         hold_rlock = 1;
4460                         SCTP_INP_READ_LOCK(inp);
4461                 }
4462                 control->held_length = 0;
4463                 if (control->data) {
4464                         /* Hmm there is data here .. fix */
4465                         struct mbuf *m;
4466                         int cnt = 0;
4467
4468                         m = control->data;
4469                         while (m) {
4470                                 cnt += m->m_len;
4471                                 if (m->m_next == NULL) {
4472                                         control->tail_mbuf = m;
4473                                         m->m_flags |= M_EOR;
4474                                         control->end_added = 1;
4475                                 }
4476                                 m = m->m_next;
4477                         }
4478                         control->length = cnt;
4479                 } else {
4480                         /* remove it */
4481                         TAILQ_REMOVE(&inp->read_queue, control, next);
4482                         /* Add back any hiddend data */
4483                         sctp_free_remote_addr(control->whoFrom);
4484                         sctp_free_a_readq(stcb, control);
4485                 }
4486                 if (hold_rlock) {
4487                         hold_rlock = 0;
4488                         SCTP_INP_READ_UNLOCK(inp);
4489                 }
4490                 goto restart;
4491         }
4492         if (control->length == 0) {
4493                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) &&
4494                     (filling_sinfo)) {
4495                         /* find a more suitable one then this */
4496                         ctl = TAILQ_NEXT(control, next);
4497                         while (ctl) {
4498                                 if ((ctl->stcb != control->stcb) && (ctl->length)) {
4499                                         /* found one */
4500                                         control = ctl;
4501                                         goto found_one;
4502                                 }
4503                                 ctl = TAILQ_NEXT(ctl, next);
4504                         }
4505                 }
4506                 /*
4507                  * if we reach here, not suitable replacement is available
4508                  * <or> fragment interleave is NOT on. So stuff the sb_cc
4509                  * into the our held count, and its time to sleep again.
4510                  */
4511                 held_length = so->so_rcv.sb_cc;
4512                 control->held_length = so->so_rcv.sb_cc;
4513                 goto restart;
4514         }
4515         /* Clear the held length since there is something to read */
4516         control->held_length = 0;
4517         if (hold_rlock) {
4518                 SCTP_INP_READ_UNLOCK(inp);
4519                 hold_rlock = 0;
4520         }
4521 found_one:
4522         /*
4523          * If we reach here, control has a some data for us to read off.
4524          * Note that stcb COULD be NULL.
4525          */
4526         if (hold_sblock) {
4527                 SOCKBUF_UNLOCK(&so->so_rcv);
4528                 hold_sblock = 0;
4529         }
4530         stcb = control->stcb;
4531         if (stcb) {
4532                 if ((stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) &&
4533                     (control->do_not_ref_stcb == 0)) {
4534                         if (freecnt_applied == 0)
4535                                 stcb = NULL;
4536                 } else if (control->do_not_ref_stcb == 0) {
4537                         /* you can't free it on me please */
4538                         /*
4539                          * The lock on the socket buffer protects us so the
4540                          * free code will stop. But since we used the
4541                          * socketbuf lock and the sender uses the tcb_lock
4542                          * to increment, we need to use the atomic add to
4543                          * the refcnt
4544                          */
4545                         atomic_add_int(&stcb->asoc.refcnt, 1);
4546                         freecnt_applied = 1;
4547                         /*
4548                          * Setup to remember how much we have not yet told
4549                          * the peer our rwnd has opened up. Note we grab the
4550                          * value from the tcb from last time. Note too that
4551                          * sack sending clears this when a sack is sent..
4552                          * which is fine. Once we hit the rwnd_req, we then
4553                          * will go to the sctp_user_rcvd() that will not
4554                          * lock until it KNOWs it MUST send a WUP-SACK.
4555                          *
4556                          */
4557                         freed_so_far = stcb->freed_by_sorcv_sincelast;
4558                         stcb->freed_by_sorcv_sincelast = 0;
4559                 }
4560         }
4561         /* First lets get off the sinfo and sockaddr info */
4562         if ((sinfo) && filling_sinfo) {
4563                 memcpy(sinfo, control, sizeof(struct sctp_nonpad_sndrcvinfo));
4564                 nxt = TAILQ_NEXT(control, next);
4565                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO)) {
4566                         struct sctp_extrcvinfo *s_extra;
4567
4568                         s_extra = (struct sctp_extrcvinfo *)sinfo;
4569                         if (nxt) {
4570                                 s_extra->next_flags = SCTP_NEXT_MSG_AVAIL;
4571                                 if (nxt->sinfo_flags & SCTP_UNORDERED) {
4572                                         s_extra->next_flags |= SCTP_NEXT_MSG_IS_UNORDERED;
4573                                 }
4574                                 s_extra->next_asocid = nxt->sinfo_assoc_id;
4575                                 s_extra->next_length = nxt->length;
4576                                 s_extra->next_ppid = nxt->sinfo_ppid;
4577                                 s_extra->next_stream = nxt->sinfo_stream;
4578                                 if (nxt->tail_mbuf != NULL) {
4579                                         if (nxt->tail_mbuf->m_flags & M_EOR) {
4580                                                 s_extra->next_flags |= SCTP_NEXT_MSG_ISCOMPLETE;
4581                                         }
4582                                 }
4583                         } else {
4584                                 /*
4585                                  * we explicitly 0 this, since the memcpy
4586                                  * got some other things beyond the older
4587                                  * sinfo_ that is on the control's structure
4588                                  * :-D
4589                                  */
4590                                 s_extra->next_flags = SCTP_NO_NEXT_MSG;
4591                                 s_extra->next_asocid = 0;
4592                                 s_extra->next_length = 0;
4593                                 s_extra->next_ppid = 0;
4594                                 s_extra->next_stream = 0;
4595                         }
4596                 }
4597                 /*
4598                  * update off the real current cum-ack, if we have an stcb.
4599                  */
4600                 if (stcb)
4601                         sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
4602                 /*
4603                  * mask off the high bits, we keep the actual chunk bits in
4604                  * there.
4605                  */
4606                 sinfo->sinfo_flags &= 0x00ff;
4607         }
4608         if (fromlen && from) {
4609                 struct sockaddr *to;
4610
4611 #ifdef AF_INET
4612                 cp_len = min(fromlen, control->whoFrom->ro._l_addr.sin.sin_len);
4613                 memcpy(from, &control->whoFrom->ro._l_addr, cp_len);
4614                 ((struct sockaddr_in *)from)->sin_port = control->port_from;
4615 #else
4616                 /* No AF_INET use AF_INET6 */
4617                 cp_len = min(fromlen, control->whoFrom->ro._l_addr.sin6.sin6_len);
4618                 memcpy(from, &control->whoFrom->ro._l_addr, cp_len);
4619                 ((struct sockaddr_in6 *)from)->sin6_port = control->port_from;
4620 #endif
4621
4622                 to = from;
4623 #if defined(AF_INET) && defined(AF_INET6)
4624                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_NEEDS_MAPPED_V4) &&
4625                     (to->sa_family == AF_INET) &&
4626                     ((size_t)fromlen >= sizeof(struct sockaddr_in6))) {
4627                         struct sockaddr_in *sin;
4628                         struct sockaddr_in6 sin6;
4629
4630                         sin = (struct sockaddr_in *)to;
4631                         bzero(&sin6, sizeof(sin6));
4632                         sin6.sin6_family = AF_INET6;
4633                         sin6.sin6_len = sizeof(struct sockaddr_in6);
4634                         sin6.sin6_addr.s6_addr16[2] = 0xffff;
4635                         bcopy(&sin->sin_addr,
4636                             &sin6.sin6_addr.s6_addr16[3],
4637                             sizeof(sin6.sin6_addr.s6_addr16[3]));
4638                         sin6.sin6_port = sin->sin_port;
4639                         memcpy(from, (caddr_t)&sin6, sizeof(sin6));
4640                 }
4641 #endif
4642 #if defined(AF_INET6)
4643                 {
4644                         struct sockaddr_in6 lsa6, *to6;
4645
4646                         to6 = (struct sockaddr_in6 *)to;
4647                         sctp_recover_scope_mac(to6, (&lsa6));
4648
4649                 }
4650 #endif
4651         }
4652         /* now copy out what data we can */
4653         if (mp == NULL) {
4654                 /* copy out each mbuf in the chain up to length */
4655 get_more_data:
4656                 m = control->data;
4657                 while (m) {
4658                         /* Move out all we can */
4659                         cp_len = (int)uio->uio_resid;
4660                         my_len = (int)m->m_len;
4661                         if (cp_len > my_len) {
4662                                 /* not enough in this buf */
4663                                 cp_len = my_len;
4664                         }
4665                         if (hold_rlock) {
4666                                 SCTP_INP_READ_UNLOCK(inp);
4667                                 hold_rlock = 0;
4668                         }
4669                         splx(s);
4670                         if (cp_len > 0)
4671                                 error = uiomove(mtod(m, char *), cp_len, uio);
4672                         s = splnet();
4673 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4674                         sctp_misc_ints(SCTP_SORCV_DOESCPY,
4675                             so->so_rcv.sb_cc,
4676                             cp_len,
4677                             0,
4678                             0);
4679 #endif
4680                         /* re-read */
4681                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4682                                 goto release;
4683                         }
4684                         if (stcb &&
4685                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
4686                                 no_rcv_needed = 1;
4687                         }
4688                         if (error) {
4689                                 /* error we are out of here */
4690                                 goto release;
4691                         }
4692                         if ((m->m_next == NULL) &&
4693                             (cp_len >= m->m_len) &&
4694                             ((control->end_added == 0) ||
4695                             (control->end_added && (TAILQ_NEXT(control, next) == NULL)))
4696                             ) {
4697 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4698                                 sctp_misc_ints(SCTP_SORCV_DOESLCK,
4699                                     so->so_rcv.sb_cc,
4700                                     cp_len,
4701                                     m->m_len,
4702                                     control->length);
4703 #endif
4704                                 SCTP_STAT_INCR(sctps_locks_in_rcvb);
4705                                 SCTP_INP_READ_LOCK(inp);
4706                                 hold_rlock = 1;
4707                         }
4708                         if (cp_len == m->m_len) {
4709 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4710                                 sctp_misc_ints(SCTP_SORCV_DOESADJ,
4711                                     so->so_rcv.sb_cc,
4712                                     control->length,
4713                                     cp_len,
4714                                     0);
4715 #endif
4716                                 if (m->m_flags & M_EOR) {
4717                                         out_flags |= MSG_EOR;
4718                                 }
4719                                 if (m->m_flags & M_NOTIFICATION) {
4720                                         out_flags |= MSG_NOTIFICATION;
4721                                 }
4722                                 /* we ate up the mbuf */
4723                                 if (in_flags & MSG_PEEK) {
4724                                         /* just looking */
4725                                         m = m->m_next;
4726                                         copied_so_far += cp_len;
4727                                 } else {
4728                                         /* dispose of the mbuf */
4729 #ifdef SCTP_SB_LOGGING
4730                                         sctp_sblog(&so->so_rcv,
4731                                             control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, m->m_len);
4732 #endif
4733                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
4734 #ifdef SCTP_SB_LOGGING
4735                                         sctp_sblog(&so->so_rcv,
4736                                             control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4737 #endif
4738                                         embuf = m;
4739                                         copied_so_far += cp_len;
4740                                         freed_so_far += cp_len;
4741                                         alen = atomic_fetchadd_int(&control->length, -(cp_len));
4742                                         if (alen < cp_len) {
4743                                                 panic("Control length goes negative?");
4744                                         }
4745 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4746                                         sctp_misc_ints(SCTP_SORCV_PASSBF,
4747                                             so->so_rcv.sb_cc,
4748                                             control->length,
4749                                             0,
4750                                             0);
4751 #endif
4752                                         control->data = sctp_m_free(m);
4753                                         m = control->data;
4754                                         /*
4755                                          * been through it all, must hold sb
4756                                          * lock ok to null tail
4757                                          */
4758                                         if (control->data == NULL) {
4759 #ifdef INVARIENTS
4760                                                 if ((control->end_added == 0) ||
4761                                                     (TAILQ_NEXT(control, next) == NULL)) {
4762                                                         /*
4763                                                          * If the end is not
4764                                                          * added, OR the
4765                                                          * next is NOT null
4766                                                          * we MUST have the
4767                                                          * lock.
4768                                                          */
4769                                                         if (mtx_owned(&inp->inp_rdata_mtx) == 0) {
4770                                                                 panic("Hmm we don't own the lock?");
4771                                                         }
4772                                                 }
4773 #endif
4774                                                 control->tail_mbuf = NULL;
4775 #ifdef INVARIENTS
4776                                                 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) {
4777                                                         panic("end_added, nothing left and no MSG_EOR");
4778                                                 }
4779 #endif
4780                                         }
4781 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4782                                         sctp_misc_ints(SCTP_SORCV_ADJD,
4783                                             so->so_rcv.sb_cc,
4784                                             control->length,
4785                                             0,
4786                                             0);
4787 #endif
4788                                 }
4789                         } else {
4790                                 /* Do we need to trim the mbuf? */
4791                                 if (m->m_flags & M_NOTIFICATION) {
4792                                         out_flags |= MSG_NOTIFICATION;
4793                                 }
4794                                 if ((in_flags & MSG_PEEK) == 0) {
4795                                         if (out_flags & MSG_NOTIFICATION) {
4796                                                 /*
4797                                                  * remark this one with the
4798                                                  * notify flag, they read
4799                                                  * only part of the
4800                                                  * notification.
4801                                                  */
4802                                                 m->m_flags |= M_NOTIFICATION;
4803                                         }
4804                                         m->m_data += cp_len;
4805                                         m->m_len -= cp_len;
4806 #ifdef SCTP_SB_LOGGING
4807                                         sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, cp_len);
4808 #endif
4809                                         atomic_subtract_int(&so->so_rcv.sb_cc, cp_len);
4810                                         if (stcb) {
4811                                                 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len);
4812                                         }
4813                                         copied_so_far += cp_len;
4814                                         embuf = m;
4815                                         freed_so_far += cp_len;
4816 #ifdef SCTP_SB_LOGGING
4817                                         sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
4818                                             SCTP_LOG_SBRESULT, 0);
4819 #endif
4820                                         alen = atomic_fetchadd_int(&control->length, -(cp_len));
4821                                         if (alen < cp_len) {
4822                                                 panic("Control length goes negative2?");
4823                                         }
4824                                 } else {
4825                                         copied_so_far += cp_len;
4826                                 }
4827                         }
4828                         if ((out_flags & MSG_EOR) ||
4829                             (uio->uio_resid == 0)
4830                             ) {
4831                                 break;
4832                         }
4833                         if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
4834                             (control->do_not_ref_stcb == 0) &&
4835                             (freed_so_far >= rwnd_req)) {
4836                                 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
4837                         }
4838 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4839                         sctp_misc_ints(SCTP_SORCV_BOTWHILE,
4840                             so->so_rcv.sb_cc,
4841                             control->length,
4842                             0,
4843                             0);
4844 #endif
4845
4846                 }               /* end while(m) */
4847                 /*
4848                  * At this point we have looked at it all and we either have
4849                  * a MSG_EOR/or read all the user wants... <OR>
4850                  * control->length == 0.
4851                  */
4852                 if ((out_flags & MSG_EOR) &&
4853                     ((in_flags & MSG_PEEK) == 0)) {
4854                         /* we are done with this control */
4855                         if (control->length == 0) {
4856                                 if (control->data) {
4857 #ifdef INVARIENTS
4858                                         panic("control->data not null at read eor?");
4859 #else
4860                                         printf("Strange, data left in the control buffer .. invarients would panic?\n");
4861                                         sctp_m_freem(control->data);
4862                                         control->data = NULL;
4863 #endif
4864                                 }
4865                 done_with_control:
4866 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4867                                 sctp_misc_ints(SCTP_SORCV_FREECTL,
4868                                     so->so_rcv.sb_cc,
4869                                     0,
4870                                     0,
4871                                     0);
4872 #endif
4873                                 if (TAILQ_NEXT(control, next) == NULL) {
4874                                         /*
4875                                          * If we don't have a next we need a
4876                                          * lock, if there is a next interupt
4877                                          * is filling ahead of us and we
4878                                          * don't need a lock to remove this
4879                                          * guy (which is the head of the
4880                                          * queue).
4881                                          */
4882                                         if (hold_rlock == 0) {
4883                                                 SCTP_STAT_INCR(sctps_locks_in_rcvc);
4884                                                 SCTP_INP_READ_LOCK(inp);
4885                                                 hold_rlock = 1;
4886                                         }
4887                                 }
4888                                 TAILQ_REMOVE(&inp->read_queue, control, next);
4889                                 /* Add back any hiddend data */
4890                                 if (control->held_length) {
4891                                         held_length = 0;
4892                                         control->held_length = 0;
4893                                         wakeup_read_socket = 1;
4894                                 }
4895                                 no_rcv_needed = control->do_not_ref_stcb;
4896                                 sctp_free_remote_addr(control->whoFrom);
4897                                 control->data = NULL;
4898                                 sctp_free_a_readq(stcb, control);
4899                                 control = NULL;
4900                                 if ((freed_so_far >= rwnd_req) && (no_rcv_needed == 0))
4901                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
4902
4903                         } else {
4904                                 /*
4905                                  * The user did not read all of this
4906                                  * message, turn off the returned MSG_EOR
4907                                  * since we are leaving more behind on the
4908                                  * control to read.
4909                                  */
4910 #ifdef INVARIENTS
4911                                 if (control->end_added && (control->data == NULL) &&
4912                                     (control->tail_mbuf == NULL)) {
4913                                         panic("Gak, control->length is corrupt?");
4914                                 }
4915 #endif
4916                                 no_rcv_needed = control->do_not_ref_stcb;
4917                                 out_flags &= ~MSG_EOR;
4918                         }
4919                 }
4920                 if (out_flags & MSG_EOR) {
4921                         goto release;
4922                 }
4923                 if ((uio->uio_resid == 0) ||
4924                     ((in_eeor_mode) && (copied_so_far >= max(so->so_rcv.sb_lowat, 1)))
4925                     ) {
4926                         goto release;
4927                 }
4928                 /*
4929                  * If I hit here the receiver wants more and this message is
4930                  * NOT done (pd-api). So two questions. Can we block? if not
4931                  * we are done. Did the user NOT set MSG_WAITALL?
4932                  */
4933                 if (block_allowed == 0) {
4934                         goto release;
4935                 }
4936                 /*
4937                  * We need to wait for more data a few things: - We don't
4938                  * sbunlock() so we don't get someone else reading. - We
4939                  * must be sure to account for the case where what is added
4940                  * is NOT to our control when we wakeup.
4941                  */
4942
4943                 /*
4944                  * Do we need to tell the transport a rwnd update might be
4945                  * needed before we go to sleep?
4946                  */
4947                 if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
4948                     ((freed_so_far >= rwnd_req) &&
4949                     (control->do_not_ref_stcb == 0) &&
4950                     (no_rcv_needed == 0))) {
4951                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
4952                 }
4953 wait_some_more:
4954                 if (so->so_error || so->so_rcv.sb_state & SBS_CANTRCVMORE) {
4955                         goto release;
4956                 }
4957                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
4958                         goto release;
4959
4960                 if (hold_rlock == 1) {
4961                         SCTP_INP_READ_UNLOCK(inp);
4962                         hold_rlock = 0;
4963                 }
4964                 if (hold_sblock == 0) {
4965                         SOCKBUF_LOCK(&so->so_rcv);
4966                         hold_sblock = 1;
4967                 }
4968 #ifdef SCTP_RECV_DETAIL_RWND_LOGGING
4969                 if (stcb)
4970                         sctp_misc_ints(SCTP_SORECV_BLOCKSB,
4971                             freed_so_far,
4972                             stcb->asoc.my_rwnd,
4973                             so->so_rcv.sb_cc,
4974                             uio->uio_resid);
4975                 else
4976                         sctp_misc_ints(SCTP_SORECV_BLOCKSB,
4977                             freed_so_far,
4978                             0,
4979                             so->so_rcv.sb_cc,
4980                             uio->uio_resid);
4981 #endif
4982                 if (so->so_rcv.sb_cc <= control->held_length) {
4983                         error = sbwait(&so->so_rcv);
4984                         if (error) {
4985                                 goto release;
4986                         }
4987                         control->held_length = 0;
4988                 }
4989                 if (hold_sblock) {
4990                         SOCKBUF_UNLOCK(&so->so_rcv);
4991                         hold_sblock = 0;
4992                 }
4993                 if (control->length == 0) {
4994                         /* still nothing here */
4995                         if (control->end_added == 1) {
4996                                 /* he aborted, or is done i.e.did a shutdown */
4997                                 out_flags |= MSG_EOR;
4998                                 if (control->pdapi_aborted)
4999                                         out_flags |= MSG_TRUNC;
5000                                 goto done_with_control;
5001                         }
5002                         if (so->so_rcv.sb_cc > held_length) {
5003                                 SCTP_STAT_INCR(sctps_locks_in_rcvf);
5004                                 control->held_length = so->so_rcv.sb_cc;
5005                                 held_length = 0;
5006                         }
5007                         goto wait_some_more;
5008                 } else if (control->data == NULL) {
5009                         /*
5010                          * we must re-sync since data is probably being
5011                          * added
5012                          */
5013                         SCTP_INP_READ_LOCK(inp);
5014                         if ((control->length > 0) && (control->data == NULL)) {
5015                                 /*
5016                                  * big trouble.. we have the lock and its
5017                                  * corrupt?
5018                                  */
5019                                 panic("Impossible data==NULL length !=0");
5020                         }
5021                         SCTP_INP_READ_UNLOCK(inp);
5022                         /* We will fall around to get more data */
5023                 }
5024                 goto get_more_data;
5025         } else {
5026                 /* copy out the mbuf chain */
5027 get_more_data2:
5028                 /*
5029                  * Do we have a uio, I doubt it if so we grab the size from
5030                  * it, if not you get it all
5031                  */
5032                 if (uio)
5033                         cp_len = uio->uio_resid;
5034                 else
5035                         cp_len = control->length;
5036
5037                 if ((uint32_t) cp_len >= control->length) {
5038                         /* easy way */
5039                         if ((control->end_added == 0) ||
5040                             (TAILQ_NEXT(control, next) == NULL)) {
5041                                 /* Need to get rlock */
5042                                 if (hold_rlock == 0) {
5043                                         SCTP_INP_READ_LOCK(inp);
5044                                         hold_rlock = 1;
5045                                 }
5046                         }
5047                         if (control->tail_mbuf->m_flags & M_EOR) {
5048                                 out_flags |= MSG_EOR;
5049                         }
5050                         if (control->data->m_flags & M_NOTIFICATION) {
5051                                 out_flags |= MSG_NOTIFICATION;
5052                         }
5053                         if (uio)
5054                                 uio->uio_resid -= control->length;
5055                         *mp = control->data;
5056                         m = control->data;
5057                         while (m) {
5058 #ifdef SCTP_SB_LOGGING
5059                                 sctp_sblog(&so->so_rcv,
5060                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, m->m_len);
5061 #endif
5062                                 sctp_sbfree(control, stcb, &so->so_rcv, m);
5063                                 freed_so_far += m->m_len;
5064 #ifdef SCTP_SB_LOGGING
5065                                 sctp_sblog(&so->so_rcv,
5066                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5067 #endif
5068                                 m = m->m_next;
5069                         }
5070                         control->data = control->tail_mbuf = NULL;
5071                         control->length = 0;
5072                         if (out_flags & MSG_EOR) {
5073                                 /* Done with this control */
5074                                 goto done_with_control;
5075                         }
5076                         /* still more to do with this conntrol */
5077                         /* do we really support msg_waitall here? */
5078                         if ((block_allowed == 0) ||
5079                             ((in_flags & MSG_WAITALL) == 0)) {
5080                                 goto release;
5081                         }
5082         wait_some_more2:
5083                         if (so->so_error || so->so_rcv.sb_state & SBS_CANTRCVMORE)
5084                                 goto release;
5085                         if (hold_rlock == 1) {
5086                                 SCTP_INP_READ_UNLOCK(inp);
5087                                 hold_rlock = 0;
5088                         }
5089                         if (hold_sblock == 0) {
5090                                 SOCKBUF_LOCK(&so->so_rcv);
5091                                 hold_sblock = 1;
5092                         }
5093                         if (so->so_rcv.sb_cc <= control->held_length) {
5094                                 error = sbwait(&so->so_rcv);
5095                                 if (error) {
5096                                         goto release;
5097                                 }
5098                         }
5099                         if (hold_sblock) {
5100                                 SOCKBUF_UNLOCK(&so->so_rcv);
5101                                 hold_sblock = 0;
5102                         }
5103                         if (control->length == 0) {
5104                                 /* still nothing here */
5105                                 if (control->end_added == 1) {
5106                                         /*
5107                                          * he aborted, or is done i.e.
5108                                          * shutdown
5109                                          */
5110                                         out_flags |= MSG_EOR;
5111                                         if (control->pdapi_aborted)
5112                                                 out_flags |= MSG_TRUNC;
5113                                         goto done_with_control;
5114                                 }
5115                                 if (so->so_rcv.sb_cc > held_length) {
5116                                         control->held_length = so->so_rcv.sb_cc;
5117                                         /*
5118                                          * We don't use held_length while
5119                                          * getting a message
5120                                          */
5121                                         held_length = 0;
5122                                 }
5123                                 goto wait_some_more2;
5124                         }
5125                         goto get_more_data2;
5126                 } else {
5127                         /* hard way mbuf by mbuf */
5128                         m = control->data;
5129                         if (control->end_added == 0) {
5130                                 /* need the rlock */
5131                                 if (hold_rlock == 0) {
5132                                         SCTP_INP_READ_LOCK(inp);
5133                                         hold_rlock = 1;
5134                                 }
5135                         }
5136                         if (m->m_flags & M_NOTIFICATION) {
5137                                 out_flags |= MSG_NOTIFICATION;
5138                         }
5139                         while ((m) && (cp_len > 0)) {
5140                                 if (cp_len >= m->m_len) {
5141                                         *mp = m;
5142                                         atomic_subtract_int(&control->length, m->m_len);
5143                                         if (uio)
5144                                                 uio->uio_resid -= m->m_len;
5145                                         cp_len -= m->m_len;
5146                                         control->data = m->m_next;
5147                                         m->m_next = NULL;
5148 #ifdef SCTP_SB_LOGGING
5149                                         sctp_sblog(&so->so_rcv,
5150                                             control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, m->m_len);
5151 #endif
5152                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
5153                                         freed_so_far += m->m_len;
5154 #ifdef SCTP_SB_LOGGING
5155                                         sctp_sblog(&so->so_rcv,
5156                                             control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5157 #endif
5158                                         mp = &m->m_next;
5159                                         m = control->data;
5160                                 } else {
5161                                         /*
5162                                          * got all he wants and its part of
5163                                          * this mbuf only.
5164                                          */
5165                                         if (uio)
5166                                                 uio->uio_resid -= m->m_len;
5167                                         cp_len -= m->m_len;
5168                                         if (hold_rlock) {
5169                                                 SCTP_INP_READ_UNLOCK(inp);
5170                                                 hold_rlock = 0;
5171                                         }
5172                                         if (hold_sblock) {
5173                                                 SOCKBUF_UNLOCK(&so->so_rcv);
5174                                                 hold_sblock = 0;
5175                                         }
5176                                         splx(s);
5177                                         *mp = sctp_m_copym(m, 0, cp_len,
5178                                             M_TRYWAIT
5179                                             );
5180                                         s = splnet();
5181 #ifdef SCTP_LOCK_LOGGING
5182                                         sctp_log_lock(inp, stcb, SCTP_LOG_LOCK_SOCKBUF_R);
5183 #endif
5184                                         if (hold_sblock == 0) {
5185                                                 SOCKBUF_LOCK(&so->so_rcv);
5186                                                 hold_sblock = 1;
5187                                         }
5188                                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
5189                                                 goto release;
5190
5191                                         if (stcb &&
5192                                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5193                                                 no_rcv_needed = 1;
5194                                         }
5195                                         m->m_data += cp_len;
5196                                         m->m_len -= cp_len;
5197 #ifdef SCTP_SB_LOGGING
5198                                         sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, cp_len);
5199 #endif
5200                                         freed_so_far += cp_len;
5201                                         atomic_subtract_int(&so->so_rcv.sb_cc, cp_len);
5202                                         if (stcb) {
5203                                                 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len);
5204                                                 if ((freed_so_far >= rwnd_req) &&
5205                                                     (control->do_not_ref_stcb == 0) &&
5206                                                     (no_rcv_needed == 0))
5207                                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5208                                         }
5209 #ifdef SCTP_SB_LOGGING
5210                                         sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
5211                                             SCTP_LOG_SBRESULT, 0);
5212 #endif
5213                                         if (out_flags & MSG_NOTIFICATION) {
5214                                                 /*
5215                                                  * remark the first mbuf if
5216                                                  * they took a partial read.
5217                                                  */
5218                                                 control->data->m_flags |= M_NOTIFICATION;
5219                                         }
5220                                         goto release;
5221                                 }
5222                         }
5223                 }
5224         }
5225 release:
5226         if (hold_rlock == 1) {
5227                 SCTP_INP_READ_UNLOCK(inp);
5228                 hold_rlock = 0;
5229         }
5230         if (hold_sblock == 0) {
5231                 SOCKBUF_LOCK(&so->so_rcv);
5232                 hold_sblock = 1;
5233         }
5234         sbunlock(&so->so_rcv);
5235
5236 release_unlocked:
5237         if (hold_sblock) {
5238                 SOCKBUF_UNLOCK(&so->so_rcv);
5239                 hold_sblock = 0;
5240         }
5241         if ((stcb) && (in_flags & MSG_PEEK) == 0) {
5242                 if ((freed_so_far >= rwnd_req) &&
5243                     (control && (control->do_not_ref_stcb == 0)) &&
5244                     (no_rcv_needed == 0))
5245                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5246         }
5247         if (msg_flags)
5248                 *msg_flags |= out_flags;
5249 out:
5250         if (hold_rlock == 1) {
5251                 SCTP_INP_READ_UNLOCK(inp);
5252                 hold_rlock = 0;
5253         }
5254         if (hold_sblock) {
5255                 SOCKBUF_UNLOCK(&so->so_rcv);
5256                 hold_sblock = 0;
5257         }
5258         if (freecnt_applied) {
5259                 /*
5260                  * The lock on the socket buffer protects us so the free
5261                  * code will stop. But since we used the socketbuf lock and
5262                  * the sender uses the tcb_lock to increment, we need to use
5263                  * the atomic add to the refcnt.
5264                  */
5265                 if (stcb == NULL) {
5266                         panic("stcb for refcnt has gone NULL?");
5267                 }
5268                 atomic_add_int(&stcb->asoc.refcnt, -1);
5269                 freecnt_applied = 0;
5270                 /* Save the value back for next time */
5271                 stcb->freed_by_sorcv_sincelast = freed_so_far;
5272         }
5273         splx(s);
5274 #ifdef SCTP_RECV_RWND_LOGGING
5275         if (stcb) {
5276                 sctp_misc_ints(SCTP_SORECV_DONE,
5277                     freed_so_far,
5278                     ((uio) ? (slen - uio->uio_resid) : slen),
5279                     stcb->asoc.my_rwnd,
5280                     so->so_rcv.sb_cc);
5281         } else {
5282                 sctp_misc_ints(SCTP_SORECV_DONE,
5283                     freed_so_far,
5284                     ((uio) ? (slen - uio->uio_resid) : slen),
5285                     0,
5286                     so->so_rcv.sb_cc);
5287         }
5288 #endif
5289         if (wakeup_read_socket) {
5290                 sctp_sorwakeup(inp, so);
5291         }
5292         return (error);
5293 }
5294
5295
5296 #ifdef SCTP_MBUF_LOGGING
5297 struct mbuf *
5298 sctp_m_free(struct mbuf *m)
5299 {
5300         if (m->m_flags & M_EXT) {
5301                 sctp_log_mb(m, SCTP_MBUF_IFREE);
5302         }
5303         return (m_free(m));
5304 }
5305
5306 void
5307 sctp_m_freem(struct mbuf *mb)
5308 {
5309         while (mb != NULL)
5310                 mb = sctp_m_free(mb);
5311 }
5312
5313 #endif
5314
5315
5316 int
5317 sctp_soreceive(so, psa, uio, mp0, controlp, flagsp)
5318         struct socket *so;
5319         struct sockaddr **psa;
5320         struct uio *uio;
5321         struct mbuf **mp0;
5322         struct mbuf **controlp;
5323         int *flagsp;
5324 {
5325         int error, fromlen;
5326         uint8_t sockbuf[256];
5327         struct sockaddr *from;
5328         struct sctp_extrcvinfo sinfo;
5329         int filling_sinfo = 1;
5330         struct sctp_inpcb *inp;
5331
5332         inp = (struct sctp_inpcb *)so->so_pcb;
5333         /* pickup the assoc we are reading from */
5334         if (inp == NULL) {
5335                 return (EINVAL);
5336         }
5337         if ((sctp_is_feature_off(inp,
5338             SCTP_PCB_FLAGS_RECVDATAIOEVNT)) ||
5339             (controlp == NULL)) {
5340                 /* user does not want the sndrcv ctl */
5341                 filling_sinfo = 0;
5342         }
5343         if (psa) {
5344                 from = (struct sockaddr *)sockbuf;
5345                 fromlen = sizeof(sockbuf);
5346                 from->sa_len = 0;
5347         } else {
5348                 from = NULL;
5349                 fromlen = 0;
5350         }
5351
5352         error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, flagsp,
5353             (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo);
5354         if ((controlp) && (filling_sinfo)) {
5355                 /* copy back the sinfo in a CMSG format */
5356                 if (filling_sinfo)
5357                         *controlp = sctp_build_ctl_nchunk(inp,
5358                             (struct sctp_sndrcvinfo *)&sinfo);
5359                 else
5360                         *controlp = NULL;
5361         }
5362         if (psa) {
5363                 /* copy back the address info */
5364                 if (from && from->sa_len) {
5365                         *psa = sodupsockaddr(from, M_NOWAIT);
5366                 } else {
5367                         *psa = NULL;
5368                 }
5369         }
5370         return (error);
5371 }