sys/netinet/sctputil.c

   1 /*-
   2  * Copyright (c) 2001-2008, by Cisco Systems, Inc. All rights reserved.
   3  * Copyright (c) 2008-2011, by Randall Stewart. All rights reserved.
   4  * Copyright (c) 2008-2011, by Michael Tuexen. All rights reserved.
   5  *
   6  * Redistribution and use in source and binary forms, with or without
   7  * modification, are permitted provided that the following conditions are met:
   8  *
   9  * a) Redistributions of source code must retain the above copyright notice,
  10  *    this list of conditions and the following disclaimer.
  11  *
  12  * b) Redistributions in binary form must reproduce the above copyright
  13  *    notice, this list of conditions and the following disclaimer in
  14  *    the documentation and/or other materials provided with the distribution.
  15  *
  16  * c) Neither the name of Cisco Systems, Inc. nor the names of its
  17  *    contributors may be used to endorse or promote products derived
  18  *    from this software without specific prior written permission.
  19  *
  20  * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
  21  * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO,
  22  * THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23  * ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE
  24  * LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
  25  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
  26  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  27  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  28  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  29  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF
  30  * THE POSSIBILITY OF SUCH DAMAGE.
  31  */
  32
  33 /* $KAME: sctputil.c,v 1.37 2005/03/07 23:26:09 itojun Exp $     */
  34
  35 #include <sys/cdefs.h>
  36 __FBSDID("$FreeBSD$");
  37
  38 #include <netinet/sctp_os.h>
  39 #include <netinet/sctp_pcb.h>
  40 #include <netinet/sctputil.h>
  41 #include <netinet/sctp_var.h>
  42 #include <netinet/sctp_sysctl.h>
  43 #ifdef INET6
  44 #endif
  45 #include <netinet/sctp_header.h>
  46 #include <netinet/sctp_output.h>
  47 #include <netinet/sctp_uio.h>
  48 #include <netinet/sctp_timer.h>
  49 #include <netinet/sctp_indata.h>/* for sctp_deliver_data() */
  50 #include <netinet/sctp_auth.h>
  51 #include <netinet/sctp_asconf.h>
  52 #include <netinet/sctp_bsd_addr.h>
  53
  54
  55 #ifndef KTR_SCTP
  56 #define KTR_SCTP KTR_SUBSYS
  57 #endif
  58
  59 extern struct sctp_cc_functions sctp_cc_functions[];
  60 extern struct sctp_ss_functions sctp_ss_functions[];
  61
  62 void
  63 sctp_sblog(struct sockbuf *sb,
  64     struct sctp_tcb *stcb, int from, int incr)
  65 {
  66         struct sctp_cwnd_log sctp_clog;
  67
  68         sctp_clog.x.sb.stcb = stcb;
  69         sctp_clog.x.sb.so_sbcc = sb->sb_cc;
  70         if (stcb)
  71                 sctp_clog.x.sb.stcb_sbcc = stcb->asoc.sb_cc;
  72         else
  73                 sctp_clog.x.sb.stcb_sbcc = 0;
  74         sctp_clog.x.sb.incr = incr;
  75         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
  76             SCTP_LOG_EVENT_SB,
  77             from,
  78             sctp_clog.x.misc.log1,
  79             sctp_clog.x.misc.log2,
  80             sctp_clog.x.misc.log3,
  81             sctp_clog.x.misc.log4);
  82 }
  83
  84 void
  85 sctp_log_closing(struct sctp_inpcb *inp, struct sctp_tcb *stcb, int16_t loc)
  86 {
  87         struct sctp_cwnd_log sctp_clog;
  88
  89         sctp_clog.x.close.inp = (void *)inp;
  90         sctp_clog.x.close.sctp_flags = inp->sctp_flags;
  91         if (stcb) {
  92                 sctp_clog.x.close.stcb = (void *)stcb;
  93                 sctp_clog.x.close.state = (uint16_t) stcb->asoc.state;
  94         } else {
  95                 sctp_clog.x.close.stcb = 0;
  96                 sctp_clog.x.close.state = 0;
  97         }
  98         sctp_clog.x.close.loc = loc;
  99         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 100             SCTP_LOG_EVENT_CLOSE,
 101             0,
 102             sctp_clog.x.misc.log1,
 103             sctp_clog.x.misc.log2,
 104             sctp_clog.x.misc.log3,
 105             sctp_clog.x.misc.log4);
 106 }
 107
 108
 109 void
 110 rto_logging(struct sctp_nets *net, int from)
 111 {
 112         struct sctp_cwnd_log sctp_clog;
 113
 114         memset(&sctp_clog, 0, sizeof(sctp_clog));
 115         sctp_clog.x.rto.net = (void *)net;
 116         sctp_clog.x.rto.rtt = net->rtt / 1000;
 117         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 118             SCTP_LOG_EVENT_RTT,
 119             from,
 120             sctp_clog.x.misc.log1,
 121             sctp_clog.x.misc.log2,
 122             sctp_clog.x.misc.log3,
 123             sctp_clog.x.misc.log4);
 124 }
 125
 126 void
 127 sctp_log_strm_del_alt(struct sctp_tcb *stcb, uint32_t tsn, uint16_t sseq, uint16_t stream, int from)
 128 {
 129         struct sctp_cwnd_log sctp_clog;
 130
 131         sctp_clog.x.strlog.stcb = stcb;
 132         sctp_clog.x.strlog.n_tsn = tsn;
 133         sctp_clog.x.strlog.n_sseq = sseq;
 134         sctp_clog.x.strlog.e_tsn = 0;
 135         sctp_clog.x.strlog.e_sseq = 0;
 136         sctp_clog.x.strlog.strm = stream;
 137         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 138             SCTP_LOG_EVENT_STRM,
 139             from,
 140             sctp_clog.x.misc.log1,
 141             sctp_clog.x.misc.log2,
 142             sctp_clog.x.misc.log3,
 143             sctp_clog.x.misc.log4);
 144 }
 145
 146 void
 147 sctp_log_nagle_event(struct sctp_tcb *stcb, int action)
 148 {
 149         struct sctp_cwnd_log sctp_clog;
 150
 151         sctp_clog.x.nagle.stcb = (void *)stcb;
 152         sctp_clog.x.nagle.total_flight = stcb->asoc.total_flight;
 153         sctp_clog.x.nagle.total_in_queue = stcb->asoc.total_output_queue_size;
 154         sctp_clog.x.nagle.count_in_queue = stcb->asoc.chunks_on_out_queue;
 155         sctp_clog.x.nagle.count_in_flight = stcb->asoc.total_flight_count;
 156         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 157             SCTP_LOG_EVENT_NAGLE,
 158             action,
 159             sctp_clog.x.misc.log1,
 160             sctp_clog.x.misc.log2,
 161             sctp_clog.x.misc.log3,
 162             sctp_clog.x.misc.log4);
 163 }
 164
 165 void
 166 sctp_log_sack(uint32_t old_cumack, uint32_t cumack, uint32_t tsn, uint16_t gaps, uint16_t dups, int from)
 167 {
 168         struct sctp_cwnd_log sctp_clog;
 169
 170         sctp_clog.x.sack.cumack = cumack;
 171         sctp_clog.x.sack.oldcumack = old_cumack;
 172         sctp_clog.x.sack.tsn = tsn;
 173         sctp_clog.x.sack.numGaps = gaps;
 174         sctp_clog.x.sack.numDups = dups;
 175         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 176             SCTP_LOG_EVENT_SACK,
 177             from,
 178             sctp_clog.x.misc.log1,
 179             sctp_clog.x.misc.log2,
 180             sctp_clog.x.misc.log3,
 181             sctp_clog.x.misc.log4);
 182 }
 183
 184 void
 185 sctp_log_map(uint32_t map, uint32_t cum, uint32_t high, int from)
 186 {
 187         struct sctp_cwnd_log sctp_clog;
 188
 189         memset(&sctp_clog, 0, sizeof(sctp_clog));
 190         sctp_clog.x.map.base = map;
 191         sctp_clog.x.map.cum = cum;
 192         sctp_clog.x.map.high = high;
 193         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 194             SCTP_LOG_EVENT_MAP,
 195             from,
 196             sctp_clog.x.misc.log1,
 197             sctp_clog.x.misc.log2,
 198             sctp_clog.x.misc.log3,
 199             sctp_clog.x.misc.log4);
 200 }
 201
 202 void
 203 sctp_log_fr(uint32_t biggest_tsn, uint32_t biggest_new_tsn, uint32_t tsn,
 204     int from)
 205 {
 206         struct sctp_cwnd_log sctp_clog;
 207
 208         memset(&sctp_clog, 0, sizeof(sctp_clog));
 209         sctp_clog.x.fr.largest_tsn = biggest_tsn;
 210         sctp_clog.x.fr.largest_new_tsn = biggest_new_tsn;
 211         sctp_clog.x.fr.tsn = tsn;
 212         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 213             SCTP_LOG_EVENT_FR,
 214             from,
 215             sctp_clog.x.misc.log1,
 216             sctp_clog.x.misc.log2,
 217             sctp_clog.x.misc.log3,
 218             sctp_clog.x.misc.log4);
 219 }
 220
 221 void
 222 sctp_log_mb(struct mbuf *m, int from)
 223 {
 224         struct sctp_cwnd_log sctp_clog;
 225
 226         sctp_clog.x.mb.mp = m;
 227         sctp_clog.x.mb.mbuf_flags = (uint8_t) (SCTP_BUF_GET_FLAGS(m));
 228         sctp_clog.x.mb.size = (uint16_t) (SCTP_BUF_LEN(m));
 229         sctp_clog.x.mb.data = SCTP_BUF_AT(m, 0);
 230         if (SCTP_BUF_IS_EXTENDED(m)) {
 231                 sctp_clog.x.mb.ext = SCTP_BUF_EXTEND_BASE(m);
 232                 sctp_clog.x.mb.refcnt = (uint8_t) (SCTP_BUF_EXTEND_REFCNT(m));
 233         } else {
 234                 sctp_clog.x.mb.ext = 0;
 235                 sctp_clog.x.mb.refcnt = 0;
 236         }
 237         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 238             SCTP_LOG_EVENT_MBUF,
 239             from,
 240             sctp_clog.x.misc.log1,
 241             sctp_clog.x.misc.log2,
 242             sctp_clog.x.misc.log3,
 243             sctp_clog.x.misc.log4);
 244 }
 245
 246 void
 247 sctp_log_strm_del(struct sctp_queued_to_read *control, struct sctp_queued_to_read *poschk,
 248     int from)
 249 {
 250         struct sctp_cwnd_log sctp_clog;
 251
 252         if (control == NULL) {
 253                 SCTP_PRINTF("Gak log of NULL?\n");
 254                 return;
 255         }
 256         sctp_clog.x.strlog.stcb = control->stcb;
 257         sctp_clog.x.strlog.n_tsn = control->sinfo_tsn;
 258         sctp_clog.x.strlog.n_sseq = control->sinfo_ssn;
 259         sctp_clog.x.strlog.strm = control->sinfo_stream;
 260         if (poschk != NULL) {
 261                 sctp_clog.x.strlog.e_tsn = poschk->sinfo_tsn;
 262                 sctp_clog.x.strlog.e_sseq = poschk->sinfo_ssn;
 263         } else {
 264                 sctp_clog.x.strlog.e_tsn = 0;
 265                 sctp_clog.x.strlog.e_sseq = 0;
 266         }
 267         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 268             SCTP_LOG_EVENT_STRM,
 269             from,
 270             sctp_clog.x.misc.log1,
 271             sctp_clog.x.misc.log2,
 272             sctp_clog.x.misc.log3,
 273             sctp_clog.x.misc.log4);
 274 }
 275
 276 void
 277 sctp_log_cwnd(struct sctp_tcb *stcb, struct sctp_nets *net, int augment, uint8_t from)
 278 {
 279         struct sctp_cwnd_log sctp_clog;
 280
 281         sctp_clog.x.cwnd.net = net;
 282         if (stcb->asoc.send_queue_cnt > 255)
 283                 sctp_clog.x.cwnd.cnt_in_send = 255;
 284         else
 285                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 286         if (stcb->asoc.stream_queue_cnt > 255)
 287                 sctp_clog.x.cwnd.cnt_in_str = 255;
 288         else
 289                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 290
 291         if (net) {
 292                 sctp_clog.x.cwnd.cwnd_new_value = net->cwnd;
 293                 sctp_clog.x.cwnd.inflight = net->flight_size;
 294                 sctp_clog.x.cwnd.pseudo_cumack = net->pseudo_cumack;
 295                 sctp_clog.x.cwnd.meets_pseudo_cumack = net->new_pseudo_cumack;
 296                 sctp_clog.x.cwnd.need_new_pseudo_cumack = net->find_pseudo_cumack;
 297         }
 298         if (SCTP_CWNDLOG_PRESEND == from) {
 299                 sctp_clog.x.cwnd.meets_pseudo_cumack = stcb->asoc.peers_rwnd;
 300         }
 301         sctp_clog.x.cwnd.cwnd_augment = augment;
 302         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 303             SCTP_LOG_EVENT_CWND,
 304             from,
 305             sctp_clog.x.misc.log1,
 306             sctp_clog.x.misc.log2,
 307             sctp_clog.x.misc.log3,
 308             sctp_clog.x.misc.log4);
 309 }
 310
 311 void
 312 sctp_log_lock(struct sctp_inpcb *inp, struct sctp_tcb *stcb, uint8_t from)
 313 {
 314         struct sctp_cwnd_log sctp_clog;
 315
 316         memset(&sctp_clog, 0, sizeof(sctp_clog));
 317         if (inp) {
 318                 sctp_clog.x.lock.sock = (void *)inp->sctp_socket;
 319
 320         } else {
 321                 sctp_clog.x.lock.sock = (void *)NULL;
 322         }
 323         sctp_clog.x.lock.inp = (void *)inp;
 324         if (stcb) {
 325                 sctp_clog.x.lock.tcb_lock = mtx_owned(&stcb->tcb_mtx);
 326         } else {
 327                 sctp_clog.x.lock.tcb_lock = SCTP_LOCK_UNKNOWN;
 328         }
 329         if (inp) {
 330                 sctp_clog.x.lock.inp_lock = mtx_owned(&inp->inp_mtx);
 331                 sctp_clog.x.lock.create_lock = mtx_owned(&inp->inp_create_mtx);
 332         } else {
 333                 sctp_clog.x.lock.inp_lock = SCTP_LOCK_UNKNOWN;
 334                 sctp_clog.x.lock.create_lock = SCTP_LOCK_UNKNOWN;
 335         }
 336         sctp_clog.x.lock.info_lock = rw_wowned(&SCTP_BASE_INFO(ipi_ep_mtx));
 337         if (inp && (inp->sctp_socket)) {
 338                 sctp_clog.x.lock.sock_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 339                 sctp_clog.x.lock.sockrcvbuf_lock = mtx_owned(&(inp->sctp_socket->so_rcv.sb_mtx));
 340                 sctp_clog.x.lock.socksndbuf_lock = mtx_owned(&(inp->sctp_socket->so_snd.sb_mtx));
 341         } else {
 342                 sctp_clog.x.lock.sock_lock = SCTP_LOCK_UNKNOWN;
 343                 sctp_clog.x.lock.sockrcvbuf_lock = SCTP_LOCK_UNKNOWN;
 344                 sctp_clog.x.lock.socksndbuf_lock = SCTP_LOCK_UNKNOWN;
 345         }
 346         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 347             SCTP_LOG_LOCK_EVENT,
 348             from,
 349             sctp_clog.x.misc.log1,
 350             sctp_clog.x.misc.log2,
 351             sctp_clog.x.misc.log3,
 352             sctp_clog.x.misc.log4);
 353 }
 354
 355 void
 356 sctp_log_maxburst(struct sctp_tcb *stcb, struct sctp_nets *net, int error, int burst, uint8_t from)
 357 {
 358         struct sctp_cwnd_log sctp_clog;
 359
 360         memset(&sctp_clog, 0, sizeof(sctp_clog));
 361         sctp_clog.x.cwnd.net = net;
 362         sctp_clog.x.cwnd.cwnd_new_value = error;
 363         sctp_clog.x.cwnd.inflight = net->flight_size;
 364         sctp_clog.x.cwnd.cwnd_augment = burst;
 365         if (stcb->asoc.send_queue_cnt > 255)
 366                 sctp_clog.x.cwnd.cnt_in_send = 255;
 367         else
 368                 sctp_clog.x.cwnd.cnt_in_send = stcb->asoc.send_queue_cnt;
 369         if (stcb->asoc.stream_queue_cnt > 255)
 370                 sctp_clog.x.cwnd.cnt_in_str = 255;
 371         else
 372                 sctp_clog.x.cwnd.cnt_in_str = stcb->asoc.stream_queue_cnt;
 373         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 374             SCTP_LOG_EVENT_MAXBURST,
 375             from,
 376             sctp_clog.x.misc.log1,
 377             sctp_clog.x.misc.log2,
 378             sctp_clog.x.misc.log3,
 379             sctp_clog.x.misc.log4);
 380 }
 381
 382 void
 383 sctp_log_rwnd(uint8_t from, uint32_t peers_rwnd, uint32_t snd_size, uint32_t overhead)
 384 {
 385         struct sctp_cwnd_log sctp_clog;
 386
 387         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 388         sctp_clog.x.rwnd.send_size = snd_size;
 389         sctp_clog.x.rwnd.overhead = overhead;
 390         sctp_clog.x.rwnd.new_rwnd = 0;
 391         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 392             SCTP_LOG_EVENT_RWND,
 393             from,
 394             sctp_clog.x.misc.log1,
 395             sctp_clog.x.misc.log2,
 396             sctp_clog.x.misc.log3,
 397             sctp_clog.x.misc.log4);
 398 }
 399
 400 void
 401 sctp_log_rwnd_set(uint8_t from, uint32_t peers_rwnd, uint32_t flight_size, uint32_t overhead, uint32_t a_rwndval)
 402 {
 403         struct sctp_cwnd_log sctp_clog;
 404
 405         sctp_clog.x.rwnd.rwnd = peers_rwnd;
 406         sctp_clog.x.rwnd.send_size = flight_size;
 407         sctp_clog.x.rwnd.overhead = overhead;
 408         sctp_clog.x.rwnd.new_rwnd = a_rwndval;
 409         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 410             SCTP_LOG_EVENT_RWND,
 411             from,
 412             sctp_clog.x.misc.log1,
 413             sctp_clog.x.misc.log2,
 414             sctp_clog.x.misc.log3,
 415             sctp_clog.x.misc.log4);
 416 }
 417
 418 void
 419 sctp_log_mbcnt(uint8_t from, uint32_t total_oq, uint32_t book, uint32_t total_mbcnt_q, uint32_t mbcnt)
 420 {
 421         struct sctp_cwnd_log sctp_clog;
 422
 423         sctp_clog.x.mbcnt.total_queue_size = total_oq;
 424         sctp_clog.x.mbcnt.size_change = book;
 425         sctp_clog.x.mbcnt.total_queue_mb_size = total_mbcnt_q;
 426         sctp_clog.x.mbcnt.mbcnt_change = mbcnt;
 427         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 428             SCTP_LOG_EVENT_MBCNT,
 429             from,
 430             sctp_clog.x.misc.log1,
 431             sctp_clog.x.misc.log2,
 432             sctp_clog.x.misc.log3,
 433             sctp_clog.x.misc.log4);
 434 }
 435
 436 void
 437 sctp_misc_ints(uint8_t from, uint32_t a, uint32_t b, uint32_t c, uint32_t d)
 438 {
 439         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 440             SCTP_LOG_MISC_EVENT,
 441             from,
 442             a, b, c, d);
 443 }
 444
 445 void
 446 sctp_wakeup_log(struct sctp_tcb *stcb, uint32_t wake_cnt, int from)
 447 {
 448         struct sctp_cwnd_log sctp_clog;
 449
 450         sctp_clog.x.wake.stcb = (void *)stcb;
 451         sctp_clog.x.wake.wake_cnt = wake_cnt;
 452         sctp_clog.x.wake.flight = stcb->asoc.total_flight_count;
 453         sctp_clog.x.wake.send_q = stcb->asoc.send_queue_cnt;
 454         sctp_clog.x.wake.sent_q = stcb->asoc.sent_queue_cnt;
 455
 456         if (stcb->asoc.stream_queue_cnt < 0xff)
 457                 sctp_clog.x.wake.stream_qcnt = (uint8_t) stcb->asoc.stream_queue_cnt;
 458         else
 459                 sctp_clog.x.wake.stream_qcnt = 0xff;
 460
 461         if (stcb->asoc.chunks_on_out_queue < 0xff)
 462                 sctp_clog.x.wake.chunks_on_oque = (uint8_t) stcb->asoc.chunks_on_out_queue;
 463         else
 464                 sctp_clog.x.wake.chunks_on_oque = 0xff;
 465
 466         sctp_clog.x.wake.sctpflags = 0;
 467         /* set in the defered mode stuff */
 468         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_DONT_WAKE)
 469                 sctp_clog.x.wake.sctpflags |= 1;
 470         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEOUTPUT)
 471                 sctp_clog.x.wake.sctpflags |= 2;
 472         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_WAKEINPUT)
 473                 sctp_clog.x.wake.sctpflags |= 4;
 474         /* what about the sb */
 475         if (stcb->sctp_socket) {
 476                 struct socket *so = stcb->sctp_socket;
 477
 478                 sctp_clog.x.wake.sbflags = (uint8_t) ((so->so_snd.sb_flags & 0x00ff));
 479         } else {
 480                 sctp_clog.x.wake.sbflags = 0xff;
 481         }
 482         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 483             SCTP_LOG_EVENT_WAKE,
 484             from,
 485             sctp_clog.x.misc.log1,
 486             sctp_clog.x.misc.log2,
 487             sctp_clog.x.misc.log3,
 488             sctp_clog.x.misc.log4);
 489 }
 490
 491 void
 492 sctp_log_block(uint8_t from, struct sctp_association *asoc, int sendlen)
 493 {
 494         struct sctp_cwnd_log sctp_clog;
 495
 496         sctp_clog.x.blk.onsb = asoc->total_output_queue_size;
 497         sctp_clog.x.blk.send_sent_qcnt = (uint16_t) (asoc->send_queue_cnt + asoc->sent_queue_cnt);
 498         sctp_clog.x.blk.peer_rwnd = asoc->peers_rwnd;
 499         sctp_clog.x.blk.stream_qcnt = (uint16_t) asoc->stream_queue_cnt;
 500         sctp_clog.x.blk.chunks_on_oque = (uint16_t) asoc->chunks_on_out_queue;
 501         sctp_clog.x.blk.flight_size = (uint16_t) (asoc->total_flight / 1024);
 502         sctp_clog.x.blk.sndlen = sendlen;
 503         SCTP_CTR6(KTR_SCTP, "SCTP:%d[%d]:%x-%x-%x-%x",
 504             SCTP_LOG_EVENT_BLOCK,
 505             from,
 506             sctp_clog.x.misc.log1,
 507             sctp_clog.x.misc.log2,
 508             sctp_clog.x.misc.log3,
 509             sctp_clog.x.misc.log4);
 510 }
 511
 512 int
 513 sctp_fill_stat_log(void *optval SCTP_UNUSED, size_t *optsize SCTP_UNUSED)
 514 {
 515         /* May need to fix this if ktrdump does not work */
 516         return (0);
 517 }
 518
 519 #ifdef SCTP_AUDITING_ENABLED
 520 uint8_t sctp_audit_data[SCTP_AUDIT_SIZE][2];
 521 static int sctp_audit_indx = 0;
 522
 523 static
 524 void
 525 sctp_print_audit_report(void)
 526 {
 527         int i;
 528         int cnt;
 529
 530         cnt = 0;
 531         for (i = sctp_audit_indx; i < SCTP_AUDIT_SIZE; i++) {
 532                 if ((sctp_audit_data[i][0] == 0xe0) &&
 533                     (sctp_audit_data[i][1] == 0x01)) {
 534                         cnt = 0;
 535                         SCTP_PRINTF("\n");
 536                 } else if (sctp_audit_data[i][0] == 0xf0) {
 537                         cnt = 0;
 538                         SCTP_PRINTF("\n");
 539                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 540                     (sctp_audit_data[i][1] == 0x01)) {
 541                         SCTP_PRINTF("\n");
 542                         cnt = 0;
 543                 }
 544                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0],
 545                     (uint32_t) sctp_audit_data[i][1]);
 546                 cnt++;
 547                 if ((cnt % 14) == 0)
 548                         SCTP_PRINTF("\n");
 549         }
 550         for (i = 0; i < sctp_audit_indx; i++) {
 551                 if ((sctp_audit_data[i][0] == 0xe0) &&
 552                     (sctp_audit_data[i][1] == 0x01)) {
 553                         cnt = 0;
 554                         SCTP_PRINTF("\n");
 555                 } else if (sctp_audit_data[i][0] == 0xf0) {
 556                         cnt = 0;
 557                         SCTP_PRINTF("\n");
 558                 } else if ((sctp_audit_data[i][0] == 0xc0) &&
 559                     (sctp_audit_data[i][1] == 0x01)) {
 560                         SCTP_PRINTF("\n");
 561                         cnt = 0;
 562                 }
 563                 SCTP_PRINTF("%2.2x%2.2x ", (uint32_t) sctp_audit_data[i][0],
 564                     (uint32_t) sctp_audit_data[i][1]);
 565                 cnt++;
 566                 if ((cnt % 14) == 0)
 567                         SCTP_PRINTF("\n");
 568         }
 569         SCTP_PRINTF("\n");
 570 }
 571
 572 void
 573 sctp_auditing(int from, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
 574     struct sctp_nets *net)
 575 {
 576         int resend_cnt, tot_out, rep, tot_book_cnt;
 577         struct sctp_nets *lnet;
 578         struct sctp_tmit_chunk *chk;
 579
 580         sctp_audit_data[sctp_audit_indx][0] = 0xAA;
 581         sctp_audit_data[sctp_audit_indx][1] = 0x000000ff & from;
 582         sctp_audit_indx++;
 583         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 584                 sctp_audit_indx = 0;
 585         }
 586         if (inp == NULL) {
 587                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 588                 sctp_audit_data[sctp_audit_indx][1] = 0x01;
 589                 sctp_audit_indx++;
 590                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 591                         sctp_audit_indx = 0;
 592                 }
 593                 return;
 594         }
 595         if (stcb == NULL) {
 596                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 597                 sctp_audit_data[sctp_audit_indx][1] = 0x02;
 598                 sctp_audit_indx++;
 599                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 600                         sctp_audit_indx = 0;
 601                 }
 602                 return;
 603         }
 604         sctp_audit_data[sctp_audit_indx][0] = 0xA1;
 605         sctp_audit_data[sctp_audit_indx][1] =
 606             (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 607         sctp_audit_indx++;
 608         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 609                 sctp_audit_indx = 0;
 610         }
 611         rep = 0;
 612         tot_book_cnt = 0;
 613         resend_cnt = tot_out = 0;
 614         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 615                 if (chk->sent == SCTP_DATAGRAM_RESEND) {
 616                         resend_cnt++;
 617                 } else if (chk->sent < SCTP_DATAGRAM_RESEND) {
 618                         tot_out += chk->book_size;
 619                         tot_book_cnt++;
 620                 }
 621         }
 622         if (resend_cnt != stcb->asoc.sent_queue_retran_cnt) {
 623                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 624                 sctp_audit_data[sctp_audit_indx][1] = 0xA1;
 625                 sctp_audit_indx++;
 626                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 627                         sctp_audit_indx = 0;
 628                 }
 629                 SCTP_PRINTF("resend_cnt:%d asoc-tot:%d\n",
 630                     resend_cnt, stcb->asoc.sent_queue_retran_cnt);
 631                 rep = 1;
 632                 stcb->asoc.sent_queue_retran_cnt = resend_cnt;
 633                 sctp_audit_data[sctp_audit_indx][0] = 0xA2;
 634                 sctp_audit_data[sctp_audit_indx][1] =
 635                     (0x000000ff & stcb->asoc.sent_queue_retran_cnt);
 636                 sctp_audit_indx++;
 637                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 638                         sctp_audit_indx = 0;
 639                 }
 640         }
 641         if (tot_out != stcb->asoc.total_flight) {
 642                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 643                 sctp_audit_data[sctp_audit_indx][1] = 0xA2;
 644                 sctp_audit_indx++;
 645                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 646                         sctp_audit_indx = 0;
 647                 }
 648                 rep = 1;
 649                 SCTP_PRINTF("tot_flt:%d asoc_tot:%d\n", tot_out,
 650                     (int)stcb->asoc.total_flight);
 651                 stcb->asoc.total_flight = tot_out;
 652         }
 653         if (tot_book_cnt != stcb->asoc.total_flight_count) {
 654                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 655                 sctp_audit_data[sctp_audit_indx][1] = 0xA5;
 656                 sctp_audit_indx++;
 657                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 658                         sctp_audit_indx = 0;
 659                 }
 660                 rep = 1;
 661                 SCTP_PRINTF("tot_flt_book:%d\n", tot_book_cnt);
 662
 663                 stcb->asoc.total_flight_count = tot_book_cnt;
 664         }
 665         tot_out = 0;
 666         TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 667                 tot_out += lnet->flight_size;
 668         }
 669         if (tot_out != stcb->asoc.total_flight) {
 670                 sctp_audit_data[sctp_audit_indx][0] = 0xAF;
 671                 sctp_audit_data[sctp_audit_indx][1] = 0xA3;
 672                 sctp_audit_indx++;
 673                 if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 674                         sctp_audit_indx = 0;
 675                 }
 676                 rep = 1;
 677                 SCTP_PRINTF("real flight:%d net total was %d\n",
 678                     stcb->asoc.total_flight, tot_out);
 679                 /* now corrective action */
 680                 TAILQ_FOREACH(lnet, &stcb->asoc.nets, sctp_next) {
 681
 682                         tot_out = 0;
 683                         TAILQ_FOREACH(chk, &stcb->asoc.sent_queue, sctp_next) {
 684                                 if ((chk->whoTo == lnet) &&
 685                                     (chk->sent < SCTP_DATAGRAM_RESEND)) {
 686                                         tot_out += chk->book_size;
 687                                 }
 688                         }
 689                         if (lnet->flight_size != tot_out) {
 690                                 SCTP_PRINTF("net:%p flight was %d corrected to %d\n",
 691                                     lnet, lnet->flight_size,
 692                                     tot_out);
 693                                 lnet->flight_size = tot_out;
 694                         }
 695                 }
 696         }
 697         if (rep) {
 698                 sctp_print_audit_report();
 699         }
 700 }
 701
 702 void
 703 sctp_audit_log(uint8_t ev, uint8_t fd)
 704 {
 705
 706         sctp_audit_data[sctp_audit_indx][0] = ev;
 707         sctp_audit_data[sctp_audit_indx][1] = fd;
 708         sctp_audit_indx++;
 709         if (sctp_audit_indx >= SCTP_AUDIT_SIZE) {
 710                 sctp_audit_indx = 0;
 711         }
 712 }
 713
 714 #endif
 715
 716 /*
 717  * sctp_stop_timers_for_shutdown() should be called
 718  * when entering the SHUTDOWN_SENT or SHUTDOWN_ACK_SENT
 719  * state to make sure that all timers are stopped.
 720  */
 721 void
 722 sctp_stop_timers_for_shutdown(struct sctp_tcb *stcb)
 723 {
 724         struct sctp_association *asoc;
 725         struct sctp_nets *net;
 726
 727         asoc = &stcb->asoc;
 728
 729         (void)SCTP_OS_TIMER_STOP(&asoc->dack_timer.timer);
 730         (void)SCTP_OS_TIMER_STOP(&asoc->strreset_timer.timer);
 731         (void)SCTP_OS_TIMER_STOP(&asoc->asconf_timer.timer);
 732         (void)SCTP_OS_TIMER_STOP(&asoc->autoclose_timer.timer);
 733         (void)SCTP_OS_TIMER_STOP(&asoc->delayed_event_timer.timer);
 734         TAILQ_FOREACH(net, &asoc->nets, sctp_next) {
 735                 (void)SCTP_OS_TIMER_STOP(&net->pmtu_timer.timer);
 736                 (void)SCTP_OS_TIMER_STOP(&net->hb_timer.timer);
 737         }
 738 }
 739
 740 /*
 741  * a list of sizes based on typical mtu's, used only if next hop size not
 742  * returned.
 743  */
 744 static uint32_t sctp_mtu_sizes[] = {
 745         68,
 746         296,
 747         508,
 748         512,
 749         544,
 750         576,
 751         1006,
 752         1492,
 753         1500,
 754         1536,
 755         2002,
 756         2048,
 757         4352,
 758         4464,
 759         8166,
 760         17914,
 761         32000,
 762         65535
 763 };
 764
 765 /*
 766  * Return the largest MTU smaller than val. If there is no
 767  * entry, just return val.
 768  */
 769 uint32_t
 770 sctp_get_prev_mtu(uint32_t val)
 771 {
 772         uint32_t i;
 773
 774         if (val <= sctp_mtu_sizes[0]) {
 775                 return (val);
 776         }
 777         for (i = 1; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 778                 if (val <= sctp_mtu_sizes[i]) {
 779                         break;
 780                 }
 781         }
 782         return (sctp_mtu_sizes[i - 1]);
 783 }
 784
 785 /*
 786  * Return the smallest MTU larger than val. If there is no
 787  * entry, just return val.
 788  */
 789 uint32_t
 790 sctp_get_next_mtu(uint32_t val)
 791 {
 792         /* select another MTU that is just bigger than this one */
 793         uint32_t i;
 794
 795         for (i = 0; i < (sizeof(sctp_mtu_sizes) / sizeof(uint32_t)); i++) {
 796                 if (val < sctp_mtu_sizes[i]) {
 797                         return (sctp_mtu_sizes[i]);
 798                 }
 799         }
 800         return (val);
 801 }
 802
 803 void
 804 sctp_fill_random_store(struct sctp_pcb *m)
 805 {
 806         /*
 807          * Here we use the MD5/SHA-1 to hash with our good randomNumbers and
 808          * our counter. The result becomes our good random numbers and we
 809          * then setup to give these out. Note that we do no locking to
 810          * protect this. This is ok, since if competing folks call this we
 811          * will get more gobbled gook in the random store which is what we
 812          * want. There is a danger that two guys will use the same random
 813          * numbers, but thats ok too since that is random as well :->
 814          */
 815         m->store_at = 0;
 816         (void)sctp_hmac(SCTP_HMAC, (uint8_t *) m->random_numbers,
 817             sizeof(m->random_numbers), (uint8_t *) & m->random_counter,
 818             sizeof(m->random_counter), (uint8_t *) m->random_store);
 819         m->random_counter++;
 820 }
 821
 822 uint32_t
 823 sctp_select_initial_TSN(struct sctp_pcb *inp)
 824 {
 825         /*
 826          * A true implementation should use random selection process to get
 827          * the initial stream sequence number, using RFC1750 as a good
 828          * guideline
 829          */
 830         uint32_t x, *xp;
 831         uint8_t *p;
 832         int store_at, new_store;
 833
 834         if (inp->initial_sequence_debug != 0) {
 835                 uint32_t ret;
 836
 837                 ret = inp->initial_sequence_debug;
 838                 inp->initial_sequence_debug++;
 839                 return (ret);
 840         }
 841 retry:
 842         store_at = inp->store_at;
 843         new_store = store_at + sizeof(uint32_t);
 844         if (new_store >= (SCTP_SIGNATURE_SIZE - 3)) {
 845                 new_store = 0;
 846         }
 847         if (!atomic_cmpset_int(&inp->store_at, store_at, new_store)) {
 848                 goto retry;
 849         }
 850         if (new_store == 0) {
 851                 /* Refill the random store */
 852                 sctp_fill_random_store(inp);
 853         }
 854         p = &inp->random_store[store_at];
 855         xp = (uint32_t *) p;
 856         x = *xp;
 857         return (x);
 858 }
 859
 860 uint32_t
 861 sctp_select_a_tag(struct sctp_inpcb *inp, uint16_t lport, uint16_t rport, int check)
 862 {
 863         uint32_t x;
 864         struct timeval now;
 865
 866         if (check) {
 867                 (void)SCTP_GETTIME_TIMEVAL(&now);
 868         }
 869         for (;;) {
 870                 x = sctp_select_initial_TSN(&inp->sctp_ep);
 871                 if (x == 0) {
 872                         /* we never use 0 */
 873                         continue;
 874                 }
 875                 if (!check || sctp_is_vtag_good(x, lport, rport, &now)) {
 876                         break;
 877                 }
 878         }
 879         return (x);
 880 }
 881
 882 int
 883 sctp_init_asoc(struct sctp_inpcb *m, struct sctp_tcb *stcb,
 884     uint32_t override_tag, uint32_t vrf_id)
 885 {
 886         struct sctp_association *asoc;
 887
 888         /*
 889          * Anything set to zero is taken care of by the allocation routine's
 890          * bzero
 891          */
 892
 893         /*
 894          * Up front select what scoping to apply on addresses I tell my peer
 895          * Not sure what to do with these right now, we will need to come up
 896          * with a way to set them. We may need to pass them through from the
 897          * caller in the sctp_aloc_assoc() function.
 898          */
 899         int i;
 900
 901         asoc = &stcb->asoc;
 902         /* init all variables to a known value. */
 903         SCTP_SET_STATE(&stcb->asoc, SCTP_STATE_INUSE);
 904         asoc->max_burst = m->sctp_ep.max_burst;
 905         asoc->fr_max_burst = m->sctp_ep.fr_max_burst;
 906         asoc->heart_beat_delay = TICKS_TO_MSEC(m->sctp_ep.sctp_timeoutticks[SCTP_TIMER_HEARTBEAT]);
 907         asoc->cookie_life = m->sctp_ep.def_cookie_life;
 908         asoc->sctp_cmt_on_off = m->sctp_cmt_on_off;
 909         asoc->ecn_allowed = m->sctp_ecn_enable;
 910         asoc->sctp_nr_sack_on_off = (uint8_t) SCTP_BASE_SYSCTL(sctp_nr_sack_on_off);
 911         asoc->sctp_cmt_pf = (uint8_t) 0;
 912         asoc->sctp_frag_point = m->sctp_frag_point;
 913         asoc->sctp_features = m->sctp_features;
 914         asoc->default_dscp = m->sctp_ep.default_dscp;
 915 #ifdef INET6
 916         if (m->sctp_ep.default_flowlabel) {
 917                 asoc->default_flowlabel = m->sctp_ep.default_flowlabel;
 918         } else {
 919                 if (m->ip_inp.inp.inp_flags & IN6P_AUTOFLOWLABEL) {
 920                         asoc->default_flowlabel = sctp_select_initial_TSN(&m->sctp_ep);
 921                         asoc->default_flowlabel &= 0x000fffff;
 922                         asoc->default_flowlabel |= 0x80000000;
 923                 } else {
 924                         asoc->default_flowlabel = 0;
 925                 }
 926         }
 927 #endif
 928         asoc->sb_send_resv = 0;
 929         if (override_tag) {
 930                 asoc->my_vtag = override_tag;
 931         } else {
 932                 asoc->my_vtag = sctp_select_a_tag(m, stcb->sctp_ep->sctp_lport, stcb->rport, 1);
 933         }
 934         /* Get the nonce tags */
 935         asoc->my_vtag_nonce = sctp_select_a_tag(m, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
 936         asoc->peer_vtag_nonce = sctp_select_a_tag(m, stcb->sctp_ep->sctp_lport, stcb->rport, 0);
 937         asoc->vrf_id = vrf_id;
 938
 939 #ifdef SCTP_ASOCLOG_OF_TSNS
 940         asoc->tsn_in_at = 0;
 941         asoc->tsn_out_at = 0;
 942         asoc->tsn_in_wrapped = 0;
 943         asoc->tsn_out_wrapped = 0;
 944         asoc->cumack_log_at = 0;
 945         asoc->cumack_log_atsnt = 0;
 946 #endif
 947 #ifdef SCTP_FS_SPEC_LOG
 948         asoc->fs_index = 0;
 949 #endif
 950         asoc->refcnt = 0;
 951         asoc->assoc_up_sent = 0;
 952         asoc->asconf_seq_out = asoc->str_reset_seq_out = asoc->init_seq_number = asoc->sending_seq =
 953             sctp_select_initial_TSN(&m->sctp_ep);
 954         asoc->asconf_seq_out_acked = asoc->asconf_seq_out - 1;
 955         /* we are optimisitic here */
 956         asoc->peer_supports_pktdrop = 1;
 957         asoc->peer_supports_nat = 0;
 958         asoc->sent_queue_retran_cnt = 0;
 959
 960         /* for CMT */
 961         asoc->last_net_cmt_send_started = NULL;
 962
 963         /* This will need to be adjusted */
 964         asoc->last_acked_seq = asoc->init_seq_number - 1;
 965         asoc->advanced_peer_ack_point = asoc->last_acked_seq;
 966         asoc->asconf_seq_in = asoc->last_acked_seq;
 967
 968         /* here we are different, we hold the next one we expect */
 969         asoc->str_reset_seq_in = asoc->last_acked_seq + 1;
 970
 971         asoc->initial_init_rto_max = m->sctp_ep.initial_init_rto_max;
 972         asoc->initial_rto = m->sctp_ep.initial_rto;
 973
 974         asoc->max_init_times = m->sctp_ep.max_init_times;
 975         asoc->max_send_times = m->sctp_ep.max_send_times;
 976         asoc->def_net_failure = m->sctp_ep.def_net_failure;
 977         asoc->def_net_pf_threshold = m->sctp_ep.def_net_pf_threshold;
 978         asoc->free_chunk_cnt = 0;
 979
 980         asoc->iam_blocking = 0;
 981         asoc->context = m->sctp_context;
 982         asoc->local_strreset_support = m->local_strreset_support;
 983         asoc->def_send = m->def_send;
 984         asoc->delayed_ack = TICKS_TO_MSEC(m->sctp_ep.sctp_timeoutticks[SCTP_TIMER_RECV]);
 985         asoc->sack_freq = m->sctp_ep.sctp_sack_freq;
 986         asoc->pr_sctp_cnt = 0;
 987         asoc->total_output_queue_size = 0;
 988
 989         if (m->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
 990                 struct in6pcb *inp6;
 991
 992                 /* Its a V6 socket */
 993                 inp6 = (struct in6pcb *)m;
 994                 asoc->ipv6_addr_legal = 1;
 995                 /* Now look at the binding flag to see if V4 will be legal */
 996                 if (SCTP_IPV6_V6ONLY(inp6) == 0) {
 997                         asoc->ipv4_addr_legal = 1;
 998                 } else {
 999                         /* V4 addresses are NOT legal on the association */
1000                         asoc->ipv4_addr_legal = 0;
1001                 }
1002         } else {
1003                 /* Its a V4 socket, no - V6 */
1004                 asoc->ipv4_addr_legal = 1;
1005                 asoc->ipv6_addr_legal = 0;
1006         }
1007
1008         asoc->my_rwnd = max(SCTP_SB_LIMIT_RCV(m->sctp_socket), SCTP_MINIMAL_RWND);
1009         asoc->peers_rwnd = SCTP_SB_LIMIT_RCV(m->sctp_socket);
1010
1011         asoc->smallest_mtu = m->sctp_frag_point;
1012         asoc->minrto = m->sctp_ep.sctp_minrto;
1013         asoc->maxrto = m->sctp_ep.sctp_maxrto;
1014
1015         asoc->locked_on_sending = NULL;
1016         asoc->stream_locked_on = 0;
1017         asoc->ecn_echo_cnt_onq = 0;
1018         asoc->stream_locked = 0;
1019
1020         asoc->send_sack = 1;
1021
1022         LIST_INIT(&asoc->sctp_restricted_addrs);
1023
1024         TAILQ_INIT(&asoc->nets);
1025         TAILQ_INIT(&asoc->pending_reply_queue);
1026         TAILQ_INIT(&asoc->asconf_ack_sent);
1027         /* Setup to fill the hb random cache at first HB */
1028         asoc->hb_random_idx = 4;
1029
1030         asoc->sctp_autoclose_ticks = m->sctp_ep.auto_close_time;
1031
1032         stcb->asoc.congestion_control_module = m->sctp_ep.sctp_default_cc_module;
1033         stcb->asoc.cc_functions = sctp_cc_functions[m->sctp_ep.sctp_default_cc_module];
1034
1035         stcb->asoc.stream_scheduling_module = m->sctp_ep.sctp_default_ss_module;
1036         stcb->asoc.ss_functions = sctp_ss_functions[m->sctp_ep.sctp_default_ss_module];
1037
1038         /*
1039          * Now the stream parameters, here we allocate space for all streams
1040          * that we request by default.
1041          */
1042         asoc->strm_realoutsize = asoc->streamoutcnt = asoc->pre_open_streams =
1043             m->sctp_ep.pre_open_stream_count;
1044         SCTP_MALLOC(asoc->strmout, struct sctp_stream_out *,
1045             asoc->streamoutcnt * sizeof(struct sctp_stream_out),
1046             SCTP_M_STRMO);
1047         if (asoc->strmout == NULL) {
1048                 /* big trouble no memory */
1049                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1050                 return (ENOMEM);
1051         }
1052         for (i = 0; i < asoc->streamoutcnt; i++) {
1053                 /*
1054                  * inbound side must be set to 0xffff, also NOTE when we get
1055                  * the INIT-ACK back (for INIT sender) we MUST reduce the
1056                  * count (streamoutcnt) but first check if we sent to any of
1057                  * the upper streams that were dropped (if some were). Those
1058                  * that were dropped must be notified to the upper layer as
1059                  * failed to send.
1060                  */
1061                 asoc->strmout[i].next_sequence_sent = 0x0;
1062                 TAILQ_INIT(&asoc->strmout[i].outqueue);
1063                 asoc->strmout[i].stream_no = i;
1064                 asoc->strmout[i].last_msg_incomplete = 0;
1065                 asoc->ss_functions.sctp_ss_init_stream(&asoc->strmout[i], NULL);
1066         }
1067         asoc->ss_functions.sctp_ss_init(stcb, asoc, 0);
1068
1069         /* Now the mapping array */
1070         asoc->mapping_array_size = SCTP_INITIAL_MAPPING_ARRAY;
1071         SCTP_MALLOC(asoc->mapping_array, uint8_t *, asoc->mapping_array_size,
1072             SCTP_M_MAP);
1073         if (asoc->mapping_array == NULL) {
1074                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1075                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1076                 return (ENOMEM);
1077         }
1078         memset(asoc->mapping_array, 0, asoc->mapping_array_size);
1079         SCTP_MALLOC(asoc->nr_mapping_array, uint8_t *, asoc->mapping_array_size,
1080             SCTP_M_MAP);
1081         if (asoc->nr_mapping_array == NULL) {
1082                 SCTP_FREE(asoc->strmout, SCTP_M_STRMO);
1083                 SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1084                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
1085                 return (ENOMEM);
1086         }
1087         memset(asoc->nr_mapping_array, 0, asoc->mapping_array_size);
1088
1089         /* Now the init of the other outqueues */
1090         TAILQ_INIT(&asoc->free_chunks);
1091         TAILQ_INIT(&asoc->control_send_queue);
1092         TAILQ_INIT(&asoc->asconf_send_queue);
1093         TAILQ_INIT(&asoc->send_queue);
1094         TAILQ_INIT(&asoc->sent_queue);
1095         TAILQ_INIT(&asoc->reasmqueue);
1096         TAILQ_INIT(&asoc->resetHead);
1097         asoc->max_inbound_streams = m->sctp_ep.max_open_streams_intome;
1098         TAILQ_INIT(&asoc->asconf_queue);
1099         /* authentication fields */
1100         asoc->authinfo.random = NULL;
1101         asoc->authinfo.active_keyid = 0;
1102         asoc->authinfo.assoc_key = NULL;
1103         asoc->authinfo.assoc_keyid = 0;
1104         asoc->authinfo.recv_key = NULL;
1105         asoc->authinfo.recv_keyid = 0;
1106         LIST_INIT(&asoc->shared_keys);
1107         asoc->marked_retrans = 0;
1108         asoc->port = m->sctp_ep.port;
1109         asoc->timoinit = 0;
1110         asoc->timodata = 0;
1111         asoc->timosack = 0;
1112         asoc->timoshutdown = 0;
1113         asoc->timoheartbeat = 0;
1114         asoc->timocookie = 0;
1115         asoc->timoshutdownack = 0;
1116         (void)SCTP_GETTIME_TIMEVAL(&asoc->start_time);
1117         asoc->discontinuity_time = asoc->start_time;
1118         /*
1119          * sa_ignore MEMLEAK {memory is put in the assoc mapping array and
1120          * freed later when the association is freed.
1121          */
1122         return (0);
1123 }
1124
1125 void
1126 sctp_print_mapping_array(struct sctp_association *asoc)
1127 {
1128         unsigned int i, limit;
1129
1130         SCTP_PRINTF("Mapping array size: %d, baseTSN: %8.8x, cumAck: %8.8x, highestTSN: (%8.8x, %8.8x).\n",
1131             asoc->mapping_array_size,
1132             asoc->mapping_array_base_tsn,
1133             asoc->cumulative_tsn,
1134             asoc->highest_tsn_inside_map,
1135             asoc->highest_tsn_inside_nr_map);
1136         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1137                 if (asoc->mapping_array[limit - 1] != 0) {
1138                         break;
1139                 }
1140         }
1141         SCTP_PRINTF("Renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1142         for (i = 0; i < limit; i++) {
1143                 SCTP_PRINTF("%2.2x%c", asoc->mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1144         }
1145         if (limit % 16)
1146                 SCTP_PRINTF("\n");
1147         for (limit = asoc->mapping_array_size; limit > 1; limit--) {
1148                 if (asoc->nr_mapping_array[limit - 1]) {
1149                         break;
1150                 }
1151         }
1152         SCTP_PRINTF("Non renegable mapping array (last %d entries are zero):\n", asoc->mapping_array_size - limit);
1153         for (i = 0; i < limit; i++) {
1154                 SCTP_PRINTF("%2.2x%c", asoc->nr_mapping_array[i], ((i + 1) % 16) ? ' ' : '\n');
1155         }
1156         if (limit % 16)
1157                 SCTP_PRINTF("\n");
1158 }
1159
1160 int
1161 sctp_expand_mapping_array(struct sctp_association *asoc, uint32_t needed)
1162 {
1163         /* mapping array needs to grow */
1164         uint8_t *new_array1, *new_array2;
1165         uint32_t new_size;
1166
1167         new_size = asoc->mapping_array_size + ((needed + 7) / 8 + SCTP_MAPPING_ARRAY_INCR);
1168         SCTP_MALLOC(new_array1, uint8_t *, new_size, SCTP_M_MAP);
1169         SCTP_MALLOC(new_array2, uint8_t *, new_size, SCTP_M_MAP);
1170         if ((new_array1 == NULL) || (new_array2 == NULL)) {
1171                 /* can't get more, forget it */
1172                 SCTP_PRINTF("No memory for expansion of SCTP mapping array %d\n", new_size);
1173                 if (new_array1) {
1174                         SCTP_FREE(new_array1, SCTP_M_MAP);
1175                 }
1176                 if (new_array2) {
1177                         SCTP_FREE(new_array2, SCTP_M_MAP);
1178                 }
1179                 return (-1);
1180         }
1181         memset(new_array1, 0, new_size);
1182         memset(new_array2, 0, new_size);
1183         memcpy(new_array1, asoc->mapping_array, asoc->mapping_array_size);
1184         memcpy(new_array2, asoc->nr_mapping_array, asoc->mapping_array_size);
1185         SCTP_FREE(asoc->mapping_array, SCTP_M_MAP);
1186         SCTP_FREE(asoc->nr_mapping_array, SCTP_M_MAP);
1187         asoc->mapping_array = new_array1;
1188         asoc->nr_mapping_array = new_array2;
1189         asoc->mapping_array_size = new_size;
1190         return (0);
1191 }
1192
1193
1194 static void
1195 sctp_iterator_work(struct sctp_iterator *it)
1196 {
1197         int iteration_count = 0;
1198         int inp_skip = 0;
1199         int first_in = 1;
1200         struct sctp_inpcb *tinp;
1201
1202         SCTP_INP_INFO_RLOCK();
1203         SCTP_ITERATOR_LOCK();
1204         if (it->inp) {
1205                 SCTP_INP_RLOCK(it->inp);
1206                 SCTP_INP_DECR_REF(it->inp);
1207         }
1208         if (it->inp == NULL) {
1209                 /* iterator is complete */
1210 done_with_iterator:
1211                 SCTP_ITERATOR_UNLOCK();
1212                 SCTP_INP_INFO_RUNLOCK();
1213                 if (it->function_atend != NULL) {
1214                         (*it->function_atend) (it->pointer, it->val);
1215                 }
1216                 SCTP_FREE(it, SCTP_M_ITER);
1217                 return;
1218         }
1219 select_a_new_ep:
1220         if (first_in) {
1221                 first_in = 0;
1222         } else {
1223                 SCTP_INP_RLOCK(it->inp);
1224         }
1225         while (((it->pcb_flags) &&
1226             ((it->inp->sctp_flags & it->pcb_flags) != it->pcb_flags)) ||
1227             ((it->pcb_features) &&
1228             ((it->inp->sctp_features & it->pcb_features) != it->pcb_features))) {
1229                 /* endpoint flags or features don't match, so keep looking */
1230                 if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1231                         SCTP_INP_RUNLOCK(it->inp);
1232                         goto done_with_iterator;
1233                 }
1234                 tinp = it->inp;
1235                 it->inp = LIST_NEXT(it->inp, sctp_list);
1236                 SCTP_INP_RUNLOCK(tinp);
1237                 if (it->inp == NULL) {
1238                         goto done_with_iterator;
1239                 }
1240                 SCTP_INP_RLOCK(it->inp);
1241         }
1242         /* now go through each assoc which is in the desired state */
1243         if (it->done_current_ep == 0) {
1244                 if (it->function_inp != NULL)
1245                         inp_skip = (*it->function_inp) (it->inp, it->pointer, it->val);
1246                 it->done_current_ep = 1;
1247         }
1248         if (it->stcb == NULL) {
1249                 /* run the per instance function */
1250                 it->stcb = LIST_FIRST(&it->inp->sctp_asoc_list);
1251         }
1252         if ((inp_skip) || it->stcb == NULL) {
1253                 if (it->function_inp_end != NULL) {
1254                         inp_skip = (*it->function_inp_end) (it->inp,
1255                             it->pointer,
1256                             it->val);
1257                 }
1258                 SCTP_INP_RUNLOCK(it->inp);
1259                 goto no_stcb;
1260         }
1261         while (it->stcb) {
1262                 SCTP_TCB_LOCK(it->stcb);
1263                 if (it->asoc_state && ((it->stcb->asoc.state & it->asoc_state) != it->asoc_state)) {
1264                         /* not in the right state... keep looking */
1265                         SCTP_TCB_UNLOCK(it->stcb);
1266                         goto next_assoc;
1267                 }
1268                 /* see if we have limited out the iterator loop */
1269                 iteration_count++;
1270                 if (iteration_count > SCTP_ITERATOR_MAX_AT_ONCE) {
1271                         /* Pause to let others grab the lock */
1272                         atomic_add_int(&it->stcb->asoc.refcnt, 1);
1273                         SCTP_TCB_UNLOCK(it->stcb);
1274                         SCTP_INP_INCR_REF(it->inp);
1275                         SCTP_INP_RUNLOCK(it->inp);
1276                         SCTP_ITERATOR_UNLOCK();
1277                         SCTP_INP_INFO_RUNLOCK();
1278                         SCTP_INP_INFO_RLOCK();
1279                         SCTP_ITERATOR_LOCK();
1280                         if (sctp_it_ctl.iterator_flags) {
1281                                 /* We won't be staying here */
1282                                 SCTP_INP_DECR_REF(it->inp);
1283                                 atomic_add_int(&it->stcb->asoc.refcnt, -1);
1284                                 if (sctp_it_ctl.iterator_flags &
1285                                     SCTP_ITERATOR_STOP_CUR_IT) {
1286                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_IT;
1287                                         goto done_with_iterator;
1288                                 }
1289                                 if (sctp_it_ctl.iterator_flags &
1290                                     SCTP_ITERATOR_STOP_CUR_INP) {
1291                                         sctp_it_ctl.iterator_flags &= ~SCTP_ITERATOR_STOP_CUR_INP;
1292                                         goto no_stcb;
1293                                 }
1294                                 /* If we reach here huh? */
1295                                 SCTP_PRINTF("Unknown it ctl flag %x\n",
1296                                     sctp_it_ctl.iterator_flags);
1297                                 sctp_it_ctl.iterator_flags = 0;
1298                         }
1299                         SCTP_INP_RLOCK(it->inp);
1300                         SCTP_INP_DECR_REF(it->inp);
1301                         SCTP_TCB_LOCK(it->stcb);
1302                         atomic_add_int(&it->stcb->asoc.refcnt, -1);
1303                         iteration_count = 0;
1304                 }
1305                 /* run function on this one */
1306                 (*it->function_assoc) (it->inp, it->stcb, it->pointer, it->val);
1307
1308                 /*
1309                  * we lie here, it really needs to have its own type but
1310                  * first I must verify that this won't effect things :-0
1311                  */
1312                 if (it->no_chunk_output == 0)
1313                         sctp_chunk_output(it->inp, it->stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1314
1315                 SCTP_TCB_UNLOCK(it->stcb);
1316 next_assoc:
1317                 it->stcb = LIST_NEXT(it->stcb, sctp_tcblist);
1318                 if (it->stcb == NULL) {
1319                         /* Run last function */
1320                         if (it->function_inp_end != NULL) {
1321                                 inp_skip = (*it->function_inp_end) (it->inp,
1322                                     it->pointer,
1323                                     it->val);
1324                         }
1325                 }
1326         }
1327         SCTP_INP_RUNLOCK(it->inp);
1328 no_stcb:
1329         /* done with all assocs on this endpoint, move on to next endpoint */
1330         it->done_current_ep = 0;
1331         if (it->iterator_flags & SCTP_ITERATOR_DO_SINGLE_INP) {
1332                 it->inp = NULL;
1333         } else {
1334                 it->inp = LIST_NEXT(it->inp, sctp_list);
1335         }
1336         if (it->inp == NULL) {
1337                 goto done_with_iterator;
1338         }
1339         goto select_a_new_ep;
1340 }
1341
1342 void
1343 sctp_iterator_worker(void)
1344 {
1345         struct sctp_iterator *it, *nit;
1346
1347         /* This function is called with the WQ lock in place */
1348
1349         sctp_it_ctl.iterator_running = 1;
1350         TAILQ_FOREACH_SAFE(it, &sctp_it_ctl.iteratorhead, sctp_nxt_itr, nit) {
1351                 sctp_it_ctl.cur_it = it;
1352                 /* now lets work on this one */
1353                 TAILQ_REMOVE(&sctp_it_ctl.iteratorhead, it, sctp_nxt_itr);
1354                 SCTP_IPI_ITERATOR_WQ_UNLOCK();
1355                 CURVNET_SET(it->vn);
1356                 sctp_iterator_work(it);
1357                 sctp_it_ctl.cur_it = NULL;
1358                 CURVNET_RESTORE();
1359                 SCTP_IPI_ITERATOR_WQ_LOCK();
1360                 /* sa_ignore FREED_MEMORY */
1361         }
1362         sctp_it_ctl.iterator_running = 0;
1363         return;
1364 }
1365
1366
1367 static void
1368 sctp_handle_addr_wq(void)
1369 {
1370         /* deal with the ADDR wq from the rtsock calls */
1371         struct sctp_laddr *wi, *nwi;
1372         struct sctp_asconf_iterator *asc;
1373
1374         SCTP_MALLOC(asc, struct sctp_asconf_iterator *,
1375             sizeof(struct sctp_asconf_iterator), SCTP_M_ASC_IT);
1376         if (asc == NULL) {
1377                 /* Try later, no memory */
1378                 sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
1379                     (struct sctp_inpcb *)NULL,
1380                     (struct sctp_tcb *)NULL,
1381                     (struct sctp_nets *)NULL);
1382                 return;
1383         }
1384         LIST_INIT(&asc->list_of_work);
1385         asc->cnt = 0;
1386
1387         SCTP_WQ_ADDR_LOCK();
1388         LIST_FOREACH_SAFE(wi, &SCTP_BASE_INFO(addr_wq), sctp_nxt_addr, nwi) {
1389                 LIST_REMOVE(wi, sctp_nxt_addr);
1390                 LIST_INSERT_HEAD(&asc->list_of_work, wi, sctp_nxt_addr);
1391                 asc->cnt++;
1392         }
1393         SCTP_WQ_ADDR_UNLOCK();
1394
1395         if (asc->cnt == 0) {
1396                 SCTP_FREE(asc, SCTP_M_ASC_IT);
1397         } else {
1398                 (void)sctp_initiate_iterator(sctp_asconf_iterator_ep,
1399                     sctp_asconf_iterator_stcb,
1400                     NULL,       /* No ep end for boundall */
1401                     SCTP_PCB_FLAGS_BOUNDALL,
1402                     SCTP_PCB_ANY_FEATURES,
1403                     SCTP_ASOC_ANY_STATE,
1404                     (void *)asc, 0,
1405                     sctp_asconf_iterator_end, NULL, 0);
1406         }
1407 }
1408
1409 void
1410 sctp_timeout_handler(void *t)
1411 {
1412         struct sctp_inpcb *inp;
1413         struct sctp_tcb *stcb;
1414         struct sctp_nets *net;
1415         struct sctp_timer *tmr;
1416
1417 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1418         struct socket *so;
1419
1420 #endif
1421         int did_output, type;
1422
1423         tmr = (struct sctp_timer *)t;
1424         inp = (struct sctp_inpcb *)tmr->ep;
1425         stcb = (struct sctp_tcb *)tmr->tcb;
1426         net = (struct sctp_nets *)tmr->net;
1427         CURVNET_SET((struct vnet *)tmr->vnet);
1428         did_output = 1;
1429
1430 #ifdef SCTP_AUDITING_ENABLED
1431         sctp_audit_log(0xF0, (uint8_t) tmr->type);
1432         sctp_auditing(3, inp, stcb, net);
1433 #endif
1434
1435         /* sanity checks... */
1436         if (tmr->self != (void *)tmr) {
1437                 /*
1438                  * SCTP_PRINTF("Stale SCTP timer fired (%p), ignoring...\n",
1439                  * tmr);
1440                  */
1441                 CURVNET_RESTORE();
1442                 return;
1443         }
1444         tmr->stopped_from = 0xa001;
1445         if (!SCTP_IS_TIMER_TYPE_VALID(tmr->type)) {
1446                 /*
1447                  * SCTP_PRINTF("SCTP timer fired with invalid type: 0x%x\n",
1448                  * tmr->type);
1449                  */
1450                 CURVNET_RESTORE();
1451                 return;
1452         }
1453         tmr->stopped_from = 0xa002;
1454         if ((tmr->type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL)) {
1455                 CURVNET_RESTORE();
1456                 return;
1457         }
1458         /* if this is an iterator timeout, get the struct and clear inp */
1459         tmr->stopped_from = 0xa003;
1460         type = tmr->type;
1461         if (inp) {
1462                 SCTP_INP_INCR_REF(inp);
1463                 if ((inp->sctp_socket == NULL) &&
1464                     ((tmr->type != SCTP_TIMER_TYPE_INPKILL) &&
1465                     (tmr->type != SCTP_TIMER_TYPE_INIT) &&
1466                     (tmr->type != SCTP_TIMER_TYPE_SEND) &&
1467                     (tmr->type != SCTP_TIMER_TYPE_RECV) &&
1468                     (tmr->type != SCTP_TIMER_TYPE_HEARTBEAT) &&
1469                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWN) &&
1470                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNACK) &&
1471                     (tmr->type != SCTP_TIMER_TYPE_SHUTDOWNGUARD) &&
1472                     (tmr->type != SCTP_TIMER_TYPE_ASOCKILL))
1473                     ) {
1474                         SCTP_INP_DECR_REF(inp);
1475                         CURVNET_RESTORE();
1476                         return;
1477                 }
1478         }
1479         tmr->stopped_from = 0xa004;
1480         if (stcb) {
1481                 atomic_add_int(&stcb->asoc.refcnt, 1);
1482                 if (stcb->asoc.state == 0) {
1483                         atomic_add_int(&stcb->asoc.refcnt, -1);
1484                         if (inp) {
1485                                 SCTP_INP_DECR_REF(inp);
1486                         }
1487                         CURVNET_RESTORE();
1488                         return;
1489                 }
1490         }
1491         tmr->stopped_from = 0xa005;
1492         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer type %d goes off\n", tmr->type);
1493         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1494                 if (inp) {
1495                         SCTP_INP_DECR_REF(inp);
1496                 }
1497                 if (stcb) {
1498                         atomic_add_int(&stcb->asoc.refcnt, -1);
1499                 }
1500                 CURVNET_RESTORE();
1501                 return;
1502         }
1503         tmr->stopped_from = 0xa006;
1504
1505         if (stcb) {
1506                 SCTP_TCB_LOCK(stcb);
1507                 atomic_add_int(&stcb->asoc.refcnt, -1);
1508                 if ((tmr->type != SCTP_TIMER_TYPE_ASOCKILL) &&
1509                     ((stcb->asoc.state == 0) ||
1510                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED))) {
1511                         SCTP_TCB_UNLOCK(stcb);
1512                         if (inp) {
1513                                 SCTP_INP_DECR_REF(inp);
1514                         }
1515                         CURVNET_RESTORE();
1516                         return;
1517                 }
1518         }
1519         /* record in stopped what t-o occured */
1520         tmr->stopped_from = tmr->type;
1521
1522         /* mark as being serviced now */
1523         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
1524                 /*
1525                  * Callout has been rescheduled.
1526                  */
1527                 goto get_out;
1528         }
1529         if (!SCTP_OS_TIMER_ACTIVE(&tmr->timer)) {
1530                 /*
1531                  * Not active, so no action.
1532                  */
1533                 goto get_out;
1534         }
1535         SCTP_OS_TIMER_DEACTIVATE(&tmr->timer);
1536
1537         /* call the handler for the appropriate timer type */
1538         switch (tmr->type) {
1539         case SCTP_TIMER_TYPE_ZERO_COPY:
1540                 if (inp == NULL) {
1541                         break;
1542                 }
1543                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
1544                         SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket);
1545                 }
1546                 break;
1547         case SCTP_TIMER_TYPE_ZCOPY_SENDQ:
1548                 if (inp == NULL) {
1549                         break;
1550                 }
1551                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
1552                         SCTP_ZERO_COPY_SENDQ_EVENT(inp, inp->sctp_socket);
1553                 }
1554                 break;
1555         case SCTP_TIMER_TYPE_ADDR_WQ:
1556                 sctp_handle_addr_wq();
1557                 break;
1558         case SCTP_TIMER_TYPE_SEND:
1559                 if ((stcb == NULL) || (inp == NULL)) {
1560                         break;
1561                 }
1562                 SCTP_STAT_INCR(sctps_timodata);
1563                 stcb->asoc.timodata++;
1564                 stcb->asoc.num_send_timers_up--;
1565                 if (stcb->asoc.num_send_timers_up < 0) {
1566                         stcb->asoc.num_send_timers_up = 0;
1567                 }
1568                 SCTP_TCB_LOCK_ASSERT(stcb);
1569                 if (sctp_t3rxt_timer(inp, stcb, net)) {
1570                         /* no need to unlock on tcb its gone */
1571
1572                         goto out_decr;
1573                 }
1574                 SCTP_TCB_LOCK_ASSERT(stcb);
1575 #ifdef SCTP_AUDITING_ENABLED
1576                 sctp_auditing(4, inp, stcb, net);
1577 #endif
1578                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1579                 if ((stcb->asoc.num_send_timers_up == 0) &&
1580                     (stcb->asoc.sent_queue_cnt > 0)) {
1581                         struct sctp_tmit_chunk *chk;
1582
1583                         /*
1584                          * safeguard. If there on some on the sent queue
1585                          * somewhere but no timers running something is
1586                          * wrong... so we start a timer on the first chunk
1587                          * on the send queue on whatever net it is sent to.
1588                          */
1589                         chk = TAILQ_FIRST(&stcb->asoc.sent_queue);
1590                         sctp_timer_start(SCTP_TIMER_TYPE_SEND, inp, stcb,
1591                             chk->whoTo);
1592                 }
1593                 break;
1594         case SCTP_TIMER_TYPE_INIT:
1595                 if ((stcb == NULL) || (inp == NULL)) {
1596                         break;
1597                 }
1598                 SCTP_STAT_INCR(sctps_timoinit);
1599                 stcb->asoc.timoinit++;
1600                 if (sctp_t1init_timer(inp, stcb, net)) {
1601                         /* no need to unlock on tcb its gone */
1602                         goto out_decr;
1603                 }
1604                 /* We do output but not here */
1605                 did_output = 0;
1606                 break;
1607         case SCTP_TIMER_TYPE_RECV:
1608                 if ((stcb == NULL) || (inp == NULL)) {
1609                         break;
1610                 }
1611                 SCTP_STAT_INCR(sctps_timosack);
1612                 stcb->asoc.timosack++;
1613                 sctp_send_sack(stcb, SCTP_SO_NOT_LOCKED);
1614 #ifdef SCTP_AUDITING_ENABLED
1615                 sctp_auditing(4, inp, stcb, net);
1616 #endif
1617                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SACK_TMR, SCTP_SO_NOT_LOCKED);
1618                 break;
1619         case SCTP_TIMER_TYPE_SHUTDOWN:
1620                 if ((stcb == NULL) || (inp == NULL)) {
1621                         break;
1622                 }
1623                 if (sctp_shutdown_timer(inp, stcb, net)) {
1624                         /* no need to unlock on tcb its gone */
1625                         goto out_decr;
1626                 }
1627                 SCTP_STAT_INCR(sctps_timoshutdown);
1628                 stcb->asoc.timoshutdown++;
1629 #ifdef SCTP_AUDITING_ENABLED
1630                 sctp_auditing(4, inp, stcb, net);
1631 #endif
1632                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_TMR, SCTP_SO_NOT_LOCKED);
1633                 break;
1634         case SCTP_TIMER_TYPE_HEARTBEAT:
1635                 if ((stcb == NULL) || (inp == NULL) || (net == NULL)) {
1636                         break;
1637                 }
1638                 SCTP_STAT_INCR(sctps_timoheartbeat);
1639                 stcb->asoc.timoheartbeat++;
1640                 if (sctp_heartbeat_timer(inp, stcb, net)) {
1641                         /* no need to unlock on tcb its gone */
1642                         goto out_decr;
1643                 }
1644 #ifdef SCTP_AUDITING_ENABLED
1645                 sctp_auditing(4, inp, stcb, net);
1646 #endif
1647                 if (!(net->dest_state & SCTP_ADDR_NOHB)) {
1648                         sctp_timer_start(SCTP_TIMER_TYPE_HEARTBEAT, inp, stcb, net);
1649                         sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_HB_TMR, SCTP_SO_NOT_LOCKED);
1650                 }
1651                 break;
1652         case SCTP_TIMER_TYPE_COOKIE:
1653                 if ((stcb == NULL) || (inp == NULL)) {
1654                         break;
1655                 }
1656                 if (sctp_cookie_timer(inp, stcb, net)) {
1657                         /* no need to unlock on tcb its gone */
1658                         goto out_decr;
1659                 }
1660                 SCTP_STAT_INCR(sctps_timocookie);
1661                 stcb->asoc.timocookie++;
1662 #ifdef SCTP_AUDITING_ENABLED
1663                 sctp_auditing(4, inp, stcb, net);
1664 #endif
1665                 /*
1666                  * We consider T3 and Cookie timer pretty much the same with
1667                  * respect to where from in chunk_output.
1668                  */
1669                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_T3, SCTP_SO_NOT_LOCKED);
1670                 break;
1671         case SCTP_TIMER_TYPE_NEWCOOKIE:
1672                 {
1673                         struct timeval tv;
1674                         int i, secret;
1675
1676                         if (inp == NULL) {
1677                                 break;
1678                         }
1679                         SCTP_STAT_INCR(sctps_timosecret);
1680                         (void)SCTP_GETTIME_TIMEVAL(&tv);
1681                         SCTP_INP_WLOCK(inp);
1682                         inp->sctp_ep.time_of_secret_change = tv.tv_sec;
1683                         inp->sctp_ep.last_secret_number =
1684                             inp->sctp_ep.current_secret_number;
1685                         inp->sctp_ep.current_secret_number++;
1686                         if (inp->sctp_ep.current_secret_number >=
1687                             SCTP_HOW_MANY_SECRETS) {
1688                                 inp->sctp_ep.current_secret_number = 0;
1689                         }
1690                         secret = (int)inp->sctp_ep.current_secret_number;
1691                         for (i = 0; i < SCTP_NUMBER_OF_SECRETS; i++) {
1692                                 inp->sctp_ep.secret_key[secret][i] =
1693                                     sctp_select_initial_TSN(&inp->sctp_ep);
1694                         }
1695                         SCTP_INP_WUNLOCK(inp);
1696                         sctp_timer_start(SCTP_TIMER_TYPE_NEWCOOKIE, inp, stcb, net);
1697                 }
1698                 did_output = 0;
1699                 break;
1700         case SCTP_TIMER_TYPE_PATHMTURAISE:
1701                 if ((stcb == NULL) || (inp == NULL)) {
1702                         break;
1703                 }
1704                 SCTP_STAT_INCR(sctps_timopathmtu);
1705                 sctp_pathmtu_timer(inp, stcb, net);
1706                 did_output = 0;
1707                 break;
1708         case SCTP_TIMER_TYPE_SHUTDOWNACK:
1709                 if ((stcb == NULL) || (inp == NULL)) {
1710                         break;
1711                 }
1712                 if (sctp_shutdownack_timer(inp, stcb, net)) {
1713                         /* no need to unlock on tcb its gone */
1714                         goto out_decr;
1715                 }
1716                 SCTP_STAT_INCR(sctps_timoshutdownack);
1717                 stcb->asoc.timoshutdownack++;
1718 #ifdef SCTP_AUDITING_ENABLED
1719                 sctp_auditing(4, inp, stcb, net);
1720 #endif
1721                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_SHUT_ACK_TMR, SCTP_SO_NOT_LOCKED);
1722                 break;
1723         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
1724                 if ((stcb == NULL) || (inp == NULL)) {
1725                         break;
1726                 }
1727                 SCTP_STAT_INCR(sctps_timoshutdownguard);
1728                 sctp_abort_an_association(inp, stcb,
1729                     SCTP_SHUTDOWN_GUARD_EXPIRES, NULL, SCTP_SO_NOT_LOCKED);
1730                 /* no need to unlock on tcb its gone */
1731                 goto out_decr;
1732
1733         case SCTP_TIMER_TYPE_STRRESET:
1734                 if ((stcb == NULL) || (inp == NULL)) {
1735                         break;
1736                 }
1737                 if (sctp_strreset_timer(inp, stcb, net)) {
1738                         /* no need to unlock on tcb its gone */
1739                         goto out_decr;
1740                 }
1741                 SCTP_STAT_INCR(sctps_timostrmrst);
1742                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_STRRST_TMR, SCTP_SO_NOT_LOCKED);
1743                 break;
1744         case SCTP_TIMER_TYPE_ASCONF:
1745                 if ((stcb == NULL) || (inp == NULL)) {
1746                         break;
1747                 }
1748                 if (sctp_asconf_timer(inp, stcb, net)) {
1749                         /* no need to unlock on tcb its gone */
1750                         goto out_decr;
1751                 }
1752                 SCTP_STAT_INCR(sctps_timoasconf);
1753 #ifdef SCTP_AUDITING_ENABLED
1754                 sctp_auditing(4, inp, stcb, net);
1755 #endif
1756                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_ASCONF_TMR, SCTP_SO_NOT_LOCKED);
1757                 break;
1758         case SCTP_TIMER_TYPE_PRIM_DELETED:
1759                 if ((stcb == NULL) || (inp == NULL)) {
1760                         break;
1761                 }
1762                 sctp_delete_prim_timer(inp, stcb, net);
1763                 SCTP_STAT_INCR(sctps_timodelprim);
1764                 break;
1765
1766         case SCTP_TIMER_TYPE_AUTOCLOSE:
1767                 if ((stcb == NULL) || (inp == NULL)) {
1768                         break;
1769                 }
1770                 SCTP_STAT_INCR(sctps_timoautoclose);
1771                 sctp_autoclose_timer(inp, stcb, net);
1772                 sctp_chunk_output(inp, stcb, SCTP_OUTPUT_FROM_AUTOCLOSE_TMR, SCTP_SO_NOT_LOCKED);
1773                 did_output = 0;
1774                 break;
1775         case SCTP_TIMER_TYPE_ASOCKILL:
1776                 if ((stcb == NULL) || (inp == NULL)) {
1777                         break;
1778                 }
1779                 SCTP_STAT_INCR(sctps_timoassockill);
1780                 /* Can we free it yet? */
1781                 SCTP_INP_DECR_REF(inp);
1782                 sctp_timer_stop(SCTP_TIMER_TYPE_ASOCKILL, inp, stcb, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_1);
1783 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1784                 so = SCTP_INP_SO(inp);
1785                 atomic_add_int(&stcb->asoc.refcnt, 1);
1786                 SCTP_TCB_UNLOCK(stcb);
1787                 SCTP_SOCKET_LOCK(so, 1);
1788                 SCTP_TCB_LOCK(stcb);
1789                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
1790 #endif
1791                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_2);
1792 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
1793                 SCTP_SOCKET_UNLOCK(so, 1);
1794 #endif
1795                 /*
1796                  * free asoc, always unlocks (or destroy's) so prevent
1797                  * duplicate unlock or unlock of a free mtx :-0
1798                  */
1799                 stcb = NULL;
1800                 goto out_no_decr;
1801         case SCTP_TIMER_TYPE_INPKILL:
1802                 SCTP_STAT_INCR(sctps_timoinpkill);
1803                 if (inp == NULL) {
1804                         break;
1805                 }
1806                 /*
1807                  * special case, take away our increment since WE are the
1808                  * killer
1809                  */
1810                 SCTP_INP_DECR_REF(inp);
1811                 sctp_timer_stop(SCTP_TIMER_TYPE_INPKILL, inp, NULL, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_3);
1812                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
1813                     SCTP_CALLED_FROM_INPKILL_TIMER);
1814                 inp = NULL;
1815                 goto out_no_decr;
1816         default:
1817                 SCTPDBG(SCTP_DEBUG_TIMER1, "sctp_timeout_handler:unknown timer %d\n",
1818                     tmr->type);
1819                 break;
1820         }
1821 #ifdef SCTP_AUDITING_ENABLED
1822         sctp_audit_log(0xF1, (uint8_t) tmr->type);
1823         if (inp)
1824                 sctp_auditing(5, inp, stcb, net);
1825 #endif
1826         if ((did_output) && stcb) {
1827                 /*
1828                  * Now we need to clean up the control chunk chain if an
1829                  * ECNE is on it. It must be marked as UNSENT again so next
1830                  * call will continue to send it until such time that we get
1831                  * a CWR, to remove it. It is, however, less likely that we
1832                  * will find a ecn echo on the chain though.
1833                  */
1834                 sctp_fix_ecn_echo(&stcb->asoc);
1835         }
1836 get_out:
1837         if (stcb) {
1838                 SCTP_TCB_UNLOCK(stcb);
1839         }
1840 out_decr:
1841         if (inp) {
1842                 SCTP_INP_DECR_REF(inp);
1843         }
1844 out_no_decr:
1845         SCTPDBG(SCTP_DEBUG_TIMER1, "Timer now complete (type %d)\n",
1846             type);
1847         CURVNET_RESTORE();
1848 }
1849
1850 void
1851 sctp_timer_start(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
1852     struct sctp_nets *net)
1853 {
1854         uint32_t to_ticks;
1855         struct sctp_timer *tmr;
1856
1857         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) && (inp == NULL))
1858                 return;
1859
1860         tmr = NULL;
1861         if (stcb) {
1862                 SCTP_TCB_LOCK_ASSERT(stcb);
1863         }
1864         switch (t_type) {
1865         case SCTP_TIMER_TYPE_ZERO_COPY:
1866                 tmr = &inp->sctp_ep.zero_copy_timer;
1867                 to_ticks = SCTP_ZERO_COPY_TICK_DELAY;
1868                 break;
1869         case SCTP_TIMER_TYPE_ZCOPY_SENDQ:
1870                 tmr = &inp->sctp_ep.zero_copy_sendq_timer;
1871                 to_ticks = SCTP_ZERO_COPY_SENDQ_TICK_DELAY;
1872                 break;
1873         case SCTP_TIMER_TYPE_ADDR_WQ:
1874                 /* Only 1 tick away :-) */
1875                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
1876                 to_ticks = SCTP_ADDRESS_TICK_DELAY;
1877                 break;
1878         case SCTP_TIMER_TYPE_SEND:
1879                 /* Here we use the RTO timer */
1880                 {
1881                         int rto_val;
1882
1883                         if ((stcb == NULL) || (net == NULL)) {
1884                                 return;
1885                         }
1886                         tmr = &net->rxt_timer;
1887                         if (net->RTO == 0) {
1888                                 rto_val = stcb->asoc.initial_rto;
1889                         } else {
1890                                 rto_val = net->RTO;
1891                         }
1892                         to_ticks = MSEC_TO_TICKS(rto_val);
1893                 }
1894                 break;
1895         case SCTP_TIMER_TYPE_INIT:
1896                 /*
1897                  * Here we use the INIT timer default usually about 1
1898                  * minute.
1899                  */
1900                 if ((stcb == NULL) || (net == NULL)) {
1901                         return;
1902                 }
1903                 tmr = &net->rxt_timer;
1904                 if (net->RTO == 0) {
1905                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1906                 } else {
1907                         to_ticks = MSEC_TO_TICKS(net->RTO);
1908                 }
1909                 break;
1910         case SCTP_TIMER_TYPE_RECV:
1911                 /*
1912                  * Here we use the Delayed-Ack timer value from the inp
1913                  * ususually about 200ms.
1914                  */
1915                 if (stcb == NULL) {
1916                         return;
1917                 }
1918                 tmr = &stcb->asoc.dack_timer;
1919                 to_ticks = MSEC_TO_TICKS(stcb->asoc.delayed_ack);
1920                 break;
1921         case SCTP_TIMER_TYPE_SHUTDOWN:
1922                 /* Here we use the RTO of the destination. */
1923                 if ((stcb == NULL) || (net == NULL)) {
1924                         return;
1925                 }
1926                 if (net->RTO == 0) {
1927                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1928                 } else {
1929                         to_ticks = MSEC_TO_TICKS(net->RTO);
1930                 }
1931                 tmr = &net->rxt_timer;
1932                 break;
1933         case SCTP_TIMER_TYPE_HEARTBEAT:
1934                 /*
1935                  * the net is used here so that we can add in the RTO. Even
1936                  * though we use a different timer. We also add the HB timer
1937                  * PLUS a random jitter.
1938                  */
1939                 if ((inp == NULL) || (stcb == NULL) || (net == NULL)) {
1940                         return;
1941                 } else {
1942                         uint32_t rndval;
1943                         uint32_t jitter;
1944
1945                         if ((net->dest_state & SCTP_ADDR_NOHB) &&
1946                             !(net->dest_state & SCTP_ADDR_UNCONFIRMED)) {
1947                                 return;
1948                         }
1949                         if (net->RTO == 0) {
1950                                 to_ticks = stcb->asoc.initial_rto;
1951                         } else {
1952                                 to_ticks = net->RTO;
1953                         }
1954                         rndval = sctp_select_initial_TSN(&inp->sctp_ep);
1955                         jitter = rndval % to_ticks;
1956                         if (jitter >= (to_ticks >> 1)) {
1957                                 to_ticks = to_ticks + (jitter - (to_ticks >> 1));
1958                         } else {
1959                                 to_ticks = to_ticks - jitter;
1960                         }
1961                         if (!(net->dest_state & SCTP_ADDR_UNCONFIRMED) &&
1962                             !(net->dest_state & SCTP_ADDR_PF)) {
1963                                 to_ticks += net->heart_beat_delay;
1964                         }
1965                         /*
1966                          * Now we must convert the to_ticks that are now in
1967                          * ms to ticks.
1968                          */
1969                         to_ticks = MSEC_TO_TICKS(to_ticks);
1970                         tmr = &net->hb_timer;
1971                 }
1972                 break;
1973         case SCTP_TIMER_TYPE_COOKIE:
1974                 /*
1975                  * Here we can use the RTO timer from the network since one
1976                  * RTT was compelete. If a retran happened then we will be
1977                  * using the RTO initial value.
1978                  */
1979                 if ((stcb == NULL) || (net == NULL)) {
1980                         return;
1981                 }
1982                 if (net->RTO == 0) {
1983                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
1984                 } else {
1985                         to_ticks = MSEC_TO_TICKS(net->RTO);
1986                 }
1987                 tmr = &net->rxt_timer;
1988                 break;
1989         case SCTP_TIMER_TYPE_NEWCOOKIE:
1990                 /*
1991                  * nothing needed but the endpoint here ususually about 60
1992                  * minutes.
1993                  */
1994                 if (inp == NULL) {
1995                         return;
1996                 }
1997                 tmr = &inp->sctp_ep.signature_change;
1998                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_SIGNATURE];
1999                 break;
2000         case SCTP_TIMER_TYPE_ASOCKILL:
2001                 if (stcb == NULL) {
2002                         return;
2003                 }
2004                 tmr = &stcb->asoc.strreset_timer;
2005                 to_ticks = MSEC_TO_TICKS(SCTP_ASOC_KILL_TIMEOUT);
2006                 break;
2007         case SCTP_TIMER_TYPE_INPKILL:
2008                 /*
2009                  * The inp is setup to die. We re-use the signature_chage
2010                  * timer since that has stopped and we are in the GONE
2011                  * state.
2012                  */
2013                 if (inp == NULL) {
2014                         return;
2015                 }
2016                 tmr = &inp->sctp_ep.signature_change;
2017                 to_ticks = MSEC_TO_TICKS(SCTP_INP_KILL_TIMEOUT);
2018                 break;
2019         case SCTP_TIMER_TYPE_PATHMTURAISE:
2020                 /*
2021                  * Here we use the value found in the EP for PMTU ususually
2022                  * about 10 minutes.
2023                  */
2024                 if ((stcb == NULL) || (inp == NULL)) {
2025                         return;
2026                 }
2027                 if (net == NULL) {
2028                         return;
2029                 }
2030                 if (net->dest_state & SCTP_ADDR_NO_PMTUD) {
2031                         return;
2032                 }
2033                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_PMTU];
2034                 tmr = &net->pmtu_timer;
2035                 break;
2036         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2037                 /* Here we use the RTO of the destination */
2038                 if ((stcb == NULL) || (net == NULL)) {
2039                         return;
2040                 }
2041                 if (net->RTO == 0) {
2042                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2043                 } else {
2044                         to_ticks = MSEC_TO_TICKS(net->RTO);
2045                 }
2046                 tmr = &net->rxt_timer;
2047                 break;
2048         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2049                 /*
2050                  * Here we use the endpoints shutdown guard timer usually
2051                  * about 3 minutes.
2052                  */
2053                 if ((inp == NULL) || (stcb == NULL)) {
2054                         return;
2055                 }
2056                 to_ticks = inp->sctp_ep.sctp_timeoutticks[SCTP_TIMER_MAXSHUTDOWN];
2057                 tmr = &stcb->asoc.shut_guard_timer;
2058                 break;
2059         case SCTP_TIMER_TYPE_STRRESET:
2060                 /*
2061                  * Here the timer comes from the stcb but its value is from
2062                  * the net's RTO.
2063                  */
2064                 if ((stcb == NULL) || (net == NULL)) {
2065                         return;
2066                 }
2067                 if (net->RTO == 0) {
2068                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2069                 } else {
2070                         to_ticks = MSEC_TO_TICKS(net->RTO);
2071                 }
2072                 tmr = &stcb->asoc.strreset_timer;
2073                 break;
2074         case SCTP_TIMER_TYPE_ASCONF:
2075                 /*
2076                  * Here the timer comes from the stcb but its value is from
2077                  * the net's RTO.
2078                  */
2079                 if ((stcb == NULL) || (net == NULL)) {
2080                         return;
2081                 }
2082                 if (net->RTO == 0) {
2083                         to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2084                 } else {
2085                         to_ticks = MSEC_TO_TICKS(net->RTO);
2086                 }
2087                 tmr = &stcb->asoc.asconf_timer;
2088                 break;
2089         case SCTP_TIMER_TYPE_PRIM_DELETED:
2090                 if ((stcb == NULL) || (net != NULL)) {
2091                         return;
2092                 }
2093                 to_ticks = MSEC_TO_TICKS(stcb->asoc.initial_rto);
2094                 tmr = &stcb->asoc.delete_prim_timer;
2095                 break;
2096         case SCTP_TIMER_TYPE_AUTOCLOSE:
2097                 if (stcb == NULL) {
2098                         return;
2099                 }
2100                 if (stcb->asoc.sctp_autoclose_ticks == 0) {
2101                         /*
2102                          * Really an error since stcb is NOT set to
2103                          * autoclose
2104                          */
2105                         return;
2106                 }
2107                 to_ticks = stcb->asoc.sctp_autoclose_ticks;
2108                 tmr = &stcb->asoc.autoclose_timer;
2109                 break;
2110         default:
2111                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2112                     __FUNCTION__, t_type);
2113                 return;
2114                 break;
2115         }
2116         if ((to_ticks <= 0) || (tmr == NULL)) {
2117                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: %d:software error to_ticks:%d tmr:%p not set ??\n",
2118                     __FUNCTION__, t_type, to_ticks, tmr);
2119                 return;
2120         }
2121         if (SCTP_OS_TIMER_PENDING(&tmr->timer)) {
2122                 /*
2123                  * we do NOT allow you to have it already running. if it is
2124                  * we leave the current one up unchanged
2125                  */
2126                 return;
2127         }
2128         /* At this point we can proceed */
2129         if (t_type == SCTP_TIMER_TYPE_SEND) {
2130                 stcb->asoc.num_send_timers_up++;
2131         }
2132         tmr->stopped_from = 0;
2133         tmr->type = t_type;
2134         tmr->ep = (void *)inp;
2135         tmr->tcb = (void *)stcb;
2136         tmr->net = (void *)net;
2137         tmr->self = (void *)tmr;
2138         tmr->vnet = (void *)curvnet;
2139         tmr->ticks = sctp_get_tick_count();
2140         (void)SCTP_OS_TIMER_START(&tmr->timer, to_ticks, sctp_timeout_handler, tmr);
2141         return;
2142 }
2143
2144 void
2145 sctp_timer_stop(int t_type, struct sctp_inpcb *inp, struct sctp_tcb *stcb,
2146     struct sctp_nets *net, uint32_t from)
2147 {
2148         struct sctp_timer *tmr;
2149
2150         if ((t_type != SCTP_TIMER_TYPE_ADDR_WQ) &&
2151             (inp == NULL))
2152                 return;
2153
2154         tmr = NULL;
2155         if (stcb) {
2156                 SCTP_TCB_LOCK_ASSERT(stcb);
2157         }
2158         switch (t_type) {
2159         case SCTP_TIMER_TYPE_ZERO_COPY:
2160                 tmr = &inp->sctp_ep.zero_copy_timer;
2161                 break;
2162         case SCTP_TIMER_TYPE_ZCOPY_SENDQ:
2163                 tmr = &inp->sctp_ep.zero_copy_sendq_timer;
2164                 break;
2165         case SCTP_TIMER_TYPE_ADDR_WQ:
2166                 tmr = &SCTP_BASE_INFO(addr_wq_timer);
2167                 break;
2168         case SCTP_TIMER_TYPE_SEND:
2169                 if ((stcb == NULL) || (net == NULL)) {
2170                         return;
2171                 }
2172                 tmr = &net->rxt_timer;
2173                 break;
2174         case SCTP_TIMER_TYPE_INIT:
2175                 if ((stcb == NULL) || (net == NULL)) {
2176                         return;
2177                 }
2178                 tmr = &net->rxt_timer;
2179                 break;
2180         case SCTP_TIMER_TYPE_RECV:
2181                 if (stcb == NULL) {
2182                         return;
2183                 }
2184                 tmr = &stcb->asoc.dack_timer;
2185                 break;
2186         case SCTP_TIMER_TYPE_SHUTDOWN:
2187                 if ((stcb == NULL) || (net == NULL)) {
2188                         return;
2189                 }
2190                 tmr = &net->rxt_timer;
2191                 break;
2192         case SCTP_TIMER_TYPE_HEARTBEAT:
2193                 if ((stcb == NULL) || (net == NULL)) {
2194                         return;
2195                 }
2196                 tmr = &net->hb_timer;
2197                 break;
2198         case SCTP_TIMER_TYPE_COOKIE:
2199                 if ((stcb == NULL) || (net == NULL)) {
2200                         return;
2201                 }
2202                 tmr = &net->rxt_timer;
2203                 break;
2204         case SCTP_TIMER_TYPE_NEWCOOKIE:
2205                 /* nothing needed but the endpoint here */
2206                 tmr = &inp->sctp_ep.signature_change;
2207                 /*
2208                  * We re-use the newcookie timer for the INP kill timer. We
2209                  * must assure that we do not kill it by accident.
2210                  */
2211                 break;
2212         case SCTP_TIMER_TYPE_ASOCKILL:
2213                 /*
2214                  * Stop the asoc kill timer.
2215                  */
2216                 if (stcb == NULL) {
2217                         return;
2218                 }
2219                 tmr = &stcb->asoc.strreset_timer;
2220                 break;
2221
2222         case SCTP_TIMER_TYPE_INPKILL:
2223                 /*
2224                  * The inp is setup to die. We re-use the signature_chage
2225                  * timer since that has stopped and we are in the GONE
2226                  * state.
2227                  */
2228                 tmr = &inp->sctp_ep.signature_change;
2229                 break;
2230         case SCTP_TIMER_TYPE_PATHMTURAISE:
2231                 if ((stcb == NULL) || (net == NULL)) {
2232                         return;
2233                 }
2234                 tmr = &net->pmtu_timer;
2235                 break;
2236         case SCTP_TIMER_TYPE_SHUTDOWNACK:
2237                 if ((stcb == NULL) || (net == NULL)) {
2238                         return;
2239                 }
2240                 tmr = &net->rxt_timer;
2241                 break;
2242         case SCTP_TIMER_TYPE_SHUTDOWNGUARD:
2243                 if (stcb == NULL) {
2244                         return;
2245                 }
2246                 tmr = &stcb->asoc.shut_guard_timer;
2247                 break;
2248         case SCTP_TIMER_TYPE_STRRESET:
2249                 if (stcb == NULL) {
2250                         return;
2251                 }
2252                 tmr = &stcb->asoc.strreset_timer;
2253                 break;
2254         case SCTP_TIMER_TYPE_ASCONF:
2255                 if (stcb == NULL) {
2256                         return;
2257                 }
2258                 tmr = &stcb->asoc.asconf_timer;
2259                 break;
2260         case SCTP_TIMER_TYPE_PRIM_DELETED:
2261                 if (stcb == NULL) {
2262                         return;
2263                 }
2264                 tmr = &stcb->asoc.delete_prim_timer;
2265                 break;
2266         case SCTP_TIMER_TYPE_AUTOCLOSE:
2267                 if (stcb == NULL) {
2268                         return;
2269                 }
2270                 tmr = &stcb->asoc.autoclose_timer;
2271                 break;
2272         default:
2273                 SCTPDBG(SCTP_DEBUG_TIMER1, "%s: Unknown timer type %d\n",
2274                     __FUNCTION__, t_type);
2275                 break;
2276         }
2277         if (tmr == NULL) {
2278                 return;
2279         }
2280         if ((tmr->type != t_type) && tmr->type) {
2281                 /*
2282                  * Ok we have a timer that is under joint use. Cookie timer
2283                  * per chance with the SEND timer. We therefore are NOT
2284                  * running the timer that the caller wants stopped.  So just
2285                  * return.
2286                  */
2287                 return;
2288         }
2289         if ((t_type == SCTP_TIMER_TYPE_SEND) && (stcb != NULL)) {
2290                 stcb->asoc.num_send_timers_up--;
2291                 if (stcb->asoc.num_send_timers_up < 0) {
2292                         stcb->asoc.num_send_timers_up = 0;
2293                 }
2294         }
2295         tmr->self = NULL;
2296         tmr->stopped_from = from;
2297         (void)SCTP_OS_TIMER_STOP(&tmr->timer);
2298         return;
2299 }
2300
2301 uint32_t
2302 sctp_calculate_len(struct mbuf *m)
2303 {
2304         uint32_t tlen = 0;
2305         struct mbuf *at;
2306
2307         at = m;
2308         while (at) {
2309                 tlen += SCTP_BUF_LEN(at);
2310                 at = SCTP_BUF_NEXT(at);
2311         }
2312         return (tlen);
2313 }
2314
2315 void
2316 sctp_mtu_size_reset(struct sctp_inpcb *inp,
2317     struct sctp_association *asoc, uint32_t mtu)
2318 {
2319         /*
2320          * Reset the P-MTU size on this association, this involves changing
2321          * the asoc MTU, going through ANY chunk+overhead larger than mtu to
2322          * allow the DF flag to be cleared.
2323          */
2324         struct sctp_tmit_chunk *chk;
2325         unsigned int eff_mtu, ovh;
2326
2327         asoc->smallest_mtu = mtu;
2328         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
2329                 ovh = SCTP_MIN_OVERHEAD;
2330         } else {
2331                 ovh = SCTP_MIN_V4_OVERHEAD;
2332         }
2333         eff_mtu = mtu - ovh;
2334         TAILQ_FOREACH(chk, &asoc->send_queue, sctp_next) {
2335                 if (chk->send_size > eff_mtu) {
2336                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2337                 }
2338         }
2339         TAILQ_FOREACH(chk, &asoc->sent_queue, sctp_next) {
2340                 if (chk->send_size > eff_mtu) {
2341                         chk->flags |= CHUNK_FLAGS_FRAGMENT_OK;
2342                 }
2343         }
2344 }
2345
2346
2347 /*
2348  * given an association and starting time of the current RTT period return
2349  * RTO in number of msecs net should point to the current network
2350  */
2351
2352 uint32_t
2353 sctp_calculate_rto(struct sctp_tcb *stcb,
2354     struct sctp_association *asoc,
2355     struct sctp_nets *net,
2356     struct timeval *told,
2357     int safe, int rtt_from_sack)
2358 {
2359         /*-
2360          * given an association and the starting time of the current RTT
2361          * period (in value1/value2) return RTO in number of msecs.
2362          */
2363         int32_t rtt;            /* RTT in ms */
2364         uint32_t new_rto;
2365         int first_measure = 0;
2366         struct timeval now, then, *old;
2367
2368         /* Copy it out for sparc64 */
2369         if (safe == sctp_align_unsafe_makecopy) {
2370                 old = &then;
2371                 memcpy(&then, told, sizeof(struct timeval));
2372         } else if (safe == sctp_align_safe_nocopy) {
2373                 old = told;
2374         } else {
2375                 /* error */
2376                 SCTP_PRINTF("Huh, bad rto calc call\n");
2377                 return (0);
2378         }
2379         /************************/
2380         /* 1. calculate new RTT */
2381         /************************/
2382         /* get the current time */
2383         if (stcb->asoc.use_precise_time) {
2384                 (void)SCTP_GETPTIME_TIMEVAL(&now);
2385         } else {
2386                 (void)SCTP_GETTIME_TIMEVAL(&now);
2387         }
2388         timevalsub(&now, old);
2389         /* store the current RTT in us */
2390         net->rtt = (uint64_t) 10000000 *(uint64_t) now.tv_sec +
2391                  (uint64_t) now.tv_usec;
2392
2393         /* computer rtt in ms */
2394         rtt = net->rtt / 1000;
2395         if ((asoc->cc_functions.sctp_rtt_calculated) && (rtt_from_sack == SCTP_RTT_FROM_DATA)) {
2396                 /*
2397                  * Tell the CC module that a new update has just occurred
2398                  * from a sack
2399                  */
2400                 (*asoc->cc_functions.sctp_rtt_calculated) (stcb, net, &now);
2401         }
2402         /*
2403          * Do we need to determine the lan? We do this only on sacks i.e.
2404          * RTT being determined from data not non-data (HB/INIT->INITACK).
2405          */
2406         if ((rtt_from_sack == SCTP_RTT_FROM_DATA) &&
2407             (net->lan_type == SCTP_LAN_UNKNOWN)) {
2408                 if (net->rtt > SCTP_LOCAL_LAN_RTT) {
2409                         net->lan_type = SCTP_LAN_INTERNET;
2410                 } else {
2411                         net->lan_type = SCTP_LAN_LOCAL;
2412                 }
2413         }
2414         /***************************/
2415         /* 2. update RTTVAR & SRTT */
2416         /***************************/
2417         /*-
2418          * Compute the scaled average lastsa and the
2419          * scaled variance lastsv as described in van Jacobson
2420          * Paper "Congestion Avoidance and Control", Annex A.
2421          *
2422          * (net->lastsa >> SCTP_RTT_SHIFT) is the srtt
2423          * (net->lastsa >> SCTP_RTT_VAR_SHIFT) is the rttvar
2424          */
2425         if (net->RTO_measured) {
2426                 rtt -= (net->lastsa >> SCTP_RTT_SHIFT);
2427                 net->lastsa += rtt;
2428                 if (rtt < 0) {
2429                         rtt = -rtt;
2430                 }
2431                 rtt -= (net->lastsv >> SCTP_RTT_VAR_SHIFT);
2432                 net->lastsv += rtt;
2433                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2434                         rto_logging(net, SCTP_LOG_RTTVAR);
2435                 }
2436         } else {
2437                 /* First RTO measurment */
2438                 net->RTO_measured = 1;
2439                 first_measure = 1;
2440                 net->lastsa = rtt << SCTP_RTT_SHIFT;
2441                 net->lastsv = (rtt / 2) << SCTP_RTT_VAR_SHIFT;
2442                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RTTVAR_LOGGING_ENABLE) {
2443                         rto_logging(net, SCTP_LOG_INITIAL_RTT);
2444                 }
2445         }
2446         if (net->lastsv == 0) {
2447                 net->lastsv = SCTP_CLOCK_GRANULARITY;
2448         }
2449         new_rto = (net->lastsa >> SCTP_RTT_SHIFT) + net->lastsv;
2450         if ((new_rto > SCTP_SAT_NETWORK_MIN) &&
2451             (stcb->asoc.sat_network_lockout == 0)) {
2452                 stcb->asoc.sat_network = 1;
2453         } else if ((!first_measure) && stcb->asoc.sat_network) {
2454                 stcb->asoc.sat_network = 0;
2455                 stcb->asoc.sat_network_lockout = 1;
2456         }
2457         /* bound it, per C6/C7 in Section 5.3.1 */
2458         if (new_rto < stcb->asoc.minrto) {
2459                 new_rto = stcb->asoc.minrto;
2460         }
2461         if (new_rto > stcb->asoc.maxrto) {
2462                 new_rto = stcb->asoc.maxrto;
2463         }
2464         /* we are now returning the RTO */
2465         return (new_rto);
2466 }
2467
2468 /*
2469  * return a pointer to a contiguous piece of data from the given mbuf chain
2470  * starting at 'off' for 'len' bytes.  If the desired piece spans more than
2471  * one mbuf, a copy is made at 'ptr'. caller must ensure that the buffer size
2472  * is >= 'len' returns NULL if there there isn't 'len' bytes in the chain.
2473  */
2474 caddr_t
2475 sctp_m_getptr(struct mbuf *m, int off, int len, uint8_t * in_ptr)
2476 {
2477         uint32_t count;
2478         uint8_t *ptr;
2479
2480         ptr = in_ptr;
2481         if ((off < 0) || (len <= 0))
2482                 return (NULL);
2483
2484         /* find the desired start location */
2485         while ((m != NULL) && (off > 0)) {
2486                 if (off < SCTP_BUF_LEN(m))
2487                         break;
2488                 off -= SCTP_BUF_LEN(m);
2489                 m = SCTP_BUF_NEXT(m);
2490         }
2491         if (m == NULL)
2492                 return (NULL);
2493
2494         /* is the current mbuf large enough (eg. contiguous)? */
2495         if ((SCTP_BUF_LEN(m) - off) >= len) {
2496                 return (mtod(m, caddr_t)+off);
2497         } else {
2498                 /* else, it spans more than one mbuf, so save a temp copy... */
2499                 while ((m != NULL) && (len > 0)) {
2500                         count = min(SCTP_BUF_LEN(m) - off, len);
2501                         bcopy(mtod(m, caddr_t)+off, ptr, count);
2502                         len -= count;
2503                         ptr += count;
2504                         off = 0;
2505                         m = SCTP_BUF_NEXT(m);
2506                 }
2507                 if ((m == NULL) && (len > 0))
2508                         return (NULL);
2509                 else
2510                         return ((caddr_t)in_ptr);
2511         }
2512 }
2513
2514
2515
2516 struct sctp_paramhdr *
2517 sctp_get_next_param(struct mbuf *m,
2518     int offset,
2519     struct sctp_paramhdr *pull,
2520     int pull_limit)
2521 {
2522         /* This just provides a typed signature to Peter's Pull routine */
2523         return ((struct sctp_paramhdr *)sctp_m_getptr(m, offset, pull_limit,
2524             (uint8_t *) pull));
2525 }
2526
2527
2528 int
2529 sctp_add_pad_tombuf(struct mbuf *m, int padlen)
2530 {
2531         /*
2532          * add padlen bytes of 0 filled padding to the end of the mbuf. If
2533          * padlen is > 3 this routine will fail.
2534          */
2535         uint8_t *dp;
2536         int i;
2537
2538         if (padlen > 3) {
2539                 SCTP_LTRACE_ERR_RET_PKT(m, NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
2540                 return (ENOBUFS);
2541         }
2542         if (padlen <= M_TRAILINGSPACE(m)) {
2543                 /*
2544                  * The easy way. We hope the majority of the time we hit
2545                  * here :)
2546                  */
2547                 dp = (uint8_t *) (mtod(m, caddr_t)+SCTP_BUF_LEN(m));
2548                 SCTP_BUF_LEN(m) += padlen;
2549         } else {
2550                 /* Hard way we must grow the mbuf */
2551                 struct mbuf *tmp;
2552
2553                 tmp = sctp_get_mbuf_for_msg(padlen, 0, M_DONTWAIT, 1, MT_DATA);
2554                 if (tmp == NULL) {
2555                         /* Out of space GAK! we are in big trouble. */
2556                         SCTP_LTRACE_ERR_RET_PKT(m, NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
2557                         return (ENOBUFS);
2558                 }
2559                 /* setup and insert in middle */
2560                 SCTP_BUF_LEN(tmp) = padlen;
2561                 SCTP_BUF_NEXT(tmp) = NULL;
2562                 SCTP_BUF_NEXT(m) = tmp;
2563                 dp = mtod(tmp, uint8_t *);
2564         }
2565         /* zero out the pad */
2566         for (i = 0; i < padlen; i++) {
2567                 *dp = 0;
2568                 dp++;
2569         }
2570         return (0);
2571 }
2572
2573 int
2574 sctp_pad_lastmbuf(struct mbuf *m, int padval, struct mbuf *last_mbuf)
2575 {
2576         /* find the last mbuf in chain and pad it */
2577         struct mbuf *m_at;
2578
2579         m_at = m;
2580         if (last_mbuf) {
2581                 return (sctp_add_pad_tombuf(last_mbuf, padval));
2582         } else {
2583                 while (m_at) {
2584                         if (SCTP_BUF_NEXT(m_at) == NULL) {
2585                                 return (sctp_add_pad_tombuf(m_at, padval));
2586                         }
2587                         m_at = SCTP_BUF_NEXT(m_at);
2588                 }
2589         }
2590         SCTP_LTRACE_ERR_RET_PKT(m, NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
2591         return (EFAULT);
2592 }
2593
2594 static void
2595 sctp_notify_assoc_change(uint32_t event, struct sctp_tcb *stcb,
2596     uint32_t error, int so_locked
2597 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2598     SCTP_UNUSED
2599 #endif
2600 )
2601 {
2602         struct mbuf *m_notify;
2603         struct sctp_assoc_change *sac;
2604         struct sctp_queued_to_read *control;
2605         unsigned int i;
2606
2607 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2608         struct socket *so;
2609
2610 #endif
2611
2612         /*
2613          * For TCP model AND UDP connected sockets we will send an error up
2614          * when an ABORT comes in.
2615          */
2616         if (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
2617             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) &&
2618             ((event == SCTP_COMM_LOST) || (event == SCTP_CANT_STR_ASSOC))) {
2619                 if (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_COOKIE_WAIT) {
2620                         SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNREFUSED);
2621                         stcb->sctp_socket->so_error = ECONNREFUSED;
2622                 } else {
2623                         SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
2624                         stcb->sctp_socket->so_error = ECONNRESET;
2625                 }
2626                 /* Wake ANY sleepers */
2627 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2628                 so = SCTP_INP_SO(stcb->sctp_ep);
2629                 if (!so_locked) {
2630                         atomic_add_int(&stcb->asoc.refcnt, 1);
2631                         SCTP_TCB_UNLOCK(stcb);
2632                         SCTP_SOCKET_LOCK(so, 1);
2633                         SCTP_TCB_LOCK(stcb);
2634                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
2635                         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2636                                 SCTP_SOCKET_UNLOCK(so, 1);
2637                                 return;
2638                         }
2639                 }
2640 #endif
2641                 socantrcvmore(stcb->sctp_socket);
2642                 sorwakeup(stcb->sctp_socket);
2643                 sowwakeup(stcb->sctp_socket);
2644 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2645                 if (!so_locked) {
2646                         SCTP_SOCKET_UNLOCK(so, 1);
2647                 }
2648 #endif
2649         }
2650         if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVASSOCEVNT)) {
2651                 /* event not enabled */
2652                 return;
2653         }
2654         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_assoc_change), 0, M_DONTWAIT, 1, MT_DATA);
2655         if (m_notify == NULL)
2656                 /* no space left */
2657                 return;
2658         SCTP_BUF_LEN(m_notify) = 0;
2659
2660         sac = mtod(m_notify, struct sctp_assoc_change *);
2661         sac->sac_type = SCTP_ASSOC_CHANGE;
2662         sac->sac_flags = 0;
2663         sac->sac_length = sizeof(struct sctp_assoc_change);
2664         sac->sac_state = event;
2665         sac->sac_error = error;
2666         /* XXX verify these stream counts */
2667         sac->sac_outbound_streams = stcb->asoc.streamoutcnt;
2668         sac->sac_inbound_streams = stcb->asoc.streamincnt;
2669         sac->sac_assoc_id = sctp_get_associd(stcb);
2670         i = 0;
2671         if (stcb->asoc.peer_supports_prsctp) {
2672                 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_PR;
2673         }
2674         if (stcb->asoc.peer_supports_auth) {
2675                 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_AUTH;
2676         }
2677         if (stcb->asoc.peer_supports_asconf) {
2678                 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_ASCONF;
2679         }
2680         sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_MULTIBUF;
2681         if (stcb->asoc.peer_supports_strreset) {
2682                 sac->sac_info[i++] = SCTP_ASSOC_SUPPORTS_RE_CONFIG;
2683         }
2684         sac->sac_length += i;
2685         SCTP_BUF_LEN(m_notify) = sac->sac_length;
2686         SCTP_BUF_NEXT(m_notify) = NULL;
2687         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2688             0, 0, stcb->asoc.context, 0, 0, 0,
2689             m_notify);
2690         if (control == NULL) {
2691                 /* no memory */
2692                 sctp_m_freem(m_notify);
2693                 return;
2694         }
2695         control->length = SCTP_BUF_LEN(m_notify);
2696         /* not that we need this */
2697         control->tail_mbuf = m_notify;
2698         control->spec_flags = M_NOTIFICATION;
2699         sctp_add_to_readq(stcb->sctp_ep, stcb,
2700             control,
2701             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD,
2702             so_locked);
2703         if (event == SCTP_COMM_LOST) {
2704                 /* Wake up any sleeper */
2705 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2706                 so = SCTP_INP_SO(stcb->sctp_ep);
2707                 if (!so_locked) {
2708                         atomic_add_int(&stcb->asoc.refcnt, 1);
2709                         SCTP_TCB_UNLOCK(stcb);
2710                         SCTP_SOCKET_LOCK(so, 1);
2711                         SCTP_TCB_LOCK(stcb);
2712                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
2713                         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
2714                                 SCTP_SOCKET_UNLOCK(so, 1);
2715                                 return;
2716                         }
2717                 }
2718 #endif
2719                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
2720 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
2721                 if (!so_locked) {
2722                         SCTP_SOCKET_UNLOCK(so, 1);
2723                 }
2724 #endif
2725         }
2726 }
2727
2728 static void
2729 sctp_notify_peer_addr_change(struct sctp_tcb *stcb, uint32_t state,
2730     struct sockaddr *sa, uint32_t error)
2731 {
2732         struct mbuf *m_notify;
2733         struct sctp_paddr_change *spc;
2734         struct sctp_queued_to_read *control;
2735
2736         if ((stcb == NULL) ||
2737             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVPADDREVNT)) {
2738                 /* event not enabled */
2739                 return;
2740         }
2741         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_paddr_change), 0, M_DONTWAIT, 1, MT_DATA);
2742         if (m_notify == NULL)
2743                 return;
2744         SCTP_BUF_LEN(m_notify) = 0;
2745         spc = mtod(m_notify, struct sctp_paddr_change *);
2746         spc->spc_type = SCTP_PEER_ADDR_CHANGE;
2747         spc->spc_flags = 0;
2748         spc->spc_length = sizeof(struct sctp_paddr_change);
2749         switch (sa->sa_family) {
2750 #ifdef INET
2751         case AF_INET:
2752                 memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in));
2753                 break;
2754 #endif
2755 #ifdef INET6
2756         case AF_INET6:
2757                 {
2758                         struct sockaddr_in6 *sin6;
2759
2760                         memcpy(&spc->spc_aaddr, sa, sizeof(struct sockaddr_in6));
2761
2762                         sin6 = (struct sockaddr_in6 *)&spc->spc_aaddr;
2763                         if (IN6_IS_SCOPE_LINKLOCAL(&sin6->sin6_addr)) {
2764                                 if (sin6->sin6_scope_id == 0) {
2765                                         /* recover scope_id for user */
2766                                         (void)sa6_recoverscope(sin6);
2767                                 } else {
2768                                         /* clear embedded scope_id for user */
2769                                         in6_clearscope(&sin6->sin6_addr);
2770                                 }
2771                         }
2772                         break;
2773                 }
2774 #endif
2775         default:
2776                 /* TSNH */
2777                 break;
2778         }
2779         spc->spc_state = state;
2780         spc->spc_error = error;
2781         spc->spc_assoc_id = sctp_get_associd(stcb);
2782
2783         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_paddr_change);
2784         SCTP_BUF_NEXT(m_notify) = NULL;
2785
2786         /* append to socket */
2787         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2788             0, 0, stcb->asoc.context, 0, 0, 0,
2789             m_notify);
2790         if (control == NULL) {
2791                 /* no memory */
2792                 sctp_m_freem(m_notify);
2793                 return;
2794         }
2795         control->length = SCTP_BUF_LEN(m_notify);
2796         control->spec_flags = M_NOTIFICATION;
2797         /* not that we need this */
2798         control->tail_mbuf = m_notify;
2799         sctp_add_to_readq(stcb->sctp_ep, stcb,
2800             control,
2801             &stcb->sctp_socket->so_rcv, 1,
2802             SCTP_READ_LOCK_NOT_HELD,
2803             SCTP_SO_NOT_LOCKED);
2804 }
2805
2806
2807 static void
2808 sctp_notify_send_failed(struct sctp_tcb *stcb, uint32_t error,
2809     struct sctp_tmit_chunk *chk, int so_locked
2810 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2811     SCTP_UNUSED
2812 #endif
2813 )
2814 {
2815         struct mbuf *m_notify;
2816         struct sctp_send_failed *ssf;
2817         struct sctp_send_failed_event *ssfe;
2818         struct sctp_queued_to_read *control;
2819         int length;
2820
2821         if ((stcb == NULL) ||
2822             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
2823             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
2824                 /* event not enabled */
2825                 return;
2826         }
2827         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2828                 length = sizeof(struct sctp_send_failed_event);
2829         } else {
2830                 length = sizeof(struct sctp_send_failed);
2831         }
2832         m_notify = sctp_get_mbuf_for_msg(length, 0, M_DONTWAIT, 1, MT_DATA);
2833         if (m_notify == NULL)
2834                 /* no space left */
2835                 return;
2836         length += chk->send_size;
2837         length -= sizeof(struct sctp_data_chunk);
2838         SCTP_BUF_LEN(m_notify) = 0;
2839         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2840                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
2841                 ssfe->ssfe_type = SCTP_SEND_FAILED_EVENT;
2842                 if (error == SCTP_NOTIFY_DATAGRAM_UNSENT)
2843                         ssfe->ssfe_flags = SCTP_DATA_UNSENT;
2844                 else
2845                         ssfe->ssfe_flags = SCTP_DATA_SENT;
2846                 ssfe->ssfe_length = length;
2847                 ssfe->ssfe_error = error;
2848                 /* not exactly what the user sent in, but should be close :) */
2849                 bzero(&ssfe->ssfe_info, sizeof(ssfe->ssfe_info));
2850                 ssfe->ssfe_info.snd_sid = chk->rec.data.stream_number;
2851                 ssfe->ssfe_info.snd_flags = chk->rec.data.rcv_flags;
2852                 ssfe->ssfe_info.snd_ppid = chk->rec.data.payloadtype;
2853                 ssfe->ssfe_info.snd_context = chk->rec.data.context;
2854                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
2855                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
2856                 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed_event);
2857         } else {
2858                 ssf = mtod(m_notify, struct sctp_send_failed *);
2859                 ssf->ssf_type = SCTP_SEND_FAILED;
2860                 if (error == SCTP_NOTIFY_DATAGRAM_UNSENT)
2861                         ssf->ssf_flags = SCTP_DATA_UNSENT;
2862                 else
2863                         ssf->ssf_flags = SCTP_DATA_SENT;
2864                 ssf->ssf_length = length;
2865                 ssf->ssf_error = error;
2866                 /* not exactly what the user sent in, but should be close :) */
2867                 bzero(&ssf->ssf_info, sizeof(ssf->ssf_info));
2868                 ssf->ssf_info.sinfo_stream = chk->rec.data.stream_number;
2869                 ssf->ssf_info.sinfo_ssn = chk->rec.data.stream_seq;
2870                 ssf->ssf_info.sinfo_flags = chk->rec.data.rcv_flags;
2871                 ssf->ssf_info.sinfo_ppid = chk->rec.data.payloadtype;
2872                 ssf->ssf_info.sinfo_context = chk->rec.data.context;
2873                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
2874                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
2875                 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed);
2876         }
2877         if (chk->data) {
2878                 /*
2879                  * trim off the sctp chunk header(it should be there)
2880                  */
2881                 if (chk->send_size >= sizeof(struct sctp_data_chunk)) {
2882                         m_adj(chk->data, sizeof(struct sctp_data_chunk));
2883                         sctp_mbuf_crush(chk->data);
2884                         chk->send_size -= sizeof(struct sctp_data_chunk);
2885                 }
2886         }
2887         SCTP_BUF_NEXT(m_notify) = chk->data;
2888         /* Steal off the mbuf */
2889         chk->data = NULL;
2890         /*
2891          * For this case, we check the actual socket buffer, since the assoc
2892          * is going away we don't want to overfill the socket buffer for a
2893          * non-reader
2894          */
2895         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
2896                 sctp_m_freem(m_notify);
2897                 return;
2898         }
2899         /* append to socket */
2900         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
2901             0, 0, stcb->asoc.context, 0, 0, 0,
2902             m_notify);
2903         if (control == NULL) {
2904                 /* no memory */
2905                 sctp_m_freem(m_notify);
2906                 return;
2907         }
2908         control->spec_flags = M_NOTIFICATION;
2909         sctp_add_to_readq(stcb->sctp_ep, stcb,
2910             control,
2911             &stcb->sctp_socket->so_rcv, 1,
2912             SCTP_READ_LOCK_NOT_HELD,
2913             so_locked);
2914 }
2915
2916
2917 static void
2918 sctp_notify_send_failed2(struct sctp_tcb *stcb, uint32_t error,
2919     struct sctp_stream_queue_pending *sp, int so_locked
2920 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
2921     SCTP_UNUSED
2922 #endif
2923 )
2924 {
2925         struct mbuf *m_notify;
2926         struct sctp_send_failed *ssf;
2927         struct sctp_send_failed_event *ssfe;
2928         struct sctp_queued_to_read *control;
2929         int length;
2930
2931         if ((stcb == NULL) ||
2932             (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSENDFAILEVNT) &&
2933             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT))) {
2934                 /* event not enabled */
2935                 return;
2936         }
2937         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2938                 length = sizeof(struct sctp_send_failed_event);
2939         } else {
2940                 length = sizeof(struct sctp_send_failed);
2941         }
2942         m_notify = sctp_get_mbuf_for_msg(length, 0, M_DONTWAIT, 1, MT_DATA);
2943         if (m_notify == NULL) {
2944                 /* no space left */
2945                 return;
2946         }
2947         length += sp->length;
2948         SCTP_BUF_LEN(m_notify) = 0;
2949         if (sctp_stcb_is_feature_on(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVNSENDFAILEVNT)) {
2950                 ssfe = mtod(m_notify, struct sctp_send_failed_event *);
2951                 ssfe->ssfe_type = SCTP_SEND_FAILED;
2952                 if (error == SCTP_NOTIFY_DATAGRAM_UNSENT)
2953                         ssfe->ssfe_flags = SCTP_DATA_UNSENT;
2954                 else
2955                         ssfe->ssfe_flags = SCTP_DATA_SENT;
2956                 ssfe->ssfe_length = length;
2957                 ssfe->ssfe_error = error;
2958                 /* not exactly what the user sent in, but should be close :) */
2959                 bzero(&ssfe->ssfe_info, sizeof(ssfe->ssfe_info));
2960                 ssfe->ssfe_info.snd_sid = sp->stream;
2961                 if (sp->some_taken) {
2962                         ssfe->ssfe_info.snd_flags = SCTP_DATA_LAST_FRAG;
2963                 } else {
2964                         ssfe->ssfe_info.snd_flags = SCTP_DATA_NOT_FRAG;
2965                 }
2966                 ssfe->ssfe_info.snd_ppid = sp->ppid;
2967                 ssfe->ssfe_info.snd_context = sp->context;
2968                 ssfe->ssfe_info.snd_assoc_id = sctp_get_associd(stcb);
2969                 ssfe->ssfe_assoc_id = sctp_get_associd(stcb);
2970                 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed_event);
2971         } else {
2972                 ssf = mtod(m_notify, struct sctp_send_failed *);
2973                 ssf->ssf_type = SCTP_SEND_FAILED;
2974                 if (error == SCTP_NOTIFY_DATAGRAM_UNSENT)
2975                         ssf->ssf_flags = SCTP_DATA_UNSENT;
2976                 else
2977                         ssf->ssf_flags = SCTP_DATA_SENT;
2978                 ssf->ssf_length = length;
2979                 ssf->ssf_error = error;
2980                 /* not exactly what the user sent in, but should be close :) */
2981                 bzero(&ssf->ssf_info, sizeof(ssf->ssf_info));
2982                 ssf->ssf_info.sinfo_stream = sp->stream;
2983                 ssf->ssf_info.sinfo_ssn = sp->strseq;
2984                 if (sp->some_taken) {
2985                         ssf->ssf_info.sinfo_flags = SCTP_DATA_LAST_FRAG;
2986                 } else {
2987                         ssf->ssf_info.sinfo_flags = SCTP_DATA_NOT_FRAG;
2988                 }
2989                 ssf->ssf_info.sinfo_ppid = sp->ppid;
2990                 ssf->ssf_info.sinfo_context = sp->context;
2991                 ssf->ssf_info.sinfo_assoc_id = sctp_get_associd(stcb);
2992                 ssf->ssf_assoc_id = sctp_get_associd(stcb);
2993                 SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_send_failed);
2994         }
2995         SCTP_BUF_NEXT(m_notify) = sp->data;
2996
2997         /* Steal off the mbuf */
2998         sp->data = NULL;
2999         /*
3000          * For this case, we check the actual socket buffer, since the assoc
3001          * is going away we don't want to overfill the socket buffer for a
3002          * non-reader
3003          */
3004         if (sctp_sbspace_failedmsgs(&stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3005                 sctp_m_freem(m_notify);
3006                 return;
3007         }
3008         /* append to socket */
3009         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3010             0, 0, stcb->asoc.context, 0, 0, 0,
3011             m_notify);
3012         if (control == NULL) {
3013                 /* no memory */
3014                 sctp_m_freem(m_notify);
3015                 return;
3016         }
3017         control->spec_flags = M_NOTIFICATION;
3018         sctp_add_to_readq(stcb->sctp_ep, stcb,
3019             control,
3020             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3021 }
3022
3023
3024
3025 static void
3026 sctp_notify_adaptation_layer(struct sctp_tcb *stcb)
3027 {
3028         struct mbuf *m_notify;
3029         struct sctp_adaptation_event *sai;
3030         struct sctp_queued_to_read *control;
3031
3032         if ((stcb == NULL) ||
3033             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ADAPTATIONEVNT)) {
3034                 /* event not enabled */
3035                 return;
3036         }
3037         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_adaption_event), 0, M_DONTWAIT, 1, MT_DATA);
3038         if (m_notify == NULL)
3039                 /* no space left */
3040                 return;
3041         SCTP_BUF_LEN(m_notify) = 0;
3042         sai = mtod(m_notify, struct sctp_adaptation_event *);
3043         sai->sai_type = SCTP_ADAPTATION_INDICATION;
3044         sai->sai_flags = 0;
3045         sai->sai_length = sizeof(struct sctp_adaptation_event);
3046         sai->sai_adaptation_ind = stcb->asoc.peers_adaptation;
3047         sai->sai_assoc_id = sctp_get_associd(stcb);
3048
3049         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_adaptation_event);
3050         SCTP_BUF_NEXT(m_notify) = NULL;
3051
3052         /* append to socket */
3053         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3054             0, 0, stcb->asoc.context, 0, 0, 0,
3055             m_notify);
3056         if (control == NULL) {
3057                 /* no memory */
3058                 sctp_m_freem(m_notify);
3059                 return;
3060         }
3061         control->length = SCTP_BUF_LEN(m_notify);
3062         control->spec_flags = M_NOTIFICATION;
3063         /* not that we need this */
3064         control->tail_mbuf = m_notify;
3065         sctp_add_to_readq(stcb->sctp_ep, stcb,
3066             control,
3067             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3068 }
3069
3070 /* This always must be called with the read-queue LOCKED in the INP */
3071 static void
3072 sctp_notify_partial_delivery_indication(struct sctp_tcb *stcb, uint32_t error,
3073     uint32_t val, int so_locked
3074 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3075     SCTP_UNUSED
3076 #endif
3077 )
3078 {
3079         struct mbuf *m_notify;
3080         struct sctp_pdapi_event *pdapi;
3081         struct sctp_queued_to_read *control;
3082         struct sockbuf *sb;
3083
3084         if ((stcb == NULL) ||
3085             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_PDAPIEVNT)) {
3086                 /* event not enabled */
3087                 return;
3088         }
3089         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
3090                 return;
3091         }
3092         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_pdapi_event), 0, M_DONTWAIT, 1, MT_DATA);
3093         if (m_notify == NULL)
3094                 /* no space left */
3095                 return;
3096         SCTP_BUF_LEN(m_notify) = 0;
3097         pdapi = mtod(m_notify, struct sctp_pdapi_event *);
3098         pdapi->pdapi_type = SCTP_PARTIAL_DELIVERY_EVENT;
3099         pdapi->pdapi_flags = 0;
3100         pdapi->pdapi_length = sizeof(struct sctp_pdapi_event);
3101         pdapi->pdapi_indication = error;
3102         pdapi->pdapi_stream = (val >> 16);
3103         pdapi->pdapi_seq = (val & 0x0000ffff);
3104         pdapi->pdapi_assoc_id = sctp_get_associd(stcb);
3105
3106         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_pdapi_event);
3107         SCTP_BUF_NEXT(m_notify) = NULL;
3108         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3109             0, 0, stcb->asoc.context, 0, 0, 0,
3110             m_notify);
3111         if (control == NULL) {
3112                 /* no memory */
3113                 sctp_m_freem(m_notify);
3114                 return;
3115         }
3116         control->spec_flags = M_NOTIFICATION;
3117         control->length = SCTP_BUF_LEN(m_notify);
3118         /* not that we need this */
3119         control->tail_mbuf = m_notify;
3120         control->held_length = 0;
3121         control->length = 0;
3122         sb = &stcb->sctp_socket->so_rcv;
3123         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3124                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m_notify));
3125         }
3126         sctp_sballoc(stcb, sb, m_notify);
3127         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
3128                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
3129         }
3130         atomic_add_int(&control->length, SCTP_BUF_LEN(m_notify));
3131         control->end_added = 1;
3132         if (stcb->asoc.control_pdapi)
3133                 TAILQ_INSERT_AFTER(&stcb->sctp_ep->read_queue, stcb->asoc.control_pdapi, control, next);
3134         else {
3135                 /* we really should not see this case */
3136                 TAILQ_INSERT_TAIL(&stcb->sctp_ep->read_queue, control, next);
3137         }
3138         if (stcb->sctp_ep && stcb->sctp_socket) {
3139                 /* This should always be the case */
3140 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3141                 struct socket *so;
3142
3143                 so = SCTP_INP_SO(stcb->sctp_ep);
3144                 if (!so_locked) {
3145                         atomic_add_int(&stcb->asoc.refcnt, 1);
3146                         SCTP_TCB_UNLOCK(stcb);
3147                         SCTP_SOCKET_LOCK(so, 1);
3148                         SCTP_TCB_LOCK(stcb);
3149                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
3150                         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3151                                 SCTP_SOCKET_UNLOCK(so, 1);
3152                                 return;
3153                         }
3154                 }
3155 #endif
3156                 sctp_sorwakeup(stcb->sctp_ep, stcb->sctp_socket);
3157 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3158                 if (!so_locked) {
3159                         SCTP_SOCKET_UNLOCK(so, 1);
3160                 }
3161 #endif
3162         }
3163 }
3164
3165 static void
3166 sctp_notify_shutdown_event(struct sctp_tcb *stcb)
3167 {
3168         struct mbuf *m_notify;
3169         struct sctp_shutdown_event *sse;
3170         struct sctp_queued_to_read *control;
3171
3172         /*
3173          * For TCP model AND UDP connected sockets we will send an error up
3174          * when an SHUTDOWN completes
3175          */
3176         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
3177             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
3178                 /* mark socket closed for read/write and wakeup! */
3179 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3180                 struct socket *so;
3181
3182                 so = SCTP_INP_SO(stcb->sctp_ep);
3183                 atomic_add_int(&stcb->asoc.refcnt, 1);
3184                 SCTP_TCB_UNLOCK(stcb);
3185                 SCTP_SOCKET_LOCK(so, 1);
3186                 SCTP_TCB_LOCK(stcb);
3187                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3188                 if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
3189                         SCTP_SOCKET_UNLOCK(so, 1);
3190                         return;
3191                 }
3192 #endif
3193                 socantsendmore(stcb->sctp_socket);
3194 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3195                 SCTP_SOCKET_UNLOCK(so, 1);
3196 #endif
3197         }
3198         if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_RECVSHUTDOWNEVNT)) {
3199                 /* event not enabled */
3200                 return;
3201         }
3202         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_shutdown_event), 0, M_DONTWAIT, 1, MT_DATA);
3203         if (m_notify == NULL)
3204                 /* no space left */
3205                 return;
3206         sse = mtod(m_notify, struct sctp_shutdown_event *);
3207         sse->sse_type = SCTP_SHUTDOWN_EVENT;
3208         sse->sse_flags = 0;
3209         sse->sse_length = sizeof(struct sctp_shutdown_event);
3210         sse->sse_assoc_id = sctp_get_associd(stcb);
3211
3212         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_shutdown_event);
3213         SCTP_BUF_NEXT(m_notify) = NULL;
3214
3215         /* append to socket */
3216         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3217             0, 0, stcb->asoc.context, 0, 0, 0,
3218             m_notify);
3219         if (control == NULL) {
3220                 /* no memory */
3221                 sctp_m_freem(m_notify);
3222                 return;
3223         }
3224         control->spec_flags = M_NOTIFICATION;
3225         control->length = SCTP_BUF_LEN(m_notify);
3226         /* not that we need this */
3227         control->tail_mbuf = m_notify;
3228         sctp_add_to_readq(stcb->sctp_ep, stcb,
3229             control,
3230             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3231 }
3232
3233 static void
3234 sctp_notify_sender_dry_event(struct sctp_tcb *stcb,
3235     int so_locked
3236 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3237     SCTP_UNUSED
3238 #endif
3239 )
3240 {
3241         struct mbuf *m_notify;
3242         struct sctp_sender_dry_event *event;
3243         struct sctp_queued_to_read *control;
3244
3245         if ((stcb == NULL) ||
3246             sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_DRYEVNT)) {
3247                 /* event not enabled */
3248                 return;
3249         }
3250         m_notify = sctp_get_mbuf_for_msg(sizeof(struct sctp_sender_dry_event), 0, M_DONTWAIT, 1, MT_DATA);
3251         if (m_notify == NULL) {
3252                 /* no space left */
3253                 return;
3254         }
3255         SCTP_BUF_LEN(m_notify) = 0;
3256         event = mtod(m_notify, struct sctp_sender_dry_event *);
3257         event->sender_dry_type = SCTP_SENDER_DRY_EVENT;
3258         event->sender_dry_flags = 0;
3259         event->sender_dry_length = sizeof(struct sctp_sender_dry_event);
3260         event->sender_dry_assoc_id = sctp_get_associd(stcb);
3261
3262         SCTP_BUF_LEN(m_notify) = sizeof(struct sctp_sender_dry_event);
3263         SCTP_BUF_NEXT(m_notify) = NULL;
3264
3265         /* append to socket */
3266         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3267             0, 0, stcb->asoc.context, 0, 0, 0,
3268             m_notify);
3269         if (control == NULL) {
3270                 /* no memory */
3271                 sctp_m_freem(m_notify);
3272                 return;
3273         }
3274         control->length = SCTP_BUF_LEN(m_notify);
3275         control->spec_flags = M_NOTIFICATION;
3276         /* not that we need this */
3277         control->tail_mbuf = m_notify;
3278         sctp_add_to_readq(stcb->sctp_ep, stcb, control,
3279             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, so_locked);
3280 }
3281
3282
3283 void
3284 sctp_notify_stream_reset_add(struct sctp_tcb *stcb, uint16_t numberin, uint16_t numberout, int flag)
3285 {
3286         struct mbuf *m_notify;
3287         struct sctp_queued_to_read *control;
3288         struct sctp_stream_change_event *stradd;
3289         int len;
3290
3291         if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_CHANGEEVNT)) {
3292                 /* event not enabled */
3293                 return;
3294         }
3295         if ((stcb->asoc.peer_req_out) && flag) {
3296                 /* Peer made the request, don't tell the local user */
3297                 stcb->asoc.peer_req_out = 0;
3298                 return;
3299         }
3300         stcb->asoc.peer_req_out = 0;
3301         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
3302         if (m_notify == NULL)
3303                 /* no space left */
3304                 return;
3305         SCTP_BUF_LEN(m_notify) = 0;
3306         len = sizeof(struct sctp_stream_change_event);
3307         if (len > M_TRAILINGSPACE(m_notify)) {
3308                 /* never enough room */
3309                 sctp_m_freem(m_notify);
3310                 return;
3311         }
3312         stradd = mtod(m_notify, struct sctp_stream_change_event *);
3313         stradd->strchange_type = SCTP_STREAM_CHANGE_EVENT;
3314         stradd->strchange_flags = flag;
3315         stradd->strchange_length = len;
3316         stradd->strchange_assoc_id = sctp_get_associd(stcb);
3317         stradd->strchange_instrms = numberin;
3318         stradd->strchange_outstrms = numberout;
3319         SCTP_BUF_LEN(m_notify) = len;
3320         SCTP_BUF_NEXT(m_notify) = NULL;
3321         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3322                 /* no space */
3323                 sctp_m_freem(m_notify);
3324                 return;
3325         }
3326         /* append to socket */
3327         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3328             0, 0, stcb->asoc.context, 0, 0, 0,
3329             m_notify);
3330         if (control == NULL) {
3331                 /* no memory */
3332                 sctp_m_freem(m_notify);
3333                 return;
3334         }
3335         control->spec_flags = M_NOTIFICATION;
3336         control->length = SCTP_BUF_LEN(m_notify);
3337         /* not that we need this */
3338         control->tail_mbuf = m_notify;
3339         sctp_add_to_readq(stcb->sctp_ep, stcb,
3340             control,
3341             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3342 }
3343
3344 void
3345 sctp_notify_stream_reset_tsn(struct sctp_tcb *stcb, uint32_t sending_tsn, uint32_t recv_tsn, int flag)
3346 {
3347         struct mbuf *m_notify;
3348         struct sctp_queued_to_read *control;
3349         struct sctp_assoc_reset_event *strasoc;
3350         int len;
3351
3352         if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_ASSOC_RESETEVNT)) {
3353                 /* event not enabled */
3354                 return;
3355         }
3356         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
3357         if (m_notify == NULL)
3358                 /* no space left */
3359                 return;
3360         SCTP_BUF_LEN(m_notify) = 0;
3361         len = sizeof(struct sctp_assoc_reset_event);
3362         if (len > M_TRAILINGSPACE(m_notify)) {
3363                 /* never enough room */
3364                 sctp_m_freem(m_notify);
3365                 return;
3366         }
3367         strasoc = mtod(m_notify, struct sctp_assoc_reset_event *);
3368         strasoc->assocreset_type = SCTP_ASSOC_RESET_EVENT;
3369         strasoc->assocreset_flags = flag;
3370         strasoc->assocreset_length = len;
3371         strasoc->assocreset_assoc_id = sctp_get_associd(stcb);
3372         strasoc->assocreset_local_tsn = sending_tsn;
3373         strasoc->assocreset_remote_tsn = recv_tsn;
3374         SCTP_BUF_LEN(m_notify) = len;
3375         SCTP_BUF_NEXT(m_notify) = NULL;
3376         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3377                 /* no space */
3378                 sctp_m_freem(m_notify);
3379                 return;
3380         }
3381         /* append to socket */
3382         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3383             0, 0, stcb->asoc.context, 0, 0, 0,
3384             m_notify);
3385         if (control == NULL) {
3386                 /* no memory */
3387                 sctp_m_freem(m_notify);
3388                 return;
3389         }
3390         control->spec_flags = M_NOTIFICATION;
3391         control->length = SCTP_BUF_LEN(m_notify);
3392         /* not that we need this */
3393         control->tail_mbuf = m_notify;
3394         sctp_add_to_readq(stcb->sctp_ep, stcb,
3395             control,
3396             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3397 }
3398
3399
3400
3401 static void
3402 sctp_notify_stream_reset(struct sctp_tcb *stcb,
3403     int number_entries, uint16_t * list, int flag)
3404 {
3405         struct mbuf *m_notify;
3406         struct sctp_queued_to_read *control;
3407         struct sctp_stream_reset_event *strreset;
3408         int len;
3409
3410         if (sctp_stcb_is_feature_off(stcb->sctp_ep, stcb, SCTP_PCB_FLAGS_STREAM_RESETEVNT)) {
3411                 /* event not enabled */
3412                 return;
3413         }
3414         m_notify = sctp_get_mbuf_for_msg(MCLBYTES, 0, M_DONTWAIT, 1, MT_DATA);
3415         if (m_notify == NULL)
3416                 /* no space left */
3417                 return;
3418         SCTP_BUF_LEN(m_notify) = 0;
3419         len = sizeof(struct sctp_stream_reset_event) + (number_entries * sizeof(uint16_t));
3420         if (len > M_TRAILINGSPACE(m_notify)) {
3421                 /* never enough room */
3422                 sctp_m_freem(m_notify);
3423                 return;
3424         }
3425         strreset = mtod(m_notify, struct sctp_stream_reset_event *);
3426         strreset->strreset_type = SCTP_STREAM_RESET_EVENT;
3427         strreset->strreset_flags = flag;
3428         strreset->strreset_length = len;
3429         strreset->strreset_assoc_id = sctp_get_associd(stcb);
3430         if (number_entries) {
3431                 int i;
3432
3433                 for (i = 0; i < number_entries; i++) {
3434                         strreset->strreset_stream_list[i] = ntohs(list[i]);
3435                 }
3436         }
3437         SCTP_BUF_LEN(m_notify) = len;
3438         SCTP_BUF_NEXT(m_notify) = NULL;
3439         if (sctp_sbspace(&stcb->asoc, &stcb->sctp_socket->so_rcv) < SCTP_BUF_LEN(m_notify)) {
3440                 /* no space */
3441                 sctp_m_freem(m_notify);
3442                 return;
3443         }
3444         /* append to socket */
3445         control = sctp_build_readq_entry(stcb, stcb->asoc.primary_destination,
3446             0, 0, stcb->asoc.context, 0, 0, 0,
3447             m_notify);
3448         if (control == NULL) {
3449                 /* no memory */
3450                 sctp_m_freem(m_notify);
3451                 return;
3452         }
3453         control->spec_flags = M_NOTIFICATION;
3454         control->length = SCTP_BUF_LEN(m_notify);
3455         /* not that we need this */
3456         control->tail_mbuf = m_notify;
3457         sctp_add_to_readq(stcb->sctp_ep, stcb,
3458             control,
3459             &stcb->sctp_socket->so_rcv, 1, SCTP_READ_LOCK_NOT_HELD, SCTP_SO_NOT_LOCKED);
3460 }
3461
3462
3463 void
3464 sctp_ulp_notify(uint32_t notification, struct sctp_tcb *stcb,
3465     uint32_t error, void *data, int so_locked
3466 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3467     SCTP_UNUSED
3468 #endif
3469 )
3470 {
3471         if ((stcb == NULL) ||
3472             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3473             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3474             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3475                 /* If the socket is gone we are out of here */
3476                 return;
3477         }
3478         if (stcb->sctp_socket->so_rcv.sb_state & SBS_CANTRCVMORE) {
3479                 return;
3480         }
3481         if (stcb && ((stcb->asoc.state & SCTP_STATE_COOKIE_WAIT) ||
3482             (stcb->asoc.state & SCTP_STATE_COOKIE_ECHOED))) {
3483                 if ((notification == SCTP_NOTIFY_INTERFACE_DOWN) ||
3484                     (notification == SCTP_NOTIFY_INTERFACE_UP) ||
3485                     (notification == SCTP_NOTIFY_INTERFACE_CONFIRMED)) {
3486                         /* Don't report these in front states */
3487                         return;
3488                 }
3489         }
3490         switch (notification) {
3491         case SCTP_NOTIFY_ASSOC_UP:
3492                 if (stcb->asoc.assoc_up_sent == 0) {
3493                         sctp_notify_assoc_change(SCTP_COMM_UP, stcb, error, so_locked);
3494                         stcb->asoc.assoc_up_sent = 1;
3495                 }
3496                 if (stcb->asoc.adaptation_needed && (stcb->asoc.adaptation_sent == 0)) {
3497                         sctp_notify_adaptation_layer(stcb);
3498                 }
3499                 if (stcb->asoc.peer_supports_auth == 0) {
3500                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3501                             NULL, so_locked);
3502                 }
3503                 break;
3504         case SCTP_NOTIFY_ASSOC_DOWN:
3505                 sctp_notify_assoc_change(SCTP_SHUTDOWN_COMP, stcb, error, so_locked);
3506                 break;
3507         case SCTP_NOTIFY_INTERFACE_DOWN:
3508                 {
3509                         struct sctp_nets *net;
3510
3511                         net = (struct sctp_nets *)data;
3512                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_UNREACHABLE,
3513                             (struct sockaddr *)&net->ro._l_addr, error);
3514                         break;
3515                 }
3516         case SCTP_NOTIFY_INTERFACE_UP:
3517                 {
3518                         struct sctp_nets *net;
3519
3520                         net = (struct sctp_nets *)data;
3521                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_AVAILABLE,
3522                             (struct sockaddr *)&net->ro._l_addr, error);
3523                         break;
3524                 }
3525         case SCTP_NOTIFY_INTERFACE_CONFIRMED:
3526                 {
3527                         struct sctp_nets *net;
3528
3529                         net = (struct sctp_nets *)data;
3530                         sctp_notify_peer_addr_change(stcb, SCTP_ADDR_CONFIRMED,
3531                             (struct sockaddr *)&net->ro._l_addr, error);
3532                         break;
3533                 }
3534         case SCTP_NOTIFY_SPECIAL_SP_FAIL:
3535                 sctp_notify_send_failed2(stcb, error,
3536                     (struct sctp_stream_queue_pending *)data, so_locked);
3537                 break;
3538         case SCTP_NOTIFY_DG_FAIL:
3539                 sctp_notify_send_failed(stcb, error,
3540                     (struct sctp_tmit_chunk *)data, so_locked);
3541                 break;
3542         case SCTP_NOTIFY_PARTIAL_DELVIERY_INDICATION:
3543                 {
3544                         uint32_t val;
3545
3546                         val = *((uint32_t *) data);
3547
3548                         sctp_notify_partial_delivery_indication(stcb, error, val, so_locked);
3549                         break;
3550                 }
3551         case SCTP_NOTIFY_STRDATA_ERR:
3552                 break;
3553         case SCTP_NOTIFY_ASSOC_ABORTED:
3554                 if ((stcb) && (((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_WAIT) ||
3555                     ((stcb->asoc.state & SCTP_STATE_MASK) == SCTP_STATE_COOKIE_ECHOED))) {
3556                         sctp_notify_assoc_change(SCTP_CANT_STR_ASSOC, stcb, error, so_locked);
3557                 } else {
3558                         sctp_notify_assoc_change(SCTP_COMM_LOST, stcb, error, so_locked);
3559                 }
3560                 break;
3561         case SCTP_NOTIFY_PEER_OPENED_STREAM:
3562                 break;
3563         case SCTP_NOTIFY_STREAM_OPENED_OK:
3564                 break;
3565         case SCTP_NOTIFY_ASSOC_RESTART:
3566                 sctp_notify_assoc_change(SCTP_RESTART, stcb, error, so_locked);
3567                 if (stcb->asoc.peer_supports_auth == 0) {
3568                         sctp_ulp_notify(SCTP_NOTIFY_NO_PEER_AUTH, stcb, 0,
3569                             NULL, so_locked);
3570                 }
3571                 break;
3572         case SCTP_NOTIFY_HB_RESP:
3573                 break;
3574         case SCTP_NOTIFY_STR_RESET_SEND:
3575                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STREAM_RESET_OUTGOING_SSN);
3576                 break;
3577         case SCTP_NOTIFY_STR_RESET_RECV:
3578                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data), SCTP_STREAM_RESET_INCOMING);
3579                 break;
3580         case SCTP_NOTIFY_STR_RESET_FAILED_OUT:
3581                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3582                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_FAILED));
3583                 break;
3584         case SCTP_NOTIFY_STR_RESET_DENIED_OUT:
3585                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3586                     (SCTP_STREAM_RESET_OUTGOING_SSN | SCTP_STREAM_RESET_DENIED));
3587                 break;
3588         case SCTP_NOTIFY_STR_RESET_FAILED_IN:
3589                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3590                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_FAILED));
3591                 break;
3592         case SCTP_NOTIFY_STR_RESET_DENIED_IN:
3593                 sctp_notify_stream_reset(stcb, error, ((uint16_t *) data),
3594                     (SCTP_STREAM_RESET_INCOMING | SCTP_STREAM_RESET_DENIED));
3595                 break;
3596         case SCTP_NOTIFY_ASCONF_ADD_IP:
3597                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_ADDED, data,
3598                     error);
3599                 break;
3600         case SCTP_NOTIFY_ASCONF_DELETE_IP:
3601                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_REMOVED, data,
3602                     error);
3603                 break;
3604         case SCTP_NOTIFY_ASCONF_SET_PRIMARY:
3605                 sctp_notify_peer_addr_change(stcb, SCTP_ADDR_MADE_PRIM, data,
3606                     error);
3607                 break;
3608         case SCTP_NOTIFY_ASCONF_SUCCESS:
3609                 break;
3610         case SCTP_NOTIFY_ASCONF_FAILED:
3611                 break;
3612         case SCTP_NOTIFY_PEER_SHUTDOWN:
3613                 sctp_notify_shutdown_event(stcb);
3614                 break;
3615         case SCTP_NOTIFY_AUTH_NEW_KEY:
3616                 sctp_notify_authentication(stcb, SCTP_AUTH_NEW_KEY, error,
3617                     (uint16_t) (uintptr_t) data,
3618                     so_locked);
3619                 break;
3620         case SCTP_NOTIFY_AUTH_FREE_KEY:
3621                 sctp_notify_authentication(stcb, SCTP_AUTH_FREE_KEY, error,
3622                     (uint16_t) (uintptr_t) data,
3623                     so_locked);
3624                 break;
3625         case SCTP_NOTIFY_NO_PEER_AUTH:
3626                 sctp_notify_authentication(stcb, SCTP_AUTH_NO_AUTH, error,
3627                     (uint16_t) (uintptr_t) data,
3628                     so_locked);
3629                 break;
3630         case SCTP_NOTIFY_SENDER_DRY:
3631                 sctp_notify_sender_dry_event(stcb, so_locked);
3632                 break;
3633         default:
3634                 SCTPDBG(SCTP_DEBUG_UTIL1, "%s: unknown notification %xh (%u)\n",
3635                     __FUNCTION__, notification, notification);
3636                 break;
3637         }                       /* end switch */
3638 }
3639
3640 void
3641 sctp_report_all_outbound(struct sctp_tcb *stcb, int holds_lock, int so_locked
3642 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3643     SCTP_UNUSED
3644 #endif
3645 )
3646 {
3647         struct sctp_association *asoc;
3648         struct sctp_stream_out *outs;
3649         struct sctp_tmit_chunk *chk, *nchk;
3650         struct sctp_stream_queue_pending *sp, *nsp;
3651         int i;
3652
3653         if (stcb == NULL) {
3654                 return;
3655         }
3656         asoc = &stcb->asoc;
3657         if (asoc->state & SCTP_STATE_ABOUT_TO_BE_FREED) {
3658                 /* already being freed */
3659                 return;
3660         }
3661         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3662             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3663             (asoc->state & SCTP_STATE_CLOSED_SOCKET)) {
3664                 return;
3665         }
3666         /* now through all the gunk freeing chunks */
3667         if (holds_lock == 0) {
3668                 SCTP_TCB_SEND_LOCK(stcb);
3669         }
3670         /* sent queue SHOULD be empty */
3671         TAILQ_FOREACH_SAFE(chk, &asoc->sent_queue, sctp_next, nchk) {
3672                 TAILQ_REMOVE(&asoc->sent_queue, chk, sctp_next);
3673                 asoc->sent_queue_cnt--;
3674                 if (chk->data != NULL) {
3675                         sctp_free_bufspace(stcb, asoc, chk, 1);
3676                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
3677                             SCTP_NOTIFY_DATAGRAM_SENT, chk, so_locked);
3678                         if (chk->data) {
3679                                 sctp_m_freem(chk->data);
3680                                 chk->data = NULL;
3681                         }
3682                 }
3683                 sctp_free_a_chunk(stcb, chk, so_locked);
3684                 /* sa_ignore FREED_MEMORY */
3685         }
3686         /* pending send queue SHOULD be empty */
3687         TAILQ_FOREACH_SAFE(chk, &asoc->send_queue, sctp_next, nchk) {
3688                 TAILQ_REMOVE(&asoc->send_queue, chk, sctp_next);
3689                 asoc->send_queue_cnt--;
3690                 if (chk->data != NULL) {
3691                         sctp_free_bufspace(stcb, asoc, chk, 1);
3692                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb,
3693                             SCTP_NOTIFY_DATAGRAM_UNSENT, chk, so_locked);
3694                         if (chk->data) {
3695                                 sctp_m_freem(chk->data);
3696                                 chk->data = NULL;
3697                         }
3698                 }
3699                 sctp_free_a_chunk(stcb, chk, so_locked);
3700                 /* sa_ignore FREED_MEMORY */
3701         }
3702         for (i = 0; i < asoc->streamoutcnt; i++) {
3703                 /* For each stream */
3704                 outs = &asoc->strmout[i];
3705                 /* clean up any sends there */
3706                 asoc->locked_on_sending = NULL;
3707                 TAILQ_FOREACH_SAFE(sp, &outs->outqueue, next, nsp) {
3708                         asoc->stream_queue_cnt--;
3709                         TAILQ_REMOVE(&outs->outqueue, sp, next);
3710                         sctp_free_spbufspace(stcb, asoc, sp);
3711                         if (sp->data) {
3712                                 sctp_ulp_notify(SCTP_NOTIFY_SPECIAL_SP_FAIL, stcb,
3713                                     SCTP_NOTIFY_DATAGRAM_UNSENT, (void *)sp, so_locked);
3714                                 if (sp->data) {
3715                                         sctp_m_freem(sp->data);
3716                                         sp->data = NULL;
3717                                 }
3718                         }
3719                         if (sp->net) {
3720                                 sctp_free_remote_addr(sp->net);
3721                                 sp->net = NULL;
3722                         }
3723                         /* Free the chunk */
3724                         sctp_free_a_strmoq(stcb, sp, so_locked);
3725                         /* sa_ignore FREED_MEMORY */
3726                 }
3727         }
3728
3729         if (holds_lock == 0) {
3730                 SCTP_TCB_SEND_UNLOCK(stcb);
3731         }
3732 }
3733
3734 void
3735 sctp_abort_notification(struct sctp_tcb *stcb, int error, int so_locked
3736 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3737     SCTP_UNUSED
3738 #endif
3739 )
3740 {
3741         if (stcb == NULL) {
3742                 return;
3743         }
3744         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL) ||
3745             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) &&
3746             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_CONNECTED))) {
3747                 stcb->sctp_ep->sctp_flags |= SCTP_PCB_FLAGS_WAS_ABORTED;
3748         }
3749         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
3750             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE) ||
3751             (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET)) {
3752                 return;
3753         }
3754         /* Tell them we lost the asoc */
3755         sctp_report_all_outbound(stcb, 1, so_locked);
3756         sctp_ulp_notify(SCTP_NOTIFY_ASSOC_ABORTED, stcb, error, NULL, so_locked);
3757 }
3758
3759 void
3760 sctp_abort_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3761     struct mbuf *m, int iphlen, struct sctphdr *sh, struct mbuf *op_err,
3762     uint32_t vrf_id, uint16_t port)
3763 {
3764         uint32_t vtag;
3765
3766 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3767         struct socket *so;
3768
3769 #endif
3770
3771         vtag = 0;
3772         if (stcb != NULL) {
3773                 /* We have a TCB to abort, send notification too */
3774                 vtag = stcb->asoc.peer_vtag;
3775                 sctp_abort_notification(stcb, 0, SCTP_SO_NOT_LOCKED);
3776                 /* get the assoc vrf id and table id */
3777                 vrf_id = stcb->asoc.vrf_id;
3778                 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
3779         }
3780         sctp_send_abort(m, iphlen, sh, vtag, op_err, vrf_id, port);
3781         if (stcb != NULL) {
3782                 /* Ok, now lets free it */
3783 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3784                 so = SCTP_INP_SO(inp);
3785                 atomic_add_int(&stcb->asoc.refcnt, 1);
3786                 SCTP_TCB_UNLOCK(stcb);
3787                 SCTP_SOCKET_LOCK(so, 1);
3788                 SCTP_TCB_LOCK(stcb);
3789                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3790 #endif
3791                 SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3792                 if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
3793                     (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3794                         SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3795                 }
3796                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_4);
3797 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3798                 SCTP_SOCKET_UNLOCK(so, 1);
3799 #endif
3800         }
3801 }
3802
3803 #ifdef SCTP_ASOCLOG_OF_TSNS
3804 void
3805 sctp_print_out_track_log(struct sctp_tcb *stcb)
3806 {
3807 #ifdef NOSIY_PRINTS
3808         int i;
3809
3810         SCTP_PRINTF("Last ep reason:%x\n", stcb->sctp_ep->last_abort_code);
3811         SCTP_PRINTF("IN bound TSN log-aaa\n");
3812         if ((stcb->asoc.tsn_in_at == 0) && (stcb->asoc.tsn_in_wrapped == 0)) {
3813                 SCTP_PRINTF("None rcvd\n");
3814                 goto none_in;
3815         }
3816         if (stcb->asoc.tsn_in_wrapped) {
3817                 for (i = stcb->asoc.tsn_in_at; i < SCTP_TSN_LOG_SIZE; i++) {
3818                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3819                             stcb->asoc.in_tsnlog[i].tsn,
3820                             stcb->asoc.in_tsnlog[i].strm,
3821                             stcb->asoc.in_tsnlog[i].seq,
3822                             stcb->asoc.in_tsnlog[i].flgs,
3823                             stcb->asoc.in_tsnlog[i].sz);
3824                 }
3825         }
3826         if (stcb->asoc.tsn_in_at) {
3827                 for (i = 0; i < stcb->asoc.tsn_in_at; i++) {
3828                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3829                             stcb->asoc.in_tsnlog[i].tsn,
3830                             stcb->asoc.in_tsnlog[i].strm,
3831                             stcb->asoc.in_tsnlog[i].seq,
3832                             stcb->asoc.in_tsnlog[i].flgs,
3833                             stcb->asoc.in_tsnlog[i].sz);
3834                 }
3835         }
3836 none_in:
3837         SCTP_PRINTF("OUT bound TSN log-aaa\n");
3838         if ((stcb->asoc.tsn_out_at == 0) &&
3839             (stcb->asoc.tsn_out_wrapped == 0)) {
3840                 SCTP_PRINTF("None sent\n");
3841         }
3842         if (stcb->asoc.tsn_out_wrapped) {
3843                 for (i = stcb->asoc.tsn_out_at; i < SCTP_TSN_LOG_SIZE; i++) {
3844                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3845                             stcb->asoc.out_tsnlog[i].tsn,
3846                             stcb->asoc.out_tsnlog[i].strm,
3847                             stcb->asoc.out_tsnlog[i].seq,
3848                             stcb->asoc.out_tsnlog[i].flgs,
3849                             stcb->asoc.out_tsnlog[i].sz);
3850                 }
3851         }
3852         if (stcb->asoc.tsn_out_at) {
3853                 for (i = 0; i < stcb->asoc.tsn_out_at; i++) {
3854                         SCTP_PRINTF("TSN:%x strm:%d seq:%d flags:%x sz:%d\n",
3855                             stcb->asoc.out_tsnlog[i].tsn,
3856                             stcb->asoc.out_tsnlog[i].strm,
3857                             stcb->asoc.out_tsnlog[i].seq,
3858                             stcb->asoc.out_tsnlog[i].flgs,
3859                             stcb->asoc.out_tsnlog[i].sz);
3860                 }
3861         }
3862 #endif
3863 }
3864
3865 #endif
3866
3867 void
3868 sctp_abort_an_association(struct sctp_inpcb *inp, struct sctp_tcb *stcb,
3869     int error, struct mbuf *op_err,
3870     int so_locked
3871 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
3872     SCTP_UNUSED
3873 #endif
3874 )
3875 {
3876 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3877         struct socket *so;
3878
3879 #endif
3880
3881 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3882         so = SCTP_INP_SO(inp);
3883 #endif
3884         if (stcb == NULL) {
3885                 /* Got to have a TCB */
3886                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
3887                         if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
3888                                 sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
3889                                     SCTP_CALLED_DIRECTLY_NOCMPSET);
3890                         }
3891                 }
3892                 return;
3893         } else {
3894                 stcb->asoc.state |= SCTP_STATE_WAS_ABORTED;
3895         }
3896         /* notify the ulp */
3897         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) == 0)
3898                 sctp_abort_notification(stcb, error, so_locked);
3899         /* notify the peer */
3900         sctp_send_abort_tcb(stcb, op_err, so_locked);
3901         SCTP_STAT_INCR_COUNTER32(sctps_aborted);
3902         if ((SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_OPEN) ||
3903             (SCTP_GET_STATE(&stcb->asoc) == SCTP_STATE_SHUTDOWN_RECEIVED)) {
3904                 SCTP_STAT_DECR_GAUGE32(sctps_currestab);
3905         }
3906         /* now free the asoc */
3907 #ifdef SCTP_ASOCLOG_OF_TSNS
3908         sctp_print_out_track_log(stcb);
3909 #endif
3910 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3911         if (!so_locked) {
3912                 atomic_add_int(&stcb->asoc.refcnt, 1);
3913                 SCTP_TCB_UNLOCK(stcb);
3914                 SCTP_SOCKET_LOCK(so, 1);
3915                 SCTP_TCB_LOCK(stcb);
3916                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
3917         }
3918 #endif
3919         (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTPUTIL + SCTP_LOC_5);
3920 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
3921         if (!so_locked) {
3922                 SCTP_SOCKET_UNLOCK(so, 1);
3923         }
3924 #endif
3925 }
3926
3927 void
3928 sctp_handle_ootb(struct mbuf *m, int iphlen, int offset, struct sctphdr *sh,
3929     struct sctp_inpcb *inp, struct mbuf *op_err, uint32_t vrf_id, uint16_t port)
3930 {
3931         struct sctp_chunkhdr *ch, chunk_buf;
3932         unsigned int chk_length;
3933         int contains_init_chunk;
3934
3935         SCTP_STAT_INCR_COUNTER32(sctps_outoftheblue);
3936         /* Generate a TO address for future reference */
3937         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)) {
3938                 if (LIST_FIRST(&inp->sctp_asoc_list) == NULL) {
3939                         sctp_inpcb_free(inp, SCTP_FREE_SHOULD_USE_ABORT,
3940                             SCTP_CALLED_DIRECTLY_NOCMPSET);
3941                 }
3942         }
3943         contains_init_chunk = 0;
3944         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
3945             sizeof(*ch), (uint8_t *) & chunk_buf);
3946         while (ch != NULL) {
3947                 chk_length = ntohs(ch->chunk_length);
3948                 if (chk_length < sizeof(*ch)) {
3949                         /* break to abort land */
3950                         break;
3951                 }
3952                 switch (ch->chunk_type) {
3953                 case SCTP_INIT:
3954                         contains_init_chunk = 1;
3955                         break;
3956                 case SCTP_COOKIE_ECHO:
3957                         /* We hit here only if the assoc is being freed */
3958                         return;
3959                 case SCTP_PACKET_DROPPED:
3960                         /* we don't respond to pkt-dropped */
3961                         return;
3962                 case SCTP_ABORT_ASSOCIATION:
3963                         /* we don't respond with an ABORT to an ABORT */
3964                         return;
3965                 case SCTP_SHUTDOWN_COMPLETE:
3966                         /*
3967                          * we ignore it since we are not waiting for it and
3968                          * peer is gone
3969                          */
3970                         return;
3971                 case SCTP_SHUTDOWN_ACK:
3972                         sctp_send_shutdown_complete2(m, sh, vrf_id, port);
3973                         return;
3974                 default:
3975                         break;
3976                 }
3977                 offset += SCTP_SIZE32(chk_length);
3978                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
3979                     sizeof(*ch), (uint8_t *) & chunk_buf);
3980         }
3981         if ((SCTP_BASE_SYSCTL(sctp_blackhole) == 0) ||
3982             ((SCTP_BASE_SYSCTL(sctp_blackhole) == 1) &&
3983             (contains_init_chunk == 0))) {
3984                 sctp_send_abort(m, iphlen, sh, 0, op_err, vrf_id, port);
3985         }
3986 }
3987
3988 /*
3989  * check the inbound datagram to make sure there is not an abort inside it,
3990  * if there is return 1, else return 0.
3991  */
3992 int
3993 sctp_is_there_an_abort_here(struct mbuf *m, int iphlen, uint32_t * vtagfill)
3994 {
3995         struct sctp_chunkhdr *ch;
3996         struct sctp_init_chunk *init_chk, chunk_buf;
3997         int offset;
3998         unsigned int chk_length;
3999
4000         offset = iphlen + sizeof(struct sctphdr);
4001         ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset, sizeof(*ch),
4002             (uint8_t *) & chunk_buf);
4003         while (ch != NULL) {
4004                 chk_length = ntohs(ch->chunk_length);
4005                 if (chk_length < sizeof(*ch)) {
4006                         /* packet is probably corrupt */
4007                         break;
4008                 }
4009                 /* we seem to be ok, is it an abort? */
4010                 if (ch->chunk_type == SCTP_ABORT_ASSOCIATION) {
4011                         /* yep, tell them */
4012                         return (1);
4013                 }
4014                 if (ch->chunk_type == SCTP_INITIATION) {
4015                         /* need to update the Vtag */
4016                         init_chk = (struct sctp_init_chunk *)sctp_m_getptr(m,
4017                             offset, sizeof(*init_chk), (uint8_t *) & chunk_buf);
4018                         if (init_chk != NULL) {
4019                                 *vtagfill = ntohl(init_chk->init.initiate_tag);
4020                         }
4021                 }
4022                 /* Nope, move to the next chunk */
4023                 offset += SCTP_SIZE32(chk_length);
4024                 ch = (struct sctp_chunkhdr *)sctp_m_getptr(m, offset,
4025                     sizeof(*ch), (uint8_t *) & chunk_buf);
4026         }
4027         return (0);
4028 }
4029
4030 /*
4031  * currently (2/02), ifa_addr embeds scope_id's and don't have sin6_scope_id
4032  * set (i.e. it's 0) so, create this function to compare link local scopes
4033  */
4034 #ifdef INET6
4035 uint32_t
4036 sctp_is_same_scope(struct sockaddr_in6 *addr1, struct sockaddr_in6 *addr2)
4037 {
4038         struct sockaddr_in6 a, b;
4039
4040         /* save copies */
4041         a = *addr1;
4042         b = *addr2;
4043
4044         if (a.sin6_scope_id == 0)
4045                 if (sa6_recoverscope(&a)) {
4046                         /* can't get scope, so can't match */
4047                         return (0);
4048                 }
4049         if (b.sin6_scope_id == 0)
4050                 if (sa6_recoverscope(&b)) {
4051                         /* can't get scope, so can't match */
4052                         return (0);
4053                 }
4054         if (a.sin6_scope_id != b.sin6_scope_id)
4055                 return (0);
4056
4057         return (1);
4058 }
4059
4060 /*
4061  * returns a sockaddr_in6 with embedded scope recovered and removed
4062  */
4063 struct sockaddr_in6 *
4064 sctp_recover_scope(struct sockaddr_in6 *addr, struct sockaddr_in6 *store)
4065 {
4066         /* check and strip embedded scope junk */
4067         if (addr->sin6_family == AF_INET6) {
4068                 if (IN6_IS_SCOPE_LINKLOCAL(&addr->sin6_addr)) {
4069                         if (addr->sin6_scope_id == 0) {
4070                                 *store = *addr;
4071                                 if (!sa6_recoverscope(store)) {
4072                                         /* use the recovered scope */
4073                                         addr = store;
4074                                 }
4075                         } else {
4076                                 /* else, return the original "to" addr */
4077                                 in6_clearscope(&addr->sin6_addr);
4078                         }
4079                 }
4080         }
4081         return (addr);
4082 }
4083
4084 #endif
4085
4086 /*
4087  * are the two addresses the same?  currently a "scopeless" check returns: 1
4088  * if same, 0 if not
4089  */
4090 int
4091 sctp_cmpaddr(struct sockaddr *sa1, struct sockaddr *sa2)
4092 {
4093
4094         /* must be valid */
4095         if (sa1 == NULL || sa2 == NULL)
4096                 return (0);
4097
4098         /* must be the same family */
4099         if (sa1->sa_family != sa2->sa_family)
4100                 return (0);
4101
4102         switch (sa1->sa_family) {
4103 #ifdef INET6
4104         case AF_INET6:
4105                 {
4106                         /* IPv6 addresses */
4107                         struct sockaddr_in6 *sin6_1, *sin6_2;
4108
4109                         sin6_1 = (struct sockaddr_in6 *)sa1;
4110                         sin6_2 = (struct sockaddr_in6 *)sa2;
4111                         return (SCTP6_ARE_ADDR_EQUAL(sin6_1,
4112                             sin6_2));
4113                 }
4114 #endif
4115 #ifdef INET
4116         case AF_INET:
4117                 {
4118                         /* IPv4 addresses */
4119                         struct sockaddr_in *sin_1, *sin_2;
4120
4121                         sin_1 = (struct sockaddr_in *)sa1;
4122                         sin_2 = (struct sockaddr_in *)sa2;
4123                         return (sin_1->sin_addr.s_addr == sin_2->sin_addr.s_addr);
4124                 }
4125 #endif
4126         default:
4127                 /* we don't do these... */
4128                 return (0);
4129         }
4130 }
4131
4132 void
4133 sctp_print_address(struct sockaddr *sa)
4134 {
4135 #ifdef INET6
4136         char ip6buf[INET6_ADDRSTRLEN];
4137
4138         ip6buf[0] = 0;
4139 #endif
4140
4141         switch (sa->sa_family) {
4142 #ifdef INET6
4143         case AF_INET6:
4144                 {
4145                         struct sockaddr_in6 *sin6;
4146
4147                         sin6 = (struct sockaddr_in6 *)sa;
4148                         SCTP_PRINTF("IPv6 address: %s:port:%d scope:%u\n",
4149                             ip6_sprintf(ip6buf, &sin6->sin6_addr),
4150                             ntohs(sin6->sin6_port),
4151                             sin6->sin6_scope_id);
4152                         break;
4153                 }
4154 #endif
4155 #ifdef INET
4156         case AF_INET:
4157                 {
4158                         struct sockaddr_in *sin;
4159                         unsigned char *p;
4160
4161                         sin = (struct sockaddr_in *)sa;
4162                         p = (unsigned char *)&sin->sin_addr;
4163                         SCTP_PRINTF("IPv4 address: %u.%u.%u.%u:%d\n",
4164                             p[0], p[1], p[2], p[3], ntohs(sin->sin_port));
4165                         break;
4166                 }
4167 #endif
4168         default:
4169                 SCTP_PRINTF("?\n");
4170                 break;
4171         }
4172 }
4173
4174 void
4175 sctp_print_address_pkt(struct ip *iph, struct sctphdr *sh)
4176 {
4177         switch (iph->ip_v) {
4178 #ifdef INET
4179         case IPVERSION:
4180                 {
4181                         struct sockaddr_in lsa, fsa;
4182
4183                         bzero(&lsa, sizeof(lsa));
4184                         lsa.sin_len = sizeof(lsa);
4185                         lsa.sin_family = AF_INET;
4186                         lsa.sin_addr = iph->ip_src;
4187                         lsa.sin_port = sh->src_port;
4188                         bzero(&fsa, sizeof(fsa));
4189                         fsa.sin_len = sizeof(fsa);
4190                         fsa.sin_family = AF_INET;
4191                         fsa.sin_addr = iph->ip_dst;
4192                         fsa.sin_port = sh->dest_port;
4193                         SCTP_PRINTF("src: ");
4194                         sctp_print_address((struct sockaddr *)&lsa);
4195                         SCTP_PRINTF("dest: ");
4196                         sctp_print_address((struct sockaddr *)&fsa);
4197                         break;
4198                 }
4199 #endif
4200 #ifdef INET6
4201         case IPV6_VERSION >> 4:
4202                 {
4203                         struct ip6_hdr *ip6;
4204                         struct sockaddr_in6 lsa6, fsa6;
4205
4206                         ip6 = (struct ip6_hdr *)iph;
4207                         bzero(&lsa6, sizeof(lsa6));
4208                         lsa6.sin6_len = sizeof(lsa6);
4209                         lsa6.sin6_family = AF_INET6;
4210                         lsa6.sin6_addr = ip6->ip6_src;
4211                         lsa6.sin6_port = sh->src_port;
4212                         bzero(&fsa6, sizeof(fsa6));
4213                         fsa6.sin6_len = sizeof(fsa6);
4214                         fsa6.sin6_family = AF_INET6;
4215                         fsa6.sin6_addr = ip6->ip6_dst;
4216                         fsa6.sin6_port = sh->dest_port;
4217                         SCTP_PRINTF("src: ");
4218                         sctp_print_address((struct sockaddr *)&lsa6);
4219                         SCTP_PRINTF("dest: ");
4220                         sctp_print_address((struct sockaddr *)&fsa6);
4221                         break;
4222                 }
4223 #endif
4224         default:
4225                 /* TSNH */
4226                 break;
4227         }
4228 }
4229
4230 void
4231 sctp_pull_off_control_to_new_inp(struct sctp_inpcb *old_inp,
4232     struct sctp_inpcb *new_inp,
4233     struct sctp_tcb *stcb,
4234     int waitflags)
4235 {
4236         /*
4237          * go through our old INP and pull off any control structures that
4238          * belong to stcb and move then to the new inp.
4239          */
4240         struct socket *old_so, *new_so;
4241         struct sctp_queued_to_read *control, *nctl;
4242         struct sctp_readhead tmp_queue;
4243         struct mbuf *m;
4244         int error = 0;
4245
4246         old_so = old_inp->sctp_socket;
4247         new_so = new_inp->sctp_socket;
4248         TAILQ_INIT(&tmp_queue);
4249         error = sblock(&old_so->so_rcv, waitflags);
4250         if (error) {
4251                 /*
4252                  * Gak, can't get sblock, we have a problem. data will be
4253                  * left stranded.. and we don't dare look at it since the
4254                  * other thread may be reading something. Oh well, its a
4255                  * screwed up app that does a peeloff OR a accept while
4256                  * reading from the main socket... actually its only the
4257                  * peeloff() case, since I think read will fail on a
4258                  * listening socket..
4259                  */
4260                 return;
4261         }
4262         /* lock the socket buffers */
4263         SCTP_INP_READ_LOCK(old_inp);
4264         TAILQ_FOREACH_SAFE(control, &old_inp->read_queue, next, nctl) {
4265                 /* Pull off all for out target stcb */
4266                 if (control->stcb == stcb) {
4267                         /* remove it we want it */
4268                         TAILQ_REMOVE(&old_inp->read_queue, control, next);
4269                         TAILQ_INSERT_TAIL(&tmp_queue, control, next);
4270                         m = control->data;
4271                         while (m) {
4272                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4273                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
4274                                 }
4275                                 sctp_sbfree(control, stcb, &old_so->so_rcv, m);
4276                                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4277                                         sctp_sblog(&old_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4278                                 }
4279                                 m = SCTP_BUF_NEXT(m);
4280                         }
4281                 }
4282         }
4283         SCTP_INP_READ_UNLOCK(old_inp);
4284         /* Remove the sb-lock on the old socket */
4285
4286         sbunlock(&old_so->so_rcv);
4287         /* Now we move them over to the new socket buffer */
4288         SCTP_INP_READ_LOCK(new_inp);
4289         TAILQ_FOREACH_SAFE(control, &tmp_queue, next, nctl) {
4290                 TAILQ_INSERT_TAIL(&new_inp->read_queue, control, next);
4291                 m = control->data;
4292                 while (m) {
4293                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4294                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4295                         }
4296                         sctp_sballoc(stcb, &new_so->so_rcv, m);
4297                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4298                                 sctp_sblog(&new_so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4299                         }
4300                         m = SCTP_BUF_NEXT(m);
4301                 }
4302         }
4303         SCTP_INP_READ_UNLOCK(new_inp);
4304 }
4305
4306 void
4307 sctp_add_to_readq(struct sctp_inpcb *inp,
4308     struct sctp_tcb *stcb,
4309     struct sctp_queued_to_read *control,
4310     struct sockbuf *sb,
4311     int end,
4312     int inp_read_lock_held,
4313     int so_locked
4314 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4315     SCTP_UNUSED
4316 #endif
4317 )
4318 {
4319         /*
4320          * Here we must place the control on the end of the socket read
4321          * queue AND increment sb_cc so that select will work properly on
4322          * read.
4323          */
4324         struct mbuf *m, *prev = NULL;
4325
4326         if (inp == NULL) {
4327                 /* Gak, TSNH!! */
4328 #ifdef INVARIANTS
4329                 panic("Gak, inp NULL on add_to_readq");
4330 #endif
4331                 return;
4332         }
4333         if (inp_read_lock_held == 0)
4334                 SCTP_INP_READ_LOCK(inp);
4335         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ) {
4336                 sctp_free_remote_addr(control->whoFrom);
4337                 if (control->data) {
4338                         sctp_m_freem(control->data);
4339                         control->data = NULL;
4340                 }
4341                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_readq), control);
4342                 if (inp_read_lock_held == 0)
4343                         SCTP_INP_READ_UNLOCK(inp);
4344                 return;
4345         }
4346         if (!(control->spec_flags & M_NOTIFICATION)) {
4347                 atomic_add_int(&inp->total_recvs, 1);
4348                 if (!control->do_not_ref_stcb) {
4349                         atomic_add_int(&stcb->total_recvs, 1);
4350                 }
4351         }
4352         m = control->data;
4353         control->held_length = 0;
4354         control->length = 0;
4355         while (m) {
4356                 if (SCTP_BUF_LEN(m) == 0) {
4357                         /* Skip mbufs with NO length */
4358                         if (prev == NULL) {
4359                                 /* First one */
4360                                 control->data = sctp_m_free(m);
4361                                 m = control->data;
4362                         } else {
4363                                 SCTP_BUF_NEXT(prev) = sctp_m_free(m);
4364                                 m = SCTP_BUF_NEXT(prev);
4365                         }
4366                         if (m == NULL) {
4367                                 control->tail_mbuf = prev;
4368                         }
4369                         continue;
4370                 }
4371                 prev = m;
4372                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4373                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(m));
4374                 }
4375                 sctp_sballoc(stcb, sb, m);
4376                 if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4377                         sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4378                 }
4379                 atomic_add_int(&control->length, SCTP_BUF_LEN(m));
4380                 m = SCTP_BUF_NEXT(m);
4381         }
4382         if (prev != NULL) {
4383                 control->tail_mbuf = prev;
4384         } else {
4385                 /* Everything got collapsed out?? */
4386                 sctp_free_remote_addr(control->whoFrom);
4387                 SCTP_ZONE_FREE(SCTP_BASE_INFO(ipi_zone_readq), control);
4388                 if (inp_read_lock_held == 0)
4389                         SCTP_INP_READ_UNLOCK(inp);
4390                 return;
4391         }
4392         if (end) {
4393                 control->end_added = 1;
4394         }
4395         TAILQ_INSERT_TAIL(&inp->read_queue, control, next);
4396         if (inp_read_lock_held == 0)
4397                 SCTP_INP_READ_UNLOCK(inp);
4398         if (inp && inp->sctp_socket) {
4399                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
4400                         SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket);
4401                 } else {
4402 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4403                         struct socket *so;
4404
4405                         so = SCTP_INP_SO(inp);
4406                         if (!so_locked) {
4407                                 if (stcb) {
4408                                         atomic_add_int(&stcb->asoc.refcnt, 1);
4409                                         SCTP_TCB_UNLOCK(stcb);
4410                                 }
4411                                 SCTP_SOCKET_LOCK(so, 1);
4412                                 if (stcb) {
4413                                         SCTP_TCB_LOCK(stcb);
4414                                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
4415                                 }
4416                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4417                                         SCTP_SOCKET_UNLOCK(so, 1);
4418                                         return;
4419                                 }
4420                         }
4421 #endif
4422                         sctp_sorwakeup(inp, inp->sctp_socket);
4423 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4424                         if (!so_locked) {
4425                                 SCTP_SOCKET_UNLOCK(so, 1);
4426                         }
4427 #endif
4428                 }
4429         }
4430 }
4431
4432
4433 int
4434 sctp_append_to_readq(struct sctp_inpcb *inp,
4435     struct sctp_tcb *stcb,
4436     struct sctp_queued_to_read *control,
4437     struct mbuf *m,
4438     int end,
4439     int ctls_cumack,
4440     struct sockbuf *sb)
4441 {
4442         /*
4443          * A partial delivery API event is underway. OR we are appending on
4444          * the reassembly queue.
4445          *
4446          * If PDAPI this means we need to add m to the end of the data.
4447          * Increase the length in the control AND increment the sb_cc.
4448          * Otherwise sb is NULL and all we need to do is put it at the end
4449          * of the mbuf chain.
4450          */
4451         int len = 0;
4452         struct mbuf *mm, *tail = NULL, *prev = NULL;
4453
4454         if (inp) {
4455                 SCTP_INP_READ_LOCK(inp);
4456         }
4457         if (control == NULL) {
4458 get_out:
4459                 if (inp) {
4460                         SCTP_INP_READ_UNLOCK(inp);
4461                 }
4462                 return (-1);
4463         }
4464         if (inp && (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_CANT_READ)) {
4465                 SCTP_INP_READ_UNLOCK(inp);
4466                 return (0);
4467         }
4468         if (control->end_added) {
4469                 /* huh this one is complete? */
4470                 goto get_out;
4471         }
4472         mm = m;
4473         if (mm == NULL) {
4474                 goto get_out;
4475         }
4476         while (mm) {
4477                 if (SCTP_BUF_LEN(mm) == 0) {
4478                         /* Skip mbufs with NO lenght */
4479                         if (prev == NULL) {
4480                                 /* First one */
4481                                 m = sctp_m_free(mm);
4482                                 mm = m;
4483                         } else {
4484                                 SCTP_BUF_NEXT(prev) = sctp_m_free(mm);
4485                                 mm = SCTP_BUF_NEXT(prev);
4486                         }
4487                         continue;
4488                 }
4489                 prev = mm;
4490                 len += SCTP_BUF_LEN(mm);
4491                 if (sb) {
4492                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4493                                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBALLOC, SCTP_BUF_LEN(mm));
4494                         }
4495                         sctp_sballoc(stcb, sb, mm);
4496                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
4497                                 sctp_sblog(sb, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
4498                         }
4499                 }
4500                 mm = SCTP_BUF_NEXT(mm);
4501         }
4502         if (prev) {
4503                 tail = prev;
4504         } else {
4505                 /* Really there should always be a prev */
4506                 if (m == NULL) {
4507                         /* Huh nothing left? */
4508 #ifdef INVARIANTS
4509                         panic("Nothing left to add?");
4510 #else
4511                         goto get_out;
4512 #endif
4513                 }
4514                 tail = m;
4515         }
4516         if (control->tail_mbuf) {
4517                 /* append */
4518                 SCTP_BUF_NEXT(control->tail_mbuf) = m;
4519                 control->tail_mbuf = tail;
4520         } else {
4521                 /* nothing there */
4522 #ifdef INVARIANTS
4523                 if (control->data != NULL) {
4524                         panic("This should NOT happen");
4525                 }
4526 #endif
4527                 control->data = m;
4528                 control->tail_mbuf = tail;
4529         }
4530         atomic_add_int(&control->length, len);
4531         if (end) {
4532                 /* message is complete */
4533                 if (stcb && (control == stcb->asoc.control_pdapi)) {
4534                         stcb->asoc.control_pdapi = NULL;
4535                 }
4536                 control->held_length = 0;
4537                 control->end_added = 1;
4538         }
4539         if (stcb == NULL) {
4540                 control->do_not_ref_stcb = 1;
4541         }
4542         /*
4543          * When we are appending in partial delivery, the cum-ack is used
4544          * for the actual pd-api highest tsn on this mbuf. The true cum-ack
4545          * is populated in the outbound sinfo structure from the true cumack
4546          * if the association exists...
4547          */
4548         control->sinfo_tsn = control->sinfo_cumtsn = ctls_cumack;
4549         if (inp) {
4550                 SCTP_INP_READ_UNLOCK(inp);
4551         }
4552         if (inp && inp->sctp_socket) {
4553                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_ZERO_COPY_ACTIVE)) {
4554                         SCTP_ZERO_COPY_EVENT(inp, inp->sctp_socket);
4555                 } else {
4556 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4557                         struct socket *so;
4558
4559                         so = SCTP_INP_SO(inp);
4560                         if (stcb) {
4561                                 atomic_add_int(&stcb->asoc.refcnt, 1);
4562                                 SCTP_TCB_UNLOCK(stcb);
4563                         }
4564                         SCTP_SOCKET_LOCK(so, 1);
4565                         if (stcb) {
4566                                 SCTP_TCB_LOCK(stcb);
4567                                 atomic_subtract_int(&stcb->asoc.refcnt, 1);
4568                         }
4569                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
4570                                 SCTP_SOCKET_UNLOCK(so, 1);
4571                                 return (0);
4572                         }
4573 #endif
4574                         sctp_sorwakeup(inp, inp->sctp_socket);
4575 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4576                         SCTP_SOCKET_UNLOCK(so, 1);
4577 #endif
4578                 }
4579         }
4580         return (0);
4581 }
4582
4583
4584
4585 /*************HOLD THIS COMMENT FOR PATCH FILE OF
4586  *************ALTERNATE ROUTING CODE
4587  */
4588
4589 /*************HOLD THIS COMMENT FOR END OF PATCH FILE OF
4590  *************ALTERNATE ROUTING CODE
4591  */
4592
4593 struct mbuf *
4594 sctp_generate_invmanparam(int err)
4595 {
4596         /* Return a MBUF with a invalid mandatory parameter */
4597         struct mbuf *m;
4598
4599         m = sctp_get_mbuf_for_msg(sizeof(struct sctp_paramhdr), 0, M_DONTWAIT, 1, MT_DATA);
4600         if (m) {
4601                 struct sctp_paramhdr *ph;
4602
4603                 SCTP_BUF_LEN(m) = sizeof(struct sctp_paramhdr);
4604                 ph = mtod(m, struct sctp_paramhdr *);
4605                 ph->param_length = htons(sizeof(struct sctp_paramhdr));
4606                 ph->param_type = htons(err);
4607         }
4608         return (m);
4609 }
4610
4611 #ifdef SCTP_MBCNT_LOGGING
4612 void
4613 sctp_free_bufspace(struct sctp_tcb *stcb, struct sctp_association *asoc,
4614     struct sctp_tmit_chunk *tp1, int chk_cnt)
4615 {
4616         if (tp1->data == NULL) {
4617                 return;
4618         }
4619         asoc->chunks_on_out_queue -= chk_cnt;
4620         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBCNT_LOGGING_ENABLE) {
4621                 sctp_log_mbcnt(SCTP_LOG_MBCNT_DECREASE,
4622                     asoc->total_output_queue_size,
4623                     tp1->book_size,
4624                     0,
4625                     tp1->mbcnt);
4626         }
4627         if (asoc->total_output_queue_size >= tp1->book_size) {
4628                 atomic_add_int(&asoc->total_output_queue_size, -tp1->book_size);
4629         } else {
4630                 asoc->total_output_queue_size = 0;
4631         }
4632
4633         if (stcb->sctp_socket && (((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) ||
4634             ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE)))) {
4635                 if (stcb->sctp_socket->so_snd.sb_cc >= tp1->book_size) {
4636                         stcb->sctp_socket->so_snd.sb_cc -= tp1->book_size;
4637                 } else {
4638                         stcb->sctp_socket->so_snd.sb_cc = 0;
4639
4640                 }
4641         }
4642 }
4643
4644 #endif
4645
4646 int
4647 sctp_release_pr_sctp_chunk(struct sctp_tcb *stcb, struct sctp_tmit_chunk *tp1,
4648     int reason, int so_locked
4649 #if !defined(__APPLE__) && !defined(SCTP_SO_LOCK_TESTING)
4650     SCTP_UNUSED
4651 #endif
4652 )
4653 {
4654         struct sctp_stream_out *strq;
4655         struct sctp_tmit_chunk *chk = NULL, *tp2;
4656         struct sctp_stream_queue_pending *sp;
4657         uint16_t stream = 0, seq = 0;
4658         uint8_t foundeom = 0;
4659         int ret_sz = 0;
4660         int notdone;
4661         int do_wakeup_routine = 0;
4662
4663         stream = tp1->rec.data.stream_number;
4664         seq = tp1->rec.data.stream_seq;
4665         do {
4666                 ret_sz += tp1->book_size;
4667                 if (tp1->data != NULL) {
4668                         if (tp1->sent < SCTP_DATAGRAM_RESEND) {
4669                                 sctp_flight_size_decrease(tp1);
4670                                 sctp_total_flight_decrease(stcb, tp1);
4671                         }
4672                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4673                         stcb->asoc.peers_rwnd += tp1->send_size;
4674                         stcb->asoc.peers_rwnd += SCTP_BASE_SYSCTL(sctp_peer_chunk_oh);
4675                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, reason, tp1, so_locked);
4676                         if (tp1->data) {
4677                                 sctp_m_freem(tp1->data);
4678                                 tp1->data = NULL;
4679                         }
4680                         do_wakeup_routine = 1;
4681                         if (PR_SCTP_BUF_ENABLED(tp1->flags)) {
4682                                 stcb->asoc.sent_queue_cnt_removeable--;
4683                         }
4684                 }
4685                 tp1->sent = SCTP_FORWARD_TSN_SKIP;
4686                 if ((tp1->rec.data.rcv_flags & SCTP_DATA_NOT_FRAG) ==
4687                     SCTP_DATA_NOT_FRAG) {
4688                         /* not frag'ed we ae done   */
4689                         notdone = 0;
4690                         foundeom = 1;
4691                 } else if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4692                         /* end of frag, we are done */
4693                         notdone = 0;
4694                         foundeom = 1;
4695                 } else {
4696                         /*
4697                          * Its a begin or middle piece, we must mark all of
4698                          * it
4699                          */
4700                         notdone = 1;
4701                         tp1 = TAILQ_NEXT(tp1, sctp_next);
4702                 }
4703         } while (tp1 && notdone);
4704         if (foundeom == 0) {
4705                 /*
4706                  * The multi-part message was scattered across the send and
4707                  * sent queue.
4708                  */
4709                 TAILQ_FOREACH_SAFE(tp1, &stcb->asoc.send_queue, sctp_next, tp2) {
4710                         if ((tp1->rec.data.stream_number != stream) ||
4711                             (tp1->rec.data.stream_seq != seq)) {
4712                                 break;
4713                         }
4714                         /*
4715                          * save to chk in case we have some on stream out
4716                          * queue. If so and we have an un-transmitted one we
4717                          * don't have to fudge the TSN.
4718                          */
4719                         chk = tp1;
4720                         ret_sz += tp1->book_size;
4721                         sctp_free_bufspace(stcb, &stcb->asoc, tp1, 1);
4722                         sctp_ulp_notify(SCTP_NOTIFY_DG_FAIL, stcb, reason, tp1, so_locked);
4723                         if (tp1->data) {
4724                                 sctp_m_freem(tp1->data);
4725                                 tp1->data = NULL;
4726                         }
4727                         /* No flight involved here book the size to 0 */
4728                         tp1->book_size = 0;
4729                         if (tp1->rec.data.rcv_flags & SCTP_DATA_LAST_FRAG) {
4730                                 foundeom = 1;
4731                         }
4732                         do_wakeup_routine = 1;
4733                         tp1->sent = SCTP_FORWARD_TSN_SKIP;
4734                         TAILQ_REMOVE(&stcb->asoc.send_queue, tp1, sctp_next);
4735                         /*
4736                          * on to the sent queue so we can wait for it to be
4737                          * passed by.
4738                          */
4739                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, tp1,
4740                             sctp_next);
4741                         stcb->asoc.send_queue_cnt--;
4742                         stcb->asoc.sent_queue_cnt++;
4743                 }
4744         }
4745         if (foundeom == 0) {
4746                 /*
4747                  * Still no eom found. That means there is stuff left on the
4748                  * stream out queue.. yuck.
4749                  */
4750                 strq = &stcb->asoc.strmout[stream];
4751                 SCTP_TCB_SEND_LOCK(stcb);
4752                 TAILQ_FOREACH(sp, &strq->outqueue, next) {
4753                         /* FIXME: Shouldn't this be a serial number check? */
4754                         if (sp->strseq > seq) {
4755                                 break;
4756                         }
4757                         /* Check if its our SEQ */
4758                         if (sp->strseq == seq) {
4759                                 sp->discard_rest = 1;
4760                                 /*
4761                                  * We may need to put a chunk on the queue
4762                                  * that holds the TSN that would have been
4763                                  * sent with the LAST bit.
4764                                  */
4765                                 if (chk == NULL) {
4766                                         /* Yep, we have to */
4767                                         sctp_alloc_a_chunk(stcb, chk);
4768                                         if (chk == NULL) {
4769                                                 /*
4770                                                  * we are hosed. All we can
4771                                                  * do is nothing.. which
4772                                                  * will cause an abort if
4773                                                  * the peer is paying
4774                                                  * attention.
4775                                                  */
4776                                                 goto oh_well;
4777                                         }
4778                                         memset(chk, 0, sizeof(*chk));
4779                                         chk->rec.data.rcv_flags = SCTP_DATA_LAST_FRAG;
4780                                         chk->sent = SCTP_FORWARD_TSN_SKIP;
4781                                         chk->asoc = &stcb->asoc;
4782                                         chk->rec.data.stream_seq = sp->strseq;
4783                                         chk->rec.data.stream_number = sp->stream;
4784                                         chk->rec.data.payloadtype = sp->ppid;
4785                                         chk->rec.data.context = sp->context;
4786                                         chk->flags = sp->act_flags;
4787                                         if (sp->net)
4788                                                 chk->whoTo = sp->net;
4789                                         else
4790                                                 chk->whoTo = stcb->asoc.primary_destination;
4791                                         atomic_add_int(&chk->whoTo->ref_count, 1);
4792                                         chk->rec.data.TSN_seq = atomic_fetchadd_int(&stcb->asoc.sending_seq, 1);
4793                                         stcb->asoc.pr_sctp_cnt++;
4794                                         chk->pr_sctp_on = 1;
4795                                         TAILQ_INSERT_TAIL(&stcb->asoc.sent_queue, chk, sctp_next);
4796                                         stcb->asoc.sent_queue_cnt++;
4797                                         stcb->asoc.pr_sctp_cnt++;
4798                                 } else {
4799                                         chk->rec.data.rcv_flags |= SCTP_DATA_LAST_FRAG;
4800                                 }
4801                 oh_well:
4802                                 if (sp->data) {
4803                                         /*
4804                                          * Pull any data to free up the SB
4805                                          * and allow sender to "add more"
4806                                          * whilc we will throw away :-)
4807                                          */
4808                                         sctp_free_spbufspace(stcb, &stcb->asoc,
4809                                             sp);
4810                                         ret_sz += sp->length;
4811                                         do_wakeup_routine = 1;
4812                                         sp->some_taken = 1;
4813                                         sctp_m_freem(sp->data);
4814                                         sp->length = 0;
4815                                         sp->data = NULL;
4816                                         sp->tail_mbuf = NULL;
4817                                 }
4818                                 break;
4819                         }
4820                 }               /* End tailq_foreach */
4821                 SCTP_TCB_SEND_UNLOCK(stcb);
4822         }
4823         if (do_wakeup_routine) {
4824 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4825                 struct socket *so;
4826
4827                 so = SCTP_INP_SO(stcb->sctp_ep);
4828                 if (!so_locked) {
4829                         atomic_add_int(&stcb->asoc.refcnt, 1);
4830                         SCTP_TCB_UNLOCK(stcb);
4831                         SCTP_SOCKET_LOCK(so, 1);
4832                         SCTP_TCB_LOCK(stcb);
4833                         atomic_subtract_int(&stcb->asoc.refcnt, 1);
4834                         if (stcb->asoc.state & SCTP_STATE_CLOSED_SOCKET) {
4835                                 /* assoc was freed while we were unlocked */
4836                                 SCTP_SOCKET_UNLOCK(so, 1);
4837                                 return (ret_sz);
4838                         }
4839                 }
4840 #endif
4841                 sctp_sowwakeup(stcb->sctp_ep, stcb->sctp_socket);
4842 #if defined (__APPLE__) || defined(SCTP_SO_LOCK_TESTING)
4843                 if (!so_locked) {
4844                         SCTP_SOCKET_UNLOCK(so, 1);
4845                 }
4846 #endif
4847         }
4848         return (ret_sz);
4849 }
4850
4851 /*
4852  * checks to see if the given address, sa, is one that is currently known by
4853  * the kernel note: can't distinguish the same address on multiple interfaces
4854  * and doesn't handle multiple addresses with different zone/scope id's note:
4855  * ifa_ifwithaddr() compares the entire sockaddr struct
4856  */
4857 struct sctp_ifa *
4858 sctp_find_ifa_in_ep(struct sctp_inpcb *inp, struct sockaddr *addr,
4859     int holds_lock)
4860 {
4861         struct sctp_laddr *laddr;
4862
4863         if (holds_lock == 0) {
4864                 SCTP_INP_RLOCK(inp);
4865         }
4866         LIST_FOREACH(laddr, &inp->sctp_addr_list, sctp_nxt_addr) {
4867                 if (laddr->ifa == NULL)
4868                         continue;
4869                 if (addr->sa_family != laddr->ifa->address.sa.sa_family)
4870                         continue;
4871 #ifdef INET
4872                 if (addr->sa_family == AF_INET) {
4873                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
4874                             laddr->ifa->address.sin.sin_addr.s_addr) {
4875                                 /* found him. */
4876                                 if (holds_lock == 0) {
4877                                         SCTP_INP_RUNLOCK(inp);
4878                                 }
4879                                 return (laddr->ifa);
4880                                 break;
4881                         }
4882                 }
4883 #endif
4884 #ifdef INET6
4885                 if (addr->sa_family == AF_INET6) {
4886                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
4887                             &laddr->ifa->address.sin6)) {
4888                                 /* found him. */
4889                                 if (holds_lock == 0) {
4890                                         SCTP_INP_RUNLOCK(inp);
4891                                 }
4892                                 return (laddr->ifa);
4893                                 break;
4894                         }
4895                 }
4896 #endif
4897         }
4898         if (holds_lock == 0) {
4899                 SCTP_INP_RUNLOCK(inp);
4900         }
4901         return (NULL);
4902 }
4903
4904 uint32_t
4905 sctp_get_ifa_hash_val(struct sockaddr *addr)
4906 {
4907         switch (addr->sa_family) {
4908 #ifdef INET
4909         case AF_INET:
4910                 {
4911                         struct sockaddr_in *sin;
4912
4913                         sin = (struct sockaddr_in *)addr;
4914                         return (sin->sin_addr.s_addr ^ (sin->sin_addr.s_addr >> 16));
4915                 }
4916 #endif
4917 #ifdef INET6
4918         case INET6:
4919                 {
4920                         struct sockaddr_in6 *sin6;
4921                         uint32_t hash_of_addr;
4922
4923                         sin6 = (struct sockaddr_in6 *)addr;
4924                         hash_of_addr = (sin6->sin6_addr.s6_addr32[0] +
4925                             sin6->sin6_addr.s6_addr32[1] +
4926                             sin6->sin6_addr.s6_addr32[2] +
4927                             sin6->sin6_addr.s6_addr32[3]);
4928                         hash_of_addr = (hash_of_addr ^ (hash_of_addr >> 16));
4929                         return (hash_of_addr);
4930                 }
4931 #endif
4932         default:
4933                 break;
4934         }
4935         return (0);
4936 }
4937
4938 struct sctp_ifa *
4939 sctp_find_ifa_by_addr(struct sockaddr *addr, uint32_t vrf_id, int holds_lock)
4940 {
4941         struct sctp_ifa *sctp_ifap;
4942         struct sctp_vrf *vrf;
4943         struct sctp_ifalist *hash_head;
4944         uint32_t hash_of_addr;
4945
4946         if (holds_lock == 0)
4947                 SCTP_IPI_ADDR_RLOCK();
4948
4949         vrf = sctp_find_vrf(vrf_id);
4950         if (vrf == NULL) {
4951 stage_right:
4952                 if (holds_lock == 0)
4953                         SCTP_IPI_ADDR_RUNLOCK();
4954                 return (NULL);
4955         }
4956         hash_of_addr = sctp_get_ifa_hash_val(addr);
4957
4958         hash_head = &vrf->vrf_addr_hash[(hash_of_addr & vrf->vrf_addr_hashmark)];
4959         if (hash_head == NULL) {
4960                 SCTP_PRINTF("hash_of_addr:%x mask:%x table:%x - ",
4961                     hash_of_addr, (uint32_t) vrf->vrf_addr_hashmark,
4962                     (uint32_t) (hash_of_addr & vrf->vrf_addr_hashmark));
4963                 sctp_print_address(addr);
4964                 SCTP_PRINTF("No such bucket for address\n");
4965                 if (holds_lock == 0)
4966                         SCTP_IPI_ADDR_RUNLOCK();
4967
4968                 return (NULL);
4969         }
4970         LIST_FOREACH(sctp_ifap, hash_head, next_bucket) {
4971                 if (sctp_ifap == NULL) {
4972 #ifdef INVARIANTS
4973                         panic("Huh LIST_FOREACH corrupt");
4974                         goto stage_right;
4975 #else
4976                         SCTP_PRINTF("LIST corrupt of sctp_ifap's?\n");
4977                         goto stage_right;
4978 #endif
4979                 }
4980                 if (addr->sa_family != sctp_ifap->address.sa.sa_family)
4981                         continue;
4982 #ifdef INET
4983                 if (addr->sa_family == AF_INET) {
4984                         if (((struct sockaddr_in *)addr)->sin_addr.s_addr ==
4985                             sctp_ifap->address.sin.sin_addr.s_addr) {
4986                                 /* found him. */
4987                                 if (holds_lock == 0)
4988                                         SCTP_IPI_ADDR_RUNLOCK();
4989                                 return (sctp_ifap);
4990                                 break;
4991                         }
4992                 }
4993 #endif
4994 #ifdef INET6
4995                 if (addr->sa_family == AF_INET6) {
4996                         if (SCTP6_ARE_ADDR_EQUAL((struct sockaddr_in6 *)addr,
4997                             &sctp_ifap->address.sin6)) {
4998                                 /* found him. */
4999                                 if (holds_lock == 0)
5000                                         SCTP_IPI_ADDR_RUNLOCK();
5001                                 return (sctp_ifap);
5002                                 break;
5003                         }
5004                 }
5005 #endif
5006         }
5007         if (holds_lock == 0)
5008                 SCTP_IPI_ADDR_RUNLOCK();
5009         return (NULL);
5010 }
5011
5012 static void
5013 sctp_user_rcvd(struct sctp_tcb *stcb, uint32_t * freed_so_far, int hold_rlock,
5014     uint32_t rwnd_req)
5015 {
5016         /* User pulled some data, do we need a rwnd update? */
5017         int r_unlocked = 0;
5018         uint32_t dif, rwnd;
5019         struct socket *so = NULL;
5020
5021         if (stcb == NULL)
5022                 return;
5023
5024         atomic_add_int(&stcb->asoc.refcnt, 1);
5025
5026         if (stcb->asoc.state & (SCTP_STATE_ABOUT_TO_BE_FREED |
5027             SCTP_STATE_SHUTDOWN_RECEIVED |
5028             SCTP_STATE_SHUTDOWN_ACK_SENT)) {
5029                 /* Pre-check If we are freeing no update */
5030                 goto no_lock;
5031         }
5032         SCTP_INP_INCR_REF(stcb->sctp_ep);
5033         if ((stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5034             (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5035                 goto out;
5036         }
5037         so = stcb->sctp_socket;
5038         if (so == NULL) {
5039                 goto out;
5040         }
5041         atomic_add_int(&stcb->freed_by_sorcv_sincelast, *freed_so_far);
5042         /* Have you have freed enough to look */
5043         *freed_so_far = 0;
5044         /* Yep, its worth a look and the lock overhead */
5045
5046         /* Figure out what the rwnd would be */
5047         rwnd = sctp_calc_rwnd(stcb, &stcb->asoc);
5048         if (rwnd >= stcb->asoc.my_last_reported_rwnd) {
5049                 dif = rwnd - stcb->asoc.my_last_reported_rwnd;
5050         } else {
5051                 dif = 0;
5052         }
5053         if (dif >= rwnd_req) {
5054                 if (hold_rlock) {
5055                         SCTP_INP_READ_UNLOCK(stcb->sctp_ep);
5056                         r_unlocked = 1;
5057                 }
5058                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5059                         /*
5060                          * One last check before we allow the guy possibly
5061                          * to get in. There is a race, where the guy has not
5062                          * reached the gate. In that case
5063                          */
5064                         goto out;
5065                 }
5066                 SCTP_TCB_LOCK(stcb);
5067                 if (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5068                         /* No reports here */
5069                         SCTP_TCB_UNLOCK(stcb);
5070                         goto out;
5071                 }
5072                 SCTP_STAT_INCR(sctps_wu_sacks_sent);
5073                 sctp_send_sack(stcb, SCTP_SO_LOCKED);
5074
5075                 sctp_chunk_output(stcb->sctp_ep, stcb,
5076                     SCTP_OUTPUT_FROM_USR_RCVD, SCTP_SO_LOCKED);
5077                 /* make sure no timer is running */
5078                 sctp_timer_stop(SCTP_TIMER_TYPE_RECV, stcb->sctp_ep, stcb, NULL, SCTP_FROM_SCTPUTIL + SCTP_LOC_6);
5079                 SCTP_TCB_UNLOCK(stcb);
5080         } else {
5081                 /* Update how much we have pending */
5082                 stcb->freed_by_sorcv_sincelast = dif;
5083         }
5084 out:
5085         if (so && r_unlocked && hold_rlock) {
5086                 SCTP_INP_READ_LOCK(stcb->sctp_ep);
5087         }
5088         SCTP_INP_DECR_REF(stcb->sctp_ep);
5089 no_lock:
5090         atomic_add_int(&stcb->asoc.refcnt, -1);
5091         return;
5092 }
5093
5094 int
5095 sctp_sorecvmsg(struct socket *so,
5096     struct uio *uio,
5097     struct mbuf **mp,
5098     struct sockaddr *from,
5099     int fromlen,
5100     int *msg_flags,
5101     struct sctp_sndrcvinfo *sinfo,
5102     int filling_sinfo)
5103 {
5104         /*
5105          * MSG flags we will look at MSG_DONTWAIT - non-blocking IO.
5106          * MSG_PEEK - Look don't touch :-D (only valid with OUT mbuf copy
5107          * mp=NULL thus uio is the copy method to userland) MSG_WAITALL - ??
5108          * On the way out we may send out any combination of:
5109          * MSG_NOTIFICATION MSG_EOR
5110          *
5111          */
5112         struct sctp_inpcb *inp = NULL;
5113         int my_len = 0;
5114         int cp_len = 0, error = 0;
5115         struct sctp_queued_to_read *control = NULL, *ctl = NULL, *nxt = NULL;
5116         struct mbuf *m = NULL;
5117         struct sctp_tcb *stcb = NULL;
5118         int wakeup_read_socket = 0;
5119         int freecnt_applied = 0;
5120         int out_flags = 0, in_flags = 0;
5121         int block_allowed = 1;
5122         uint32_t freed_so_far = 0;
5123         uint32_t copied_so_far = 0;
5124         int in_eeor_mode = 0;
5125         int no_rcv_needed = 0;
5126         uint32_t rwnd_req = 0;
5127         int hold_sblock = 0;
5128         int hold_rlock = 0;
5129         int slen = 0;
5130         uint32_t held_length = 0;
5131         int sockbuf_lock = 0;
5132
5133         if (uio == NULL) {
5134                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5135                 return (EINVAL);
5136         }
5137         if (msg_flags) {
5138                 in_flags = *msg_flags;
5139                 if (in_flags & MSG_PEEK)
5140                         SCTP_STAT_INCR(sctps_read_peeks);
5141         } else {
5142                 in_flags = 0;
5143         }
5144         slen = uio->uio_resid;
5145
5146         /* Pull in and set up our int flags */
5147         if (in_flags & MSG_OOB) {
5148                 /* Out of band's NOT supported */
5149                 return (EOPNOTSUPP);
5150         }
5151         if ((in_flags & MSG_PEEK) && (mp != NULL)) {
5152                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
5153                 return (EINVAL);
5154         }
5155         if ((in_flags & (MSG_DONTWAIT
5156             | MSG_NBIO
5157             )) ||
5158             SCTP_SO_IS_NBIO(so)) {
5159                 block_allowed = 0;
5160         }
5161         /* setup the endpoint */
5162         inp = (struct sctp_inpcb *)so->so_pcb;
5163         if (inp == NULL) {
5164                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EFAULT);
5165                 return (EFAULT);
5166         }
5167         rwnd_req = (SCTP_SB_LIMIT_RCV(so) >> SCTP_RWND_HIWAT_SHIFT);
5168         /* Must be at least a MTU's worth */
5169         if (rwnd_req < SCTP_MIN_RWND)
5170                 rwnd_req = SCTP_MIN_RWND;
5171         in_eeor_mode = sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXPLICIT_EOR);
5172         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5173                 sctp_misc_ints(SCTP_SORECV_ENTER,
5174                     rwnd_req, in_eeor_mode, so->so_rcv.sb_cc, uio->uio_resid);
5175         }
5176         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
5177                 sctp_misc_ints(SCTP_SORECV_ENTERPL,
5178                     rwnd_req, block_allowed, so->so_rcv.sb_cc, uio->uio_resid);
5179         }
5180         error = sblock(&so->so_rcv, (block_allowed ? SBL_WAIT : 0));
5181         sockbuf_lock = 1;
5182         if (error) {
5183                 goto release_unlocked;
5184         }
5185 restart:
5186
5187
5188 restart_nosblocks:
5189         if (hold_sblock == 0) {
5190                 SOCKBUF_LOCK(&so->so_rcv);
5191                 hold_sblock = 1;
5192         }
5193         if ((inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) ||
5194             (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_ALLGONE)) {
5195                 goto out;
5196         }
5197         if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
5198                 if (so->so_error) {
5199                         error = so->so_error;
5200                         if ((in_flags & MSG_PEEK) == 0)
5201                                 so->so_error = 0;
5202                         goto out;
5203                 } else {
5204                         if (so->so_rcv.sb_cc == 0) {
5205                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5206                                 /* indicate EOF */
5207                                 error = 0;
5208                                 goto out;
5209                         }
5210                 }
5211         }
5212         if ((so->so_rcv.sb_cc <= held_length) && block_allowed) {
5213                 /* we need to wait for data */
5214                 if ((so->so_rcv.sb_cc == 0) &&
5215                     ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5216                     (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL))) {
5217                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5218                                 /*
5219                                  * For active open side clear flags for
5220                                  * re-use passive open is blocked by
5221                                  * connect.
5222                                  */
5223                                 if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5224                                         /*
5225                                          * You were aborted, passive side
5226                                          * always hits here
5227                                          */
5228                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5229                                         error = ECONNRESET;
5230                                 }
5231                                 so->so_state &= ~(SS_ISCONNECTING |
5232                                     SS_ISDISCONNECTING |
5233                                     SS_ISCONFIRMING |
5234                                     SS_ISCONNECTED);
5235                                 if (error == 0) {
5236                                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5237                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5238                                                 error = ENOTCONN;
5239                                         }
5240                                 }
5241                                 goto out;
5242                         }
5243                 }
5244                 error = sbwait(&so->so_rcv);
5245                 if (error) {
5246                         goto out;
5247                 }
5248                 held_length = 0;
5249                 goto restart_nosblocks;
5250         } else if (so->so_rcv.sb_cc == 0) {
5251                 if (so->so_error) {
5252                         error = so->so_error;
5253                         if ((in_flags & MSG_PEEK) == 0)
5254                                 so->so_error = 0;
5255                 } else {
5256                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_TCPTYPE) ||
5257                             (inp->sctp_flags & SCTP_PCB_FLAGS_IN_TCPPOOL)) {
5258                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_CONNECTED) == 0) {
5259                                         /*
5260                                          * For active open side clear flags
5261                                          * for re-use passive open is
5262                                          * blocked by connect.
5263                                          */
5264                                         if (inp->sctp_flags & SCTP_PCB_FLAGS_WAS_ABORTED) {
5265                                                 /*
5266                                                  * You were aborted, passive
5267                                                  * side always hits here
5268                                                  */
5269                                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ECONNRESET);
5270                                                 error = ECONNRESET;
5271                                         }
5272                                         so->so_state &= ~(SS_ISCONNECTING |
5273                                             SS_ISDISCONNECTING |
5274                                             SS_ISCONFIRMING |
5275                                             SS_ISCONNECTED);
5276                                         if (error == 0) {
5277                                                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_WAS_CONNECTED) == 0) {
5278                                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOTCONN);
5279                                                         error = ENOTCONN;
5280                                                 }
5281                                         }
5282                                         goto out;
5283                                 }
5284                         }
5285                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EWOULDBLOCK);
5286                         error = EWOULDBLOCK;
5287                 }
5288                 goto out;
5289         }
5290         if (hold_sblock == 1) {
5291                 SOCKBUF_UNLOCK(&so->so_rcv);
5292                 hold_sblock = 0;
5293         }
5294         /* we possibly have data we can read */
5295         /* sa_ignore FREED_MEMORY */
5296         control = TAILQ_FIRST(&inp->read_queue);
5297         if (control == NULL) {
5298                 /*
5299                  * This could be happening since the appender did the
5300                  * increment but as not yet did the tailq insert onto the
5301                  * read_queue
5302                  */
5303                 if (hold_rlock == 0) {
5304                         SCTP_INP_READ_LOCK(inp);
5305                 }
5306                 control = TAILQ_FIRST(&inp->read_queue);
5307                 if ((control == NULL) && (so->so_rcv.sb_cc != 0)) {
5308 #ifdef INVARIANTS
5309                         panic("Huh, its non zero and nothing on control?");
5310 #endif
5311                         so->so_rcv.sb_cc = 0;
5312                 }
5313                 SCTP_INP_READ_UNLOCK(inp);
5314                 hold_rlock = 0;
5315                 goto restart;
5316         }
5317         if ((control->length == 0) &&
5318             (control->do_not_ref_stcb)) {
5319                 /*
5320                  * Clean up code for freeing assoc that left behind a
5321                  * pdapi.. maybe a peer in EEOR that just closed after
5322                  * sending and never indicated a EOR.
5323                  */
5324                 if (hold_rlock == 0) {
5325                         hold_rlock = 1;
5326                         SCTP_INP_READ_LOCK(inp);
5327                 }
5328                 control->held_length = 0;
5329                 if (control->data) {
5330                         /* Hmm there is data here .. fix */
5331                         struct mbuf *m_tmp;
5332                         int cnt = 0;
5333
5334                         m_tmp = control->data;
5335                         while (m_tmp) {
5336                                 cnt += SCTP_BUF_LEN(m_tmp);
5337                                 if (SCTP_BUF_NEXT(m_tmp) == NULL) {
5338                                         control->tail_mbuf = m_tmp;
5339                                         control->end_added = 1;
5340                                 }
5341                                 m_tmp = SCTP_BUF_NEXT(m_tmp);
5342                         }
5343                         control->length = cnt;
5344                 } else {
5345                         /* remove it */
5346                         TAILQ_REMOVE(&inp->read_queue, control, next);
5347                         /* Add back any hiddend data */
5348                         sctp_free_remote_addr(control->whoFrom);
5349                         sctp_free_a_readq(stcb, control);
5350                 }
5351                 if (hold_rlock) {
5352                         hold_rlock = 0;
5353                         SCTP_INP_READ_UNLOCK(inp);
5354                 }
5355                 goto restart;
5356         }
5357         if ((control->length == 0) &&
5358             (control->end_added == 1)) {
5359                 /*
5360                  * Do we also need to check for (control->pdapi_aborted ==
5361                  * 1)?
5362                  */
5363                 if (hold_rlock == 0) {
5364                         hold_rlock = 1;
5365                         SCTP_INP_READ_LOCK(inp);
5366                 }
5367                 TAILQ_REMOVE(&inp->read_queue, control, next);
5368                 if (control->data) {
5369 #ifdef INVARIANTS
5370                         panic("control->data not null but control->length == 0");
5371 #else
5372                         SCTP_PRINTF("Strange, data left in the control buffer. Cleaning up.\n");
5373                         sctp_m_freem(control->data);
5374                         control->data = NULL;
5375 #endif
5376                 }
5377                 if (control->aux_data) {
5378                         sctp_m_free(control->aux_data);
5379                         control->aux_data = NULL;
5380                 }
5381                 sctp_free_remote_addr(control->whoFrom);
5382                 sctp_free_a_readq(stcb, control);
5383                 if (hold_rlock) {
5384                         hold_rlock = 0;
5385                         SCTP_INP_READ_UNLOCK(inp);
5386                 }
5387                 goto restart;
5388         }
5389         if (control->length == 0) {
5390                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE)) &&
5391                     (filling_sinfo)) {
5392                         /* find a more suitable one then this */
5393                         ctl = TAILQ_NEXT(control, next);
5394                         while (ctl) {
5395                                 if ((ctl->stcb != control->stcb) && (ctl->length) &&
5396                                     (ctl->some_taken ||
5397                                     (ctl->spec_flags & M_NOTIFICATION) ||
5398                                     ((ctl->do_not_ref_stcb == 0) &&
5399                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))
5400                                     ) {
5401                                         /*-
5402                                          * If we have a different TCB next, and there is data
5403                                          * present. If we have already taken some (pdapi), OR we can
5404                                          * ref the tcb and no delivery as started on this stream, we
5405                                          * take it. Note we allow a notification on a different
5406                                          * assoc to be delivered..
5407                                          */
5408                                         control = ctl;
5409                                         goto found_one;
5410                                 } else if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_INTERLEAVE_STRMS)) &&
5411                                             (ctl->length) &&
5412                                             ((ctl->some_taken) ||
5413                                             ((ctl->do_not_ref_stcb == 0) &&
5414                                             ((ctl->spec_flags & M_NOTIFICATION) == 0) &&
5415                                     (ctl->stcb->asoc.strmin[ctl->sinfo_stream].delivery_started == 0)))) {
5416                                         /*-
5417                                          * If we have the same tcb, and there is data present, and we
5418                                          * have the strm interleave feature present. Then if we have
5419                                          * taken some (pdapi) or we can refer to tht tcb AND we have
5420                                          * not started a delivery for this stream, we can take it.
5421                                          * Note we do NOT allow a notificaiton on the same assoc to
5422                                          * be delivered.
5423                                          */
5424                                         control = ctl;
5425                                         goto found_one;
5426                                 }
5427                                 ctl = TAILQ_NEXT(ctl, next);
5428                         }
5429                 }
5430                 /*
5431                  * if we reach here, not suitable replacement is available
5432                  * <or> fragment interleave is NOT on. So stuff the sb_cc
5433                  * into the our held count, and its time to sleep again.
5434                  */
5435                 held_length = so->so_rcv.sb_cc;
5436                 control->held_length = so->so_rcv.sb_cc;
5437                 goto restart;
5438         }
5439         /* Clear the held length since there is something to read */
5440         control->held_length = 0;
5441         if (hold_rlock) {
5442                 SCTP_INP_READ_UNLOCK(inp);
5443                 hold_rlock = 0;
5444         }
5445 found_one:
5446         /*
5447          * If we reach here, control has a some data for us to read off.
5448          * Note that stcb COULD be NULL.
5449          */
5450         control->some_taken++;
5451         if (hold_sblock) {
5452                 SOCKBUF_UNLOCK(&so->so_rcv);
5453                 hold_sblock = 0;
5454         }
5455         stcb = control->stcb;
5456         if (stcb) {
5457                 if ((control->do_not_ref_stcb == 0) &&
5458                     (stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED)) {
5459                         if (freecnt_applied == 0)
5460                                 stcb = NULL;
5461                 } else if (control->do_not_ref_stcb == 0) {
5462                         /* you can't free it on me please */
5463                         /*
5464                          * The lock on the socket buffer protects us so the
5465                          * free code will stop. But since we used the
5466                          * socketbuf lock and the sender uses the tcb_lock
5467                          * to increment, we need to use the atomic add to
5468                          * the refcnt
5469                          */
5470                         if (freecnt_applied) {
5471 #ifdef INVARIANTS
5472                                 panic("refcnt already incremented");
5473 #else
5474                                 SCTP_PRINTF("refcnt already incremented?\n");
5475 #endif
5476                         } else {
5477                                 atomic_add_int(&stcb->asoc.refcnt, 1);
5478                                 freecnt_applied = 1;
5479                         }
5480                         /*
5481                          * Setup to remember how much we have not yet told
5482                          * the peer our rwnd has opened up. Note we grab the
5483                          * value from the tcb from last time. Note too that
5484                          * sack sending clears this when a sack is sent,
5485                          * which is fine. Once we hit the rwnd_req, we then
5486                          * will go to the sctp_user_rcvd() that will not
5487                          * lock until it KNOWs it MUST send a WUP-SACK.
5488                          */
5489                         freed_so_far = stcb->freed_by_sorcv_sincelast;
5490                         stcb->freed_by_sorcv_sincelast = 0;
5491                 }
5492         }
5493         if (stcb &&
5494             ((control->spec_flags & M_NOTIFICATION) == 0) &&
5495             control->do_not_ref_stcb == 0) {
5496                 stcb->asoc.strmin[control->sinfo_stream].delivery_started = 1;
5497         }
5498         /* First lets get off the sinfo and sockaddr info */
5499         if ((sinfo) && filling_sinfo) {
5500                 memcpy(sinfo, control, sizeof(struct sctp_nonpad_sndrcvinfo));
5501                 nxt = TAILQ_NEXT(control, next);
5502                 if (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
5503                     sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) {
5504                         struct sctp_extrcvinfo *s_extra;
5505
5506                         s_extra = (struct sctp_extrcvinfo *)sinfo;
5507                         if ((nxt) &&
5508                             (nxt->length)) {
5509                                 s_extra->sreinfo_next_flags = SCTP_NEXT_MSG_AVAIL;
5510                                 if (nxt->sinfo_flags & SCTP_UNORDERED) {
5511                                         s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_IS_UNORDERED;
5512                                 }
5513                                 if (nxt->spec_flags & M_NOTIFICATION) {
5514                                         s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_IS_NOTIFICATION;
5515                                 }
5516                                 s_extra->sreinfo_next_aid = nxt->sinfo_assoc_id;
5517                                 s_extra->sreinfo_next_length = nxt->length;
5518                                 s_extra->sreinfo_next_ppid = nxt->sinfo_ppid;
5519                                 s_extra->sreinfo_next_stream = nxt->sinfo_stream;
5520                                 if (nxt->tail_mbuf != NULL) {
5521                                         if (nxt->end_added) {
5522                                                 s_extra->sreinfo_next_flags |= SCTP_NEXT_MSG_ISCOMPLETE;
5523                                         }
5524                                 }
5525                         } else {
5526                                 /*
5527                                  * we explicitly 0 this, since the memcpy
5528                                  * got some other things beyond the older
5529                                  * sinfo_ that is on the control's structure
5530                                  * :-D
5531                                  */
5532                                 nxt = NULL;
5533                                 s_extra->sreinfo_next_flags = SCTP_NO_NEXT_MSG;
5534                                 s_extra->sreinfo_next_aid = 0;
5535                                 s_extra->sreinfo_next_length = 0;
5536                                 s_extra->sreinfo_next_ppid = 0;
5537                                 s_extra->sreinfo_next_stream = 0;
5538                         }
5539                 }
5540                 /*
5541                  * update off the real current cum-ack, if we have an stcb.
5542                  */
5543                 if ((control->do_not_ref_stcb == 0) && stcb)
5544                         sinfo->sinfo_cumtsn = stcb->asoc.cumulative_tsn;
5545                 /*
5546                  * mask off the high bits, we keep the actual chunk bits in
5547                  * there.
5548                  */
5549                 sinfo->sinfo_flags &= 0x00ff;
5550                 if ((control->sinfo_flags >> 8) & SCTP_DATA_UNORDERED) {
5551                         sinfo->sinfo_flags |= SCTP_UNORDERED;
5552                 }
5553         }
5554 #ifdef SCTP_ASOCLOG_OF_TSNS
5555         {
5556                 int index, newindex;
5557                 struct sctp_pcbtsn_rlog *entry;
5558
5559                 do {
5560                         index = inp->readlog_index;
5561                         newindex = index + 1;
5562                         if (newindex >= SCTP_READ_LOG_SIZE) {
5563                                 newindex = 0;
5564                         }
5565                 } while (atomic_cmpset_int(&inp->readlog_index, index, newindex) == 0);
5566                 entry = &inp->readlog[index];
5567                 entry->vtag = control->sinfo_assoc_id;
5568                 entry->strm = control->sinfo_stream;
5569                 entry->seq = control->sinfo_ssn;
5570                 entry->sz = control->length;
5571                 entry->flgs = control->sinfo_flags;
5572         }
5573 #endif
5574         if (fromlen && from) {
5575                 cp_len = min((size_t)fromlen, (size_t)control->whoFrom->ro._l_addr.sa.sa_len);
5576                 switch (control->whoFrom->ro._l_addr.sa.sa_family) {
5577 #ifdef INET6
5578                 case AF_INET6:
5579                         ((struct sockaddr_in6 *)from)->sin6_port = control->port_from;
5580                         break;
5581 #endif
5582 #ifdef INET
5583                 case AF_INET:
5584                         ((struct sockaddr_in *)from)->sin_port = control->port_from;
5585                         break;
5586 #endif
5587                 default:
5588                         break;
5589                 }
5590                 memcpy(from, &control->whoFrom->ro._l_addr, cp_len);
5591
5592 #if defined(INET) && defined(INET6)
5593                 if ((sctp_is_feature_on(inp, SCTP_PCB_FLAGS_NEEDS_MAPPED_V4)) &&
5594                     (from->sa_family == AF_INET) &&
5595                     ((size_t)fromlen >= sizeof(struct sockaddr_in6))) {
5596                         struct sockaddr_in *sin;
5597                         struct sockaddr_in6 sin6;
5598
5599                         sin = (struct sockaddr_in *)from;
5600                         bzero(&sin6, sizeof(sin6));
5601                         sin6.sin6_family = AF_INET6;
5602                         sin6.sin6_len = sizeof(struct sockaddr_in6);
5603                         sin6.sin6_addr.s6_addr32[2] = htonl(0xffff);
5604                         bcopy(&sin->sin_addr,
5605                             &sin6.sin6_addr.s6_addr32[3],
5606                             sizeof(sin6.sin6_addr.s6_addr32[3]));
5607                         sin6.sin6_port = sin->sin_port;
5608                         memcpy(from, &sin6, sizeof(struct sockaddr_in6));
5609                 }
5610 #endif
5611 #if defined(INET6)
5612                 {
5613                         struct sockaddr_in6 lsa6, *from6;
5614
5615                         from6 = (struct sockaddr_in6 *)from;
5616                         sctp_recover_scope_mac(from6, (&lsa6));
5617                 }
5618 #endif
5619         }
5620         /* now copy out what data we can */
5621         if (mp == NULL) {
5622                 /* copy out each mbuf in the chain up to length */
5623 get_more_data:
5624                 m = control->data;
5625                 while (m) {
5626                         /* Move out all we can */
5627                         cp_len = (int)uio->uio_resid;
5628                         my_len = (int)SCTP_BUF_LEN(m);
5629                         if (cp_len > my_len) {
5630                                 /* not enough in this buf */
5631                                 cp_len = my_len;
5632                         }
5633                         if (hold_rlock) {
5634                                 SCTP_INP_READ_UNLOCK(inp);
5635                                 hold_rlock = 0;
5636                         }
5637                         if (cp_len > 0)
5638                                 error = uiomove(mtod(m, char *), cp_len, uio);
5639                         /* re-read */
5640                         if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE) {
5641                                 goto release;
5642                         }
5643                         if ((control->do_not_ref_stcb == 0) && stcb &&
5644                             stcb->asoc.state & SCTP_STATE_ABOUT_TO_BE_FREED) {
5645                                 no_rcv_needed = 1;
5646                         }
5647                         if (error) {
5648                                 /* error we are out of here */
5649                                 goto release;
5650                         }
5651                         if ((SCTP_BUF_NEXT(m) == NULL) &&
5652                             (cp_len >= SCTP_BUF_LEN(m)) &&
5653                             ((control->end_added == 0) ||
5654                             (control->end_added &&
5655                             (TAILQ_NEXT(control, next) == NULL)))
5656                             ) {
5657                                 SCTP_INP_READ_LOCK(inp);
5658                                 hold_rlock = 1;
5659                         }
5660                         if (cp_len == SCTP_BUF_LEN(m)) {
5661                                 if ((SCTP_BUF_NEXT(m) == NULL) &&
5662                                     (control->end_added)) {
5663                                         out_flags |= MSG_EOR;
5664                                         if ((control->do_not_ref_stcb == 0) &&
5665                                             (control->stcb != NULL) &&
5666                                             ((control->spec_flags & M_NOTIFICATION) == 0))
5667                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5668                                 }
5669                                 if (control->spec_flags & M_NOTIFICATION) {
5670                                         out_flags |= MSG_NOTIFICATION;
5671                                 }
5672                                 /* we ate up the mbuf */
5673                                 if (in_flags & MSG_PEEK) {
5674                                         /* just looking */
5675                                         m = SCTP_BUF_NEXT(m);
5676                                         copied_so_far += cp_len;
5677                                 } else {
5678                                         /* dispose of the mbuf */
5679                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5680                                                 sctp_sblog(&so->so_rcv,
5681                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
5682                                         }
5683                                         sctp_sbfree(control, stcb, &so->so_rcv, m);
5684                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5685                                                 sctp_sblog(&so->so_rcv,
5686                                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5687                                         }
5688                                         copied_so_far += cp_len;
5689                                         freed_so_far += cp_len;
5690                                         freed_so_far += MSIZE;
5691                                         atomic_subtract_int(&control->length, cp_len);
5692                                         control->data = sctp_m_free(m);
5693                                         m = control->data;
5694                                         /*
5695                                          * been through it all, must hold sb
5696                                          * lock ok to null tail
5697                                          */
5698                                         if (control->data == NULL) {
5699 #ifdef INVARIANTS
5700                                                 if ((control->end_added == 0) ||
5701                                                     (TAILQ_NEXT(control, next) == NULL)) {
5702                                                         /*
5703                                                          * If the end is not
5704                                                          * added, OR the
5705                                                          * next is NOT null
5706                                                          * we MUST have the
5707                                                          * lock.
5708                                                          */
5709                                                         if (mtx_owned(&inp->inp_rdata_mtx) == 0) {
5710                                                                 panic("Hmm we don't own the lock?");
5711                                                         }
5712                                                 }
5713 #endif
5714                                                 control->tail_mbuf = NULL;
5715 #ifdef INVARIANTS
5716                                                 if ((control->end_added) && ((out_flags & MSG_EOR) == 0)) {
5717                                                         panic("end_added, nothing left and no MSG_EOR");
5718                                                 }
5719 #endif
5720                                         }
5721                                 }
5722                         } else {
5723                                 /* Do we need to trim the mbuf? */
5724                                 if (control->spec_flags & M_NOTIFICATION) {
5725                                         out_flags |= MSG_NOTIFICATION;
5726                                 }
5727                                 if ((in_flags & MSG_PEEK) == 0) {
5728                                         SCTP_BUF_RESV_UF(m, cp_len);
5729                                         SCTP_BUF_LEN(m) -= cp_len;
5730                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5731                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, cp_len);
5732                                         }
5733                                         atomic_subtract_int(&so->so_rcv.sb_cc, cp_len);
5734                                         if ((control->do_not_ref_stcb == 0) &&
5735                                             stcb) {
5736                                                 atomic_subtract_int(&stcb->asoc.sb_cc, cp_len);
5737                                         }
5738                                         copied_so_far += cp_len;
5739                                         freed_so_far += cp_len;
5740                                         freed_so_far += MSIZE;
5741                                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5742                                                 sctp_sblog(&so->so_rcv, control->do_not_ref_stcb ? NULL : stcb,
5743                                                     SCTP_LOG_SBRESULT, 0);
5744                                         }
5745                                         atomic_subtract_int(&control->length, cp_len);
5746                                 } else {
5747                                         copied_so_far += cp_len;
5748                                 }
5749                         }
5750                         if ((out_flags & MSG_EOR) || (uio->uio_resid == 0)) {
5751                                 break;
5752                         }
5753                         if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5754                             (control->do_not_ref_stcb == 0) &&
5755                             (freed_so_far >= rwnd_req)) {
5756                                 sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5757                         }
5758                 }               /* end while(m) */
5759                 /*
5760                  * At this point we have looked at it all and we either have
5761                  * a MSG_EOR/or read all the user wants... <OR>
5762                  * control->length == 0.
5763                  */
5764                 if ((out_flags & MSG_EOR) && ((in_flags & MSG_PEEK) == 0)) {
5765                         /* we are done with this control */
5766                         if (control->length == 0) {
5767                                 if (control->data) {
5768 #ifdef INVARIANTS
5769                                         panic("control->data not null at read eor?");
5770 #else
5771                                         SCTP_PRINTF("Strange, data left in the control buffer .. invarients would panic?\n");
5772                                         sctp_m_freem(control->data);
5773                                         control->data = NULL;
5774 #endif
5775                                 }
5776                 done_with_control:
5777                                 if (TAILQ_NEXT(control, next) == NULL) {
5778                                         /*
5779                                          * If we don't have a next we need a
5780                                          * lock, if there is a next
5781                                          * interrupt is filling ahead of us
5782                                          * and we don't need a lock to
5783                                          * remove this guy (which is the
5784                                          * head of the queue).
5785                                          */
5786                                         if (hold_rlock == 0) {
5787                                                 SCTP_INP_READ_LOCK(inp);
5788                                                 hold_rlock = 1;
5789                                         }
5790                                 }
5791                                 TAILQ_REMOVE(&inp->read_queue, control, next);
5792                                 /* Add back any hiddend data */
5793                                 if (control->held_length) {
5794                                         held_length = 0;
5795                                         control->held_length = 0;
5796                                         wakeup_read_socket = 1;
5797                                 }
5798                                 if (control->aux_data) {
5799                                         sctp_m_free(control->aux_data);
5800                                         control->aux_data = NULL;
5801                                 }
5802                                 no_rcv_needed = control->do_not_ref_stcb;
5803                                 sctp_free_remote_addr(control->whoFrom);
5804                                 control->data = NULL;
5805                                 sctp_free_a_readq(stcb, control);
5806                                 control = NULL;
5807                                 if ((freed_so_far >= rwnd_req) &&
5808                                     (no_rcv_needed == 0))
5809                                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5810
5811                         } else {
5812                                 /*
5813                                  * The user did not read all of this
5814                                  * message, turn off the returned MSG_EOR
5815                                  * since we are leaving more behind on the
5816                                  * control to read.
5817                                  */
5818 #ifdef INVARIANTS
5819                                 if (control->end_added &&
5820                                     (control->data == NULL) &&
5821                                     (control->tail_mbuf == NULL)) {
5822                                         panic("Gak, control->length is corrupt?");
5823                                 }
5824 #endif
5825                                 no_rcv_needed = control->do_not_ref_stcb;
5826                                 out_flags &= ~MSG_EOR;
5827                         }
5828                 }
5829                 if (out_flags & MSG_EOR) {
5830                         goto release;
5831                 }
5832                 if ((uio->uio_resid == 0) ||
5833                     ((in_eeor_mode) && (copied_so_far >= max(so->so_rcv.sb_lowat, 1)))
5834                     ) {
5835                         goto release;
5836                 }
5837                 /*
5838                  * If I hit here the receiver wants more and this message is
5839                  * NOT done (pd-api). So two questions. Can we block? if not
5840                  * we are done. Did the user NOT set MSG_WAITALL?
5841                  */
5842                 if (block_allowed == 0) {
5843                         goto release;
5844                 }
5845                 /*
5846                  * We need to wait for more data a few things: - We don't
5847                  * sbunlock() so we don't get someone else reading. - We
5848                  * must be sure to account for the case where what is added
5849                  * is NOT to our control when we wakeup.
5850                  */
5851
5852                 /*
5853                  * Do we need to tell the transport a rwnd update might be
5854                  * needed before we go to sleep?
5855                  */
5856                 if (((stcb) && (in_flags & MSG_PEEK) == 0) &&
5857                     ((freed_so_far >= rwnd_req) &&
5858                     (control->do_not_ref_stcb == 0) &&
5859                     (no_rcv_needed == 0))) {
5860                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
5861                 }
5862 wait_some_more:
5863                 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
5864                         goto release;
5865                 }
5866                 if (inp->sctp_flags & SCTP_PCB_FLAGS_SOCKET_GONE)
5867                         goto release;
5868
5869                 if (hold_rlock == 1) {
5870                         SCTP_INP_READ_UNLOCK(inp);
5871                         hold_rlock = 0;
5872                 }
5873                 if (hold_sblock == 0) {
5874                         SOCKBUF_LOCK(&so->so_rcv);
5875                         hold_sblock = 1;
5876                 }
5877                 if ((copied_so_far) && (control->length == 0) &&
5878                     (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_FRAG_INTERLEAVE))) {
5879                         goto release;
5880                 }
5881                 if (so->so_rcv.sb_cc <= control->held_length) {
5882                         error = sbwait(&so->so_rcv);
5883                         if (error) {
5884                                 goto release;
5885                         }
5886                         control->held_length = 0;
5887                 }
5888                 if (hold_sblock) {
5889                         SOCKBUF_UNLOCK(&so->so_rcv);
5890                         hold_sblock = 0;
5891                 }
5892                 if (control->length == 0) {
5893                         /* still nothing here */
5894                         if (control->end_added == 1) {
5895                                 /* he aborted, or is done i.e.did a shutdown */
5896                                 out_flags |= MSG_EOR;
5897                                 if (control->pdapi_aborted) {
5898                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5899                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5900
5901                                         out_flags |= MSG_TRUNC;
5902                                 } else {
5903                                         if ((control->do_not_ref_stcb == 0) && ((control->spec_flags & M_NOTIFICATION) == 0))
5904                                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5905                                 }
5906                                 goto done_with_control;
5907                         }
5908                         if (so->so_rcv.sb_cc > held_length) {
5909                                 control->held_length = so->so_rcv.sb_cc;
5910                                 held_length = 0;
5911                         }
5912                         goto wait_some_more;
5913                 } else if (control->data == NULL) {
5914                         /*
5915                          * we must re-sync since data is probably being
5916                          * added
5917                          */
5918                         SCTP_INP_READ_LOCK(inp);
5919                         if ((control->length > 0) && (control->data == NULL)) {
5920                                 /*
5921                                  * big trouble.. we have the lock and its
5922                                  * corrupt?
5923                                  */
5924 #ifdef INVARIANTS
5925                                 panic("Impossible data==NULL length !=0");
5926 #endif
5927                                 out_flags |= MSG_EOR;
5928                                 out_flags |= MSG_TRUNC;
5929                                 control->length = 0;
5930                                 SCTP_INP_READ_UNLOCK(inp);
5931                                 goto done_with_control;
5932                         }
5933                         SCTP_INP_READ_UNLOCK(inp);
5934                         /* We will fall around to get more data */
5935                 }
5936                 goto get_more_data;
5937         } else {
5938                 /*-
5939                  * Give caller back the mbuf chain,
5940                  * store in uio_resid the length
5941                  */
5942                 wakeup_read_socket = 0;
5943                 if ((control->end_added == 0) ||
5944                     (TAILQ_NEXT(control, next) == NULL)) {
5945                         /* Need to get rlock */
5946                         if (hold_rlock == 0) {
5947                                 SCTP_INP_READ_LOCK(inp);
5948                                 hold_rlock = 1;
5949                         }
5950                 }
5951                 if (control->end_added) {
5952                         out_flags |= MSG_EOR;
5953                         if ((control->do_not_ref_stcb == 0) &&
5954                             (control->stcb != NULL) &&
5955                             ((control->spec_flags & M_NOTIFICATION) == 0))
5956                                 control->stcb->asoc.strmin[control->sinfo_stream].delivery_started = 0;
5957                 }
5958                 if (control->spec_flags & M_NOTIFICATION) {
5959                         out_flags |= MSG_NOTIFICATION;
5960                 }
5961                 uio->uio_resid = control->length;
5962                 *mp = control->data;
5963                 m = control->data;
5964                 while (m) {
5965                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5966                                 sctp_sblog(&so->so_rcv,
5967                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBFREE, SCTP_BUF_LEN(m));
5968                         }
5969                         sctp_sbfree(control, stcb, &so->so_rcv, m);
5970                         freed_so_far += SCTP_BUF_LEN(m);
5971                         freed_so_far += MSIZE;
5972                         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_SB_LOGGING_ENABLE) {
5973                                 sctp_sblog(&so->so_rcv,
5974                                     control->do_not_ref_stcb ? NULL : stcb, SCTP_LOG_SBRESULT, 0);
5975                         }
5976                         m = SCTP_BUF_NEXT(m);
5977                 }
5978                 control->data = control->tail_mbuf = NULL;
5979                 control->length = 0;
5980                 if (out_flags & MSG_EOR) {
5981                         /* Done with this control */
5982                         goto done_with_control;
5983                 }
5984         }
5985 release:
5986         if (hold_rlock == 1) {
5987                 SCTP_INP_READ_UNLOCK(inp);
5988                 hold_rlock = 0;
5989         }
5990         if (hold_sblock == 1) {
5991                 SOCKBUF_UNLOCK(&so->so_rcv);
5992                 hold_sblock = 0;
5993         }
5994         sbunlock(&so->so_rcv);
5995         sockbuf_lock = 0;
5996
5997 release_unlocked:
5998         if (hold_sblock) {
5999                 SOCKBUF_UNLOCK(&so->so_rcv);
6000                 hold_sblock = 0;
6001         }
6002         if ((stcb) && (in_flags & MSG_PEEK) == 0) {
6003                 if ((freed_so_far >= rwnd_req) &&
6004                     (control && (control->do_not_ref_stcb == 0)) &&
6005                     (no_rcv_needed == 0))
6006                         sctp_user_rcvd(stcb, &freed_so_far, hold_rlock, rwnd_req);
6007         }
6008 out:
6009         if (msg_flags) {
6010                 *msg_flags = out_flags;
6011         }
6012         if (((out_flags & MSG_EOR) == 0) &&
6013             ((in_flags & MSG_PEEK) == 0) &&
6014             (sinfo) &&
6015             (sctp_is_feature_on(inp, SCTP_PCB_FLAGS_EXT_RCVINFO) ||
6016             sctp_is_feature_on(inp, SCTP_PCB_FLAGS_RECVNXTINFO))) {
6017                 struct sctp_extrcvinfo *s_extra;
6018
6019                 s_extra = (struct sctp_extrcvinfo *)sinfo;
6020                 s_extra->sreinfo_next_flags = SCTP_NO_NEXT_MSG;
6021         }
6022         if (hold_rlock == 1) {
6023                 SCTP_INP_READ_UNLOCK(inp);
6024         }
6025         if (hold_sblock) {
6026                 SOCKBUF_UNLOCK(&so->so_rcv);
6027         }
6028         if (sockbuf_lock) {
6029                 sbunlock(&so->so_rcv);
6030         }
6031         if (freecnt_applied) {
6032                 /*
6033                  * The lock on the socket buffer protects us so the free
6034                  * code will stop. But since we used the socketbuf lock and
6035                  * the sender uses the tcb_lock to increment, we need to use
6036                  * the atomic add to the refcnt.
6037                  */
6038                 if (stcb == NULL) {
6039 #ifdef INVARIANTS
6040                         panic("stcb for refcnt has gone NULL?");
6041                         goto stage_left;
6042 #else
6043                         goto stage_left;
6044 #endif
6045                 }
6046                 atomic_add_int(&stcb->asoc.refcnt, -1);
6047                 /* Save the value back for next time */
6048                 stcb->freed_by_sorcv_sincelast = freed_so_far;
6049         }
6050         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_RECV_RWND_LOGGING_ENABLE) {
6051                 if (stcb) {
6052                         sctp_misc_ints(SCTP_SORECV_DONE,
6053                             freed_so_far,
6054                             ((uio) ? (slen - uio->uio_resid) : slen),
6055                             stcb->asoc.my_rwnd,
6056                             so->so_rcv.sb_cc);
6057                 } else {
6058                         sctp_misc_ints(SCTP_SORECV_DONE,
6059                             freed_so_far,
6060                             ((uio) ? (slen - uio->uio_resid) : slen),
6061                             0,
6062                             so->so_rcv.sb_cc);
6063                 }
6064         }
6065 stage_left:
6066         if (wakeup_read_socket) {
6067                 sctp_sorwakeup(inp, so);
6068         }
6069         return (error);
6070 }
6071
6072
6073 #ifdef SCTP_MBUF_LOGGING
6074 struct mbuf *
6075 sctp_m_free(struct mbuf *m)
6076 {
6077         if (SCTP_BASE_SYSCTL(sctp_logging_level) & SCTP_MBUF_LOGGING_ENABLE) {
6078                 if (SCTP_BUF_IS_EXTENDED(m)) {
6079                         sctp_log_mb(m, SCTP_MBUF_IFREE);
6080                 }
6081         }
6082         return (m_free(m));
6083 }
6084
6085 void
6086 sctp_m_freem(struct mbuf *mb)
6087 {
6088         while (mb != NULL)
6089                 mb = sctp_m_free(mb);
6090 }
6091
6092 #endif
6093
6094 int
6095 sctp_dynamic_set_primary(struct sockaddr *sa, uint32_t vrf_id)
6096 {
6097         /*
6098          * Given a local address. For all associations that holds the
6099          * address, request a peer-set-primary.
6100          */
6101         struct sctp_ifa *ifa;
6102         struct sctp_laddr *wi;
6103
6104         ifa = sctp_find_ifa_by_addr(sa, vrf_id, 0);
6105         if (ifa == NULL) {
6106                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, EADDRNOTAVAIL);
6107                 return (EADDRNOTAVAIL);
6108         }
6109         /*
6110          * Now that we have the ifa we must awaken the iterator with this
6111          * message.
6112          */
6113         wi = SCTP_ZONE_GET(SCTP_BASE_INFO(ipi_zone_laddr), struct sctp_laddr);
6114         if (wi == NULL) {
6115                 SCTP_LTRACE_ERR_RET(NULL, NULL, NULL, SCTP_FROM_SCTPUTIL, ENOMEM);
6116                 return (ENOMEM);
6117         }
6118         /* Now incr the count and int wi structure */
6119         SCTP_INCR_LADDR_COUNT();
6120         bzero(wi, sizeof(*wi));
6121         (void)SCTP_GETTIME_TIMEVAL(&wi->start_time);
6122         wi->ifa = ifa;
6123         wi->action = SCTP_SET_PRIM_ADDR;
6124         atomic_add_int(&ifa->refcount, 1);
6125
6126         /* Now add it to the work queue */
6127         SCTP_WQ_ADDR_LOCK();
6128         /*
6129          * Should this really be a tailq? As it is we will process the
6130          * newest first :-0
6131          */
6132         LIST_INSERT_HEAD(&SCTP_BASE_INFO(addr_wq), wi, sctp_nxt_addr);
6133         SCTP_WQ_ADDR_UNLOCK();
6134         sctp_timer_start(SCTP_TIMER_TYPE_ADDR_WQ,
6135             (struct sctp_inpcb *)NULL,
6136             (struct sctp_tcb *)NULL,
6137             (struct sctp_nets *)NULL);
6138         return (0);
6139 }
6140
6141
6142 int
6143 sctp_soreceive(struct socket *so,
6144     struct sockaddr **psa,
6145     struct uio *uio,
6146     struct mbuf **mp0,
6147     struct mbuf **controlp,
6148     int *flagsp)
6149 {
6150         int error, fromlen;
6151         uint8_t sockbuf[256];
6152         struct sockaddr *from;
6153         struct sctp_extrcvinfo sinfo;
6154         int filling_sinfo = 1;
6155         struct sctp_inpcb *inp;
6156
6157         inp = (struct sctp_inpcb *)so->so_pcb;
6158         /* pickup the assoc we are reading from */
6159         if (inp == NULL) {
6160                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6161                 return (EINVAL);
6162         }
6163         if ((sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVDATAIOEVNT) &&
6164             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVRCVINFO) &&
6165             sctp_is_feature_off(inp, SCTP_PCB_FLAGS_RECVNXTINFO)) ||
6166             (controlp == NULL)) {
6167                 /* user does not want the sndrcv ctl */
6168                 filling_sinfo = 0;
6169         }
6170         if (psa) {
6171                 from = (struct sockaddr *)sockbuf;
6172                 fromlen = sizeof(sockbuf);
6173                 from->sa_len = 0;
6174         } else {
6175                 from = NULL;
6176                 fromlen = 0;
6177         }
6178
6179         error = sctp_sorecvmsg(so, uio, mp0, from, fromlen, flagsp,
6180             (struct sctp_sndrcvinfo *)&sinfo, filling_sinfo);
6181         if ((controlp) && (filling_sinfo)) {
6182                 /* copy back the sinfo in a CMSG format */
6183                 if (filling_sinfo)
6184                         *controlp = sctp_build_ctl_nchunk(inp,
6185                             (struct sctp_sndrcvinfo *)&sinfo);
6186                 else
6187                         *controlp = NULL;
6188         }
6189         if (psa) {
6190                 /* copy back the address info */
6191                 if (from && from->sa_len) {
6192                         *psa = sodupsockaddr(from, M_NOWAIT);
6193                 } else {
6194                         *psa = NULL;
6195                 }
6196         }
6197         return (error);
6198 }
6199
6200
6201
6202
6203
6204 int
6205 sctp_connectx_helper_add(struct sctp_tcb *stcb, struct sockaddr *addr,
6206     int totaddr, int *error)
6207 {
6208         int added = 0;
6209         int i;
6210         struct sctp_inpcb *inp;
6211         struct sockaddr *sa;
6212         size_t incr = 0;
6213
6214 #ifdef INET
6215         struct sockaddr_in *sin;
6216
6217 #endif
6218 #ifdef INET6
6219         struct sockaddr_in6 *sin6;
6220
6221 #endif
6222
6223         sa = addr;
6224         inp = stcb->sctp_ep;
6225         *error = 0;
6226         for (i = 0; i < totaddr; i++) {
6227                 switch (sa->sa_family) {
6228 #ifdef INET
6229                 case AF_INET:
6230                         incr = sizeof(struct sockaddr_in);
6231                         sin = (struct sockaddr_in *)sa;
6232                         if ((sin->sin_addr.s_addr == INADDR_ANY) ||
6233                             (sin->sin_addr.s_addr == INADDR_BROADCAST) ||
6234                             IN_MULTICAST(ntohl(sin->sin_addr.s_addr))) {
6235                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6236                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_7);
6237                                 *error = EINVAL;
6238                                 goto out_now;
6239                         }
6240                         if (sctp_add_remote_addr(stcb, sa, NULL, SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) {
6241                                 /* assoc gone no un-lock */
6242                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6243                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_7);
6244                                 *error = ENOBUFS;
6245                                 goto out_now;
6246                         }
6247                         added++;
6248                         break;
6249 #endif
6250 #ifdef INET6
6251                 case AF_INET6:
6252                         incr = sizeof(struct sockaddr_in6);
6253                         sin6 = (struct sockaddr_in6 *)sa;
6254                         if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr) ||
6255                             IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
6256                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6257                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_8);
6258                                 *error = EINVAL;
6259                                 goto out_now;
6260                         }
6261                         if (sctp_add_remote_addr(stcb, sa, NULL, SCTP_DONOT_SETSCOPE, SCTP_ADDR_IS_CONFIRMED)) {
6262                                 /* assoc gone no un-lock */
6263                                 SCTP_LTRACE_ERR_RET(NULL, stcb, NULL, SCTP_FROM_SCTPUTIL, ENOBUFS);
6264                                 (void)sctp_free_assoc(inp, stcb, SCTP_NORMAL_PROC, SCTP_FROM_SCTP_USRREQ + SCTP_LOC_8);
6265                                 *error = ENOBUFS;
6266                                 goto out_now;
6267                         }
6268                         added++;
6269                         break;
6270 #endif
6271                 default:
6272                         break;
6273                 }
6274                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6275         }
6276 out_now:
6277         return (added);
6278 }
6279
6280 struct sctp_tcb *
6281 sctp_connectx_helper_find(struct sctp_inpcb *inp, struct sockaddr *addr,
6282     int *totaddr, int *num_v4, int *num_v6, int *error,
6283     int limit, int *bad_addr)
6284 {
6285         struct sockaddr *sa;
6286         struct sctp_tcb *stcb = NULL;
6287         size_t incr, at, i;
6288
6289         at = incr = 0;
6290         sa = addr;
6291
6292         *error = *num_v6 = *num_v4 = 0;
6293         /* account and validate addresses */
6294         for (i = 0; i < (size_t)*totaddr; i++) {
6295                 switch (sa->sa_family) {
6296 #ifdef INET
6297                 case AF_INET:
6298                         (*num_v4) += 1;
6299                         incr = sizeof(struct sockaddr_in);
6300                         if (sa->sa_len != incr) {
6301                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6302                                 *error = EINVAL;
6303                                 *bad_addr = 1;
6304                                 return (NULL);
6305                         }
6306                         break;
6307 #endif
6308 #ifdef INET6
6309                 case AF_INET6:
6310                         {
6311                                 struct sockaddr_in6 *sin6;
6312
6313                                 sin6 = (struct sockaddr_in6 *)sa;
6314                                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6315                                         /* Must be non-mapped for connectx */
6316                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6317                                         *error = EINVAL;
6318                                         *bad_addr = 1;
6319                                         return (NULL);
6320                                 }
6321                                 (*num_v6) += 1;
6322                                 incr = sizeof(struct sockaddr_in6);
6323                                 if (sa->sa_len != incr) {
6324                                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6325                                         *error = EINVAL;
6326                                         *bad_addr = 1;
6327                                         return (NULL);
6328                                 }
6329                                 break;
6330                         }
6331 #endif
6332                 default:
6333                         *totaddr = i;
6334                         /* we are done */
6335                         break;
6336                 }
6337                 if (i == (size_t)*totaddr) {
6338                         break;
6339                 }
6340                 SCTP_INP_INCR_REF(inp);
6341                 stcb = sctp_findassociation_ep_addr(&inp, sa, NULL, NULL, NULL);
6342                 if (stcb != NULL) {
6343                         /* Already have or am bring up an association */
6344                         return (stcb);
6345                 } else {
6346                         SCTP_INP_DECR_REF(inp);
6347                 }
6348                 if ((at + incr) > (size_t)limit) {
6349                         *totaddr = i;
6350                         break;
6351                 }
6352                 sa = (struct sockaddr *)((caddr_t)sa + incr);
6353         }
6354         return ((struct sctp_tcb *)NULL);
6355 }
6356
6357 /*
6358  * sctp_bindx(ADD) for one address.
6359  * assumes all arguments are valid/checked by caller.
6360  */
6361 void
6362 sctp_bindx_add_address(struct socket *so, struct sctp_inpcb *inp,
6363     struct sockaddr *sa, sctp_assoc_t assoc_id,
6364     uint32_t vrf_id, int *error, void *p)
6365 {
6366         struct sockaddr *addr_touse;
6367
6368 #ifdef INET6
6369         struct sockaddr_in sin;
6370
6371 #endif
6372
6373         /* see if we're bound all already! */
6374         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6375                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6376                 *error = EINVAL;
6377                 return;
6378         }
6379         addr_touse = sa;
6380 #ifdef INET6
6381         if (sa->sa_family == AF_INET6) {
6382                 struct sockaddr_in6 *sin6;
6383
6384                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6385                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6386                         *error = EINVAL;
6387                         return;
6388                 }
6389                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6390                         /* can only bind v6 on PF_INET6 sockets */
6391                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6392                         *error = EINVAL;
6393                         return;
6394                 }
6395                 sin6 = (struct sockaddr_in6 *)addr_touse;
6396                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6397                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6398                             SCTP_IPV6_V6ONLY(inp)) {
6399                                 /* can't bind v4-mapped on PF_INET sockets */
6400                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6401                                 *error = EINVAL;
6402                                 return;
6403                         }
6404                         in6_sin6_2_sin(&sin, sin6);
6405                         addr_touse = (struct sockaddr *)&sin;
6406                 }
6407         }
6408 #endif
6409 #ifdef INET
6410         if (sa->sa_family == AF_INET) {
6411                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6412                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6413                         *error = EINVAL;
6414                         return;
6415                 }
6416                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6417                     SCTP_IPV6_V6ONLY(inp)) {
6418                         /* can't bind v4 on PF_INET sockets */
6419                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6420                         *error = EINVAL;
6421                         return;
6422                 }
6423         }
6424 #endif
6425         if (inp->sctp_flags & SCTP_PCB_FLAGS_UNBOUND) {
6426                 if (p == NULL) {
6427                         /* Can't get proc for Net/Open BSD */
6428                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6429                         *error = EINVAL;
6430                         return;
6431                 }
6432                 *error = sctp_inpcb_bind(so, addr_touse, NULL, p);
6433                 return;
6434         }
6435         /*
6436          * No locks required here since bind and mgmt_ep_sa all do their own
6437          * locking. If we do something for the FIX: below we may need to
6438          * lock in that case.
6439          */
6440         if (assoc_id == 0) {
6441                 /* add the address */
6442                 struct sctp_inpcb *lep;
6443                 struct sockaddr_in *lsin = (struct sockaddr_in *)addr_touse;
6444
6445                 /* validate the incoming port */
6446                 if ((lsin->sin_port != 0) &&
6447                     (lsin->sin_port != inp->sctp_lport)) {
6448                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6449                         *error = EINVAL;
6450                         return;
6451                 } else {
6452                         /* user specified 0 port, set it to existing port */
6453                         lsin->sin_port = inp->sctp_lport;
6454                 }
6455
6456                 lep = sctp_pcb_findep(addr_touse, 1, 0, vrf_id);
6457                 if (lep != NULL) {
6458                         /*
6459                          * We must decrement the refcount since we have the
6460                          * ep already and are binding. No remove going on
6461                          * here.
6462                          */
6463                         SCTP_INP_DECR_REF(lep);
6464                 }
6465                 if (lep == inp) {
6466                         /* already bound to it.. ok */
6467                         return;
6468                 } else if (lep == NULL) {
6469                         ((struct sockaddr_in *)addr_touse)->sin_port = 0;
6470                         *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6471                             SCTP_ADD_IP_ADDRESS,
6472                             vrf_id, NULL);
6473                 } else {
6474                         *error = EADDRINUSE;
6475                 }
6476                 if (*error)
6477                         return;
6478         } else {
6479                 /*
6480                  * FIX: decide whether we allow assoc based bindx
6481                  */
6482         }
6483 }
6484
6485 /*
6486  * sctp_bindx(DELETE) for one address.
6487  * assumes all arguments are valid/checked by caller.
6488  */
6489 void
6490 sctp_bindx_delete_address(struct sctp_inpcb *inp,
6491     struct sockaddr *sa, sctp_assoc_t assoc_id,
6492     uint32_t vrf_id, int *error)
6493 {
6494         struct sockaddr *addr_touse;
6495
6496 #ifdef INET6
6497         struct sockaddr_in sin;
6498
6499 #endif
6500
6501         /* see if we're bound all already! */
6502         if (inp->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6503                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6504                 *error = EINVAL;
6505                 return;
6506         }
6507         addr_touse = sa;
6508 #if defined(INET6)
6509         if (sa->sa_family == AF_INET6) {
6510                 struct sockaddr_in6 *sin6;
6511
6512                 if (sa->sa_len != sizeof(struct sockaddr_in6)) {
6513                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6514                         *error = EINVAL;
6515                         return;
6516                 }
6517                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) == 0) {
6518                         /* can only bind v6 on PF_INET6 sockets */
6519                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6520                         *error = EINVAL;
6521                         return;
6522                 }
6523                 sin6 = (struct sockaddr_in6 *)addr_touse;
6524                 if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
6525                         if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6526                             SCTP_IPV6_V6ONLY(inp)) {
6527                                 /* can't bind mapped-v4 on PF_INET sockets */
6528                                 SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6529                                 *error = EINVAL;
6530                                 return;
6531                         }
6532                         in6_sin6_2_sin(&sin, sin6);
6533                         addr_touse = (struct sockaddr *)&sin;
6534                 }
6535         }
6536 #endif
6537 #ifdef INET
6538         if (sa->sa_family == AF_INET) {
6539                 if (sa->sa_len != sizeof(struct sockaddr_in)) {
6540                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6541                         *error = EINVAL;
6542                         return;
6543                 }
6544                 if ((inp->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) &&
6545                     SCTP_IPV6_V6ONLY(inp)) {
6546                         /* can't bind v4 on PF_INET sockets */
6547                         SCTP_LTRACE_ERR_RET(inp, NULL, NULL, SCTP_FROM_SCTPUTIL, EINVAL);
6548                         *error = EINVAL;
6549                         return;
6550                 }
6551         }
6552 #endif
6553         /*
6554          * No lock required mgmt_ep_sa does its own locking. If the FIX:
6555          * below is ever changed we may need to lock before calling
6556          * association level binding.
6557          */
6558         if (assoc_id == 0) {
6559                 /* delete the address */
6560                 *error = sctp_addr_mgmt_ep_sa(inp, addr_touse,
6561                     SCTP_DEL_IP_ADDRESS,
6562                     vrf_id, NULL);
6563         } else {
6564                 /*
6565                  * FIX: decide whether we allow assoc based bindx
6566                  */
6567         }
6568 }
6569
6570 /*
6571  * returns the valid local address count for an assoc, taking into account
6572  * all scoping rules
6573  */
6574 int
6575 sctp_local_addr_count(struct sctp_tcb *stcb)
6576 {
6577         int loopback_scope, ipv4_local_scope, local_scope, site_scope;
6578         int ipv4_addr_legal, ipv6_addr_legal;
6579         struct sctp_vrf *vrf;
6580         struct sctp_ifn *sctp_ifn;
6581         struct sctp_ifa *sctp_ifa;
6582         int count = 0;
6583
6584         /* Turn on all the appropriate scopes */
6585         loopback_scope = stcb->asoc.loopback_scope;
6586         ipv4_local_scope = stcb->asoc.ipv4_local_scope;
6587         local_scope = stcb->asoc.local_scope;
6588         site_scope = stcb->asoc.site_scope;
6589         ipv4_addr_legal = ipv6_addr_legal = 0;
6590         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUND_V6) {
6591                 ipv6_addr_legal = 1;
6592                 if (SCTP_IPV6_V6ONLY(stcb->sctp_ep) == 0) {
6593                         ipv4_addr_legal = 1;
6594                 }
6595         } else {
6596                 ipv4_addr_legal = 1;
6597         }
6598
6599         SCTP_IPI_ADDR_RLOCK();
6600         vrf = sctp_find_vrf(stcb->asoc.vrf_id);
6601         if (vrf == NULL) {
6602                 /* no vrf, no addresses */
6603                 SCTP_IPI_ADDR_RUNLOCK();
6604                 return (0);
6605         }
6606         if (stcb->sctp_ep->sctp_flags & SCTP_PCB_FLAGS_BOUNDALL) {
6607                 /*
6608                  * bound all case: go through all ifns on the vrf
6609                  */
6610                 LIST_FOREACH(sctp_ifn, &vrf->ifnlist, next_ifn) {
6611                         if ((loopback_scope == 0) &&
6612                             SCTP_IFN_IS_IFT_LOOP(sctp_ifn)) {
6613                                 continue;
6614                         }
6615                         LIST_FOREACH(sctp_ifa, &sctp_ifn->ifalist, next_ifa) {
6616                                 if (sctp_is_addr_restricted(stcb, sctp_ifa))
6617                                         continue;
6618                                 switch (sctp_ifa->address.sa.sa_family) {
6619 #ifdef INET
6620                                 case AF_INET:
6621                                         if (ipv4_addr_legal) {
6622                                                 struct sockaddr_in *sin;
6623
6624                                                 sin = (struct sockaddr_in *)&sctp_ifa->address.sa;
6625                                                 if (sin->sin_addr.s_addr == 0) {
6626                                                         /*
6627                                                          * skip unspecified
6628                                                          * addrs
6629                                                          */
6630                                                         continue;
6631                                                 }
6632                                                 if ((ipv4_local_scope == 0) &&
6633                                                     (IN4_ISPRIVATE_ADDRESS(&sin->sin_addr))) {
6634                                                         continue;
6635                                                 }
6636                                                 /* count this one */
6637                                                 count++;
6638                                         } else {
6639                                                 continue;
6640                                         }
6641                                         break;
6642 #endif
6643 #ifdef INET6
6644                                 case AF_INET6:
6645                                         if (ipv6_addr_legal) {
6646                                                 struct sockaddr_in6 *sin6;
6647
6648                                                 sin6 = (struct sockaddr_in6 *)&sctp_ifa->address.sa;
6649                                                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr)) {
6650                                                         continue;
6651                                                 }
6652                                                 if (IN6_IS_ADDR_LINKLOCAL(&sin6->sin6_addr)) {
6653                                                         if (local_scope == 0)
6654                                                                 continue;
6655                                                         if (sin6->sin6_scope_id == 0) {
6656                                                                 if (sa6_recoverscope(sin6) != 0)
6657                                                                         /*
6658                                                                          *
6659                                                                          * bad
6660                                                                          *
6661                                                                          * li
6662                                                                          * nk
6663                                                                          *
6664                                                                          * loc
6665                                                                          * al
6666                                                                          *
6667                                                                          * add
6668                                                                          * re
6669                                                                          * ss
6670                                                                          * */
6671                                                                         continue;
6672                                                         }
6673                                                 }
6674                                                 if ((site_scope == 0) &&
6675                                                     (IN6_IS_ADDR_SITELOCAL(&sin6->sin6_addr))) {
6676                                                         continue;
6677                                                 }
6678                                                 /* count this one */
6679                                                 count++;
6680                                         }
6681                                         break;
6682 #endif
6683                                 default:
6684                                         /* TSNH */
6685                                         break;
6686                                 }
6687                         }
6688                 }
6689         } else {
6690                 /*
6691                  * subset bound case
6692                  */
6693                 struct sctp_laddr *laddr;
6694
6695                 LIST_FOREACH(laddr, &stcb->sctp_ep->sctp_addr_list,
6696                     sctp_nxt_addr) {
6697                         if (sctp_is_addr_restricted(stcb, laddr->ifa)) {
6698                                 continue;
6699                         }
6700                         /* count this one */
6701                         count++;
6702                 }
6703         }
6704         SCTP_IPI_ADDR_RUNLOCK();
6705         return (count);
6706 }
6707
6708 #if defined(SCTP_LOCAL_TRACE_BUF)
6709
6710 void
6711 sctp_log_trace(uint32_t subsys, const char *str SCTP_UNUSED, uint32_t a, uint32_t b, uint32_t c, uint32_t d, uint32_t e, uint32_t f)
6712 {
6713         uint32_t saveindex, newindex;
6714
6715         do {
6716                 saveindex = SCTP_BASE_SYSCTL(sctp_log).index;
6717                 if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6718                         newindex = 1;
6719                 } else {
6720                         newindex = saveindex + 1;
6721                 }
6722         } while (atomic_cmpset_int(&SCTP_BASE_SYSCTL(sctp_log).index, saveindex, newindex) == 0);
6723         if (saveindex >= SCTP_MAX_LOGGING_SIZE) {
6724                 saveindex = 0;
6725         }
6726         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].timestamp = SCTP_GET_CYCLECOUNT;
6727         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].subsys = subsys;
6728         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[0] = a;
6729         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[1] = b;
6730         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[2] = c;
6731         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[3] = d;
6732         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[4] = e;
6733         SCTP_BASE_SYSCTL(sctp_log).entry[saveindex].params[5] = f;
6734 }
6735
6736 #endif
6737 /* XXX: Remove the #ifdef after tunneling over IPv6 works also on FreeBSD. */
6738 #ifdef INET
6739 /* We will need to add support
6740  * to bind the ports and such here
6741  * so we can do UDP tunneling. In
6742  * the mean-time, we return error
6743  */
6744 #include <netinet/udp.h>
6745 #include <netinet/udp_var.h>
6746 #include <sys/proc.h>
6747 #ifdef INET6
6748 #include <netinet6/sctp6_var.h>
6749 #endif
6750
6751 static void
6752 sctp_recv_udp_tunneled_packet(struct mbuf *m, int off, struct inpcb *ignored)
6753 {
6754         struct ip *iph;
6755         struct mbuf *sp, *last;
6756         struct udphdr *uhdr;
6757         uint16_t port = 0;
6758         int header_size = sizeof(struct udphdr) + sizeof(struct sctphdr);
6759
6760         /*
6761          * Split out the mbuf chain. Leave the IP header in m, place the
6762          * rest in the sp.
6763          */
6764         if ((m->m_flags & M_PKTHDR) == 0) {
6765                 /* Can't handle one that is not a pkt hdr */
6766                 goto out;
6767         }
6768         /* pull the src port */
6769         iph = mtod(m, struct ip *);
6770         uhdr = (struct udphdr *)((caddr_t)iph + off);
6771
6772         port = uhdr->uh_sport;
6773         sp = m_split(m, off, M_DONTWAIT);
6774         if (sp == NULL) {
6775                 /* Gak, drop packet, we can't do a split */
6776                 goto out;
6777         }
6778         if (sp->m_pkthdr.len < header_size) {
6779                 /* Gak, packet can't have an SCTP header in it - to small */
6780                 m_freem(sp);
6781                 goto out;
6782         }
6783         /* ok now pull up the UDP header and SCTP header together */
6784         sp = m_pullup(sp, header_size);
6785         if (sp == NULL) {
6786                 /* Gak pullup failed */
6787                 goto out;
6788         }
6789         /* trim out the UDP header */
6790         m_adj(sp, sizeof(struct udphdr));
6791
6792         /* Now reconstruct the mbuf chain */
6793         /* 1) find last one */
6794         last = m;
6795         while (last->m_next != NULL) {
6796                 last = last->m_next;
6797         }
6798         last->m_next = sp;
6799         m->m_pkthdr.len += sp->m_pkthdr.len;
6800         last = m;
6801         while (last != NULL) {
6802                 last = last->m_next;
6803         }
6804         /* Now its ready for sctp_input or sctp6_input */
6805         iph = mtod(m, struct ip *);
6806         switch (iph->ip_v) {
6807 #ifdef INET
6808         case IPVERSION:
6809                 {
6810                         uint16_t len;
6811
6812                         /* its IPv4 */
6813                         len = SCTP_GET_IPV4_LENGTH(iph);
6814                         len -= sizeof(struct udphdr);
6815                         SCTP_GET_IPV4_LENGTH(iph) = len;
6816                         sctp_input_with_port(m, off, port);
6817                         break;
6818                 }
6819 #endif
6820 #ifdef INET6
6821         case IPV6_VERSION >> 4:
6822                 {
6823                         /* its IPv6 - NOT supported */
6824                         goto out;
6825                         break;
6826
6827                 }
6828 #endif
6829         default:
6830                 {
6831                         m_freem(m);
6832                         break;
6833                 }
6834         }
6835         return;
6836 out:
6837         m_freem(m);
6838 }
6839
6840 void
6841 sctp_over_udp_stop(void)
6842 {
6843         struct socket *sop;
6844
6845         /*
6846          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
6847          * for writting!
6848          */
6849         if (SCTP_BASE_INFO(udp_tun_socket) == NULL) {
6850                 /* Nothing to do */
6851                 return;
6852         }
6853         sop = SCTP_BASE_INFO(udp_tun_socket);
6854         soclose(sop);
6855         SCTP_BASE_INFO(udp_tun_socket) = NULL;
6856 }
6857
6858 int
6859 sctp_over_udp_start(void)
6860 {
6861         uint16_t port;
6862         int ret;
6863         struct sockaddr_in sin;
6864         struct socket *sop = NULL;
6865         struct thread *th;
6866         struct ucred *cred;
6867
6868         /*
6869          * This function assumes sysctl caller holds sctp_sysctl_info_lock()
6870          * for writting!
6871          */
6872         port = SCTP_BASE_SYSCTL(sctp_udp_tunneling_port);
6873         if (port == 0) {
6874                 /* Must have a port set */
6875                 return (EINVAL);
6876         }
6877         if (SCTP_BASE_INFO(udp_tun_socket) != NULL) {
6878                 /* Already running -- must stop first */
6879                 return (EALREADY);
6880         }
6881         th = curthread;
6882         cred = th->td_ucred;
6883         if ((ret = socreate(PF_INET, &sop,
6884             SOCK_DGRAM, IPPROTO_UDP, cred, th))) {
6885                 return (ret);
6886         }
6887         SCTP_BASE_INFO(udp_tun_socket) = sop;
6888         /* call the special UDP hook */
6889         ret = udp_set_kernel_tunneling(sop, sctp_recv_udp_tunneled_packet);
6890         if (ret) {
6891                 goto exit_stage_left;
6892         }
6893         /* Ok we have a socket, bind it to the port */
6894         memset(&sin, 0, sizeof(sin));
6895         sin.sin_len = sizeof(sin);
6896         sin.sin_family = AF_INET;
6897         sin.sin_port = htons(port);
6898         ret = sobind(sop, (struct sockaddr *)&sin, th);
6899         if (ret) {
6900                 /* Close up we cant get the port */
6901 exit_stage_left:
6902                 sctp_over_udp_stop();
6903                 return (ret);
6904         }
6905         /*
6906          * Ok we should now get UDP packets directly to our input routine
6907          * sctp_recv_upd_tunneled_packet().
6908          */
6909         return (0);
6910 }
6911
6912 #endif